[GH-ISSUE #265] Per-domain policy support #249

New issue

Closed

opened 2026-02-27 11:10:48 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 11:10:48 +03:00

Owner

Originally created by @tonioo on GitHub (Dec 4, 2013).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/265

Originally assigned to: @tonioo on GitHub.

Originally created by Antoine Nguyen on 2012-06-07T07:25:02Z

The amavis extension should offer a way to edit per-domain policies.

h2. Proposal

Add a new "Content filter" tab into the domain edition form.

This tab will only propose a reduced set of settings:

bypass_virus_checks (yes/no)
bypass_spam_checks (yes/no)
spam_tag2_level (float)
spam_modifies_subj (yes/no)
spam_kill_level (float)
bypass_banned_checks (yes/no)
banned_rulenames (a list of selectable rule names)

The last setting requires more work as it must know which rules are defined into amavis configuration file. I see two solutions to get this information :

Add a new extension setting to let admin copy/paste the names present into the configuration file

Implement a simple tool that will scan the configuration file(s) and look for the '%banned_rules' hash

The first option is simple to implement but it introduces information duplication. It can be difficult to maintain.

The second one is more flexible but may introduce security issues as Modoboa will need a read access to the configuration file (ie. the user that runs Modoboa, www-data?). It can also be a performance killer if the configuration is parsed each time the tab is displayed...

A simple caching mechanism proposal:

Save the filename that contains the hash definition and its last modification time
Each time we need to display the rule names, check if the modification time is different from the last we saw
If different, parse the file.

h2. Who can access this feature

This proposal would work great for super users or resellers because they can access the domain management section. Domain administrators can't but I think it could be useful to let those users control those settings for the domain(s) they manage.

Allowing domain administrators to access this section introduce a big issue : they will also be able to modify domain properties.

What is the best to do ?

Originally created by @tonioo on GitHub (Dec 4, 2013). Original GitHub issue: https://github.com/modoboa/modoboa/issues/265 Originally assigned to: @tonioo on GitHub. **Originally created by Antoine Nguyen on 2012-06-07T07:25:02Z** The amavis extension should offer a way to edit per-domain policies. h2. Proposal Add a new "Content filter" tab into the domain edition form. This tab will only propose a reduced set of settings: - bypass_virus_checks (yes/no) - bypass_spam_checks (yes/no) - spam_tag2_level (float) - spam_modifies_subj (yes/no) - spam_kill_level (float) - bypass_banned_checks (yes/no) - banned_rulenames (a list of selectable rule names) The last setting requires more work as it must know which rules are defined into amavis configuration file. I see two solutions to get this information : # Add a new extension setting to let admin copy/paste the names present into the configuration file # Implement a simple tool that will scan the configuration file(s) and look for the '%banned_rules' hash The first option is simple to implement but it introduces information duplication. It can be difficult to maintain. The second one is more flexible but may introduce security issues as Modoboa will need a read access to the configuration file (ie. the user that runs Modoboa, www-data?). It can also be a performance killer if the configuration is parsed each time the tab is displayed... A simple caching mechanism proposal: - Save the filename that contains the hash definition and its last modification time - Each time we need to display the rule names, check if the modification time is different from the last we saw - If different, parse the file. h2. Who can access this feature This proposal would work great for super users or resellers because they can access the domain management section. Domain administrators can't but I think it could be useful to let those users control those settings for the domain(s) they manage. Allowing domain administrators to access this section introduce a big issue : they will also be able to modify domain properties. What is the best to do ?