On 11/26/2007 10:32 AM, Leon Kolchinsky wrote:
>> Yesterday I ran into a problem that might also
bring other amavis users
>> into trouble:
>>
>> Mailbombs containing special attachments caused
clamav to get into
>> trouble. It became very slow on scanning those
attachments, so amavisd
>> killed it after it reached the timeout. In my case
(pre-queue-setup), it
>> caused the mail to be rejected with a 451 temporary
error. The bad thing
>> is that amavisd didn't remove the temporary
directory ("PRESERVING
>> EVIDENCE ..."), in some cases containing more
than 100 MB of unpacked
>> files.
> You may try this as a cronjob:
>
> * */2 * * * /bin/bash -c "(find /var/spool/amavis
-type d -name 'amavis-*'
> -prune -mmin +120 -exec rm -rf {} ;)"
Yes, of course. In fact I do have similar cron-job (using
tmpwatch).
But
1) disk space might be filled up in much less then two hours
when a real
DOS-attack is launched (yes, I could shorten the interval of
course)
2) I'd prefer to use amavisd's already built-in routines
instead of
doing asynchronous cleanup afterwards.
I believe that assuring proper operation should be a higher
goal than
trying to conserve traces for forensic analysis. (Actually
using a
configurable cleanup-goal, you can have both.)
Cheers,
--leo
--
e-mail ::: Alexander.Bergolth (at) wu-wien.ac.at
fax ::: +43-1-31336-906050
location ::: Computer Center | Vienna University of
Economics | Austria
------------------------------------------------------------
-------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
AMaViS-user mailing list
AMaViS-user lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/
|
