TNPI - Simscan

home : internet : mail : toaster : filtering : content filtering : Simscan

Simscan is a fantastic mail scanner. It currently supports blocking messages based on file extensions, virus content (ClamAV), spam score (SpamAssassin), and regular expressions. You can customize these settings for each domain!

It's written in C so it's fast. It also doesn't require a quarantine but can use one. It processes the message in real time and allows you to deny the message during the SMTP conversation. My favorite way to configure it is to deny any messages that are virus laden or have a spam score higher than 20. Everything else passes normally.

Simscan is still immature. There are quite a few issues still being discovered and fixed but it works great and carries much promise. It is my favorite.

per-domain surprise

Simscan has the fantastic ability to set which scanners and attachments can be blocked on a per domain basis. However, this tends to surprise a few folks when they configure ssattach and then simscan lets through an attachment that's listed there. That's because ssattach is ignored when you are using per-domain settings.

How do I configure the regular expressions?

First, make sure simscan was build with regexp support. This is configured with the simscan_regex_scanner option in toaster-watcher.conf. In order to use simscan regular expressions, you must also have per-domain options enabled (the default). If simscan_regex_scanner was not enabled, set it and then rebuild simscan (toaster_setup.pl -s simscan). Then edit /var/qmail/control/simcontrol and add your regular expressions to that file. There is some basic simscan regexp documentation on the qmail wiki. Don't forget to run "qmail cdb" after editing simcontrol.

Where does simscan log to?

Since simscan is inline with qmail-smtpd (activated via the QMAILQUEUE input, it's logging goes to the same place as the rest of your SMTP logs. By default, that is: /var/log/mail/smtp/*. As of version 1.1, it doesn't log very much but that will change soon.

Simscan is reporting the wrong version of SA or ClamAV. Why?

Simscan creates a simversions.cdb file in which is stores the version numbers of your scanners such as SpamAssassin and ClamAV. After upgrading them, you must update the simversions.cdb file. You do this by running "/var/qmail/bin/simscanmk -g". Mail::Toaster 4.07 and higher does this for you when you run "qmail cdb".

Last modified on 5/17/05.