Filtering/storing outgoing mail...

[Nifty Hat Mitch]

On Thu, Sep 02, 2004 at 06:27:49PM +0200, Andrea Giuliano wrote:
....
> I would like to filter, or at least just store, any outgoing mail 
> message, not at a client level, but eventually at a lower level.
> 
> For instance, it would be enough to instruct postfix some way so that it 
> stores outgoing messages permanently somewhere before sendind them. They 
> usually stay for a while in /var/spool/mqueue, but when they are 
> actually send are removed from there.
> 
> I don't want to rely on the client, because I could change it sometime 
> (and I actually did it many times). I rather prefer a "system" solution. 
> Clearly, a per-user solution would be better in order to prevent users 
> to look at each other's mail, just like it happens with 
> /var/spool/mail/<user>.

Is this a single box or is this a network with multiple boxes.

Bottom line, what you are asking is possibly hard if you
cannot force all mail to flow through a central tool.

i.e. if a user can telnet to port 25 (and 465/tcp ) someplace on the
net you cannot begin to impose (with an iron hand) a system solution.
This will require a firewall and mail relay/gateway solution.

Since sendmail can be instructed to use ports other than the standard
ones if there is a 'serious requirement' for this then more
interesting solutions need to be managed.

Many clients are capable of making a direct connection for outgoing
mail and fall back to localhost:25 where you can define your smart
archiving host.  i.e.  The existence of clients that can bypass your
MTA can require you to manage a firewall.

One value in this is that many worms and viruses contain their own
smtp (simple mail transport protocol) engine.  Blocking port 25
connections can keep any infected hosts from being bad actors.

Others have posted solutions with more modest scope.  Start
there.... 

The good news is that postfix has common configuration tools like this
to help: 

   sender_bcc_maps:
      Optional BCC (blind carbon-copy) address lookup tables, indexed
      by sender address. The BCC address (multiple results are not
      supported) is added when mail enters from outside of Postfix.

Note with caution that a BCC failure will bounce back to the sender
so this is not a 'stealth' trick in the presence of an error.


-- 
	T o m  M i t c h e l l 
	Just say no to 74LS73 in 2004