From jonas at vrt.dk Mon Aug 1 10:55:07 2011 From: jonas at vrt.dk (Jonas) Date: Mon Aug 1 10:55:18 2011 Subject: MS only scanning mail from local network In-Reply-To: <1312032239.21948.12.camel@localhost> References: <1312027275.21948.8.camel@localhost><1312030486.21948.10.camel@localhost> <1312032239.21948.12.camel@localhost> Message-ID: <09F23668E315FD4597C13D73E5123ADF64E616@SCTSBS.sct.dk> > > > Are you talking about a setting in MailScanner.comf? or some other file? > > > > Since you say it scans some mails ( from you own network ) and not > > from any external sources ... that makes me think that its a setting > > in MailScanner.conf or some of the subdirs "conf.d" in the MailScanner > > dir. > > > > And especially the "Scan Messages". > > > The only line I have in my MailScanner.conf is:- > Scan Messages = yes > > I have no files except README in the conf.d directory, and all lines in that file > are, as expected, commented out > Well do the mails which you say are not scanned pass through your mailscanner at all? (Look at the headers and or logs) Med venlig hilsen / Best regards ? Jonas Akrouh Larsen ? TechBiz ApS Laplandsgade 4, 2. sal 2300 K?benhavn S ? Office: 7020 0979 Direct: 3336 9974 Mobile: 5120 1096 Fax:??? 7020 0978 Web: www.techbiz.dk From kunal.gurukul at gmail.com Mon Aug 1 11:47:43 2011 From: kunal.gurukul at gmail.com (kunal verma) Date: Mon Aug 1 11:47:53 2011 Subject: Slow mail delivery for few mails In-Reply-To: References: Message-ID: the problem is not resolved and mails still remain in mqueue directory with the following entry in the /var/spool/maillog: Jul 29 11:14:40 dak sendmail[6527]: p6T5ieeZ006527: from=< vsrao@something.com>, size=1520, class=0, nrcpts=1, msgid=<008801cc4db4$37ad5460$7f1113ac@nfce8b77d1c360>, proto=ESMTP, daemon=MTA, relay=[Ip address]**** Jul 29 11:16:58 dak sendmail[6569]: p6T5ieeZ006527: timeout waiting for input from local during Draining Input On Sat, Jul 30, 2011 at 10:09 AM, kunal verma wrote: please help me sorting out the problem. Kunal Verma > the problem still persist. > the *mailq.in* directory keeps the mesages for long period of time for > some mails. > regarding memory requirement, i have 16 GB memory. > i m unable to sort it out..what could be the problem?? > any help would be appreciated. > > Kunal Verma > > > On Sat, Jul 30, 2011 at 3:17 AM, Scott Silva wrote: > >> on 7/29/2011 12:11 AM kunal verma spake the following: >> >> timeout waiting for input from local during Draining Input >>> >> have you tried all the optimization settings in the MAQ? >> do you have enough memory? Mailscanner should have 1 gb per processor to >> run well >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.**info >> http://lists.mailscanner.info/**mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/**posting >> >> Support MailScanner development - buy the book off the website! >> > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110801/d47a0ed1/attachment.html From jeremy at fluxlabs.net Mon Aug 1 15:56:06 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Mon Aug 1 15:56:24 2011 Subject: Slow mail delivery for few mails In-Reply-To: References: Message-ID: <63688B2A-68E7-4AA5-96CC-F7562BD566DB@fluxlabs.net> http://www.sendmail.org/ftp/KNOWNBUGS Delivery to programs that generate too much output may cause problems If e-mail is delivered to a program which generates too much output, then sendmail may issue an error: timeout waiting for input from local during Draining Input Make sure that the program does not generate output beyond a status message (corresponding to the exit status). This may require a wrapper around the actual program to redirect output to /dev/null. Such a problem has been reported for bulk_mailer. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 1, 2011, at 5:53 AM, "kunal verma" > wrote: the problem is not resolved and mails still remain in mqueue directory with the following entry in the /var/spool/maillog: Jul 29 11:14:40 dak sendmail[6527]: p6T5ieeZ006527: from=<vsrao@something.com>, size=1520, class=0, nrcpts=1, msgid=<008801cc4db4$37ad5460$7f1113ac@nfce8b77d1c360>, proto=ESMTP, daemon=MTA, relay=[Ip address] Jul 29 11:16:58 dak sendmail[6569]: p6T5ieeZ006527: timeout waiting for input from local during Draining Input On Sat, Jul 30, 2011 at 10:09 AM, kunal verma <kunal.gurukul@gmail.com> wrote: please help me sorting out the problem. Kunal Verma the problem still persist. the mailq.in directory keeps the mesages for long period of time for some mails. regarding memory requirement, i have 16 GB memory. i m unable to sort it out..what could be the problem?? any help would be appreciated. Kunal Verma On Sat, Jul 30, 2011 at 3:17 AM, Scott Silva <ssilva@sgvwater.com> wrote: on 7/29/2011 12:11 AM kunal verma spake the following: timeout waiting for input from local during Draining Input have you tried all the optimization settings in the MAQ? do you have enough memory? Mailscanner should have 1 gb per processor to run well -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110801/a452a9b7/attachment.html From maxsec at gmail.com Mon Aug 1 19:56:43 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Mon Aug 1 19:56:53 2011 Subject: Slow mail delivery for few mails In-Reply-To: References: Message-ID: Have you got mailscanner running in batch mode ( see mailscannner.conf)? What insctructions have you used to install mailscanner? Martin On Monday, 1 August 2011, kunal verma wrote: > the problem is not resolved and mails still remain in mqueue directory > with the following entry in the /var/spool/maillog: > > Jul 29 11:14:40 dak sendmail[6527]: p6T5ieeZ006527: from=< vsrao@something.com>, size=1520, class=0, nrcpts=1, msgid=<008801cc4db4$37ad5460$7f1113ac@nfce8b77d1c360>, proto=ESMTP, daemon=MTA, relay=[Ip address] > > Jul 29 11:16:58 dak sendmail[6569]: p6T5ieeZ006527: timeout waiting for input from local during Draining Input > > On Sat, Jul 30, 2011 at 10:09 AM, kunal verma wrote: > please help me sorting out the problem. > Kunal Verma > >> >> the problem still persist. >> the mailq.in directory keeps the mesages for long period of time for some mails. >> regarding memory requirement, i have 16 GB memory. >> i m unable to sort it out..what could be the problem?? >> any help would be appreciated. >> Kunal Verma >> >> On Sat, Jul 30, 2011 at 3:17 AM, Scott Silva wrote: >>> >>> on 7/29/2011 12:11 AM kunal verma spake the following: >>>> >>>> timeout waiting for input from local during Draining Input >>> >>> have you tried all the optimization settings in the MAQ? >>> do you have enough memory? Mailscanner should have 1 gb per processor to run well >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner < http://lists.mailscanner.info/mailman/listinfo/mailscanner> >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! > > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110801/2058b9eb/attachment.html From ssilva at sgvwater.com Mon Aug 1 20:19:57 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Mon Aug 1 20:20:21 2011 Subject: Slow mail delivery for few mails In-Reply-To: References: Message-ID: on 8/1/2011 11:56 AM Martin Hepworth spake the following: > Have you got mailscanner running in batch mode ( see mailscannner.conf)? > > What insctructions have you used to install mailscanner? > > Martin Also, a caching nameserver on the host can speed name resolution. From kunal.gurukul at gmail.com Tue Aug 2 09:46:02 2011 From: kunal.gurukul at gmail.com (kunal verma) Date: Tue Aug 2 09:46:11 2011 Subject: Slow mail delivery for few mails In-Reply-To: <63688B2A-68E7-4AA5-96CC-F7562BD566DB@fluxlabs.net> References: <63688B2A-68E7-4AA5-96CC-F7562BD566DB@fluxlabs.net> Message-ID: Delivery to programs that generate too much output may cause problems but i m not getting what is that program??i m using *sendmail 8.13 as MTA* and *procmail* as local delivery agent and using a global *procmailrc* file for delivering mails to user home directory. am i missing something??which program is generating the output?? Kunal Verma On Mon, Aug 1, 2011 at 8:26 PM, Jeremy McSpadden wrote: > http://www.sendmail.org/ftp/KNOWNBUGS > > Delivery to programs that generate too much output may cause problems > > If e-mail is delivered to a program which generates too much > output, then sendmail may issue an error: > > timeout waiting for input from local during Draining Input > > Make sure that the program does not generate output beyond a > status message (corresponding to the exit status). This may > require a wrapper around the actual program to redirect output > to /dev/null. > > Such a problem has been reported for bulk_mailer. > > > -- > Jeremy McSpadden > Flux Labs, Inc > http://www.fluxlabs.net > Endless Solutions > Office : 850-588-4626 > Cell : 850-890-2543 > Fax : 850-254-2955 > > > On Aug 1, 2011, at 5:53 AM, "kunal verma" wrote: > > the problem is not resolved and mails still remain in mqueue directory > with the following entry in the /var/spool/maillog: > > Jul 29 11:14:40 dak sendmail[6527]: p6T5ieeZ006527: from=< > vsrao@something.com>, size=1520, class=0, nrcpts=1, > msgid=<008801cc4db4$37ad5460$7f1113ac@nfce8b77d1c360>, proto=ESMTP, > daemon=MTA, relay=[Ip address]**** > > Jul 29 11:16:58 dak sendmail[6569]: p6T5ieeZ006527: timeout waiting for > input from local during Draining Input > On Sat, Jul 30, 2011 at 10:09 AM, kunal verma < > kunal.gurukul@gmail.com> wrote: > please help me sorting out the problem. > > Kunal Verma > > >> the problem still persist. >> the *mailq.in* directory keeps the mesages for long period of time for >> some mails. >> regarding memory requirement, i have 16 GB memory. >> i m unable to sort it out..what could be the problem?? >> any help would be appreciated. >> >> Kunal Verma >> >> >> On Sat, Jul 30, 2011 at 3:17 AM, Scott Silva < >> ssilva@sgvwater.com> wrote: >> >>> on 7/29/2011 12:11 AM kunal verma spake the following: >>> >>> timeout waiting for input from local during Draining Input >>>> >>> have you tried all the optimization settings in the MAQ? >>> do you have enough memory? Mailscanner should have 1 gb per processor to >>> run well >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.** >>> info >>> >>> http://lists.mailscanner.info/**mailman/listinfo/mailscanner >>> >>> Before posting, read >>> http://wiki.mailscanner.info/**posting >>> >>> Support MailScanner development - buy the book off the website! >>> >> >> > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read > http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110802/66a2975c/attachment.html From sonidhaval at gmail.com Tue Aug 2 22:03:55 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Tue Aug 2 22:04:45 2011 Subject: Disabling the rule Message-ID: Dear All, How to disable this rule - Scanner: Attempt to hide real filename extension? MailScanner - 4.79 Thanks, -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110803/806042f2/attachment.html From jeremy at fluxlabs.net Tue Aug 2 22:10:06 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Aug 2 22:10:33 2011 Subject: Disabling the rule In-Reply-To: References: Message-ID: <8B935802-C432-4FE0-B7CC-8197A5937FCB@fluxlabs.net> filename rules file -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 2, 2011, at 4:06 PM, "sonidhaval@gmail.com" > wrote: Dear All, How to disable this rule - Scanner: Attempt to hide real filename extension? MailScanner - 4.79 Thanks, -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of LinuxArticles.org -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110802/bf883a75/attachment.html From bjron.mork at gmail.com Wed Aug 3 11:21:41 2011 From: bjron.mork at gmail.com (Bjron Mork) Date: Wed Aug 3 11:22:40 2011 Subject: MailScanner Crash Message-ID: <005401cc51c7$25da7f80$718f7e80$@gmail.com> Dear All, I have MailScanner running 4.79.11 with Postfix 2.7, and mailwatch, everything was working fine, since long, but suddenly, my both servers has started showing messages below.. I have more than 10GB RAM free, disk space is around 70% free, currently MailScanner is not scanning for any email for spam, need your urgent support for its recovery. [root@outbound ~]# tail -f /var/log/maillog | grep MailScanner Aug 3 09:58:52 outbound MailScanner[10560]: Warning: skipping message E41E321D800A.AC841 as it has been attempted too many times Aug 3 09:58:52 outbound MailScanner[10560]: Quarantined message E41E321D800A.AC841 as it caused MailScanner to crash several times Aug 3 09:58:52 outbound MailScanner[10560]: Saved entire message to /var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841 Aug 3 09:58:52 outbound MailScanner[10560]: writing to /var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841/message: No such file or directory Aug 3 09:58:56 outbound MailScanner[10618]: MailScanner E-Mail Virus Scanner version 4.79.11 starting... Aug 3 09:58:56 outbound MailScanner[10618]: Reading configuration file /etc/MailScanner/MailScanner.conf Aug 3 09:58:56 outbound MailScanner[10618]: Reading configuration file /etc/MailScanner/conf.d/README Aug 3 09:58:56 outbound MailScanner[10618]: Enabling SpamAssassin auto-whitelist functionality... Aug 3 09:58:57 outbound MailScanner[10596]: Connected to Processing Attempts Database Aug 3 09:58:57 outbound MailScanner[10596]: Found 5223 messages in the Processing Attempts Database Aug 3 09:58:57 outbound MailScanner[10596]: Using locktype = flock Aug 3 09:58:57 outbound MailScanner[10596]: Warning: skipping message E41E321D800A.AC841 as it has been attempted too many times Aug 3 09:58:57 outbound MailScanner[10596]: Quarantined message E41E321D800A.AC841 as it caused MailScanner to crash several times Aug 3 09:58:57 outbound MailScanner[10596]: Saved entire message to /var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841 Aug 3 09:58:57 outbound MailScanner[10596]: writing to /var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841/message: No such file or directory [root@outbound ~]# check_MailScanner MailScanner running with pid 8262 10698 10704 10710 10716 10722 [root@outbound ~]# [root@outbound ~]# MailScanner --lint Trying to setlogsock(unix) Reading configuration file /etc/MailScanner/MailScanner.conf Reading configuration file /etc/MailScanner/conf.d/README Read 867 hostnames from the phishing whitelist Read 4306 hostnames from the phishing blacklists Config: calling custom init function SQLBlacklist Starting up SQL Blacklist Read 772 blacklist entries Config: calling custom init function MailWatchLogging Started SQL Logging child Config: calling custom init function SQLWhitelist Starting up SQL Whitelist Read 101 whitelist entries Checking version numbers... Version number in MailScanner.conf (4.79.11) is correct. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (89) MailScanner setting UID to (89) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database config: SpamAssassin failed to parse line, "/usr/local/bin/dccproc" is not valid for "dcc_path", skipping: dcc_path /usr/local/bin/dccproc SpamAssassin reported an error. LibClamAV Warning: *********************************************************** LibClamAV Warning: *** This version of the ClamAV engine is outdated. *** LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq *** LibClamAV Warning: *********************************************************** LibClamAV Warning: *********************************************************** LibClamAV Warning: *** This version of the ClamAV engine is outdated. *** LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq *** LibClamAV Warning: *********************************************************** Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 5223 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = clamavmodule" Found these virus scanners installed: clamavmodule =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting ClamAVModule::INFECTED:: Eicar-Test-Signature:: ./1/eicar.com Virus Scanning: ClamAVModule found 1 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 1 viruses =========================================================================== If any of your virus scanners (clamavmodule) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. Config: calling custom end function SQLBlacklist Closing down by-domain spam blacklist Config: calling custom end function MailWatchLogging Config: calling custom end function SQLWhitelist Closing down by-domain spam whitelist [root@outbound ~]# Regards, B~Mork -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110803/340ea08e/attachment.html From prandal at herefordshire.gov.uk Wed Aug 3 11:39:45 2011 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Wed Aug 3 11:42:45 2011 Subject: MailScanner Crash In-Reply-To: <005401cc51c7$25da7f80$718f7e80$@gmail.com> References: <005401cc51c7$25da7f80$718f7e80$@gmail.com> Message-ID: <7CA580B59C1ABD45B4614ED90D4C7B853AE72F1E@HC-EXMBX02.herefordshire.gov.uk> Obsolete ClamAV, obsolete MailScanner; fix these and try again. ClamAVModule is deprecated, you'll need to use clamdscan instead. Phil -- Phil Randal | Infrastructure Engineer NHS Herefordshire & Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Bjron Mork Sent: 03 August 2011 11:22 To: mailscanner@lists.mailscanner.info Subject: MailScanner Crash Dear All, I have MailScanner running 4.79.11 with Postfix 2.7, and mailwatch, everything was working fine, since long, but suddenly, my both servers has started showing messages below.. I have more than 10GB RAM free, disk space is around 70% free, currently MailScanner is not scanning for any email for spam, need your urgent support for its recovery. [root@outbound ~]# tail -f /var/log/maillog | grep MailScanner Aug 3 09:58:52 outbound MailScanner[10560]: Warning: skipping message E41E321D800A.AC841 as it has been attempted too many times Aug 3 09:58:52 outbound MailScanner[10560]: Quarantined message E41E321D800A.AC841 as it caused MailScanner to crash several times Aug 3 09:58:52 outbound MailScanner[10560]: Saved entire message to /var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841 Aug 3 09:58:52 outbound MailScanner[10560]: writing to /var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841/message: No such file or directory Aug 3 09:58:56 outbound MailScanner[10618]: MailScanner E-Mail Virus Scanner version 4.79.11 starting... Aug 3 09:58:56 outbound MailScanner[10618]: Reading configuration file /etc/MailScanner/MailScanner.conf Aug 3 09:58:56 outbound MailScanner[10618]: Reading configuration file /etc/MailScanner/conf.d/README Aug 3 09:58:56 outbound MailScanner[10618]: Enabling SpamAssassin auto-whitelist functionality... Aug 3 09:58:57 outbound MailScanner[10596]: Connected to Processing Attempts Database Aug 3 09:58:57 outbound MailScanner[10596]: Found 5223 messages in the Processing Attempts Database Aug 3 09:58:57 outbound MailScanner[10596]: Using locktype = flock Aug 3 09:58:57 outbound MailScanner[10596]: Warning: skipping message E41E321D800A.AC841 as it has been attempted too many times Aug 3 09:58:57 outbound MailScanner[10596]: Quarantined message E41E321D800A.AC841 as it caused MailScanner to crash several times Aug 3 09:58:57 outbound MailScanner[10596]: Saved entire message to /var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841 Aug 3 09:58:57 outbound MailScanner[10596]: writing to /var/spool/MailScanner/quarantine/20110803/E41E321D800A.AC841/message: No such file or directory [root@outbound ~]# check_MailScanner MailScanner running with pid 8262 10698 10704 10710 10716 10722 [root@outbound ~]# [root@outbound ~]# MailScanner --lint Trying to setlogsock(unix) Reading configuration file /etc/MailScanner/MailScanner.conf Reading configuration file /etc/MailScanner/conf.d/README Read 867 hostnames from the phishing whitelist Read 4306 hostnames from the phishing blacklists Config: calling custom init function SQLBlacklist Starting up SQL Blacklist Read 772 blacklist entries Config: calling custom init function MailWatchLogging Started SQL Logging child Config: calling custom init function SQLWhitelist Starting up SQL Whitelist Read 101 whitelist entries Checking version numbers... Version number in MailScanner.conf (4.79.11) is correct. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (89) MailScanner setting UID to (89) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database config: SpamAssassin failed to parse line, "/usr/local/bin/dccproc" is not valid for "dcc_path", skipping: dcc_path /usr/local/bin/dccproc SpamAssassin reported an error. LibClamAV Warning: *********************************************************** LibClamAV Warning: *** This version of the ClamAV engine is outdated. *** LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq *** LibClamAV Warning: *********************************************************** LibClamAV Warning: *********************************************************** LibClamAV Warning: *** This version of the ClamAV engine is outdated. *** LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq *** LibClamAV Warning: *********************************************************** Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 5223 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = clamavmodule" Found these virus scanners installed: clamavmodule =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting ClamAVModule::INFECTED:: Eicar-Test-Signature:: ./1/eicar.com Virus Scanning: ClamAVModule found 1 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 1 viruses =========================================================================== If any of your virus scanners (clamavmodule) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. Config: calling custom end function SQLBlacklist Closing down by-domain spam blacklist Config: calling custom end function MailWatchLogging Config: calling custom end function SQLWhitelist Closing down by-domain spam whitelist [root@outbound ~]# Regards, B~Mork -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110803/13aad59d/attachment.html From stephencoxmail at gmail.com Wed Aug 3 14:06:09 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Wed Aug 3 14:06:19 2011 Subject: MailScanner Crash In-Reply-To: <005401cc51c7$25da7f80$718f7e80$@gmail.com> References: <005401cc51c7$25da7f80$718f7e80$@gmail.com> Message-ID: On Wed, Aug 3, 2011 at 12:21 PM, Bjron Mork wrote: > I have more than 10GB RAM free, disk space is around 70% free, currently > MailScanner is not scanning for any email for spam, need your urgent support > for its recovery. What is the output of MailScanner -v -- Stephen Cox From Bjron.Mork at gmail.com Wed Aug 3 18:29:30 2011 From: Bjron.Mork at gmail.com (bjron.mork@gmail.com) Date: Wed Aug 3 18:30:32 2011 Subject: MailScanner Crash Message-ID: <7ED160EA352F4FD38DE815E2B124F2D1@WTPK.local> Hi Phil / forum, Thanks for your reply. I found another work-around for my problem, MailScanner is unable to create folder in /var/spool/MailScanner/quarantine/DAILY_DATE_WISE_FOLDER, today I created 20110803 folder manually and allowed ownership and mode to 770, and MailScanner started working properly. What might be the reason for the this issue, and how can it be permanently resolved. Thanks in advance.... Regards, B~Mork -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110803/a4b63e2f/attachment.html From alex at vidadigital.com.pa Wed Aug 3 18:59:45 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Wed Aug 3 19:00:00 2011 Subject: MailScanner Crash In-Reply-To: <7ED160EA352F4FD38DE815E2B124F2D1@WTPK.local> References: <7ED160EA352F4FD38DE815E2B124F2D1@WTPK.local> Message-ID: <37F83BA5-3D88-4133-8E10-92434077597E@vidadigital.com.pa> You don't have SELINUX enabled, do you? On Aug 3, 2011, at 12:29 PM, bjron.mork@gmail.com wrote: > Hi Phil / forum, > > Thanks for your reply. I found another work-around for my problem, MailScanner is unable to create folder in /var/spool/MailScanner/quarantine/DAILY_DATE_WISE_FOLDER, today I created 20110803 folder manually and allowed ownership and mode to 770, and MailScanner started working properly. > > What might be the reason for the this issue, and how can it be permanently resolved. > > Thanks in advance.... > > > Regards, > B~Mork > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ms-list at alexb.ch Wed Aug 3 21:30:22 2011 From: ms-list at alexb.ch (Alex Broens) Date: Wed Aug 3 21:30:40 2011 Subject: MailScanner Crash In-Reply-To: <7ED160EA352F4FD38DE815E2B124F2D1@WTPK.local> References: <7ED160EA352F4FD38DE815E2B124F2D1@WTPK.local> Message-ID: <4E39AFDE.7030606@alexb.ch> On 2011-08-03 19:29, bjron.mork@gmail.com wrote: > Hi Phil / forum, > > > > Thanks for your reply. I found another work-around for my problem, MailScanner is unable to create folder in /var/spool/MailScanner/quarantine/DAILY_DATE_WISE_FOLDER, today I created 20110803 folder manually and allowed ownership and mode to 770, and MailScanner started working properly. > > > > What might be the reason for the this issue, and how can it be permanently resolved. if not Selinux then permissions: for RHEL/Fedora/Centos: chown -R postfix:postfix /var/spool/MailScanner/incoming chown -R postfix:apache /var/spool/MailScanner/quarantine or whatever user you're running postfix/apache under. h2h From mailinglist at mindconnect.nl Thu Aug 4 12:18:15 2011 From: mailinglist at mindconnect.nl (Martijn) Date: Thu Aug 4 12:18:33 2011 Subject: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 Message-ID: <4E3A7FF7.5040107@mindconnect.nl> Hi guys, I'm designing and testing a new mail system for our company. While researching I came across MailScanner and I liked the way of thinking with putting mail in the hold queue for processing instead of running an extra SMTP-service like amavisd seems to need. But while testing I have come across a quite a few things that don't seem to work out using the providing documentation. Perhaps anyone could help solving these, in my particular situation, or upstream where it applies. I have numbered the issues for easier reference. There are a few sections where I may sound a bit frustrated. It's not personal and I respect what everyone is trying to do with MailScanner. With the trouble I'm experiencing currently, it's a bit hard for me to imagine this software is ready for production. I'm seeing messages all over the web that the software is ready, so I hope I actually did something stupid and MailScanner is not to 'blame'. Little bit of intro: MailScanner is basically the last thing we're adding to our setup. We already have a well running system that consists of (currently) Ubuntu LTS 10.04.2, equipped with Postfix 2.7.0 for SMTP and Dovecot 1.2.9 for POP3, IMAP (The Dovecot LDA is used). All mail users are virtual. I'm completely new to MailScanner and I'm going through the documentation, eventually ending up at http://www.mailscanner.info/install_guides.html and more specifically http://www.mailscanner.info/ubuntu.html Issue 1: I see no date or version numbers mentioned there, except for the 8.04-part. I would really highly recommend this for all documentation and blogposts to prevent someone from staring at old docs for hours. Of course everyone has the intention of keeping docs up to date, but we all know there are times when it just doesn't happen. What I basically do reading documentation like this is: see if I understand what I'm doing and if that's the case then copy paste the commands, perhaps edit them if my system is different and then run them. In this case it's all pretty basic and I'm not aware of anything I need to edit for it to work, so I just start copy-pasting them. Issue 2: When installing the MailScanner Dependencies I notice that the documented command doesn't work for me. Unfortunately I don't have any notes for that part but I remember something about package names not matching, or needing to install the packages in a specific order instead of all at once. Problem solved, so I continue with the installation getting the latest .deb from the suggested http://debian.intergenia.de/debian/pool/main/m/mailscanner/ : That's mailscanner_4.79.11-2.2_all.deb. dpkg -i seems to run well, as well as the steps described under Configuring MailScanner and ClamAV, until the point I can start mailscanner: Issue 3: Could not read directory /var/spool/MailScanner/incoming at /usr/share/MailScanner//MailScanner/Config.pm line 2786 Error in configuration file line 184, directory /var/spool/MailScanner/incoming for incomingworkdir does not exist (or is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 3146 Could not read directory /var/spool/MailScanner/quarantine at /usr/share/MailScanner//MailScanner/Config.pm line 2786 Error in configuration file line 188, directory /var/spool/MailScanner/quarantine for quarantinedir does not exist (or is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 3146 So I check: root@insular:/var/spool/MailScanner# ls -la total 24 drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive drwxr-x--- 3 mail mail 4096 2011-08-04 10:54 incoming drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 quarantine drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin root@insular:/var/spool/MailScanner# Everything is there (I noticed the wrong permissions later, I'll get to that in a minute). Thinking that MailScanner failed to start because of these errors, I try to start again. /etc/init.d/mailscanner start returns no output, so I think the directories where created automatically after the first error and now everything runs well. In practice however, MailScanner started the first time dispite the errors. No idea what happened when I started it a second time. This may very well confuse a lot of people. I stop the service, check to see if no MailScanner processes are running and start fixing the permission problems. Issue 4: Alright so there's a problem with incomingworkdir and quarentinedir. Both exist, I notice they're owned by mail:mail but MailScanner runs as the postfix user so that probably is the problem. Although mail:mail is the Ubuntu default I don't see any ownership changes documented in the Ubuntu guide. I find an extra doc about Postfix and start going over all the checks: http://www.mailscanner.info/postfix.html Most of the points here are done while going through the Ubuntu steps. The doc does confirm that the directories need to be owned by postfix:postfix. I correct the problem and start the service: same error about directories not existing or not being readable. I check the permissions again, and they seem good: root@insular:/var/spool/MailScanner# ls -la total 24 drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive drwxr-x--- 3 postfix postfix 4096 2011-08-04 10:54 incoming drwxr-x--- 2 postfix postfix 4096 2010-12-09 20:36 quarantine drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin root@insular:/var/spool/MailScanner# So I'm double checking values in the configuration, and they check out with what is documented. Now I'm a bit confused and I start checking general configuration with --lint. Issue 5: Running mailscanner --lint gives me some hints: "The "envelope_sender_header" in your spam.assassin.prefs.conf is not correct" Ok, corrected that. Plus, a range of errors because of trouble with the permissions, like: Could not create SpamAssassin temporary directory /var/spool/MailScanner/incoming/SpamAssassin-Temp, Permission denied at /usr/share/MailScanner//MailScanner/SA.pm line 80. But no real configuration problems seem to surface. Issue 6: After running mailscanner --lint, permissions on the directories in /var/spool/MailScanner have changed: root@insular:/var/spool/MailScanner# ls -la total 24 drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive drwxr-x--- 5 postfix clamav 4096 2011-08-04 12:46 incoming drwxr-x--- 2 postfix postfix 4096 2010-12-09 20:36 quarantine drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin root@insular:/var/spool/MailScanner# Incoming is now suddenly owned by postfix:clamav. Clamav does happen to be the only scanner I have installed. If I just start MailScanner service normally, the permissions change doesn't happen. So I reverse the change to make sure I'm testing consistently. What else can I test? check_mailscanner: root@insular:/var/spool/MailScanner# check_mailscanner check_mailscanner: command not found root@insular:/var/spool/MailScanner# check_MailScanner check_MailScanner: command not found root@insular:/var/spool/MailScanner# Seems that I'm missing that script. Issue 7: In an earlier try (I'm collecting info on these issues on my second try) I ended up with a MailScanner that seemed to start without issues, but no mail came through and I discovered something is wrong in mail.log. MailScanner seems to be starting every few seconds. If I start MailScanner on my second try, the same thing happens: [...] Aug 4 12:45:26 insular MailScanner[12221]: Using SpamAssassin results cache Aug 4 12:45:26 insular MailScanner[12221]: Could not create SpamAssassin cache database /var/spool/MailScanner/incoming/SpamAssassin.cache.db Aug 4 12:45:26 insular MailScanner[12221]: Enabling SpamAssassin auto-whitelist functionality... Aug 4 12:46:03 insular MailScanner[12256]: MailScanner E-Mail Virus Scanner version 4.79.11 starting... Aug 4 12:46:04 insular MailScanner[12256]: Reading configuration file /etc/MailScanner/MailScanner.conf Aug 4 12:46:04 insular MailScanner[12256]: Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*, skipping them. Aug 4 12:46:04 insular MailScanner[12256]: Read 858 hostnames from the phishing whitelist Aug 4 12:46:04 insular MailScanner[12256]: Read 5497 hostnames from the phishing blacklists Aug 4 12:46:04 insular MailScanner[12256]: Using SpamAssassin results cache Aug 4 12:46:04 insular MailScanner[12256]: Could not create SpamAssassin cache database /var/spool/MailScanner/incoming/SpamAssassin.cache.db Aug 4 12:46:04 insular MailScanner[12256]: Enabling SpamAssassin auto-whitelist functionality... Aug 4 12:46:06 insular MailScanner[12256]: I have found clamav scanners installed, and will use them all by default. Aug 4 12:46:06 insular MailScanner[12256]: Could not create Processing Attempts Database "/var/spool/MailScanner/incoming/Processing.db" Aug 4 12:46:06 insular MailScanner[12256]: Incoming Work Dir does not exist Aug 4 12:46:08 insular MailScanner[12303]: MailScanner E-Mail Virus Scanner version 4.79.11 starting... Aug 4 12:46:08 insular MailScanner[12303]: Reading configuration file /etc/MailScanner/MailScanner.conf Aug 4 12:46:09 insular MailScanner[12303]: Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*, skipping them. Aug 4 12:46:09 insular MailScanner[12303]: Read 858 hostnames from the phishing whitelist Aug 4 12:46:09 insular MailScanner[12303]: Read 5497 hostnames from the phishing blacklists Aug 4 12:46:09 insular MailScanner[12303]: Using SpamAssassin results cache Aug 4 12:46:09 insular MailScanner[12303]: Could not create SpamAssassin cache database /var/spool/MailScanner/incoming/SpamAssassin.cache.db Aug 4 12:46:09 insular MailScanner[12303]: Enabling SpamAssassin auto-whitelist functionality... Aug 4 12:46:28 insular MailScanner[12314]: MailScanner E-Mail Virus Scanner version 4.79.11 starting... [...] When looking at the process list, the pattern is this: root@insular:/var/log# ps aux | grep MailScanner postfix 12553 0.0 1.9 26548 20184 ? SNs 13:03 0:00 MailScanner: starting children postfix 12554 74.0 4.8 54996 49740 ? RN 13:03 0:01 MailScanner: starting children root 12579 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep --color=auto MailScanner root@insular:/var/log# ps aux | grep MailScanner postfix 12553 0.0 1.9 26548 20184 ? SNs 13:03 0:00 MailScanner: starting children postfix 12554 55.0 0.0 0 0 ? ZN 13:03 0:01 [MailScanner] root 12602 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep --color=auto MailScanner root@insular:/var/log# ps aux | grep MailScanner postfix 12553 0.3 1.9 26548 20488 ? SNs 13:03 0:00 MailScanner: starting child postfix 12603 86.0 3.6 42708 37376 ? RN 13:03 0:00 MailScanner: starting child root 12605 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep --color=auto MailScanner root@insular:/var/log# Starting children, , starting children, etc. I've been Googling *a lot* of error strings and problems that I came across but I never really ended up with answers so this mailing list is my last resort. Went through a good few months of the mailing list by hand and didn't really find anything that really is the same as what I'm experiencing. I really would like to stick with MailScanner because I think there's an advantage in a system that works more transparent then linking a bunch of SMTP services together. Issue 8: Visiting http://www.mailscanner.info/docs.html as suggested in the e-mails I get from the mailing list, links "The MailScanner Book" and "Installation Guides" give me a 404. That rounds up all the issues I can remember and reproduce right now. Hope that anyone can help me. Thanks in advance, - Martijn From craigwhite at azapple.com Thu Aug 4 12:43:18 2011 From: craigwhite at azapple.com (Craig White) Date: Thu Aug 4 12:47:36 2011 Subject: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 In-Reply-To: <4E3A7FF7.5040107@mindconnect.nl> References: <4E3A7FF7.5040107@mindconnect.nl> Message-ID: <1312458198.2777.10.camel@lin-workstation.azapple.com> On Thu, 2011-08-04 at 13:18 +0200, Martijn wrote: > Hi guys, > > I'm designing and testing a new mail system for our company. While > researching I came across MailScanner and I liked the way of thinking > with putting mail in the hold queue for processing instead of running an > extra SMTP-service like amavisd seems to need. > > But while testing I have come across a quite a few things that don't > seem to work out using the providing documentation. Perhaps anyone could > help solving these, in my particular situation, or upstream where it > applies. I have numbered the issues for easier reference. > > There are a few sections where I may sound a bit frustrated. It's not > personal and I respect what everyone is trying to do with MailScanner. > With the trouble I'm experiencing currently, it's a bit hard for me to > imagine this software is ready for production. I'm seeing messages all > over the web that the software is ready, so I hope I actually did > something stupid and MailScanner is not to 'blame'. > > Little bit of intro: > MailScanner is basically the last thing we're adding to our setup. We > already have a well running system that consists of (currently) Ubuntu > LTS 10.04.2, equipped with Postfix 2.7.0 for SMTP and Dovecot 1.2.9 for > POP3, IMAP (The Dovecot LDA is used). All mail users are virtual. > > I'm completely new to MailScanner and I'm going through the > documentation, eventually ending up at > http://www.mailscanner.info/install_guides.html and more specifically > http://www.mailscanner.info/ubuntu.html > > Issue 1: > I see no date or version numbers mentioned there, except for the > 8.04-part. I would really highly recommend this for all documentation > and blogposts to prevent someone from staring at old docs for hours. Of > course everyone has the intention of keeping docs up to date, but we all > know there are times when it just doesn't happen. > > What I basically do reading documentation like this is: see if I > understand what I'm doing and if that's the case then copy paste the > commands, perhaps edit them if my system is different and then run them. > In this case it's all pretty basic and I'm not aware of anything I need > to edit for it to work, so I just start copy-pasting them. > > Issue 2: > When installing the MailScanner Dependencies I notice that the > documented command doesn't work for me. Unfortunately I don't have any > notes for that part but I remember something about package names not > matching, or needing to install the packages in a specific order instead > of all at once. > > Problem solved, so I continue with the installation getting the latest > .deb from the suggested > http://debian.intergenia.de/debian/pool/main/m/mailscanner/ : > That's mailscanner_4.79.11-2.2_all.deb. > > dpkg -i seems to run well, as well as the steps described under > Configuring MailScanner and ClamAV, until the point I can start mailscanner: > > Issue 3: > Could not read directory /var/spool/MailScanner/incoming at > /usr/share/MailScanner//MailScanner/Config.pm line 2786 > Error in configuration file line 184, directory > /var/spool/MailScanner/incoming for incomingworkdir does not exist (or > is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 3146 > Could not read directory /var/spool/MailScanner/quarantine at > /usr/share/MailScanner//MailScanner/Config.pm line 2786 > Error in configuration file line 188, directory > /var/spool/MailScanner/quarantine for quarantinedir does not exist (or > is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 3146 > > So I check: > root@insular:/var/spool/MailScanner# ls -la > total 24 > drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . > drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. > drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive > drwxr-x--- 3 mail mail 4096 2011-08-04 10:54 incoming > drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 quarantine > drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin > root@insular:/var/spool/MailScanner# > > Everything is there (I noticed the wrong permissions later, I'll get to > that in a minute). Thinking that MailScanner failed to start because of > these errors, I try to start again. /etc/init.d/mailscanner start > returns no output, so I think the directories where created > automatically after the first error and now everything runs well. > > In practice however, MailScanner started the first time dispite the > errors. No idea what happened when I started it a second time. This may > very well confuse a lot of people. > I stop the service, check to see if no MailScanner processes are running > and start fixing the permission problems. > > Issue 4: > Alright so there's a problem with incomingworkdir and quarentinedir. > Both exist, I notice they're owned by mail:mail but MailScanner runs as > the postfix user so that probably is the problem. Although mail:mail is > the Ubuntu default I don't see any ownership changes documented in the > Ubuntu guide. I find an extra doc about Postfix and start going over all > the checks: http://www.mailscanner.info/postfix.html > > Most of the points here are done while going through the Ubuntu steps. > The doc does confirm that the directories need to be owned by > postfix:postfix. I correct the problem and start the service: same error > about directories not existing or not being readable. > > I check the permissions again, and they seem good: > root@insular:/var/spool/MailScanner# ls -la > total 24 > drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . > drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. > drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive > drwxr-x--- 3 postfix postfix 4096 2011-08-04 10:54 incoming > drwxr-x--- 2 postfix postfix 4096 2010-12-09 20:36 quarantine > drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin > root@insular:/var/spool/MailScanner# > > So I'm double checking values in the configuration, and they check out > with what is documented. Now I'm a bit confused and I start checking > general configuration with --lint. > > Issue 5: > Running mailscanner --lint gives me some hints: > "The "envelope_sender_header" in your spam.assassin.prefs.conf is not > correct" > Ok, corrected that. > > Plus, a range of errors because of trouble with the permissions, like: > Could not create SpamAssassin temporary directory > /var/spool/MailScanner/incoming/SpamAssassin-Temp, Permission denied at > /usr/share/MailScanner//MailScanner/SA.pm line 80. > > But no real configuration problems seem to surface. > > Issue 6: > After running mailscanner --lint, permissions on the directories in > /var/spool/MailScanner have changed: > root@insular:/var/spool/MailScanner# ls -la > total 24 > drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . > drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. > drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive > drwxr-x--- 5 postfix clamav 4096 2011-08-04 12:46 incoming > drwxr-x--- 2 postfix postfix 4096 2010-12-09 20:36 quarantine > drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin > root@insular:/var/spool/MailScanner# > > Incoming is now suddenly owned by postfix:clamav. Clamav does happen to > be the only scanner I have installed. If I just start MailScanner > service normally, the permissions change doesn't happen. So I reverse > the change to make sure I'm testing consistently. > > What else can I test? check_mailscanner: > root@insular:/var/spool/MailScanner# check_mailscanner > check_mailscanner: command not found > root@insular:/var/spool/MailScanner# check_MailScanner > check_MailScanner: command not found > root@insular:/var/spool/MailScanner# > > Seems that I'm missing that script. > > Issue 7: > In an earlier try (I'm collecting info on these issues on my second try) > I ended up with a MailScanner that seemed to start without issues, but > no mail came through and I discovered something is wrong in mail.log. > MailScanner seems to be starting every few seconds. If I start > MailScanner on my second try, the same thing happens: > > [...] > Aug 4 12:45:26 insular MailScanner[12221]: Using SpamAssassin results cache > Aug 4 12:45:26 insular MailScanner[12221]: Could not create > SpamAssassin cache database > /var/spool/MailScanner/incoming/SpamAssassin.cache.db > Aug 4 12:45:26 insular MailScanner[12221]: Enabling SpamAssassin > auto-whitelist functionality... > Aug 4 12:46:03 insular MailScanner[12256]: MailScanner E-Mail Virus > Scanner version 4.79.11 starting... > Aug 4 12:46:04 insular MailScanner[12256]: Reading configuration file > /etc/MailScanner/MailScanner.conf > Aug 4 12:46:04 insular MailScanner[12256]: Configuration: Failed to > find any configuration files like /etc/MailScanner/conf.d/*, skipping them. > Aug 4 12:46:04 insular MailScanner[12256]: Read 858 hostnames from the > phishing whitelist > Aug 4 12:46:04 insular MailScanner[12256]: Read 5497 hostnames from the > phishing blacklists > Aug 4 12:46:04 insular MailScanner[12256]: Using SpamAssassin results cache > Aug 4 12:46:04 insular MailScanner[12256]: Could not create > SpamAssassin cache database > /var/spool/MailScanner/incoming/SpamAssassin.cache.db > Aug 4 12:46:04 insular MailScanner[12256]: Enabling SpamAssassin > auto-whitelist functionality... > Aug 4 12:46:06 insular MailScanner[12256]: I have found clamav scanners > installed, and will use them all by default. > Aug 4 12:46:06 insular MailScanner[12256]: Could not create Processing > Attempts Database "/var/spool/MailScanner/incoming/Processing.db" > Aug 4 12:46:06 insular MailScanner[12256]: Incoming Work Dir does not exist > Aug 4 12:46:08 insular MailScanner[12303]: MailScanner E-Mail Virus > Scanner version 4.79.11 starting... > Aug 4 12:46:08 insular MailScanner[12303]: Reading configuration file > /etc/MailScanner/MailScanner.conf > Aug 4 12:46:09 insular MailScanner[12303]: Configuration: Failed to > find any configuration files like /etc/MailScanner/conf.d/*, skipping them. > Aug 4 12:46:09 insular MailScanner[12303]: Read 858 hostnames from the > phishing whitelist > Aug 4 12:46:09 insular MailScanner[12303]: Read 5497 hostnames from the > phishing blacklists > Aug 4 12:46:09 insular MailScanner[12303]: Using SpamAssassin results cache > Aug 4 12:46:09 insular MailScanner[12303]: Could not create > SpamAssassin cache database > /var/spool/MailScanner/incoming/SpamAssassin.cache.db > Aug 4 12:46:09 insular MailScanner[12303]: Enabling SpamAssassin > auto-whitelist functionality... > Aug 4 12:46:28 insular MailScanner[12314]: MailScanner E-Mail Virus > Scanner version 4.79.11 starting... > [...] > > When looking at the process list, the pattern is this: > root@insular:/var/log# ps aux | grep MailScanner > postfix 12553 0.0 1.9 26548 20184 ? SNs 13:03 0:00 > MailScanner: starting children > postfix 12554 74.0 4.8 54996 49740 ? RN 13:03 0:01 > MailScanner: starting children > root 12579 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep > --color=auto MailScanner > root@insular:/var/log# ps aux | grep MailScanner > postfix 12553 0.0 1.9 26548 20184 ? SNs 13:03 0:00 > MailScanner: starting children > postfix 12554 55.0 0.0 0 0 ? ZN 13:03 0:01 > [MailScanner] > root 12602 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep > --color=auto MailScanner > root@insular:/var/log# ps aux | grep MailScanner > postfix 12553 0.3 1.9 26548 20488 ? SNs 13:03 0:00 > MailScanner: starting child > postfix 12603 86.0 3.6 42708 37376 ? RN 13:03 0:00 > MailScanner: starting child > root 12605 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep > --color=auto MailScanner > root@insular:/var/log# > > Starting children, , starting children, etc. > > I've been Googling *a lot* of error strings and problems that I came > across but I never really ended up with answers so this mailing list is > my last resort. Went through a good few months of the mailing list by > hand and didn't really find anything that really is the same as what I'm > experiencing. > > I really would like to stick with MailScanner because I think there's an > advantage in a system that works more transparent then linking a bunch > of SMTP services together. > > Issue 8: > Visiting http://www.mailscanner.info/docs.html as suggested in the > e-mails I get from the mailing list, links "The MailScanner Book" and > "Installation Guides" give me a 404. > > That rounds up all the issues I can remember and reproduce right now. > > Hope that anyone can help me. ---- maybe someone else will take this up with you and give you more specific things but I installed MailScanner on my 10.04 LTS a few weeks ago and it was rather painful. The MailScanner program and this list misses Julian very much. In short, the ubuntu/debian package is extremely old (4.79) and I ended up using the latest beta which solves all sorts of problems with tainting and perl 5.10.x Thus I had to do a few things by hand. I modified the /etc/init.d/mailscanner script a little. This may help assure your mind... # ls -l /var/spool/MailScanner/ total 12 drwxr-x--- 72 postfix clamav 4096 2011-08-04 04:38 incoming drwxr-x--- 6 postfix postfix 4096 2011-08-04 04:02 quarantine drwxr-xr-x 2 postfix postfix 4096 2011-07-27 22:19 spamassassin If you build from source, then it's likely to end up in /opt and then you will have to adjust things like the /etc/init.d/mailscanner script and the cron scripts to point to the installation. I also had to write another script to kill off older MailScanner processes that didn't seem to get killed off each cycle (I think it is by default 20 minutes). I can provide the /etc/init.d/mailscanner script and the extra script if you decide to go with the latest beta tarball (and I would definitely recommend that). Craig From markus at markusoft.se Thu Aug 4 13:02:58 2011 From: markus at markusoft.se (Markus Nilsson) Date: Thu Aug 4 13:03:15 2011 Subject: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 In-Reply-To: <4E3A7FF7.5040107@mindconnect.nl> Message-ID: > Fr?n: "Martijn" > Till: mailscanner@lists.mailscanner.info > Skickat: torsdag, 4 aug 2011 13:18:15 > ?mne: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 > Hi guys, > I'm designing and testing a new mail system for our company. While > researching I came across MailScanner and I liked the way of thinking > with putting mail in the hold queue for processing instead of running > an > extra SMTP-service like amavisd seems to need. > But while testing I have come across a quite a few things that don't > seem to work out using the providing documentation. Perhaps anyone > could > help solving these, in my particular situation, or upstream where it > applies. I have numbered the issues for easier reference. > There are a few sections where I may sound a bit frustrated. It's not > personal and I respect what everyone is trying to do with > MailScanner. > With the trouble I'm experiencing currently, it's a bit hard for me > to > imagine this software is ready for production. I'm seeing messages > all > over the web that the software is ready, so I hope I actually did > something stupid and MailScanner is not to 'blame'. > Little bit of intro: > MailScanner is basically the last thing we're adding to our setup. We > already have a well running system that consists of (currently) > Ubuntu > LTS 10.04.2, equipped with Postfix 2.7.0 for SMTP and Dovecot 1.2.9 > for > POP3, IMAP (The Dovecot LDA is used). All mail users are virtual. > I'm completely new to MailScanner and I'm going through the > documentation, eventually ending up at > http://www.mailscanner.info/install_guides.html and more specifically > http://www.mailscanner.info/ubuntu.html > Issue 1: > I see no date or version numbers mentioned there, except for the > 8.04-part. I would really highly recommend this for all documentation > and blogposts to prevent someone from staring at old docs for hours. > Of > course everyone has the intention of keeping docs up to date, but we > all > know there are times when it just doesn't happen. > What I basically do reading documentation like this is: see if I > understand what I'm doing and if that's the case then copy paste the > commands, perhaps edit them if my system is different and then run > them. > In this case it's all pretty basic and I'm not aware of anything I > need > to edit for it to work, so I just start copy-pasting them. > Issue 2: > When installing the MailScanner Dependencies I notice that the > documented command doesn't work for me. Unfortunately I don't have > any > notes for that part but I remember something about package names not > matching, or needing to install the packages in a specific order > instead > of all at once. > Problem solved, so I continue with the installation getting the > latest > .deb from the suggested > http://debian.intergenia.de/debian/pool/main/m/mailscanner/ : > That's mailscanner_4.79.11-2.2_all.deb. > dpkg -i seems to run well, as well as the steps described under > Configuring MailScanner and ClamAV, until the point I can start > mailscanner: > Issue 3: > Could not read directory /var/spool/MailScanner/incoming at > /usr/share/MailScanner//MailScanner/Config.pm line 2786 > Error in configuration file line 184, directory > /var/spool/MailScanner/incoming for incomingworkdir does not exist > (or > is not readable) at /usr/share/MailScanner//MailScanner/Config.pm > line 3146 > Could not read directory /var/spool/MailScanner/quarantine at > /usr/share/MailScanner//MailScanner/Config.pm line 2786 > Error in configuration file line 188, directory > /var/spool/MailScanner/quarantine for quarantinedir does not exist > (or > is not readable) at /usr/share/MailScanner//MailScanner/Config.pm > line 3146 > So I check: > root@insular:/var/spool/MailScanner# ls -la > total 24 > drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . > drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. > drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive > drwxr-x--- 3 mail mail 4096 2011-08-04 10:54 incoming > drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 quarantine > drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin > root@insular:/var/spool/MailScanner# > Everything is there (I noticed the wrong permissions later, I'll get > to > that in a minute). Thinking that MailScanner failed to start because > of > these errors, I try to start again. /etc/init.d/mailscanner start > returns no output, so I think the directories where created > automatically after the first error and now everything runs well. > In practice however, MailScanner started the first time dispite the > errors. No idea what happened when I started it a second time. This > may > very well confuse a lot of people. > I stop the service, check to see if no MailScanner processes are > running > and start fixing the permission problems. > Issue 4: > Alright so there's a problem with incomingworkdir and quarentinedir. > Both exist, I notice they're owned by mail:mail but MailScanner runs > as > the postfix user so that probably is the problem. Although mail:mail > is > the Ubuntu default I don't see any ownership changes documented in > the > Ubuntu guide. I find an extra doc about Postfix and start going over > all > the checks: http://www.mailscanner.info/postfix.html > Most of the points here are done while going through the Ubuntu > steps. > The doc does confirm that the directories need to be owned by > postfix:postfix. I correct the problem and start the service: same > error > about directories not existing or not being readable. > I check the permissions again, and they seem good: > root@insular:/var/spool/MailScanner# ls -la > total 24 > drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . > drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. > drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive > drwxr-x--- 3 postfix postfix 4096 2011-08-04 10:54 incoming > drwxr-x--- 2 postfix postfix 4096 2010-12-09 20:36 quarantine > drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin > root@insular:/var/spool/MailScanner# > So I'm double checking values in the configuration, and they check > out > with what is documented. Now I'm a bit confused and I start checking > general configuration with --lint. > Issue 5: > Running mailscanner --lint gives me some hints: > "The "envelope_sender_header" in your spam.assassin.prefs.conf is not > correct" > Ok, corrected that. > Plus, a range of errors because of trouble with the permissions, > like: > Could not create SpamAssassin temporary directory > /var/spool/MailScanner/incoming/SpamAssassin-Temp, Permission denied > at > /usr/share/MailScanner//MailScanner/SA.pm line 80. > But no real configuration problems seem to surface. > Issue 6: > After running mailscanner --lint, permissions on the directories in > /var/spool/MailScanner have changed: > root@insular:/var/spool/MailScanner# ls -la > total 24 > drwxr-x--- 6 mail mail 4096 2011-08-04 10:46 . > drwxr-xr-x 8 root root 4096 2011-08-04 10:40 .. > drwxr-x--- 2 mail mail 4096 2010-12-09 20:36 archive > drwxr-x--- 5 postfix clamav 4096 2011-08-04 12:46 incoming > drwxr-x--- 2 postfix postfix 4096 2010-12-09 20:36 quarantine > drwxr-xr-x 2 postfix root 4096 2011-08-04 10:46 spamassassin > root@insular:/var/spool/MailScanner# > Incoming is now suddenly owned by postfix:clamav. Clamav does happen > to > be the only scanner I have installed. If I just start MailScanner > service normally, the permissions change doesn't happen. So I reverse > the change to make sure I'm testing consistently. > What else can I test? check_mailscanner: > root@insular:/var/spool/MailScanner# check_mailscanner > check_mailscanner: command not found > root@insular:/var/spool/MailScanner# check_MailScanner > check_MailScanner: command not found > root@insular:/var/spool/MailScanner# > Seems that I'm missing that script. > Issue 7: > In an earlier try (I'm collecting info on these issues on my second > try) > I ended up with a MailScanner that seemed to start without issues, > but > no mail came through and I discovered something is wrong in mail.log. > MailScanner seems to be starting every few seconds. If I start > MailScanner on my second try, the same thing happens: > [...] > Aug 4 12:45:26 insular MailScanner[12221]: Using SpamAssassin results > cache > Aug 4 12:45:26 insular MailScanner[12221]: Could not create > SpamAssassin cache database > /var/spool/MailScanner/incoming/SpamAssassin.cache.db > Aug 4 12:45:26 insular MailScanner[12221]: Enabling SpamAssassin > auto-whitelist functionality... > Aug 4 12:46:03 insular MailScanner[12256]: MailScanner E-Mail Virus > Scanner version 4.79.11 starting... > Aug 4 12:46:04 insular MailScanner[12256]: Reading configuration file > /etc/MailScanner/MailScanner.conf > Aug 4 12:46:04 insular MailScanner[12256]: Configuration: Failed to > find any configuration files like /etc/MailScanner/conf.d/*, skipping > them. > Aug 4 12:46:04 insular MailScanner[12256]: Read 858 hostnames from > the > phishing whitelist > Aug 4 12:46:04 insular MailScanner[12256]: Read 5497 hostnames from > the > phishing blacklists > Aug 4 12:46:04 insular MailScanner[12256]: Using SpamAssassin results > cache > Aug 4 12:46:04 insular MailScanner[12256]: Could not create > SpamAssassin cache database > /var/spool/MailScanner/incoming/SpamAssassin.cache.db > Aug 4 12:46:04 insular MailScanner[12256]: Enabling SpamAssassin > auto-whitelist functionality... > Aug 4 12:46:06 insular MailScanner[12256]: I have found clamav > scanners > installed, and will use them all by default. > Aug 4 12:46:06 insular MailScanner[12256]: Could not create > Processing > Attempts Database "/var/spool/MailScanner/incoming/Processing.db" > Aug 4 12:46:06 insular MailScanner[12256]: Incoming Work Dir does not > exist > Aug 4 12:46:08 insular MailScanner[12303]: MailScanner E-Mail Virus > Scanner version 4.79.11 starting... > Aug 4 12:46:08 insular MailScanner[12303]: Reading configuration file > /etc/MailScanner/MailScanner.conf > Aug 4 12:46:09 insular MailScanner[12303]: Configuration: Failed to > find any configuration files like /etc/MailScanner/conf.d/*, skipping > them. > Aug 4 12:46:09 insular MailScanner[12303]: Read 858 hostnames from > the > phishing whitelist > Aug 4 12:46:09 insular MailScanner[12303]: Read 5497 hostnames from > the > phishing blacklists > Aug 4 12:46:09 insular MailScanner[12303]: Using SpamAssassin results > cache > Aug 4 12:46:09 insular MailScanner[12303]: Could not create > SpamAssassin cache database > /var/spool/MailScanner/incoming/SpamAssassin.cache.db > Aug 4 12:46:09 insular MailScanner[12303]: Enabling SpamAssassin > auto-whitelist functionality... > Aug 4 12:46:28 insular MailScanner[12314]: MailScanner E-Mail Virus > Scanner version 4.79.11 starting... > [...] > When looking at the process list, the pattern is this: > root@insular:/var/log# ps aux | grep MailScanner > postfix 12553 0.0 1.9 26548 20184 ? SNs 13:03 0:00 > MailScanner: starting children > postfix 12554 74.0 4.8 54996 49740 ? RN 13:03 0:01 > MailScanner: starting children > root 12579 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep > --color=auto MailScanner > root@insular:/var/log# ps aux | grep MailScanner > postfix 12553 0.0 1.9 26548 20184 ? SNs 13:03 0:00 > MailScanner: starting children > postfix 12554 55.0 0.0 0 0 ? ZN 13:03 0:01 > [MailScanner] > root 12602 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep > --color=auto MailScanner > root@insular:/var/log# ps aux | grep MailScanner > postfix 12553 0.3 1.9 26548 20488 ? SNs 13:03 0:00 > MailScanner: starting child > postfix 12603 86.0 3.6 42708 37376 ? RN 13:03 0:00 > MailScanner: starting child > root 12605 0.0 0.0 3324 796 pts/5 S+ 13:03 0:00 grep > --color=auto MailScanner > root@insular:/var/log# > Starting children, , starting children, etc. > I've been Googling *a lot* of error strings and problems that I came > across but I never really ended up with answers so this mailing list > is > my last resort. Went through a good few months of the mailing list by > hand and didn't really find anything that really is the same as what > I'm > experiencing. > I really would like to stick with MailScanner because I think there's > an > advantage in a system that works more transparent then linking a > bunch > of SMTP services together. > Issue 8: > Visiting http://www.mailscanner.info/docs.html as suggested in the > e-mails I get from the mailing list, links "The MailScanner Book" and > "Installation Guides" give me a 404. > That rounds up all the issues I can remember and reproduce right now. > Hope that anyone can help me. > Thanks in advance, > - Martijn > -- Hi Martijn Relating the directory permissions, maybe you need to review your configuration settings for the work dirs? See the well-commented configuration file under the section # # Incoming Work Dir Settings # -------------------------- # I'm guessing you want something like: Incoming Work User = postfix Incoming Work Group = postfix Incoming Work Permissions = 0660 Also check what group your clam scanner is using, so that is configured with the same group! (I.e if the clamd group is clamav, the group above should be clamav instead!) /Markus From tc at sommersoft.de Thu Aug 4 13:31:53 2011 From: tc at sommersoft.de (Tim Cappell) Date: Thu Aug 4 13:32:05 2011 Subject: RBL checks when some mail is received via a relay Message-ID: We have a Mailscanner setup where some of the mails (from an older domain) are received by a relay (which is not blacklisted). Mailscanner works fine for all the mails we receive directly but RBL checks do not apply to those mails sent via the relay (which is still about 50%). Thus there are a lot of spam mails that get through although the originating mail server is blacklisted. Is there a way to apply a method similar to "Read IP Address From Received Header" _only_ to mails where the last hop is that specific relay server? Best regards, Tim Cappell -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110804/06ee3cd5/attachment.html From maxsec at gmail.com Thu Aug 4 18:56:53 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Aug 4 18:57:03 2011 Subject: RBL checks when some mail is received via a relay In-Reply-To: References: Message-ID: Why are the emails from this relay being trusted? Have you whitelisted it or something? Martin On Thursday, 4 August 2011, Tim Cappell wrote: > We have a Mailscanner setup where some of the mails (from an older domain) are received by a relay (which is not blacklisted). Mailscanner works fine for all the mails we receive directly but RBL checks do not apply to those mails sent via the relay (which is still about 50%). Thus there are a lot of spam mails that get through although the originating mail server is blacklisted. > > Is there a way to apply a method similar to ?Read IP Address From Received Header? _only_ to mails where the last hop is that specific relay server? > > > > Best regards, > > > > Tim Cappell -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110804/095105b0/attachment.html From tc at sommersoft.de Fri Aug 5 14:49:16 2011 From: tc at sommersoft.de (Tim Cappell) Date: Fri Aug 5 14:49:27 2011 Subject: AW: RBL checks when some mail is received via a relay In-Reply-To: References: Message-ID: Hi, No the relay is not whitelisted. As far as I understand, Mailscanner only queries RBLs for the last relay server which in this case is not blacklisted in any RBL. To clarify my situation I'll try to visualize our current mail flow: 1) Domain.old: Sender -> mx.old -> mx.new with Mailscanner 2) Domain.new: Sender -> mx.new with Mailscanner The problem is with part 1) of this setup, because all RBL checks are performed against mx.old which is a "good" server. I would need a setup where Mailscanner uses "Read IP Address From Received Header = 2" for situation 1) and "Read IP Address From Received Header = no" for situation 2). I don't know if this is possible so I'm also looking for alternate suggestions. Tim Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Martin Hepworth Gesendet: Donnerstag, 4. August 2011 19:57 An: MailScanner discussion Betreff: Re: RBL checks when some mail is received via a relay Why are the emails from this relay being trusted? Have you whitelisted it or something? Martin On Thursday, 4 August 2011, Tim Cappell wrote: > We have a Mailscanner setup where some of the mails (from an older domain) are received by a relay (which is not blacklisted). Mailscanner works fine for all the mails we receive directly but RBL checks do not apply to those mails sent via the relay (which is still about 50%). Thus there are a lot of spam mails that get through although the originating mail server is blacklisted. > > Is there a way to apply a method similar to "Read IP Address From Received Header" _only_ to mails where the last hop is that specific relay server? > > ? > > Best regards, > > ? > > Tim Cappell -- -- Martin Hepworth Oxford, UK From jeremy at fluxlabs.net Fri Aug 5 14:53:01 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Fri Aug 5 14:53:25 2011 Subject: AW: RBL checks when some mail is received via a relay In-Reply-To: References: Message-ID: <835C3877-3068-4F46-8142-58A117911C20@fluxlabs.net> If you have control of the domain, by not deliver directly instead if through the relay? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 5, 2011, at 8:50 AM, "Tim Cappell" wrote: > Hi, > > No the relay is not whitelisted. As far as I understand, Mailscanner only queries RBLs for the last relay server which in this case is not blacklisted in any RBL. > To clarify my situation I'll try to visualize our current mail flow: > > 1) Domain.old: Sender -> mx.old -> mx.new with Mailscanner > 2) Domain.new: Sender -> mx.new with Mailscanner > > The problem is with part 1) of this setup, because all RBL checks are performed against mx.old which is a "good" server. > I would need a setup where Mailscanner uses "Read IP Address From Received Header = 2" for situation 1) and "Read IP Address From Received Header = no" for situation 2). > I don't know if this is possible so I'm also looking for alternate suggestions. > > Tim > > > > Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Martin Hepworth > Gesendet: Donnerstag, 4. August 2011 19:57 > An: MailScanner discussion > Betreff: Re: RBL checks when some mail is received via a relay > > Why are the emails from this relay being trusted? Have you whitelisted it or something? > > Martin > > On Thursday, 4 August 2011, Tim Cappell wrote: >> We have a Mailscanner setup where some of the mails (from an older domain) are received by a relay (which is not blacklisted). Mailscanner works fine for all the mails we receive directly but RBL checks do not apply to those mails sent via the relay (which is still about 50%). Thus there are a lot of spam mails that get through although the originating mail server is blacklisted. >> >> Is there a way to apply a method similar to "Read IP Address From Received Header" _only_ to mails where the last hop is that specific relay server? >> >> >> >> Best regards, >> >> >> >> Tim Cappell > > -- > -- > Martin Hepworth > Oxford, UK > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From tc at sommersoft.de Fri Aug 5 15:12:39 2011 From: tc at sommersoft.de (Tim Cappell) Date: Fri Aug 5 15:12:49 2011 Subject: AW: RBL checks when some mail is received via a relay In-Reply-To: <835C3877-3068-4F46-8142-58A117911C20@fluxlabs.net> References: <835C3877-3068-4F46-8142-58A117911C20@fluxlabs.net> Message-ID: That's not possible, but I have to clarify some more (should have done that from the start, I'm sorry): The company split up into 3 new companies. From those three we manage the IT of one and we do not have control over the old domain. Furthermore the admin who is in control of the old domain seems unwilling or unable to help. So the only thing he does is forward mails to certain old E-Mail accounts to us and we have to sort out the mess. If he would just implement a RBL check on his end everything would be fine. Tim -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: Friday, August 05, 2011 3:53 PM To: MailScanner discussion Subject: Re: AW: RBL checks when some mail is received via a relay If you have control of the domain, by not deliver directly instead if through the relay? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From markus at markusoft.se Fri Aug 5 15:17:42 2011 From: markus at markusoft.se (Markus Nilsson) Date: Fri Aug 5 15:18:07 2011 Subject: AW: RBL checks when some mail is received via a relay In-Reply-To: Message-ID: <6dce9c68-5037-4204-8337-cd689faccb8c@cronlabworkstation0> Hi! Are you doing RBL checks in MS or in SA? If you are doing it in SA, you need to setup TrustPath correctly in SA, see: http://wiki.apache.org/spamassassin/TrustPath Why doesn't SpamAssassin default to not trusting any hosts? Well, trusting too few is in many ways just as bad as trusting too many. Many SpamAssassin rules try to perform checks against the untrusted host that delivered mail to the first trusted server. If there's too few or too many hosts that SA trusts, these tests will be examining the wrong host. Both situations contribute greatly to false negative problems, and to a lesser extent false positive problems Adding mx.old to the config trusted_networks In your spamassassin.conf might be what you need! /Markus ----- Ursprungligt meddelande ----- Fr?n: "Tim Cappell" Till: "MailScanner discussion" Skickat: fredag, 5 aug 2011 15:49:16 ?mne: AW: RBL checks when some mail is received via a relay Hi, No the relay is not whitelisted. As far as I understand, Mailscanner only queries RBLs for the last relay server which in this case is not blacklisted in any RBL. To clarify my situation I'll try to visualize our current mail flow: 1) Domain.old: Sender -> mx.old -> mx.new with Mailscanner 2) Domain.new: Sender -> mx.new with Mailscanner The problem is with part 1) of this setup, because all RBL checks are performed against mx.old which is a "good" server. I would need a setup where Mailscanner uses "Read IP Address From Received Header = 2" for situation 1) and "Read IP Address From Received Header = no" for situation 2). I don't know if this is possible so I'm also looking for alternate suggestions. Tim Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Martin Hepworth Gesendet: Donnerstag, 4. August 2011 19:57 An: MailScanner discussion Betreff: Re: RBL checks when some mail is received via a relay Why are the emails from this relay being trusted? Have you whitelisted it or something? Martin On Thursday, 4 August 2011, Tim Cappell wrote: > We have a Mailscanner setup where some of the mails (from an older domain) are received by a relay (which is not blacklisted). Mailscanner works fine for all the mails we receive directly but RBL checks do not apply to those mails sent via the relay (which is still about 50%). Thus there are a lot of spam mails that get through although the originating mail server is blacklisted. > > Is there a way to apply a method similar to "Read IP Address From Received Header" _only_ to mails where the last hop is that specific relay server? > > > > Best regards, > > > > Tim Cappell -- -- Martin Hepworth Oxford, UK -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110805/1d0a7c4a/attachment.html From jeremy at fluxlabs.net Fri Aug 5 15:18:07 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Fri Aug 5 15:19:00 2011 Subject: AW: RBL checks when some mail is received via a relay In-Reply-To: References: <835C3877-3068-4F46-8142-58A117911C20@fluxlabs.net> Message-ID: <49B80714-0F24-4B03-BBA3-E62FA2C64661@fluxlabs.net> Transfer the domain since the old tech is unwilling to cooperate. Rather than trying to find a work-around; do it correctly. Split or not split, the company should own their own domains. If your managing the email, you need control of routing. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 5, 2011, at 9:13 AM, Tim Cappell wrote: > That's not possible, but I have to clarify some more (should have done that from the start, I'm sorry): > The company split up into 3 new companies. From those three we manage the IT of one and we do not have control over the old domain. Furthermore the admin who is in control of the old domain seems unwilling or unable to help. So the only thing he does is forward mails to certain old E-Mail accounts to us and we have to sort out the mess. If he would just implement a RBL check on his end everything would be fine. > > Tim > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden > Sent: Friday, August 05, 2011 3:53 PM > To: MailScanner discussion > Subject: Re: AW: RBL checks when some mail is received via a relay > > If you have control of the domain, by not deliver directly instead if through the relay? > > -- > Jeremy McSpadden > Flux Labs, Inc > http://www.fluxlabs.net > Endless Solutions > Office : 850-588-4626 > Cell : 850-890-2543 > Fax : 850-254-2955 > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From tc at sommersoft.de Fri Aug 5 15:45:36 2011 From: tc at sommersoft.de (Tim Cappell) Date: Fri Aug 5 15:45:47 2011 Subject: AW: RBL checks when some mail is received via a relay In-Reply-To: <6dce9c68-5037-4204-8337-cd689faccb8c@cronlabworkstation0> References: <6dce9c68-5037-4204-8337-cd689faccb8c@cronlabworkstation0> Message-ID: Hi, I just added that to the spam.assassin.prefs.conf and will see how it goes. Thank you all for your input, I'll be sure to report back with results. Tim From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Markus Nilsson Sent: Friday, August 05, 2011 4:18 PM To: MailScanner discussion Subject: Re: AW: RBL checks when some mail is received via a relay Hi! Are you doing RBL checks in MS or in SA? If you are doing it in SA, you need to setup TrustPath correctly in SA, see: http://wiki.apache.org/spamassassin/TrustPath Why doesn't SpamAssassin default to not trusting any hosts? Well, trusting too few is in many ways just as bad as trusting too many. Many SpamAssassin rules try to perform checks against the untrusted host that delivered mail to the first trusted server. If there's too few or too many hosts that SA trusts, these tests will be examining the wrong host. Both situations contribute greatly to false negative problems, and to a lesser extent false positive problems Adding mx.old to the config trusted_networks In your spamassassin.conf might be what you need! /Markus From Chris at ChrisBailey.au.com Sat Aug 6 07:09:49 2011 From: Chris at ChrisBailey.au.com (Christopher M Bailey) Date: Sat Aug 6 07:10:08 2011 Subject: SpamAss error Message-ID: <1312610995.1956.3.camel@localhost> Hi All, I've just reinstalled SA, ClamAV and MS but when I run MailScanner --lint I get the following error:- Connected to SpamAssassin cache database config: failed to parse line, skipping, in "/etc/mail/spamassassin/mailscanner.cf": use_auto_whitelist 0 SpamAssassin reported an error. As far as I can tell the line it is pointing to is fine. Anyone got any ideas? TIA Chris From stephencoxmail at gmail.com Sat Aug 6 08:06:32 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Sat Aug 6 08:06:42 2011 Subject: SpamAss error In-Reply-To: <1312610995.1956.3.camel@localhost> References: <1312610995.1956.3.camel@localhost> Message-ID: On Aug 6, 2011 8:13 AM, "Christopher M Bailey" wrote: > > Hi All, > > I've just reinstalled SA, ClamAV and MS but when I run MailScanner > --lint I get the following error:- > > Connected to SpamAssassin cache database > config: failed to parse line, skipping, in > "/etc/mail/spamassassin/mailscanner.cf": use_auto_whitelist 0 Try commenting out the line > SpamAssassin reported an error. > > As far as I can tell the line it is pointing to is fine. > > Anyone got any ideas? > > TIA > Chris > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110806/a469f5dc/attachment.html From mailinglist at mindconnect.nl Sat Aug 6 11:40:39 2011 From: mailinglist at mindconnect.nl (Martijn) Date: Sat Aug 6 11:40:57 2011 Subject: SpamAss error In-Reply-To: <1312610995.1956.3.camel@localhost> References: <1312610995.1956.3.camel@localhost> Message-ID: <4E3D1A27.5030204@mindconnect.nl> On 6-8-2011 8:09, Christopher M Bailey wrote: > I've just reinstalled SA, ClamAV and MS but when I run MailScanner > --lint I get the following error:- > > Connected to SpamAssassin cache database > config: failed to parse line, skipping, in > "/etc/mail/spamassassin/mailscanner.cf": use_auto_whitelist 0 > SpamAssassin reported an error. > > As far as I can tell the line it is pointing to is fine. Hi Chris, If forgot to mention this in my recent post, but I got the same warning. On http://wiki.apache.org/spamassassin/AutoWhitelist I found this: "In 3.3, the plugin is not loaded by default." If the plugin isn't loaded, SA probably doesn't know what to do with that setting. Hope that solves your problem. - Martijn From maxsec at gmail.com Sat Aug 6 13:31:29 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Sat Aug 6 13:31:37 2011 Subject: SpamAss error In-Reply-To: <4E3D1A27.5030204@mindconnect.nl> References: <1312610995.1956.3.camel@localhost> <4E3D1A27.5030204@mindconnect.nl> Message-ID: Need to enable the plugin first to use that setting. Personnally I'd keep it disabled and comment out the line due to issues with aw false positives I've had in the past Martin On Saturday, 6 August 2011, Martijn wrote: > On 6-8-2011 8:09, Christopher M Bailey wrote: >> >> I've just reinstalled SA, ClamAV and MS but when I run MailScanner >> --lint I get the following error:- >> >> Connected to SpamAssassin cache database >> config: failed to parse line, skipping, in >> "/etc/mail/spamassassin/mailscanner.cf": use_auto_whitelist 0 >> SpamAssassin reported an error. >> >> As far as I can tell the line it is pointing to is fine. > > Hi Chris, > > If forgot to mention this in my recent post, but I got the same warning. On http://wiki.apache.org/spamassassin/AutoWhitelist I found this: > > "In 3.3, the plugin is not loaded by default." > > If the plugin isn't loaded, SA probably doesn't know what to do with that setting. > > Hope that solves your problem. > > - Martijn > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110806/20354ace/attachment.html From bjron.mork at gmail.com Mon Aug 8 07:28:39 2011 From: bjron.mork at gmail.com (Bjorn Mork) Date: Mon Aug 8 07:28:50 2011 Subject: MailScanner RBL Check for specific ip subnet Message-ID: Hi everybody, I have two Public IP subnet, and I want that MailScanner must check spamhaus or spamcop for IP pool 1, and it should allow my IP pool 2 without any black list checking. Anti-Spamming feature other than black list checking must apply for both IP pool Is this possible via MailScanner ? Regards, B~Mork -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110808/0dde3413/attachment.html From mailinglist at mindconnect.nl Mon Aug 8 15:14:53 2011 From: mailinglist at mindconnect.nl (Martijn) Date: Mon Aug 8 15:15:14 2011 Subject: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 (reply to Craig and Markus) In-Reply-To: <201108051102.p75B0SoT018228@safir.blacknight.ie> References: <201108051102.p75B0SoT018228@safir.blacknight.ie> Message-ID: <4E3FEF5D.2030701@mindconnect.nl> Sorry this reply won't be threaded correctly, I accidently set up my subscription as a digest so I couldn't respond to individual replies. For reference, my original post is here and I'm looking for hints and tips as to how to solve this problem, as are other (potential) users of MailScanner. http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098228.html And I'm replying to these: http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098229.html http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098230.html > Date: Thu, 04 Aug 2011 04:43:18 -0700 > From: Craig White > Subject: Re: Bunch of issues with installing MailScanner on Ubuntu LTS > 10.04 > > maybe someone else will take this up with you and give you more specific > things but I installed MailScanner on my 10.04 LTS a few weeks ago and > it was rather painful. The MailScanner program and this list misses > Julian very much. > > In short, the ubuntu/debian package is extremely old (4.79) and I ended > up using the latest beta which solves all sorts of problems with > tainting and perl 5.10.x > > Thus I had to do a few things by hand. > > [...] > I can provide the /etc/init.d/mailscanner script and the extra script if > you decide to go with the latest beta tarball (and I would definitely > recommend that). > > Craig Thanks Craig, I'll let you know if I'd like to have those. I was hoping to stick to installing from a reputable (Debian/Ubuntu) repository though. I have to see if it's worth the trouble. For the record: you did try running a recent/non-beta version first, right? Did anyone attempt to construct a newer .deb? > Date: Thu, 04 Aug 2011 14:02:58 +0200 (CEST) > From: Markus Nilsson > Subject: Re: Bunch of issues with installing MailScanner on Ubuntu LTS > 10.04 > > Hi Martijn > > Relating the directory permissions, maybe you need to review your configuration settings for the work dirs? See the well-commented configuration file under the section > > # > # Incoming Work Dir Settings > # -------------------------- > # > > I'm guessing you want something like: > Incoming Work User = postfix > Incoming Work Group = postfix > Incoming Work Permissions = 0660 > > Also check what group your clam scanner is using, so that is configured with the same group! > (I.e if the clamd group is clamav, the group above should be clamav instead!) > > > /Markus I have reviews the settings, they currently are: Incoming Work User = Incoming Work Group = clamav Incoming Work Permissions = 640 So, user is empty. I believe that means that it defaults to the 'Run As User' value. Clamav is actually working as the clamav user in de clamav group. To test, I changed permissies on /var/spool/MailScanner/incoming to 777, but that still results in the same error: Could not read directory /var/spool/MailScanner/incoming at /usr/share/MailScanner//MailScanner/Config.pm line 2786 Error in configuration file line 184, directory /var/spool/MailScanner/incoming for incomingworkdir does not exist (or is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 3146 Could not read directory /var/spool/MailScanner/quarantine at /usr/share/MailScanner//MailScanner/Config.pm line 2786 Error in configuration file line 188, directory /var/spool/MailScanner/quarantine for quarantinedir does not exist (or is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 3146 Thanks, - Martijn From markus at markusoft.se Mon Aug 8 15:43:26 2011 From: markus at markusoft.se (Markus Nilsson) Date: Mon Aug 8 15:43:41 2011 Subject: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 (reply to Craig and Markus) In-Reply-To: <4E3FEF5D.2030701@mindconnect.nl> Message-ID: <98a4e7da-c245-491e-a7ed-c555f7a4bbe9@cronlabworkstation0> ----- Ursprungligt meddelande ----- > Fr?n: "Martijn" > Till: mailscanner@lists.mailscanner.info > Skickat: m?ndag, 8 aug 2011 16:14:53 > ?mne: Re: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 (reply to Craig and Markus) > > Sorry this reply won't be threaded correctly, I accidently set up my > subscription as a digest so I couldn't respond to individual replies. > > For reference, my original post is here and I'm looking for hints and > tips as to how to solve this problem, as are other (potential) users > of > MailScanner. > http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098228.html > > And I'm replying to these: > http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098229.html > http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098230.html > > > Date: Thu, 04 Aug 2011 04:43:18 -0700 > > From: Craig White > > Subject: Re: Bunch of issues with installing MailScanner on Ubuntu > > LTS > > 10.04 > > > > maybe someone else will take this up with you and give you more > > specific > > things but I installed MailScanner on my 10.04 LTS a few weeks ago > > and > > it was rather painful. The MailScanner program and this list misses > > Julian very much. > > > > In short, the ubuntu/debian package is extremely old (4.79) and I > > ended > > up using the latest beta which solves all sorts of problems with > > tainting and perl 5.10.x > > > > Thus I had to do a few things by hand. > > > > [...] > > I can provide the /etc/init.d/mailscanner script and the extra > > script if > > you decide to go with the latest beta tarball (and I would > > definitely > > recommend that). > > > > Craig > Thanks Craig, I'll let you know if I'd like to have those. I was > hoping > to stick to installing from a reputable (Debian/Ubuntu) repository > though. I have to see if it's worth the trouble. > > For the record: you did try running a recent/non-beta version first, > right? Did anyone attempt to construct a newer .deb? > There is one newer package for debian: http://lists.mailscanner.info/pipermail/mailscanner/2011-March/097689.html However, no-one has yet stepped in to maintain the debian packaging. > > > > Date: Thu, 04 Aug 2011 14:02:58 +0200 (CEST) > > From: Markus Nilsson > > Subject: Re: Bunch of issues with installing MailScanner on Ubuntu > > LTS > > 10.04 > > > > Hi Martijn > > > > Relating the directory permissions, maybe you need to review your > > configuration settings for the work dirs? See the well-commented > > configuration file under the section > > > > # > > # Incoming Work Dir Settings > > # -------------------------- > > # > > > > I'm guessing you want something like: > > Incoming Work User = postfix > > Incoming Work Group = postfix > > Incoming Work Permissions = 0660 > > > > Also check what group your clam scanner is using, so that is > > configured with the same group! > > (I.e if the clamd group is clamav, the group above should be clamav > > instead!) > > > > > > /Markus > I have reviews the settings, they currently are: > > Incoming Work User = > Incoming Work Group = clamav > Incoming Work Permissions = 640 > > So, user is empty. I believe that means that it defaults to the 'Run > As > User' value. > Clamav is actually working as the clamav user in de clamav group. > And what is your Run As User and Run As Group values? If the Run As Group value is postfix, maybe clamav will need to be added to this group. adduser clamav postfix I have a different setup for my servers, with a unique group for the quarantine, to which I have added the required users. Just to make sure :) The folders do exist, right? Maybe show the output from ls -l /var/spool/MailScanner /Markus > To test, I changed permissies on /var/spool/MailScanner/incoming to > 777, > but that still results in the same error: > > Could not read directory /var/spool/MailScanner/incoming at > /usr/share/MailScanner//MailScanner/Config.pm line 2786 > Error in configuration file line 184, directory > /var/spool/MailScanner/incoming for incomingworkdir does not exist > (or > is not readable) at /usr/share/MailScanner//MailScanner/Config.pm > line 3146 > Could not read directory /var/spool/MailScanner/quarantine at > /usr/share/MailScanner//MailScanner/Config.pm line 2786 > Error in configuration file line 188, directory > /var/spool/MailScanner/quarantine for quarantinedir does not exist > (or > is not readable) at /usr/share/MailScanner//MailScanner/Config.pm > line 3146 > > Thanks, > - Martijn > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > From ecasarero at gmail.com Mon Aug 8 17:34:46 2011 From: ecasarero at gmail.com (Eduardo Casarero) Date: Mon Aug 8 17:35:12 2011 Subject: Quarantine an email by size and notify. Message-ID: Hi everybody, I have a request from my boss asking if it is possible to quarantine an email by its size (using max.size.rules) and send a notification to the destination email or an administrator. The rule works ok, but the issue is with the action, i could not find any workaround. I did search old emails in the mailling list and some wide range google search but the only thing i found was a thread from uxbod writing about a perl plugin to use ZendTo but with no "ready for production" solutions. The behaviour we need is: Email arrives to MS, MS detects it's too big, MS reads action (says too big put in quarantine and notify), MS saves in quarantine, MS notifies destination. I am already having a discussion about how usefull would this be, but i would like to have a workaround or something just in case. Any idea would be appreciated! Thanks Eduardo. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110808/70c637cf/attachment.html From maxsec at gmail.com Mon Aug 8 20:14:38 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Mon Aug 8 20:14:48 2011 Subject: Quarantine an email by size and notify. In-Reply-To: References: Message-ID: There's the compress over certain size option but no direct quarantine on size other than the zendto option which works quote well frOm what Iftar Martin On Monday, 8 August 2011, Eduardo Casarero wrote: > Hi everybody, > I have a request from my boss asking if it is possible to quarantine an email by its size (using max.size.rules) and send a notification to the destination email or an administrator. The rule works ok, but the issue is with the action, i could not find any workaround. I did search old emails in the mailling list and some wide range google search but the only thing i found was a thread from uxbod writing about a perl plugin to use ZendTo but with no "ready for production" solutions. > The behaviour we need is: > Email arrives to MS, MS detects it's too big, MS reads action (says too big put in quarantine and notify), MS saves in quarantine, MS notifies destination. > I am already having a discussion about how usefull would this be, but i would like to have a workaround or something just in case. > Any idea would be appreciated! > Thanks > Eduardo. > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110808/ce7d055e/attachment.html From craigwhite at azapple.com Tue Aug 9 04:00:49 2011 From: craigwhite at azapple.com (Craig White) Date: Tue Aug 9 04:03:09 2011 Subject: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 (reply to Craig and Markus) In-Reply-To: <4E3FEF5D.2030701@mindconnect.nl> References: <201108051102.p75B0SoT018228@safir.blacknight.ie> <4E3FEF5D.2030701@mindconnect.nl> Message-ID: <1312858849.3132.57.camel@lin-workstation.azapple.com> On Mon, 2011-08-08 at 16:14 +0200, Martijn wrote: > Sorry this reply won't be threaded correctly, I accidently set up my > subscription as a digest so I couldn't respond to individual replies. > > For reference, my original post is here and I'm looking for hints and > tips as to how to solve this problem, as are other (potential) users of > MailScanner. > http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098228.html > > And I'm replying to these: > http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098229.html > http://lists.mailscanner.info/pipermail/mailscanner/2011-August/098230.html > > > Date: Thu, 04 Aug 2011 04:43:18 -0700 > > From: Craig White > > Subject: Re: Bunch of issues with installing MailScanner on Ubuntu LTS > > 10.04 > > > > maybe someone else will take this up with you and give you more specific > > things but I installed MailScanner on my 10.04 LTS a few weeks ago and > > it was rather painful. The MailScanner program and this list misses > > Julian very much. > > > > In short, the ubuntu/debian package is extremely old (4.79) and I ended > > up using the latest beta which solves all sorts of problems with > > tainting and perl 5.10.x > > > > Thus I had to do a few things by hand. > > > > [...] > > I can provide the /etc/init.d/mailscanner script and the extra script if > > you decide to go with the latest beta tarball (and I would definitely > > recommend that). > > > > Craig > Thanks Craig, I'll let you know if I'd like to have those. I was hoping > to stick to installing from a reputable (Debian/Ubuntu) repository > though. I have to see if it's worth the trouble. > > For the record: you did try running a recent/non-beta version first, > right? Did anyone attempt to construct a newer .deb? > > > > > Date: Thu, 04 Aug 2011 14:02:58 +0200 (CEST) > > From: Markus Nilsson > > Subject: Re: Bunch of issues with installing MailScanner on Ubuntu LTS > > 10.04 > > > > Hi Martijn > > > > Relating the directory permissions, maybe you need to review your configuration settings for the work dirs? See the well-commented configuration file under the section > > > > # > > # Incoming Work Dir Settings > > # -------------------------- > > # > > > > I'm guessing you want something like: > > Incoming Work User = postfix > > Incoming Work Group = postfix > > Incoming Work Permissions = 0660 > > > > Also check what group your clam scanner is using, so that is configured with the same group! > > (I.e if the clamd group is clamav, the group above should be clamav instead!) > > > > > > /Markus > I have reviews the settings, they currently are: > > Incoming Work User = > Incoming Work Group = clamav > Incoming Work Permissions = 640 > > So, user is empty. I believe that means that it defaults to the 'Run As > User' value. > Clamav is actually working as the clamav user in de clamav group. > > To test, I changed permissies on /var/spool/MailScanner/incoming to 777, > but that still results in the same error: > > Could not read directory /var/spool/MailScanner/incoming at > /usr/share/MailScanner//MailScanner/Config.pm line 2786 > Error in configuration file line 184, directory > /var/spool/MailScanner/incoming for incomingworkdir does not exist (or > is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 3146 > Could not read directory /var/spool/MailScanner/quarantine at > /usr/share/MailScanner//MailScanner/Config.pm line 2786 > Error in configuration file line 188, directory > /var/spool/MailScanner/quarantine for quarantinedir does not exist (or > is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 3146 ---- mkdir /var/spool/MailScanner/incoming mkdir /var/spool/MailScanner/quarantine mkdir /var/spool/MailScanner/spamassassin chown postfix:clamav mkdir /var/spool/MailScanner/incoming chown postfix:postfix mkdir /var/spool/MailScanner/quarantine chown postfix:postfix mkdir /var/spool/MailScanner/spamassassin > Incoming Work User = > Incoming Work Group = clamav > Incoming Work Permissions = 640 These are correct Make sure you also have these settings in MailScanner.conf Run As User = postfix Run As Group = postfix Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = /var/spool/postfix/incoming MTA = postfix Quarantine Group = postfix I think you can pretty much give up on the idea of anyone maintaining deb packages for MailScanner - perhaps one day I might but I have my hands full at the moment. That said, MailScanner installs just fine from tarball and it's not so difficult to upgrade from a newer tarball. Craig From bjron.mork at gmail.com Tue Aug 9 06:27:05 2011 From: bjron.mork at gmail.com (Bjron Mork) Date: Tue Aug 9 06:28:06 2011 Subject: MailScanner Crash In-Reply-To: <4E39AFDE.7030606@alexb.ch> References: <7ED160EA352F4FD38DE815E2B124F2D1@WTPK.local> <4E39AFDE.7030606@alexb.ch> Message-ID: <00fb01cc5654$fc9904b0$f5cb0e10$@gmail.com> Thanks Alex , phil for your support....I changed permissions and issue is now resolved.... Regards, B~Mork -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Alex Broens Sent: Thursday, August 04, 2011 1:30 AM To: mailscanner@lists.mailscanner.info Subject: Re: MailScanner Crash On 2011-08-03 19:29, bjron.mork@gmail.com wrote: > Hi Phil / forum, > > > > Thanks for your reply. I found another work-around for my problem, MailScanner is unable to create folder in /var/spool/MailScanner/quarantine/DAILY_DATE_WISE_FOLDER, today I created 20110803 folder manually and allowed ownership and mode to 770, and MailScanner started working properly. > > > > What might be the reason for the this issue, and how can it be permanently resolved. if not Selinux then permissions: for RHEL/Fedora/Centos: chown -R postfix:postfix /var/spool/MailScanner/incoming chown -R postfix:apache /var/spool/MailScanner/quarantine or whatever user you're running postfix/apache under. h2h -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From stephencoxmail at gmail.com Tue Aug 9 08:00:08 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Tue Aug 9 08:00:19 2011 Subject: Fwd: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> Message-ID: ---------- Forwarded message ---------- From: "Andrew Colin Kissa" Date: Aug 8, 2011 11:07 AM Subject: [Baruwa] MailScanner rpm packages now in Baruwa repo To: Hi all, MailScanner rpm packages are now available in the Baruwa repo, these packages include various fixes and should run without taint errors. This means you no longer need a build kit on your mailscanner machines to install the rpm's and dependencies using the mailscanner.info install.sh script. All dependencies are available via base and EPEL. EL6 - http://repo.baruwa.org/el6/x86_64/repoview/mailscanner.html EL5 - http://repo.baruwa.org/el5/x86_64/repoview/mailscanner.html - Andrew -- Baruwa - www.baruwa.org _______________________________________________ Baruwa mailing list Baruwa@lists.baruwa.org http://lists.baruwa.org/mailman/listinfo/baruwa Keep Baruwa FREE - http://pledgie.com/campaigns/12056 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110809/181ef408/attachment.html From john at tradoc.fr Tue Aug 9 08:22:08 2011 From: john at tradoc.fr (John Wilcock) Date: Tue Aug 9 08:22:26 2011 Subject: Fwd: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> Message-ID: <4E40E020.9010000@tradoc.fr> Le 09/08/2011 09:00, Stephen Cox a ?crit : > MailScanner rpm packages are now available in the Baruwa repo, these > packages include various fixes and should run without taint errors. Have these fixes been sent to Julian for inclusion in the next release? What exactly has been fixed? John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From stephencoxmail at gmail.com Tue Aug 9 10:34:39 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Tue Aug 9 10:34:50 2011 Subject: Fwd: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: <4E40E020.9010000@tradoc.fr> References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> <4E40E020.9010000@tradoc.fr> Message-ID: On Tue, Aug 9, 2011 at 9:22 AM, John Wilcock wrote: > Le 09/08/2011 09:00, Stephen Cox a ?crit : >> >> MailScanner rpm packages are now available in the Baruwa repo, these >> packages include various fixes and should run without taint errors. > > Have these fixes been sent to Julian for inclusion in the next release? What > exactly has been fixed? > > John. John, There was a lot of taint errors where perl crashed mailscanner. I think Andrew backported the fixes Julian added to 4.84.1-1 beta. -- Stephen Cox From john at tradoc.fr Tue Aug 9 10:54:48 2011 From: john at tradoc.fr (John Wilcock) Date: Tue Aug 9 10:55:05 2011 Subject: Fwd: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> <4E40E020.9010000@tradoc.fr> Message-ID: <4E4103E8.4050808@tradoc.fr> Le 09/08/2011 11:34, Stephen Cox a ?crit : > There was a lot of taint errors where perl crashed mailscanner. I > think Andrew backported the fixes Julian added to 4.84.1-1 beta. There are also a few taint errors that only crop up with perl 5.12.3 or later and that aren't fixed in Julian's latest beta. I was hoping Andrew might have had more fixes than Julian... John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From stephencoxmail at gmail.com Tue Aug 9 11:14:47 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Tue Aug 9 11:14:57 2011 Subject: Fwd: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: <4E4103E8.4050808@tradoc.fr> References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> <4E40E020.9010000@tradoc.fr> <4E4103E8.4050808@tradoc.fr> Message-ID: On Tue, Aug 9, 2011 at 11:54 AM, John Wilcock wrote: > Le 09/08/2011 11:34, Stephen Cox a ?crit : >> >> There was a lot of taint errors where perl crashed mailscanner. I >> think Andrew backported the fixes Julian added to 4.84.1-1 beta. > > There are also a few taint errors that only crop up with perl 5.12.3 or > later and that aren't fixed in Julian's latest beta. I was hoping Andrew > might have had more fixes than Julian... I think he did. Lets wait for his reply. -- Stephen Cox From achim+mailwatch at qustodium.net Tue Aug 9 20:55:48 2011 From: achim+mailwatch at qustodium.net (Achim J. Latz) Date: Tue Aug 9 20:56:29 2011 Subject: Bunch of issues with installing MailScanner on Ubuntu LTS 10.04 In-Reply-To: <98a4e7da-c245-491e-a7ed-c555f7a4bbe9@cronlabworkstation0> References: <98a4e7da-c245-491e-a7ed-c555f7a4bbe9@cronlabworkstation0> Message-ID: <4E4190C4.3040608@qustodium.net> Hello Markus: On 08/08/2011 16:43, Markus Nilsson wrote: > There is one newer package for debian: > http://lists.mailscanner.info/pipermail/mailscanner/2011-March/097689.html > > However, no-one has yet stepped in to maintain the debian packaging. Andrew Colin Kissa (lead developer of Baruwa [0], a web 2.0 MailScanner front-end) is hosting more recent DEB versions in his repository [1], including the "taint" backports from Julian's latest beta, and then some [2]. Best regards, Achim [0] [1] [2] -- Achim J. Latz, Qustodium Internet Security achim.latz@qustodium.net ? http://www.qustodium.net Data Encryption ? Backup Automatisation ? E-Mail Protection From glenn.steen at gmail.com Wed Aug 10 09:51:37 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed Aug 10 09:51:48 2011 Subject: AW: RBL checks when some mail is received via a relay In-Reply-To: References: <6dce9c68-5037-4204-8337-cd689faccb8c@cronlabworkstation0> Message-ID: On 5 August 2011 16:45, Tim Cappell wrote: > Hi, > > I just added that to the spam.assassin.prefs.conf and will see how it goes. Thank you all for your input, I'll be sure to report back with results. > > Tim > (snip) Doing all RBLs in SA is a good idea for more reasons (than the obvious one Markus points to:)... It'll lookup several BLs in parallell (MS is serial), you can finetune scoring etc. Unfortunately, MS does not allow a ruleset (see http://www.mailscanner.info/MailScanner.conf.index.html#Read%20IP%20Address%20From%20Received%20Header) on this particular setting, so your only other option would be to make sure that both setups looked the same... That is, insert a new MX before the MailScnner-enhanced one (for the new domain) that only do a simple forward to the latter... And set Read Address... = 2. Icky, since this will obfuscate your mailflow a bit:)... Stick with SA and a correct trust path setting. Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From glenn.steen at gmail.com Wed Aug 10 10:06:32 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed Aug 10 10:06:42 2011 Subject: MailScanner RBL Check for specific ip subnet In-Reply-To: References: Message-ID: On 8 August 2011 08:28, Bjorn Mork wrote: > Hi everybody, > > I have two Public IP subnet, and I want that MailScanner must check spamhaus > or spamcop for IP pool 1, and it should allow my IP pool 2 without any black > list checking. > Anti-Spamming feature other than black list checking must apply for both IP > pool > Is this possible via MailScanner ? > > Regards, > B~Mork > Hello Bj?rn, Yes, this should be possible to achieve with a ruleset (or two) on "Spam Lists" and "Spam Domain Lists". Read up on rulesets (you have examples in the installed rules directory, in the wiki and in the book). I'm not sure if you will be able to use anything like "To: IP.N.E.T ", you'll have to explore that a bit (the command "MailScanner --help" will show a bit on how to test rulesets by supplying fake information;-). You'll also have to look at the BLs in SpamAssassin (scoring etc)... Since you just want one or twolists in MS (which will be a "hard stop", compared to SAs scoring), that might be OK (SA does lookups in parallell while MS serializes lookups). Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From glenn.steen at gmail.com Wed Aug 10 10:11:55 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed Aug 10 10:12:04 2011 Subject: Quarantine an email by size and notify. In-Reply-To: References: Message-ID: On 8 August 2011 18:34, Eduardo Casarero wrote: > Hi everybody, > I have a request from my boss asking if it is possible to quarantine an > email by its size (using max.size.rules) and send a notification to the > destination email ?or an administrator. The rule works ok, but the issue is > with the action, i could not find any workaround. I did search old emails in > the mailling list and some wide range google search but the only thing i > found was a thread from uxbod writing about a perl plugin to use ZendTo but > with no "ready for production" solutions. > The behaviour we need is: > Email arrives to MS, MS detects it's too big, MS reads action (says too big > put in quarantine and notify), MS saves in quarantine, MS notifies > destination. > I am already having a discussion about how usefull would this be, but i > would like to have a workaround or something just in case. > Any idea would be appreciated! > Thanks > Eduardo. > I suppose you could do something with an SA rule and the SA rule action thingies... But the usefulness of actually accepting and quarantining an oversized message... Your MTA should be set to reject oversized mail already, so this would be ... what? The "almost-to-big"? Doesn't make sense to me... But I'm preaching to the choir her, I guess;-) Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From andrew at topdog.za.net Thu Aug 11 13:16:19 2011 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Thu Aug 11 13:18:47 2011 Subject: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> <4E40E020.9010000@tradoc.fr> <4E4103E8.4050808@tradoc.fr> Message-ID: On 09 Aug 2011, at 12:14 PM, Stephen Cox wrote: > I think he did. Lets wait for his reply. Its mostly julians beta fixes, temp file security fixes from debian and a few minor fixes to run on fedora which has perl 5.12.4 I have not come across any other taint issue, John please indicate what triggers the taint issues you have on 5.12.3 as am not picking them up on 5.12.4 - Andrew -- Baruwa - www.baruwa.org From john at tradoc.fr Thu Aug 11 15:44:33 2011 From: john at tradoc.fr (John Wilcock) Date: Thu Aug 11 15:44:48 2011 Subject: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> <4E40E020.9010000@tradoc.fr> <4E4103E8.4050808@tradoc.fr> Message-ID: <4E43EAD1.2020600@tradoc.fr> Le 11/08/2011 14:16, Andrew Colin Kissa a ?crit : > I have not come across any other taint issue, John please indicate what triggers > the taint issues you have on 5.12.3 as am not picking them up on 5.12.4 I had the following with MS 4.84.1-1 on perl 5.12.3: > Insecure dependency in open while running with -T switch at /usr/lib64/perl5/vendor_perl/5.12.3/x86_64-linux/IO/File.pm line 185, <$fh> line 6. > Insecure dependency in open while running with -T switch at /usr/lib64/perl5/vendor_perl/5.12.3/x86_64-linux/IO/File.pm line 185. > Insecure dependency in chown while running with -T switch at /usr/lib/MailScanner/MailScanner/Message.pm line 1381. Julian gave me a fix for Message.pm line 1381: + my $tempid = $this->{id}; + $tempid =~ /^(.*)$/; + $tempid = $1; + chown $uid, $gid, "$spamdir/" . $tempid; # Harmless if this fails - chown $uid, $gid, "$spamdir/" . $this->{id}; # Harmless if this fails However I was unable to track down the *open* problems in IO::File, as there are dozens of open() calls in MailScanner. If I get time I'll try upgrading to 5.12.4 and see if that changes anything... John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From john at tradoc.fr Thu Aug 11 16:16:28 2011 From: john at tradoc.fr (John Wilcock) Date: Thu Aug 11 16:16:46 2011 Subject: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: <4E43EAD1.2020600@tradoc.fr> References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> <4E40E020.9010000@tradoc.fr> <4E4103E8.4050808@tradoc.fr> <4E43EAD1.2020600@tradoc.fr> Message-ID: <4E43F24C.3020606@tradoc.fr> Le 11/08/2011 16:44, John Wilcock a ?crit : > However I was unable to track down the *open* problems in IO::File, as > there are dozens of open() calls in MailScanner. Should perhaps have mentioned that IO::File is version 1.14 - by the looks of it gentoo pulls in a more recent version of IO::File than the one in upstream perl (1.11 as standard in 5.12.4?) John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From andrew at topdog.za.net Thu Aug 11 16:26:03 2011 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Thu Aug 11 16:26:29 2011 Subject: [Baruwa] MailScanner rpm packages now in Baruwa repo In-Reply-To: <4E43F24C.3020606@tradoc.fr> References: <31BA7A35-3E63-4FCF-8C41-C8085165F1A7@topdog.za.net> <4E40E020.9010000@tradoc.fr> <4E4103E8.4050808@tradoc.fr> <4E43EAD1.2020600@tradoc.fr> <4E43F24C.3020606@tradoc.fr> Message-ID: <759B8650-B181-4769-AD08-CBBC41E72E3B@topdog.za.net> On 11 Aug 2011, at 5:16 PM, John Wilcock wrote: > Should perhaps have mentioned that IO::File is version 1.14 - by the looks of it gentoo pulls in a more recent version of IO::File than the one in upstream perl (1.11 as standard in 5.12.4?) Well that could be it, will keep testing though to see if they come up. -- Baruwa - www.baruwa.org From mailscanner at barendse.to Sat Aug 13 22:41:47 2011 From: mailscanner at barendse.to (Remco Barendse) Date: Sat Aug 13 22:42:02 2011 Subject: Problems with MailScanner and SELinux compatibility In-Reply-To: <4DF0EC74.8090109@alpha2.com> References: <4DF0EC74.8090109@alpha2.com> Message-ID: Hi Martin, Sorry for replying to a rather old posting. Did you ever find the solution to this? I was always lazy (with CentOS 4 and 5 nothing seemed to work with SELinux enabled) and also just disabled SELinux, so far everything is working without problems though. Would be nice if MailScanner would also play along with SELinux on my new server :) Thanks! On Thu, 9 Jun 2011, Mark L. Wise wrote: > Sorry if this is a second post... I am still debugging my new mail server > and I did not see the first post come back to me from the list... > > I have just built a new box based on Fedora Core 15 (2.6.38.7-30). I am > going to use this box as a mail server. I am using sendmail (8.14.4), > spamassassin (3.3.2-r929478), clamav (0.97), dovecot (2.0.13) and MailScanner > (4.83.5). > > Everything appears to be configured well and working, except when I turn on > MailScanner I get errors in the maillog file that indicate a problem writing > (apparently temporary) files. > > After a bit of research, it appears that this may be a conflict between > MailScanner and SELinux. > > Does anyone have a SELinux policy or know of a way to fix this issue? I > really would like to have SELinux enforcing AND MailScanner checking my mail. > > Thanks in advance for any help you can give me. > > Mark > > From secmas at gmail.com Sun Aug 14 15:42:29 2011 From: secmas at gmail.com (Sergio) Date: Sun Aug 14 15:42:40 2011 Subject: Issues with MCP Message-ID: Hi all, I am new to the list, so, I don't know it my question has been answered before. I have an issue using MCP, I have set my MCP rules and are working as I want, if the emails has a spam value lower than 5 and the MCP score is high (11 points) the email is discarded and it is not delivered, But if if the email spam value is over 5 and MCP score is 11, the email is delivered. My question is, why the email is delivered if MCP is high and the spam value is over 5? Is there a way to configure MailScanner to discard any message when MCP is high regardless of the spam score? TIA for your kind answers. Sergio -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110814/219acda3/attachment.html From eric_le_corre at msn.com Thu Aug 18 11:16:47 2011 From: eric_le_corre at msn.com (eric le corre) Date: Thu Aug 18 11:16:57 2011 Subject: Problem lock and GID mailscanner Message-ID: Hello and sorry for my english i have 2 errors in mailscanner debug : 1) Can 't set GID 125 at /usr/sbin/MailScanner line 1541 2) Error : Attempt to create locks in /var/lock/MailScanner failed ! thanks for help ! :-) -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110818/90480b54/attachment.html From maxsec at gmail.com Thu Aug 18 13:46:30 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Aug 18 13:46:38 2011 Subject: Problem lock and GID mailscanner In-Reply-To: References: Message-ID: you are starting mailscanner from root user? have you got selinux disabled? -- Martin Hepworth Oxford, UK On 18 August 2011 11:16, eric le corre wrote: > Hello and sorry for my english > > i have 2 errors in mailscanner debug : > > 1) Can 't set GID 125 at /usr/sbin/MailScanner line 1541 > > 2) Error : Attempt to create locks in /var/lock/MailScanner failed ! > > thanks for help ! :-) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110818/07a6756e/attachment.html From eric_le_corre at msn.com Thu Aug 18 16:05:51 2011 From: eric_le_corre at msn.com (eric le corre) Date: Thu Aug 18 16:06:00 2011 Subject: Problem lock and GID mailscanner Message-ID: hello, i have Ubuntu 11.04 and mailscanner 4.83.5 i start mailscanner like this : "sudo /etc/init.d/mailscanner start" and i put my password next sorry i don t know what is "selinux". thanks ---------------------------------------------------------------------------------------------------------------------------------------------- you are starting mailscanner from root user? have you got selinux disabled? -- Martin Hepworth Oxford, UK On 18 August 2011 11:16, eric le corre wrote: > Hello and sorry for my english > > i have 2 errors in mailscanner debug : > > 1) Can 't set GID 125 at /usr/sbin/MailScanner line 1541 > > 2) Error : Attempt to create locks in /var/lock/MailScanner failed ! > > thanks for help ! :-) -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110818/ba199e4a/attachment.html From eric_le_corre at msn.com Thu Aug 18 16:21:54 2011 From: eric_le_corre at msn.com (eric le corre) Date: Thu Aug 18 16:22:03 2011 Subject: MailScanner Digest, Vol 68, Issue 14 In-Reply-To: <201108181100.p7IB0LUm012900@safir.blacknight.ie> References: <201108181100.p7IB0LUm012900@safir.blacknight.ie> Message-ID: hello, i have Ubuntu 11.04 and mailscanner 4.83.5 i start mailscanner like this : "sudo /etc/init.d/mailscanner start" and i put my password next sorry i don t know what is "selinux". thanks > Date: Thu, 18 Aug 2011 12:00:59 +0100 > From: mailscanner-request@lists.mailscanner.info > Subject: MailScanner Digest, Vol 68, Issue 14 > To: mailscanner@lists.mailscanner.info > > Send MailScanner mailing list submissions to > mailscanner@lists.mailscanner.info > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.mailscanner.info/mailman/listinfo/mailscanner > or, via email, send a message with subject or body 'help' to > mailscanner-request@lists.mailscanner.info > > You can reach the person managing the list at > mailscanner-owner@lists.mailscanner.info > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of MailScanner digest..." > > > Today's Topics: > > 1. Problem lock and GID mailscanner (eric le corre) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 18 Aug 2011 12:16:47 +0200 > From: eric le corre > Subject: Problem lock and GID mailscanner > To: > Message-ID: > Content-Type: text/plain; charset="iso-8859-1" > > > > > > Hello and sorry for my english i have 2 errors in mailscanner debug : 1) Can 't set GID 125 at /usr/sbin/MailScanner line 1541 2) Error : Attempt to create locks in /var/lock/MailScanner failed ! thanks for help ! :-) > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110818/90480b54/attachment-0001.html > > ------------------------------ > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read the Wiki (http://wiki.mailscanner.info/). > > Support MailScanner development - buy the book off the website! > > > End of MailScanner Digest, Vol 68, Issue 14 > ******************************************* -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110818/b3e65ad7/attachment.html From eric_le_corre at msn.com Fri Aug 19 08:00:14 2011 From: eric_le_corre at msn.com (eric le corre) Date: Fri Aug 19 08:00:22 2011 Subject: How to respond to mailing list Message-ID: Hello, when i send email to mailscanner@lists.mailscanner.info, it create a new subject. but how to respont to subject ? i dont receive emails to mailing list. thanks. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/645c7a50/attachment.html From jeremy at fluxlabs.net Fri Aug 19 08:08:33 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Fri Aug 19 08:10:48 2011 Subject: How to respond to mailing list In-Reply-To: References: Message-ID: Check your spam, and look at http://lists.mailscanner.info/mailman/listinfo/mailscanner -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 19, 2011, at 2:07 AM, eric le corre > wrote: Hello, when i send email to mailscanner@lists.mailscanner.info, it create a new subject. but how to respont to subject ? i dont receive emails to mailing list. thanks. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/9cedfd6d/attachment.html From denis.beauchemin at usherbrooke.ca Fri Aug 19 13:43:48 2011 From: denis.beauchemin at usherbrooke.ca (Denis Beauchemin) Date: Fri Aug 19 13:50:17 2011 Subject: How to respond to mailing list References: Message-ID: eric le corre msn.com> writes: > > Hello,?when i send email to mailscanner lists.mailscanner.info, it create a new subject.?but how to respont to subject ? i dont receive emails to mailing list.?thanks. > Eric, I am trying to reply to your email through http://news.gmane.org/gmane.mail.virus.mailscanner . I've never done this before... it will probably work :P This site keeps archives of this list but you can also reply to an individual email. Denis From Johan at double-l.nl Fri Aug 19 15:09:11 2011 From: Johan at double-l.nl (Johan Hendriks) Date: Fri Aug 19 15:09:06 2011 Subject: Can't locate object method "config" MIME::ToolUtils Message-ID: <6C3F8332272B7D4DA26909F15F1C90E1E55DD8@SRV01.double-l.local> Hello all. Today i updated one of the MailScanner machines. But it can not start after the update of some perl modules. The error i get when debug is set and i start Mailscanner is Can't locate object method "config" via package "MIME::ToolUtils" (perhaps you forgot to load "MIME::ToolUtils"?) at /usr/local/sbin/mailscanner line 1471. My system = FreeBSD 8.2. perl-5.12.4_1 Practical Extraction and Report Language p5-Archive-Zip-1.30_1 Perl module to create, manipulate, read, and write Zip arch p5-Authen-NTLM-1.08_1 An NTLM authentication modulelocal/sbin/mailscanner line 1 p5-CPAN-Meta-2.110930 The distribution metadata for a CPAN dist p5-CPAN-Meta-YAML-0.003 Read and write a subset of YAML for CPAN Meta files p5-Compress-Raw-Bzip2-2.037 Low-Level Interface to bzip2 compression library p5-Compress-Raw-Zlib-2.037 Low-Level Interface to zlib compression library p5-Convert-BinHex-1.119 Perl module to extract data from Macintosh BinHex files p5-Convert-TNEF-0.17 Perl module to read TNEF files p5-Crypt-OpenSSL-Bignum-0.04 OpenSSL's multiprecision integer arithmetic p5-Crypt-OpenSSL-RSA-0.27 Perl5 module to RSA encode and decode strings using OpenSSL p5-Crypt-OpenSSL-Random-0.04 Perl5 interface to the OpenSSL pseudo-random number generat p5-DBD-SQLite-1.33 Provides access to SQLite3 databases through the DBI p5-DBD-mysql51-4.019 MySQL 5.1 driver for the Perl5 Database Interface (DBI) p5-DBI-1.616 The perl5 Database Interface. Required for DBD::* modules p5-Digest-HMAC-1.03 Perl5 interface to HMAC Message-Digest Algorithms p5-Digest-SHA1-2.13 Perl interface to the SHA-1 Algorithm p5-Encode-Detect-1.01 An Encode::Encoding subclass that detects the encoding of d p5-Encode-Locale-1.02 Determine the locale encoding p5-Error-0.17016 Perl module to provide Error/exception support for perl: Er p5-ExtUtils-CBuilder-0.2802.02,1 Compile and link C code for Perl modules p5-ExtUtils-Install-1.54_1 Perl extension to install files from here to there p5-ExtUtils-ParseXS-3.03 Converts Perl XS code into C code p5-File-Listing-6.02 Parse directory listings p5-File-Tail-0.99.3 Perl Module to read the end of a file as it\'s appended to p5-Filesys-Df-0.92 Perl extension for filesystem space p5-FuzzyOcr-2.3.b_8,1 Plugin for SpamAssassin which scans image attachments for s p5-Geography-Countries-2009041301 Handle ISO-3166 country codes p5-HTML-Parser-3.68 Perl5 module for parsing HTML documents p5-HTML-Tagset-3.20 Some useful data table in parsing HTML p5-HTTP-Cookies-6.00 HTTP Cookie jars p5-HTTP-Daemon-6.00 Simple HTTP server class p5-HTTP-Date-6.00 Conversion routines for the HTTP protocol date formats p5-HTTP-Message-6.02 Representation of HTTP style messages p5-HTTP-Negotiate-6.00 Implementation of the HTTP content negotiation algorithm p5-IO-Compress-2.037 Perl5 compression modules (bzip2, deflate, gzip, zlib, zip) p5-IO-Socket-INET6-2.67 Perl module with object interface to AF_INET6 domain socket p5-IO-Socket-SSL-1.44 Perl5 interface to SSL sockets p5-IO-stringy-2.110 Perl5 module for using IO handles with non-file objects p5-IP-Country-2.27 Fast lookup of country codes from IP addresses p5-JSON-PP-2.27200 A JSON::XS compatible pure-Perl module p5-LWP-MediaTypes-6.01 Guess media type for a file or a URL p5-Locale-gettext-1.05_3 Message handling functions p5-MIME-Tools-5.502,2 A set of perl5 modules for MIME p5-Mail-DKIM-0.39 Perl5 module to process and/or create DKIM email p5-Mail-SPF-2.007 Reference implementation of the RFC 4408 SPF protocol p5-Mail-SpamAssassin-3.3.2_1 A highly efficient mail filter for identifying spam p5-Mail-Tools-2.08 Perl5 modules for dealing with Internet e-mail messages p5-Module-Build-0.3800_1 Build and install Perl modules p5-Module-Metadata-1.000005 Perl extension to gather package information from perl modu p5-Net-CIDR-0.14 Perl module to manipulate IPv4/IPv6 netblocks in CIDR notat p5-Net-DNS-0.66_1 Perl5 interface to the DNS resolver, and dynamic updates p5-Net-DNS-Resolver-Programmable-0.003 Programmable DNS resolver for off-line testing p5-Net-HTTP-6.01 Low-level HTTP client p5-Net-IP-1.25_3 Perl extension for manipulating IPv4/IPv6 addresses p5-Net-Ident-1.23 Lookup the username on the remote end of a TCP/IP connectio p5-Net-SSLeay-1.36 Perl5 interface to SSL p5-NetAddr-IP-4.038 Perl module for working with IP addresses and blocks thereo p5-OLE-Storage_Lite-0.19 Perl module for OLE document interface p5-Parse-CPAN-Meta-1.44.01 Parse META.yml and other similar CPAN metadata files p5-Perl-OSType-1.002 Map Perl operating system names to generic types p5-Socket6-0.23 IPv6 related part of the C socket.h defines and structure m p5-Storable-2.25 Persistency for perl data structures p5-String-Approx-3.26_1 Perl extension for approximate matching (fuzzy matching) p5-Sys-Hostname-Long-1.4 Try every conceivable way to get full hostname p5-Sys-SigAction-0.15 Perl extension for Consistent Signal Handling p5-Test-Simple-0.98 Basic utilities for writing tests in perl p5-TimeDate-1.20,1 Perl5 module containing a better/faster date parser for abs p5-URI-1.59 Perl5 interface to Uniform Resource Identifier (URI) refere p5-Version-Requirements-0.101020 A set of version requirements for a CPAN dist p5-WWW-RobotRules-6.01 Database of robots.txt-derived permissions p5-XML-Parser-2.40 Perl extension interface to James Clark's XML parser, expat p5-YAML-Tiny-1.50 Read/Write YAML files with as little code as possible p5-libwww-6.02_1 Perl5 library for WWW access p5-version-0.93 Perl extension for Version Objects Is there something i can try? Regards Johan Hendriks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/69c51557/attachment.html From glenn.steen at gmail.com Fri Aug 19 15:19:57 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Fri Aug 19 15:20:07 2011 Subject: MailScanner Digest, Vol 68, Issue 14 In-Reply-To: References: <201108181100.p7IB0LUm012900@safir.blacknight.ie> Message-ID: Since you use Ubuntu, you likely use Postfix as MTA. PF runs as an unprivileged user, do you need pay special attention to pernissiond, both actual perms in the filesystem and the setup in MailScanner.conf ... A lot has been said on this topic, on this list and in the guides and wiki ... Gmane is your friend here...;-) Cheers -- -- Glenn Den 18 aug 2011 17:26 skrev "eric le corre" : > > hello, i have Ubuntu 11.04 and mailscanner 4.83.5 i start mailscanner like this : "sudo /etc/init.d/mailscanner start" and i put my password next > > sorry i don t know what is "selinux". > > thanks > > > Date: Thu, 18 Aug 2011 12:00:59 +0100 > > From: mailscanner-request@lists.mailscanner.info > > Subject: MailScanner Digest, Vol 68, Issue 14 > > To: mailscanner@lists.mailscanner.info > > > > Send MailScanner mailing list submissions to > > mailscanner@lists.mailscanner.info > > > > To subscribe or unsubscribe via the World Wide Web, visit > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > or, via email, send a message with subject or body 'help' to > > mailscanner-request@lists.mailscanner.info > > > > You can reach the person managing the list at > > mailscanner-owner@lists.mailscanner.info > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of MailScanner digest..." > > > > > > Today's Topics: > > > > 1. Problem lock and GID mailscanner (eric le corre) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Thu, 18 Aug 2011 12:16:47 +0200 > > From: eric le corre > > Subject: Problem lock and GID mailscanner > > To: > > Message-ID: > > Content-Type: text/plain; charset="iso-8859-1" > > > > > > > > > > > > Hello and sorry for my english i have 2 errors in mailscanner debug : 1) Can 't set GID 125 at /usr/sbin/MailScanner line 1541 2) Error : Attempt to create locks in /var/lock/MailScanner failed ! thanks for help ! :-) > > -------------- next part -------------- > > An HTML attachment was scrubbed... > > URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110818/90480b54/attachment-0001.html > > > > ------------------------------ > > > > -- > > MailScanner mailing list > > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read the Wiki (http://wiki.mailscanner.info/). > > > > Support MailScanner development - buy the book off the website! > > > > > > End of MailScanner Digest, Vol 68, Issue 14 > > ******************************************* > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/a301ed6b/attachment.html From glenn.steen at gmail.com Fri Aug 19 15:27:27 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Fri Aug 19 15:27:37 2011 Subject: Can't locate object method "config" MIME::ToolUtils In-Reply-To: <6C3F8332272B7D4DA26909F15F1C90E1E55DD8@SRV01.double-l.local> References: <6C3F8332272B7D4DA26909F15F1C90E1E55DD8@SRV01.double-l.local> Message-ID: And is the MIME::ToolUtils package installed? What happend when you install it? Cheers -- -- Glenn Den 19 aug 2011 16:14 skrev "Johan Hendriks" : > > Hello all. > > > > Today i updated one of the MailScanner machines. > > But it can not start after the update of some perl modules. > > > > The error i get when debug is set and i start Mailscanner is > > > > Can't locate object method "config" via package "MIME::ToolUtils" (perhaps you forgot to load "MIME::ToolUtils"?) at /usr/local/sbin/mailscanner line 1471. > > > > My system = FreeBSD 8.2. > > > > perl-5.12.4_1 Practical Extraction and Report Language > > > > p5-Archive-Zip-1.30_1 Perl module to create, manipulate, read, and write Zip arch > > p5-Authen-NTLM-1.08_1 An NTLM authentication modulelocal/sbin/mailscanner line 1 > > p5-CPAN-Meta-2.110930 The distribution metadata for a CPAN dist > > p5-CPAN-Meta-YAML-0.003 Read and write a subset of YAML for CPAN Meta files > > p5-Compress-Raw-Bzip2-2.037 Low-Level Interface to bzip2 compression library > > p5-Compress-Raw-Zlib-2.037 Low-Level Interface to zlib compression library > > p5-Convert-BinHex-1.119 Perl module to extract data from Macintosh BinHex files > > p5-Convert-TNEF-0.17 Perl module to read TNEF files > > p5-Crypt-OpenSSL-Bignum-0.04 OpenSSL's multiprecision integer arithmetic > > p5-Crypt-OpenSSL-RSA-0.27 Perl5 module to RSA encode and decode strings using OpenSSL > > p5-Crypt-OpenSSL-Random-0.04 Perl5 interface to the OpenSSL pseudo-random number generat > > p5-DBD-SQLite-1.33 Provides access to SQLite3 databases through the DBI > > p5-DBD-mysql51-4.019 MySQL 5.1 driver for the Perl5 Database Interface (DBI) > > p5-DBI-1.616 The perl5 Database Interface. Required for DBD::* modules > > p5-Digest-HMAC-1.03 Perl5 interface to HMAC Message-Digest Algorithms > > p5-Digest-SHA1-2.13 Perl interface to the SHA-1 Algorithm > > p5-Encode-Detect-1.01 An Encode::Encoding subclass that detects the encoding of d > > p5-Encode-Locale-1.02 Determine the locale encoding > > p5-Error-0.17016 Perl module to provide Error/exception support for perl: Er > > p5-ExtUtils-CBuilder-0.2802.02,1 Compile and link C code for Perl modules > > p5-ExtUtils-Install-1.54_1 Perl extension to install files from here to there > > p5-ExtUtils-ParseXS-3.03 Converts Perl XS code into C code > > p5-File-Listing-6.02 Parse directory listings > > p5-File-Tail-0.99.3 Perl Module to read the end of a file as it\'s appended to > > p5-Filesys-Df-0.92 Perl extension for filesystem space > > p5-FuzzyOcr-2.3.b_8,1 Plugin for SpamAssassin which scans image attachments for s > > p5-Geography-Countries-2009041301 Handle ISO-3166 country codes > > p5-HTML-Parser-3.68 Perl5 module for parsing HTML documents > > p5-HTML-Tagset-3.20 Some useful data table in parsing HTML > > p5-HTTP-Cookies-6.00 HTTP Cookie jars > > p5-HTTP-Daemon-6.00 Simple HTTP server class > > p5-HTTP-Date-6.00 Conversion routines for the HTTP protocol date formats > > p5-HTTP-Message-6.02 Representation of HTTP style messages > > p5-HTTP-Negotiate-6.00 Implementation of the HTTP content negotiation algorithm > > p5-IO-Compress-2.037 Perl5 compression modules (bzip2, deflate, gzip, zlib, zip) > > p5-IO-Socket-INET6-2.67 Perl module with object interface to AF_INET6 domain socket > > p5-IO-Socket-SSL-1.44 Perl5 interface to SSL sockets > > p5-IO-stringy-2.110 Perl5 module for using IO handles with non-file objects > > p5-IP-Country-2.27 Fast lookup of country codes from IP addresses > > p5-JSON-PP-2.27200 A JSON::XS compatible pure-Perl module > > p5-LWP-MediaTypes-6.01 Guess media type for a file or a URL > > p5-Locale-gettext-1.05_3 Message handling functions > > p5-MIME-Tools-5.502,2 A set of perl5 modules for MIME > > p5-Mail-DKIM-0.39 Perl5 module to process and/or create DKIM email > > p5-Mail-SPF-2.007 Reference implementation of the RFC 4408 SPF protocol > > p5-Mail-SpamAssassin-3.3.2_1 A highly efficient mail filter for identifying spam > > p5-Mail-Tools-2.08 Perl5 modules for dealing with Internet e-mail messages > > p5-Module-Build-0.3800_1 Build and install Perl modules > > p5-Module-Metadata-1.000005 Perl extension to gather package information from perl modu > > p5-Net-CIDR-0.14 Perl module to manipulate IPv4/IPv6 netblocks in CIDR notat > > p5-Net-DNS-0.66_1 Perl5 interface to the DNS resolver, and dynamic updates > > p5-Net-DNS-Resolver-Programmable-0.003 Programmable DNS resolver for off-line testing > > p5-Net-HTTP-6.01 Low-level HTTP client > > p5-Net-IP-1.25_3 Perl extension for manipulating IPv4/IPv6 addresses > > p5-Net-Ident-1.23 Lookup the username on the remote end of a TCP/IP connectio > > p5-Net-SSLeay-1.36 Perl5 interface to SSL > > p5-NetAddr-IP-4.038 Perl module for working with IP addresses and blocks thereo > > p5-OLE-Storage_Lite-0.19 Perl module for OLE document interface > > p5-Parse-CPAN-Meta-1.44.01 Parse META.yml and other similar CPAN metadata files > > p5-Perl-OSType-1.002 Map Perl operating system names to generic types > > p5-Socket6-0.23 IPv6 related part of the C socket.h defines and structure m > > p5-Storable-2.25 Persistency for perl data structures > > p5-String-Approx-3.26_1 Perl extension for approximate matching (fuzzy matching) > > p5-Sys-Hostname-Long-1.4 Try every conceivable way to get full hostname > > p5-Sys-SigAction-0.15 Perl extension for Consistent Signal Handling > > p5-Test-Simple-0.98 Basic utilities for writing tests in perl > > p5-TimeDate-1.20,1 Perl5 module containing a better/faster date parser for abs > > p5-URI-1.59 Perl5 interface to Uniform Resource Identifier (URI) refere > > p5-Version-Requirements-0.101020 A set of version requirements for a CPAN dist > > p5-WWW-RobotRules-6.01 Database of robots.txt-derived permissions > > p5-XML-Parser-2.40 Perl extension interface to James Clark's XML parser, expat > > p5-YAML-Tiny-1.50 Read/Write YAML files with as little code as possible > > p5-libwww-6.02_1 Perl5 library for WWW access > > p5-version-0.93 Perl extension for Version Objects > > > > Is there something i can try? > > > > Regards > > Johan Hendriks > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/b862b162/attachment.html From Johan at double-l.nl Fri Aug 19 15:57:57 2011 From: Johan at double-l.nl (Johan Hendriks) Date: Fri Aug 19 15:58:01 2011 Subject: Can't locate object method "config" MIME::ToolUtils In-Reply-To: References: <6C3F8332272B7D4DA26909F15F1C90E1E55DD8@SRV01.double-l.local> Message-ID: <6C3F8332272B7D4DA26909F15F1C90E1E560CE@SRV01.double-l.local> Yes it is installed. See the list of modules I also tryed reinstalling and so on. Reinstalled perl and the p5-MIME-Tools module, after that Mail Scanner again. Still the same. Regards, Johan Hendriks Van: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Namens Glenn Steen Verzonden: vrijdag 19 augustus 2011 16:27 Aan: MailScanner discussion Onderwerp: Re: Can't locate object method "config" MIME::ToolUtils And is the MIME::ToolUtils package installed? What happend when you install it? Cheers -- -- Glenn Den 19 aug 2011 16:14 skrev "Johan Hendriks" >: > > Hello all. > > > > Today i updated one of the MailScanner machines. > > But it can not start after the update of some perl modules. > > > > The error i get when debug is set and i start Mailscanner is > > > > Can't locate object method "config" via package "MIME::ToolUtils" (perhaps you forgot to load "MIME::ToolUtils"?) at /usr/local/sbin/mailscanner line 1471. > > > > My system = FreeBSD 8.2. > > > > perl-5.12.4_1 Practical Extraction and Report Language > > > > p5-Archive-Zip-1.30_1 Perl module to create, manipulate, read, and write Zip arch > > p5-Authen-NTLM-1.08_1 An NTLM authentication modulelocal/sbin/mailscanner line 1 > > p5-CPAN-Meta-2.110930 The distribution metadata for a CPAN dist > > p5-CPAN-Meta-YAML-0.003 Read and write a subset of YAML for CPAN Meta files > > p5-Compress-Raw-Bzip2-2.037 Low-Level Interface to bzip2 compression library > > p5-Compress-Raw-Zlib-2.037 Low-Level Interface to zlib compression library > > p5-Convert-BinHex-1.119 Perl module to extract data from Macintosh BinHex files > > p5-Convert-TNEF-0.17 Perl module to read TNEF files > > p5-Crypt-OpenSSL-Bignum-0.04 OpenSSL's multiprecision integer arithmetic > > p5-Crypt-OpenSSL-RSA-0.27 Perl5 module to RSA encode and decode strings using OpenSSL > > p5-Crypt-OpenSSL-Random-0.04 Perl5 interface to the OpenSSL pseudo-random number generat > > p5-DBD-SQLite-1.33 Provides access to SQLite3 databases through the DBI > > p5-DBD-mysql51-4.019 MySQL 5.1 driver for the Perl5 Database Interface (DBI) > > p5-DBI-1.616 The perl5 Database Interface. Required for DBD::* modules > > p5-Digest-HMAC-1.03 Perl5 interface to HMAC Message-Digest Algorithms > > p5-Digest-SHA1-2.13 Perl interface to the SHA-1 Algorithm > > p5-Encode-Detect-1.01 An Encode::Encoding subclass that detects the encoding of d > > p5-Encode-Locale-1.02 Determine the locale encoding > > p5-Error-0.17016 Perl module to provide Error/exception support for perl: Er > > p5-ExtUtils-CBuilder-0.2802.02,1 Compile and link C code for Perl modules > > p5-ExtUtils-Install-1.54_1 Perl extension to install files from here to there > > p5-ExtUtils-ParseXS-3.03 Converts Perl XS code into C code > > p5-File-Listing-6.02 Parse directory listings > > p5-File-Tail-0.99.3 Perl Module to read the end of a file as it\'s appended to > > p5-Filesys-Df-0.92 Perl extension for filesystem space > > p5-FuzzyOcr-2.3.b_8,1 Plugin for SpamAssassin which scans image attachments for s > > p5-Geography-Countries-2009041301 Handle ISO-3166 country codes > > p5-HTML-Parser-3.68 Perl5 module for parsing HTML documents > > p5-HTML-Tagset-3.20 Some useful data table in parsing HTML > > p5-HTTP-Cookies-6.00 HTTP Cookie jars > > p5-HTTP-Daemon-6.00 Simple HTTP server class > > p5-HTTP-Date-6.00 Conversion routines for the HTTP protocol date formats > > p5-HTTP-Message-6.02 Representation of HTTP style messages > > p5-HTTP-Negotiate-6.00 Implementation of the HTTP content negotiation algorithm > > p5-IO-Compress-2.037 Perl5 compression modules (bzip2, deflate, gzip, zlib, zip) > > p5-IO-Socket-INET6-2.67 Perl module with object interface to AF_INET6 domain socket > > p5-IO-Socket-SSL-1.44 Perl5 interface to SSL sockets > > p5-IO-stringy-2.110 Perl5 module for using IO handles with non-file objects > > p5-IP-Country-2.27 Fast lookup of country codes from IP addresses > > p5-JSON-PP-2.27200 A JSON::XS compatible pure-Perl module > > p5-LWP-MediaTypes-6.01 Guess media type for a file or a URL > > p5-Locale-gettext-1.05_3 Message handling functions > > p5-MIME-Tools-5.502,2 A set of perl5 modules for MIME > > p5-Mail-DKIM-0.39 Perl5 module to process and/or create DKIM email > > p5-Mail-SPF-2.007 Reference implementation of the RFC 4408 SPF protocol > > p5-Mail-SpamAssassin-3.3.2_1 A highly efficient mail filter for identifying spam > > p5-Mail-Tools-2.08 Perl5 modules for dealing with Internet e-mail messages > > p5-Module-Build-0.3800_1 Build and install Perl modules > > p5-Module-Metadata-1.000005 Perl extension to gather package information from perl modu > > p5-Net-CIDR-0.14 Perl module to manipulate IPv4/IPv6 netblocks in CIDR notat > > p5-Net-DNS-0.66_1 Perl5 interface to the DNS resolver, and dynamic updates > > p5-Net-DNS-Resolver-Programmable-0.003 Programmable DNS resolver for off-line testing > > p5-Net-HTTP-6.01 Low-level HTTP client > > p5-Net-IP-1.25_3 Perl extension for manipulating IPv4/IPv6 addresses > > p5-Net-Ident-1.23 Lookup the username on the remote end of a TCP/IP connectio > > p5-Net-SSLeay-1.36 Perl5 interface to SSL > > p5-NetAddr-IP-4.038 Perl module for working with IP addresses and blocks thereo > > p5-OLE-Storage_Lite-0.19 Perl module for OLE document interface > > p5-Parse-CPAN-Meta-1.44.01 Parse META.yml and other similar CPAN metadata files > > p5-Perl-OSType-1.002 Map Perl operating system names to generic types > > p5-Socket6-0.23 IPv6 related part of the C socket.h defines and structure m > > p5-Storable-2.25 Persistency for perl data structures > > p5-String-Approx-3.26_1 Perl extension for approximate matching (fuzzy matching) > > p5-Sys-Hostname-Long-1.4 Try every conceivable way to get full hostname > > p5-Sys-SigAction-0.15 Perl extension for Consistent Signal Handling > > p5-Test-Simple-0.98 Basic utilities for writing tests in perl > > p5-TimeDate-1.20,1 Perl5 module containing a better/faster date parser for abs > > p5-URI-1.59 Perl5 interface to Uniform Resource Identifier (URI) refere > > p5-Version-Requirements-0.101020 A set of version requirements for a CPAN dist > > p5-WWW-RobotRules-6.01 Database of robots.txt-derived permissions > > p5-XML-Parser-2.40 Perl extension interface to James Clark's XML parser, expat > > p5-YAML-Tiny-1.50 Read/Write YAML files with as little code as possible > > p5-libwww-6.02_1 Perl5 library for WWW access > > p5-version-0.93 Perl extension for Version Objects > > > > Is there something i can try? > > > > Regards > > Johan Hendriks > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/d2ce7cc6/attachment.html From andrew at topdog.za.net Fri Aug 19 16:19:02 2011 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Fri Aug 19 16:19:20 2011 Subject: Can't locate object method "config" MIME::ToolUtils In-Reply-To: <6C3F8332272B7D4DA26909F15F1C90E1E55DD8@SRV01.double-l.local> References: <6C3F8332272B7D4DA26909F15F1C90E1E55DD8@SRV01.double-l.local> Message-ID: On 19 Aug 2011, at 4:09 PM, Johan Hendriks wrote: > Can't locate object method "config" via package "MIME::ToolUtils" (perhaps you forgot to load "MIME::ToolUtils"?) at "config" was removed from MIME::ToolsUtils long time ago, just comment out that line, it is never used any way and only gets called when you are debugging. -- Baruwa - www.baruwa.org From maxsec at gmail.com Fri Aug 19 16:23:22 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Aug 19 16:26:05 2011 Subject: Can't locate object method "config" MIME::ToolUtils In-Reply-To: <6C3F8332272B7D4DA26909F15F1C90E1E560CE@SRV01.double-l.local> References: <6C3F8332272B7D4DA26909F15F1C90E1E55DD8@SRV01.double-l.local> <6C3F8332272B7D4DA26909F15F1C90E1E560CE@SRV01.double-l.local> Message-ID: make sure you've got the right perl being called from mailscanner, system-perl or ports perl!! -- Martin Hepworth Oxford, UK On 19 August 2011 15:57, Johan Hendriks wrote: > Yes it is installed.**** > > ** ** > > See the list of modules**** > > I also tryed reinstalling and so on.**** > > Reinstalled perl and the p5-MIME-Tools module, after that Mail Scanner > again.**** > > ** ** > > Still the same.**** > > Regards,**** > > Johan Hendriks**** > > ** ** > > ** ** > > *Van:* mailscanner-bounces@lists.mailscanner.info [mailto: > mailscanner-bounces@lists.mailscanner.info] *Namens *Glenn Steen > *Verzonden:* vrijdag 19 augustus 2011 16:27 > *Aan:* MailScanner discussion > *Onderwerp:* Re: Can't locate object method "config" MIME::ToolUtils**** > > ** ** > > And is the MIME::ToolUtils package installed? What happend when you install > it?**** > > Cheers > -- > -- Glenn**** > > Den 19 aug 2011 16:14 skrev "Johan Hendriks" : > > > > Hello all. > > > > > > > > Today i updated one of the MailScanner machines. > > > > But it can not start after the update of some perl modules. > > > > > > > > The error i get when debug is set and i start Mailscanner is > > > > > > > > Can't locate object method "config" via package "MIME::ToolUtils" > (perhaps you forgot to load "MIME::ToolUtils"?) at > /usr/local/sbin/mailscanner line 1471. > > > > > > > > My system = FreeBSD 8.2. > > > > > > > > perl-5.12.4_1 Practical Extraction and Report Language > > > > > > > > p5-Archive-Zip-1.30_1 Perl module to create, manipulate, read, and write > Zip arch > > > > p5-Authen-NTLM-1.08_1 An NTLM authentication modulelocal/sbin/mailscanner > line 1 > > > > p5-CPAN-Meta-2.110930 The distribution metadata for a CPAN dist > > > > p5-CPAN-Meta-YAML-0.003 Read and write a subset of YAML for CPAN Meta > files > > > > p5-Compress-Raw-Bzip2-2.037 Low-Level Interface to bzip2 compression > library > > > > p5-Compress-Raw-Zlib-2.037 Low-Level Interface to zlib compression > library > > > > p5-Convert-BinHex-1.119 Perl module to extract data from Macintosh BinHex > files > > > > p5-Convert-TNEF-0.17 Perl module to read TNEF files > > > > p5-Crypt-OpenSSL-Bignum-0.04 OpenSSL's multiprecision integer arithmetic > > > > p5-Crypt-OpenSSL-RSA-0.27 Perl5 module to RSA encode and decode strings > using OpenSSL > > > > p5-Crypt-OpenSSL-Random-0.04 Perl5 interface to the OpenSSL pseudo-random > number generat > > > > p5-DBD-SQLite-1.33 Provides access to SQLite3 databases through the DBI > > > > p5-DBD-mysql51-4.019 MySQL 5.1 driver for the Perl5 Database Interface > (DBI) > > > > p5-DBI-1.616 The perl5 Database Interface. Required for DBD::* > modules > > > > p5-Digest-HMAC-1.03 Perl5 interface to HMAC Message-Digest Algorithms > > > > p5-Digest-SHA1-2.13 Perl interface to the SHA-1 Algorithm > > > > p5-Encode-Detect-1.01 An Encode::Encoding subclass that detects the > encoding of d > > > > p5-Encode-Locale-1.02 Determine the locale encoding > > > > p5-Error-0.17016 Perl module to provide Error/exception support for > perl: Er > > > > p5-ExtUtils-CBuilder-0.2802.02,1 Compile and link C code for Perl modules > > > > p5-ExtUtils-Install-1.54_1 Perl extension to install files from here to > there > > > > p5-ExtUtils-ParseXS-3.03 Converts Perl XS code into C code > > > > p5-File-Listing-6.02 Parse directory listings > > > > p5-File-Tail-0.99.3 Perl Module to read the end of a file as it\'s > appended to > > > > p5-Filesys-Df-0.92 Perl extension for filesystem space > > > > p5-FuzzyOcr-2.3.b_8,1 Plugin for SpamAssassin which scans image > attachments for s > > > > p5-Geography-Countries-2009041301 Handle ISO-3166 country codes > > > > p5-HTML-Parser-3.68 Perl5 module for parsing HTML documents > > > > p5-HTML-Tagset-3.20 Some useful data table in parsing HTML > > > > p5-HTTP-Cookies-6.00 HTTP Cookie jars > > > > p5-HTTP-Daemon-6.00 Simple HTTP server class > > > > p5-HTTP-Date-6.00 Conversion routines for the HTTP protocol date > formats > > > > p5-HTTP-Message-6.02 Representation of HTTP style messages > > > > p5-HTTP-Negotiate-6.00 Implementation of the HTTP content negotiation > algorithm > > > > p5-IO-Compress-2.037 Perl5 compression modules (bzip2, deflate, gzip, > zlib, zip) > > > > p5-IO-Socket-INET6-2.67 Perl module with object interface to AF_INET6 > domain socket > > > > p5-IO-Socket-SSL-1.44 Perl5 interface to SSL sockets > > > > p5-IO-stringy-2.110 Perl5 module for using IO handles with non-file > objects > > > > p5-IP-Country-2.27 Fast lookup of country codes from IP addresses > > > > p5-JSON-PP-2.27200 A JSON::XS compatible pure-Perl module > > > > p5-LWP-MediaTypes-6.01 Guess media type for a file or a URL > > > > p5-Locale-gettext-1.05_3 Message handling functions > > > > p5-MIME-Tools-5.502,2 A set of perl5 modules for MIME > > > > p5-Mail-DKIM-0.39 Perl5 module to process and/or create DKIM email > > > > p5-Mail-SPF-2.007 Reference implementation of the RFC 4408 SPF protocol > > > > p5-Mail-SpamAssassin-3.3.2_1 A highly efficient mail filter for > identifying spam > > > > p5-Mail-Tools-2.08 Perl5 modules for dealing with Internet e-mail > messages > > > > p5-Module-Build-0.3800_1 Build and install Perl modules > > > > p5-Module-Metadata-1.000005 Perl extension to gather package information > from perl modu > > > > p5-Net-CIDR-0.14 Perl module to manipulate IPv4/IPv6 netblocks in CIDR > notat > > > > p5-Net-DNS-0.66_1 Perl5 interface to the DNS resolver, and dynamic > updates > > > > p5-Net-DNS-Resolver-Programmable-0.003 Programmable DNS resolver for > off-line testing > > > > p5-Net-HTTP-6.01 Low-level HTTP client > > > > p5-Net-IP-1.25_3 Perl extension for manipulating IPv4/IPv6 addresses > > > > p5-Net-Ident-1.23 Lookup the username on the remote end of a TCP/IP > connectio > > > > p5-Net-SSLeay-1.36 Perl5 interface to SSL > > > > p5-NetAddr-IP-4.038 Perl module for working with IP addresses and blocks > thereo > > > > p5-OLE-Storage_Lite-0.19 Perl module for OLE document interface > > > > p5-Parse-CPAN-Meta-1.44.01 Parse META.yml and other similar CPAN metadata > files > > > > p5-Perl-OSType-1.002 Map Perl operating system names to generic types > > > > p5-Socket6-0.23 IPv6 related part of the C socket.h defines and > structure m > > > > p5-Storable-2.25 Persistency for perl data structures > > > > p5-String-Approx-3.26_1 Perl extension for approximate matching (fuzzy > matching) > > > > p5-Sys-Hostname-Long-1.4 Try every conceivable way to get full hostname > > > > p5-Sys-SigAction-0.15 Perl extension for Consistent Signal Handling > > > > p5-Test-Simple-0.98 Basic utilities for writing tests in perl > > > > p5-TimeDate-1.20,1 Perl5 module containing a better/faster date parser > for abs > > > > p5-URI-1.59 Perl5 interface to Uniform Resource Identifier (URI) > refere > > > > p5-Version-Requirements-0.101020 A set of version requirements for a CPAN > dist > > > > p5-WWW-RobotRules-6.01 Database of robots.txt-derived permissions > > > > p5-XML-Parser-2.40 Perl extension interface to James Clark's XML parser, > expat > > > > p5-YAML-Tiny-1.50 Read/Write YAML files with as little code as possible > > > > p5-libwww-6.02_1 Perl5 library for WWW access > > > > p5-version-0.93 Perl extension for Version Objects > > > > > > > > Is there something i can try? > > > > > > > > Regards > > > > Johan Hendriks > > > > > > -- > > MailScanner mailing list > > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > >**** > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/ce24ea9b/attachment.html From Johan at double-l.nl Fri Aug 19 18:12:08 2011 From: Johan at double-l.nl (Johan Hendriks) Date: Fri Aug 19 18:12:09 2011 Subject: Mailscanner won't start. Message-ID: <6C3F8332272B7D4DA26909F15F1C90E1E561B2@SRV01.double-l.local> After a system update, i noticed that the hold dir from postfix which contains some mail does not get picked up anymore. So i set MailScanner in debug mode, and i get the following error. # /usr/local/etc/rc.d/mailscanner start Starting mailscanner. In Debugging mode, not forking... Trying to setlogsock(unix) Building a message batch to scan... Insecure dependency in open while running with -T switch at /usr/local/lib/MailScanner/MailScanner/Lock.pm line 358. /usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner Someone knows what i can do about this? The system is FreeBSD 8.2 I did only updated some perl modules. All is installed from ports I rebuid mailscanner, plus perl and all perl modules, still get this error. Regards, Johan Hendriks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/629f26d6/attachment-0001.html From Johan at double-l.nl Fri Aug 19 18:13:52 2011 From: Johan at double-l.nl (Johan Hendriks) Date: Fri Aug 19 18:13:50 2011 Subject: Can't locate object method "config" MIME::ToolUtils In-Reply-To: References: <6C3F8332272B7D4DA26909F15F1C90E1E55DD8@SRV01.double-l.local> <6C3F8332272B7D4DA26909F15F1C90E1E560CE@SRV01.double-l.local> Message-ID: <6C3F8332272B7D4DA26909F15F1C90E1E561BE@SRV01.double-l.local> >make sure you've got the right perl being called from mailscanner, system-perl or ports perl!! >Martin Hepworth >Oxford, UK On FreeBSD 8 there is no perl in the base system. Perl has been removed from base sinds FreeBSD 5 if my memory served me well. The patch supplied by andrew make Mailscanner work in debug mode again.! Thank you all for your time! Regards, Johan Hendriks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/8211dead/attachment.html From jeremy at fluxlabs.net Fri Aug 19 18:20:09 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Fri Aug 19 18:20:35 2011 Subject: Mailscanner won't start. In-Reply-To: <6C3F8332272B7D4DA26909F15F1C90E1E561B2@SRV01.double-l.local> References: <6C3F8332272B7D4DA26909F15F1C90E1E561B2@SRV01.double-l.local> Message-ID: <7A0952BD-E6D3-4688-B488-E3EC8EE1E0AC@fluxlabs.net> I am having the same issues, but with Ubuntu. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 19, 2011, at 12:19 PM, Johan Hendriks > wrote: After a system update, i noticed that the hold dir from postfix which contains some mail does not get picked up anymore. So i set MailScanner in debug mode, and i get the following error. # /usr/local/etc/rc.d/mailscanner start Starting mailscanner. In Debugging mode, not forking... Trying to setlogsock(unix) Building a message batch to scan... Insecure dependency in open while running with -T switch at /usr/local/lib/MailScanner/MailScanner/Lock.pm line 358. /usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner Someone knows what i can do about this? The system is FreeBSD 8.2 I did only updated some perl modules. All is installed from ports I rebuid mailscanner, plus perl and all perl modules, still get this error. Regards, Johan Hendriks -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/9de2d4db/attachment.html From maxsec at gmail.com Fri Aug 19 19:20:43 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Aug 19 19:20:51 2011 Subject: Mailscanner won't start. In-Reply-To: <7A0952BD-E6D3-4688-B488-E3EC8EE1E0AC@fluxlabs.net> References: <6C3F8332272B7D4DA26909F15F1C90E1E561B2@SRV01.double-l.local> <7A0952BD-E6D3-4688-B488-E3EC8EE1E0AC@fluxlabs.net> Message-ID: Latest beta plus start with -u flag at top of mailscanner perl script should fix it Martin On Friday, 19 August 2011, Jeremy McSpadden wrote: > I am having the same issues, but with Ubuntu. > > -- > Jeremy McSpadden > Flux Labs, Inc > http://www.fluxlabs.net > Endless Solutions > Office : 850-588-4626 > Cell : 850-890-2543 > Fax : 850-254-2955 > > On Aug 19, 2011, at 12:19 PM, Johan Hendriks wrote: > > After a system update, i noticed that the hold dir from postfix which contains some mail does not get picked up anymore. > > So i set MailScanner in debug mode, and i get the following error. > > > > # /usr/local/etc/rc.d/mailscanner start > > Starting mailscanner. > > > > > > In Debugging mode, not forking... > > Trying to setlogsock(unix) > > Building a message batch to scan... > > Insecure dependency in open while running with -T switch at /usr/local/lib/MailScanner/MailScanner/Lock.pm line 358. > > /usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner > > > > Someone knows what i can do about this? > > > > The system is FreeBSD 8.2 > > > > I did only updated some perl modules. > > All is installed from ports > > I rebuid mailscanner, plus perl and all perl modules, still get this error. > > > > > > Regards, > > Johan Hendriks > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110819/744cc4e8/attachment.html From lhaig at haigmail.com Fri Aug 19 20:08:55 2011 From: lhaig at haigmail.com (Lance Haig) Date: Fri Aug 19 20:09:13 2011 Subject: New Build of MS Message-ID: <4E4EB4C7.70302@haigmail.com> hey, I am about to rebuild my MX server and I was wondering if anyone here knows of a comprehensive howto on installing MS that has info for all the new features that have been added to MS? I thought I would ask here first as this is authoritive source for all things MS Thanks Lance -- This message was scanned by Better Hosted and is believed to be clean. http://www.betterhosted.com From mail_list at woh.rr.com Sun Aug 21 15:11:58 2011 From: mail_list at woh.rr.com (Mailing List) Date: Sun Aug 21 15:12:14 2011 Subject: CentOS 6 and MailScanner Message-ID: <4E51122E.6040901@woh.rr.com> Hi List, Has any one successfully installed the rpm version of MailScanner on a CentOS 6 machine. I have ran into the same errors as others have posted, but being just lightly comfortable with linux I do not want to install a tar on an rpm formatted system. I also must note that the installer for clamav-SpamAssassin errors just as bad, So if anyone has any idea's or recomendations please let me know. TIA Brian. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/pkcs7-signature Size: 4326 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110821/e04ff250/smime.bin From jeremy at fluxlabs.net Sun Aug 21 15:20:42 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Sun Aug 21 15:21:45 2011 Subject: CentOS 6 and MailScanner In-Reply-To: <4E51122E.6040901@woh.rr.com> References: <4E51122E.6040901@woh.rr.com> Message-ID: Try posting your errors. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 21, 2011, at 9:20 AM, "Mailing List" wrote: > > Hi List, > > Has any one successfully installed the rpm version of MailScanner on > a CentOS 6 machine. I have ran into the same errors as others have > posted, but being just lightly comfortable with linux I do not want to > install a tar on an rpm formatted system. > > I also must note that the installer for clamav-SpamAssassin errors > just as bad, So if anyone has any idea's or recomendations please let me > know. > > TIA > > Brian. > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From mail_list at woh.rr.com Sun Aug 21 17:27:14 2011 From: mail_list at woh.rr.com (Mailing List) Date: Sun Aug 21 17:27:27 2011 Subject: CentOS 6 and MailScanner In-Reply-To: References: <4E51122E.6040901@woh.rr.com> Message-ID: <4E5131E2.4090606@woh.rr.com> On 8/21/2011 10:20 AM, Jeremy McSpadden wrote: > Try posting your errors. > > -- > Jeremy McSpadden > Flux Labs, Inc > http://www.fluxlabs.net > Endless Solutions > Office : 850-588-4626 > Cell : 850-890-2543 > Fax : 850-254-2955 > > > On Aug 21, 2011, at 9:20 AM, "Mailing List" wrote: > > With any perl module the install script tries it is the same error, this also goes for the clamav-SpamAssassin script as well. make: *** No rule to make target `/usr/lib64/perl5/CORE/config.h', needed by `Makefile'. Stop. error: Bad exit status from /var/tmp/rpm-tmp.ar3QuO (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.ar3QuO (%build) Centos 6 with latest updates , MailScanner version 4.83.3.5-1 Brian. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/pkcs7-signature Size: 4326 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110821/f207b675/smime.bin From mail_list at woh.rr.com Sun Aug 21 17:54:53 2011 From: mail_list at woh.rr.com (Mailing List) Date: Sun Aug 21 17:55:05 2011 Subject: CentOS 6 and MailScanner In-Reply-To: <4E51122E.6040901@woh.rr.com> References: <4E51122E.6040901@woh.rr.com> Message-ID: <4E51385D.1050405@woh.rr.com> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/pkcs7-signature Size: 4326 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110821/eb389f2f/smime.bin From J.Ede at birchenallhowden.co.uk Sun Aug 21 18:28:01 2011 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Sun Aug 21 18:29:01 2011 Subject: CentOS 6 and MailScanner In-Reply-To: <4E51122E.6040901@woh.rr.com> References: <4E51122E.6040901@woh.rr.com> Message-ID: > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Mailing List > Sent: 21 August 2011 15:12 > To: 'MailScanner discussion' > Subject: CentOS 6 and MailScanner > > > Hi List, > > Has any one successfully installed the rpm version of MailScanner on a > CentOS 6 machine. I have ran into the same errors as others have posted, > but being just lightly comfortable with linux I do not want to install a tar on > an rpm formatted system. > > I also must note that the installer for clamav-SpamAssassin errors just as > bad, So if anyone has any idea's or recomendations please let me know. > > TIA > > Brian. I added the EPEL repository and use that to keep clam uptodate and to provide most of the requirements for spamassassin... Other than adding the -U for tainting MS works fine on Centos6 with no issues. Jason From mailscanner at barendse.to Sun Aug 21 22:12:38 2011 From: mailscanner at barendse.to (Remco Barendse) Date: Sun Aug 21 22:12:59 2011 Subject: CentOS 6 and MailScanner In-Reply-To: References: <4E51122E.6040901@woh.rr.com> Message-ID: On Sun, 21 Aug 2011, Jason Ede wrote: >> Brian. > > I added the EPEL repository and use that to keep clam uptodate and to provide most of the requirements for spamassassin... Other than adding the -U for tainting MS works fine on Centos6 with no issues. > > Jason Did you manage to get it working with selinux in enforcing mode? I'm a n00b when it comes to selinux but is the problem as simple as fixing the permissions on the temporary files directory? Or is there more? From J.Ede at birchenallhowden.co.uk Mon Aug 22 08:31:52 2011 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Mon Aug 22 08:32:20 2011 Subject: CentOS 6 and MailScanner In-Reply-To: References: <4E51122E.6040901@woh.rr.com> Message-ID: > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Remco Barendse > Sent: 21 August 2011 22:13 > To: MailScanner discussion > Subject: RE: CentOS 6 and MailScanner > > On Sun, 21 Aug 2011, Jason Ede wrote: > > >> Brian. > > > > I added the EPEL repository and use that to keep clam uptodate and to > provide most of the requirements for spamassassin... Other than adding the > -U for tainting MS works fine on Centos6 with no issues. > > > > Jason > > > Did you manage to get it working with selinux in enforcing mode? > > I'm a n00b when it comes to selinux but is the problem as simple as fixing the > permissions on the temporary files directory? Or is there more? > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! I've just disabled selinux. For a time I did try and set it all up properly, but it got to be too much of a pain. Use chroot jails where possible on MTAs and it will help From octaviomaiden at yahoo.com Mon Aug 22 18:00:19 2011 From: octaviomaiden at yahoo.com (Octavio) Date: Mon Aug 22 18:00:28 2011 Subject: starting loop In-Reply-To: References: <4E51122E.6040901@woh.rr.com> Message-ID: <1314032419.93492.YahooMailNeo@web38902.mail.mud.yahoo.com> Hello I have install MailScanner in a debian as always did but now after config it gets stuck in a starting loop Aug 22 18:20:12 mail MailScanner[30213]: MailScanner E-Mail Virus Scanner version 4.79.11 starting... Aug 22 18:20:12 mail MailScanner[30213]: Reading configuration file /etc/MailScanner/MailScanner.conf Aug 22 18:20:12 mail MailScanner[30213]: Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*, skipping them. Aug 22 18:20:12 mail MailScanner[30213]: Read 858 hostnames from the phishing whitelist Aug 22 18:20:12 mail MailScanner[30213]: Read 5497 hostnames from the phishing blacklists Aug 22 18:20:12 mail MailScanner[30213]: Using SpamAssassin results cache Aug 22 18:20:12 mail MailScanner[30213]: Connected to SpamAssassin cache database Aug 22 18:20:12 mail MailScanner[30213]: Enabling SpamAssassin auto-whitelist functionality... Aug 22 18:20:14 mail MailScanner[30213]: I have found clamd scanners installed, and will use them all by default. Aug 22 18:20:14 mail MailScanner[30213]: Connected to Processing Attempts Database Aug 22 18:20:14 mail MailScanner[30213]: Found 0 messages in the Processing Attempts Database Aug 22 18:20:14 mail MailScanner[30213]: Using locktype = flock Any idea whats is going on? Thanks Octavio -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110822/a918805d/attachment.html From mailinglist at mindconnect.nl Mon Aug 22 18:15:48 2011 From: mailinglist at mindconnect.nl (Martijn) Date: Mon Aug 22 18:16:46 2011 Subject: starting loop In-Reply-To: <1314032419.93492.YahooMailNeo@web38902.mail.mud.yahoo.com> References: <4E51122E.6040901@woh.rr.com> <1314032419.93492.YahooMailNeo@web38902.mail.mud.yahoo.com> Message-ID: <4E528EC4.6010306@mindconnect.nl> On 22-8-2011 19:00, Octavio wrote: > Hello > > I have install MailScanner in a debian as always did but now after > config it gets stuck in a starting loop > > [cut] > > Any idea whats is going on? > > Thanks > > Octavio I had this too when installing on Ubuntu 10 LTS after following the instructions on the site using a older .deb. I have not yet figured out what the exact cause is, but others advised me to build MailScanner from the latest beta or a newer .deb instead of using the instructions. You can read more about what others suggested to me here: http://lists.mailscanner.info/pipermail/mailscanner/2011-August/thread.html See the "Bunch of issues" topics and the replies. - Martijn From jbull at esd113.org Mon Aug 22 23:06:24 2011 From: jbull at esd113.org (John Bull) Date: Mon Aug 22 23:06:05 2011 Subject: Spam remaining in hold queue Message-ID: <2046762850AF9D4DA8E1EB3B6F2BA19C10284120@VA3DIAXVS1A1.RED001.local> List, Testing Lab - Installation specifics: MailScanner-4.84.3-1.rpm.tar Postfix 2.6.6 Scientific Linux 6.1, perl 5.10.1 High scoring spam is set to: store and notify Problem: Email with gtube spam test remains in the Postfix hold queue and is not delivered to the spam quarantine. # postqueue -p -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- EFF9C4EB9! 755 Mon Aug 22 13:22:51 jbull@esd113.lab tone@test.lab MailScanner successfully creates /var/Spool/MailScanner/quarantine//spam but the email never makes it there. Directory Permissions: chown -R postfix.clamav /var/spool/MailScanner/incoming chmod -R 770 /var/spool/MailScanner/incoming chown postfix.postfix /var/spool/MailScanner/incoming/SpamAssassin.cache.db chown postfix.postfix -R /var/spool/MailScanner/incoming/SpamAssassin-Temp chown postfix.postfix /var/spool/MailScanner/incoming/Processing.db chown -R postfix.apache /var/spool/MailScanner/quarantine chmod 770 -R /var/spool/MailScanner/quarantine mkdir /var/spool/MailScanner/spamassassin chown -R postfix:postfix /var/spool/MailScanner/spamassassin chmod -R 770 /var/spool/MailScanner/spamassassin MailScanner Config Run As User = postfix Run As Group = postfix Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = /var/spool/postfix/incoming Incoming Work Dir = /var/spool/MailScanner/incoming MTA = postfix Sendmail = /usr/sbin/sendmail.postfix Incoming Work Group = clamav Incoming Work Permissions = 0644 Quarantine User = postfix Quarantine Group = apache Quarantine Permissions = 0660 Virus Scanners = clamd Quarantine Infections = no Quarantine Whole Message = yes Quarantine Whole Messages As Queue Files = no Keep Spam And MCP Archive Clean = yes Spam Checks = yes Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules Is Definitely Spam = %rules-dir%/spam.blacklist.rules Definite Spam Is High Scoring = yes Use SpamAssassin = yes Required SpamAssassin Score = 4.75 High SpamAssassin Score = 6 Spam Score = yes Spam Actions = deliver High Scoring Spam Actions = store notify Maillog: Spam Checks: Starting Aug 22 13:26:06 opened MailScanner[2548]: Message EFF9C4EB9.A5C23 from 192.168.0.110 (jbull@esd113.lab) to test.lab is spam, SpamAssassin (score=1001.99, required 4.75, autolearn=disabled, ALL_TRUSTED -1.00, DCC_CHECK 3.00, GTUBE 1000.00, T_RP_MATCHES_RCVD -0.01) Aug 22 13:26:06 opened MailScanner[2548]: Spam Checks: Found 1 spam messages Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: message EFF9C4EB9.A5C23 actions are store,notify Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: Notify tone@test.lab : Warning: skipping message EFF9C4EB9.A5C23 as it has been attempted too many times Aug 22 13:46:35 opened MailScanner[3396]: Quarantined message EFF9C4EB9.A5C23 as it caused MailScanner to crash several times MailScanner --processing Currently being processed: Number of messages: 1 Tries Message Next Try At ===== ======= =========== 6 EFF9C4EB9.A5C23 Mon Aug 22 13:49:34 2011 # MailScanner --lint --debug Trying to setlogsock(unix) Reading configuration file /etc/MailScanner/MailScanner.conf Reading configuration file /etc/MailScanner/conf.d/README Read 867 hostnames from the phishing whitelist Read 4076 hostnames from the phishing blacklists Checking version numbers... Version number in MailScanner.conf (4.84.3) is correct. MailScanner setting GID to (89) MailScanner setting UID to (89) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Connected to Processing Attempts Database Created Processing Attempts Database successfully There is 1 message in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = clamd" Found these virus scanners installed: clamd =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus Scanning: Clamd found 2 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 2 viruses =========================================================================== Virus Scanner test reports: Clamd said "eicar.com was infected: Eicar-Test-Signature" If any of your virus scanners (clamd) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. Thank you, John -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110822/310e6d14/attachment.html From stephencoxmail at gmail.com Tue Aug 23 08:07:36 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Tue Aug 23 08:07:45 2011 Subject: Spam remaining in hold queue In-Reply-To: <2046762850AF9D4DA8E1EB3B6F2BA19C10284120@VA3DIAXVS1A1.RED001.local> References: <2046762850AF9D4DA8E1EB3B6F2BA19C10284120@VA3DIAXVS1A1.RED001.local> Message-ID: On Tue, Aug 23, 2011 at 12:06 AM, John Bull wrote: > MailScanner-4.84.3-1.rpm.tar I think we have the same issue. What is your output of MailScanner --debug -- Stephen Cox From glenn.steen at gmail.com Wed Aug 24 00:59:40 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed Aug 24 00:59:50 2011 Subject: Spam remaining in hold queue In-Reply-To: <2046762850AF9D4DA8E1EB3B6F2BA19C10284120@VA3DIAXVS1A1.RED001.local> References: <2046762850AF9D4DA8E1EB3B6F2BA19C10284120@VA3DIAXVS1A1.RED001.local> Message-ID: What is the debug result for a gtube run, not eicar as you showed that to be fine...? The processing db thing kind of indicate that something is killing ms. Cheers -- -- Glenn Den 23 aug 2011 00:12 skrev "John Bull" : > List, > > Testing Lab - Installation specifics: > MailScanner-4.84.3-1.rpm.tar > Postfix 2.6.6 > Scientific Linux 6.1, perl 5.10.1 > High scoring spam is set to: store and notify > > Problem: > Email with gtube spam test remains in the Postfix hold queue and is not delivered to the spam quarantine. > > # postqueue -p > -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- > EFF9C4EB9! 755 Mon Aug 22 13:22:51 jbull@esd113.lab > tone@test.lab > > MailScanner successfully creates /var/Spool/MailScanner/quarantine//spam > but the email never makes it there. > > Directory Permissions: > chown -R postfix.clamav /var/spool/MailScanner/incoming > chmod -R 770 /var/spool/MailScanner/incoming > chown postfix.postfix /var/spool/MailScanner/incoming/SpamAssassin.cache.db > chown postfix.postfix -R /var/spool/MailScanner/incoming/SpamAssassin-Temp > chown postfix.postfix /var/spool/MailScanner/incoming/Processing.db > > chown -R postfix.apache /var/spool/MailScanner/quarantine > chmod 770 -R /var/spool/MailScanner/quarantine > > mkdir /var/spool/MailScanner/spamassassin > chown -R postfix:postfix /var/spool/MailScanner/spamassassin > chmod -R 770 /var/spool/MailScanner/spamassassin > > MailScanner Config > Run As User = postfix > Run As Group = postfix > Incoming Queue Dir = /var/spool/postfix/hold > Outgoing Queue Dir = /var/spool/postfix/incoming > Incoming Work Dir = /var/spool/MailScanner/incoming > MTA = postfix > Sendmail = /usr/sbin/sendmail.postfix > Incoming Work Group = clamav > Incoming Work Permissions = 0644 > Quarantine User = postfix > Quarantine Group = apache > Quarantine Permissions = 0660 > Virus Scanners = clamd > Quarantine Infections = no > Quarantine Whole Message = yes > Quarantine Whole Messages As Queue Files = no > Keep Spam And MCP Archive Clean = yes > Spam Checks = yes > Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules > Is Definitely Spam = %rules-dir%/spam.blacklist.rules > Definite Spam Is High Scoring = yes > Use SpamAssassin = yes > Required SpamAssassin Score = 4.75 > High SpamAssassin Score = 6 > Spam Score = yes > Spam Actions = deliver > High Scoring Spam Actions = store notify > > > Maillog: > Spam Checks: Starting > Aug 22 13:26:06 opened MailScanner[2548]: Message EFF9C4EB9.A5C23 from 192.168.0.110 (jbull@esd113.lab) to test.lab is spam, SpamAssassin (score=1001.99, required 4.75, autolearn=disabled, ALL_TRUSTED -1.00, DCC_CHECK 3.00, GTUBE 1000.00, T_RP_MATCHES_RCVD -0.01) > Aug 22 13:26:06 opened MailScanner[2548]: Spam Checks: Found 1 spam messages > Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: message EFF9C4EB9.A5C23 actions are store,notify > Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: Notify tone@test.lab > > : Warning: skipping message EFF9C4EB9.A5C23 as it has been attempted too many times > Aug 22 13:46:35 opened MailScanner[3396]: Quarantined message EFF9C4EB9.A5C23 as it caused MailScanner to crash several times > > MailScanner --processing > Currently being processed: > > Number of messages: 1 > Tries Message Next Try At > ===== ======= =========== > 6 EFF9C4EB9.A5C23 Mon Aug 22 13:49:34 2011 > > # MailScanner --lint --debug > Trying to setlogsock(unix) > > Reading configuration file /etc/MailScanner/MailScanner.conf > Reading configuration file /etc/MailScanner/conf.d/README > Read 867 hostnames from the phishing whitelist > Read 4076 hostnames from the phishing blacklists > > Checking version numbers... > Version number in MailScanner.conf (4.84.3) is correct. > MailScanner setting GID to (89) > MailScanner setting UID to (89) > > Checking for SpamAssassin errors (if you use it)... > Using SpamAssassin results cache > Connected to SpamAssassin cache database > SpamAssassin reported no errors. > Connected to Processing Attempts Database > Created Processing Attempts Database successfully > There is 1 message in the Processing Attempts Database > Using locktype = posix > MailScanner.conf says "Virus Scanners = clamd" > Found these virus scanners installed: clamd > =========================================================================== > Filename Checks: Windows/DOS Executable (1 eicar.com) > Other Checks: Found 1 problems > Virus and Content Scanning: Starting > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com > Virus Scanning: Clamd found 2 infections > Infected message 1 came from 10.1.1.1 > Virus Scanning: Found 2 viruses > =========================================================================== > Virus Scanner test reports: > Clamd said "eicar.com was infected: Eicar-Test-Signature" > > If any of your virus scanners (clamd) > are not listed there, you should check that they are installed correctly > and that MailScanner is finding them correctly via its virus.scanners.conf. > > Thank you, > John -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110824/bbe6f83f/attachment.html From jbull at esd113.org Wed Aug 24 19:38:18 2011 From: jbull at esd113.org (John Bull) Date: Wed Aug 24 19:38:07 2011 Subject: Spam remaining in hold queue In-Reply-To: References: <2046762850AF9D4DA8E1EB3B6F2BA19C10284120@VA3DIAXVS1A1.RED001.local> Message-ID: <2046762850AF9D4DA8E1EB3B6F2BA19C103143AF@VA3DIAXVS1A1.RED001.local> I have tried numerous attempts to edit directory/file permissions so I believe that can safely be ruled out as an issue. Mailscanner -debug is hanging after the message "Building a message batch to scan... # MailScanner --debug In Debugging mode, not forking... Trying to setlogsock(unix) Building a message batch to scan... It maybe that there are additional Perl taint issues that remain. My production build on CentOS 5.6 with Perl 5.8.8 has always worked like a charm. Regards, John From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Glenn Steen Sent: Tuesday, August 23, 2011 5:00 PM To: MailScanner discussion Subject: Re: Spam remaining in hold queue What is the debug result for a gtube run, not eicar as you showed that to be fine...? The processing db thing kind of indicate that something is killing ms. Cheers -- -- Glenn Den 23 aug 2011 00:12 skrev "John Bull" >: > List, > > Testing Lab - Installation specifics: > MailScanner-4.84.3-1.rpm.tar > Postfix 2.6.6 > Scientific Linux 6.1, perl 5.10.1 > High scoring spam is set to: store and notify > > Problem: > Email with gtube spam test remains in the Postfix hold queue and is not delivered to the spam quarantine. > > # postqueue -p > -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- > EFF9C4EB9! 755 Mon Aug 22 13:22:51 jbull@esd113.lab > tone@test.lab> > > MailScanner successfully creates /var/Spool/MailScanner/quarantine//spam > but the email never makes it there. > > Directory Permissions: > chown -R postfix.clamav /var/spool/MailScanner/incoming > chmod -R 770 /var/spool/MailScanner/incoming > chown postfix.postfix /var/spool/MailScanner/incoming/SpamAssassin.cache.db > chown postfix.postfix -R /var/spool/MailScanner/incoming/SpamAssassin-Temp > chown postfix.postfix /var/spool/MailScanner/incoming/Processing.db > > chown -R postfix.apache /var/spool/MailScanner/quarantine > chmod 770 -R /var/spool/MailScanner/quarantine > > mkdir /var/spool/MailScanner/spamassassin > chown -R postfix:postfix /var/spool/MailScanner/spamassassin > chmod -R 770 /var/spool/MailScanner/spamassassin > > MailScanner Config > Run As User = postfix > Run As Group = postfix > Incoming Queue Dir = /var/spool/postfix/hold > Outgoing Queue Dir = /var/spool/postfix/incoming > Incoming Work Dir = /var/spool/MailScanner/incoming > MTA = postfix > Sendmail = /usr/sbin/sendmail.postfix > Incoming Work Group = clamav > Incoming Work Permissions = 0644 > Quarantine User = postfix > Quarantine Group = apache > Quarantine Permissions = 0660 > Virus Scanners = clamd > Quarantine Infections = no > Quarantine Whole Message = yes > Quarantine Whole Messages As Queue Files = no > Keep Spam And MCP Archive Clean = yes > Spam Checks = yes > Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules > Is Definitely Spam = %rules-dir%/spam.blacklist.rules > Definite Spam Is High Scoring = yes > Use SpamAssassin = yes > Required SpamAssassin Score = 4.75 > High SpamAssassin Score = 6 > Spam Score = yes > Spam Actions = deliver > High Scoring Spam Actions = store notify > > > Maillog: > Spam Checks: Starting > Aug 22 13:26:06 opened MailScanner[2548]: Message EFF9C4EB9.A5C23 from 192.168.0.110 (jbull@esd113.lab) to test.lab is spam, SpamAssassin (score=1001.99, required 4.75, autolearn=disabled, ALL_TRUSTED -1.00, DCC_CHECK 3.00, GTUBE 1000.00, T_RP_MATCHES_RCVD -0.01) > Aug 22 13:26:06 opened MailScanner[2548]: Spam Checks: Found 1 spam messages > Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: message EFF9C4EB9.A5C23 actions are store,notify > Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: Notify tone@test.lab> > > : Warning: skipping message EFF9C4EB9.A5C23 as it has been attempted too many times > Aug 22 13:46:35 opened MailScanner[3396]: Quarantined message EFF9C4EB9.A5C23 as it caused MailScanner to crash several times > > MailScanner --processing > Currently being processed: > > Number of messages: 1 > Tries Message Next Try At > ===== ======= =========== > 6 EFF9C4EB9.A5C23 Mon Aug 22 13:49:34 2011 > > # MailScanner --lint --debug > Trying to setlogsock(unix) > > Reading configuration file /etc/MailScanner/MailScanner.conf > Reading configuration file /etc/MailScanner/conf.d/README > Read 867 hostnames from the phishing whitelist > Read 4076 hostnames from the phishing blacklists > > Checking version numbers... > Version number in MailScanner.conf (4.84.3) is correct. > MailScanner setting GID to (89) > MailScanner setting UID to (89) > > Checking for SpamAssassin errors (if you use it)... > Using SpamAssassin results cache > Connected to SpamAssassin cache database > SpamAssassin reported no errors. > Connected to Processing Attempts Database > Created Processing Attempts Database successfully > There is 1 message in the Processing Attempts Database > Using locktype = posix > MailScanner.conf says "Virus Scanners = clamd" > Found these virus scanners installed: clamd > =========================================================================== > Filename Checks: Windows/DOS Executable (1 eicar.com) > Other Checks: Found 1 problems > Virus and Content Scanning: Starting > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com > Virus Scanning: Clamd found 2 infections > Infected message 1 came from 10.1.1.1 > Virus Scanning: Found 2 viruses > =========================================================================== > Virus Scanner test reports: > Clamd said "eicar.com was infected: Eicar-Test-Signature" > > If any of your virus scanners (clamd) > are not listed there, you should check that they are installed correctly > and that MailScanner is finding them correctly via its virus.scanners.conf. > > Thank you, > John -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110824/ee0649ff/attachment.html From glenn.steen at gmail.com Thu Aug 25 14:24:43 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Aug 25 14:24:55 2011 Subject: Spam remaining in hold queue In-Reply-To: <2046762850AF9D4DA8E1EB3B6F2BA19C103143AF@VA3DIAXVS1A1.RED001.local> References: <2046762850AF9D4DA8E1EB3B6F2BA19C10284120@VA3DIAXVS1A1.RED001.local> <2046762850AF9D4DA8E1EB3B6F2BA19C103143AF@VA3DIAXVS1A1.RED001.local> Message-ID: It hangs because the queue is empty. You need stop ms, start the mta through the ms init script (should work with the startin option), supply a gtube message the same as before, then run the ms debug command. Cheers -- -- Glenn Den 24 aug 2011 20:44 skrev "John Bull" : > I have tried numerous attempts to edit directory/file permissions so I believe that can safely be ruled out as an issue. > Mailscanner -debug is hanging after the message "Building a message batch to scan... > # MailScanner --debug > In Debugging mode, not forking... > Trying to setlogsock(unix) > Building a message batch to scan... > > It maybe that there are additional Perl taint issues that remain. My production build on CentOS 5.6 with Perl 5.8.8 has always worked like a charm. > > Regards, > John > > > From: mailscanner-bounces@lists.mailscanner.info [mailto: mailscanner-bounces@lists.mailscanner.info] On Behalf Of Glenn Steen > Sent: Tuesday, August 23, 2011 5:00 PM > To: MailScanner discussion > Subject: Re: Spam remaining in hold queue > > > What is the debug result for a gtube run, not eicar as you showed that to be fine...? > The processing db thing kind of indicate that something is killing ms. > > Cheers > -- > -- Glenn > Den 23 aug 2011 00:12 skrev "John Bull" >: >> List, >> >> Testing Lab - Installation specifics: >> MailScanner-4.84.3-1.rpm.tar >> Postfix 2.6.6 >> Scientific Linux 6.1, perl 5.10.1 >> High scoring spam is set to: store and notify >> >> Problem: >> Email with gtube spam test remains in the Postfix hold queue and is not delivered to the spam quarantine. >> >> # postqueue -p >> -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- >> EFF9C4EB9! 755 Mon Aug 22 13:22:51 jbull@esd113.lab >> tone@test.lab> >> >> MailScanner successfully creates /var/Spool/MailScanner/quarantine//spam >> but the email never makes it there. >> >> Directory Permissions: >> chown -R postfix.clamav /var/spool/MailScanner/incoming >> chmod -R 770 /var/spool/MailScanner/incoming >> chown postfix.postfix /var/spool/MailScanner/incoming/SpamAssassin.cache.db >> chown postfix.postfix -R /var/spool/MailScanner/incoming/SpamAssassin-Temp >> chown postfix.postfix /var/spool/MailScanner/incoming/Processing.db >> >> chown -R postfix.apache /var/spool/MailScanner/quarantine >> chmod 770 -R /var/spool/MailScanner/quarantine >> >> mkdir /var/spool/MailScanner/spamassassin >> chown -R postfix:postfix /var/spool/MailScanner/spamassassin >> chmod -R 770 /var/spool/MailScanner/spamassassin >> >> MailScanner Config >> Run As User = postfix >> Run As Group = postfix >> Incoming Queue Dir = /var/spool/postfix/hold >> Outgoing Queue Dir = /var/spool/postfix/incoming >> Incoming Work Dir = /var/spool/MailScanner/incoming >> MTA = postfix >> Sendmail = /usr/sbin/sendmail.postfix >> Incoming Work Group = clamav >> Incoming Work Permissions = 0644 >> Quarantine User = postfix >> Quarantine Group = apache >> Quarantine Permissions = 0660 >> Virus Scanners = clamd >> Quarantine Infections = no >> Quarantine Whole Message = yes >> Quarantine Whole Messages As Queue Files = no >> Keep Spam And MCP Archive Clean = yes >> Spam Checks = yes >> Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules >> Is Definitely Spam = %rules-dir%/spam.blacklist.rules >> Definite Spam Is High Scoring = yes >> Use SpamAssassin = yes >> Required SpamAssassin Score = 4.75 >> High SpamAssassin Score = 6 >> Spam Score = yes >> Spam Actions = deliver >> High Scoring Spam Actions = store notify >> >> >> Maillog: >> Spam Checks: Starting >> Aug 22 13:26:06 opened MailScanner[2548]: Message EFF9C4EB9.A5C23 from 192.168.0.110 (jbull@esd113.lab) to test.lab is spam, SpamAssassin (score=1001.99, required 4.75, autolearn=disabled, ALL_TRUSTED -1.00, DCC_CHECK 3.00, GTUBE 1000.00, T_RP_MATCHES_RCVD -0.01) >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Checks: Found 1 spam messages >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: message EFF9C4EB9.A5C23 actions are store,notify >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: Notify tone@test.lab> >> >> : Warning: skipping message EFF9C4EB9.A5C23 as it has been attempted too many times >> Aug 22 13:46:35 opened MailScanner[3396]: Quarantined message EFF9C4EB9.A5C23 as it caused MailScanner to crash several times >> >> MailScanner --processing >> Currently being processed: >> >> Number of messages: 1 >> Tries Message Next Try At >> ===== ======= =========== >> 6 EFF9C4EB9.A5C23 Mon Aug 22 13:49:34 2011 >> >> # MailScanner --lint --debug >> Trying to setlogsock(unix) >> >> Reading configuration file /etc/MailScanner/MailScanner.conf >> Reading configuration file /etc/MailScanner/conf.d/README >> Read 867 hostnames from the phishing whitelist >> Read 4076 hostnames from the phishing blacklists >> >> Checking version numbers... >> Version number in MailScanner.conf (4.84.3) is correct. >> MailScanner setting GID to (89) >> MailScanner setting UID to (89) >> >> Checking for SpamAssassin errors (if you use it)... >> Using SpamAssassin results cache >> Connected to SpamAssassin cache database >> SpamAssassin reported no errors. >> Connected to Processing Attempts Database >> Created Processing Attempts Database successfully >> There is 1 message in the Processing Attempts Database >> Using locktype = posix >> MailScanner.conf says "Virus Scanners = clamd" >> Found these virus scanners installed: clamd >> =========================================================================== >> Filename Checks: Windows/DOS Executable (1 eicar.com) >> Other Checks: Found 1 problems >> Virus and Content Scanning: Starting >> Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com >> Virus Scanning: Clamd found 2 infections >> Infected message 1 came from 10.1.1.1 >> Virus Scanning: Found 2 viruses >> =========================================================================== >> Virus Scanner test reports: >> Clamd said "eicar.com was infected: Eicar-Test-Signature" >> >> If any of your virus scanners (clamd) >> are not listed there, you should check that they are installed correctly >> and that MailScanner is finding them correctly via its virus.scanners.conf. >> >> Thank you, >> John -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110825/cce75b15/attachment.html From jbull at esd113.org Thu Aug 25 18:20:01 2011 From: jbull at esd113.org (John Bull) Date: Thu Aug 25 18:22:33 2011 Subject: MailScanner Digest, Vol 68, Issue 20 In-Reply-To: <201108241100.p7OB0MDF014798@safir.blacknight.ie> References: <201108241100.p7OB0MDF014798@safir.blacknight.ie> Message-ID: <2046762850AF9D4DA8E1EB3B6F2BA19C1031456C@VA3DIAXVS1A1.RED001.local> # MailScanner --debug In Debugging mode, not forking... Trying to setlogsock(unix) Building a message batch to scan... Insecure dependency in mkdir while running with -T switch at /usr/lib/MailScanner/MailScanner/Quarantine.pm line 189. Regards, John -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of mailscanner-request@lists.mailscanner.info Sent: Wednesday, August 24, 2011 4:01 AM To: mailscanner@lists.mailscanner.info Subject: MailScanner Digest, Vol 68, Issue 20 Send MailScanner mailing list submissions to mailscanner@lists.mailscanner.info To subscribe or unsubscribe via the World Wide Web, visit http://lists.mailscanner.info/mailman/listinfo/mailscanner or, via email, send a message with subject or body 'help' to mailscanner-request@lists.mailscanner.info You can reach the person managing the list at mailscanner-owner@lists.mailscanner.info When replying, please edit your Subject line so it is more specific than "Re: Contents of MailScanner digest..." Today's Topics: 1. Re: Spam remaining in hold queue (Glenn Steen) ---------------------------------------------------------------------- Message: 1 Date: Wed, 24 Aug 2011 01:59:40 +0200 From: Glenn Steen Subject: Re: Spam remaining in hold queue To: MailScanner discussion Message-ID: Content-Type: text/plain; charset="iso-8859-1" What is the debug result for a gtube run, not eicar as you showed that to be fine...? The processing db thing kind of indicate that something is killing ms. Cheers -- -- Glenn Den 23 aug 2011 00:12 skrev "John Bull" : > List, > > Testing Lab - Installation specifics: > MailScanner-4.84.3-1.rpm.tar > Postfix 2.6.6 > Scientific Linux 6.1, perl 5.10.1 > High scoring spam is set to: store and notify > > Problem: > Email with gtube spam test remains in the Postfix hold queue and is > not delivered to the spam quarantine. > > # postqueue -p > -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- > EFF9C4EB9! 755 Mon Aug 22 13:22:51 jbull@esd113.lab > tone@test.lab > > MailScanner successfully creates /var/Spool/MailScanner/quarantine//spam > but the email never makes it there. > > Directory Permissions: > chown -R postfix.clamav /var/spool/MailScanner/incoming chmod -R 770 > /var/spool/MailScanner/incoming chown postfix.postfix /var/spool/MailScanner/incoming/SpamAssassin.cache.db > chown postfix.postfix -R > /var/spool/MailScanner/incoming/SpamAssassin-Temp > chown postfix.postfix /var/spool/MailScanner/incoming/Processing.db > > chown -R postfix.apache /var/spool/MailScanner/quarantine chmod 770 -R > /var/spool/MailScanner/quarantine > > mkdir /var/spool/MailScanner/spamassassin > chown -R postfix:postfix /var/spool/MailScanner/spamassassin > chmod -R 770 /var/spool/MailScanner/spamassassin > > MailScanner Config > Run As User = postfix > Run As Group = postfix > Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = > /var/spool/postfix/incoming Incoming Work Dir = > /var/spool/MailScanner/incoming MTA = postfix Sendmail = > /usr/sbin/sendmail.postfix Incoming Work Group = clamav Incoming Work > Permissions = 0644 Quarantine User = postfix Quarantine Group = apache > Quarantine Permissions = 0660 Virus Scanners = clamd Quarantine > Infections = no Quarantine Whole Message = yes Quarantine Whole > Messages As Queue Files = no Keep Spam And MCP Archive Clean = yes > Spam Checks = yes Is Definitely Not Spam = > %rules-dir%/spam.whitelist.rules Is Definitely Spam = > %rules-dir%/spam.blacklist.rules Definite Spam Is High Scoring = yes > Use SpamAssassin = yes Required SpamAssassin Score = 4.75 High > SpamAssassin Score = 6 Spam Score = yes Spam Actions = deliver High > Scoring Spam Actions = store notify > > > Maillog: > Spam Checks: Starting > Aug 22 13:26:06 opened MailScanner[2548]: Message EFF9C4EB9.A5C23 from 192.168.0.110 (jbull@esd113.lab) to test.lab is spam, SpamAssassin (score=1001.99, required 4.75, autolearn=disabled, ALL_TRUSTED -1.00, DCC_CHECK 3.00, GTUBE 1000.00, T_RP_MATCHES_RCVD -0.01) > Aug 22 13:26:06 opened MailScanner[2548]: Spam Checks: Found 1 spam messages > Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: message EFF9C4EB9.A5C23 actions are store,notify > Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: Notify tone@test.lab > > : Warning: skipping message EFF9C4EB9.A5C23 as it has been attempted > too many times > Aug 22 13:46:35 opened MailScanner[3396]: Quarantined message EFF9C4EB9.A5C23 as it caused MailScanner to crash several times > > MailScanner --processing > Currently being processed: > > Number of messages: 1 > Tries Message Next Try At > ===== ======= =========== > 6 EFF9C4EB9.A5C23 Mon Aug 22 13:49:34 2011 > > # MailScanner --lint --debug > Trying to setlogsock(unix) > > Reading configuration file /etc/MailScanner/MailScanner.conf Reading > configuration file /etc/MailScanner/conf.d/README Read 867 hostnames > from the phishing whitelist Read 4076 hostnames from the phishing > blacklists > > Checking version numbers... > Version number in MailScanner.conf (4.84.3) is correct. > MailScanner setting GID to (89) > MailScanner setting UID to (89) > > Checking for SpamAssassin errors (if you use it)... > Using SpamAssassin results cache > Connected to SpamAssassin cache database SpamAssassin reported no > errors. > Connected to Processing Attempts Database Created Processing Attempts > Database successfully There is 1 message in the Processing Attempts > Database Using locktype = posix MailScanner.conf says "Virus Scanners > = clamd" > Found these virus scanners installed: clamd > =========================================================================== > Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: > Found 1 problems Virus and Content Scanning: Starting > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus > Scanning: Clamd found 2 infections Infected message 1 came from > 10.1.1.1 Virus Scanning: Found 2 viruses > =========================================================================== > Virus Scanner test reports: > Clamd said "eicar.com was infected: Eicar-Test-Signature" > > If any of your virus scanners (clamd) > are not listed there, you should check that they are installed > correctly and that MailScanner is finding them correctly via its virus.scanners.conf. > > Thank you, > John -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110824/bbe6f83f/attachment-0001.html ------------------------------ -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read the Wiki (http://wiki.mailscanner.info/). Support MailScanner development - buy the book off the website! End of MailScanner Digest, Vol 68, Issue 20 ******************************************* From glenn.steen at gmail.com Fri Aug 26 21:36:06 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Fri Aug 26 21:36:17 2011 Subject: MailScanner Digest, Vol 68, Issue 20 In-Reply-To: <2046762850AF9D4DA8E1EB3B6F2BA19C1031456C@VA3DIAXVS1A1.RED001.local> References: <201108241100.p7OB0MDF014798@safir.blacknight.ie> <2046762850AF9D4DA8E1EB3B6F2BA19C1031456C@VA3DIAXVS1A1.RED001.local> Message-ID: Right, so you have a taint issue preventing the creation of the date subdir (or similar) in the quarantine. Did you try the usual -U thing (google it, or use gmane, I'm tipsy and would likely get something wrong;-) . Cheers -- -- Glenn Den 25 aug 2011 19:28 skrev "John Bull" : > # MailScanner --debug > > In Debugging mode, not forking... > Trying to setlogsock(unix) > Building a message batch to scan... > Insecure dependency in mkdir while running with -T switch at /usr/lib/MailScanner/MailScanner/Quarantine.pm line 189. > > Regards, > John > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto: mailscanner-bounces@lists.mailscanner.info] On Behalf Of mailscanner-request@lists.mailscanner.info > Sent: Wednesday, August 24, 2011 4:01 AM > To: mailscanner@lists.mailscanner.info > Subject: MailScanner Digest, Vol 68, Issue 20 > > Send MailScanner mailing list submissions to > mailscanner@lists.mailscanner.info > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.mailscanner.info/mailman/listinfo/mailscanner > or, via email, send a message with subject or body 'help' to > mailscanner-request@lists.mailscanner.info > > You can reach the person managing the list at > mailscanner-owner@lists.mailscanner.info > > When replying, please edit your Subject line so it is more specific than "Re: Contents of MailScanner digest..." > > > Today's Topics: > > 1. Re: Spam remaining in hold queue (Glenn Steen) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 24 Aug 2011 01:59:40 +0200 > From: Glenn Steen > Subject: Re: Spam remaining in hold queue > To: MailScanner discussion > Message-ID: > > Content-Type: text/plain; charset="iso-8859-1" > > What is the debug result for a gtube run, not eicar as you showed that to be fine...? > The processing db thing kind of indicate that something is killing ms. > > Cheers > -- > -- Glenn > Den 23 aug 2011 00:12 skrev "John Bull" : >> List, >> >> Testing Lab - Installation specifics: >> MailScanner-4.84.3-1.rpm.tar >> Postfix 2.6.6 >> Scientific Linux 6.1, perl 5.10.1 >> High scoring spam is set to: store and notify >> >> Problem: >> Email with gtube spam test remains in the Postfix hold queue and is >> not > delivered to the spam quarantine. >> >> # postqueue -p >> -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- >> EFF9C4EB9! 755 Mon Aug 22 13:22:51 jbull@esd113.lab >> tone@test.lab >> >> MailScanner successfully creates > /var/Spool/MailScanner/quarantine//spam >> but the email never makes it there. >> >> Directory Permissions: >> chown -R postfix.clamav /var/spool/MailScanner/incoming chmod -R 770 >> /var/spool/MailScanner/incoming chown postfix.postfix > /var/spool/MailScanner/incoming/SpamAssassin.cache.db >> chown postfix.postfix -R >> /var/spool/MailScanner/incoming/SpamAssassin-Temp >> chown postfix.postfix /var/spool/MailScanner/incoming/Processing.db >> >> chown -R postfix.apache /var/spool/MailScanner/quarantine chmod 770 -R >> /var/spool/MailScanner/quarantine >> >> mkdir /var/spool/MailScanner/spamassassin >> chown -R postfix:postfix /var/spool/MailScanner/spamassassin >> chmod -R 770 /var/spool/MailScanner/spamassassin >> >> MailScanner Config >> Run As User = postfix >> Run As Group = postfix >> Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = >> /var/spool/postfix/incoming Incoming Work Dir = >> /var/spool/MailScanner/incoming MTA = postfix Sendmail = >> /usr/sbin/sendmail.postfix Incoming Work Group = clamav Incoming Work >> Permissions = 0644 Quarantine User = postfix Quarantine Group = apache >> Quarantine Permissions = 0660 Virus Scanners = clamd Quarantine >> Infections = no Quarantine Whole Message = yes Quarantine Whole >> Messages As Queue Files = no Keep Spam And MCP Archive Clean = yes >> Spam Checks = yes Is Definitely Not Spam = >> %rules-dir%/spam.whitelist.rules Is Definitely Spam = >> %rules-dir%/spam.blacklist.rules Definite Spam Is High Scoring = yes >> Use SpamAssassin = yes Required SpamAssassin Score = 4.75 High >> SpamAssassin Score = 6 Spam Score = yes Spam Actions = deliver High >> Scoring Spam Actions = store notify >> >> >> Maillog: >> Spam Checks: Starting >> Aug 22 13:26:06 opened MailScanner[2548]: Message EFF9C4EB9.A5C23 from > 192.168.0.110 (jbull@esd113.lab) to test.lab is spam, SpamAssassin (score=1001.99, required 4.75, autolearn=disabled, ALL_TRUSTED -1.00, DCC_CHECK 3.00, GTUBE 1000.00, T_RP_MATCHES_RCVD -0.01) >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Checks: Found 1 spam > messages >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: message > EFF9C4EB9.A5C23 actions are store,notify >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: Notify > tone@test.lab >> >> : Warning: skipping message EFF9C4EB9.A5C23 as it has been attempted >> too > many times >> Aug 22 13:46:35 opened MailScanner[3396]: Quarantined message > EFF9C4EB9.A5C23 as it caused MailScanner to crash several times >> >> MailScanner --processing >> Currently being processed: >> >> Number of messages: 1 >> Tries Message Next Try At >> ===== ======= =========== >> 6 EFF9C4EB9.A5C23 Mon Aug 22 13:49:34 2011 >> >> # MailScanner --lint --debug >> Trying to setlogsock(unix) >> >> Reading configuration file /etc/MailScanner/MailScanner.conf Reading >> configuration file /etc/MailScanner/conf.d/README Read 867 hostnames >> from the phishing whitelist Read 4076 hostnames from the phishing >> blacklists >> >> Checking version numbers... >> Version number in MailScanner.conf (4.84.3) is correct. >> MailScanner setting GID to (89) >> MailScanner setting UID to (89) >> >> Checking for SpamAssassin errors (if you use it)... >> Using SpamAssassin results cache >> Connected to SpamAssassin cache database SpamAssassin reported no >> errors. >> Connected to Processing Attempts Database Created Processing Attempts >> Database successfully There is 1 message in the Processing Attempts >> Database Using locktype = posix MailScanner.conf says "Virus Scanners >> = clamd" >> Found these virus scanners installed: clamd >> > =========================================================================== >> Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: >> Found 1 problems Virus and Content Scanning: Starting >> Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus >> Scanning: Clamd found 2 infections Infected message 1 came from >> 10.1.1.1 Virus Scanning: Found 2 viruses >> > =========================================================================== >> Virus Scanner test reports: >> Clamd said "eicar.com was infected: Eicar-Test-Signature" >> >> If any of your virus scanners (clamd) >> are not listed there, you should check that they are installed >> correctly and that MailScanner is finding them correctly via its > virus.scanners.conf. >> >> Thank you, >> John > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110824/bbe6f83f/attachment-0001.html > > ------------------------------ > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read the Wiki (http://wiki.mailscanner.info/). > > Support MailScanner development - buy the book off the website! > > > End of MailScanner Digest, Vol 68, Issue 20 > ******************************************* > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110826/fbc86b43/attachment.html From mrm at medicine.wisc.edu Fri Aug 26 22:25:13 2011 From: mrm at medicine.wisc.edu (Michael Masse) Date: Fri Aug 26 22:25:35 2011 Subject: Tell MailScanner to stop incoming mail Message-ID: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> I'm having performance issues on one of my incoming email servers, and while I'm trying to figure out the root of that problem I need to be able to tell MailScanner to stop accepting incoming mail so that it can get caught up on the email it has already accepted and queued up. I have multiple servers running w/ this mx record, so senders should just find a different server to send to automatically if this one stops accepting. It appears to me that MailScanner starts a secondary sendmail process specifically just for receiving email vs sending, so hopefully there's some sort of startup command that would allow me to not accept new email. I've tried just blocking port 25 from the outside on this server specifically via iptables, and it does prevent outside systems from sending mail, it also keeps MailScanner from properly processing queued up mail for some reason. Any help would be greatly appreciated. -Mike -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110826/2b27e0f7/attachment.html From jeremy at fluxlabs.net Fri Aug 26 22:27:13 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Fri Aug 26 22:29:01 2011 Subject: Tell MailScanner to stop incoming mail In-Reply-To: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> References: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> Message-ID: Stop your mta -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 26, 2011, at 4:26 PM, Michael Masse wrote: > I'm having performance issues on one of my incoming email servers, and while I'm trying to figure out the root of that problem I need to be able to tell MailScanner to stop accepting incoming mail so that it can get caught up on the email it has already accepted and queued up. I have multiple servers running w/ this mx record, so senders should just find a different server to send to automatically if this one stops accepting. It appears to me that MailScanner starts a secondary sendmail process specifically just for receiving email vs sending, so hopefully there's some sort of startup command that would allow me to not accept new email. I've tried just blocking port 25 from the outside on this server specifically via iptables, and it does prevent outside systems from sending mail, it also keeps MailScanner from properly processing queued up mail for some reason. Any help would be greatly appreciated. > > -Mike > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From dave at KD0YU.COM Fri Aug 26 23:14:52 2011 From: dave at KD0YU.COM (Dave Helton) Date: Fri Aug 26 23:15:15 2011 Subject: mailwatch and jpgraph Message-ID: <4398918D4E9DB84BB07FF9EFC4B64B1177A4@dc1.KD0YU.COM> Hello all, @Mike Consider putting your incoming spool on a tmpfs partition (if you have not already), lots of documentation as to how to do it. RBL lookups are a real hit to performance also... you might disable them temporarily. @everyone else I have a problem with mailwatch. Please let me know if this is not an appropriate list for this. All reports work fine except for the ones that use jpgraph, pages are blank. A few well placed php tags reveals the pages are hanging on require_once(jpgraph.et.al) Anyone know what may be causing this? I have verfied apache owns the entire tree. EL5 MailScanner 4.83.5 Mailwatch 1.05 w/ included jpgraph 1.21 php-gd 5.1.6 Thank you --Dave Helton, KD0YU -- This message has been scanned for viruses and dangerous content by MailScanner at KD0YU.COM, and is believed to be clean. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110826/db4f39bd/attachment.html From Kevin_Miller at ci.juneau.ak.us Sat Aug 27 00:12:19 2011 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Sat Aug 27 00:12:33 2011 Subject: mailwatch and jpgraph In-Reply-To: <4398918D4E9DB84BB07FF9EFC4B64B1177A4@dc1.KD0YU.COM> References: <4398918D4E9DB84BB07FF9EFC4B64B1177A4@dc1.KD0YU.COM> Message-ID: <4A09477D575C2C4B86497161427DD94C1631BC98DE@city-exchange07> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Dave Helton Sent: Friday, August 26, 2011 2:15 PM To: mailscanner@lists.mailscanner.info Subject: mailwatch and jpgraph >@everyone else > > I have a problem with mailwatch. Please let me know if this is not an appropriate list for this. > All reports work fine except for the ones that use jpgraph, pages are blank. A few well placed php tags reveals the pages are > hanging on require_once(jpgraph.et.al) Anyone know what may be causing this? > I have verfied apache owns the entire tree. There is a mailing list for mailwatch - probably get the best response there. There's a link to it on the MailWatch home page. It's not a very noisy list so joining it isn't likely to overwhelm you with a gazillion posts... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From mrm at medicine.wisc.edu Sat Aug 27 05:16:08 2011 From: mrm at medicine.wisc.edu (Michael Masse) Date: Sat Aug 27 05:16:30 2011 Subject: Tell MailScanner to stop incoming mail In-Reply-To: References: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> Message-ID: <4E5829380200003E0003E85D@gwmail.medicine.wisc.edu> >>> On 8/26/2011 at 4:27 PM, in message , Jeremy McSpadden wrote: Stop your mta -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 Ok but how does previously accepted and queued up mail continue to process and get distributed to appropriate servers if I do that so that overflowing queues can get caught up? If I simply stop the MTA (sendmail) then how does mail flow to appropriate servers? Like I said previously: Mailscanner appears to me like it starts a separate MTA process for incoming email versus a different MTA process for sending email that has been processed. Does MailScanner give the option of not starting up the incoming MTA and only running the processing/sending MTA? Using iptables to block port 25 does block incoming emails, but seems to cause other problems so that processing/sending already queued up mail doesn't work either. If I could simply get MailScanner to temporarily not start up the incoming MTA (Sendmail) that would seemingly solve my problem. If MailScanner doesn't give the option per se, can I somehow force MailScanner to not start up the incoming MTA process? Maybe I'm looking at this all wrong, but essentially here is what I want to do: I have other servers that can respond to the same mx record lookup and when this server is having problems with it's incoming queue getting overloaded I want to manually tell it to stop accepting new mail so that it can process what it already has accepted. Other servers that respond to the same MX scope should take up the slack for new email, while hopefully I can get this one to process an overflowing queue and reduce it to a manageable size. Regarding WHY this is happening in the first place is a separate issue that I'm trying to figure out. In the mean time I need a workaround to keep email from queuing up on this server and taking forever to process. -Mike >>> On 8/26/2011 at 4:27 PM, in message , Jeremy McSpadden wrote: Stop your mta -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 26, 2011, at 4:26 PM, Michael Masse wrote: > I'm having performance issues on one of my incoming email servers, and while I'm trying to figure out the root of that problem I need to be able to tell MailScanner to stop accepting incoming mail so that it can get caught up on the email it has already accepted and queued up. I have multiple servers running w/ this mx record, so senders should just find a different server to send to automatically if this one stops accepting. It appears to me that MailScanner starts a secondary sendmail process specifically just for receiving email vs sending, so hopefully there's some sort of startup command that would allow me to not accept new email. I've tried just blocking port 25 from the outside on this server specifically via iptables, and it does prevent outside systems from sending mail, it also keeps MailScanner from properly processing queued up mail for some reason. Any help would be greatly appreciated. > > -Mike > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110826/0235cc4e/attachment.html From jeremy at fluxlabs.net Sat Aug 27 06:11:59 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Sat Aug 27 06:12:13 2011 Subject: Tell MailScanner to stop incoming mail In-Reply-To: <4E5829380200003E0003E85D@gwmail.medicine.wisc.edu> References: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> <4E5829380200003E0003E85D@gwmail.medicine.wisc.edu> Message-ID: You could also move your MTA to another port. I use postfix, no sendmail. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 26, 2011, at 11:16 PM, Michael Masse wrote: >>> On 8/26/2011 at 4:27 PM, in message >, Jeremy McSpadden > wrote: Stop your mta -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 Ok but how does previously accepted and queued up mail continue to process and get distributed to appropriate servers if I do that so that overflowing queues can get caught up? If I simply stop the MTA (sendmail) then how does mail flow to appropriate servers? Like I said previously: Mailscanner appears to me like it starts a separate MTA process for incoming email versus a different MTA process for sending email that has been processed. Does MailScanner give the option of not starting up the incoming MTA and only running the processing/sending MTA? Using iptables to block port 25 does block incoming emails, but seems to cause other problems so that processing/sending already queued up mail doesn't work either. If I could simply get MailScanner to temporarily not start up the incoming MTA (Sendmail) that would seemingly solve my problem. If MailScanner doesn't give the option per se, can I somehow force MailScanner to not start up the incoming MTA process? Maybe I'm looking at this all wrong, but essentially here is what I want to do: I have other servers that can respond to the same mx record lookup and when this server is having problems with it's incoming queue getting overloaded I want to manually tell it to stop accepting new mail so that it can process what it already has accepted. Other servers that respond to the same MX scope should take up the slack for new email, while hopefully I can get this one to process an overflowing queue and reduce it to a manageable size. Regarding WHY this is happening in the first place is a separate issue that I'm trying to figure out. In the mean time I need a workaround to keep email from queuing up on this server and taking forever to process. -Mike >>> On 8/26/2011 at 4:27 PM, in message >, Jeremy McSpadden > wrote: Stop your mta -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Aug 26, 2011, at 4:26 PM, Michael Masse > wrote: > I'm having performance issues on one of my incoming email servers, and while I'm trying to figure out the root of that problem I need to be able to tell MailScanner to stop accepting incoming mail so that it can get caught up on the email it has already accepted and queued up. I have multiple servers running w/ this mx record, so senders should just find a different server to send to automatically if this one stops accepting. It appears to me that MailScanner starts a secondary sendmail process specifically just for receiving email vs sending, so hopefully there's some sort of startup command that would allow me to not accept new email. I've tried just blocking port 25 from the outside on this server specifically via iptables, and it does prevent outside systems from sending mail, it also keeps MailScanner from properly processing queued up mail for some reason. Any help would be greatly appreciated. > > -Mike > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110826/5771c11d/attachment.html From maxsec at gmail.com Sat Aug 27 07:49:53 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Sat Aug 27 07:50:01 2011 Subject: Tell MailScanner to stop incoming mail In-Reply-To: <4E5829380200003E0003E85D@gwmail.medicine.wisc.edu> References: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> <4E5829380200003E0003E85D@gwmail.medicine.wisc.edu> Message-ID: Mailscanner sits between two instances of and mta and suffles emails between the queues for delivery. If u look at the mailscanner init script you may find the option to stop the "incoming" mta depending On how u installed mailscanner in the first place. But I'd look in the logs and also the performance section of the wiki for some ideas to speed up ms as well Martin On Saturday, 27 August 2011, Michael Masse wrote: > > >>>> On 8/26/2011 at 4:27 PM, in message < DA838176-A795-4431-BD4B-E265949B8E8D@fluxlabs.net>, Jeremy McSpadden < jeremy@fluxlabs.net> wrote: > Stop your mta > > -- > Jeremy McSpadden > Flux Labs, Inc > http://www.fluxlabs.net > Endless Solutions > Office : 850-588-4626 > Cell : 850-890-2543 > Fax : 850-254-2955 > > > Ok but how does previously accepted and queued up mail continue to process and get distributed to appropriate servers if I do that so that overflowing queues can get caught up? If I simply stop the MTA (sendmail) then how does mail flow to appropriate servers? > > Like I said previously: Mailscanner appears to me like it starts a separate MTA process for incoming email versus a different MTA process for sending email that has been processed. Does MailScanner give the option of not starting up the incoming MTA and only running the processing/sending MTA? Using iptables to block port 25 does block incoming emails, but seems to cause other problems so that processing/sending already queued up mail doesn't work either. If I could simply get MailScanner to temporarily not start up the incoming MTA (Sendmail) that would seemingly solve my problem. If MailScanner doesn't give the option per se, can I somehow force MailScanner to not start up the incoming MTA process? Maybe I'm looking at this all wrong, but essentially here is what I want to do: I have other servers that can respond to the same mx record lookup and when this server is having problems with it's incoming queue getting overloaded I want to manually tell it to stop accepting new mail so that it can process what it already has accepted. Other servers that respond to the same MX scope should take up the slack for new email, while hopefully I can get this one to process an overflowing queue and reduce it to a manageable size. Regarding WHY this is happening in the first place is a separate issue that I'm trying to figure out. In the mean time I need a workaround to keep email from queuing up on this server and taking forever to process. > > -Mike > >>>> On 8/26/2011 at 4:27 PM, in message < DA838176-A795-4431-BD4B-E265949B8E8D@fluxlabs.net>, Jeremy McSpadden < jeremy@fluxlabs.net> wrote: > Stop your mta > > -- > Jeremy McSpadden > Flux Labs, Inc > http://www.fluxlabs.net > Endless Solutions > Office : 850-588-4626 > Cell : 850-890-2543 > Fax : 850-254-2955 > > > On Aug 26, 2011, at 4:26 PM, Michael Masse wrote: > >> I'm having performance issues on one of my incoming email servers, and while I'm trying to figure out the root of that problem I need to be able to tell MailScanner to stop accepting incoming mail so that it can get caught up on the email it has already accepted and queued up. I have multiple servers running w/ this mx record, so senders should just find a different server to send to automatically if this one stops accepting. It appears to me that MailScanner starts a secondary sendmail process specifically just for receiving email vs sending, so hopefully there's some sort of startup command that would allow me to not accept new email. I've tried just blocking port 25 from the outside on this server specifically via iptables, and it does prevent outside systems from sending mail, it also keeps MailScanner from properly processing queued up mail for some reason. Any help would be greatly appreciated. >> >> -Mike >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110827/882b53a5/attachment.html From glenn.steen at gmail.com Sat Aug 27 10:58:02 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Sat Aug 27 10:58:12 2011 Subject: Tell MailScanner to stop incoming mail In-Reply-To: References: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> <4E5829380200003E0003E85D@gwmail.medicine.wisc.edu> Message-ID: Also remember that the queue content is just files... Stop ms (and the mta) and move a sizeable bit of 'em out of the way, then start things up and start feeding reasonable amounts back... Best performance tip: don't do work you don't have to! If you can reject mail, then configure to do so... Unknown recipients (recipient verification), known bad sites (RBLs), RFC violations etc. Also make sure you don't overcommit your resources (too many children, too memory-hungry SA rules, using wrong clam (module or commandline instead of clamd) etc)... Most of this should be in the wiki... Cheers -- -- Glenn Den 27 aug 2011 08:55 skrev "Martin Hepworth" : > Mailscanner sits between two instances of and mta and suffles emails between > the queues for delivery. If u look at the mailscanner init script you may > find the option to stop the "incoming" mta depending On how u installed > mailscanner in the first place. > > But I'd look in the logs and also the performance section of the wiki for > some ideas to speed up ms as well > > Martin > > On Saturday, 27 August 2011, Michael Masse wrote: >> >> >>>>> On 8/26/2011 at 4:27 PM, in message < > DA838176-A795-4431-BD4B-E265949B8E8D@fluxlabs.net>, Jeremy McSpadden < > jeremy@fluxlabs.net> wrote: >> Stop your mta >> >> -- >> Jeremy McSpadden >> Flux Labs, Inc >> http://www.fluxlabs.net >> Endless Solutions >> Office : 850-588-4626 >> Cell : 850-890-2543 >> Fax : 850-254-2955 >> >> >> Ok but how does previously accepted and queued up mail continue to process > and get distributed to appropriate servers if I do that so that > overflowing queues can get caught up? If I simply stop the MTA (sendmail) > then how does mail flow to appropriate servers? >> >> Like I said previously: Mailscanner appears to me like it starts a > separate MTA process for incoming email versus a different MTA process for > sending email that has been processed. Does MailScanner give the option of > not starting up the incoming MTA and only running the processing/sending > MTA? Using iptables to block port 25 does block incoming emails, but seems > to cause other problems so that processing/sending already queued up mail > doesn't work either. If I could simply get MailScanner to temporarily not > start up the incoming MTA (Sendmail) that would seemingly solve my problem. > If MailScanner doesn't give the option per se, can I somehow force > MailScanner to not start up the incoming MTA process? Maybe I'm looking at > this all wrong, but essentially here is what I want to do: I have other > servers that can respond to the same mx record lookup and when this server > is having problems with it's incoming queue getting overloaded I want to > manually tell it to stop accepting new mail so that it can process what it > already has accepted. Other servers that respond to the same MX scope > should take up the slack for new email, while hopefully I can get this one > to process an overflowing queue and reduce it to a manageable size. > Regarding WHY this is happening in the first place is a separate issue that > I'm trying to figure out. In the mean time I need a workaround to keep > email from queuing up on this server and taking forever to process. >> >> -Mike >> >>>>> On 8/26/2011 at 4:27 PM, in message < > DA838176-A795-4431-BD4B-E265949B8E8D@fluxlabs.net>, Jeremy McSpadden < > jeremy@fluxlabs.net> wrote: >> Stop your mta >> >> -- >> Jeremy McSpadden >> Flux Labs, Inc >> http://www.fluxlabs.net >> Endless Solutions >> Office : 850-588-4626 >> Cell : 850-890-2543 >> Fax : 850-254-2955 >> >> >> On Aug 26, 2011, at 4:26 PM, Michael Masse wrote: >> >>> I'm having performance issues on one of my incoming email servers, and > while I'm trying to figure out the root of that problem I need to be able to > tell MailScanner to stop accepting incoming mail so that it can get caught > up on the email it has already accepted and queued up. I have multiple > servers running w/ this mx record, so senders should just find a different > server to send to automatically if this one stops accepting. It appears > to me that MailScanner starts a secondary sendmail process specifically just > for receiving email vs sending, so hopefully there's some sort of startup > command that would allow me to not accept new email. I've tried just > blocking port 25 from the outside on this server specifically via iptables, > and it does prevent outside systems from sending mail, it also keeps > MailScanner from properly processing queued up mail for some reason. > Any help would be greatly appreciated. >>> >>> -Mike >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read > > -- > -- > Martin Hepworth > Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110827/6550158d/attachment-0001.html From rich at mail.wvnet.edu Sat Aug 27 15:20:43 2011 From: rich at mail.wvnet.edu (Richard Lynch) Date: Sat Aug 27 15:21:15 2011 Subject: Tell MailScanner to stop incoming mail In-Reply-To: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> References: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> Message-ID: <4E58FD3B.4020309@mail.wvnet.edu> Michael Masse wrote: > I'm having performance issues on one of my incoming email servers, and > while I'm trying to figure out the root of that problem I need to be > able to tell MailScanner to stop accepting incoming mail so that it > can get caught up on the email it has already accepted and queued > up. I have multiple servers running w/ this mx record, so senders > should just find a different server to send to automatically if this > one stops accepting. It appears to me that MailScanner starts a > secondary sendmail process specifically just for receiving email vs > sending, so hopefully there's some sort of startup command that would > allow me to not accept new email. I've tried just blocking port 25 > from the outside on this server specifically via iptables, and it does > prevent outside systems from sending mail, it also keeps MailScanner > from properly processing queued up mail for some reason. Any help > would be greatly appreciated. > > -Mike > What I do on RHEL/CentOS is... service sendmail stop service MailScanner startout ...then when I'm ready to start accepting inbound mail again... service MailScanner startin Rich -- Obstacles are those frightening things we see when we take our eyes off our goal. Henry Ford From maxsec at gmail.com Sat Aug 27 15:49:13 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Sat Aug 27 15:49:30 2011 Subject: Tell MailScanner to stop incoming mail In-Reply-To: <4E58FD3B.4020309@mail.wvnet.edu> References: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> <4E58FD3B.4020309@mail.wvnet.edu> Message-ID: Should only need Service mailscanner stopin To stop the incoming mta. The sendmail service shouldn't be used separately anymre afaik Martin On Saturday, 27 August 2011, Richard Lynch wrote: > Michael Masse wrote: >> >> I'm having performance issues on one of my incoming email servers, and while I'm trying to figure out the root of that problem I need to be able to tell MailScanner to stop accepting incoming mail so that it can get caught up on the email it has already accepted and queued up. I have multiple servers running w/ this mx record, so senders should just find a different server to send to automatically if this one stops accepting. It appears to me that MailScanner starts a secondary sendmail process specifically just for receiving email vs sending, so hopefully there's some sort of startup command that would allow me to not accept new email. I've tried just blocking port 25 from the outside on this server specifically via iptables, and it does prevent outside systems from sending mail, it also keeps MailScanner from properly processing queued up mail for some reason. Any help would be greatly appreciated. >> -Mike >> > > What I do on RHEL/CentOS is... > > service sendmail stop > service MailScanner startout > > ...then when I'm ready to start accepting inbound mail again... > > service MailScanner startin > > > Rich > > -- > > Obstacles are those frightening things we see when we take > our eyes off our goal. > > Henry Ford > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110827/1ca0fbbb/attachment.html From mrm at medicine.wisc.edu Sat Aug 27 17:41:37 2011 From: mrm at medicine.wisc.edu (Michael Masse) Date: Sat Aug 27 17:42:10 2011 Subject: Tell MailScanner to stop incoming mail In-Reply-To: References: <4E57C8E90200003E0003E36E@gwmail.medicine.wisc.edu> <4E58FD3B.4020309@mail.wvnet.edu> Message-ID: <4E58D7F10200003E0003F35D@gwmail.medicine.wisc.edu> Thank you! >>> On 8/27/2011 at 9:49 AM, in message , Martin Hepworth wrote: Should only need Service mailscanner stopin To stop the incoming mta. The sendmail service shouldn't be used separately anymre afaik Martin On Saturday, 27 August 2011, Richard Lynch wrote: > Michael Masse wrote: >> >> I'm having performance issues on one of my incoming email servers, and while I'm trying to figure out the root of that problem I need to be able to tell MailScanner to stop accepting incoming mail so that it can get caught up on the email it has already accepted and queued up. I have multiple servers running w/ this mx record, so senders should just find a different server to send to automatically if this one stops accepting. It appears to me that MailScanner starts a secondary sendmail process specifically just for receiving email vs sending, so hopefully there's some sort of startup command that would allow me to not accept new email. I've tried just blocking port 25 from the outside on this server specifically via iptables, and it does prevent outside systems from sending mail, it also keeps MailScanner from properly processing queued up mail for some reason. Any help would be greatly appreciated. >> -Mike >> > > What I do on RHEL/CentOS is... > > service sendmail stop > service MailScanner startout > > ...then when I'm ready to start accepting inbound mail again... > > service MailScanner startin > > > Rich > > -- > > Obstacles are those frightening things we see when we take > our eyes off our goal. > > Henry Ford > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110827/7bc181f9/attachment.html From kristofer at cybernetik.net Mon Aug 29 16:41:50 2011 From: kristofer at cybernetik.net (Kristofer Pettijohn) Date: Mon Aug 29 16:42:00 2011 Subject: Tagging phishing emails Message-ID: Hello, I have set up Mailscanner as a gateway box in front of my mailserver. I have it adding a header to messages identified as Spam "X-Organization-Spam-Flag: Yes". My mail server then parses the headers, and if it sees that header it automatically filters it into my users' "Junk" folder. I see messages that go through MailScanner where in the log it says "Found phishing fraud from", but it still passes SpamAssassin, so that flag doesn't get set. MailScanner will clean and disarm the email, however. What I would like is for MailScanner to leave the message alone, but also tag it as being spam. Basically I would like it to do that for all emails where it finds phishing fraud. Is this possible? Thanks! Kris -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110829/bd12726d/attachment.html From raubvogel at gmail.com Mon Aug 29 17:21:40 2011 From: raubvogel at gmail.com (Mauricio Tavares) Date: Mon Aug 29 17:21:51 2011 Subject: Tagging phishing emails In-Reply-To: References: Message-ID: On Mon, Aug 29, 2011 at 11:41 AM, Kristofer Pettijohn wrote: > Hello, > > I have set up Mailscanner as a gateway box in front of my mailserver.? I > have it adding a header to messages identified as Spam > "X-Organization-Spam-Flag: Yes".? My mail server then parses the headers, > and if it sees that header it automatically filters it into my users' "Junk" > folder. > > I see messages that go through MailScanner where in the log it says "Found > phishing fraud from", but it still passes SpamAssassin, so that flag doesn't > get set.? MailScanner will clean and disarm the email, however.? What I > would like is for MailScanner to leave the message alone, but also tag it as > being spam.? Basically I would like it to do that for all emails where it > finds phishing fraud. > Correct me if I am wrong but wouldn't that mean a program/module/something other than spamassassin is handling the phishing stuff? > Is this possible? > > Thanks! > Kris > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > From mailscanner at joolee.nl Mon Aug 29 17:43:02 2011 From: mailscanner at joolee.nl (Joolee) Date: Mon Aug 29 17:43:58 2011 Subject: Tagging phishing emails In-Reply-To: References: Message-ID: Yes, that would be MailScanner itself. I disabled the option because it gives a lot of false positives. Mailscanner checks the contents of anchor texts against their href. (https://mybank.com) Problem is that something like this also gets flagged: Coupon worth $50 on booking.com for only $5! When MailScanner detects something with this method and Spamassassin thinks the E-mail is okay, the mail gets cleaned and delivered with all headers set like nothing is wrong. I've implemented a few simple rules in Spamassassin to detect https / http replacements like above. Doesn't catch all the phishing but sure does a lot. On 29 August 2011 18:21, Mauricio Tavares wrote: > On Mon, Aug 29, 2011 at 11:41 AM, Kristofer Pettijohn > wrote: > > Hello, > > > > I have set up Mailscanner as a gateway box in front of my mailserver. I > > have it adding a header to messages identified as Spam > > "X-Organization-Spam-Flag: Yes". My mail server then parses the headers, > > and if it sees that header it automatically filters it into my users' > "Junk" > > folder. > > > > I see messages that go through MailScanner where in the log it says > "Found > > phishing fraud from", but it still passes SpamAssassin, so that flag > doesn't > > get set. MailScanner will clean and disarm the email, however. What I > > would like is for MailScanner to leave the message alone, but also tag it > as > > being spam. Basically I would like it to do that for all emails where it > > finds phishing fraud. > > > Correct me if I am wrong but wouldn't that mean a > program/module/something other than spamassassin is handling the phishing > stuff? > > > Is this possible? > > > > Thanks! > > Kris > > > > -- > > MailScanner mailing list > > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110829/7dc47276/attachment.html From fercho_aml at yahoo.es Wed Aug 31 22:20:56 2011 From: fercho_aml at yahoo.es (=?iso-8859-1?Q?Fernando_Andr=E9s_Moya_Leimberg?=) Date: Wed Aug 31 22:21:05 2011 Subject: MailScanner Digest, Vol 68, Issue 20 In-Reply-To: References: <201108241100.p7OB0MDF014798@safir.blacknight.ie> <2046762850AF9D4DA8E1EB3B6F2BA19C1031456C@VA3DIAXVS1A1.RED001.local> Message-ID: <1314825656.6052.YahooMailNeo@web29715.mail.ird.yahoo.com> Did that command finally solve your problem Jhon? Think it's a good to know how it ended, or if you're stilll looking for an answer... Greetings... ________________________________ De: Glenn Steen Para: MailScanner discussion Enviado: viernes 26 de agosto de 2011 15:36 Asunto: Re: RE: MailScanner Digest, Vol 68, Issue 20 Right, so you have a taint issue preventing the creation of the date subdir (or similar) in the quarantine. Did you try the usual -U thing (google it, or use gmane, I'm tipsy and would likely get something wrong;-) . Cheers -- --? Glenn Den 25 aug 2011 19:28 skrev "John Bull" : > # MailScanner --debug > > In Debugging mode, not forking... > Trying to setlogsock(unix) > Building a message batch to scan... > Insecure dependency in mkdir while running with -T switch at /usr/lib/MailScanner/MailScanner/Quarantine.pm line 189. > > Regards, > John > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of mailscanner-request@lists.mailscanner.info > Sent: Wednesday, August 24, 2011 4:01 AM > To: mailscanner@lists.mailscanner.info > Subject: MailScanner Digest, Vol 68, Issue 20 > > Send MailScanner mailing list submissions to > mailscanner@lists.mailscanner.info > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.mailscanner.info/mailman/listinfo/mailscanner > or, via email, send a message with subject or body 'help' to > mailscanner-request@lists.mailscanner.info > > You can reach the person managing the list at > mailscanner-owner@lists.mailscanner.info > > When replying, please edit your Subject line so it is more specific than "Re: Contents of MailScanner digest..." > > > Today's Topics: > > 1. Re: Spam remaining in hold queue (Glenn Steen) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 24 Aug 2011 01:59:40 +0200 > From: Glenn Steen > Subject: Re: Spam remaining in hold queue > To: MailScanner discussion > Message-ID: > > Content-Type: text/plain; charset="iso-8859-1" > > What is the debug result for a gtube run, not eicar as you showed that to be fine...? > The processing db thing kind of indicate that something is killing ms. > > Cheers > -- > -- Glenn > Den 23 aug 2011 00:12 skrev "John Bull" : >> List, >> >> Testing Lab - Installation specifics: >> MailScanner-4.84.3-1.rpm.tar >> Postfix 2.6.6 >> Scientific Linux 6.1, perl 5.10.1 >> High scoring spam is set to: store and notify >> >> Problem: >> Email with gtube spam test remains in the Postfix hold queue and is >> not > delivered to the spam quarantine. >> >> # postqueue -p >> -Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient------- >> EFF9C4EB9! 755 Mon Aug 22 13:22:51 jbull@esd113.lab >> tone@test.lab >> >> MailScanner successfully creates > /var/Spool/MailScanner/quarantine//spam >> but the email never makes it there. >> >> Directory Permissions: >> chown -R postfix.clamav /var/spool/MailScanner/incoming chmod -R 770 >> /var/spool/MailScanner/incoming chown postfix.postfix > /var/spool/MailScanner/incoming/SpamAssassin.cache.db >> chown postfix.postfix -R >> /var/spool/MailScanner/incoming/SpamAssassin-Temp >> chown postfix.postfix /var/spool/MailScanner/incoming/Processing.db >> >> chown -R postfix.apache /var/spool/MailScanner/quarantine chmod 770 -R >> /var/spool/MailScanner/quarantine >> >> mkdir /var/spool/MailScanner/spamassassin >> chown -R postfix:postfix /var/spool/MailScanner/spamassassin >> chmod -R 770 /var/spool/MailScanner/spamassassin >> >> MailScanner Config >> Run As User = postfix >> Run As Group = postfix >> Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = >> /var/spool/postfix/incoming Incoming Work Dir = >> /var/spool/MailScanner/incoming MTA = postfix Sendmail = >> /usr/sbin/sendmail.postfix Incoming Work Group = clamav Incoming Work >> Permissions = 0644 Quarantine User = postfix Quarantine Group = apache >> Quarantine Permissions = 0660 Virus Scanners = clamd Quarantine >> Infections = no Quarantine Whole Message = yes Quarantine Whole >> Messages As Queue Files = no Keep Spam And MCP Archive Clean = yes >> Spam Checks = yes Is Definitely Not Spam = >> %rules-dir%/spam.whitelist.rules Is Definitely Spam = >> %rules-dir%/spam.blacklist.rules Definite Spam Is High Scoring = yes >> Use SpamAssassin = yes Required SpamAssassin Score = 4.75 High >> SpamAssassin Score = 6 Spam Score = yes Spam Actions = deliver High >> Scoring Spam Actions = store notify >> >> >> Maillog: >> Spam Checks: Starting >> Aug 22 13:26:06 opened MailScanner[2548]: Message EFF9C4EB9.A5C23 from > 192.168.0.110 (jbull@esd113.lab) to test.lab is spam, SpamAssassin (score=1001.99, required 4.75, autolearn=disabled, ALL_TRUSTED -1.00, DCC_CHECK 3.00, GTUBE 1000.00, T_RP_MATCHES_RCVD -0.01) >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Checks: Found 1 spam > messages >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: message > EFF9C4EB9.A5C23 actions are store,notify >> Aug 22 13:26:06 opened MailScanner[2548]: Spam Actions: Notify > tone@test.lab >> >> : Warning: skipping message EFF9C4EB9.A5C23 as it has been attempted >> too > many times >> Aug 22 13:46:35 opened MailScanner[3396]: Quarantined message > EFF9C4EB9.A5C23 as it caused MailScanner to crash several times >> >> MailScanner --processing >> Currently being processed: >> >> Number of messages: 1 >> Tries Message Next Try At >> ===== ======= =========== >> 6 EFF9C4EB9.A5C23 Mon Aug 22 13:49:34 2011 >> >> # MailScanner --lint --debug >> Trying to setlogsock(unix) >> >> Reading configuration file /etc/MailScanner/MailScanner.conf Reading >> configuration file /etc/MailScanner/conf.d/README Read 867 hostnames >> from the phishing whitelist Read 4076 hostnames from the phishing >> blacklists >> >> Checking version numbers... >> Version number in MailScanner.conf (4.84.3) is correct. >> MailScanner setting GID to (89) >> MailScanner setting UID to (89) >> >> Checking for SpamAssassin errors (if you use it)... >> Using SpamAssassin results cache >> Connected to SpamAssassin cache database SpamAssassin reported no >> errors. >> Connected to Processing Attempts Database Created Processing Attempts >> Database successfully There is 1 message in the Processing Attempts >> Database Using locktype = posix MailScanner.conf says "Virus Scanners >> = clamd" >> Found these virus scanners installed: clamd >> > =========================================================================== >> Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: >> Found 1 problems Virus and Content Scanning: Starting >> Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus >> Scanning: Clamd found 2 infections Infected message 1 came from >> 10.1.1.1 Virus Scanning: Found 2 viruses >> > =========================================================================== >> Virus Scanner test reports: >> Clamd said "eicar.com was infected: Eicar-Test-Signature" >> >> If any of your virus scanners (clamd) >> are not listed there, you should check that they are installed >> correctly and that MailScanner is finding them correctly via its > virus.scanners.conf. >> >> Thank you, >> John > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110824/bbe6f83f/attachment-0001.html > > ------------------------------ > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read the Wiki (http://wiki.mailscanner.info/). > > Support MailScanner development - buy the book off the website! > > > End of MailScanner Digest, Vol 68, Issue 20 > ******************************************* > > -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110831/1c481a88/attachment.html