MailScanner installation questions

[Hongwei Li]

Hi Julian,

Thank you very much!  I changed the configuration according to your
advice, then restarted MailScanner, ClamAV and SpamAssassin.  It looks
working now.

I haven't tested sending myself a "virus", but the root has received 2
mails that look like either a spam or a virus.  Is that it should be?  I
mean should the root receive ALL blocked mails that were sent originally
to any regular user, but the regular user does not know at all?  If I
(root) finds a mail that should not be blocked, what should I do?

The other questions are: how can I know it is a virus or a spam?  If it
is a virus, how to or is there any way to repair it and then send it
automatically to the supposed receiver?

Thanks a lot!

Hongwei

==============Original message text===============
On Mon, 15 Sep 2003 9:34:25 am CDT Julian Field wrote:

At 15:18 15/09/2003, you wrote:
>Hello,
>
>I just installed MailScanner 4.23-11 on our RedHat 7.3 Linux system that
>uses sendmail-8.11.6-25.73.    Following the instruction, I installed
>MailScanner, configured it, then started it as follows:
>
># service sendmail stop
># chkconfig sendmail off
># chkconfig --level 2345 sendmail off
>#
># chkconfig MailScanner on
># chkconfig --level 2345 MailScanner on
># service MailScanner start
>#
>
>However, after MailScanner started, we have trouble with pop3 server
>function.  None of Outlook, Outlook Express, Netscape mail, Eudora users
>are able to send mails out although they can read mails.  If using pine,
>then no problems at all.
>
>Checking the processes, I got:
>
># ps xa | grep Mail
>  4920 ?        S      0:00 /usr/bin/perl -I/usr/lib/MailScanner
>/usr/sbin/MailSc
>  4924 ?        Z      0:00 [MailScanner <defunct>]
>  4933 ?        Z      0:00 [MailScanner <defunct>]
>  4934 ?        Z      0:00 [MailScanner <defunct>]
>[root at morpheus root]# ps xa | grep sendmail
>  4893 ?        S      0:00 sendmail: accepting connections
>  4902 ?        S      0:00 /usr/sbin/sendmail -q15m -OPidFile
>/var/run/sendmail.

Look in your /var/log/maillog and find the errors in your MailScanner
configuration.

>So, I have the following questions:
>
>1. Should I change anything in sendmail setting or MailScanner so that
>pop3 users can read/send mails as usually?

No.


>2. What does [MailScanner <defunct>] mean? something wrong?

It has found something wrong in your configuration, and is logging the
errors to your maillog.

>3. The file mqueue has the property as:
># ls -ld /var/spool/mqueue
>drwxr-xr-x    2 root     mail         4096 Sep  5 13:10 /var/spool/mqueue
>
>so, I created mqueue.in the same:
># ls -ld /var/spool/mqueue.in
>drwxr-xr-x    2 root     mail         4096 Sep  5 09:39 /var/spool/mqueue.in
>
>However, the configuration file /etc/MailScanner/MailScanner.conf has the
>options:
>
>Run As User = mail
>Run As Group = mail
>
>Will that cause any problem? shoul I change the options?

Yes, that will cause a problem. If you are running sendmail, then just
leave "Run As User" and "Run As Group" both blank.


>4. I want to ues clamav with mailscanner.  Do I need to start daemon for
>clamav?

No.

>5. I have installed SpamAssassin before, and set up it as per-user level
>(not system-wide, no daemon for it).   To use MailScanner with
>SpamAssassin, do I need to change any setting for SpamAssassin?

You just need to set "Use SpamAssassin = yes" in MailScanner.conf.

>  do I need
>to start daemon for spammassassin?

No.

>   do I need to change any of the
>following settings in MailScanner.conf :
>
>Use SpamAssassin = no

Change this to "yes".

>SpamAssassin User State Dir =
>SpamAssassin Install Prefix =
>SpamAssassin Local Rules Dir =
>SpamAssassin Default Rules Dir =

Leave all of them alone.

>6. If everything is setupcorrect, how to check if MailScanner and ClamAV
>are working properly?

Send yourself a virus (something nice and safe like Eicar --- see
www.eicar.org).
Send yourself some spam (e.g. the sample-spam.txt that comes with
SpamAssassin).


>Thanks a lot!
>
>Hongwei

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
===========End of original message text===========