Services

avfilter()

AV filter service. [obsolete]

This service can be used to filter an email through sagator.
Some headers should be added to filtered email.

Usage: avfilter(scanners)

Where: scanners is an array of scanners (see README.scanners for more info)

Example: avfilter(SCANNERS)

You can use this service for example with procmail.
Example .procmailrc:
  # filter through sagator
  :0fw
  |sagator --logfile /var/log/sagator.log
  
  # move identified emails to quarantine
  :0
  * ^X-Sagator-Status: .
  $HOME/mail/quarantine

This service is obsolete since 0.7.0. Please use sgfilterd/sgfilter.

chroot_execvp()

Execute an external command (or start an daemon).

This service can be used to start external daemons used by sagator.

Usage: chroot_execvp('daemon_name',args=[],pid_file='')

Where: daemon_name is a string, which defines command name
       args are strings, which defines command line arguments
       pid_file is an string to filename with PID of started daemon
       pgrp_file is an string to a process group filename

Example: chroot_execvp('/usr/sbin/clamd','-c','/etc/clamav.conf')

New in version 0.7.0.

chroot_execvpe()

Execute an external command (or start an daemon) and update variables.

This service can be used to start external daemons used by sagator.
You also can set environment varibles.

Usage: chroot_execvpe('daemon_name',args=[],env={})

Where: daemon_name is a string, which defines command name
       args are strings, which defines command line arguments
       env is an dictionary of environment variables
       pid_file is an string to filename with PID of started daemon
       pgrp_file is an string to a process group filename

Example: chroot_execvpe('/usr/sbin/clamd',['-c','/etc/clamav.conf'],
                        {'LANG': 'C'})

New in version 0.7.0.

collector()

Statistics collector service.

This service can be used to collect some data for statistics.

Usage: collector(ip_or_hostname,port,statfile='/var/lib/sagator/status')

Where: ip_or_hostname is an string, which defines IP to bind to
       port is an integer, which defines port number to bind to
       status_file is an string, which defines where to store status

Example: collector('0.0.0.0',28)

fusefs()

Fuse filesystem with antivir checking.

This service can be used to check filesystem access for viruses.

Usage: fusefs(SCANNERS, mountpoint, root_path='/')

Where: mountpoint is a string, which defines an directory, where files
         will be accessed.
       root_path is a path, which files will real files.

Example: fusefs(SCANNERS, '/home', '/realhome')

New in version 0.8.0.

http_proxy()

HTTP proxy service (experimental).

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!  WARNING! This service is experimental! Use at your risk!  !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

This service can be used as filtering HTTP proxy.

Usage: http_proxy(scanners, host, port, prefork=2)

Where: scanners is an array of scanners (see README.scanners for more info)
       host is a an ip address to bind
       port is a port to bind
       prefork is a number, which defines preforked process count

Example: http_proxy(SCANNERS, '127.0.0.1', 3128)

Warning! Do not forget to block access to this port for non-local users.

lmtpd()

LMTP daemon service.

This service can be used to start sagator as separate filtering LMTP
daemon. Is is useful for postfix and any other LMTP client, which
can use these filters.
LMTP protocol is useful, if you want to set different filters for
different users.

Usage: lmtpd(scanners, host, port, prefork=2)

Where: scanners is an array of scanners (see README.scanners for more info)
       host is a an ip address to bind
       port is a port to bind
       prefork is a number, which defines preforked process count.
         Set this parameter to actual processor count + 1
         or leave it's default (2).

Example: lmtpd(SCANNERS, '127.0.0.1', 27)

New in version 0.7.0.

milter()

Milter support service.

This service can be used to start sagator as milter filter.

Usage: milter(scanners,name,connection)

Example: milter(SCANNERS,"sagator","inet:3333@127.0.0.1")

For more information about milter's parameters see milter documentation.

You need python's milter module to run this service:
  http://www.bmsi.com/python/milter.html

recipient_policy()

Virtual recipient policy.

This policy check is invoked after an "RCPT TO:" smtp command is received.
You can use an policy scanner combination as scanner. It is useable for
postfix's before-queue policy filter or an policy filter for milter.
This service must be defined before service, which want to use it.

Usage: recipient_policy(scanners,dbc)

Where: scanners is an array of policy scanners
         (see README.scanners for more info)
       dbc is an database connection

Example: recipient_policy(POLICY_SCANNERS, db.sqlite())

New in version 0.8.0.

reporter()

Reporter virtual service.

This service is only a virtual service to configure parameters for
reporter script.

Usage: reporter(...parameters...)

There you can define some parameters:
"begin", "body", "end", "include", "exclude", "include_fx" and "exclude_fx".
First three parameters are email templates. "begin" is report header.
It must contain RFC2822 headers. "body" is message part displayed for each
rejected/dropped message. "end" is report's tailer, added to message
after all "body"s.
With "include" and "exclude" you can define regular expressions, which
are tested for each report recipient. For example you can define your
domain by: "@your-domain.com$". "include_fx" and "exculde_fx" are functions
with similiar functionality.

Example: reporter()

rlimit()

Resource limit virtual service.

This service can be used to set resource limits for sagator.

Usage: rlimit(PARAM1=value1, PARAM2=value1, ...)

Where: PARAM1,... are resource parameter names
       value1,... are resource values

For example you can use there resource parameter names:
  AS for the maximum area (in bytes) of address space which may be
      taken by the process.
  NOFILE for the maximum number of open file descriptors for the
      current process.
  VMEM for the largest area of mapped memory which the process may occupy.
  DATA for the maximum size (in bytes) of the process's heap.
  RSS for the maximum resident set size that should be made available
      to the process.
  STACK for the maximum size (in bytes) of the call stack for the current
      process.
  FSIZE for the maximum size of a file which the process may create.
      This only affects the stack of the main thread in a multi-threaded
      process.
  CPU for the maximum amount of processor time (in seconds) that a process
      can use

Example: rlimit(AS=30000000)

scand()

Scanner daemon with a preload library ability.

This service can be used to scan for viruses with an library, which
can be "preloaded" as LD_PRELOAD library.

Usage: scand(scanner,ld_preload='',
             sock='/tmp/scand.sock',
             pid_file='/var/run/scand.pid',
             as_root=False)

Where: scanner is a scand scanner
       ld_preload is an library name, which can be preloaded with
         LD_PRELOAD parameter. By default by library will be preloaded.
       sock is path to communicate with scanner
       pid_file is a path to store daemon's pid file. This will be loaded
         at exit and this process will be killed.
       as_root is an boolean. Set it to True if you want to run scanners
         in scand as root.

Example: scand(nod2pac(),ld_preload='/usr/lib/libnod32pac.so')
     or: scand(usrquota('mydomain.sk'),as_root=True)

New in version 0.8.0.

sgfilterd()

A service to filter data sent by sgfilter command.

This service can be used to filter an email through sagator.
Some headers should be added to filtered email. A client for this
service is the sgfilter script. See man sgfilter for more information.

Usage: sgfilterd(scanners,host='127.0.0.1',port=27,prefork=2)

Where: scanners is an array of scanners (see README.scanners for more info)
       host is a hostname to bind
       port is a tcp port to bind
       prefork is a number, which defines preforked process count.
         Set this parameter to actual processor count + 1
         or leave it's default (2).

Example: sgfilterd(SCANNERS)

Input protocol description:
  MAIL FROM: sender_email
  RCPT TO: recipient_email
  DATA length
  ...

Where: sender_email is sender's email address
       recipient_email is recipient's email address. You can send more
         RCPT TO: lines.
       length is whole data length in bytes (including control characters,
         as newlines, ...)

Output protocol description:
  XXX L.LL VIRNAME
  ...
  ^D
  
Where: XXX is three digit status, one from these:
           250 - clean
           251 - not clean, but sending forced
           451 - an internal error occured during scanning
           550 - reject
           551 - drop
       L.LL is an floating number of virus/spam level status
       VIRNAME is an short description (like virus name, 'SPAM' string
           or other one line short description
       ... is modified email message (if some scanners are defined
           to modify scanned message)
       ^D is an EOF character, after message the communication is closed

New in version 0.7.0.

smtpd()

SMTP daemon service.

This service can be used to start sagator as separate filtering SMTP
daemon. Is is useful for postfix and any other SMTP daemon, which
can use these filters.

Usage: smtpd(scanners, host, port, prefork=2)

Where: scanners is an array of scanners (see README.scanners for more info)
       host is a an ip address to bind
       port is a port to bind
       prefork is a number, which defines preforked process count.
         Set this parameter to actual processor count + 1
         or leave it's default (2).

Example: smtpd(SCANNERS, '127.0.0.1', 27)

smtpd_policy()

SMTP policy service.

This service can be used as smtpd policy service for postfix.

Usage: smtpd_polixy(scanners, dbc, host, port, prefork=2)

Where: scanners is an array of policy scanners
         (see README.scanners for more info)
       dbc is an database connection
       host is a an ip address to bind
       port is a port to bind
       prefork is a number, which defines preforked process count.
         Set this parameter to actual processor count + 1
         or leave it's default (2).

Example: smtpd_policy(SCANNERS, db.sqlite(), '127.0.0.1', 29)

Postfix configuration example:
  /etc/postfix/main.cf:
    smtpd_recipient_restrictions=
            ...
            check_policy_service inet:127.0.0.1:29
            ...

New in version 0.8.0.

webq_apache()

Virtual service for sagator's quaratine access via HTTP. [obsolete]

This service can be used to access email collected by sagator via
web interface. You need to configure mod_python in apache to run
this service.

Usage: webq_apache(...)

Where: rootdir is a string, which defines where are HTML templates
       scanner is a scanner to use for checking (only one scanner
         can be used here!)
       userconv is an array, which defines regular expression
         and substitution strings. Usernames from login prompt
         are marched against this regular expression and substitued
         by substitution string.
       admin is an array of webqueue admins.
       perms is an array of strings, which defines access permissions
         for subpages.
       db is a database connection. For description see Databases.txt.

Example: see default config file for example

This scanner is obsolete since 0.8.0. There is no replacement now,
please wait for new webq() service in any new versions. This service
has been marked as obsolete because it's installation is too complicated.