Problem releasing file from quarantine

[Alden Levy]

Date:    Thu, 1 Jul 2004 14:11:19 -0400
From:    Ugo Bellavance <ugob at CAMO-ROUTE.COM>
Subject: Re: Problem releasing file from quarantine

Alden Levy wrote:

>> I have been TRYING to release a file from quarantine, but I keep getting
the
>> same error.  According to the MAQ, all I have to do is copy the df- and
qf-
>> files to the mqueue. I also included the file that was tagged as a
possible
>> virus (PETERSON.rel.doc).  Unfortunately, the file never reaches the
>> destination.
>>
>> I found the offending rule in filename.rules.conf ("deny
>> \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$"), but I am loathe to change it.
>>
>> By now, we've had the sender change the name of the doc and resend it.
But I
>> am wondering what I can do in the future to release a file from
quarantine.
>> Any help would be appreciated.

>What do you have in your logs?  I think that once the df and qf files
>are in mqueue, it should not be processed by MailScanner again.  Make
>sure mqueue is your outgoing queue.

My outgoing queue for that particular email is where I put it (I had tried
to put it in /var/spool/mqueue as well, but that didn't work).  I tailed the
maillog when I put it in the correct mqueue and I got:

Jul  1 21:48:41 engine sendmail[7765]: i621mfR07765:
from=MS at engineno9inc.com, size=1343, class=0, nrcpts=1,
msgid=<200407020148.i621mfR07765 at engine.engineno9inc.com>,
relay=root at localhost
Jul  1 21:48:41 engine virthostmail[7770]: Chrooting to
/home/virtual/site2/fst
Jul  1 21:48:41 engine MailScanner[3565]: Notices: Warned about 1 messages
Jul  1 21:48:41 engine virthostmail[7773]: Chrooting to
/home/virtual/site1/fst
Jul  1 21:48:41 engine sendmail[7772]: i621mf907772: from=<k at SENDERDOMAIN>,
size=20759, class=0, nrcpts=1,
msgid=<F49F5382B0E1C14AB7667DC53AC3D3DC9CBBF7 at mail.SENDERDOMAIN>,
proto=ESMTP, relay=root at localhost
Jul  1 21:48:41 engine sendmail[7764]: i5TLNTD18954: to=<J at RECIEVEDOMAIN>,
delay=2+04:25:12, xdelay=00:00:00, mailer=virthostmail, pri=214559,
relay=RECEIVEDOMAIN, dsn=2.0.0, stat=Sent (i621mf907772 Message accepted for
delivery)
Jul  1 21:48:41 engine sendmail[7776]: i621mfT07776:
from=<MS at engineno9inc.com>, size=1593, class=0, nrcpts=1,
msgid=<200407020148.i621mfR07765 at engine.engineno9inc.com>, proto=ESMTP,
relay=root at localhost
Jul  1 21:48:41 engine sendmail[7775]: i621mf907772: to=<J at RECEIVEDOMAIN>,
delay=00:00:00, xdelay=00:00:00, mailer=local, pri=49543, dsn=2.0.0,
stat=Sent
Jul  1 21:48:41 engine sendmail[7769]: i621mfR07765: to=MS at engineno9inc.com,
ctladdr=MS at engineno9inc.com (0/0), delay=00:00:00, xdelay=00:00:00,
mailer=virthostmail, pri=31343, relay=engineno9inc.com, dsn=2.0.0, stat=Sent
(i621mfT07776 Message accepted for delivery)
Jul  1 21:48:41 engine sendmail[7778]: i621mfT07776: to=alden,
delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31230, dsn=2.0.0,
stat=Sent

(obviously, I have changed the sender's domain and the recipient's domain)

Any thoughts?

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html