28 Dec
2008
28 Dec
'08
4:11 a.m.
Hi,
I was hoping to provide a centralised clamav service -- something
that has been repeatedly asked for -- but I've hit a bit of a road
block.
I can't be having clamav on just one host, and most clamav clients
don't support multiple IPs to round robin, so I'd like to load
balance it.
The problem is that clamav appears to expect the clients to send the
file data by a separate TCP stream, the port for which it tells the
client in response to a command the client gives. This is similar
to FTP.
It means I can't see a way to know which ports to open in the
firewall, and worse still, the daemon only responds with a port not
an IP, which is no good in a load balanced scenario since all the
clients are talking to the load balancer.
The only thing I can think of is configuring each clamav box to use
a different port range and mapping all those ports on the load
balancer to the correct boxes. That's really horrible. Anyone got
any better ideas?
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
Encrypted mail welcome - keyid 0x604DE5DB
28 Dec
28 Dec
4:46 p.m.
Hi,
On Sun, Dec 28, 2008 at 04:11:58AM +0000, Andy Smith wrote:
The only thing I can think of is configuring each
clamav box to use
a different port range and mapping all those ports on the load
balancer to the correct boxes. That's really horrible. Anyone got
any better ideas?
Someone asked offlist why I don't use clamav-milter. This is not
for me, this is for all customers. Not everyone can or wants to use
clamav-milter. For example I have not found a way that Exim can use
clamav-milter, so I myself would have to continue running my own
clamd. If I've missed something there, please do let me know
though..
Someone else suggested I configure the load balancer to make sure
sessions from one client always go to the same back end. That is not
the problem.
The problem is that the back end replies, inside the protocol, to
advise of a *new* port that it is listening upon (like FTP). The
client then will make a new connection to this port on the load
balancer. The port is not open on the load balancer, it is open on
the back end. The ClamAV stream protocol does not include the IP
address, so the client cannot know to connect to the back end and
not the load balancer. Since the ports are in a dynamic range, I
cannot make the load balancer balance them either. I would need to
statically forward every single port in the ranges from the load
balancer to the back ends.
FWIW I am using haproxy as the load balancer, but as far as I am
aware there is no way to solve this problem in the balancer without
a load balancer that is programmable to inspect the TCP
conversation, learn for itself what the port is, and set up a
dynamic port forward. Something like F5 or ZXTM could do it easily,
if anyone wants to spend about £30k on balancing clamav!
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
Encrypted mail welcome - keyid 0x604DE5DB
6:35 p.m.
Andy Smith wrote:
The only thing I can think of is configuring each
clamav box to use
a different port range and mapping all those ports on the load
balancer to the correct boxes. That's really horrible. Anyone got
any better ideas?
I might be missing the point here a little bit, but is there any reason
why you're not load-balancing via SMTP? Perhaps I'm assuming that
everyone wanting ClamAV and/or SpamAssassin centrally is only going to
be scanning mail, but it seems to me like either offering an MX solution
or an SMTP server which accepts mail from the BitFolk network and
resends it whence it came post-scan would be easier to setup. This could
still be load-balanced via haproxy, but the internals of scanning then
would be inside boxes.
Otherwise I would think that you're down to writing your own
client/server or something. The limited port thing is relatively ugly,
and I would imagine it would be pretty easy for any given client to DoS
the server simply by not closing down connections properly and running
through the ports.
Cheers,
Alex.
7:28 p.m.
Hi Alex,
On Sun, Dec 28, 2008 at 06:35:33PM +0000, Alex Hudson wrote:
Andy Smith wrote:
Mainly just to allow people the flexibility to integrate spamd (and
it was hoped clamd) how they want.
The only thing I can think of is configuring each
clamav box to use
a different port range and mapping all those ports on the load
balancer to the correct boxes. That's really horrible. Anyone got
any better ideas?
I might be missing the point here a little bit, but is there any reason
why you're not load-balancing via SMTP? Perhaps I'm assuming that everyone wanting ClamAV
and/or
SpamAssassin centrally is only going to be scanning mail, but it
seems to me like either offering an MX solution or an SMTP server
which accepts mail from the BitFolk network and resends it whence
it came post-scan would be easier to setup. This could still be
load-balanced via haproxy, but the internals of scanning then
would be inside boxes.
Hmm, wouldn't it be a lot harder for people to properly reject email
if they had to forward on to another mail server to find out if it
was spam or virus?
I already do MX for a few customers and it's a bit of an annoyance.
When their mail server is broken in some way I start getting double
bounces, I'm sometimes being asked where missing mail got to, people
expect too much for a free service.
To be honest I may bundle it all off to antibodymx.com or something,
this is far too much hassle.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
Encrypted mail welcome - keyid 0x604DE5DB
5597
days inactive
5597
days old
3 comments
2 participants
participants (2)
-
Alex Hudson -
Andy Smith