$Id: README.Postfix,v 1.3 2001/11/09 18:57:34 mjt Exp $

For postfix, setting up avcheck is simple.  Postfix has a feature
called content_filter (look to file FILTER_README in Postfix
distribution).  The idea is that every mail that comes into postfix
will be subject to a content filter that runs as a postfix transport.
I.e. instead of delivering mail directly, it delivered to this
transport instead.  Next, if transport checked a mail and it looks ok,
it can reinject mail back into postfix using an injection path that
does not mark mails "to be filtered", or can perform other actions.

In order to use avcheck with postfix, first set up and run antivirus
daemon.  Then, make the following changes in postfix configuration:

in master.cf file, add the following line (comments are as in
master.cf):

# =======================================================================
# service       type private unpriv chroot wakeup  maxproc command + args
#                    (yes)   (yes)  (yes)  (never) (50)
# =======================================================================
localhost:1025  inet n       -      n      -       - smtpd -o content_filter=

(yes, last character should be an equal sign).
You may copy regular `smtp inet ... smtpd' line and edit it.  Also, you
can add some more -o stuff about smtpd_*_restrictions to stop postfix
from doing some unnecessary checks, e.g.
 -o smtpd_recipient_restrictions=permit_mynetworks,reject

Next, add a transport called avcheck into this same master.cf file
(this is for chrooted AVP example, modify paths and set other options
to reflect actual configurtion):

# ==================================================================
# service  type private unpriv chroot wakeup  maxproc command + args
#               (yes)   (yes)  (yes)  (never) (50)
# ==================================================================
avcheck    unix -       n      n      -       5      pipe
        flags=q user=avclient argv=/var/spool/avp/avcheck
        -d /var/spool/avp/./tst -s AVP:/var/spool/avp/ctl/AvpCtl
	-f ${sender} -S :1025 -- ${recipient}

(last 3 lines should start with leading whitespace: all 4 lines
are one logical line!)
Note -S :1025 option: it tells that "non-filtering" path to inject
mail is to use port 1025 on local host, where non-filtering smtp
daemon listens (set up above).  `flags=q' is needed to properly
quote addresses with spaces and other special characters.

You may also want to add `-t timeout' option here as well (specifies
a timeout in secounds for antivirus operations).  Note that it is
useless to have timeout greater than postfix's command_time_limit (or
avcheck_time_limit if set) parameter (the default is 1000s).  But be
careful with it!

Next, after you changed the `infected' script to suit your needs,
you may add either

  content_filter = avcheck

into main.cf file, to scan *all*, even locally-submitted, mails, or add
  -o content_filter=avcheck
to main smtpd's line in master.cf, to read like

 smtp inet  n - n - - smtpd -o content_filter=avcheck

(in last case, postfix will scan/filter only mails submitted via SMTP
on the usual smtp port).

After all the changes was made, issue

  postfix reload

command, try to send a test message (using an injection path that is
subject to filtering) and watch for logfile.

Note that it is a *very good idea* to test if your avcheck will actually
work: execute it manually before trying to turn content_filter in postfix,
with correct userid, giving it clean message and then infected one.  It
should work before can be used from postfix!

Also, for testing it can be usefult to set

soft_bounce = yes

in main.cf to prevent mail from bouncing in case of error somewhere.
Verify that all works as expected, and then remove this option.
