Mail Filtering Amavis, adding mail domains

[Evert Mouw]

Binary package hint: ubuntu-docs

The current guide at

Ubuntu Documentation > Ubuntu 9.10 > Ubuntu Server Guide > Email Services > Mail Filtering
[ http://doc.ubuntu.com/ubuntu/serverguide/C/mail-filtering.html ]

includes information about configuring Amavisd-new. It says:

" ... Also, if the server receives mail for multiple domains the @local_domains_acl option will need to be customized. Edit the /etc/amavis/conf.d/50-user file ... "

But this is error-prone. When users add new domains to their postfix configuration, they are likely to forget to add those new domains to amavis. And some users have many domains on one server, so this is not exactly an easy job. So why not enable Amavis for all domains? Most users will probably want spam checks on all mail flows anyway. You can do that by setting local_domains_acl = qw(.)

Note that I have marked this as also as a security bug. Users who (understandably) forget to add new domains to the amavis config will create mail domains where recipients will receive mails which are not scanned for spam or viruses.

# to just use ALL domains, use local_domains_acl = qw(.) or maybe local_domains_acl = ('.') ,
# so you do not need to explicitly list all domains
@local_domains_acl = qw(.);

I propose to make this default behavior.

Cheers, Evert

[Jamie Strandboge (jdstrand)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

[Connor Imes (ckimes)]

The Ubuntu Documentation team has moved the serverguide out of the ubuntu-docs source, it is now under the serverguide project. Moving this bug accordingly.