Re: [bitfolk] centralised clamav - a sticking point

Hi, On Sun, Dec 28, 2008 at 04:11:58AM +0000, Andy Smith wrote: Someone asked offlist why I don't use clamav-milter. This is not for me, this is for all customers. Not everyone can or wants to use clamav-milter. For example I have not found a way that Exim can use clamav-milter, so I myself would have to continue running my own clamd. If I've missed something there, please do let me know though.. Someone else suggested I configure the load balancer to make sure sessions from one client always go to the same back end. That is not the problem. The problem is that the back end replies, inside the protocol, to advise of a *new* port that it is listening upon (like FTP). The client then will make a new connection to this port on the load balancer. The port is not open on the load balancer, it is open on the back end. The ClamAV stream protocol does not include the IP address, so the client cannot know to connect to the back end and not the load balancer. Since the ports are in a dynamic range, I cannot make the load balancer balance them either. I would need to statically forward every single port in the ranges from the load balancer to the back ends. FWIW I am using haproxy as the load balancer, but as far as I am aware there is no way to solve this problem in the balancer without a load balancer that is programmable to inspect the TCP conversation, learn for itself what the port is, and set up a dynamic port forward. Something like F5 or ZXTM could do it easily, if anyone wants to spend about £30k on balancing clamav! Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting Encrypted mail welcome - keyid 0x604DE5DB