MCP bug? Mcp only reading last rule .cf file

Darren Fulton - Concept Technology darren at CONCEPTTECHNOLOGYINC.COM
Tue Dec 30 06:02:25 GMT 2003


Hello,
I think this is a bug and would like input if it can be replicated by
others and suggestions on how I can fix this whether it is a bug or if
I've just screwed something up.  Upgraded to latest revision which
contained some mcp fixes.

Issue: mcp checker uses only the last rule and not the other .cf rules
located in /etc/MailScanner/mcp/
Meaning, it gives MCP scores to messages that apply to the last rule
(alphabetically) in the directory but to the rules above it.

MTA is postfix

Info copied from terminal:

[root at mailgateway mcp]# hostname
mailgateway.healthleaders.com
[root at mailgateway mcp]# uname -a
Linux mailgateway.healthleaders.com 2.4.20-24.9 #1 Mon Dec 1 11:35:51
EST 2003 i686 i686 i386 GNU/Linux
[root at mailgateway mcp]# pwd
/etc/MailScanner/mcp
[root at mailgateway mcp]# ls -la
total 24
drwxr-xr-x    2 root     root         4096 Dec 29 23:24 .
drwxr-xr-x    6 root     root         4096 Dec 29 22:58 ..
-rw-r--r--    1 root     root          598 Dec 29 23:02 10_example.cf
-rw-r--r--    1 root     root          111 Dec 29 23:31 11_penis_banned.cf
-rw-r--r--    1 root     root          112 Dec 29 23:31 12_valium_banned.cf
-rw-r--r--    1 root     root         1256 Dec 29 10:25
mcp.spam.assassin.prefs.conf

[root at mailgateway mcp]# cat *.cf

header   BANNED         Subject =~ /banned/i
describe BANNED         Banned Subject
score    BANNED         22

body     BANNED_BODY    /this text is banned/i
describe BANNED_BODY    Banned body text
score    BANNED_BODY    5

header   BANNED         Subject =~ /penis/i
describe BANNED         Banned Subject
score    BANNED         10

header   BANNED         Subject =~ /valium/i
describe BANNED         Banned Subject
score    BANNED         10

Some examples from the /var/log/maillog:

Here is the valium one that worked:
Dec 29 23:54:48 mailgateway postfix/cleanup[8909]: CD7073FEE:
message-id=<20031230055417.CD7073FEE at mailgateway.healthleaders.com>
Dec 29 23:54:48 mailgateway postfix/nqmgr[8768]: CD7073FEE:
from=<darren at internav.dyndns.org>, size=440, nrcpt=1 (queue active)
Dec 29 23:54:48 mailgateway postfix/nqmgr[8768]: CD7073FEE:
to=<darren at concepttechnologyinc.com>, relay=none, delay=31,
status=deferred (deferred transport)
Dec 29 23:54:51 mailgateway MailScanner[8853]: New Batch: Scanning 1
messages, 613 bytes
Dec 29 23:54:51 mailgateway MailScanner[8853]: MCP Checks: Starting
Dec 29 23:54:51 mailgateway MailScanner[8853]: Message CD7073FEE from
127.0.0.1 (darren at internav.dyndns.org) to concepttechnologyinc.com is
MCP, MCP-Checker (score=10, required 1, BANNED 10.00)
Dec 29 23:54:51 mailgateway MailScanner[8853]: MCP Actions: message
CD7073FEE actions are delete

Here is the penis one that didn't work:
Dec 29 23:36:27 mailgateway postfix/nqmgr[8768]: 3E71F3FEE:
to=<darren at concepttechnologyinc.com>, relay=none, delay=44,
status=deferred (deferred transport)
Dec 29 23:36:27 mailgateway MailScanner[8859]: New Batch: Scanning 1
messages, 632 bytes
Dec 29 23:36:27 mailgateway MailScanner[8859]: MCP Checks: Starting
Dec 29 23:36:27 mailgateway MailScanner[8859]: Spam Checks: Starting
Dec 29 23:36:28 mailgateway MailScanner[8859]: Virus and Content
Scanning: Starting
Dec 29 23:36:28 mailgateway postfix/nqmgr[8838]: 3D9181A7339:
from=<darren at healthleaders.com>, size=720, nrcpt=1 (queue active)
Dec 29 23:36:28 mailgateway MailScanner[8859]: Uninfected: Delivered 1
messages
Dec 29 23:36:29 mailgateway postfix/smtp[8878]: 3D9181A7339:
to=<darren at concepttechnologyinc.com>,
relay=local.concepttechnologyinc.com[192.168.1.10], delay=46,
status=sent (250 ok 1072763854 qp 21046)

What do you think?  Do you need more info?

Best Regards,

Darren Fulton
Concept Technology, Inc.



More information about the MailScanner mailing list