clamsmtpd(8)

📦
version 1.10.2 · 3 versions
, in ubuntu stonking

💖 clamsmtpd(8) — the SMTP virus-scanning bestie 💖

okay so before we even get into it: this is clamsmtpd, section 8 of the System Manager's Manual, and it's literally the little SMTP server that checks your email for viruses through clamd. she's simple, she's lightweight, and she's about to make your mail queue slay. 🦋

✨ NAME ✨

clamsmtpd — an SMTP server for scanning viruses via clamd

🌸 SYNOPSIS 🌸

clamsmtpd [-d level] [-f configfile] [-p pidfile]
clamsmtpd -v

👑 DESCRIPTION 👑

so basically clamsmtpd is an SMTP filter that lets you check for viruses using the ClamAV anti-virus software. it accepts SMTP connections and then forwards the SMTP commands and responses over to another SMTP server. it's giving middleman, but make it antivirus. 💅

the DATA email body gets intercepted and scanned before it gets forwarded. by default, emails with viruses are just... dropped silently and logged. no extra drama, no additional action taken. periodt.

clamsmtpd is designed to be lightweight and simple rather than have a myriad of options. the options it does have are configured by editing the clamsmtpd.conf(5) file. wanna know where that config file lives by default? go read the clamsmtpd.conf(5) man page, bestie, it's all in there. 📖

✨ OPTIONS ✨

ngl, previous versions had more options. those still work for now, but they have equivalents in clamsmtpd.conf(5) and are not documented here. so here's what we've got:

  • -d — don't detach from the console, and run as a daemon. also, the level argument tells it what level of error messages to display. 0 is the least, 4 is the most. so like, pick your volume. 🔊
  • -f — configfile specifies an alternate location for the clamsmtpd configuration file. check out clamsmtpd.conf(5) for more deets on where the config file lives by default.
  • -p — pidfile specifies a location for a process id file to be written to. this file holds the process id of clamsmtpd and you can use it to stop the daemon. so like, it's the "how do i shut this down" receipt. 🧾
  • -v — prints the clamsmtp version number and exits. short, sweet, iconic.

💜 LOGGING 💜

by default clamsmtpd logs to syslogd under the 'mail' facility. you can also output logs to the console using the -d option, if you want that direct-to-face energy. 😌

🌈 LOOPBACK FEATURE 🌈

sometimes it's genuinely advantageous to consolidate the virus scanning and filtering for several mail servers onto one machine. clamsmtpd allows this by providing a loopback feature — it connects back to the IP that an SMTP connection came in from. it's giving "come back to where you came from, boo". 🫶

to use this feature, specify only a port number (no IP address) for the OutAddress setting in the configuration file. this causes clamsmtpd to pass the email back to said port on the incoming IP address.

make sure the MaxConnections setting is set high enough to handle the mail from all the servers without refusing connections. don't set it too low and then act surprised, bestie. 💀

💅 TRANSPARENT PROXY FEATURE 💅

a transparent proxy is a configuration on a gateway that routes certain types of traffic through a proxy server without any changes on the client computers. clamsmtpd has support for transparent proxying of SMTP traffic by enabling the TransparentProxy setting. this kind of setup usually involves firewall rules that redirect traffic to clamsmtpd, and the setup varies from OS to OS. after being scanned, the SMTP traffic is forwarded to its original destination. no cap.

when doing transparent proxying for outgoing email, it's probably a good idea to turn on bounce notifications using the Action: bounce setting. also note that some features (such as SSL/TLS) will not be available when going through the transparent proxy. sad but true. 😭

make sure that the MaxConnections setting is set high enough for your transparent proxying. because clamsmtpd isn't being used as a filter inside a queue, which usually throttles the amount of email going through, this setting may need to be higher than usual. highkey important. 🔥

🎀 VIRUS ACTIONS 🎀

using the VirusAction option you can run a script or program whenever a virus is found. this may be handy in certain circumstances, but it has several drawbacks. for one, the performance of the virus filtering will take a hit — perhaps DOS'ing your machine under heavy load. secondly, as with running any program, there are security implications to be considered. 😬

please consider the above carefully before implementing a virus action. fr fr, read it twice.

the script is run without its output being logged, or its return value being checked. because of this you should test it thoroughly. make sure it runs without problems under the user that clamsmtpd(8) is being run as.

various environment variables will be present when your script is run. you may need to escape them properly before use in your favorite scripting language. failure to do this could lead to a REMOTE COMPROMISE of your machine. not me being dramatic, that's literally what the page says. 💀

  • CLIENT — the network address of the SMTP client connected.
  • EMAIL — when the Quarantine option is enabled, this specifies the file that the virus was saved to.
  • RECIPIENTS — the email addresses of the email recipients. these are specified one per line, in standard address format.
  • REMOTE — if clamsmtpd is being used to filter email between SMTP servers, then this is the IP address of the original client. for this info to be present: (a) the SMTP client (sending server) must send an XFORWARD command, and (b) the SMTP server (receiving server) must accept that XFORWARD command without error.
  • REMOTE_HELO — if clamsmtpd is being used to filter email between SMTP servers, then this is the HELO/EHLO banner of the original client. for this info to be present: (a) the SMTP client (sending server) must send an XFORWARD command, and (b) the SMTP server (receiving server) must accept that XFORWARD command without error.
  • SENDER — the email address for the sender of the email.
  • SERVER — the network address of the SMTP server we're connected to.
  • TMPDIR — the path to the temp directory in use. this is the same as the TempDirectory option.
  • VIRUS — the name of the virus found. 🦠

🔥 SECURITY 🔥

there's no reason to run this daemon as root. it's meant as a filter and should listen on a high TCP port. it's probably a good idea to run it using the same user as the clamd(8) daemon — that way the temporary files it writes are accessible to clamd(8). teamwork, besties. 🤝

care should be taken with the directory that clamsmtpd writes its temporary files to. in order to be secure, it should not be a world writeable location. specify the directory using the TempDirectory setting. don't skip this one.

when using the VirusAction option, make sure you understand the security issues involved. unescaped environment variables can lead to execution of arbitrary shell commands on your machine. that's the nightmare scenario, babes. 😭

if you're running clamsmtpd on a publicly accessible IP address or without a firewall, please be sure to understand all the possible security issues. this is especially true if the loopback feature is used (see above). 👀

🌟 SEE ALSO 🌟

clamsmtpd.conf(5) clamd(8), clamdscan(1)

🫶 AUTHOR 🫶

Stef Walter <stef@memberwebs.com>

--- 🌈 ---

and that's the whole page, bestie! this was clamsmtp, dated September, 2004, living its best life in clamsmtpd(8) on your system. go scan some email and stay safe out there. 💖✨🎀🦋🌸💅👑

📦 where this page comes from