{Disarmed} Re: MailSacanner don't work
Martin.Hepworth
martinh at solidstatelogic.com
Fri Mar 9 11:09:03 CET 2007
Looks like it's fine to me..... maybe the status check in the init
script is broke...
You check is it's actually doing stuff by entries in /var/log/maillog
for the mailscanner processes and also X-<your-orgname>-MailScanner:
headers in the email.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Claudio Mundin
> Sent: 09 March 2007 10:02
> To: MailScanner discussion
> Subject: {Disarmed} Re: MailSacanner don't work
>
> After /etc/init.d/MailScanner start
>
> I have the next proces:
>
> 3650 ? Ss 0:00 MailScanner: master waiting for children,
> sleeping
> 3651 ? S 0:02 \_ MailScanner: waiting for messages
> 3655 ? S 0:02 \_ MailScanner: waiting for messages
> 3665 ? S 0:02 \_ MailScanner: waiting for messages
> 3671 ? S 0:02 \_ MailScanner: waiting for messages
> 3675 ? S 0:02 \_ MailScanner: waiting for messages
> 3821 ? Ss 0:00 sendmail: accepting connections
> 3826 ? Ss 0:00 sendmail: Queue control
> 3827 ? S 0:00 \_ sendmail: running queue:
/var/spool/mqueue
> 3839 ? Ss 0:00 sendmail: Queue runner at 00:30:00 for
> /var/spool/mqueue
>
>
> the output of netstat:
>
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 192.168.10.165:427 <http://192.168.10.165:427>
0.0.0.0:*
> LISTEN 3008/slpd
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 127.0.0.1:427 <http://127.0.0.1:427> 0.0.0.0:*
> LISTEN 3008/slpd
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 0.0.0.0:111 <http://0.0.0.0:111> 0.0.0.0:*
> LISTEN 2419/portmap
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 127.0.0.1:2544 <http://127.0.0.1:2544> 0.0.0.0:*
> LISTEN 2515/zmd
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 192.168.10.165:53 <http://192.168.10.165:53>
0.0.0.0:*
> LISTEN 2755/named
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 127.0.0.1:53 <http://127.0.0.1:53> 0.0.0.0:*
> LISTEN 2755/named
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 127.0.0.1:25 <http://127.0.0.1:25> 0.0.0.0:*
> LISTEN 3821/sendmail: acce
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 127.0.0.1:953 <http://127.0.0.1:953> 0.0.0.0:*
> LISTEN 2755/named
> tcp 0 0 :::52005 :::*
LISTEN
> 2609/sshd
> tcp 0 0 :::80 :::*
LISTEN
> 3013/httpd2-prefork
> tcp 0 0 ::1:953 :::*
LISTEN
> 2755/named
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 192.168.10.165:52005 <http://192.168.10.165:52005>
> MailScanner warning: numerical links are often malicious:
> 192.168.10.58:41439 <http://192.168.10.58:41439> ESTABLISHED
3164/0
> tcp 0 0 MailScanner warning: numerical links are often
> malicious: 192.168.10.165:52005 <http://192.168.10.165:52005>
> MailScanner warning: numerical links are often malicious:
> 192.168.10.58:41440 <http://192.168.10.58:41440> ESTABLISHED
3194/1
> udp 0 0 MailScanner warning: numerical links are often
> malicious: 0.0.0.0:32768 <http://0.0.0.0:32768> 0.0.0.0:*
> 2755/named
> udp 0 0 MailScanner warning: numerical links are often
> malicious: 255.255.255.255:427 <http://255.255.255.255:427>
0.0.0.0:*
> 3008/slpd
> udp 0 0 MailScanner warning: numerical links are often
> malicious: 192.168.10.165:427 <http://192.168.10.165:427>
0.0.0.0:*
> 3008/slpd
> udp 0 0 MailScanner warning: numerical links are often
> malicious: 224.0.1.22:427 <http://224.0.1.22:427> 0.0.0.0:*
> 3008/slpd
> udp 0 0 MailScanner warning: numerical links are often
> malicious: 239.255.255.253:427 <http://239.255.255.253:427>
0.0.0.0:*
> 3008/slpd
> udp 0 0 MailScanner warning: numerical links are often
> malicious: 192.168.10.165:53 <http://192.168.10.165:53>
0.0.0.0:*
> 2755/named
> udp 0 0 MailScanner warning: numerical links are often
> malicious: 127.0.0.1:53 <http://127.0.0.1:53> 0.0.0.0:*
> 2755/named
> udp 0 0 MailScanner warning: numerical links are often
> malicious: 0.0.0.0:111 <http://0.0.0.0:111> 0.0.0.0:*
> 2419/portmap
> udp 0 0 :::32769 :::*
> 2755/named
>
> where only have the proces sendmail in MailScanner warning: numerical
> links are often malicious: 127.0.0.1:25 <http://127.0.0.1:25> and i
don't
> mailscanner proces
>
> Then with /etc/init.d/MailScanner status the output is:
>
> Checking for service MailScanner:
dead
>
>
>
>
>
>
> 2007/3/9, Martin.Hepworth <martinh at solidstatelogic.com>:
>
> Claudio
>
> How are you looking for the 'status'.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
> > -----Original Message-----
> > From: mailscanner-bounces at lists.mailscanner.info
> <mailto:mailscanner-bounces at lists.mailscanner.info>
[mailto:mailscanner-
> > bounces at lists.mailscanner.info] On Behalf Of Claudio Mundin
> > Sent: 09 March 2007 09:46
> > To: mailscanner at lists.mailscanner.info
> > Subject: MailSacanner don't work
> >
> > Hi,
> >
> > I install MailSacanner with out any errors, but when i try to
star
> up
> > MailScanner (/etc/init.d/MailScanner start) and I try to see
the
> status,
> > the result of status is dead.
> >
> > where can i see information about the error??
> >
> > THANK
>
>
>
>
>
>
********************************************************************
> **
> Confidentiality : This e-mail and any attachments are intended
for
> the
> addressee only and may be confidential. If they come to you in
error
> you must take no action based on them, nor must you copy or show
> them
> to anyone. Please advise the sender by replying to this e-mail
> immediately and then delete the original from your computer.
>
> Opinion : Any opinions expressed in this e-mail are entirely
those
> of
> the author and unless specifically stated to the contrary, are
not
> necessarily those of the author's employer.
>
> Security Warning : Internet e-mail is not necessarily a secure
> communications medium and can be subject to data corruption. We
> advise
> that you consider this fact when e-mailing us.
>
> Viruses : We have taken steps to ensure that this e-mail and any
> attachments are free from known viruses but in keeping with good
> computing practice, you should ensure that they are virus free.
>
> Red Lion 49 Ltd T/A Solid State Logic
> Registered as a limited company in England and Wales
> (Company No:5362730)
> Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5
1RU,
> United Kingdom
>
********************************************************************
> **
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
**********************************************************************
Confidentiality : This e-mail and any attachments are intended for the
addressee only and may be confidential. If they come to you in error
you must take no action based on them, nor must you copy or show them
to anyone. Please advise the sender by replying to this e-mail
immediately and then delete the original from your computer.
Opinion : Any opinions expressed in this e-mail are entirely those of
the author and unless specifically stated to the contrary, are not
necessarily those of the author's employer.
Security Warning : Internet e-mail is not necessarily a secure
communications medium and can be subject to data corruption. We advise
that you consider this fact when e-mailing us.
Viruses : We have taken steps to ensure that this e-mail and any
attachments are free from known viruses but in keeping with good
computing practice, you should ensure that they are virus free.
Red Lion 49 Ltd T/A Solid State Logic
Registered as a limited company in England and Wales
(Company No:5362730)
Registered Office: 25 Spring Hill Road, Begbroke, Oxford OX5 1RU,
United Kingdom
**********************************************************************
More information about the MailScanner
mailing list