Mailscanner attach scan problem (Ante Gulam)

[Ante Gulam]

Hi...

 

So... here are some new things about my antispam/virus mail relay server..

I've tuned up everything a little.. all seemed to work perfect.. until i
noticed that some attachments that

Are recognized as virii (probably by clamAV) (in this case CSV file) are
blocked in /var/spool/postfix/hold... As the first problem which i've posted
here before.. BUT.. ive noticed now a error in /var/log/mail.log.. while "
tail -f  the log "..

 

"WARNING: lstat() failed on: /var/spool/MailScanner/incoming/2208"

 

Related error was also in /var/log/clamav/clamav.log"... filling up with
errors..

As i've figured out it was related to permissions on /incoming folder of
/var/spool/MailScanner/ for user clamav.

I've usermod -a -G postfix clamav ... also gived it more permissions .. but
nothing helped.. 

Setted also apparmor to allow incoming/** rw to clamav... really played with
it for a while with no success..

than i've noticed parameter in MailScanner.conf that concerns work group
perms and user perms.. so i changed it a little... And suddenly no error was
showing in logs.. clam's nor mail.log... 

i've switched:

 #Incoming Work Permissions = 0640

Incoming Work Permissions = 0600

And uncommented:

#Incoming Work Group = clamav

 

But after changing those parameters it seems no mail is passing L proc goes
<defunct>... and my postqueue -p is filling up with incoming mails.. nothing
helps.. i cannot find errors anywhere... except in my mail.log .. mails keep
filling..

 

Dec  9 14:04:23 mailfilter MailScanner[30921]: SpamAssassin cache hit for
message E10BE6D22E.CB1AA

Dec  9 14:04:23 mailfilter MailScanner[30921]: SpamAssassin cache hit for
message ECD9F6D23A.731E2

Dec  9 14:04:23 mailfilter MailScanner[30921]: SpamAssassin cache hit for
message 043646D22F.77D01

Dec  9 14:04:23 mailfilter MailScanner[30921]: SpamAssassin cache hit for
message 288966D230.4BBCE

Dec  9 14:04:23 mailfilter MailScanner[30921]: SpamAssassin cache hit for
message 1FBF06D23B.BAD13

....

 

Googling gave many solutions but none worked ... my mails were stucked in
hold.. i have no ideas anymore.. 

Is the problem certanly with clam or ?! what's the most painless way to
upgrade the version of clamav..?

 

Hope someone had similiar situation.. now i've putted back the permission
parameters in MailScanner.conf..

All seems going ok again.. probably until some strange mail comes in (csv,
pptx, zip...) as soon it gets recognized as

Virus it stays in hold.. but other mails keeps going through with some small
delay.. is that way things should work ?!

Strange.. btw. Can i manually tell SA or Clam which extensions to whitelist
etc. ?! J 

 

tnx

 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20101209/29e8b8c0/attachment.html