Emails not getting scanned

Fri Dec 23 11:09:27 GMT 2011

Do
service MailScanner stop
This is, of course, to stop both MS and your MTA. Check that all Sendmail
processes have ended, with ps. Then do
service MailScanner startin
Which will only start the mta. Send a message to it... If it flows through,
then you've got a bad Sendmail setup. If not, then do
service MailScanner startout
If the mail get delivered now, then your outgoing instance picks up mail
from the wrong queue dir.

Cheers&Merry Xmas
-- 
-- Glenn
Den 23 dec 2011 00:26 skrev "Tony Arcus" <tony at ai.net.nz>:

>
>
>  I'd look very carefully at the sendmail setup
>> (http://www.mailscanner.info/**sendmail.html<http://www.mailscanner.info/sendmail.html>
>> )
>>
>> and make sure that mail doesnot flow with MS turned off.
>>
>> --
>> Martin Hepworth
>> Oxford, UK
>>
>>
>> On 21 December 2011 23:29, Tony Arcus <tony at ai.net.nz> wrote:
>>
>>  On Mon, Dec 19, 2011 at 11:31 PM, Martin Hepworth <maxsec at gmail.com>
>>>
>>>> wrote:
>>>>>
>>>>>  FYI in centos 6 the default mta could be postfix if it's like red hat
>>>>>> !
>>>>>> So
>>>>>> you may need to disable postfix if u want to get this going..
>>>>>>
>>>>>>
>>>>> Good point
>>>>>
>>>>> Tony - if you telnet to the server on port 25, do you get the sendmail
>>>>> or postfix banner?
>>>>>
>>>>>
>>>>> Chris
>>>>> --
>>>>> MailScanner mailing list
>>>>> mailscanner at lists.mailscanner.****info<mailscanner at lists.**
>>>>> mailscanner.info <mailscanner at lists.mailscanner.info>>
>>>>> http://lists.mailscanner.info/****mailman/listinfo/mailscanner<http://lists.mailscanner.info/**mailman/listinfo/mailscanner>
>>>>> **<http://lists.mailscanner.**info/mailman/listinfo/**mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner>
>>>>> >
>>>>>
>>>>> Before posting, read http://wiki.mailscanner.info/****posting<http://wiki.mailscanner.info/**posting>
>>>>> <http://wiki.**mailscanner.info/posting<http://wiki.mailscanner.info/posting>
>>>>> >
>>>>>
>>>>> Support MailScanner development - buy the book off the website!
>>>>>
>>>>> --
>>>>> This message has been scanned for viruses and
>>>>> dangerous content by MailScanner, and is
>>>>> believed to be clean.
>>>>>
>>>>>
>>>>>  Thanks Martin and Chris for that tip, I had already discovered that
>>>> and
>>>> uninstalled postfix. No luck
>>>>
>>>> It got me thinking... what else could be delivering the mail from
>>>> /var/spool/mqueue.in? Other than sendmail?
>>>>
>>>>  Thanks to a lot of people with suggestions.
>>>>
>>>
>>> This is what I believe is happening.
>>> Being Centos 6
>>>
>>> Postfix was installed but not running.
>>> Postfix has been uninstalled and the server restarted
>>> Telnet in and you get:
>>>
>>>  Trying 202.xxx.xxx.124...
>>>> Connected to mail.xxxxx.co.nz (202.xxx.xxx.124).
>>>> Escape character is '^]'.
>>>> 220 mail.xxxxxx.co.nz ESMTP Sendmail 8.14.4/8.14.4; Thu, 22 Dec 2011 >
>>>> 11:20:06 +1300
>>>>
>>>>
>>> looking at chkconfig, this appears clean and unless some one wants
>>> something specific from it I wont report my findings.
>>>
>>> SO
>>>
>>> It would appear that emails come in on the sendmail MTA
>>> They get put in the /var/spool/mqueue.in directory
>>> THEN sendmail straight away picks them back up and delivers them before.
>>> MailScanner can ever get a change to process them.
>>>
>>> My reason for thinking this:
>>>
>>> I sent a number of emails from a different server.
>>> Here is sendmail getting the email as we would expect, and as emails are
>>> also received on other sendmail/MailScanner servers that are operating
>>> correctly.
>>>
>>> root     16583  0.0  0.3  10848  3952 ?        D    11:34   0:00
>>> sendmail:
>>> pBLMYFqF016583 ip-202-174-161-37.wizbiz.net.****nz<
>>> http://ip-202-174-161-37.**wizbiz.net.nz<http://ip-202-174-161-37.wizbiz.net.nz>
>>> >
>>> [202.174.161.37]: DATA
>>>
>>>
>>> INSTANTLY though I also see this
>>> root     16585  0.0  0.3  10668  3200 ?        S    11:34   0:00
>>> sendmail:
>>> ./pBLMYFqD016583 from queue
>>>
>>> sendmail picks the email back up and delivers it, MailScanner never get a
>>> change to poll the this message.
>>>
>>> How do I stop sendmail from doing this?
>>>
>>>
> I agree with you Martin, and am looking closely at sendmail.
> With MailScanner turned off no emails flow.
>
> I have even checked to make sure there is no other stray process that is
> running when MailScanner is running that might be activating a sendmail
> process to deliver emails.
>
> Turn MailScanner on emails are accepted but delivered right away.
> The process
> root     30934  0.0  0.1  10032  2012 ?        Ss   11:32   0:00 sendmail:
> accepting connections
> Is accepting the connection to receive an email.
> A process is started to receive this email
> Something like:
> sendmail: pBMLiEI2027891 ip-202-xxx-xxx-37.wizbiz.net.**nz<http://ip-202-xxx-xxx-37.wizbiz.net.nz>[202.xxx.xxx.37]:
> Then a third process is started to deliver this message.
>
> It is this last step that I DO NOT what happening.
>
> Configurations between this system and other systems seem the same, except
> this is a different version of send mail, 8.14.4-8.el6 as apposite to
> 8.12.8-8.1el5_7
>
> Checked the process for accepting emails
> /usr/sbin/sendmail -bd -OPrivacyOptions=noetrn -ODeliveryMode=queueonly
> -OQueueDirectory=/var/spool/mq**ueue.in <http://mqueue.in>-OPidFile=/var/run/sendmail.
> **in.pid
>
> It should only put the emails in the queue not also deliver them.
>
> Even changing sendmail.cf to O DeliveryMode=queueonly does not help.
>
>
> ------------------------------**------------------------------**----
> This message was sent using IMP, the Internet Messaging Program.
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.**info <mailscanner at lists.mailscanner.info>
> http://lists.mailscanner.info/**mailman/listinfo/mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner>
>
> Before posting, read http://wiki.mailscanner.info/**posting<http://wiki.mailscanner.info/posting>
>
> Support MailScanner development - buy the book off the website!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111223/38251871/attachment.html