From m.sapsed at bangor.ac.uk Wed Jun 1 10:41:05 2011 From: m.sapsed at bangor.ac.uk (Martin Sapsed) Date: Wed Jun 1 10:42:02 2011 Subject: Sophos on Solaris/Sparc - V4 or V7? Message-ID: <4DE60931.7060704@bangor.ac.uk> Hi all, Been out of the loop here for a long time but haven't seen much about Sophos in my archive. We've been using MailScanner for a loooong time on Solaris/Sparc boxes. We've stuck to using version 4 on the "if it ain't broke" principle, doing the manual engine update every month or two. We kind of shied away from using the newer versions maintained by Enterprise Manager which update automagically, just in case something went wrong and wasn't spotted. There doesn't seem to be any mention on the Sophos site of support for this version ending any time soon but my guess is it won't go on for ever... Wondering whether the users of Sophos with MailScanner on this platform are still using V4 like us or have moved to V7 and whether any of the latter (if there are any) have noticed any issues? Thanks & Regards, Martin -- Martin Sapsed BSc (Hons) MBCS CITP Desktop Support Manager IT Services "Who do you say that I am?" Bangor University Jesus of Nazareth From mrebsamen at swissonline.ch Wed Jun 1 11:19:23 2011 From: mrebsamen at swissonline.ch (Marco Rebsamen) Date: Wed Jun 1 11:19:00 2011 Subject: Broken MailScanner after Systemupdate Message-ID: Hello Everybody Since a recent System Update (not Upgrade) my MailScanner is broken. While I tried to figure out what the problem is I started the MailScanner process with the -debug option. I get this: Insecure dependency in open while running with -T... I assume that this is related to Perl updates....? The system is openSUSE 11.4 Thanks for your Help Marco -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110601/c492e92c/attachment.html From maxsec at gmail.com Wed Jun 1 11:54:19 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Jun 1 11:54:29 2011 Subject: Broken MailScanner after Systemupdate In-Reply-To: References: Message-ID: yup - well 'documented' in this forum. Add a -U to the mail mailscanner program, -- Martin Hepworth Oxford, UK On 1 June 2011 11:19, Marco Rebsamen wrote: > Hello Everybody > > > > Since a recent System Update (not Upgrade) my MailScanner is broken. While > I tried to figure out what the problem is I started the MailScanner process > with the ?debug option. I get this: > > > > Insecure dependency in open while running with ?T? > > > > I assume that this is related to Perl updates?.? The system is openSUSE > 11.4 > > > > Thanks for your Help > > Marco > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110601/1063427e/attachment.html From mrebsamen at swissonline.ch Wed Jun 1 12:00:12 2011 From: mrebsamen at swissonline.ch (Marco Rebsamen) Date: Wed Jun 1 11:59:48 2011 Subject: AW: Broken MailScanner after Systemupdate References: Message-ID: Excuse me System is OpenSuse 11.3 Mailscanner: 4.81.4 Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Marco Rebsamen Gesendet: Mittwoch, 1. Juni 2011 12:19 An: mailscanner@lists.mailscanner.info Betreff: Broken MailScanner after Systemupdate Hello Everybody Since a recent System Update (not Upgrade) my MailScanner is broken. While I tried to figure out what the problem is I started the MailScanner process with the -debug option. I get this: Insecure dependency in open while running with -T... I assume that this is related to Perl updates....? The system is openSUSE 11.4 Thanks for your Help Marco -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110601/cf9456a2/attachment.html From mrebsamen at swissonline.ch Wed Jun 1 13:03:40 2011 From: mrebsamen at swissonline.ch (Marco Rebsamen) Date: Wed Jun 1 13:03:55 2011 Subject: Broken MailScanner after Systemupdate In-Reply-To: References: Message-ID: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> Hm... Well couldn't find anything... Thanks anyway... Am 01.06.2011 um 13:05 schrieb "Martin Hepworth" : > yup - well 'documented' in this forum. Add a -U to the mail mailscanner program, > > -- > Martin Hepworth > Oxford, UK > > > On 1 June 2011 11:19, Marco Rebsamen wrote: > Hello Everybody > > > > Since a recent System Update (not Upgrade) my MailScanner is broken. While I tried to figure out what the problem is I started the MailScanner process with the ?debug option. I get this: > > > > Insecure dependency in open while running with ?T? > > > > I assume that this is related to Perl updates?.? The system is openSUSE 11.4 > > > > Thanks for your Help > > Marco > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110601/66e7458b/attachment.html From maxsec at gmail.com Wed Jun 1 13:55:36 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Jun 1 13:55:46 2011 Subject: Broken MailScanner after Systemupdate In-Reply-To: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> Message-ID: http://lists.mailscanner.info/pipermail/mailscanner/2011-May/097870.html -- Martin Hepworth Oxford, UK On 1 June 2011 13:03, Marco Rebsamen wrote: > Hm... Well couldn't find anything... > Thanks anyway... > > Am 01.06.2011 um 13:05 schrieb "Martin Hepworth" : > > yup - well 'documented' in this forum. Add a -U to the mail mailscanner > program, > > -- > Martin Hepworth > Oxford, UK > > > On 1 June 2011 11:19, Marco Rebsamen < > mrebsamen@swissonline.ch> wrote: > >> Hello Everybody >> >> >> >> Since a recent System Update (not Upgrade) my MailScanner is broken. While >> I tried to figure out what the problem is I started the MailScanner process >> with the ?debug option. I get this: >> >> >> >> Insecure dependency in open while running with ?T? >> >> >> >> I assume that this is related to Perl updates?.? The system is openSUSE >> 11.4 >> >> >> >> Thanks for your Help >> >> Marco >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read >> http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read > http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110601/06724d27/attachment.html From john at tradoc.fr Wed Jun 1 14:18:33 2011 From: john at tradoc.fr (John Wilcock) Date: Wed Jun 1 14:18:49 2011 Subject: Broken MailScanner after Systemupdate In-Reply-To: References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> Message-ID: <4DE63C29.3080002@tradoc.fr> Le 01/06/2011 14:55, Martin Hepworth a ?crit : > http://lists.mailscanner.info/pipermail/mailscanner/2011-May/097870.html Hmm, that was almost a month ago. Where is Julian when we need him? John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From Amelein at dantumadiel.eu Wed Jun 1 15:14:07 2011 From: Amelein at dantumadiel.eu (Arjan Melein) Date: Wed Jun 1 15:15:32 2011 Subject: Betr.: Re: Broken MailScanner after Systemupdate In-Reply-To: <4DE63C29.3080002@tradoc.fr> References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> <4DE63C29.3080002@tradoc.fr> Message-ID: <4DE6654F0200008E00019D57@10.1.0.206> >>> Op 1-6-2011 om 15:18 is door John Wilcock geschreven: > Le 01/06/2011 14:55, Martin Hepworth a ?crit : >> http://lists.mailscanner.info/pipermail/mailscanner/2011-May/097870.html > > Hmm, that was almost a month ago. Where is Julian when we need him? > > John. He's probably out trying to hunt down the people who made the decision to change perl in such a way that it is causing these errors in MS. But back on topic, I'm guessing this is the same problem as I was seeing on Fedora 15. [root@Linux ~]# head /usr/sbin/MailScanner #!/usr/bin/perl -U -I/usr/lib/MailScanner Adding -U to the top of the MailScanner program file 'fixes' it but there might be some residual errors where MS does not exit properly. But it'll work. In case you run into more problem, the main cause of further problems for FC15 was the perl-MIME-tools package, I need to keep that downgraded to the version that comes with MS or even the -U will not keep the program running. - Arjan From maxsec at gmail.com Wed Jun 1 15:17:58 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Jun 1 15:18:07 2011 Subject: Broken MailScanner after Systemupdate In-Reply-To: <4DE63C29.3080002@tradoc.fr> References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> <4DE63C29.3080002@tradoc.fr> Message-ID: Prob up to his neck in end of year stuff at his paid job. I did prod him about this but not heard anything.. -- Martin Hepworth Oxford, UK On 1 June 2011 14:18, John Wilcock wrote: > Le 01/06/2011 14:55, Martin Hepworth a ?crit : > > http://lists.mailscanner.info/pipermail/mailscanner/2011-May/097870.html >> > > Hmm, that was almost a month ago. Where is Julian when we need him? > > John. > > -- > -- Over 4000 webcams from ski resorts around the world - www.snoweye.com > -- Translate your technical documents and web pages - www.tradoc.fr > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110601/136b61da/attachment.html From ccaaarb at ucl.ac.uk Thu Jun 2 11:18:44 2011 From: ccaaarb at ucl.ac.uk (ccaaarb@ucl.ac.uk) Date: Thu Jun 2 11:18:56 2011 Subject: Sophos on Solaris/Sparc - V4 or V7? In-Reply-To: Your message of "Wed, 01 Jun 2011 10:41:05 BST." <4DE60931.7060704@bangor.ac.uk> Message-ID: <201106021018.p52AIi7h017795@socrates-a.ucl.ac.uk> Hi, We still use Sophos v4 on Solaris (and also Linux), and I've also been wondering about whether we should switch to a later version. A few months ago I phoned Sophos to ask about support for V4, and they said that they had no plans to discontinue support for this version. Do later versions work with MailScanner, and are there any tips or instructions for installing V7 ? On the Linux side, we are having problems installing SophosSAVI on 64-bit machines. Adrian Barker. -- Adrian Barker, Internet Technology Section IS - Datacentre Services University College London External phone: +44 20 3108 9875 Internal phone: x 59875 Email: A.Barker@ucl.ac.uk >Hi all, > >Been out of the loop here for a long time but haven't seen much about >Sophos in my archive. > >We've been using MailScanner for a loooong time on Solaris/Sparc boxes. >We've stuck to using version 4 on the "if it ain't broke" principle, >doing the manual engine update every month or two. We kind of shied away >from using the newer versions maintained by Enterprise Manager which >update automagically, just in case something went wrong and wasn't >spotted. There doesn't seem to be any mention on the Sophos site of >support for this version ending any time soon but my guess is it won't >go on for ever... > >Wondering whether the users of Sophos with MailScanner on this platform >are still using V4 like us or have moved to V7 and whether any of the >latter (if there are any) have noticed any issues? > >Thanks & Regards, > >Martin > >-- >Martin Sapsed BSc (Hons) MBCS CITP >Desktop Support Manager >IT Services "Who do you say that I am?" >Bangor University Jesus of Nazareth > > >-- >MailScanner mailing list >mailscanner@lists.mailscanner.info >http://lists.mailscanner.info/mailman/listinfo/mailscanner > >Before posting, read http://wiki.mailscanner.info/posting > >Support MailScanner development - buy the book off the website! Adrian Barker Internet Technology Section Information Systems Information Services Division (ISD) University College London, Gower Street, London WC1E 6BT External phone: +44 20 7679 5140, Fax (+44) 20 7388 5406 Internal phone: x 25140 Email: A.Barker@ucl.ac.uk From mrebsamen at swissonline.ch Wed Jun 1 21:04:08 2011 From: mrebsamen at swissonline.ch (Marco Rebsamen) Date: Thu Jun 2 12:02:37 2011 Subject: AW: Broken MailScanner after Systemupdate References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> Message-ID: Hello Ok I changed the line in /usr/sbin/MailScanner it looks like this now: #!/usr/bin/perl -I/usr/lib/MailScanner -U But the messages still stay in the queue and were only proccessed when I started MailScanner in debug mode and it printed alot of those messages. Anything else? Regards Marco Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Martin Hepworth Gesendet: Mittwoch, 1. Juni 2011 14:56 An: MailScanner discussion Betreff: Re: Broken MailScanner after Systemupdate http://lists.mailscanner.info/pipermail/mailscanner/2011-May/097870.html -- Martin Hepworth Oxford, UK On 1 June 2011 13:03, Marco Rebsamen wrote: Hm... Well couldn't find anything... Thanks anyway... Am 01.06.2011 um 13:05 schrieb "Martin Hepworth" : yup - well 'documented' in this forum. Add a -U to the mail mailscanner program, -- Martin Hepworth Oxford, UK On 1 June 2011 11:19, Marco Rebsamen wrote: Hello Everybody Since a recent System Update (not Upgrade) my MailScanner is broken. While I tried to figure out what the problem is I started the MailScanner process with the -debug option. I get this: Insecure dependency in open while running with -T... I assume that this is related to Perl updates....? The system is openSUSE 11.4 Thanks for your Help Marco -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110601/1f945321/attachment.html From mrebsamen at swissonline.ch Fri Jun 3 09:46:42 2011 From: mrebsamen at swissonline.ch (Marco Rebsamen) Date: Fri Jun 3 09:46:17 2011 Subject: AW: Broken MailScanner after Systemupdate References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> Message-ID: Hello Excuse me that I pick on this but I have a not-working system and it's getting annoying with all that spam. I've added the -U option as mentioned but this didn't completely fix the problem. The messages still stay in the queue. If I start MailScanner in debug mode they seem to be processed but I get a lot of those "Insecure..." messages though. Thank you for your help Regards Marco Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Marco Rebsamen Gesendet: Mittwoch, 1. Juni 2011 22:04 An: MailScanner discussion Betreff: AW: Broken MailScanner after Systemupdate Hello Ok I changed the line in /usr/sbin/MailScanner it looks like this now: #!/usr/bin/perl -I/usr/lib/MailScanner -U But the messages still stay in the queue and were only proccessed when I started MailScanner in debug mode and it printed alot of those messages. Anything else? Regards Marco Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Martin Hepworth Gesendet: Mittwoch, 1. Juni 2011 14:56 An: MailScanner discussion Betreff: Re: Broken MailScanner after Systemupdate http://lists.mailscanner.info/pipermail/mailscanner/2011-May/097870.html -- Martin Hepworth Oxford, UK On 1 June 2011 13:03, Marco Rebsamen wrote: Hm... Well couldn't find anything... Thanks anyway... Am 01.06.2011 um 13:05 schrieb "Martin Hepworth" : yup - well 'documented' in this forum. Add a -U to the mail mailscanner program, -- Martin Hepworth Oxford, UK On 1 June 2011 11:19, Marco Rebsamen wrote: Hello Everybody Since a recent System Update (not Upgrade) my MailScanner is broken. While I tried to figure out what the problem is I started the MailScanner process with the -debug option. I get this: Insecure dependency in open while running with -T... I assume that this is related to Perl updates....? The system is openSUSE 11.4 Thanks for your Help Marco -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110603/e53f40f7/attachment.html From richard at fastnet.co.uk Fri Jun 3 14:13:53 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Fri Jun 3 14:14:07 2011 Subject: Broken MailScanner after Systemupdate In-Reply-To: References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> Message-ID: <1251B5423222C446A299CABAA7B46FF412F620@fn-exchange.fastnet.local> Hi Marco, Have you tried adding this - #!/usr/bin/perl -U -I/usr/lib/MailScanner ? I think that is what was mensioned in a previous post for a fedora system, though I don't have this problem. Rich From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Marco Rebsamen Sent: 03 June 2011 09:47 To: MailScanner discussion Subject: AW: Broken MailScanner after Systemupdate Hello Excuse me that I pick on this but I have a not-working system and it's getting annoying with all that spam. I've added the -U option as mentioned but this didn't completely fix the problem. The messages still stay in the queue. If I start MailScanner in debug mode they seem to be processed but I get a lot of those "Insecure..." messages though. Thank you for your help Regards Marco Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Marco Rebsamen Gesendet: Mittwoch, 1. Juni 2011 22:04 An: MailScanner discussion Betreff: AW: Broken MailScanner after Systemupdate Hello Ok I changed the line in /usr/sbin/MailScanner it looks like this now: #!/usr/bin/perl -I/usr/lib/MailScanner -U But the messages still stay in the queue and were only proccessed when I started MailScanner in debug mode and it printed alot of those messages. Anything else? Regards Marco Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Martin Hepworth Gesendet: Mittwoch, 1. Juni 2011 14:56 An: MailScanner discussion Betreff: Re: Broken MailScanner after Systemupdate http://lists.mailscanner.info/pipermail/mailscanner/2011-May/097870.html -- Martin Hepworth Oxford, UK On 1 June 2011 13:03, Marco Rebsamen > wrote: Hm... Well couldn't find anything... Thanks anyway... Am 01.06.2011 um 13:05 schrieb "Martin Hepworth" >: yup - well 'documented' in this forum. Add a -U to the mail mailscanner program, -- Martin Hepworth Oxford, UK On 1 June 2011 11:19, Marco Rebsamen > wrote: Hello Everybody Since a recent System Update (not Upgrade) my MailScanner is broken. While I tried to figure out what the problem is I started the MailScanner process with the -debug option. I get this: Insecure dependency in open while running with -T... I assume that this is related to Perl updates....? The system is openSUSE 11.4 Thanks for your Help Marco -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110603/201a2259/attachment.html From stu at spacehopper.org Fri Jun 3 17:02:03 2011 From: stu at spacehopper.org (Stuart Henderson) Date: Fri Jun 3 17:05:17 2011 Subject: AW: Broken MailScanner after Systemupdate References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> Message-ID: You could get rid of the -U stuff and try starting MailScanner directly as the "run as user", for example "sudo -u postfix check_mailscanner" On 2011-06-03, Marco Rebsamen wrote: > Excuse me that I pick on this but I have a not-working system and it's > getting annoying with all that spam. > > I've added the -U option as mentioned but this didn't completely fix the > problem. The messages still stay in the queue. If I start MailScanner in > debug mode they seem to be processed but I get a lot of those > "Insecure..." messages though.=20 From mrebsamen at swissonline.ch Sun Jun 5 12:52:39 2011 From: mrebsamen at swissonline.ch (Marco Rebsamen) Date: Sun Jun 5 12:52:57 2011 Subject: AW: Broken MailScanner after Systemupdate References: <2EB66E26-4C4E-4C96-891C-0B4113FD5BA7@unimatrix0.ch> <1251B5423222C446A299CABAA7B46FF412F620@fn-exchange.fastnet.local> Message-ID: Hi Rich Thanks for this hint. MailScanner is running again. I thought I've already tried this... Well thanks anyway Regards Marco Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Richard Mealing Gesendet: Freitag, 3. Juni 2011 15:14 An: MailScanner discussion Betreff: RE: Broken MailScanner after Systemupdate Hi Marco, Have you tried adding this - #!/usr/bin/perl -U -I/usr/lib/MailScanner ? I think that is what was mensioned in a previous post for a fedora system, though I don't have this problem. Rich From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Marco Rebsamen Sent: 03 June 2011 09:47 To: MailScanner discussion Subject: AW: Broken MailScanner after Systemupdate Hello Excuse me that I pick on this but I have a not-working system and it's getting annoying with all that spam. I've added the -U option as mentioned but this didn't completely fix the problem. The messages still stay in the queue. If I start MailScanner in debug mode they seem to be processed but I get a lot of those "Insecure..." messages though. Thank you for your help Regards Marco Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Marco Rebsamen Gesendet: Mittwoch, 1. Juni 2011 22:04 An: MailScanner discussion Betreff: AW: Broken MailScanner after Systemupdate Hello Ok I changed the line in /usr/sbin/MailScanner it looks like this now: #!/usr/bin/perl -I/usr/lib/MailScanner -U But the messages still stay in the queue and were only proccessed when I started MailScanner in debug mode and it printed alot of those messages. Anything else? Regards Marco Von: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] Im Auftrag von Martin Hepworth Gesendet: Mittwoch, 1. Juni 2011 14:56 An: MailScanner discussion Betreff: Re: Broken MailScanner after Systemupdate http://lists.mailscanner.info/pipermail/mailscanner/2011-May/097870.html -- Martin Hepworth Oxford, UK On 1 June 2011 13:03, Marco Rebsamen wrote: Hm... Well couldn't find anything... Thanks anyway... Am 01.06.2011 um 13:05 schrieb "Martin Hepworth" : yup - well 'documented' in this forum. Add a -U to the mail mailscanner program, -- Martin Hepworth Oxford, UK On 1 June 2011 11:19, Marco Rebsamen wrote: Hello Everybody Since a recent System Update (not Upgrade) my MailScanner is broken. While I tried to figure out what the problem is I started the MailScanner process with the -debug option. I get this: Insecure dependency in open while running with -T... I assume that this is related to Perl updates....? The system is openSUSE 11.4 Thanks for your Help Marco -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110605/31147c98/attachment.html From ash at trellick.net Sun Jun 5 17:58:18 2011 From: ash at trellick.net (ash@trellick.net) Date: Sun Jun 5 17:58:39 2011 Subject: {Filename?} MailScanner Digest, Vol 65, Issue 14 Message-ID: Return Receipt Your {Filename?} MailScanner Digest, Vol 65, Issue 14 document: was received by: at: 05/06/2011 17:58:18 From fosiul at gmail.com Tue Jun 7 13:40:59 2011 From: fosiul at gmail.com (Fosiul Alam) Date: Tue Jun 7 13:41:09 2011 Subject: Signature rules for On Behalf user Message-ID: Hellow Every one , I have setup Signature in mail scanner , which works fine. today another condition occured as bellow : User A is trying to sent email on Behalf of user B . When User B is trying to sent email by himself, mailscanner attached his own signature( Which is fine,as Expected) When user A is trying to sent email on behalf of user B, the mailscanner is attaching user A's signature. but We want to attach user B's signature when user A will sent email on behalf of user B . can it be possible ? Please advise . -- Regards Fosiul Alam http://www.fosiul.co.uk -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110607/a808bc3f/attachment.html From sandro.dentella at gmail.com Wed Jun 8 11:44:13 2011 From: sandro.dentella at gmail.com (Sandro Dentella) Date: Wed Jun 8 11:44:23 2011 Subject: Disabling antivirus Message-ID: Hi, I'm currently having problems with my postfix+mailscanner installation that has worked fine up to yesterday. As I think probelms are in the antivirus I wanted to get rid of it momentarily so I set Virus Scanning = no and restarted Mailserver. I still fine in the log: Jun 8 12:40:22 mail MailScanner[4343]: Virus and Content Scanning: Starting Jun 8 12:40:24 mail MailScanner[4343]: Requeue: 188BE246072.ABE45 to B81D22460E7 Jun 8 12:40:24 mail postfix/qmgr[27742]: B81D22460E7: from=, size=618, nrcpt=1 (queue active) Jun 8 12:40:24 mail MailScanner[4343]: Uninfected: Delivered 1 messages So, how should I do to really disable virus scanning (even thought now it seems it's working correctly...) TIA sandro *:-) -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110608/f460aff1/attachment.html From john.clancy at businessworld.ie Wed Jun 8 13:47:27 2011 From: john.clancy at businessworld.ie (John Clancy) Date: Wed Jun 8 13:46:30 2011 Subject: spam-viruses notification Message-ID: <0fd201cc25da$38d7d970$696078c1@JCSPC> Hi all, I'm probably missing something obvious here but is there any way of setting MailScanner to send virus notifications to the postmaster but not send spam-viruses notifications to the postmaster. I'm using the SANE security signatures and I'm getting buried in spam-virus notifications - I'd like to keep using the SANE signatures but I could definitely do without all of the notifications for them! John Clancy From J.Ede at birchenallhowden.co.uk Wed Jun 8 14:13:44 2011 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Wed Jun 8 14:12:46 2011 Subject: OT: PDF attachments from MAC users broken in Exchange 2007 and Exchange 2010 Message-ID: We've recently come across a few emails that aren't displayed correctly in an uptodate exchange environment (Exchange 2007 SP3 Rollup 3 and Exchange 2010 SP1 Rollup 4) due to a bug in the latest rollups. http://blogs.technet.com/b/exchange/archive/2011/04/21/mixed-ing-it-up-multipart-mixed-messages-and-you.aspx There is a fix from MS, but it requires raising a support case with them to get it and I was wondering if there was anything we could do in MailScanner to make sure these attachments get through properly as a workaround till the proper fix is in place? The attachments can be viewed fine in mailwatch so I know the email is good and that the problem is purely how exchange displays these emails. Jason -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110608/3894e262/attachment.html From iveymr at gmail.com Wed Jun 8 14:52:12 2011 From: iveymr at gmail.com (Ryan Ivey) Date: Wed Jun 8 14:52:25 2011 Subject: Disabling antivirus In-Reply-To: References: Message-ID: On Wed, Jun 8, 2011 at 6:44 AM, Sandro Dentella wrote: > Hi, > > I'm currently having problems with my postfix+mailscanner installation that > has worked fine up to yesterday. As I think probelms are in the antivirus I > wanted to get rid of it momentarily so I set > > Virus Scanning = no > > and restarted Mailserver. I still fine in the log: > > Jun 8 12:40:22 mail MailScanner[4343]: Virus and Content Scanning: > Starting > Jun 8 12:40:24 mail MailScanner[4343]: Requeue: 188BE246072.ABE45 to > B81D22460E7 > Jun 8 12:40:24 mail postfix/qmgr[27742]: B81D22460E7: from=< > sandro@e-den.it>, size=618, nrcpt=1 (queue active) > Jun 8 12:40:24 mail MailScanner[4343]: Uninfected: Delivered 1 messages > > So, how should I do to really disable virus scanning (even thought now it > seems it's working correctly...) > > TIA > > sandro > *:-) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > What's the output of MailScanner --lint? You should be able to set it 'no' and check w/out restarting MailScanner. With it set to 'no' --lint will produce output without the 'infected' message on the test file (eicar) because it won't call your virus scanner. Get in the habit of lint'ing after every change to your config before restarting, it'll save you some headaches. HTH, Ryan Ivey Linux Administrator Initial Source Solutions, LLC www.initialss.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110608/29f7aefa/attachment.html From bbecken at aafp.org Wed Jun 8 20:39:59 2011 From: bbecken at aafp.org (Brad Beckenhauer) Date: Wed Jun 8 20:40:32 2011 Subject: Rules & forwards Message-ID: <4DEF89BF020000680008E337@smtp.aafp.org> I need a rule that will forward email to a given account to multiple accounts as shown below. To: jdoe@domain.tld forward User1@domain.tld ( mailto:User1@domain.tld ) forward User2@domain.tld The syntax does work for User1, but not User2. Any suggestions on how to make this work for the second user account? thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110608/ea6a65ca/attachment.html From sbanderson at impromed.com Wed Jun 8 20:51:11 2011 From: sbanderson at impromed.com (Scott B. Anderson) Date: Wed Jun 8 20:51:40 2011 Subject: Rules & forwards In-Reply-To: <4DEF89BF020000680008E337@smtp.aafp.org> References: <4DEF89BF020000680008E337@smtp.aafp.org> Message-ID: <7D95F4DE708E0948892128F41A250738168E5994@es3.impromed.com> This is an MTA question, so it is off topic for the list, but if you are using sendmail, then use /etc/mail/aliases (or wherever your distribution places it) Username: username@domain.tld, username2@domain.tld, username3@domain.tld Then save and run newaliases. I'm sure someone else will reply with the answer for postfix, but my guess would be to replace your second 'forward' with a comma. Scott -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Brad Beckenhauer Sent: Wednesday, June 08, 2011 2:40 PM To: mailscanner@lists.mailscanner.info Subject: Rules & forwards I need a rule that will forward email to a given account to multiple accounts as shown below. To: jdoe@domain.tld forward User1@domain.tld ( mailto:User1@domain.tld ) forward User2@domain.tld The syntax does work for User1, but not User2. Any suggestions on how to make this work for the second user account? thanks -- ImproMed, LLC. -- From bbecken at aafp.org Wed Jun 8 22:31:55 2011 From: bbecken at aafp.org (Brad Beckenhauer) Date: Wed Jun 8 22:32:25 2011 Subject: Rules & forwards In-Reply-To: <7D95F4DE708E0948892128F41A250738168E5994@es3.impromed.com> References: <4DEF89BF020000680008E337@smtp.aafp.org> <7D95F4DE708E0948892128F41A250738168E5994@es3.impromed.com> Message-ID: <4DEFA3FB020000680008E40A@smtp.aafp.org> I figured it out. I did not need the extra forward statement For example within MailScanner: Non-Spam Actions using a ruleset: To: jdoe@domain.tld deliver forward User1@domain.tld User2@domain.tld or To: jdoe@domain.tld forward User1@domain.tld User2@domain.tld thanks >>> On 6/8/2011 at 2:51 PM, "Scott B. Anderson" wrote: This is an MTA question, so it is off topic for the list, but if you are using sendmail, then use /etc/mail/aliases (or wherever your distribution places it) Username: username@domain.tld, username2@domain.tld, username3@domain.tld Then save and run newaliases. I'm sure someone else will reply with the answer for postfix, but my guess would be to replace your second 'forward' with a comma. Scott -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Brad Beckenhauer Sent: Wednesday, June 08, 2011 2:40 PM To: mailscanner@lists.mailscanner.info Subject: Rules & forwards I need a rule that will forward email to a given account to multiple accounts as shown below. To: jdoe@domain.tld forward User1@domain.tld ( mailto:User1@domain.tld ) forward User2@domain.tld The syntax does work for User1, but not User2. Any suggestions on how to make this work for the second user account? thanks -- ImproMed, LLC. -- -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110608/62823dd9/attachment.html From ipcopper.ph at gmail.com Thu Jun 9 03:23:20 2011 From: ipcopper.ph at gmail.com (jan gestre) Date: Thu Jun 9 03:23:30 2011 Subject: yahoo mail rejected Message-ID: Hi Everyone, We're using MailScanner for years already, unfortunately there are some odd things happening from time to time, here is one instance. One of our client is trying to send an email using yahoo mail unfortunately our Postfix-MailScanner server rejected the email and spewed this error message: From: System Administrator Sent: Tuesday, June 07, 2011 11:10 AM To: Jane Doe Cc: 'MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be janedoe@sampledomain.com' Subject: Undeliverable: Draft NDA Your message did not reach some or all of the intended recipients. Subject: FW: Draft NDA Sent: 6/7/2011 11:10 AM The following recipient(s) cannot be reached: 'MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be janedoe@sampledomain.com' on 6/7/2011 11:10 AM Server error: '450 4.1.2 : Recipient address rejected: Domain not found' Googling for similar issues led me to none, any ideas why? Thanks in advance. From glenn.steen at gmail.com Thu Jun 9 12:14:22 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jun 9 12:14:33 2011 Subject: yahoo mail rejected In-Reply-To: References: Message-ID: Two things seem to happen there: The recipient address has a domain part that is unknown to the server generating the rejection. The NDN get seriously mangled (and rightly so, it seems) by a mailscanner server (perhaps yours), making it a bit harder to read;-) Root cause is likely some really bad editing of a "hyperlink email address" in the senders piece of crap MUA... Tell the sender to actually type the adress, and it'll likely work much better;-) Cheers -- -- Glenn Den 9 jun 2011 04.28, "jan gestre" skrev: Hi Everyone, We're using MailScanner for years already, unfortunately there are some odd things happening from time to time, here is one instance. One of our client is trying to send an email using yahoo mail unfortunately our Postfix-MailScanner server rejected the email and spewed this error message: From: System Administrator Sent: Tuesday, June 07, 2011 11:10 AM To: Jane Doe Cc: 'MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be janedoe@sampledomain.com' Subject: Undeliverable: Draft NDA Your message did not reach some or all of the intended recipients. Subject: FW: Draft NDA Sent: 6/7/2011 11:10 AM The following recipient(s) cannot be reached: 'MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be janedoe@sampledomain.com' on 6/7/2011 11:10 AM Server error: '450 4.1.2 : Recipient address rejected: Domain not found' Googling for similar issues led me to none, any ideas why? Thanks in advance. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110609/fecaa67f/attachment.html From mark at alpha2.com Thu Jun 9 16:53:24 2011 From: mark at alpha2.com (Mark L. Wise) Date: Thu Jun 9 16:54:21 2011 Subject: Problems with MailScanner and SELinux compatibility Message-ID: <4DF0EC74.8090109@alpha2.com> Sorry if this is a second post... I am still debugging my new mail server and I did not see the first post come back to me from the list... I have just built a new box based on Fedora Core 15 (2.6.38.7-30). I am going to use this box as a mail server. I am using sendmail (8.14.4), spamassassin (3.3.2-r929478), clamav (0.97), dovecot (2.0.13) and MailScanner (4.83.5). Everything appears to be configured well and working, except when I turn on MailScanner I get errors in the maillog file that indicate a problem writing (apparently temporary) files. After a bit of research, it appears that this may be a conflict between MailScanner and SELinux. Does anyone have a SELinux policy or know of a way to fix this issue? I really would like to have SELinux enforcing AND MailScanner checking my mail. Thanks in advance for any help you can give me. Mark -- Mark L. Wise Alpha II Service, Inc. 1312 Epworth Ave Reynoldsburg, Ohio 43068-2116 USA Office: (614) 868-5033 Fax: (614) 868-1060 Email: mark@alpha2.com WEB: www.alpha2.com "People do not quit playing because they grow old; they grow old because they quit playing." Oliver Wendell Holmes From maxsec at gmail.com Thu Jun 9 18:40:20 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Jun 9 18:40:30 2011 Subject: Problems with MailScanner and SELinux compatibility In-Reply-To: <4DF0EC74.8090109@alpha2.com> References: <4DF0EC74.8090109@alpha2.com> Message-ID: MArk Ok beyond the usual reply that using FC for a 'server' is a bad idea due to the short build/support cycle and bleeding edge features... :-) (use centos) Put mailScanner on a dedicated box that sits between the internet and the actual mailserver. That way if one of the duties of either mailscanning or mailserving you don't take out both functions at the same time. I've helped a couple of installations where both duties where on the same box and upgrades, maintanance becomes 'interesting' and frought quote quickly. I also tend to turn off SELinux as I tend it more trouble than it's worth - either that or I'm just too darn lazy to get my head arounf SElinux. :-) -- Martin Hepworth Oxford, UK On 9 June 2011 16:53, Mark L. Wise wrote: > Sorry if this is a second post... I am still debugging my new mail server > and I did not see the first post come back to me from the list... > > I have just built a new box based on Fedora Core 15 (2.6.38.7-30). I am > going to use this box as a mail server. I am using sendmail (8.14.4), > spamassassin (3.3.2-r929478), clamav (0.97), dovecot (2.0.13) and > MailScanner (4.83.5). > > Everything appears to be configured well and working, except when I turn on > MailScanner I get errors in the maillog file that indicate a problem writing > (apparently temporary) files. > > After a bit of research, it appears that this may be a conflict between > MailScanner and SELinux. > > Does anyone have a SELinux policy or know of a way to fix this issue? I > really would like to have SELinux enforcing AND MailScanner checking my > mail. > > Thanks in advance for any help you can give me. > > Mark > > -- > Mark L. Wise > > Alpha II Service, Inc. > 1312 Epworth Ave > Reynoldsburg, Ohio 43068-2116 > USA > > Office: (614) 868-5033 > Fax: (614) 868-1060 > Email: mark@alpha2.com > WEB: www.alpha2.com > > "People do not quit playing because they grow old; they grow old because > they quit playing." > > Oliver Wendell Holmes > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110609/fbab1143/attachment.html From sandro.dentella at gmail.com Thu Jun 9 19:49:23 2011 From: sandro.dentella at gmail.com (Sandro Dentella) Date: Thu Jun 9 19:49:33 2011 Subject: Disabling antivirus In-Reply-To: References: Message-ID: 2011/6/8 Ryan Ivey > On Wed, Jun 8, 2011 at 6:44 AM, Sandro Dentella > wrote: > >> Hi, >> >> I'm currently having problems with my postfix+mailscanner installation >> that has worked fine up to yesterday. As I think probelms are in the >> antivirus I wanted to get rid of it momentarily so I set >> >> Virus Scanning = no >> > >> and restarted Mailserver. I still fine in the log: >> >> Jun 8 12:40:22 mail MailScanner[4343]: Virus and Content Scanning: >> Starting >> Jun 8 12:40:24 mail MailScanner[4343]: Requeue: 188BE246072.ABE45 to >> B81D22460E7 >> Jun 8 12:40:24 mail postfix/qmgr[27742]: B81D22460E7: from=< >> sandro@e-den.it>, size=618, nrcpt=1 (queue active) >> Jun 8 12:40:24 mail MailScanner[4343]: Uninfected: Delivered 1 messages >> >> So, how should I do to really disable virus scanning (even thought now it >> seems it's working correctly...) >> >> TIA >> >> sandro >> *:-) >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > > > What's the output of MailScanner --lint? You should be able to set it > 'no' and check w/out restarting MailScanner. With it set to 'no' --lint > will produce output without the 'infected' message on the test file (eicar) > because it won't call your virus scanner. Get in the habit of lint'ing > after every change to your config before restarting, it'll save you some > headaches. > > Thanks for the hint Ryan! I wasn't aware of --lint option. I could fix a couplpe of errors. In fact I see that setting to 'no' turns out the EICAR infected message but does not stop the message: MailScanner.conf says "Virus Scanners = clamav" Found these virus scanners installed: clamd =========================================================================== Virus and Content Scanning: Starting =========================================================================== If any of your virus scanners (clamd) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. that I find misleading if the meaning is that virus scanning is disabled! A last question: I had problems setting the permission. Using Virus Scanenr = clamd raise an error: =========================================================================== Virus and Content Scanning: Starting Clamd::ERROR:: UNKNOWN CLAMD RETURN ./MSlintPTFbzv/lstat() failed: Permission denied. ERROR :: /var/spool/MailScanner/incoming/22945 Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus Scanning: Clamd found 2 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 2 viruses =========================================================================== that I don't have if I set Virus Scanners = clamav user and Group definition in MailScanner.conf are: Run As User = postfix Incoming Work User = Quarantine User = Incoming Work Group = clamav Quarantine Group = Run As Group = www-data Incoming Work Group = clamav and postfix also belongs to clamav group. I don't really know ho to interpret the error. Since the virus scanner is clamd, it means that clamd user should be able to create /var/spool/MailScanner/incoming/22945, correct? clamd *is* able to do that... Any help is appreciated sandro *:-) -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110609/153100be/attachment.html From glenn.steen at gmail.com Thu Jun 9 22:11:37 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Thu Jun 9 22:11:49 2011 Subject: Disabling antivirus In-Reply-To: References: Message-ID: 1. Set Virus Scanning to no, to disable that part. 2. This will neither stop the installed scanners from being updated, nor exclude them from the lint tests. Jules designed it this way deliberately, and for good reason. 3. Clamav scanner is a wrapped up call to clamscan run as the user you run MS as. The clamd thing passes the job of scanning the batch to the clamd daemon, which pribably runs as the clamav user/group. Amend the permissions and ownerships so that it xan, but without fouling up things for MS as such... And you're good. There's at least one wiki page in the MS wiki to guide you, as well as numerous (but old-ish) posts in this ml... Go read them. Cheers! -- -- Glenn Den 9 jun 2011 20.56, "Sandro Dentella" skrev: 2011/6/8 Ryan Ivey > > On Wed, Jun 8, 2011 at 6:44 AM, Sandro Dentella References: Message-ID: On Thu, Jun 9, 2011 at 7:14 PM, Glenn Steen wrote: > Two things seem to happen there: > The recipient address has a domain part that is unknown to the server > generating the rejection. > > The NDN get seriously mangled (and rightly so, it seems) by a mailscanner > server (perhaps yours),? making it a bit harder to read;-) > > Root cause is likely some really bad editing of a "hyperlink email address" > in the senders piece of crap MUA... Tell the sender to actually type the > adress, and it'll likely work much better;-) > > Cheers > -- > -- Glenn > Hi Glen, Thanks for the response! Is there any way I can fix MailScanner i.e. the mangling part? Regards, j From glenn.steen at gmail.com Fri Jun 10 18:31:31 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Fri Jun 10 18:31:41 2011 Subject: yahoo mail rejected In-Reply-To: References: Message-ID: That'd be up to Jules, I've not looked at the actual anti-phishing code myself, at least not recently:-) . If you're running something other than the latest, an update might help... Check the changelog on www.mailscanner.info;-) Cheers! Den 10 jun 2011 09.20, "jan gestre" skrev: On Thu, Jun 9, 2011 at 7:14 PM, Glenn Steen wrote: > Two things seem to happ... Hi Glen, Thanks for the response! Is there any way I can fix MailScanner i.e. the mangling part? Regards, j -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/li... -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110610/71dcfdc5/attachment.html From Denis.Beauchemin at usherbrooke.ca Fri Jun 10 18:49:18 2011 From: Denis.Beauchemin at usherbrooke.ca (Beauchemin, Denis) Date: Fri Jun 10 18:50:08 2011 Subject: yahoo mail rejected In-Reply-To: References: Message-ID: <1C7E4902EA98DE4487AA66F401F237F001F61665@EPSILONX.spa.usherbrooke.ca> I would say the mangling may result from the email passing twice through MailScanner. Denis ________________________________ Denis Beauchemin Architecte Technologique - Section Infrastructure des serveurs Service des technologies de l?information (S.T.I.) Universit? de Sherbrooke Courriel: Denis.Beauchemin@USherbrooke.ca T?l.: 819-821-8000 Poste: 62252 De : mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] De la part de Glenn Steen Envoy? : 9 juin 2011 07:14 ? : MailScanner discussion Objet : Re: yahoo mail rejected Two things seem to happen there: The recipient address has a domain part that is unknown to the server generating the rejection. The NDN get seriously mangled (and rightly so, it seems) by a mailscanner server (perhaps yours), making it a bit harder to read;-) Root cause is likely some really bad editing of a "hyperlink email address" in the senders piece of crap MUA... Tell the sender to actually type the adress, and it'll likely work much better;-) Cheers -- -- Glenn Den 9 jun 2011 04.28, "jan gestre" skrev: Hi Everyone, We're using MailScanner for years already, unfortunately there are some odd things happening from time to time, here is one instance. One of our client is trying to send an email using yahoo mail unfortunately our Postfix-MailScanner server rejected the email and spewed this error message: From: System Administrator Sent: Tuesday, June 07, 2011 11:10 AM To: Jane Doe Cc: 'MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be janedoe@sampledomain.com' Subject: Undeliverable: Draft NDA Your message did not reach some or all of the intended recipients. Subject: FW: Draft NDA Sent: 6/7/2011 11:10 AM The following recipient(s) cannot be reached: 'MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be MailScanner has detected a possible fraud attempt from "us.mc768.mail.yahoo.com" claiming to be janedoe@sampledomain.com' on 6/7/2011 11:10 AM Server error: '450 4.1.2 : Recipient address rejected: Domain not found' Googling for similar issues led me to none, any ideas why? Thanks in advance. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110610/31a1d7a8/attachment.html From glenn.steen at gmail.com Sat Jun 11 18:21:12 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Sat Jun 11 18:21:22 2011 Subject: yahoo mail rejected In-Reply-To: <1C7E4902EA98DE4487AA66F401F237F001F61665@EPSILONX.spa.usherbrooke.ca> References: <1C7E4902EA98DE4487AA66F401F237F001F61665@EPSILONX.spa.usherbrooke.ca> Message-ID: Might be, but I've seen similar badness on a single pass though... I think...:-) Den 10 jun 2011 19.54, "Beauchemin, Denis" skrev: I would say the mangling may result from the email passing twice through MailScanner. Denis * ------------------------------ * *Denis Beauchemin** **Architecte Technologique - Section Infrastructure des serveurs *Service des technologies de l?information (S.T.I.) Universit? de Sherbrooke Courriel: Denis.Beauchemin@USherbrooke.ca T?l.: 819-821-8000 Poste: 62252** *De :* mailscanner-bounces@lists.mailscanner.info [mailto: mailscanner-bounces@lists.mailscanner.info] *De la part de* Glenn Steen *Envoy? :* 9 juin 2011 07:14 *? :* MailScanner discussion *Objet :* Re: yahoo mail rejected Two things seem to happen there: The recipient address has a domain part that is unknown to the... -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110611/b882116d/attachment.html From noisex at apollo.lv Tue Jun 14 13:39:55 2011 From: noisex at apollo.lv (Noisex) Date: Tue Jun 14 13:40:19 2011 Subject: MS Word problems In-Reply-To: References: Message-ID: <002701cc2a90$2a3279b0$7e976d10$@lv> Hi! I can't figure out where is the problem with Mailscanner configuration or something else is wrong. So the problem is that recipients don't getting e-mails at all where is attached Microsoft Word documents (*.doc, *.docx). The sender receive answer from Mailserver: Our virus detector failed to completely analyse a message you sent:- To: mail@domain.tld Subject: Date: Sat Jun 11 02:42:45 2011 Any parts of the message that could not be analysed will not have been delivered. If you are using Microsoft Outlook, we strongly recommend you change your outgoing message format from "Rich Text" to "HTML" or "Plain Text". 1) Click on the "Tools" menu and choose "Options..." 2) Go to the "Mail Format" tab 3) For message format, select "HTML" or "Plain text" 4) Click OK The virus detector said this about the message: Report: Report: MailScanner: Message attempted to kill MailScanner -- MailScanner Email Virus Scanner Mail server Besides mail is didn't send through MS Outlook J MTA: Postfix + Courier + MailScanner + SA + Clamav >From Maillog: Jun 14 15:19:56 obelix postfix/smtpd[67189]: connect from xxxx.xxxx.xx[xx.xx.xxx.xx] Jun 14 15:19:56 obelix postfix/smtpd[67189]: C89706E0B7: client=xxxx.xxxx.xx[xx.xx.xx.xx] Jun 14 15:19:56 obelix postfix/cleanup[67193]: C89706E0B7: hold: header Received: from xxxx@xxxx.xx (xxxxxxxxxxxxx [xx.xx.xx.xx])??by xxxxxxxxxxx (Postfix) with ESMTP id C89706E0B7??for ; Tue, 14 Jun 2011 15:19:56 +0300 (EEST) from xxxxx.xxxx.xx[xx.xx.xx.xx]; from= to= proto=ESMTP helo= Jun 14 15:19:56 obelix postfix/cleanup[67193]: C89706E0B7: message-id=<001b01cc2a8d$6bfe3940$43faabc0$@lv> Jun 14 15:19:56 obelix postfix/smtpd[67189]: disconnect from xxxxx.xxxxx.xx[xx.xx.xx.xx] Jun 14 15:19:58 obelix MailScanner[66707]: New Batch: Found 2 messages waiting Jun 14 15:19:58 obelix MailScanner[66707]: New Batch: Scanning 1 messages, 61350 bytes Jun 14 15:19:59 obelix MailScanner[67199]: MailScanner E-Mail Virus Scanner version 4.81.4 starting... Jun 14 15:19:59 obelix MailScanner[67199]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf Jun 14 15:19:59 obelix MailScanner[67199]: Read 865 hostnames from the phishing whitelist Jun 14 15:19:59 obelix MailScanner[67199]: Read 5278 hostnames from the phishing blacklists Jun 14 15:19:59 obelix MailScanner[67199]: Using SpamAssassin results cache Jun 14 15:19:59 obelix MailScanner[67199]: Connected to SpamAssassin cache database Jun 14 15:19:59 obelix MailScanner[67199]: Enabling SpamAssassin auto-whitelist functionality... Jun 14 15:20:01 obelix MailScanner[66737]: Virus and Content Scanning: Starting Jun 14 15:20:04 obelix MailScanner[67199]: Connected to Processing Attempts Database Jun 14 15:20:04 obelix MailScanner[67199]: Found 2 messages in the Processing Attempts Database Jun 14 15:20:04 obelix MailScanner[67199]: Using locktype = flock .. MailScanner -V Running on FreeBSD obelix.rdx.lv 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 15:02:08 UTC 2009 root@mason.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64 This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.81.4 Module versions are: 1.00 AnyDBM_File 1.30 Archive::Zip 0.23 bignum 1.11 Carp 2.02 Compress::Zlib 1.119 Convert::BinHex 0.17 Convert::TNEF 2.124 Data::Dumper 2.30 Date::Parse 1.03 DirHandle 1.06 Fcntl 2.77 File::Basename 2.14 File::Copy 2.02 FileHandle 2.07_03 File::Path 0.22 File::Temp 0.92 Filesys::Df 3.68 HTML::Entities 3.68 HTML::Parser 3.57 HTML::TokeParser 1.25 IO 1.14 IO::File 1.13 IO::Pipe 2.07 Mail::Header 1.89 Math::BigInt 0.22 Math::BigRat 3.08 MIME::Base64 5.428 MIME::Decoder 5.428 MIME::Decoder::UU 5.428 MIME::Head 5.428 MIME::Parser 3.08 MIME::QuotedPrint 5.428 MIME::Tools 0.14 Net::CIDR 1.25 Net::IP 0.19 OLE::Storage_Lite 1.04 Pod::Escapes 3.07 Pod::Simple 1.17 POSIX 1.21 Scalar::Util 1.82 Socket 2.21 Storable 1.4 Sys::Hostname::Long 0.27 Sys::Syslog missing Test::Pod 0.96 Test::Simple 1.9719 Time::HiRes 1.02 Time::localtime Optional module versions are: 1.52 Archive::Tar 0.23 bignum missing Business::ISBN missing Business::ISBN::Data missing Data::Dump 1.82 DB_File 1.31 DBD::SQLite 1.615 DBI 1.16 Digest 1.02 Digest::HMAC 2.39 Digest::MD5 2.13 Digest::SHA1 1.01 Encode::Detect missing Error 0.2703 ExtUtils::CBuilder 2.2203 ExtUtils::ParseXS 2.38 Getopt::Long missing Inline missing IO::String 1.09 IO::Zlib 2.27 IP::Country missing Mail::ClamAV 3.003001 Mail::SpamAssassin missing Mail::SPF missing Mail::SPF::Query 0.3607 Module::Build missing Net::CIDR::Lite 0.66 Net::DNS missing Net::DNS::Resolver::Programmable missing Net::LDAP 4.028 NetAddr::IP missing Parse::RecDescent missing SAVI 3.17 Test::Harness missing Test::Manifest 2.0.0 Text::Balanced 1.53 URI 0.77 version missing YAML Trying to setlogsock(unix) Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf Read 865 hostnames from the phishing whitelist Read 5278 hostnames from the phishing blacklists Checking version numbers... Version number in MailScanner.conf (4.81.4) is correct. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (125) MailScanner setting UID to (125) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 2 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = clamd" Found these virus scanners installed: clamd =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus Scanning: Clamd found 1 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 1 viruses =========================================================================== Virus Scanner test reports: Clamd said "eicar.com was infected: Eicar-Test-Signature" If any of your virus scanners (clamd) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110614/d8794393/attachment.html From iveymr at gmail.com Tue Jun 14 14:17:07 2011 From: iveymr at gmail.com (Ryan Ivey) Date: Tue Jun 14 14:31:19 2011 Subject: MS Word problems In-Reply-To: <002701cc2a90$2a3279b0$7e976d10$@lv> References: <002701cc2a90$2a3279b0$7e976d10$@lv> Message-ID: On Tue, Jun 14, 2011 at 8:39 AM, Noisex wrote: > Hi! I can?t figure out where is the problem with Mailscanner > configuration or something else is wrong. So the problem is that recipients > don?t getting e-mails at all where is attached Microsoft Word documents > (*.doc, *.docx). > > > > The sender receive answer from Mailserver: > > > > > > Our virus detector failed to completely analyse a message you sent:- > > To: mail@domain.tld > > Subject: > > Date: Sat Jun 11 02:42:45 2011 > > Any parts of the message that could not be analysed will not have been > delivered. > > > > If you are using Microsoft Outlook, we strongly recommend you change your > outgoing message format from "Rich Text" to "HTML" or "Plain Text". > > > > 1) Click on the "Tools" menu and choose "Options..." > > 2) Go to the "Mail Format" tab > > 3) For message format, select "HTML" or "Plain text" > > 4) Click OK > > > > The virus detector said this about the message: > > Report: Report: MailScanner: Message attempted to kill MailScanner > > > > > > -- > > MailScanner > > Email Virus Scanner > > Mail server > > > > > > Besides mail is didn?t send through MS Outlook J > > > > MTA: Postfix + Courier + MailScanner + SA + Clamav > > > > > > From Maillog: > > > > Jun 14 15:19:56 obelix postfix/smtpd[67189]: connect from > xxxx.xxxx.xx[xx.xx.xxx.xx] > > Jun 14 15:19:56 obelix postfix/smtpd[67189]: C89706E0B7: > client=xxxx.xxxx.xx[xx.xx.xx.xx] > > Jun 14 15:19:56 obelix postfix/cleanup[67193]: C89706E0B7: hold: header > Received: from xxxx@xxxx.xx (xxxxxxxxxxxxx [xx.xx.xx.xx])??by xxxxxxxxxxx > (Postfix) with ESMTP id C89706E0B7??for ; Tue, 14 Jun 2011 > 15:19:56 +0300 (EEST) from xxxxx.xxxx.xx[xx.xx.xx.xx]; from= > to= proto=ESMTP helo= > > Jun 14 15:19:56 obelix postfix/cleanup[67193]: C89706E0B7: > message-id=<001b01cc2a8d$6bfe3940$43faabc0$@lv> > > Jun 14 15:19:56 obelix postfix/smtpd[67189]: disconnect from > xxxxx.xxxxx.xx[xx.xx.xx.xx] > > Jun 14 15:19:58 obelix MailScanner[66707]: New Batch: Found 2 messages > waiting > > Jun 14 15:19:58 obelix MailScanner[66707]: New Batch: Scanning 1 messages, > 61350 bytes > > Jun 14 15:19:59 obelix MailScanner[67199]: MailScanner E-Mail Virus Scanner > version 4.81.4 starting... > > Jun 14 15:19:59 obelix MailScanner[67199]: Reading configuration file > /usr/local/etc/MailScanner/MailScanner.conf > > Jun 14 15:19:59 obelix MailScanner[67199]: Read 865 hostnames from the > phishing whitelist > > Jun 14 15:19:59 obelix MailScanner[67199]: Read 5278 hostnames from the > phishing blacklists > > Jun 14 15:19:59 obelix MailScanner[67199]: Using SpamAssassin results cache > > > Jun 14 15:19:59 obelix MailScanner[67199]: Connected to SpamAssassin cache > database > > Jun 14 15:19:59 obelix MailScanner[67199]: Enabling SpamAssassin > auto-whitelist functionality... > > Jun 14 15:20:01 obelix MailScanner[66737]: Virus and Content Scanning: > Starting > > Jun 14 15:20:04 obelix MailScanner[67199]: Connected to Processing Attempts > Database > > Jun 14 15:20:04 obelix MailScanner[67199]: Found 2 messages in the > Processing Attempts Database > > Jun 14 15:20:04 obelix MailScanner[67199]: Using locktype = flock > > ?. > > > > > > MailScanner -V > > Running on > > FreeBSD obelix.rdx.lv 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 > 15:02:08 UTC 2009 root@mason.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC > amd64 > > This is Perl version 5.010001 (5.10.1) > > > > This is MailScanner version 4.81.4 > > Module versions are: > > 1.00 AnyDBM_File > > 1.30 Archive::Zip > > 0.23 bignum > > 1.11 Carp > > 2.02 Compress::Zlib > > 1.119 Convert::BinHex > > 0.17 Convert::TNEF > > 2.124 Data::Dumper > > 2.30 Date::Parse > > 1.03 DirHandle > > 1.06 Fcntl > > 2.77 File::Basename > > 2.14 File::Copy > > 2.02 FileHandle > > 2.07_03 File::Path > > 0.22 File::Temp > > 0.92 Filesys::Df > > 3.68 HTML::Entities > > 3.68 HTML::Parser > > 3.57 HTML::TokeParser > > 1.25 IO > > 1.14 IO::File > > 1.13 IO::Pipe > > 2.07 Mail::Header > > 1.89 Math::BigInt > > 0.22 Math::BigRat > > 3.08 MIME::Base64 > > 5.428 MIME::Decoder > > 5.428 MIME::Decoder::UU > > 5.428 MIME::Head > > 5.428 MIME::Parser > > 3.08 MIME::QuotedPrint > > 5.428 MIME::Tools > > 0.14 Net::CIDR > > 1.25 Net::IP > > 0.19 OLE::Storage_Lite > > 1.04 Pod::Escapes > > 3.07 Pod::Simple > > 1.17 POSIX > > 1.21 Scalar::Util > > 1.82 Socket > > 2.21 Storable > > 1.4 Sys::Hostname::Long > > 0.27 Sys::Syslog > > missing Test::Pod > > 0.96 Test::Simple > > 1.9719 Time::HiRes > > 1.02 Time::localtime > > > > Optional module versions are: > > 1.52 Archive::Tar > > 0.23 bignum > > missing Business::ISBN > > missing Business::ISBN::Data > > missing Data::Dump > > 1.82 DB_File > > 1.31 DBD::SQLite > > 1.615 DBI > > 1.16 Digest > > 1.02 Digest::HMAC > > 2.39 Digest::MD5 > > 2.13 Digest::SHA1 > > 1.01 Encode::Detect > > missing Error > > 0.2703 ExtUtils::CBuilder > > 2.2203 ExtUtils::ParseXS > > 2.38 Getopt::Long > > missing Inline > > missing IO::String > > 1.09 IO::Zlib > > 2.27 IP::Country > > missing Mail::ClamAV > > 3.003001 Mail::SpamAssassin > > missing Mail::SPF > > missing Mail::SPF::Query > > 0.3607 Module::Build > > missing Net::CIDR::Lite > > 0.66 Net::DNS > > missing Net::DNS::Resolver::Programmable > > missing Net::LDAP > > 4.028 NetAddr::IP > > missing Parse::RecDescent > > missing SAVI > > 3.17 Test::Harness > > missing Test::Manifest > > 2.0.0 Text::Balanced > > 1.53 URI > > 0.77 version > > missing YAML > > > > Trying to setlogsock(unix) > > > > Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf > > Read 865 hostnames from the phishing whitelist > > Read 5278 hostnames from the phishing blacklists > > > > Checking version numbers... > > Version number in MailScanner.conf (4.81.4) is correct. > > > > Your envelope_sender_header in spam.assassin.prefs.conf is correct. > > MailScanner setting GID to (125) > > MailScanner setting UID to (125) > > > > Checking for SpamAssassin errors (if you use it)... > > Using SpamAssassin results cache > > Connected to SpamAssassin cache database > > SpamAssassin reported no errors. > > Connected to Processing Attempts Database > > Created Processing Attempts Database successfully > > There are 2 messages in the Processing Attempts Database > > Using locktype = posix > > MailScanner.conf says "Virus Scanners = clamd" > > Found these virus scanners installed: clamd > > =========================================================================== > > Filename Checks: Windows/DOS Executable (1 eicar.com) > > Other Checks: Found 1 problems > > Virus and Content Scanning: Starting > > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com > > Virus Scanning: Clamd found 1 infections > > Infected message 1 came from 10.1.1.1 > > Virus Scanning: Found 1 viruses > > =========================================================================== > > Virus Scanner test reports: > > Clamd said "eicar.com was infected: Eicar-Test-Signature" > > > > If any of your virus scanners (clamd) > > are not listed there, you should check that they are installed correctly > > and that MailScanner is finding them correctly via its virus.scanners.conf. > > > > > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > You need to run MailScanner --debug on an offending message. It will give you more details as to where the error is actually occurring. Ryan Ivey Linux Administrator Initial Source Solutions, LLC www.initialss.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110614/bbd790b6/attachment.html From alex at vidadigital.com.pa Tue Jun 14 14:36:10 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Tue Jun 14 14:36:20 2011 Subject: MS Word problems In-Reply-To: <002701cc2a90$2a3279b0$7e976d10$@lv> References: <002701cc2a90$2a3279b0$7e976d10$@lv> Message-ID: Did you try changing from RTF to HTML as per the instructions? On Tue, Jun 14, 2011 at 7:39 AM, Noisex wrote: > Hi! I can?t figure out where is the problem with Mailscanner > configuration or something else is wrong. So the problem is that recipients > don?t getting e-mails at all where is attached Microsoft Word documents > (*.doc, *.docx). > > > > The sender receive answer from Mailserver: > > > > > > Our virus detector failed to completely analyse a message you sent:- > > To: mail@domain.tld > > Subject: > > Date: Sat Jun 11 02:42:45 2011 > > Any parts of the message that could not be analysed will not have been > delivered. > > > > If you are using Microsoft Outlook, we strongly recommend you change your > outgoing message format from "Rich Text" to "HTML" or "Plain Text". > > > > 1) Click on the "Tools" menu and choose "Options..." > > 2) Go to the "Mail Format" tab > > 3) For message format, select "HTML" or "Plain text" > > 4) Click OK > > > > The virus detector said this about the message: > > Report: Report: MailScanner: Message attempted to kill MailScanner > > > > > > -- > > MailScanner > > Email Virus Scanner > > Mail server > > > > > > Besides mail is didn?t send through MS Outlook J > > > > MTA: Postfix + Courier + MailScanner + SA + Clamav > > > > > > From Maillog: > > > > Jun 14 15:19:56 obelix postfix/smtpd[67189]: connect from > xxxx.xxxx.xx[xx.xx.xxx.xx] > > Jun 14 15:19:56 obelix postfix/smtpd[67189]: C89706E0B7: > client=xxxx.xxxx.xx[xx.xx.xx.xx] > > Jun 14 15:19:56 obelix postfix/cleanup[67193]: C89706E0B7: hold: header > Received: from xxxx@xxxx.xx (xxxxxxxxxxxxx [xx.xx.xx.xx])??by xxxxxxxxxxx > (Postfix) with ESMTP id C89706E0B7??for ; Tue, 14 Jun 2011 > 15:19:56 +0300 (EEST) from xxxxx.xxxx.xx[xx.xx.xx.xx]; from= > to= proto=ESMTP helo= > > Jun 14 15:19:56 obelix postfix/cleanup[67193]: C89706E0B7: > message-id=<001b01cc2a8d$6bfe3940$43faabc0$@lv> > > Jun 14 15:19:56 obelix postfix/smtpd[67189]: disconnect from > xxxxx.xxxxx.xx[xx.xx.xx.xx] > > Jun 14 15:19:58 obelix MailScanner[66707]: New Batch: Found 2 messages > waiting > > Jun 14 15:19:58 obelix MailScanner[66707]: New Batch: Scanning 1 messages, > 61350 bytes > > Jun 14 15:19:59 obelix MailScanner[67199]: MailScanner E-Mail Virus Scanner > version 4.81.4 starting... > > Jun 14 15:19:59 obelix MailScanner[67199]: Reading configuration file > /usr/local/etc/MailScanner/MailScanner.conf > > Jun 14 15:19:59 obelix MailScanner[67199]: Read 865 hostnames from the > phishing whitelist > > Jun 14 15:19:59 obelix MailScanner[67199]: Read 5278 hostnames from the > phishing blacklists > > Jun 14 15:19:59 obelix MailScanner[67199]: Using SpamAssassin results cache > > > Jun 14 15:19:59 obelix MailScanner[67199]: Connected to SpamAssassin cache > database > > Jun 14 15:19:59 obelix MailScanner[67199]: Enabling SpamAssassin > auto-whitelist functionality... > > Jun 14 15:20:01 obelix MailScanner[66737]: Virus and Content Scanning: > Starting > > Jun 14 15:20:04 obelix MailScanner[67199]: Connected to Processing Attempts > Database > > Jun 14 15:20:04 obelix MailScanner[67199]: Found 2 messages in the > Processing Attempts Database > > Jun 14 15:20:04 obelix MailScanner[67199]: Using locktype = flock > > ?. > > > > > > MailScanner -V > > Running on > > FreeBSD obelix.rdx.lv 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 > 15:02:08 UTC 2009 root@mason.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC > amd64 > > This is Perl version 5.010001 (5.10.1) > > > > This is MailScanner version 4.81.4 > > Module versions are: > > 1.00 AnyDBM_File > > 1.30 Archive::Zip > > 0.23 bignum > > 1.11 Carp > > 2.02 Compress::Zlib > > 1.119 Convert::BinHex > > 0.17 Convert::TNEF > > 2.124 Data::Dumper > > 2.30 Date::Parse > > 1.03 DirHandle > > 1.06 Fcntl > > 2.77 File::Basename > > 2.14 File::Copy > > 2.02 FileHandle > > 2.07_03 File::Path > > 0.22 File::Temp > > 0.92 Filesys::Df > > 3.68 HTML::Entities > > 3.68 HTML::Parser > > 3.57 HTML::TokeParser > > 1.25 IO > > 1.14 IO::File > > 1.13 IO::Pipe > > 2.07 Mail::Header > > 1.89 Math::BigInt > > 0.22 Math::BigRat > > 3.08 MIME::Base64 > > 5.428 MIME::Decoder > > 5.428 MIME::Decoder::UU > > 5.428 MIME::Head > > 5.428 MIME::Parser > > 3.08 MIME::QuotedPrint > > 5.428 MIME::Tools > > 0.14 Net::CIDR > > 1.25 Net::IP > > 0.19 OLE::Storage_Lite > > 1.04 Pod::Escapes > > 3.07 Pod::Simple > > 1.17 POSIX > > 1.21 Scalar::Util > > 1.82 Socket > > 2.21 Storable > > 1.4 Sys::Hostname::Long > > 0.27 Sys::Syslog > > missing Test::Pod > > 0.96 Test::Simple > > 1.9719 Time::HiRes > > 1.02 Time::localtime > > > > Optional module versions are: > > 1.52 Archive::Tar > > 0.23 bignum > > missing Business::ISBN > > missing Business::ISBN::Data > > missing Data::Dump > > 1.82 DB_File > > 1.31 DBD::SQLite > > 1.615 DBI > > 1.16 Digest > > 1.02 Digest::HMAC > > 2.39 Digest::MD5 > > 2.13 Digest::SHA1 > > 1.01 Encode::Detect > > missing Error > > 0.2703 ExtUtils::CBuilder > > 2.2203 ExtUtils::ParseXS > > 2.38 Getopt::Long > > missing Inline > > missing IO::String > > 1.09 IO::Zlib > > 2.27 IP::Country > > missing Mail::ClamAV > > 3.003001 Mail::SpamAssassin > > missing Mail::SPF > > missing Mail::SPF::Query > > 0.3607 Module::Build > > missing Net::CIDR::Lite > > 0.66 Net::DNS > > missing Net::DNS::Resolver::Programmable > > missing Net::LDAP > > 4.028 NetAddr::IP > > missing Parse::RecDescent > > missing SAVI > > 3.17 Test::Harness > > missing Test::Manifest > > 2.0.0 Text::Balanced > > 1.53 URI > > 0.77 version > > missing YAML > > > > Trying to setlogsock(unix) > > > > Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf > > Read 865 hostnames from the phishing whitelist > > Read 5278 hostnames from the phishing blacklists > > > > Checking version numbers... > > Version number in MailScanner.conf (4.81.4) is correct. > > > > Your envelope_sender_header in spam.assassin.prefs.conf is correct. > > MailScanner setting GID to (125) > > MailScanner setting UID to (125) > > > > Checking for SpamAssassin errors (if you use it)... > > Using SpamAssassin results cache > > Connected to SpamAssassin cache database > > SpamAssassin reported no errors. > > Connected to Processing Attempts Database > > Created Processing Attempts Database successfully > > There are 2 messages in the Processing Attempts Database > > Using locktype = posix > > MailScanner.conf says "Virus Scanners = clamd" > > Found these virus scanners installed: clamd > > =========================================================================== > > Filename Checks: Windows/DOS Executable (1 eicar.com) > > Other Checks: Found 1 problems > > Virus and Content Scanning: Starting > > Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com > > Virus Scanning: Clamd found 1 infections > > Infected message 1 came from 10.1.1.1 > > Virus Scanning: Found 1 viruses > > =========================================================================== > > Virus Scanner test reports: > > Clamd said "eicar.com was infected: Eicar-Test-Signature" > > > > If any of your virus scanners (clamd) > > are not listed there, you should check that they are installed correctly > > and that MailScanner is finding them correctly via its virus.scanners.conf. > > > > > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110614/c943ae89/attachment.html From ssilva at sgvwater.com Tue Jun 14 17:18:56 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Jun 14 17:19:17 2011 Subject: CentOS 5 perl update Message-ID: Has anyone seen any problems with the perl update that is just out? I am going to start testing, but figured I would look for bumps ahead of time... From prandal at herefordshire.gov.uk Tue Jun 14 17:53:08 2011 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Tue Jun 14 17:53:36 2011 Subject: CentOS 5 perl update In-Reply-To: References: Message-ID: <7CA580B59C1ABD45B4614ED90D4C7B853AD60DB6@HC-EXMBX02.herefordshire.gov.uk> None at all, works a treat. Phil -- Phil Randal | Infrastructure Engineer NHS Herefordshire & Herefordshire Council? | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Scott Silva Sent: 14 June 2011 17:19 To: mailscanner@lists.mailscanner.info Subject: CentOS 5 perl update Has anyone seen any problems with the perl update that is just out? I am going to start testing, but figured I would look for bumps ahead of time... -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From noisex at apollo.lv Tue Jun 14 19:27:43 2011 From: noisex at apollo.lv (Noisex) Date: Tue Jun 14 19:28:06 2011 Subject: MS Word problems In-Reply-To: References: <002701cc2a90$2a3279b0$7e976d10$@lv> Message-ID: <005c01cc2ac0$c0ba6430$422f2c90$@lv> As I said, this happening no matter what kind of client is using (also tested with webmail). So there is no need to change from HTML to Text in the Outlook. So if in the attachment is Word document, Mailscanner process dies and current mail is not delivered also after several retries. It he message: Report: Report: MailScanner: Message attempted to kill MailScanner In the syslog I can see: Jun 13 13:58:53 obelix mailscanner: Process did not exit cleanly, returned 9 with signal 0 Jun 13 14:07:28 obelix last message repeated 2 times Jun 13 14:18:00 obelix last message repeated 5 times Jun 13 14:25:24 obelix last message repeated 3 times From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Alex Neuman Sent: otrdiena, 2011. gada 14. j?nij? 16:36 To: MailScanner discussion Subject: Re: MS Word problems Did you try changing from RTF to HTML as per the instructions? On Tue, Jun 14, 2011 at 7:39 AM, Noisex wrote: Hi! I can?t figure out where is the problem with Mailscanner configuration or something else is wrong. So the problem is that recipients don?t getting e-mails at all where is attached Microsoft Word documents (*.doc, *.docx). The sender receive answer from Mailserver: Our virus detector failed to completely analyse a message you sent:- To: mail@domain.tld Subject: Date: Sat Jun 11 02:42:45 2011 Any parts of the message that could not be analysed will not have been delivered. If you are using Microsoft Outlook, we strongly recommend you change your outgoing message format from "Rich Text" to "HTML" or "Plain Text". 1) Click on the "Tools" menu and choose "Options..." 2) Go to the "Mail Format" tab 3) For message format, select "HTML" or "Plain text" 4) Click OK The virus detector said this about the message: Report: Report: MailScanner: Message attempted to kill MailScanner -- MailScanner Email Virus Scanner Mail server Besides mail is didn?t send through MS Outlook J MTA: Postfix + Courier + MailScanner + SA + Clamav >From Maillog: Jun 14 15:19:56 obelix postfix/smtpd[67189]: connect from xxxx.xxxx.xx[xx.xx.xxx.xx] Jun 14 15:19:56 obelix postfix/smtpd[67189]: C89706E0B7: client=xxxx.xxxx.xx[xx.xx.xx.xx] Jun 14 15:19:56 obelix postfix/cleanup[67193]: C89706E0B7: hold: header Received: from xxxx@xxxx.xx (xxxxxxxxxxxxx [xx.xx.xx.xx])??by xxxxxxxxxxx (Postfix) with ESMTP id C89706E0B7??for ; Tue, 14 Jun 2011 15:19:56 +0300 (EEST) from xxxxx.xxxx.xx[xx.xx.xx.xx]; from= to= proto=ESMTP helo= Jun 14 15:19:56 obelix postfix/cleanup[67193]: C89706E0B7: message-id=<001b01cc2a8d$6bfe3940$43faabc0$@lv> Jun 14 15:19:56 obelix postfix/smtpd[67189]: disconnect from xxxxx.xxxxx.xx[xx.xx.xx.xx] Jun 14 15:19:58 obelix MailScanner[66707]: New Batch: Found 2 messages waiting Jun 14 15:19:58 obelix MailScanner[66707]: New Batch: Scanning 1 messages, 61350 bytes Jun 14 15:19:59 obelix MailScanner[67199]: MailScanner E-Mail Virus Scanner version 4.81.4 starting... Jun 14 15:19:59 obelix MailScanner[67199]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf Jun 14 15:19:59 obelix MailScanner[67199]: Read 865 hostnames from the phishing whitelist Jun 14 15:19:59 obelix MailScanner[67199]: Read 5278 hostnames from the phishing blacklists Jun 14 15:19:59 obelix MailScanner[67199]: Using SpamAssassin results cache Jun 14 15:19:59 obelix MailScanner[67199]: Connected to SpamAssassin cache database Jun 14 15:19:59 obelix MailScanner[67199]: Enabling SpamAssassin auto-whitelist functionality... Jun 14 15:20:01 obelix MailScanner[66737]: Virus and Content Scanning: Starting Jun 14 15:20:04 obelix MailScanner[67199]: Connected to Processing Attempts Database Jun 14 15:20:04 obelix MailScanner[67199]: Found 2 messages in the Processing Attempts Database Jun 14 15:20:04 obelix MailScanner[67199]: Using locktype = flock ?. MailScanner -V Running on FreeBSD obelix.rdx.lv 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 15:02:08 UTC 2009 root@mason.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC amd64 This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.81.4 Module versions are: 1.00 AnyDBM_File 1.30 Archive::Zip 0.23 bignum 1.11 Carp 2.02 Compress::Zlib 1.119 Convert::BinHex 0.17 Convert::TNEF 2.124 Data::Dumper 2.30 Date::Parse 1.03 DirHandle 1.06 Fcntl 2.77 File::Basename 2.14 File::Copy 2.02 FileHandle 2.07_03 File::Path 0.22 File::Temp 0.92 Filesys::Df 3.68 HTML::Entities 3.68 HTML::Parser 3.57 HTML::TokeParser 1.25 IO 1.14 IO::File 1.13 IO::Pipe 2.07 Mail::Header 1.89 Math::BigInt 0.22 Math::BigRat 3.08 MIME::Base64 5.428 MIME::Decoder 5.428 MIME::Decoder::UU 5.428 MIME::Head 5.428 MIME::Parser 3.08 MIME::QuotedPrint 5.428 MIME::Tools 0.14 Net::CIDR 1.25 Net::IP 0.19 OLE::Storage_Lite 1.04 Pod::Escapes 3.07 Pod::Simple 1.17 POSIX 1.21 Scalar::Util 1.82 Socket 2.21 Storable 1.4 Sys::Hostname::Long 0.27 Sys::Syslog missing Test::Pod 0.96 Test::Simple 1.9719 Time::HiRes 1.02 Time::localtime Optional module versions are: 1.52 Archive::Tar 0.23 bignum missing Business::ISBN missing Business::ISBN::Data missing Data::Dump 1.82 DB_File 1.31 DBD::SQLite 1.615 DBI 1.16 Digest 1.02 Digest::HMAC 2.39 Digest::MD5 2.13 Digest::SHA1 1.01 Encode::Detect missing Error 0.2703 ExtUtils::CBuilder 2.2203 ExtUtils::ParseXS 2.38 Getopt::Long missing Inline missing IO::String 1.09 IO::Zlib 2.27 IP::Country missing Mail::ClamAV 3.003001 Mail::SpamAssassin missing Mail::SPF missing Mail::SPF::Query 0.3607 Module::Build missing Net::CIDR::Lite 0.66 Net::DNS missing Net::DNS::Resolver::Programmable missing Net::LDAP 4.028 NetAddr::IP missing Parse::RecDescent missing SAVI 3.17 Test::Harness missing Test::Manifest 2.0.0 Text::Balanced 1.53 URI 0.77 version missing YAML Trying to setlogsock(unix) Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf Read 865 hostnames from the phishing whitelist Read 5278 hostnames from the phishing blacklists Checking version numbers... Version number in MailScanner.conf (4.81.4) is correct. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (125) MailScanner setting UID to (125) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 2 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = clamd" Found these virus scanners installed: clamd =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus Scanning: Clamd found 1 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 1 viruses =========================================================================== Virus Scanner test reports: Clamd said "eicar.com was infected: Eicar-Test-Signature" If any of your virus scanners (clamd) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110614/015a55aa/attachment-0001.html From jeff.jackson at rbza.com Tue Jun 14 22:44:09 2011 From: jeff.jackson at rbza.com (Jeff Jackson) Date: Tue Jun 14 22:44:22 2011 Subject: CentOS 5 perl update In-Reply-To: References: Message-ID: <72050959DEC5764EBD3E25F1309EACAB99B4A50B9F@nt18.rbza.com> I had problems with it. MailScanner wouldn't restart until I upgrade File::Temp and did a force install of Scalar::Util. I just needed a newer File::Temp, but Scalar::Util was the latest version but MailScanner was coughing up an error that it wasn't an XS-compiled version. Jeff -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Scott Silva Sent: Tuesday, June 14, 2011 9:19 AM To: mailscanner@lists.mailscanner.info Subject: CentOS 5 perl update Has anyone seen any problems with the perl update that is just out? I am going to start testing, but figured I would look for bumps ahead of time... -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From jwithrow at matech.net Wed Jun 15 13:18:06 2011 From: jwithrow at matech.net (Joshua F. Withrow) Date: Wed Jun 15 13:19:01 2011 Subject: CentOS 5 perl update In-Reply-To: <72050959DEC5764EBD3E25F1309EACAB99B4A50B9F@nt18.rbza.com> References: <72050959DEC5764EBD3E25F1309EACAB99B4A50B9F@nt18.rbza.com> Message-ID: I'm having similar problems, but haven't resolved them yet. How did you force the installation of File::Temp and Scalar::Util? Josh Withrow Software Developer Office: 410-548-1627 x154 Email: jwithrow@matech.net -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeff Jackson Sent: Tuesday, June 14, 2011 5:44 PM To: MailScanner discussion Subject: RE: CentOS 5 perl update I had problems with it. MailScanner wouldn't restart until I upgrade File::Temp and did a force install of Scalar::Util. I just needed a newer File::Temp, but Scalar::Util was the latest version but MailScanner was coughing up an error that it wasn't an XS-compiled version. Jeff -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Scott Silva Sent: Tuesday, June 14, 2011 9:19 AM To: mailscanner@lists.mailscanner.info Subject: CentOS 5 perl update Has anyone seen any problems with the perl update that is just out? I am going to start testing, but figured I would look for bumps ahead of time... -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! This message is the property of Machining Technologies, Inc (MaTech) and the Information contained herein may be/is subject to the Code of Federal Regulations Chapter 22 International Traffic in Arms Regulations (ITAR). This data may not be resold, diverted, transferred, transshipped, made available to a foreign national within the United States, or otherwise disposed of in any other country outside of its intended destination, either in original form or after being incorporated through an intermediate process into other data without the prior written approval of the US Department of State. The information in this e-mail and subsequent attachments may contain legally privileged, proprietary and/or confidential information that is intended only for the use of the addressee(s). No addressee should forward, print, copy or otherwise reproduce this message in any manner that would allow it to be viewed by any individual not originally listed as the recipient. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, retention or use of the contents of this e-mail information is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or return e-mail and delete this e-mail. Thank You. From roy at kaldung.com Wed Jun 15 13:35:24 2011 From: roy at kaldung.com (Roy Kaldung) Date: Wed Jun 15 13:33:32 2011 Subject: CentOS 5 perl update In-Reply-To: References: <72050959DEC5764EBD3E25F1309EACAB99B4A50B9F@nt18.rbza.com> Message-ID: <1d820069fc36f09c5227443ed7a2dc62@127.0.0.1> On Wed, 15 Jun 2011 08:18:06 -0400, "Joshua F. Withrow" wrote: > I'm having similar problems, but haven't resolved them yet. How did you > force the installation of File::Temp and Scalar::Util? > Hi, Just use the command force install packagename from the CPAN shell, I just run into the same problem and fixed it this way. hth, Roy -- Roy Kaldung From prandal at herefordshire.gov.uk Wed Jun 15 13:47:17 2011 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Wed Jun 15 13:47:47 2011 Subject: CentOS 5 perl update In-Reply-To: References: <72050959DEC5764EBD3E25F1309EACAB99B4A50B9F@nt18.rbza.com> Message-ID: <7CA580B59C1ABD45B4614ED90D4C7B853AD6561C@HC-EXMBX02.herefordshire.gov.uk> Version numbers are all important here, as is the version of MailScanner. Care to enlighten us? Cheers, Phil -- Phil Randal | Infrastructure Engineer NHS Herefordshire & Herefordshire Council? | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Joshua F. Withrow Sent: 15 June 2011 13:18 To: 'MailScanner discussion' Subject: RE: CentOS 5 perl update I'm having similar problems, but haven't resolved them yet. How did you force the installation of File::Temp and Scalar::Util? Josh Withrow Software Developer Office: 410-548-1627 x154 Email: jwithrow@matech.net -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeff Jackson Sent: Tuesday, June 14, 2011 5:44 PM To: MailScanner discussion Subject: RE: CentOS 5 perl update I had problems with it. MailScanner wouldn't restart until I upgrade File::Temp and did a force install of Scalar::Util. I just needed a newer File::Temp, but Scalar::Util was the latest version but MailScanner was coughing up an error that it wasn't an XS-compiled version. Jeff -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Scott Silva Sent: Tuesday, June 14, 2011 9:19 AM To: mailscanner@lists.mailscanner.info Subject: CentOS 5 perl update Has anyone seen any problems with the perl update that is just out? I am going to start testing, but figured I would look for bumps ahead of time... -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! This message is the property of Machining Technologies, Inc (MaTech) and the Information contained herein may be/is subject to the Code of Federal Regulations Chapter 22 International Traffic in Arms Regulations (ITAR). This data may not be resold, diverted, transferred, transshipped, made available to a foreign national within the United States, or otherwise disposed of in any other country outside of its intended destination, either in original form or after being incorporated through an intermediate process into other data without the prior written approval of the US Department of State. The information in this e-mail and subsequent attachments may contain legally privileged, proprietary and/or confidential information that is intended only for the use of the addressee(s). No addressee should forward, print, copy or otherwise reproduce this message in any manner that would allow it to be viewed by any individual not originally listed as the recipient. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, retention or use of the contents of this e-mail information is prohibited. If you have received this communication in error, please immediately notify the sender by telephone or return e-mail and delete this e-mail. Thank You. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From edward.prendergast at netring.co.uk Wed Jun 15 13:54:19 2011 From: edward.prendergast at netring.co.uk (Edward Prendergast) Date: Wed Jun 15 13:53:39 2011 Subject: CentOS 5 perl update In-Reply-To: <1d820069fc36f09c5227443ed7a2dc62@127.0.0.1> References: <72050959DEC5764EBD3E25F1309EACAB99B4A50B9F@nt18.rbza.com> <1d820069fc36f09c5227443ed7a2dc62@127.0.0.1> Message-ID: <4DF8AB7B.9040701@netring.co.uk> On 15/06/11 13:35, Roy Kaldung wrote: > On Wed, 15 Jun 2011 08:18:06 -0400, "Joshua F. Withrow" > wrote: >> I'm having similar problems, but haven't resolved them yet. How did you >> force the installation of File::Temp and Scalar::Util? >> > Hi, > > Just use the command > force install packagename > from the CPAN shell, I just run into the same problem and fixed it this > way. I've found mixing and matching CPAN modules with those from RPM on CentOS problematic in the past, and I prefer to use local::lib (http://search.cpan.org/dist/local-lib/lib/local/lib.pm) or a custom perl build. Just my 2c, this is what works in our setup, it may not be right for you, and as always, YMMV! Edward ************ The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any action taken or omitted to be taken in reliance on it, any form of reproduction, dissemination, copying, disclosure, modification, distribution and/or publication of this E-mail message is strictly prohibited and may be unlawful. If you have received this E-mail message in error, please notify us immediately. Please also destroy and delete the message from your computer. ************ From prandal at herefordshire.gov.uk Wed Jun 15 13:53:30 2011 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Wed Jun 15 13:54:40 2011 Subject: CentOS 5 perl update In-Reply-To: <1d820069fc36f09c5227443ed7a2dc62@127.0.0.1> References: <72050959DEC5764EBD3E25F1309EACAB99B4A50B9F@nt18.rbza.com> <1d820069fc36f09c5227443ed7a2dc62@127.0.0.1> Message-ID: <7CA580B59C1ABD45B4614ED90D4C7B853AD65659@HC-EXMBX02.herefordshire.gov.uk> You shouldn't need to do that. If you've installed the RPM version of MailScanner it comes with perl-File-Temp-0.20-4 and perl-Scalar-List-Utils-1.19-3. If they're not good enough they can be installed from rpmforge. Having broken things using CPAN in the past, I try to avoid it. MailScanner's install.sh --reinstall option should sort out the required perl modules. Cheers, Phil -- Phil Randal | Infrastructure Engineer NHS Herefordshire & Herefordshire Council? | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Roy Kaldung Sent: 15 June 2011 13:35 To: MailScanner discussion Subject: RE: CentOS 5 perl update On Wed, 15 Jun 2011 08:18:06 -0400, "Joshua F. Withrow" wrote: > I'm having similar problems, but haven't resolved them yet. How did > you force the installation of File::Temp and Scalar::Util? > Hi, Just use the command force install packagename from the CPAN shell, I just run into the same problem and fixed it this way. hth, Roy -- Roy Kaldung -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From dave.filchak at senecac.on.ca Wed Jun 15 17:37:03 2011 From: dave.filchak at senecac.on.ca (Dave Filchak) Date: Wed Jun 15 17:37:14 2011 Subject: errors after upgrade Message-ID: <4DF8DFAF.60405@senecac.on.ca> I have recently taken over management of a server that I used to manage some time ago. The MailScanner install had not been upgraded in some time so I decided to upgrade to the latest version. First mistake I made was not checking the version BEFORE I ran the upgrade but the person who had been managing it said it had not been upgraded in a year or so. So, I installed the latest version and during the install, I get the following: BEGIN failed--compilation aborted at t/weak.t line 33. dubious Test returned status 255 (wstat 65280, 0xff00) Failed Test Stat Wstat Total Fail List of Failed ------------------------------------------------------------------------------- t/weak.t 255 65280 ?? ?? ?? 1 test skipped. Failed 1/32 test scripts. 0/2190 subtests failed. Files=32, Tests=2190, 2 wallclock secs ( 2.10 cusr + 0.31 csys = 2.41 CPU) Failed 1/32 test programs. 0/2190 subtests failed. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.74452 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.74452 (%build) When I run MailScanner -V I get: MailScanner -V dualvar is only available with the XS version of Scalar::Util at /usr/lib/perl5/site_perl/5.8.8/Compress/Zlib.pm line 8 BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/Compress/Zlib.pm line 8. Compilation failed in require at /usr/lib/MailScanner/MailScanner/SA.pm line 42. BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/SA.pm line 42. Compilation failed in require at /usr/sbin/MailScanner line 110. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 110. AND: service MailScanner status Checking MailScanner daemons: MailScanner: [FAILED] incoming sendmail: head: cannot open `/var/run/sendmail.in.pid' for reading: No such file or directory [ OK ] outgoing sendmail: [ OK ] It is receiving and sending mail but I am not seeing anything about MailScanner in the logs so I assume it is not running. I appreciate all suggestions as to how to troubleshoot/repair this. Dave -- Professor Seneca College School of Media& Marketing 70 The Pond Road Toronto, On Canada From maxsec at gmail.com Wed Jun 15 18:29:50 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Jun 15 18:30:01 2011 Subject: errors after upgrade In-Reply-To: <4DF8DFAF.60405@senecac.on.ca> References: <4DF8DFAF.60405@senecac.on.ca> Message-ID: Looks like some of the underlying perl utils have upgraded maybe by the os Try the install again and watch for any errors Martin On Wednesday, 15 June 2011, Dave Filchak wrote: > I have recently taken over management of a server that I used to manage some time ago. The MailScanner install had not been upgraded in some time so I decided to upgrade to the latest version. First mistake I made was not checking the version BEFORE I ran the upgrade but the person who had been managing it said it had not been upgraded in a year or so. > > So, I installed the latest version and during the install, I get the following: > > BEGIN failed--compilation aborted at t/weak.t line 33. > dubious > ? ? ? ?Test returned status 255 (wstat 65280, 0xff00) > Failed Test Stat Wstat Total Fail ?List of Failed > ------------------------------------------------------------------------------- > t/weak.t ? ? 255 65280 ? ??? ? ?? ??? > 1 test skipped. > Failed 1/32 test scripts. 0/2190 subtests failed. > Files=32, Tests=2190, ?2 wallclock secs ( 2.10 cusr + ?0.31 csys = ?2.41 CPU) > Failed 1/32 test programs. 0/2190 subtests failed. > make: *** [test_dynamic] Error 255 > error: Bad exit status from /var/tmp/rpm-tmp.74452 (%build) > > > RPM build errors: > ? ?Bad exit status from /var/tmp/rpm-tmp.74452 (%build) > > When I run MailScanner -V I get: > > ?MailScanner -V > dualvar is only available with the XS version of Scalar::Util at /usr/lib/perl5/site_perl/5.8.8/Compress/Zlib.pm line 8 > BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/Compress/Zlib.pm line 8. > Compilation failed in require at /usr/lib/MailScanner/MailScanner/SA.pm line 42. > BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/SA.pm line 42. > Compilation failed in require at /usr/sbin/MailScanner line 110. > BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 110. > > AND: > > ?service MailScanner status > Checking MailScanner daemons: > ? ? ? ? MailScanner: ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?[FAILED] > ? ? ? ? incoming sendmail: head: cannot open `/var/run/sendmail.in.pid' for reading: No such file or directory > ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? [ ?OK ?] > ? ? ? ? outgoing sendmail: ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?[ ?OK ?] > > It is receiving and sending mail but I am not seeing anything about MailScanner in the logs so I assume it is not running. > > I appreciate all suggestions as to how to troubleshoot/repair this. > > Dave > > > > > > > -- > Professor > Seneca College > School of Media& ?Marketing > 70 The Pond Road > Toronto, On Canada > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Martin Hepworth Oxford, UK From submit at zuka.net Wed Jun 15 20:45:19 2011 From: submit at zuka.net (Dave Filchak) Date: Wed Jun 15 20:45:30 2011 Subject: errors after upgrade In-Reply-To: References: <4DF8DFAF.60405@senecac.on.ca> Message-ID: <4DF90BCF.4030508@zuka.net> On 6/15/2011 1:29 PM, Martin Hepworth wrote: > Looks like some of the underlying perl utils have upgraded maybe by the os > Try the install again and watch for any errors > > Martin > > On Wednesday, 15 June 2011, Dave Filchak wrote: >> I have recently taken over management of a server that I used to manage some time ago. The MailScanner install had not been upgraded in some time so I decided to upgrade to the latest version. First mistake I made was not checking the version BEFORE I ran the upgrade but the person who had been managing it said it had not been upgraded in a year or so. >> >> So, I installed the latest version and during the install, I get the following: >> >> BEGIN failed--compilation aborted at t/weak.t line 33. >> dubious >> Test returned status 255 (wstat 65280, 0xff00) >> Failed Test Stat Wstat Total Fail List of Failed >> ------------------------------------------------------------------------------- >> t/weak.t 255 65280 ?? ?? ?? >> 1 test skipped. >> Failed 1/32 test scripts. 0/2190 subtests failed. >> Files=32, Tests=2190, 2 wallclock secs ( 2.10 cusr + 0.31 csys = 2.41 CPU) >> Failed 1/32 test programs. 0/2190 subtests failed. >> make: *** [test_dynamic] Error 255 >> error: Bad exit status from /var/tmp/rpm-tmp.74452 (%build) >> >> >> RPM build errors: >> Bad exit status from /var/tmp/rpm-tmp.74452 (%build) >> >> When I run MailScanner -V I get: >> >> MailScanner -V >> dualvar is only available with the XS version of Scalar::Util at /usr/lib/perl5/site_perl/5.8.8/Compress/Zlib.pm line 8 >> BEGIN failed--compilation aborted at /usr/lib/perl5/site_perl/5.8.8/Compress/Zlib.pm line 8. >> Compilation failed in require at /usr/lib/MailScanner/MailScanner/SA.pm line 42. >> BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/SA.pm line 42. >> Compilation failed in require at /usr/sbin/MailScanner line 110. >> BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 110. >> >> AND: >> >> service MailScanner status >> Checking MailScanner daemons: >> MailScanner: [FAILED] >> incoming sendmail: head: cannot open `/var/run/sendmail.in.pid' for reading: No such file or directory >> [ OK ] >> outgoing sendmail: [ OK ] >> >> It is receiving and sending mail but I am not seeing anything about MailScanner in the logs so I assume it is not running. >> >> I appreciate all suggestions as to how to troubleshoot/repair this. >> >> Dave >> >> >> >> >> >> >> -- >> Professor >> Seneca College >> School of Media& Marketing >> 70 The Pond Road >> Toronto, On Canada >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! Tried installing again and here is all I can find for errors from the install.sh: t/weak................weaken is only available with the XS version of Scalar::Util at t/weak.t line 28 BEGIN failed--compilation aborted at t/weak.t line 33. dubious Test returned status 255 (wstat 65280, 0xff00) Failed Test Stat Wstat Total Fail List of Failed ------------------------------------------------------------------------------- t/weak.t 255 65280 ?? ?? ?? 1 test skipped. Failed 1/32 test scripts. 0/2190 subtests failed. Files=32, Tests=2190, 2 wallclock secs ( 2.10 cusr + 0.31 csys = 2.41 CPU) Failed 1/32 test programs. 0/2190 subtests failed. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.84732 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.84732 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-Storable-2.16-3.noarch.rpm. Maybe it did not build correctly? Just updated perl so we'll see what that does, if anything. Dave From mina.moussa at hotmail.com Thu Jun 16 01:45:15 2011 From: mina.moussa at hotmail.com (Mina Moussa) Date: Thu Jun 16 01:45:30 2011 Subject: Mailscanner corrupting docx and xlsx fiiles Message-ID: Hi Guys, Mailscanner is corrupting docx and xlxs files attatched to emails, whenever I bypass mailscanner and just use exchange <-> exchange, or postfix<->exchange, everything works fine. version 4.74.16 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/a89cb439/attachment.html From maxsec at gmail.com Thu Jun 16 08:34:53 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Jun 16 08:35:02 2011 Subject: Mailscanner corrupting docx and xlsx fiiles In-Reply-To: References: Message-ID: There's been a few fixes for these files in the almost 2.5 years since 4.74 was released. I'd start by upgrading to the latest Version 4.83.5-1and see how that improves things. -- Martin Hepworth Oxford, UK On 16 June 2011 01:45, Mina Moussa wrote: > Hi Guys, > > Mailscanner is corrupting docx and xlxs files attatched to emails, whenever > I bypass mailscanner and just use exchange <-> exchange, or > postfix<->exchange, everything works fine. > > version 4.74.16 > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/84b0ed79/attachment.html From maxsec at gmail.com Thu Jun 16 08:41:26 2011 From: maxsec at gmail.com (maxsec@gmail.com) Date: Thu Jun 16 08:41:37 2011 Subject: maxsec@gmail.com sent you a link to content of interest Message-ID: <90e6ba613ce08076dc04a5cf6502@google.com> maxsec@gmail.com sent you a link to the following content: ClamAV 0.97.1 is now available http://blog.clamav.net/2011/06/clamav-0971-is-now-available.html The sender also included this note: Don't recall seeing this on the list you FYI Also Jules you clamav/sa package needs upgrading as well -- Sent via a FeedFlare link from a FeedBurner feed. http://www.google.com/support/feedburner/bin/answer.py?answer=78966&topic=13246 From uxbod at splatnix.net Thu Jun 16 10:55:21 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Thu Jun 16 10:55:39 2011 Subject: MailScanner and ZendTo Message-ID: Hello all, I have been tasked with writing a custom function to integrate MailScanner with ZendTo and looking for a little bit of help with anybody who knows the MailScanner internals. I thought about using something like "Always Looked Up Last" though that is called whether the message is deleted or not. Therefore I believe it will have to be a complete new option with MailScanner but wondering at what point the attachment should be stripped and replaced with the ZendTo URL and key. I guess after virii scanning would be the most obvious so would like to ask which piece of code would be best to start looking at please to inject a new function ? -- Thanks, Phil -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/73a110ce/attachment.html From prandal at herefordshire.gov.uk Thu Jun 16 11:10:38 2011 From: prandal at herefordshire.gov.uk (Randal, Phil) Date: Thu Jun 16 11:11:07 2011 Subject: MailScanner and ZendTo In-Reply-To: References: Message-ID: <7CA580B59C1ABD45B4614ED90D4C7B853AD6A8B3@HC-EXMBX02.herefordshire.gov.uk> Fabulous idea, would make a good Ironport replacement. Will the code be released publically? Cheers, Phil -- Phil Randal | Infrastructure Engineer NHS Herefordshire & Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel: 01432 260160 From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[ UxBoD ]-- Sent: 16 June 2011 10:55 To: MailScanner discussion Subject: MailScanner and ZendTo Hello all, I have been tasked with writing a custom function to integrate MailScanner with ZendTo and looking for a little bit of help with anybody who knows the MailScanner internals. I thought about using something like "Always Looked Up Last" though that is called whether the message is deleted or not. Therefore I believe it will have to be a complete new option with MailScanner but wondering at what point the attachment should be stripped and replaced with the ZendTo URL and key. I guess after virii scanning would be the most obvious so would like to ask which piece of code would be best to start looking at please to inject a new function ? -- Thanks, Phil Any opinion expressed in this e-mail or any attached files are those of the individual and not necessarily those of Herefordshire Council. You should be aware that Herefordshire Council monitors its email service. This e-mail and any attached files are confidential and intended solely for the use of the addressee. This communication may contain material protected by law from being passed on. If you are not the intended recipient and have received this e-mail in error, you are advised that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please contact the sender immediately and destroy all copies of it. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/e189d06e/attachment.html From uxbod at splatnix.net Thu Jun 16 12:20:38 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Thu Jun 16 12:20:58 2011 Subject: MailScanner and ZendTo In-Reply-To: <7CA580B59C1ABD45B4614ED90D4C7B853AD6A8B3@HC-EXMBX02.herefordshire.gov.uk> Message-ID: <037003c3-0e29-4da3-9df4-e38803654af5@office.splatnix.net> ----- Original Message ----- > Fabulous idea, would make a good Ironport replacement. > Will the code be released publically? > Cheers, > Phil > -- > Phil Randal | Infrastructure Engineer > NHS Herefordshire & Herefordshire Council | Deputy Chief Executive's > Office | I.C.T. Services Division > Thorn Office Centre, Rotherwas, Hereford, HR2 6JT > Tel: 01432 260160 > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of --[ > UxBoD ]-- > Sent: 16 June 2011 10:55 > To: MailScanner discussion > Subject: MailScanner and ZendTo > Hello all, > I have been tasked with writing a custom function to integrate > MailScanner with ZendTo and looking for a little bit of help with > anybody who knows the MailScanner internals. I thought about using > something like "Always Looked Up Last" though that is called whether > the message is deleted or not. Therefore I believe it will have to > be a complete new option with MailScanner but wondering at what > point the attachment should be stripped and replaced with the ZendTo > URL and key. I guess after virii scanning would be the most obvious > so would like to ask which piece of code would be best to start > looking at please to inject a new function ? Hi Phil, I am of the understanding that the code will be contributed back to the community; like all good code :) -- Thanks, Phil From duval.rick at gmail.com Thu Jun 16 13:43:07 2011 From: duval.rick at gmail.com (Rick Duval) Date: Thu Jun 16 13:43:16 2011 Subject: Cannot find Socket (/tmp/clamd.socket) Exiting! Message-ID: Cannot find Socket (/tmp/clamd.socket) Exiting! I keep getting this message in /var/log/maillog. Anybody know how to fix this? Thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/dd575782/attachment.html From jwithrow at matech.net Thu Jun 16 13:45:54 2011 From: jwithrow at matech.net (Joshua F. Withrow) Date: Thu Jun 16 13:46:51 2011 Subject: Cannot find Socket (/tmp/clamd.socket) Exiting! In-Reply-To: References: Message-ID: Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: image001.jpg Type: image/jpeg Size: 7337 bytes Desc: image001.jpg Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/928cf37e/image001.jpg From s.oreilly at linnovations.co.uk Thu Jun 16 13:54:45 2011 From: s.oreilly at linnovations.co.uk (s.oreilly) Date: Thu Jun 16 13:54:56 2011 Subject: Cannot find Socket (/tmp/clamd.socket) Exiting! Message-ID: <13426.1308228885@linnovations.co.uk> Is clamd running? On Thu 16/06/11 2:43 PM , Rick Duval duval.rick@gmail.com sent: Cannot find Socket (/tmp/clamd.socket) Exiting! I keep getting this message in /var/log/maillog. Anybody know how to fix this? Thanks -- MailScanner mailing list mailscanner@lists.mailscanner.info [1] http://lists.mailscanner.info/mailman/listinfo/mailscanner [2]">http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting [3]">http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! Links: ------ [1] mailto:mailscanner@lists.mailscanner.info [2] http://lists.mailscanner.info/mailman/listinfo/mailscanner [3] http://wiki.mailscanner.info/posting -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/d950225a/attachment.html From maxsec at gmail.com Thu Jun 16 14:05:26 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Jun 16 14:05:35 2011 Subject: Cannot find Socket (/tmp/clamd.socket) Exiting! In-Reply-To: References: Message-ID: also check the socket definition is consistent between MailScanner.comf and clamd.conf -- Martin Hepworth Oxford, UK On 16 June 2011 13:43, Rick Duval wrote: > Cannot find Socket (/tmp/clamd.socket) Exiting! > > I keep getting this message in /var/log/maillog. > > Anybody know how to fix this? > > Thanks > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/3483d693/attachment.html From dyioulos at firstbhph.com Thu Jun 16 14:41:43 2011 From: dyioulos at firstbhph.com (Dimitri Yioulos) Date: Thu Jun 16 14:42:25 2011 Subject: BitDefender error Message-ID: <201106160941.44170.dyioulos@firstbhph.com> All, We're provisioning a new mail server and are, of course, going to use MailScanner. Along with the latest version of MS, we've also installed the latest Sendmail, SA, ClamAV, and Sophos, BitDefender-Console-Antivirus-7.1-3, and Mailwatch 1.4, on a CentOS 5.6 box. Thus far, everything has gone well and, under test conditions, almost everything works just fine. I do get this error, though, when running "MailScanner --lint": /usr/lib/MailScanner/bitdefender-wrapper: line 63: 13099 Segmentation fault ${PackageDir}/$prog --log=$LogFile $extras "$@" > /dev/null 2>&1 This error did not occur on the initial installation of BitDefender, but began after the first update of the signature files. (We're using BitDefender on our production system, set up almost exactly the same as described above, without problem). I realize that we could let BitDefender go, but another layer of defense can't be bad, so we're trying to hang on to it. Has anybody run into this problem and/or can offer a solution? Thanks. Dimitri -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ssilva at sgvwater.com Thu Jun 16 15:49:09 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Jun 16 15:49:40 2011 Subject: BitDefender error In-Reply-To: <201106160941.44170.dyioulos@firstbhph.com> References: <201106160941.44170.dyioulos@firstbhph.com> Message-ID: on 6/16/2011 6:41 AM Dimitri Yioulos spake the following: > All, > > We're provisioning a new mail server and are, of course, going to > use MailScanner. Along with the latest version of MS, we've also > installed the latest Sendmail, SA, ClamAV, and Sophos, > BitDefender-Console-Antivirus-7.1-3, and Mailwatch 1.4, on a > CentOS 5.6 box. Thus far, everything has gone well and, under > test conditions, almost everything works just fine. I do get > this error, though, when running "MailScanner --lint": > > /usr/lib/MailScanner/bitdefender-wrapper: line 63: 13099 > Segmentation fault ${PackageDir}/$prog --log=$LogFile > $extras "$@" > /dev/null 2>&1 > > This error did not occur on the initial installation of > BitDefender, but began after the first update of the signature > files. (We're using BitDefender on our production system, set up > almost exactly the same as described above, without problem). > > I realize that we could let BitDefender go, but another layer of > defense can't be bad, so we're trying to hang on to it. Has > anybody run into this problem and/or can offer a solution? > > Thanks. > > Dimitri > I had to dump bitdefender over a year ago. It doesn't seem to be supported by the newer signatures very well, segfaulted constantly, and hadn't caught anything for over a year before that. From dyioulos at firstbhph.com Thu Jun 16 16:14:37 2011 From: dyioulos at firstbhph.com (Dimitri Yioulos) Date: Thu Jun 16 16:15:14 2011 Subject: BitDefender error In-Reply-To: References: <201106160941.44170.dyioulos@firstbhph.com> Message-ID: <201106161114.37762.dyioulos@firstbhph.com> On Thursday 16 June 2011 10:49:09 am Scott Silva wrote: > on 6/16/2011 6:41 AM Dimitri Yioulos spake the following: > > All, > > > > We're provisioning a new mail server and are, of course, > > going to use MailScanner. Along with the latest version of > > MS, we've also installed the latest Sendmail, SA, ClamAV, and > > Sophos, BitDefender-Console-Antivirus-7.1-3, and Mailwatch > > 1.4, on a CentOS 5.6 box. Thus far, everything has gone well > > and, under test conditions, almost everything works just > > fine. I do get this error, though, when running "MailScanner > > --lint": > > > > /usr/lib/MailScanner/bitdefender-wrapper: line 63: 13099 > > Segmentation fault ${PackageDir}/$prog --log=$LogFile > > $extras "$@" > /dev/null 2>&1 > > > > This error did not occur on the initial installation of > > BitDefender, but began after the first update of the > > signature files. (We're using BitDefender on our production > > system, set up almost exactly the same as described above, > > without problem). > > > > I realize that we could let BitDefender go, but another layer > > of defense can't be bad, so we're trying to hang on to it. > > Has anybody run into this problem and/or can offer a > > solution? > > > > Thanks. > > > > Dimitri > > I had to dump bitdefender over a year ago. It doesn't seem to > be supported by the newer signatures very well, segfaulted > constantly, and hadn't caught anything for over a year before > that. > :-( Thanks, Scott. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From AHKAPLAN at PARTNERS.ORG Thu Jun 16 16:44:42 2011 From: AHKAPLAN at PARTNERS.ORG (Kaplan, Andrew H.) Date: Thu Jun 16 16:44:54 2011 Subject: MailScanner not starting error Message-ID: Hi there -- We are running MailScanner 4.83.4-1 on a CentOS 5.6 64-bit distribution. The status of MailScanner was checked hourly via the check_mailscanner script, and normally the e-mailed result was 'Starting MailScanner...' which indicated the process was running without issue. The server in question sits outside the company firewall, and was configured to deliver e-mail messages directly to their intended recipients. Our company recently changed its policy concerning external e-mail servers to require them to send their e-mails to their destinations via an e-mail gateway server. Consequently, the server was reconfigured to relay its messages to the gateway, and is no longer delivering messages directly to their recipients. When the change was made, I noticed the check_mailscanner script was sending a new message which read as follows: 'Starting MailScanner...failed' I have tried starting and restarting the MailScanner software via the /etc/init.d/MailScanner script. The output of the script seems to indicate that MailScanner starts, but a subsequent check for the application via the ps -ef |grep MailScanner command shows the command is not running. I checked the /var/log/maillog file for any reference to this when I did the restart of MailScanner, and the excerpt shown below coincides with the time that I ran the script: Jun 16 11:42:53 hadron sendmail[17895]: alias database /etc/aliases rebuilt by ahk Jun 16 11:42:53 hadron sendmail[17895]: /etc/aliases: 104 aliases, longest 29 bytes, 1526 bytes total Jun 16 11:42:53 hadron sendmail[17903]: starting daemon (8.13.8): SMTP Jun 16 11:42:53 hadron sendmail[17903]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Jun 16 11:42:53 hadron sendmail[17903]: daemon MTA: problem creating SMTP socket Jun 16 11:42:53 hadron sm-msp-queue[17907]: starting daemon (8.13.8): queueing@00:15:00 Jun 16 11:42:53 hadron sendmail[17911]: starting daemon (8.13.8): queueing@00:15:00 Jun 16 11:42:58 hadron sendmail[17903]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Jun 16 11:42:58 hadron sendmail[17903]: daemon MTA: problem creating SMTP socket I am not sure if this is the source of the problem, please excuse my ignorance if it is, or if there is something else at fault here. Can someone lend a hand on this? Thanks. The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/ec7b5df8/attachment.html From ssilva at sgvwater.com Thu Jun 16 16:52:45 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Jun 16 16:53:16 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: on 6/16/2011 8:44 AM Kaplan, Andrew H. spake the following: > Hi there -- > > We are running MailScanner 4.83.4-1 on a CentOS 5.6 64-bit distribution. The > status of MailScanner was checked hourly via the > > check_mailscanner script, and normally the e-mailed result was 'Starting > MailScanner?' which indicated the process was running > > without issue. > > The server in question sits outside the company firewall, and was configured > to deliver e-mail messages directly to their intended > > recipients. Our company recently changed its policy concerning external e-mail > servers to require them to send their e-mails to > > their destinations via an e-mail gateway server. Consequently, the server was > reconfigured to relay its messages to the gateway, > > and is no longer delivering messages directly to their recipients. > > When the change was made, I noticed the check_mailscanner script was sending a > new message which read as follows: > > 'Starting MailScanner?failed' > > I have tried starting and restarting the MailScanner software via the > /etc/init.d/MailScanner script. The output of the script > > seems to indicate that MailScanner starts, but a subsequent check for the > application via the ps -ef |grep MailScanner command > > shows the command is not running. > > I checked the /var/log/maillog file for any reference to this when I did the > restart of MailScanner, and the excerpt shown below > > coincides with the time that I ran the script: > > Jun 16 11:42:53 hadron sendmail[17895]: alias database /etc/aliases rebuilt by > ahk > Jun 16 11:42:53 hadron sendmail[17895]: /etc/aliases: 104 aliases, longest 29 > bytes, 1526 bytes total > Jun 16 11:42:53 hadron sendmail[17903]: starting daemon (8.13.8): SMTP > Jun 16 11:42:53 hadron sendmail[17903]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > > Jun 16 11:42:53 hadron sendmail[17903]: daemon MTA: problem creating SMTP socket > Jun 16 11:42:53 hadron sm-msp-queue[17907]: starting daemon (8.13.8): > queueing@00:15:00 > Jun 16 11:42:53 hadron sendmail[17911]: starting daemon (8.13.8): > queueing@00:15:00 > Jun 16 11:42:58 hadron sendmail[17903]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > > Jun 16 11:42:58 hadron sendmail[17903]: daemon MTA: problem creating SMTP socket > > I am not sure if this is the source of the problem, please excuse my ignorance > if it is, or if there is something else at fault here. > > Can someone lend a hand on this? > > Thanks. Either your MTA is not restarting, or something else has taken the port that your MTA is trying to bind to. Check your MTA config files for typos since you stated you just made changes to it... From bonivart at opencsw.org Thu Jun 16 17:12:57 2011 From: bonivart at opencsw.org (Peter Bonivart) Date: Thu Jun 16 17:13:28 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: On Thu, Jun 16, 2011 at 5:44 PM, Kaplan, Andrew H. wrote: > Jun 16 11:42:53 hadron sendmail[17895]: alias database /etc/aliases rebuilt > by ahk > Jun 16 11:42:53 hadron sendmail[17895]: /etc/aliases: 104 aliases, longest > 29 bytes, 1526 bytes total > Jun 16 11:42:53 hadron sendmail[17903]: starting daemon (8.13.8): SMTP > Jun 16 11:42:53 hadron sendmail[17903]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > > Jun 16 11:42:53 hadron sendmail[17903]: daemon MTA: problem creating SMTP > socket > Jun 16 11:42:53 hadron sm-msp-queue[17907]: starting daemon (8.13.8): > queueing@00:15:00 > Jun 16 11:42:53 hadron sendmail[17911]: starting daemon (8.13.8): > queueing@00:15:00 > Jun 16 11:42:58 hadron sendmail[17903]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > > Jun 16 11:42:58 hadron sendmail[17903]: daemon MTA: problem creating SMTP > socket Check if sendmail is already running: # ps -ef | grep sendmail See what services you have for mail: # chkconfig --list | grep -i mail MailScanner 0:off 1:off 2:on 3:on 4:on 5:on 6:off sendmail 0:off 1:off 2:off 3:off 4:off 5:off 6:off Chances are that the system sendmail is also on, if so: # chkconfig sendmail off # service sendmail stop /peter From AHKAPLAN at PARTNERS.ORG Thu Jun 16 18:34:21 2011 From: AHKAPLAN at PARTNERS.ORG (Kaplan, Andrew H.) Date: Thu Jun 16 18:34:35 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: Hi there -- I checked the sendmail.mc file, and I verified there was only one reference to the mail gateway server, as well as the correct spelling being in place for it. I have included the sendmail.cf file with this e-mail as reference. The netstat -a command indicated the following for the smtp port: tcp 0 0 *:smtp *:* LISTEN The system runs dovecot as its pop3 server, and the netstat entries there are the following: tcp 0 0 *:pop3s *:* LISTEN tcp 0 0 *:pop3 *:* LISTEN tcp 0 0 *:imap *:* LISTEN The MTA, sendmail, is restarting apparent without issue. This is proven by the following readout of the ps -ef |grep sendmail command: root 21516 1 0 13:22 ? 00:00:00 sendmail: accepting connections smmsp 21520 1 0 13:22 ? 00:00:00 sendmail: Queue runner@00:15:00 for /var/spool/clientmqueue root 21524 1 0 13:22 ? 00:00:00 sendmail: Queue runner@00:15:00 for /var/spool/mqueue -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Scott Silva Sent: Thursday, June 16, 2011 11:53 AM To: mailscanner@lists.mailscanner.info Subject: Re: MailScanner not starting error on 6/16/2011 8:44 AM Kaplan, Andrew H. spake the following: > Hi there -- > > We are running MailScanner 4.83.4-1 on a CentOS 5.6 64-bit distribution. The > status of MailScanner was checked hourly via the > > check_mailscanner script, and normally the e-mailed result was 'Starting > MailScanner...' which indicated the process was running > > without issue. > > The server in question sits outside the company firewall, and was configured > to deliver e-mail messages directly to their intended > > recipients. Our company recently changed its policy concerning external e-mail > servers to require them to send their e-mails to > > their destinations via an e-mail gateway server. Consequently, the server was > reconfigured to relay its messages to the gateway, > > and is no longer delivering messages directly to their recipients. > > When the change was made, I noticed the check_mailscanner script was sending a > new message which read as follows: > > 'Starting MailScanner...failed' > > I have tried starting and restarting the MailScanner software via the > /etc/init.d/MailScanner script. The output of the script > > seems to indicate that MailScanner starts, but a subsequent check for the > application via the ps -ef |grep MailScanner command > > shows the command is not running. > > I checked the /var/log/maillog file for any reference to this when I did the > restart of MailScanner, and the excerpt shown below > > coincides with the time that I ran the script: > > Jun 16 11:42:53 hadron sendmail[17895]: alias database /etc/aliases rebuilt by > ahk > Jun 16 11:42:53 hadron sendmail[17895]: /etc/aliases: 104 aliases, longest 29 > bytes, 1526 bytes total > Jun 16 11:42:53 hadron sendmail[17903]: starting daemon (8.13.8): SMTP > Jun 16 11:42:53 hadron sendmail[17903]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > > Jun 16 11:42:53 hadron sendmail[17903]: daemon MTA: problem creating SMTP socket > Jun 16 11:42:53 hadron sm-msp-queue[17907]: starting daemon (8.13.8): > queueing@00:15:00 > Jun 16 11:42:53 hadron sendmail[17911]: starting daemon (8.13.8): > queueing@00:15:00 > Jun 16 11:42:58 hadron sendmail[17903]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > > Jun 16 11:42:58 hadron sendmail[17903]: daemon MTA: problem creating SMTP socket > > I am not sure if this is the source of the problem, please excuse my ignorance > if it is, or if there is something else at fault here. > > Can someone lend a hand on this? > > Thanks. Either your MTA is not restarting, or something else has taken the port that your MTA is trying to bind to. Check your MTA config files for typos since you stated you just made changes to it... -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail. -------------- next part -------------- A non-text attachment was scrubbed... Name: sendmail.cf Type: application/octet-stream Size: 58266 bytes Desc: sendmail.cf Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110616/e5a685bf/sendmail-0001.obj From ssilva at sgvwater.com Thu Jun 16 18:47:38 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Jun 16 18:48:04 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: on 6/16/2011 10:34 AM Kaplan, Andrew H. spake the following: > Hi there -- > > I checked the sendmail.mc file, and I verified there was only one reference to > the mail gateway server, > as well as the correct spelling being in place for it. I have included the > sendmail.cf file with this > e-mail as reference. > > The netstat -a command indicated the following for the smtp port: > > tcp 0 0 *:smtp *:* > LISTEN > > The system runs dovecot as its pop3 server, and the netstat entries there are > the following: > > tcp 0 0 *:pop3s *:* > LISTEN > tcp 0 0 *:pop3 *:* > LISTEN > tcp 0 0 *:imap *:* > LISTEN > > The MTA, sendmail, is restarting apparent without issue. This is proven by the > following readout > of the ps -ef |grep sendmail command: > > root 21516 1 0 13:22 ? 00:00:00 sendmail: accepting connections > > smmsp 21520 1 0 13:22 ? 00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/clientmqueue > root 21524 1 0 13:22 ? 00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/mqueue > Can the box actually resolve phsmgout.partners.org? Also... try stopping mailscanner then doing a killall sendmail to see if a queue runner is zombied and not catching the HUP. From AHKAPLAN at PARTNERS.ORG Thu Jun 16 19:21:59 2011 From: AHKAPLAN at PARTNERS.ORG (Kaplan, Andrew H.) Date: Thu Jun 16 19:22:11 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: Hi there -- I ran the nslookup command on the server, and it was able to resolve the phsmgout.partners.org hostname. After that I stopped MailScanner via the /etc/init.d/MailScanner script, and followed up with the killall sendmail command. When I ran the ps -ef command immediately thereafter, I observed two defunct sendmail processes. After I restarted MailScanner, the two defunct processes were still present along with two 'regular' sendmail processes. The first of the two defunct processes disappeared after ten minutes, while the second one as of this e-mail continues to exist. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Scott Silva Sent: Thursday, June 16, 2011 1:48 PM To: mailscanner@lists.mailscanner.info Subject: Re: MailScanner not starting error on 6/16/2011 10:34 AM Kaplan, Andrew H. spake the following: > Hi there -- > > I checked the sendmail.mc file, and I verified there was only one reference to > the mail gateway server, > as well as the correct spelling being in place for it. I have included the > sendmail.cf file with this > e-mail as reference. > > The netstat -a command indicated the following for the smtp port: > > tcp 0 0 *:smtp *:* > LISTEN > > The system runs dovecot as its pop3 server, and the netstat entries there are > the following: > > tcp 0 0 *:pop3s *:* > LISTEN > tcp 0 0 *:pop3 *:* > LISTEN > tcp 0 0 *:imap *:* > LISTEN > > The MTA, sendmail, is restarting apparent without issue. This is proven by the > following readout > of the ps -ef |grep sendmail command: > > root 21516 1 0 13:22 ? 00:00:00 sendmail: accepting connections > > smmsp 21520 1 0 13:22 ? 00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/clientmqueue > root 21524 1 0 13:22 ? 00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/mqueue > Can the box actually resolve phsmgout.partners.org? Also... try stopping mailscanner then doing a killall sendmail to see if a queue runner is zombied and not catching the HUP. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail. From axisml at gmail.com Thu Jun 16 20:10:36 2011 From: axisml at gmail.com (Chris Stone) Date: Thu Jun 16 20:10:46 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: Andrew, On Thu, Jun 16, 2011 at 12:21 PM, Kaplan, Andrew H. wrote: > I ran the nslookup command on the server, and it was able to resolve the > phsmgout.partners.org hostname. After that I stopped MailScanner via the > /etc/init.d/MailScanner script, and followed up with the killall sendmail > command. When I ran the ps -ef command immediately thereafter, I observed > two defunct sendmail processes. > > After I restarted MailScanner, the two defunct processes were still present > along with two 'regular' sendmail processes. The first of the two defunct > processes disappeared after ten minutes, while the second one as of this > e-mail continues to exist. Try running: service MailScanner stop service sendmail stop chkconfig MailScanner on chkconfig sendmail off killall -TERM sendmail service MailScanner start The MailScanner init script starts sendmail for you, so you need to make sure the the 'normal' sendmail init script is disabled. The above commands should do that all for you and after the last, you should then see MailScanner (with sendmail) starting up successfully. Chris From AHKAPLAN at PARTNERS.ORG Thu Jun 16 20:31:25 2011 From: AHKAPLAN at PARTNERS.ORG (Kaplan, Andrew H.) Date: Thu Jun 16 20:31:38 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: Hi there -- I ran the commands listed in your e-mail, and for good measure I confirmed that sendmail was not configured to start on system boot. After that, I did reboot the server. After the server came up I checked for an instance of MailScanner running, and there was none. When I ran the MailScanner script with the status option, MailScanner continued to appear as failed. As far as running sendmail processes are concerned, here is a listing of them: root 2828 1 0 15:26 ? 00:00:00 sendmail: accepting connections smmsp 2832 1 0 15:26 ? 00:00:00 sendmail: Queue runner@00:15:00 for /var/spool/clientmqueue root 2836 1 0 15:26 ? 00:00:00 sendmail: Queue runner@00:15:00 for /var/spool/mqueue -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Chris Stone Sent: Thursday, June 16, 2011 3:11 PM To: MailScanner discussion Subject: Re: MailScanner not starting error Andrew, On Thu, Jun 16, 2011 at 12:21 PM, Kaplan, Andrew H. wrote: > I ran the nslookup command on the server, and it was able to resolve the > phsmgout.partners.org hostname. After that I stopped MailScanner via the > /etc/init.d/MailScanner script, and followed up with the killall sendmail > command. When I ran the ps -ef command immediately thereafter, I observed > two defunct sendmail processes. > > After I restarted MailScanner, the two defunct processes were still present > along with two 'regular' sendmail processes. The first of the two defunct > processes disappeared after ten minutes, while the second one as of this > e-mail continues to exist. Try running: service MailScanner stop service sendmail stop chkconfig MailScanner on chkconfig sendmail off killall -TERM sendmail service MailScanner start The MailScanner init script starts sendmail for you, so you need to make sure the the 'normal' sendmail init script is disabled. The above commands should do that all for you and after the last, you should then see MailScanner (with sendmail) starting up successfully. Chris -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail. From maxsec at gmail.com Thu Jun 16 20:47:58 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Jun 16 20:48:10 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: And what does Mailscanner --debug Give you?? On Thursday, 16 June 2011, Kaplan, Andrew H. wrote: > Hi there -- > > I ran the commands listed in your e-mail, and for good measure I confirmed > that sendmail was not configured to start on system boot. After that, I did > reboot the server. > > After the server came up I checked for an instance of MailScanner running, > and there was none. When I ran the MailScanner script with the status option, > MailScanner continued to appear as failed. > > As far as running sendmail processes are concerned, here is a listing of them: > > root ? ? ?2828 ? ? 1 ?0 15:26 ? ? ? ? ?00:00:00 sendmail: accepting connections > > smmsp ? ? 2832 ? ? 1 ?0 15:26 ? ? ? ? ?00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/clientmqueue > root ? ? ?2836 ? ? 1 ?0 15:26 ? ? ? ? ?00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/mqueue > > > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Chris Stone > Sent: Thursday, June 16, 2011 3:11 PM > To: MailScanner discussion > Subject: Re: MailScanner not starting error > > Andrew, > > On Thu, Jun 16, 2011 at 12:21 PM, Kaplan, Andrew H. > wrote: >> I ran the nslookup command on the server, and it was able to resolve the >> phsmgout.partners.org hostname. After that I stopped MailScanner via the >> /etc/init.d/MailScanner script, and followed up with the killall sendmail >> command. When I ran the ps -ef command immediately thereafter, I observed >> two defunct sendmail processes. >> >> After I restarted MailScanner, the two defunct processes were still present >> along with two 'regular' sendmail processes. The first of the two defunct >> processes disappeared after ten minutes, while the second one as of this >> e-mail continues to exist. > > Try running: > > service MailScanner stop > service sendmail stop > chkconfig MailScanner on > chkconfig sendmail off > killall -TERM sendmail > service MailScanner start > > The MailScanner init script starts sendmail for you, so you need to > make sure the the 'normal' sendmail init script is disabled. The above > commands should do that all for you and after the last, you should > then see MailScanner (with sendmail) starting up successfully. > > > Chris > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > The information in this e-mail is intended only for the person to whom it is > addressed. If you believe this e-mail was sent to you in error and the e-mail > contains patient information, please contact the Partners Compliance HelpLine at > http://www.partners.org/complianceline . If the e-mail was sent to you in error > but does not contain patient information, please contact the sender and properly > dispose of the e-mail. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Martin Hepworth Oxford, UK From steve at fsl.com Thu Jun 16 20:51:39 2011 From: steve at fsl.com (Stephen Swaney) Date: Thu Jun 16 20:51:49 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: On Jun 16, 2011, at 3:31 PM, Kaplan, Andrew H. wrote: > Hi there -- > > I ran the commands listed in your e-mail, and for good measure I confirmed > that sendmail was not configured to start on system boot. After that, I did > reboot the server. > > After the server came up I checked for an instance of MailScanner running, > and there was none. When I ran the MailScanner script with the status option, > MailScanner continued to appear as failed. > > As far as running sendmail processes are concerned, here is a listing of them: > > root 2828 1 0 15:26 ? 00:00:00 sendmail: accepting connections > > smmsp 2832 1 0 15:26 ? 00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/clientmqueue > root 2836 1 0 15:26 ? 00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/mqueue > > > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Chris Stone > Sent: Thursday, June 16, 2011 3:11 PM > To: MailScanner discussion > Subject: Re: MailScanner not starting error > > Andrew, > > On Thu, Jun 16, 2011 at 12:21 PM, Kaplan, Andrew H. > wrote: >> I ran the nslookup command on the server, and it was able to resolve the >> phsmgout.partners.org hostname. After that I stopped MailScanner via the >> /etc/init.d/MailScanner script, and followed up with the killall sendmail >> command. When I ran the ps -ef command immediately thereafter, I observed >> two defunct sendmail processes. >> >> After I restarted MailScanner, the two defunct processes were still present >> along with two 'regular' sendmail processes. The first of the two defunct >> processes disappeared after ten minutes, while the second one as of this >> e-mail continues to exist. > > Try running: > > service MailScanner stop > service sendmail stop > chkconfig MailScanner on > chkconfig sendmail off > killall -TERM sendmail > service MailScanner start > > The MailScanner init script starts sendmail for you, so you need to > make sure the the 'normal' sendmail init script is disabled. The above > commands should do that all for you and after the last, you should > then see MailScanner (with sendmail) starting up successfully. > > > Chris > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > The information in this e-mail is intended only for the person to whom it is > addressed. If you believe this e-mail was sent to you in error and the e-mail > contains patient information, please contact the Partners Compliance HelpLine at > http://www.partners.org/complianceline . If the e-mail was sent to you in error > but does not contain patient information, please contact the sender and properly > dispose of the e-mail. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! Stop all the processes again: service MailScanner stop service sendmail stop MailScanner on chkconfig sendmail off killall -TERM sendmail Then try running in one login session window: sh -x /etc/init/MailScanner start and in second login session window: tail -f /var/log/maillog and look for errors or problems. You should see something that will give you a clue to where things are going left. Best regards, Steve -- Steve Swaney steve@fsl.com www.fsl.com The most accurate and cost effective anti-spam solutions available From AHKAPLAN at PARTNERS.ORG Thu Jun 16 20:58:00 2011 From: AHKAPLAN at PARTNERS.ORG (Kaplan, Andrew H.) Date: Thu Jun 16 20:58:12 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: Hi there -- The output of the MailScanner --debug command is shown below, sorry if I did not think of this sooner: Can't locate MailScanner/MessageBatch.pm in @INC (@INC contains: /usr/lib/MailScanner /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/5.8.8 /usr/lib/MailScanner) at /usr/sbin/MailScanner line 103. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 103. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Martin Hepworth Sent: Thursday, June 16, 2011 3:48 PM To: MailScanner discussion Subject: Re: MailScanner not starting error And what does Mailscanner --debug Give you?? On Thursday, 16 June 2011, Kaplan, Andrew H. wrote: > Hi there -- > > I ran the commands listed in your e-mail, and for good measure I confirmed > that sendmail was not configured to start on system boot. After that, I did > reboot the server. > > After the server came up I checked for an instance of MailScanner running, > and there was none. When I ran the MailScanner script with the status option, > MailScanner continued to appear as failed. > > As far as running sendmail processes are concerned, here is a listing of them: > > root ? ? ?2828 ? ? 1 ?0 15:26 ? ? ? ? ?00:00:00 sendmail: accepting connections > > smmsp ? ? 2832 ? ? 1 ?0 15:26 ? ? ? ? ?00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/clientmqueue > root ? ? ?2836 ? ? 1 ?0 15:26 ? ? ? ? ?00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/mqueue > > > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Chris Stone > Sent: Thursday, June 16, 2011 3:11 PM > To: MailScanner discussion > Subject: Re: MailScanner not starting error > > Andrew, > > On Thu, Jun 16, 2011 at 12:21 PM, Kaplan, Andrew H. > wrote: >> I ran the nslookup command on the server, and it was able to resolve the >> phsmgout.partners.org hostname. After that I stopped MailScanner via the >> /etc/init.d/MailScanner script, and followed up with the killall sendmail >> command. When I ran the ps -ef command immediately thereafter, I observed >> two defunct sendmail processes. >> >> After I restarted MailScanner, the two defunct processes were still present >> along with two 'regular' sendmail processes. The first of the two defunct >> processes disappeared after ten minutes, while the second one as of this >> e-mail continues to exist. > > Try running: > > service MailScanner stop > service sendmail stop > chkconfig MailScanner on > chkconfig sendmail off > killall -TERM sendmail > service MailScanner start > > The MailScanner init script starts sendmail for you, so you need to > make sure the the 'normal' sendmail init script is disabled. The above > commands should do that all for you and after the last, you should > then see MailScanner (with sendmail) starting up successfully. > > > Chris > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > The information in this e-mail is intended only for the person to whom it is > addressed. If you believe this e-mail was sent to you in error and the e-mail > contains patient information, please contact the Partners Compliance HelpLine at > http://www.partners.org/complianceline . If the e-mail was sent to you in error > but does not contain patient information, please contact the sender and properly > dispose of the e-mail. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Martin Hepworth Oxford, UK -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From AHKAPLAN at PARTNERS.ORG Thu Jun 16 21:40:37 2011 From: AHKAPLAN at PARTNERS.ORG (Kaplan, Andrew H.) Date: Thu Jun 16 21:40:49 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: Hi there -- I ran the commands listed in the previous e-mail, with special attention paid to the sh -x and tail commands. The output of the maillog file is shown below: Jun 16 16:34:19 hadron sendmail[6594]: alias database /etc/aliases rebuilt by ahk Jun 16 16:34:19 hadron sendmail[6594]: /etc/aliases: 104 aliases, longest 29 bytes, 1526 bytes total Jun 16 16:34:19 hadron sendmail[6602]: starting daemon (8.13.8): SMTP Jun 16 16:34:19 hadron sm-msp-queue[6606]: starting daemon (8.13.8): queueing@00:15:00 Jun 16 16:34:19 hadron sendmail[6610]: starting daemon (8.13.8): queueing@00:15:00 There is no apparent error being listed here. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Stephen Swaney Sent: Thursday, June 16, 2011 3:52 PM To: MailScanner discussion Subject: Re: MailScanner not starting error On Jun 16, 2011, at 3:31 PM, Kaplan, Andrew H. wrote: > Hi there -- > > I ran the commands listed in your e-mail, and for good measure I confirmed > that sendmail was not configured to start on system boot. After that, I did > reboot the server. > > After the server came up I checked for an instance of MailScanner running, > and there was none. When I ran the MailScanner script with the status option, > MailScanner continued to appear as failed. > > As far as running sendmail processes are concerned, here is a listing of them: > > root 2828 1 0 15:26 ? 00:00:00 sendmail: accepting connections > > smmsp 2832 1 0 15:26 ? 00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/clientmqueue > root 2836 1 0 15:26 ? 00:00:00 sendmail: Queue runner@00:15:00 > for /var/spool/mqueue > > > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Chris Stone > Sent: Thursday, June 16, 2011 3:11 PM > To: MailScanner discussion > Subject: Re: MailScanner not starting error > > Andrew, > > On Thu, Jun 16, 2011 at 12:21 PM, Kaplan, Andrew H. > wrote: >> I ran the nslookup command on the server, and it was able to resolve the >> phsmgout.partners.org hostname. After that I stopped MailScanner via the >> /etc/init.d/MailScanner script, and followed up with the killall sendmail >> command. When I ran the ps -ef command immediately thereafter, I observed >> two defunct sendmail processes. >> >> After I restarted MailScanner, the two defunct processes were still present >> along with two 'regular' sendmail processes. The first of the two defunct >> processes disappeared after ten minutes, while the second one as of this >> e-mail continues to exist. > > Try running: > > service MailScanner stop > service sendmail stop > chkconfig MailScanner on > chkconfig sendmail off > killall -TERM sendmail > service MailScanner start > > The MailScanner init script starts sendmail for you, so you need to > make sure the the 'normal' sendmail init script is disabled. The above > commands should do that all for you and after the last, you should > then see MailScanner (with sendmail) starting up successfully. > > > Chris > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > The information in this e-mail is intended only for the person to whom it is > addressed. If you believe this e-mail was sent to you in error and the e-mail > contains patient information, please contact the Partners Compliance HelpLine at > http://www.partners.org/complianceline . If the e-mail was sent to you in error > but does not contain patient information, please contact the sender and properly > dispose of the e-mail. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! Stop all the processes again: service MailScanner stop service sendmail stop MailScanner on chkconfig sendmail off killall -TERM sendmail Then try running in one login session window: sh -x /etc/init/MailScanner start and in second login session window: tail -f /var/log/maillog and look for errors or problems. You should see something that will give you a clue to where things are going left. Best regards, Steve -- Steve Swaney steve@fsl.com www.fsl.com The most accurate and cost effective anti-spam solutions available -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From ssilva at sgvwater.com Thu Jun 16 21:50:47 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Jun 16 21:51:12 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: on 6/16/2011 12:58 PM Kaplan, Andrew H. spake the following: > Hi there -- > > The output of the MailScanner --debug command is shown below, > sorry if I did not think of this sooner: > > Can't locate MailScanner/MessageBatch.pm in @INC (@INC contains: > /usr/lib/MailScanner /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl > /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl > /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/5.8.8 > /usr/lib/MailScanner) at /usr/sbin/MailScanner line 103. > BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 103. > > That looks like a perl update clobbered MailScanner. Maybe a re-install is in order? From mina.moussa at hotmail.com Thu Jun 16 23:36:27 2011 From: mina.moussa at hotmail.com (Mina Moussa) Date: Thu Jun 16 23:36:39 2011 Subject: Mailscanner corrupting docx and xlsx fiiles In-Reply-To: References: , Message-ID: Thank you for the reply, has this been a reported issue though? Date: Thu, 16 Jun 2011 08:34:53 +0100 From: maxsec@gmail.com To: mailscanner@lists.mailscanner.info Subject: Re: Mailscanner corrupting docx and xlsx fiiles There's been a few fixes for these files in the almost 2.5 years since 4.74 was released. I'd start by upgrading to the latest Version 4.83.5-1 and see how that improves things. -- Martin Hepworth Oxford, UK On 16 June 2011 01:45, Mina Moussa wrote: Hi Guys, Mailscanner is corrupting docx and xlxs files attatched to emails, whenever I bypass mailscanner and just use exchange <-> exchange, or postfix<->exchange, everything works fine. version 4.74.16 -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110617/c754469d/attachment.html From mailscanner at pdscc.com Fri Jun 17 00:10:30 2011 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Fri Jun 17 00:10:54 2011 Subject: how to allow mobile user to send email with getting blocked Message-ID: <20110616231033.5EEFB5A1C81@sinclaire.sibble.net> Just wondering what you all suggest is the best way to deal with the following. Mailscanner machine at the enge of the network, internal imap mailserver, users with mobile phones connected via imaps to the internal server with various mail clients. SMTP Auth is in place for all users to send email. Approx 50% percent of the time, the users on one cell provider (Mobilicity) have their mail marked as spam and quarantined, generally users on Rogers, Fido, or Telus don't have the same problem or not to same extent, eg SpamAssassin Score: 4.42 Spam Report: Score Matching Rule Descriptioncached not score=4.423 4 required -2.60 BAYES_00 Bayesian spam probability is 0 to 1% -3.30 KHOP_DNSBL_ADJ -1.50 KHOP_THREADED 1.96 RCVD_IN_BL_SPAMCOP_NET Received via a relay in bl.spamcop.net 1.70 RCVD_IN_HOSTKARMA_BL 2.00 RCVD_IN_MSPIKE_BL 0.01 RCVD_IN_MSPIKE_L3 2.40 RCVD_IN_PSBL 0.62 RCVD_IN_SORBS_WEB SORBS: sender is a abuseable web server 3.03 RCVD_IN_XBL Received via a relay in Spamhaus XBL 0.10 RDNS_NONE Delivered to trusted network by a host with no rDNS I've considered client ssl certs but not all the devices/mail client apps support this so not really a solution? What would you suggest is the best way to keep their legitimate emails from being blocked by the mailscanner machine. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From alex at vidadigital.com.pa Fri Jun 17 04:52:05 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Fri Jun 17 04:52:21 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <20110616231033.5EEFB5A1C81@sinclaire.sibble.net> References: <20110616231033.5EEFB5A1C81@sinclaire.sibble.net> Message-ID: <0B6764E3-C724-426C-BAFE-B0A42DF3D82D@vidadigital.com.pa> This has been asked in the past, and I repeat my solution for the benefit of those who haven't had the opportunity to search the archives for a solution. If you're not using sendmail as your MTA you can try doing something like this on your own MTA similarly. My sendmail.mc has a line like this: define(`confRECEIVED_HEADER', `_REC_HDR_ _REC_FULL_AUTH_$?{auth_ssf} MYOWNTOKEN bits=${auth_ssf}$.) _REC_BY_ _REC_TLS_ _REC_END_')dnl Where "MYOWNTOKEN" is something not trivially guessable. Then in /etc/mail/spamassasin/local.cf I add: header MYOWNTOKEN ALL =~ /MYOWNTOKEN/ score MYOWNTOKEN -100 This way, everyone who *REALLY* authenticates in my server gets scored -100 and therefore it doesn't get flagged as spam. On Jun 16, 2011, at 6:10 PM, Harondel J. Sibble wrote: > Just wondering what you all suggest is the best way to deal with the > following. > > Mailscanner machine at the enge of the network, internal imap mailserver, > users with mobile phones connected via imaps to the internal server with > various mail clients. > > SMTP Auth is in place for all users to send email. > > Approx 50% percent of the time, the users on one cell provider (Mobilicity) > have their mail marked as spam and quarantined, generally users on Rogers, > Fido, or Telus don't have the same problem or not to same extent, eg > > SpamAssassin Score: 4.42 > Spam Report: > Score Matching Rule Descriptioncached not > score=4.423 > 4 required > -2.60 BAYES_00 Bayesian spam probability is 0 to 1% > -3.30 KHOP_DNSBL_ADJ > -1.50 KHOP_THREADED > 1.96 RCVD_IN_BL_SPAMCOP_NET Received via a relay in bl.spamcop.net > 1.70 RCVD_IN_HOSTKARMA_BL > 2.00 RCVD_IN_MSPIKE_BL > 0.01 RCVD_IN_MSPIKE_L3 > 2.40 RCVD_IN_PSBL > 0.62 RCVD_IN_SORBS_WEB SORBS: sender is a abuseable web server > 3.03 RCVD_IN_XBL Received via a relay in Spamhaus XBL > 0.10 RDNS_NONE Delivered to trusted network by a host with no rDNS > > I've considered client ssl certs but not all the devices/mail client apps > support this so not really a solution? > > What would you suggest is the best way to keep their legitimate emails from > being blocked by the mailscanner machine. > > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Skype: alexneuman BB PIN 20EA17C5 Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From maxsec at gmail.com Fri Jun 17 06:30:05 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Jun 17 06:30:15 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <0B6764E3-C724-426C-BAFE-B0A42DF3D82D@vidadigital.com.pa> References: <20110616231033.5EEFB5A1C81@sinclaire.sibble.net> <0B6764E3-C724-426C-BAFE-B0A42DF3D82D@vidadigital.com.pa> Message-ID: I would have a sendmail listening on a different other than 25 and have this be trusted with passwords etc. This can route without mailscanner ( or a less restrictive setup eg no SA being called ) It's fairly common these days for the outgoing mta for clients to be on something other than Port 25 Martin On Friday, 17 June 2011, Alex Neuman wrote: > This has been asked in the past, and I repeat my solution for the benefit of those who haven't had the opportunity to search the archives for a solution. > > If you're not using sendmail as your MTA you can try doing something like this on your own MTA similarly. > > My sendmail.mc has a line like this: > > define(`confRECEIVED_HEADER', `_REC_HDR_ > ? ? ? ?_REC_FULL_AUTH_$?{auth_ssf} MYOWNTOKEN bits=${auth_ssf}$.) > ? ? ? ?_REC_BY_ > ? ? ? ?_REC_TLS_ > ? ? ? ?_REC_END_')dnl > > Where "MYOWNTOKEN" is something not trivially guessable. > > > Then in /etc/mail/spamassasin/local.cf I add: > > header MYOWNTOKEN ALL =~ /MYOWNTOKEN/ > score MYOWNTOKEN -100 > > This way, everyone who *REALLY* authenticates in my server gets scored -100 and therefore it doesn't get flagged as spam. > > On Jun 16, 2011, at 6:10 PM, Harondel J. Sibble wrote: > >> Just wondering what you all suggest is the best way to deal with the >> following. >> >> Mailscanner machine at the enge of the network, internal imap mailserver, >> users with mobile phones connected via imaps to the internal server with >> various mail clients. >> >> SMTP Auth is in place for all users to send email. >> >> Approx 50% percent of the time, the users on one cell provider (Mobilicity) >> have their mail marked as spam and quarantined, generally users on Rogers, >> Fido, or Telus don't have the same problem or not to same extent, eg >> >> SpamAssassin Score: ? 4.42 >> Spam Report: >> ? ? ? Score ? Matching Rule ? Descriptioncached ? ? ? not >> ? ? ? score=4.423 >> 4 ? ? required >> -2.60 BAYES_00 ? ? ? ?Bayesian spam probability is 0 to 1% >> -3.30 KHOP_DNSBL_ADJ >> -1.50 KHOP_THREADED >> 1.96 ?RCVD_IN_BL_SPAMCOP_NET ?Received via a relay in bl.spamcop.net >> 1.70 ?RCVD_IN_HOSTKARMA_BL >> 2.00 ?RCVD_IN_MSPIKE_BL >> 0.01 ?RCVD_IN_MSPIKE_L3 >> 2.40 ?RCVD_IN_PSBL >> 0.62 ?RCVD_IN_SORBS_WEB ? ? ? SORBS: sender is a abuseable web server >> 3.03 ?RCVD_IN_XBL ? ? Received via a relay in Spamhaus XBL >> 0.10 ?RDNS_NONE ? ? ? Delivered to trusted network by a host with no rDNS >> >> I've considered client ssl certs but not all the devices/mail client apps >> support this so not really a solution? >> >> What would you suggest is the best way to keep their legitimate emails from >> being blocked by the mailscanner machine. >> >> >> -- >> Harondel J. Sibble >> Sibble Computer Consulting >> Creating Solutions for the small and medium business computer user. >> help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com >> Blog: http://www.pdscc.com/blog >> (604) 739-3709 (voice) >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > -- > > Alex Neuman van der Hans > Reliant Technologies / Vida Digital > http://vidadigital.com.pa/ > > +507-6781-9505 > +507-832-6725 > +1-440-253-9789 (USA) > Skype: alexneuman > BB PIN 20EA17C5 > > > Follow @AlexNeuman on Twitter > http://facebook.com/vidadigital > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Martin Hepworth Oxford, UK From maxsec at gmail.com Fri Jun 17 06:33:54 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Jun 17 06:34:03 2011 Subject: Mailscanner corrupting docx and xlsx fiiles In-Reply-To: References: Message-ID: Doing odd things with these files?? Yes from what I can see of the changelog - have a look yourself. On Thursday, 16 June 2011, Mina Moussa wrote: > > > > > > Thank you for the reply, has this been a reported issue though? > > > > > Date: Thu, 16 Jun 2011 08:34:53 +0100 > From: maxsec@gmail.com > To: mailscanner@lists.mailscanner.info > Subject: Re: Mailscanner corrupting docx and xlsx fiiles > > There's been a few fixes for these files in? the almost 2.5 years since 4.74 was released. > > I'd start by upgrading to the latest Version 4.83.5-1? and see how that improves things. > > -- > Martin Hepworth > Oxford, UK > > > On 16 June 2011 01:45, Mina Moussa wrote: > > > Hi Guys, > > Mailscanner is corrupting docx and xlxs files attatched to emails, whenever I bypass mailscanner and just use exchange <-> exchange, or postfix<->exchange, everything works fine. > > version 4.74.16 > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! > -- -- Martin Hepworth Oxford, UK From alex at vidadigital.com.pa Fri Jun 17 14:48:07 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Fri Jun 17 14:48:18 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: References: <20110616231033.5EEFB5A1C81@sinclaire.sibble.net> <0B6764E3-C724-426C-BAFE-B0A42DF3D82D@vidadigital.com.pa> Message-ID: You'd also have to have that other MTA use the MailScanner-enabled host as a SMART_HOST in order to enjoy all the other benefits of running MailScanner, such as virus scanning, content filtering, etc. The way I do it is a workaround, but it keeps you from having to run different instances or set up nonstandard ports. IMHO people should use MSA (587) or SMTP/S (465) anyway, so I have those enabled in all my MTA's. On Fri, Jun 17, 2011 at 12:30 AM, Martin Hepworth wrote: > I would have a sendmail listening on a different other than 25 and > have this be trusted with passwords etc. This can route without > mailscanner ( or a less restrictive setup eg no SA being called ) > > It's fairly common these days for the outgoing mta for clients to be > on something other than Port 25 > > Martin > > On Friday, 17 June 2011, Alex Neuman wrote: >> This has been asked in the past, and I repeat my solution for the benefit of those who haven't had the opportunity to search the archives for a solution. >> >> If you're not using sendmail as your MTA you can try doing something like this on your own MTA similarly. >> >> My sendmail.mc has a line like this: >> >> define(`confRECEIVED_HEADER', `_REC_HDR_ >> ?? ? ? ?_REC_FULL_AUTH_$?{auth_ssf} MYOWNTOKEN bits=${auth_ssf}$.) >> ?? ? ? ?_REC_BY_ >> ?? ? ? ?_REC_TLS_ >> ?? ? ? ?_REC_END_')dnl >> >> Where "MYOWNTOKEN" is something not trivially guessable. >> >> >> Then in /etc/mail/spamassasin/local.cf I add: >> >> header MYOWNTOKEN ALL =~ /MYOWNTOKEN/ >> score MYOWNTOKEN -100 >> >> This way, everyone who *REALLY* authenticates in my server gets scored -100 and therefore it doesn't get flagged as spam. >> >> On Jun 16, 2011, at 6:10 PM, Harondel J. Sibble wrote: >> >>> Just wondering what you all suggest is the best way to deal with the >>> following. >>> >>> Mailscanner machine at the enge of the network, internal imap mailserver, >>> users with mobile phones connected via imaps to the internal server with >>> various mail clients. >>> >>> SMTP Auth is in place for all users to send email. >>> >>> Approx 50% percent of the time, the users on one cell provider (Mobilicity) >>> have their mail marked as spam and quarantined, generally users on Rogers, >>> Fido, or Telus don't have the same problem or not to same extent, eg >>> >>> SpamAssassin Score: ? 4.42 >>> Spam Report: >>> ? ? ? Score ? Matching Rule ? Descriptioncached ? ? ? not >>> ? ? ? score=4.423 >>> 4 ? ? required >>> -2.60 BAYES_00 ? ? ? ?Bayesian spam probability is 0 to 1% >>> -3.30 KHOP_DNSBL_ADJ >>> -1.50 KHOP_THREADED >>> 1.96 ?RCVD_IN_BL_SPAMCOP_NET ?Received via a relay in bl.spamcop.net >>> 1.70 ?RCVD_IN_HOSTKARMA_BL >>> 2.00 ?RCVD_IN_MSPIKE_BL >>> 0.01 ?RCVD_IN_MSPIKE_L3 >>> 2.40 ?RCVD_IN_PSBL >>> 0.62 ?RCVD_IN_SORBS_WEB ? ? ? SORBS: sender is a abuseable web server >>> 3.03 ?RCVD_IN_XBL ? ? Received via a relay in Spamhaus XBL >>> 0.10 ?RDNS_NONE ? ? ? Delivered to trusted network by a host with no rDNS >>> >>> I've considered client ssl certs but not all the devices/mail client apps >>> support this so not really a solution? >>> >>> What would you suggest is the best way to keep their legitimate emails from >>> being blocked by the mailscanner machine. >>> >>> >>> -- >>> Harondel J. Sibble >>> Sibble Computer Consulting >>> Creating Solutions for the small and medium business computer user. >>> help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com >>> Blog: http://www.pdscc.com/blog >>> (604) 739-3709 (voice) >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> >> -- >> >> Alex Neuman van der Hans >> Reliant Technologies / Vida Digital >> http://vidadigital.com.pa/ >> >> +507-6781-9505 >> +507-832-6725 >> +1-440-253-9789 (USA) >> Skype: alexneuman >> BB PIN 20EA17C5 >> >> >> Follow @AlexNeuman on Twitter >> http://facebook.com/vidadigital >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > -- > -- > Martin Hepworth > Oxford, UK > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From mailscanner at pdscc.com Fri Jun 17 17:22:09 2011 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Fri Jun 17 17:22:31 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: References: <20110616231033.5EEFB5A1C81@sinclaire.sibble.net>, , Message-ID: <20110617162213.53E045A1C81@sinclaire.sibble.net> On 17 Jun 2011 at 8:48, Alex Neuman wrote: > You'd also have to have that other MTA use the MailScanner-enabled > host as a SMART_HOST in order to enjoy all the other benefits of > running MailScanner, such as virus scanning, content filtering, etc. I'm not sure what you mean, are you refering to Martin's suggest to run a second MTA instance that bypasses MS? > The way I do it is a workaround, but it keeps you from having to run > different instances or set up nonstandard ports. yeah, that's something I don't like. > IMHO people should use MSA (587) or SMTP/S (465) anyway, so I have > those enabled in all my MTA's. Yes, I already use TLS on port 587, that and IMAPs are the only ports open to the world on the mailserver behind mailscanner. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From mailscanner at pdscc.com Fri Jun 17 17:22:10 2011 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Fri Jun 17 17:22:32 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <0B6764E3-C724-426C-BAFE-B0A42DF3D82D@vidadigital.com.pa> References: <20110616231033.5EEFB5A1C81@sinclaire.sibble.net>, <0B6764E3-C724-426C-BAFE-B0A42DF3D82D@vidadigital.com.pa> Message-ID: <20110617162213.7BE375A1C82@sinclaire.sibble.net> Didn't find that one in my search, thanks. Not sure I understand fully, I use postfix and haven't touched sendmail in years. Are you suggesting adding an additional header at the mail client level that is then processed by the mta/ms? I'n not convinced that's something I can fully control on the various mail clients on the phones, it's just the same as using ssl client certs. Not all devices support it. On 16 Jun 2011 at 22:52, Alex Neuman wrote: > This has been asked in the past, and I repeat my solution for the benefit of > those who haven't had the opportunity to search the archives for a solution. > > If you're not using sendmail as your MTA you can try doing something like this > on your own MTA similarly. > > My sendmail.mc has a line like this: > > define(`confRECEIVED_HEADER', `_REC_HDR_ > _REC_FULL_AUTH_$?{auth_ssf} MYOWNTOKEN bits=${auth_ssf}$.) > _REC_BY_ > _REC_TLS_ > _REC_END_')dnl > > Where "MYOWNTOKEN" is something not trivially guessable. > > > Then in /etc/mail/spamassasin/local.cf I add: > > header MYOWNTOKEN ALL =~ /MYOWNTOKEN/ > score MYOWNTOKEN -100 > > This way, everyone who *REALLY* authenticates in my server gets scored -100 > and therefore it doesn't get flagged as spam. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From alex at vidadigital.com.pa Fri Jun 17 18:03:06 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Fri Jun 17 18:03:17 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <20110617162213.53E045A1C81@sinclaire.sibble.net> References: <20110616231033.5EEFB5A1C81@sinclaire.sibble.net> <20110617162213.53E045A1C81@sinclaire.sibble.net> Message-ID: > yeah, that's something I don't like. > That's the beauty of open source - you can pick and choose a solution or build your own! > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From jase at sensis.com Fri Jun 17 16:07:14 2011 From: jase at sensis.com (Desai, Jason) Date: Fri Jun 17 18:18:32 2011 Subject: Spam Viruses Message-ID: I have some emails coming in that are being caught by Sophos as >>> Virus 'Mal/Phish-A' found in file ./1QXX4J-0005TS-O7/PayPal - Restore Your Account.htm And in MailScanner.conf I have Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/* *Phish* So I would expect the above email to be tagged as a spam-virus. However, it is not. Looking at the code, it looks to me like spam viruses are only checked for ClamAV and Fprot6. Is this an oversight, or by design? Using MailScanner 4.83.5. Jase - This message is intended only for the addressee and may contain information that is company confidential or privileged. Any technical data in this message may be exported only in accordance with the U.S. International Traffic in Arms Regulations (22 CFR Parts 120-130) or the Export Administration Regulations (15 CFR Parts 730-774). Unauthorized use is strictly prohibited and may be unlawful. If you are not the intended recipient, or the person responsible for delivering to the intended recipient, you should not read, copy, disclose or otherwise use this message. If you have received this email in error, please delete it, and advise the sender immediately. - From AHKAPLAN at PARTNERS.ORG Fri Jun 17 19:08:39 2011 From: AHKAPLAN at PARTNERS.ORG (Kaplan, Andrew H.) Date: Fri Jun 17 19:08:49 2011 Subject: MailScanner not starting error In-Reply-To: References: Message-ID: Hi there -- Sorry about the delay in replying to the previous e-mail. Hopefully the contents of this reply will prove to be worth it. I went ahead with a reinstall/upgrade of MailScanner on the server so the version that is running is the 4.83.5-1 release. Once the upgrade was complete, I started MailScanner via the /etc/init.d script, and the service has been running successfully since then. One other note: I have the clamav anti-viral software on the server, and it is configured to do a scan of the root filesystem every night. The most recent scan 'detected' a trojan with the /usr/lib/MailScanner/MailScanner/MessageBatch.pm file, and the so-called offending file was moved to quarantine. I believe this was a false positive, and after restoring the file to its original location, I reconfigured clamav to ignore that file. It is possible, that part, if not all, of the problem was caused by the absense of this file. Thanks again for everyone's help on this. This is one incident that I am going to thoroughly document for our company's knowledgebase. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Scott Silva Sent: Thursday, June 16, 2011 4:51 PM To: mailscanner@lists.mailscanner.info Subject: Re: MailScanner not starting error on 6/16/2011 12:58 PM Kaplan, Andrew H. spake the following: > Hi there -- > > The output of the MailScanner --debug command is shown below, > sorry if I did not think of this sooner: > > Can't locate MailScanner/MessageBatch.pm in @INC (@INC contains: > /usr/lib/MailScanner /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl > /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl > /usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi /usr/lib/perl5/5.8.8 > /usr/lib/MailScanner) at /usr/sbin/MailScanner line 103. > BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 103. > > That looks like a perl update clobbered MailScanner. Maybe a re-install is in order? -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! The information in this e-mail is intended only for the person to whom it is addressed. If you believe this e-mail was sent to you in error and the e-mail contains patient information, please contact the Partners Compliance HelpLine at http://www.partners.org/complianceline . If the e-mail was sent to you in error but does not contain patient information, please contact the sender and properly dispose of the e-mail. From Kevin_Miller at ci.juneau.ak.us Sat Jun 18 00:46:14 2011 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Sat Jun 18 00:46:31 2011 Subject: Sig file returns a 404 Message-ID: <4A09477D575C2C4B86497161427DD94C162F20F510@city-exchange07> I just tried to download the sig file below and it returns a 404. Not a show stopper, but figured it was worth mentioning. http://www.mailscanner.info/files/4/rpm/MailScanner-4.83.5-1.rpm.tar.gz.sig ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From markus at markusoft.se Mon Jun 20 07:52:50 2011 From: markus at markusoft.se (Markus Nilsson) Date: Mon Jun 20 07:53:11 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <20110617162213.7BE375A1C82@sinclaire.sibble.net> Message-ID: <34c69003-dfb6-4a74-b5f5-b01302493d23@cronlabworkstation0> In postfix I solve this by setting smtpd_sasl_authenticated_header = yes That by-passes network checks in SA if the header comes from a trusted source, and the host receiving the connection from your remote users is trusted I guess? This disables RBL-checks at SA, if you need even more negative scoring, you can modify the score for ALL_TRUSTED /Markus ----- Ursprungligt meddelande ----- Fr?n: "Harondel J. Sibble" Till: "MailScanner discussion" Skickat: fredag, 17 jun 2011 18:22:10 ?mne: Re: how to allow mobile user to send email with getting blocked Didn't find that one in my search, thanks. Not sure I understand fully, I use postfix and haven't touched sendmail in years. Are you suggesting adding an additional header at the mail client level that is then processed by the mta/ms? I'n not convinced that's something I can fully control on the various mail clients on the phones, it's just the same as using ssl client certs. Not all devices support it. On 16 Jun 2011 at 22:52, Alex Neuman wrote: > This has been asked in the past, and I repeat my solution for the benefit of > those who haven't had the opportunity to search the archives for a solution. > > If you're not using sendmail as your MTA you can try doing something like this > on your own MTA similarly. > > My sendmail.mc has a line like this: > > define(`confRECEIVED_HEADER', `_REC_HDR_ > _REC_FULL_AUTH_$?{auth_ssf} MYOWNTOKEN bits=${auth_ssf}$.) > _REC_BY_ > _REC_TLS_ > _REC_END_')dnl > > Where "MYOWNTOKEN" is something not trivially guessable. > > > Then in /etc/mail/spamassasin/local.cf I add: > > header MYOWNTOKEN ALL =~ /MYOWNTOKEN/ > score MYOWNTOKEN -100 > > This way, everyone who *REALLY* authenticates in my server gets scored -100 > and therefore it doesn't get flagged as spam. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- Bearcom scanned this message. We don't think it was spam. If it was, please report by copying this link into your browser: http://message4.bearnet.nu/mail/index.php?id=47465ADE082.A50D7-&learn=spam&host=212.91.140.36 -- This message has been scanned for viruses and dangerous content by Bearcom (www.bearcom.se), and is believed to be clean. -------------- next part -------------- Skipped content of type multipart/related From mailscanner at pdscc.com Mon Jun 20 17:20:53 2011 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Mon Jun 20 17:21:12 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <34c69003-dfb6-4a74-b5f5-b01302493d23@cronlabworkstation0> References: <20110617162213.7BE375A1C82@sinclaire.sibble.net>, <34c69003-dfb6-4a74-b5f5-b01302493d23@cronlabworkstation0> Message-ID: <20110620162057.EFAC51A30@sinclaire.sibble.net> Just so I am clear, you are suggesting I put this in postfix on the mailscanner machine, rather than in postfix on the protected imap server behind mailscanner right? As to changing the headers in the mailclient, it doesn't appear that K-9 on Android supports that :-( On 20 Jun 2011 at 8:52, Markus Nilsson wrote: > In postfix I solve this by setting > smtpd_sasl_authenticated_header = yes That by-passes network checks in SA if > the header comes from a trusted source, and the host receiving the connection > from your remote users is trusted I guess? > > This disables RBL-checks at SA, if you need even more negative scoring, you > can modify the score for ALL_TRUSTED > > /Markus > > > ----- Ursprungligt meddelande ----- > > Fr?n: "Harondel J. Sibble" > Till: "MailScanner discussion" > Skickat: fredag, 17 jun 2011 18:22:10 > ?mne: Re: how to allow mobile user to send email with getting blocked > > Didn't find that one in my search, thanks. > > Not sure I understand fully, I use postfix and haven't touched sendmail in > years. Are you suggesting adding an additional header at the mail client level > that is then processed by the mta/ms? > > I'n not convinced that's something I can fully control on the various mail > clients on the phones, it's just the same as using ssl client certs. Not all > devices support it. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From alex at vidadigital.com.pa Mon Jun 20 18:18:35 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Mon Jun 20 18:18:46 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <20110620162057.EFAC51A30@sinclaire.sibble.net> References: <20110617162213.7BE375A1C82@sinclaire.sibble.net> <34c69003-dfb6-4a74-b5f5-b01302493d23@cronlabworkstation0> <20110620162057.EFAC51A30@sinclaire.sibble.net> Message-ID: That's the beauty of my solution. It doesn't require you to change the e-mail headers on the client - it does so at the server the moment you authenticate. On Mon, Jun 20, 2011 at 11:20 AM, Harondel J. Sibble wrote: > Just so I am clear, you are suggesting I put this in postfix on the > mailscanner machine, rather than in postfix on the protected imap server > behind mailscanner right? > > As to changing the headers in the mailclient, it doesn't appear that K-9 on > Android supports that ?:-( > > On 20 Jun 2011 at 8:52, Markus Nilsson wrote: > >> In postfix I solve this by setting >> smtpd_sasl_authenticated_header = yes That by-passes network checks in SA if >> the header comes from a trusted source, and the host receiving the connection >> from your remote users is trusted I guess? >> >> This disables RBL-checks at SA, if you need even more negative scoring, you >> can modify the score for ALL_TRUSTED >> >> /Markus >> >> >> ----- Ursprungligt meddelande ----- >> >> Fr?n: "Harondel J. Sibble" >> Till: "MailScanner discussion" >> Skickat: fredag, 17 jun 2011 18:22:10 >> ?mne: Re: how to allow mobile user to send email with getting blocked >> >> Didn't find that one in my search, thanks. >> >> Not sure I understand fully, I use postfix and haven't touched sendmail in >> years. Are you suggesting adding an additional header at the mail client level >> that is then processed by the mta/ms? >> >> I'n not convinced that's something I can fully control on the various mail >> clients on the phones, it's just the same as using ssl client certs. Not all >> devices support it. > > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From jase at sensis.com Mon Jun 20 17:05:01 2011 From: jase at sensis.com (Desai, Jason) Date: Mon Jun 20 18:24:41 2011 Subject: MailScanner not removing viruses Message-ID: I have recently upgraded from Debian Lenny running MailScanner version 4.72.5-1 to Debian Squeeze running MailScanner 4.83.5-1. MailScanner was installed from the tarball (not the Debian repository). We have "Still Deliver Silent Viruses = yes" in the configuration, as we do not get a lot of viruses and like to let people know that MailScanner is protecting them. In version 7.72.5-1, a silent virus would still be "cleaned" - removed from the email and replaced with a notice - before being delivered. However, with version 4.83.5-1, it seems that the virus is passed on without being removed. I suspect this has something to do with the changes made in 4.78.17-1 when the order of the virus and spam checking was switched, and code for spam-viruses was added. I have come up with a simple patch that seems to fix the issue: =============================================================== --- MessageBatch.pm.orig 2010-08-03 07:19:16.000000000 -0400 +++ MessageBatch.pm 2011-06-20 11:39:04.000000000 -0400 @@ -875,6 +875,7 @@ #MailScanner::Log::WarnLog("Deliversilent for %s is %s", $message->{id}, # MailScanner::Config::Value('deliversilent', $message)); if (MailScanner::Config::Value('deliversilent', $message)) { + $message->Clean(); $message->DeliverCleaned(); #print STDERR "Deleting silent-infected message " . $message->{id} . "\n"; push @messages, $message; =============================================================== I'm not sure if this is the best place to do the clean or not, but it does seem to work fine. Julian, can you take a look if you get a chance? I would highly recommend either using this patch or not setting "Still Deliver Silent Viruses = yes". The default is no, which I think would be recommended anyways. Jase - This message is intended only for the addressee and may contain information that is company confidential or privileged. Any technical data in this message may be exported only in accordance with the U.S. International Traffic in Arms Regulations (22 CFR Parts 120-130) or the Export Administration Regulations (15 CFR Parts 730-774). Unauthorized use is strictly prohibited and may be unlawful. If you are not the intended recipient, or the person responsible for delivering to the intended recipient, you should not read, copy, disclose or otherwise use this message. If you have received this email in error, please delete it, and advise the sender immediately. - From alex at vidadigital.com.pa Mon Jun 20 18:46:19 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Mon Jun 20 18:46:30 2011 Subject: Blank Rules Message-ID: For the "Archive Mail = " option the default is blank. I am aware I can set up a ruleset using: Archive Mail = %rules-dir%/archive.rules Which can have something like: FromOrTo: onlythisaddress@domain.com thisotheraddress@domain.com Which would "archive" all e-mails "from or to" "onlythisaddress@domain.com" by sending a copy to "thisotheraddress@domain.com". If I'm correct so far, I guess I would need a default. So is the correct syntax after that then, FromOrTo: default (where after "default" is nothing at all since I don't want anything done with it) ? -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From bonivart at opencsw.org Mon Jun 20 18:54:06 2011 From: bonivart at opencsw.org (Peter Bonivart) Date: Mon Jun 20 18:54:35 2011 Subject: Blank Rules In-Reply-To: References: Message-ID: On Mon, Jun 20, 2011 at 7:46 PM, Alex Neuman wrote: > If I'm correct so far, I guess I would need a default. No, you don't need a default. Just enter the archive lines, everything not matching those will not be archived. /peter From alex at vidadigital.com.pa Mon Jun 20 19:08:06 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Mon Jun 20 19:08:15 2011 Subject: Blank Rules In-Reply-To: References: Message-ID: Thanks! On Mon, Jun 20, 2011 at 12:54 PM, Peter Bonivart wrote: > On Mon, Jun 20, 2011 at 7:46 PM, Alex Neuman wrote: >> If I'm correct so far, I guess I would need a default. > > No, you don't need a default. Just enter the archive lines, everything > not matching those will not be archived. > > /peter > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From mailscanner at pdscc.com Mon Jun 20 19:58:33 2011 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Mon Jun 20 19:58:54 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <20110620162057.EFAC51A30@sinclaire.sibble.net> References: <20110617162213.7BE375A1C82@sinclaire.sibble.net>, <34c69003-dfb6-4a74-b5f5-b01302493d23@cronlabworkstation0>, <20110620162057.EFAC51A30@sinclaire.sibble.net> Message-ID: <20110620185838.5E9E31A2C@sinclaire.sibble.net> Tried it frist on the MS machine, test message got held up as spam, then tried if on the internal mailserver also and again another test message got held as spam :-( On 20 Jun 2011 at 9:20, Harondel J. Sibble wrote: > Just so I am clear, you are suggesting I put this in postfix on the > mailscanner machine, rather than in postfix on the protected imap server > behind mailscanner right? > > As to changing the headers in the mailclient, it doesn't appear that K-9 on > Android supports that :-( > > On 20 Jun 2011 at 8:52, Markus Nilsson wrote: > > > In postfix I solve this by setting > > smtpd_sasl_authenticated_header = yes That by-passes network checks in SA if > > the header comes from a trusted source, and the host receiving the > > connection from your remote users is trusted I guess? > > > > This disables RBL-checks at SA, if you need even more negative scoring, you > > can modify the score for ALL_TRUSTED > > > > /Markus > > > > > > ----- Ursprungligt meddelande ----- > > > > Fr?n: "Harondel J. Sibble" > > Till: "MailScanner discussion" > > Skickat: fredag, 17 jun 2011 18:22:10 > > ?mne: Re: how to allow mobile user to send email with getting blocked > > > > Didn't find that one in my search, thanks. > > > > Not sure I understand fully, I use postfix and haven't touched sendmail in > > years. Are you suggesting adding an additional header at the mail client > > level that is then processed by the mta/ms? > > > > I'n not convinced that's something I can fully control on the various mail > > clients on the phones, it's just the same as using ssl client certs. Not all > > devices support it. > > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From mailscanner at pdscc.com Mon Jun 20 20:02:27 2011 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Mon Jun 20 20:02:47 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: References: <20110617162213.7BE375A1C82@sinclaire.sibble.net>, <20110620162057.EFAC51A30@sinclaire.sibble.net>, Message-ID: <20110620190231.E26411A4C@sinclaire.sibble.net> I'm obviously missing something as per my last email, where after implementing this change, emails from mobile devices are still getting squashed, eg SpamAssassin Score: 7.11 Spam Report: Score Matching Rule Description cached score=7.113 4 required -2.60 BAYES_00 Bayesian spam probability is 0 to 1% 2.00 KHOP_DNSBL_BUMP 1.70 RCVD_IN_HOSTKARMA_BL 2.00 RCVD_IN_MSPIKE_BL 0.01 RCVD_IN_MSPIKE_L3 0.25 RCVD_IN_NIX_SPAM 0.62 RCVD_IN_SORBS_WEB SORBS: sender is a abuseable web server 3.03 RCVD_IN_XBL Received via a relay in Spamhaus XBL 0.10 RDNS_NONE Delivered to trusted network by a host with no rDNS On 20 Jun 2011 at 12:18, Alex Neuman wrote: > That's the beauty of my solution. It doesn't require you to change the > e-mail headers on the client - it does so at the server the moment you > authenticate. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From mailscanner at pdscc.com Mon Jun 20 20:26:24 2011 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Mon Jun 20 20:26:45 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <20110620190231.E26411A4C@sinclaire.sibble.net> References: <20110617162213.7BE375A1C82@sinclaire.sibble.net>, , <20110620190231.E26411A4C@sinclaire.sibble.net> Message-ID: <20110620192629.62EBC5A1C81@sinclaire.sibble.net> these are the headers of a bcc'd message sent from a phone (obfuscated) Return-Path: X-Original-To: archival@mytld.com Delivered-To: myusername@hostname.mailservertld.com Received: from [10.xxx.xxx.xxx] (unknown [xxx.xxx.xxx.xxx]) (using TLSv1 with cipher RC4-MD5 (128/128 bits)) (No client certificate requested) (Authenticated sender: myusername) by hostname.mailservertld.com (Postfix) with ESMTP id E0A421A2C; Mon, 20 Jun 2011 11:55:35 -0700 (PDT) User-Agent: K-9 Mail for Android MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: Test 2 From: "This is my user" Date: Mon, 20 Jun 2011 11:54:25 -0700 To: **************@gmail.com Message-ID: <33e95b7f-adb2-4718-9158-42fd4e4e0242@email.android.com> X-PM-PLACEHOLDER: On 20 Jun 2011 at 12:02, Harondel J. Sibble wrote: > I'm obviously missing something as per my last email, where after > implementing this change, emails from mobile devices are still getting > squashed, eg > > SpamAssassin Score: 7.11 > Spam Report: > Score Matching Rule Description cached > score=7.113 > 4 required > -2.60 BAYES_00 Bayesian spam probability is 0 to 1% > 2.00 KHOP_DNSBL_BUMP > 1.70 RCVD_IN_HOSTKARMA_BL > 2.00 RCVD_IN_MSPIKE_BL > 0.01 RCVD_IN_MSPIKE_L3 > 0.25 RCVD_IN_NIX_SPAM > 0.62 RCVD_IN_SORBS_WEB SORBS: sender is a abuseable web server > 3.03 RCVD_IN_XBL Received via a relay in Spamhaus XBL > 0.10 RDNS_NONE Delivered to trusted network by a host with no rDNS > > On 20 Jun 2011 at 12:18, Alex Neuman wrote: > > > That's the beauty of my solution. It doesn't require you to change the > > e-mail headers on the client - it does so at the server the moment you > > authenticate. > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From ipcopper.ph at gmail.com Tue Jun 21 06:52:08 2011 From: ipcopper.ph at gmail.com (jan gestre) Date: Tue Jun 21 06:52:19 2011 Subject: yahoo mail rejected In-Reply-To: References: <1C7E4902EA98DE4487AA66F401F237F001F61665@EPSILONX.spa.usherbrooke.ca> Message-ID: On Sun, Jun 12, 2011 at 1:21 AM, Glenn Steen wrote: > Might be, but I've seen similar badness on a single pass though... I > think...:-) > > Den 10 jun 2011 19.54, "Beauchemin, Denis" > skrev: > > I would say the mangling may result from the email passing twice through > MailScanner. > > > > Denis > > > > ________________________________ > > Denis Beauchemin > Architecte Technologique - Section Infrastructure des serveurs > Service des technologies de l?information (S.T.I.) > Universit? de Sherbrooke > Courriel: Denis.Beauchemin@USherbrooke.ca > T?l.: 819-821-8000 Poste: 62252 > > > > De?: mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] De la part de Glenn > Steen > Envoy??: 9 juin 2011 07:14 > ??: MailScanner discussion > Objet?: Re: yahoo mail rejected > > > > Two things seem to happen there: > The recipient address has a domain part that is unknown to the... > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > If the mangling is caused by the phising function, is it possible to disable the phising function? If yes, how? Many thanks! From markus at markusoft.se Tue Jun 21 07:06:27 2011 From: markus at markusoft.se (Markus Nilsson) Date: Tue Jun 21 07:06:43 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <20110620162057.EFAC51A30@sinclaire.sibble.net> Message-ID: <9a092fde-9d8d-4271-9e41-ac51ab23af04@cronlabworkstation0> Hi Harondel, With my example, add this rule (smtpd_sasl_authenticated_header = yes) to the postfix machine where the users login, and on the second machine (where MS/SA is running) make sure that the first machine is "trusted" by adding it to the mynetworks setting! BR/ Markus ----- Ursprungligt meddelande ----- Fr?n: "Harondel J. Sibble" Till: "MailScanner discussion" Skickat: m?ndag, 20 jun 2011 18:20:53 ?mne: Re: how to allow mobile user to send email with getting blocked Just so I am clear, you are suggesting I put this in postfix on the mailscanner machine, rather than in postfix on the protected imap server behind mailscanner right? As to changing the headers in the mailclient, it doesn't appear that K-9 on Android supports that :-( On 20 Jun 2011 at 8:52, Markus Nilsson wrote: > In postfix I solve this by setting > smtpd_sasl_authenticated_header = yes That by-passes network checks in SA if > the header comes from a trusted source, and the host receiving the connection > from your remote users is trusted I guess? > > This disables RBL-checks at SA, if you need even more negative scoring, you > can modify the score for ALL_TRUSTED > > /Markus > > > ----- Ursprungligt meddelande ----- > > Fr?n: "Harondel J. Sibble" > Till: "MailScanner discussion" > Skickat: fredag, 17 jun 2011 18:22:10 > ?mne: Re: how to allow mobile user to send email with getting blocked > > Didn't find that one in my search, thanks. > > Not sure I understand fully, I use postfix and haven't touched sendmail in > years. Are you suggesting adding an additional header at the mail client level > that is then processed by the mta/ms? > > I'n not convinced that's something I can fully control on the various mail > clients on the phones, it's just the same as using ssl client certs. Not all > devices support it. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- Bearcom scanned this message. We don't think it was spam. If it was, please report by copying this link into your browser: http://message4.bearnet.nu/mail/index.php?id=C3485ADE0AA.A721F-&learn=spam&host=212.91.140.36 -- This message has been scanned for viruses and dangerous content by Bearcom (www.bearcom.se), and is believed to be clean. -------------- next part -------------- Skipped content of type multipart/related From markus at markusoft.se Tue Jun 21 07:15:42 2011 From: markus at markusoft.se (Markus Nilsson) Date: Tue Jun 21 07:15:57 2011 Subject: yahoo mail rejected In-Reply-To: Message-ID: <1f74349f-2fa6-4c33-9037-845608f8499b@cronlabworkstation0> > Fr?n: "jan gestre" > Till: "MailScanner discussion" > Skickat: tisdag, 21 jun 2011 7:52:08 > ?mne: Re: RE: yahoo mail rejected > On Sun, Jun 12, 2011 at 1:21 AM, Glenn Steen > wrote: > > Might be, but I've seen similar badness on a single pass though... > > I > > think...:-) > > > > Den 10 jun 2011 19.54, "Beauchemin, Denis" > > > > skrev: > > > > I would say the mangling may result from the email passing twice > > through > > MailScanner. > > > > > > > > Denis > > > > > > > > ________________________________ > > > > Denis Beauchemin > > Architecte Technologique - Section Infrastructure des serveurs > > Service des technologies de l?information (S.T.I.) > > Universit? de Sherbrooke > > Courriel: Denis.Beauchemin@USherbrooke.ca > > T?l.: 819-821-8000 Poste: 62252 > > > > > > > > De : mailscanner-bounces@lists.mailscanner.info > > [mailto:mailscanner-bounces@lists.mailscanner.info] De la part de > > Glenn > > Steen > > Envoy? : 9 juin 2011 07:14 > > ? : MailScanner discussion > > Objet : Re: yahoo mail rejected > > > > > > > > Two things seem to happen there: > > The recipient address has a domain part that is unknown to the... > > > > > > > If the mangling is caused by the phising function, is it possible to > disable the phising function? If yes, how? > Many thanks! A wild guess is that you can turn it off by setting Find Phishing Fraud = no :) /Markus -- This message has been scanned for viruses and dangerous content by Bearcom (www.bearcom.se), and is believed to be clean. From ipcopper.ph at gmail.com Tue Jun 21 13:57:53 2011 From: ipcopper.ph at gmail.com (jan gestre) Date: Tue Jun 21 13:58:04 2011 Subject: yahoo mail rejected In-Reply-To: <1f74349f-2fa6-4c33-9037-845608f8499b@cronlabworkstation0> References: <1f74349f-2fa6-4c33-9037-845608f8499b@cronlabworkstation0> Message-ID: > > A wild guess is that you can turn it off by setting > > Find Phishing Fraud = no > > :) > > /Markus > > > Thanks Markus, how lazy of me to Google that :D. From v.matys at grumpa.net Tue Jun 21 13:59:19 2011 From: v.matys at grumpa.net (Viktor Matys - Grumpa.Net) Date: Tue Jun 21 13:59:28 2011 Subject: Lock.PM insecure with -T switch Message-ID: <4E0095A7.9070805@grumpa.net> Hi everybody, today I upgraded Perl in Debian Squeeze and after restarting the MailScanner tries to start again and again (repeating messages in syslog) and does not read messages form incoming dir (postfix/hold). When I run MailScanner -debug (or -debug-sa), it ends with this message: Insecure dependency in open while running with -T switch at /usr/share/MailScanner//MailScanner/Lock.pm line 358. There is another interesting message in the syslog: MailScanner: Process did not exit cleanly, returned 9 with signal 0 I'm unable to filter e-mails now. I have similar configuration on second server and there is everything O.K. Any idea? Thanks Viktor From bonivart at opencsw.org Tue Jun 21 16:13:01 2011 From: bonivart at opencsw.org (Peter Bonivart) Date: Tue Jun 21 16:13:31 2011 Subject: Lock.PM insecure with -T switch In-Reply-To: <4E0095A7.9070805@grumpa.net> References: <4E0095A7.9070805@grumpa.net> Message-ID: 2011/6/21 Viktor Matys - Grumpa.Net : > Insecure dependency in open while running with -T switch at > /usr/share/MailScanner//MailScanner/Lock.pm line 358. This has been mentioned many times now, this is from one of the first hits on Google: "There's no fix from Mailscanner yet, but I did find a workarround by adding -U to the first line of the Mailscanner perl script: #!/usr/bin/perl -I/opt/MailScanner/lib -U" Since so many of you seem to have a "problem" with this, can't one of you contribute a patch to Julian? /peter From v.matys at grumpa.net Tue Jun 21 17:18:56 2011 From: v.matys at grumpa.net (Viktor Matys) Date: Tue Jun 21 17:19:07 2011 Subject: Lock.PM insecure with -T switch In-Reply-To: <4E0095A7.9070805@grumpa.net> References: <4E0095A7.9070805@grumpa.net> Message-ID: <4E00C470.9030609@grumpa.net> Correction: > > I have similar configuration on second server and there is everything > O.K. > Other server is broken now too. Viktor From utisoft at gmail.com Tue Jun 21 17:28:24 2011 From: utisoft at gmail.com (Chris Rees) Date: Tue Jun 21 17:29:03 2011 Subject: Lock.PM insecure with -T switch In-Reply-To: <4E00C470.9030609@grumpa.net> References: <4E0095A7.9070805@grumpa.net> <4E00C470.9030609@grumpa.net> Message-ID: 2011/6/21 Viktor Matys : > Correction: >> >> I have similar configuration on second server and there is everything O.K. >> > Other server is broken now too. > > Viktor Have you tried the solution posted by Peter Bonivart? Chris From v.matys at grumpa.net Tue Jun 21 17:29:57 2011 From: v.matys at grumpa.net (Viktor Matys) Date: Tue Jun 21 17:30:21 2011 Subject: Lock.PM insecure with -T switch - SOLVED In-Reply-To: References: <4E0095A7.9070805@grumpa.net> Message-ID: <4E00C705.4040006@grumpa.net> Thank you, wizard. It works. Viktor Dne 21.6.2011 17:13, Peter Bonivart napsal(a): > 2011/6/21 Viktor Matys - Grumpa.Net: > >> Insecure dependency in open while running with -T switch at >> /usr/share/MailScanner//MailScanner/Lock.pm line 358. >> > This has been mentioned many times now, this is from one of the first > hits on Google: > > "There's no fix from Mailscanner yet, but I did find a workarround by > adding -U to the first line of the Mailscanner perl script: > > #!/usr/bin/perl -I/opt/MailScanner/lib -U" > > Since so many of you seem to have a "problem" with this, can't one of > you contribute a patch to Julian? > > /peter > From bonivart at opencsw.org Tue Jun 21 17:38:44 2011 From: bonivart at opencsw.org (Peter Bonivart) Date: Tue Jun 21 17:39:14 2011 Subject: Lock.PM insecure with -T switch In-Reply-To: References: <4E0095A7.9070805@grumpa.net> Message-ID: On Tue, Jun 21, 2011 at 5:13 PM, Peter Bonivart wrote: > Since so many of you seem to have a "problem" with this, can't one of > you contribute a patch to Julian? Just to clarify, with patch I don't mean to just add -U :) but to really untaint all those references. /peter From stu at spacehopper.org Tue Jun 21 19:42:53 2011 From: stu at spacehopper.org (Stuart Henderson) Date: Tue Jun 21 19:43:15 2011 Subject: Lock.PM insecure with -T switch References: <4E0095A7.9070805@grumpa.net> Message-ID: On 2011-06-21, Peter Bonivart wrote: > On Tue, Jun 21, 2011 at 5:13 PM, Peter Bonivart wrote: >> Since so many of you seem to have a "problem" with this, can't one of >> you contribute a patch to Julian? > > Just to clarify, with patch I don't mean to just add -U :) but to > really untaint all those references. "really" untainting would be something more than the $foo =~ /^(.*)$/; $foo = $1; and similar you see everywhere... running with -U or su'ing to the "Run as user" before starting MailScanner isn't really any worse than this. From bonivart at opencsw.org Tue Jun 21 20:08:35 2011 From: bonivart at opencsw.org (Peter Bonivart) Date: Tue Jun 21 20:09:04 2011 Subject: Lock.PM insecure with -T switch In-Reply-To: References: <4E0095A7.9070805@grumpa.net> Message-ID: On Tue, Jun 21, 2011 at 8:42 PM, Stuart Henderson wrote: > "really" untainting would be something more than the > > $foo =~ /^(.*)$/; > $foo = $1; > > and similar you see everywhere... running with -U or su'ing > to the "Run as user" before starting MailScanner isn't really any > worse than this. I agree with you and I don't suggest that the people who have trouble with this should fix this for Julian but if others are capable of writing, e.g., advanced custom functions and debugging Postfix support I think they are capable of properly untainting at least some of the code. It was just an open invitation without targeting anyone specific. It comes to a point when you answer the same question x amount of times you realize that if you fixed the source of the problem instead you would have saved time. :) /peter From markus at markusoft.se Wed Jun 22 08:40:45 2011 From: markus at markusoft.se (Markus Nilsson) Date: Wed Jun 22 08:40:59 2011 Subject: Phishing filter Message-ID: Hi I'm looking into whitelisting all private subnets in the phishing filter, since we see quite a few mails with links within or intranet that are reported by the filter. Do you see any obvious disadvantages with this? If not I'll submit the patch to the list, and hope to get it included! It should be as simple as adding a few lines to InPhishingWhiteList: return 1 if $linkurl =~ m/^192\.168\.\d+\.\d+$/; etc /Markus -- This message has been scanned for viruses and dangerous content by Bearcom (www.bearcom.se), and is believed to be clean. -------------- next part -------------- Skipped content of type multipart/related From maxsec at gmail.com Wed Jun 22 15:26:50 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Jun 22 15:26:58 2011 Subject: Lock.PM insecure with -T switch In-Reply-To: References: <4E0095A7.9070805@grumpa.net> Message-ID: Or indeed if people are willing to get their hands in their pockets and sponsor Julian to do this or buy him something nice from his Amazon list he may have a little more incentive to do this. (Assuming he's not playing with his new pet zend.to :-) -- Martin Hepworth Oxford, UK On 21 June 2011 20:08, Peter Bonivart wrote: > On Tue, Jun 21, 2011 at 8:42 PM, Stuart Henderson > wrote: > > "really" untainting would be something more than the > > > > $foo =~ /^(.*)$/; > > $foo = $1; > > > > and similar you see everywhere... running with -U or su'ing > > to the "Run as user" before starting MailScanner isn't really any > > worse than this. > > I agree with you and I don't suggest that the people who have trouble > with this should fix this for Julian but if others are capable of > writing, e.g., advanced custom functions and debugging Postfix support > I think they are capable of properly untainting at least some of the > code. It was just an open invitation without targeting anyone > specific. > > It comes to a point when you answer the same question x amount of > times you realize that if you fixed the source of the problem instead > you would have saved time. :) > > /peter > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110622/7828bdc3/attachment.html From glenn.steen at gmail.com Wed Jun 22 15:52:32 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed Jun 22 15:52:43 2011 Subject: Phishing filter In-Reply-To: References: Message-ID: On 22 June 2011 09:40, Markus Nilsson wrote: > Hi > > I'm looking into whitelisting all private subnets in the phishing filter, > since we see quite a few mails with links within or intranet that are > reported by the filter. > > Do you see any obvious disadvantages with this? If not I'll submit the > patch to the list, and hope to get it included! > > > It should be as simple as adding a few lines to InPhishingWhiteList: > return 1 if $linkurl =~ m/^192\.168\.\d+\.\d+$/; > etc > > Why would you need a patch? IIRC there is a "phishing.safe.sites.conf" file where you can add your local/intranet servers. Should do the trick:-). Cheers! -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110622/79370f19/attachment.html From markus at markusoft.se Wed Jun 22 16:14:27 2011 From: markus at markusoft.se (Markus Nilsson) Date: Wed Jun 22 16:14:58 2011 Subject: Phishing filter In-Reply-To: Message-ID: <9864416e-8487-49a1-b5fd-5ffddf6d295f@cronlabworkstation0> Skipped content of type multipart/related From ssilva at sgvwater.com Wed Jun 22 18:07:34 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Wed Jun 22 18:07:52 2011 Subject: Phishing filter In-Reply-To: <9864416e-8487-49a1-b5fd-5ffddf6d295f@cronlabworkstation0> References: <9864416e-8487-49a1-b5fd-5ffddf6d295f@cronlabworkstation0> Message-ID: on 6/22/2011 8:14 AM Markus Nilsson spake the following: > > ----- Ursprungligt meddelande ----- > >> Fr??n: "Glenn Steen" >> Till: "MailScanner discussion" >> Skickat: onsdag, 22 jun 2011 16:52:32 >> ??mne: Re: Phishing filter > >> On 22 June 2011 09:40, Markus Nilsson < markus@markusoft.se > wrote: > >>> Hi >> > >>> I'm looking into whitelisting all private subnets in the phishing >>> filter, since we see quite a few mails with links within or >>> intranet >>> that are reported by the filter. >> > >>> Do you see any obvious disadvantages with this? If not I'll submit >>> the patch to the list, and hope to get it included! >> > >>> It should be as simple as adding a few lines to >>> InPhishingWhiteList: >> >>> return 1 if $linkurl =~ m/^192\.168\.\d+\.\d+$/; >> >>> etc >> > >> Why would you need a patch? IIRC there is a >> "phishing.safe.sites.conf" file where you can add your >> local/intranet servers. Should do the trick:-). > >> Cheers! >> -- >> -- Glenn > > Because I have a lot of users using this setup, using links to different > intranets. So I would want to whitelist the entire nets, to not need to > maintain such a list. The current phishing.safe.sites only accepts > left-hand-side wildcards (naturally) so I can't add the ranges there with > less than specifying all addresses... > > The change to the code above would be much easier since that effectively > whitelists all private ranges. > Not all private ranges.... how about 10.0.0.0/8 or 172.16.0.0/16? Maybe a patch that allows subnets in the whitelist would be better? Not that I would dare to write it. From markus at markusoft.se Thu Jun 23 07:30:54 2011 From: markus at markusoft.se (Markus Nilsson) Date: Thu Jun 23 07:31:18 2011 Subject: Phishing filter In-Reply-To: Message-ID: <4ad8c02e-ca6d-474a-81f9-a98d39b48b7c@cronlabworkstation0> ----- Ursprungligt meddelande ----- > Fr?n: "Scott Silva" > Till: mailscanner@lists.mailscanner.info > Skickat: onsdag, 22 jun 2011 19:07:34 > ?mne: Re: Phishing filter > on 6/22/2011 8:14 AM Markus Nilsson spake the following: > > > > ----- Ursprungligt meddelande ----- > > > >> Fr??n: "Glenn Steen" > >> Till: "MailScanner discussion" > >> > >> Skickat: onsdag, 22 jun 2011 16:52:32 > >> ??mne: Re: Phishing filter > > > >> On 22 June 2011 09:40, Markus Nilsson < markus@markusoft.se > > >> wrote: > > > >>> Hi > >> > > > >>> I'm looking into whitelisting all private subnets in the phishing > >>> filter, since we see quite a few mails with links within or > >>> intranet > >>> that are reported by the filter. > >> > > > >>> Do you see any obvious disadvantages with this? If not I'll > >>> submit > >>> the patch to the list, and hope to get it included! > >> > > > >>> It should be as simple as adding a few lines to > >>> InPhishingWhiteList: > >> > >>> return 1 if $linkurl =~ m/^192\.168\.\d+\.\d+$/; > >> > >>> etc > >> > > > >> Why would you need a patch? IIRC there is a > >> "phishing.safe.sites.conf" file where you can add your > >> local/intranet servers. Should do the trick:-). > > > >> Cheers! > >> -- > >> -- Glenn > > > > Because I have a lot of users using this setup, using links to > > different > > intranets. So I would want to whitelist the entire nets, to not > > need to > > maintain such a list. The current phishing.safe.sites only accepts > > left-hand-side wildcards (naturally) so I can't add the ranges > > there with > > less than specifying all addresses... > > > > The change to the code above would be much easier since that > > effectively > > whitelists all private ranges. > > > Not all private ranges.... how about 10.0.0.0/8 or 172.16.0.0/16? > Maybe a patch that allows subnets in the whitelist would be better? > Not that I would dare to write it. That was a good idea! Shouldn't be too hard, guessing a few lines like this would do the trick (in : sub InPhishingWhitelist, Message.pm) *** /home/markus/Message.pm 2011-05-03 17:13:54.000000000 +0200 --- /home/markus/Message.pm.patch 2011-06-23 08:27:51.000000000 +0200 *************** *** 7604,7613 **** --- 7604,7623 ---- my($linkurl) = @_; # Quick lookup return 1 if $MailScanner::Config::PhishingWhitelist{$linkurl}; + #Check for subnet entries + $subnet = 8; + $mask = ""; + while ($linkurl ne "" && $linkurl =~ s/\.\d+$//) { + $mask .= ".0"; + #print STDERR "Looking up " . $linkurl . $mask . "/" . $subnet . "\n"; + return 1 if $MailScanner::Config::PhishingWhitelist{$linkurl . $mask . "/" . $subnet}; + $subnet += 8; + } + # Trim host. off the front of the hostname while ($linkurl ne "" && $linkurl =~ s/^[^.]+\.//) { # And replace it with *. then look it up #print STDERR "Looking up *.$linkurl\n"; return 1 if $MailScanner::Config::PhishingWhitelist{'*.' . $linkurl}; -- This message has been scanned for viruses and dangerous content by CronLab (www.cronlab.com), and is believed to be clean. From campbell at cnpapers.com Thu Jun 23 20:40:39 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jun 23 20:41:20 2011 Subject: OT - one gateway to multiple mail hubs/domains Message-ID: <4E0396B7.2040108@cnpapers.com> Overtime time: How do most of you who have multiple domains route your mail through a singular gateway running MS to multiple mail hubs (server with mailboxes)? I'd like to consolidate my mail servers running sendmail and MS into one gateway. Right now, I have one server per domain, but see no reason why I can't put up a single incoming gateway for all domains which could route the mail to the mail hubs. I've used SmartHost for a single instance of domains, and think I could use virtual table , but just thought I'd ask. steve campbell From Kevin_Miller at ci.juneau.ak.us Thu Jun 23 21:04:20 2011 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Thu Jun 23 21:04:32 2011 Subject: OT - one gateway to multiple mail hubs/domains In-Reply-To: <4E0396B7.2040108@cnpapers.com> References: <4E0396B7.2040108@cnpapers.com> Message-ID: <4A09477D575C2C4B86497161427DD94C162F20F527@city-exchange07> Steve Campbell wrote: > Overtime time: > > How do most of you who have multiple domains route your mail through > a singular gateway running MS to multiple mail hubs (server with > mailboxes)? > > I'd like to consolidate my mail servers running sendmail and MS into > one gateway. Right now, I have one server per domain, but see no > reason why I can't put up a single incoming gateway for all domains > which could route the mail to the mail hubs. > > I've used SmartHost for a single instance of domains, and think I > could use virtual table , but just thought I'd ask. > > steve campbell I don't think I'd go w/just one MS gateway. Eggs, basket, that sort of thing. It's really handy being able to update/upgrade a gateway server and the users never notice the difference. They're all connecting to an internal Exchange server. Being able to bring my MailScanner boxes up or down w/o them noticing is a real treat. I service several domains and just use the mailertable to route to the appropriate inside host. I don't use the virtual table at all. At the gateway level I don't care about users so much as domains. I do use smf-sav to verify recipients at the gateway but then just send the messages to the appropriate server. Works well for us... I'm running sendmail FWIW... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From mailscanner at pdscc.com Thu Jun 23 21:26:53 2011 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Jun 23 21:27:14 2011 Subject: how to allow mobile user to send email with getting blocked In-Reply-To: <9a092fde-9d8d-4271-9e41-ac51ab23af04@cronlabworkstation0> References: <20110620162057.EFAC51A30@sinclaire.sibble.net>, <9a092fde-9d8d-4271-9e41-ac51ab23af04@cronlabworkstation0> Message-ID: <20110623202654.E5A345A1C82@sinclaire.sibble.net> the trust is already in place, added the line to the machine authenticating users and it was still marking them as spam on the MS/SA machine :-( On 21 Jun 2011 at 8:06, Markus Nilsson wrote: > Hi Harondel, > > With my example, add this rule (smtpd_sasl_authenticated_header = yes) to the > postfix machine where the users login, and on the second machine (where MS/SA > is running) make sure that the first machine is "trusted" by adding it to the > mynetworks setting! > > BR/ > Markus > > ----- Ursprungligt meddelande ----- > > Fr?n: "Harondel J. Sibble" > Till: "MailScanner discussion" > Skickat: m?ndag, 20 jun 2011 18:20:53 > ?mne: Re: how to allow mobile user to send email with getting blocked > > Just so I am clear, you are suggesting I put this in postfix on the > mailscanner machine, rather than in postfix on the protected imap server > behind mailscanner right? > > As to changing the headers in the mailclient, it doesn't appear that K-9 on > Android supports that :-( > > On 20 Jun 2011 at 8:52, Markus Nilsson wrote: > > > In postfix I solve this by setting > > smtpd_sasl_authenticated_header = yes That by-passes network checks in SA if > > the header comes from a trusted source, and the host receiving the > > connection from your remote users is trusted I guess? > > > > This disables RBL-checks at SA, if you need even more negative scoring, you > > can modify the score for ALL_TRUSTED > > > > /Markus > > > > > > ----- Ursprungligt meddelande ----- > > > > Fr?n: "Harondel J. Sibble" > > Till: "MailScanner discussion" > > Skickat: fredag, 17 jun 2011 18:22:10 > > ?mne: Re: how to allow mobile user to send email with getting blocked > > > > Didn't find that one in my search, thanks. > > > > Not sure I understand fully, I use postfix and haven't touched sendmail in > > years. Are you suggesting adding an additional header at the mail client > > level that is then processed by the mta/ms? > > > > I'n not convinced that's something I can fully control on the various mail > > clients on the phones, it's just the same as using ssl client certs. Not all > > devices support it. > > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > > Bearcom scanned this message. We don't think it was spam. If it was, > please report by copying this link into your browser: > http://message4.bearnet.nu/mail/index.php?id=C3485ADE0AA.A721F-&learn=spam&hos > t=212.91.140.36 > > > > > > > -- > This message has been scanned for viruses and dangerous content by Bearcom > (www.bearcom.se), and is believed to be clean. > > -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From J.Ede at birchenallhowden.co.uk Thu Jun 23 21:04:54 2011 From: J.Ede at birchenallhowden.co.uk (Jason Ede) Date: Thu Jun 23 21:59:37 2011 Subject: OT - one gateway to multiple mail hubs/domains In-Reply-To: <4E0396B7.2040108@cnpapers.com> References: <4E0396B7.2040108@cnpapers.com> Message-ID: I use postfix and just use transports to determine where to deliver email for a particular domain. As long as there is spare capacity on your MailScanner server then can just add domains as required. Have started to look at mysql configuration for postfix so everything can be managed through a nice interface. Jason > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner- > bounces@lists.mailscanner.info] On Behalf Of Steve Campbell > Sent: 23 June 2011 20:41 > To: mailscanner@lists.mailscanner.info > Subject: OT - one gateway to multiple mail hubs/domains > > Overtime time: > > How do most of you who have multiple domains route your mail through a > singular gateway running MS to multiple mail hubs (server with mailboxes)? > > I'd like to consolidate my mail servers running sendmail and MS into one > gateway. Right now, I have one server per domain, but see no reason why I > can't put up a single incoming gateway for all domains which could route the > mail to the mail hubs. > > I've used SmartHost for a single instance of domains, and think I could use > virtual table , but just thought I'd ask. > > steve campbell > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ecasarero at gmail.com Thu Jun 23 22:03:54 2011 From: ecasarero at gmail.com (Eduardo Casarero) Date: Thu Jun 23 22:04:18 2011 Subject: OT - one gateway to multiple mail hubs/domains In-Reply-To: <4E0396B7.2040108@cnpapers.com> References: <4E0396B7.2040108@cnpapers.com> Message-ID: 2011/6/23 Steve Campbell > Overtime time: > > How do most of you who have multiple domains route your mail through a > singular gateway running MS to multiple mail hubs (server with mailboxes)? > > I'd like to consolidate my mail servers running sendmail and MS into one > gateway. Right now, I have one server per domain, but see no reason why I > can't put up a single incoming gateway for all domains which could route the > mail to the mail hubs. > > I've used SmartHost for a single instance of domains, and think I could use > virtual table , but just thought I'd ask. > > steve campbell > > Just like previous answers, that should be easy to solve with postfix/transport or sendmail/mailertable just pay attention if you have different configs per domain in MS. but it should work like a charm. > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info > http://lists.mailscanner.info/**mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/**posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110623/b535df9a/attachment.html From jakari at bithose.com Thu Jun 23 22:10:42 2011 From: jakari at bithose.com (Jameel Akari) Date: Thu Jun 23 22:11:28 2011 Subject: OT - one gateway to multiple mail hubs/domains In-Reply-To: <4E0396B7.2040108@cnpapers.com> References: <4E0396B7.2040108@cnpapers.com> Message-ID: On Thu, 23 Jun 2011, Steve Campbell wrote: > Overtime time: > > How do most of you who have multiple domains route your mail through a > singular gateway running MS to multiple mail hubs (server with mailboxes)? > > I'd like to consolidate my mail servers running sendmail and MS into one > gateway. Right now, I have one server per domain, but see no reason why I > can't put up a single incoming gateway for all domains which could route the > mail to the mail hubs. In ssendmail, I use mailertable. If you have multiple internal mailbox servers for a given recepient domain, you can also setup some internal-only MX records to use in those mailertable entries, and get some simple yet fairly robust load-balancing and failover. We have two MailScanner front-ends for all of our domains (soon to be four, so I can finally upgrade to a non-ancient MailScanner) and I've been doing routing this way for years. Very handy, quite flexible. -- Jameel Akari From richard at fastnet.co.uk Fri Jun 24 11:19:39 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Fri Jun 24 11:19:53 2011 Subject: SaneSecurity Message-ID: <1251B5423222C446A299CABAA7B46FF414B696@fn-exchange.fastnet.local> Hi, None of my sane signatures are being applied to the SA scores. They get tagged in the headers but not in the SA score. I have MailScanner-4.83.5 version (FreeBSD - via a shar from the maintainer), they don't work. On another version, MailScanner-4.83.4 they work fine. Any ideas to a fix on this? I don't see any problems on --lint. Many thanks, Rich -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110624/5ec9ac7f/attachment.html From richard at fastnet.co.uk Fri Jun 24 11:23:27 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Fri Jun 24 11:23:39 2011 Subject: Spam Viruses In-Reply-To: References: Message-ID: <1251B5423222C446A299CABAA7B46FF414B6BD@fn-exchange.fastnet.local> Hi Jase, I'm having the same problem here. I think this is something to do with the latest fix on removing the spaces from the virus names. I might need to revert to a older version to get around this for now. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Desai, Jason Sent: 17 June 2011 16:07 To: MailScanner discussion Subject: Spam Viruses I have some emails coming in that are being caught by Sophos as >>> Virus 'Mal/Phish-A' found in file ./1QXX4J-0005TS-O7/PayPal - Restore Your Account.htm And in MailScanner.conf I have Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/* *Phish* So I would expect the above email to be tagged as a spam-virus. However, it is not. Looking at the code, it looks to me like spam viruses are only checked for ClamAV and Fprot6. Is this an oversight, or by design? Using MailScanner 4.83.5. Jase - This message is intended only for the addressee and may contain information that is company confidential or privileged. Any technical data in this message may be exported only in accordance with the U.S. International Traffic in Arms Regulations (22 CFR Parts 120-130) or the Export Administration Regulations (15 CFR Parts 730-774). Unauthorized use is strictly prohibited and may be unlawful. If you are not the intended recipient, or the person responsible for delivering to the intended recipient, you should not read, copy, disclose or otherwise use this message. If you have received this email in error, please delete it, and advise the sender immediately. - -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From Johan at double-l.nl Fri Jun 24 12:16:58 2011 From: Johan at double-l.nl (Johan Hendriks) Date: Fri Jun 24 12:17:17 2011 Subject: SaneSecurity In-Reply-To: <1251B5423222C446A299CABAA7B46FF414B696@fn-exchange.fastnet.local> References: <1251B5423222C446A299CABAA7B46FF414B696@fn-exchange.fastnet.local> Message-ID: <6C3F8332272B7D4DA26909F15F1C90E1DD9E65@SRV01.double-l.local> Hi, None of my sane signatures are being applied to the SA scores. They get tagged in the headers but not in the SA score. I have MailScanner-4.83.5 version (FreeBSD - via a shar from the maintainer), they don't work. On another version, MailScanner-4.83.4 they work fine. Any ideas to a fix on this? I don't see any problems on --lint. Many thanks, Rich I did an update on FreeBSD also, and i noticed some strange things also. After some investigation, it became clear that /usr/local/etc/MailScanner/spam.assassin.prefs.conf was no longer linked to /usr/local/etc/mail/spamassassin. Maybe linking /usr/local/etc/MailScanner/spam.assassin.prefs.conf to /usr/local/etc/mail/spamassassin solves your problem. Al versions before 4.83.5 had the file mailscanner.cf linked to /usr/local/etc/MailScanner/spam.assassin.prefs.conf ms03 # cd /usr/local/etc/mail/spamassassin/ ms03 spamassassin # ls -al total 374 drwxr-xr-x 3 root wheel 1024 Jun 24 13:13 . drwxr-xr-x 3 root wheel 512 Jul 17 2009 .. -rw-r--r-- 1 root wheel 1299 Jun 23 09:28 init.pre lrwxr-xr-x 1 root wheel 51 Jun 24 13:13 mailscanner.cf -> /usr/local/etc/MailScanner/spam.assassin.prefs.conf -rw-r--r-- 1 root wheel 2602 Jul 21 2009 v310.pre -rw-r--r-- 1 root wheel 1194 Jun 23 09:28 v312.pre -rw-r--r-- 1 root wheel 2416 Jun 23 09:28 v320.pre -rw-r--r-- 1 root wheel 1237 Jun 23 09:28 v330.pre ms03 spamassassin # hope this helps. Regards, Johan Hendriks Double L Automatisering -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110624/475f7abb/attachment.html From richard at fastnet.co.uk Fri Jun 24 12:49:23 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Fri Jun 24 12:49:37 2011 Subject: SaneSecurity In-Reply-To: <6C3F8332272B7D4DA26909F15F1C90E1DD9E65@SRV01.double-l.local> References: <1251B5423222C446A299CABAA7B46FF414B696@fn-exchange.fastnet.local> <6C3F8332272B7D4DA26909F15F1C90E1DD9E65@SRV01.double-l.local> Message-ID: <1251B5423222C446A299CABAA7B46FF414B7A4@fn-exchange.fastnet.local> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Johan Hendriks Sent: 24 June 2011 12:17 To: MailScanner discussion Subject: RE: SaneSecurity Hi, None of my sane signatures are being applied to the SA scores. They get tagged in the headers but not in the SA score. I have MailScanner-4.83.5 version (FreeBSD - via a shar from the maintainer), they don't work. On another version, MailScanner-4.83.4 they work fine. Any ideas to a fix on this? I don't see any problems on --lint. Many thanks, Rich I did an update on FreeBSD also, and i noticed some strange things also. After some investigation, it became clear that /usr/local/etc/MailScanner/spam.assassin.prefs.conf was no longer linked to /usr/local/etc/mail/spamassassin. Maybe linking /usr/local/etc/MailScanner/spam.assassin.prefs.conf to /usr/local/etc/mail/spamassassin solves your problem. Al versions before 4.83.5 had the file mailscanner.cf linked to /usr/local/etc/MailScanner/spam.assassin.prefs.conf ms03 # cd /usr/local/etc/mail/spamassassin/ ms03 spamassassin # ls -al total 374 drwxr-xr-x 3 root wheel 1024 Jun 24 13:13 . drwxr-xr-x 3 root wheel 512 Jul 17 2009 .. -rw-r--r-- 1 root wheel 1299 Jun 23 09:28 init.pre lrwxr-xr-x 1 root wheel 51 Jun 24 13:13 mailscanner.cf -> /usr/local/etc/MailScanner/spam.assassin.prefs.conf -rw-r--r-- 1 root wheel 2602 Jul 21 2009 v310.pre -rw-r--r-- 1 root wheel 1194 Jun 23 09:28 v312.pre -rw-r--r-- 1 root wheel 2416 Jun 23 09:28 v320.pre -rw-r--r-- 1 root wheel 1237 Jun 23 09:28 v330.pre ms03 spamassassin # hope this helps. Regards, Johan Hendriks Double L Automatisering Hi Johan, Thanks for this. I should have spotted that.. All working again now! Rich -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110624/0db76f7f/attachment.html From gdr at gno.org Fri Jun 24 16:04:02 2011 From: gdr at gno.org (Devin Reade) Date: Fri Jun 24 16:08:29 2011 Subject: OT - one gateway to multiple mail hubs/domains In-Reply-To: <4A09477D575C2C4B86497161427DD94C162F20F527@city-exchange07> References: <4E0396B7.2040108@cnpapers.com> <4A09477D575C2C4B86497161427DD94C162F20F527@city-exchange07> Message-ID: <4DCD2D3A10B75EABA2E528E4@eich.gno.org> --On Thursday, June 23, 2011 12:04:20 PM -0800 Kevin Miller wrote: > Steve Campbell wrote: >> >> How do most of you who have multiple domains route your mail through >> a singular gateway running MS to multiple mail hubs (server with >> mailboxes)? > > I don't think I'd go w/just one MS gateway. Eggs, basket, that sort of > thing. It's really handy being able to update/upgrade a gateway server > and the users never notice the difference. I'll second that. Multiple MX records to multiple mailscanners to handle normal inbound traffic, plus a mobile IP in a clustered configuration to handle road warriors works wonders (but that's getting more OT). I don't think you mentioned your MDA, but if you're in the situation where you're needing multiple multiple servers to handle the mailbox load, Cyrus Murder is a robust and scalable solution. Cyrus can also be easily clustered if you also have to handle failover at the MDA level. Devin From richard at fastnet.co.uk Fri Jun 24 16:36:43 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Fri Jun 24 16:36:57 2011 Subject: Mailscanner crashed. Message-ID: <1251B5423222C446A299CABAA7B46FF414B99E@fn-exchange.fastnet.local> Hi, I've put my signatures back with the link, but all my nodes started crashing with the message - Quarantined message p5OCISoJ080926 as it caused MailScanner to crash several times There is a signature that is causing this issue. Does anyone know which one it is? I've had to remove all of them for the time being, as it causes my nodes to crash with all different versions of perl. Many thanks, Rich -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110624/85ff2b4c/attachment.html From MailScanner at ecs.soton.ac.uk Sat Jun 25 21:14:07 2011 From: MailScanner at ecs.soton.ac.uk (Jules Field) Date: Sat Jun 25 21:14:17 2011 Subject: Released fix for taint errors References: <4E06418F.4060307@ecs.soton.ac.uk> Message-ID: I have just released version 4.84.1 beta, which I hope will avoid the taint errors that have been plaguing people running new versions of Perl. Please let me know how you get on. Sorry for the lack of contact, I've been really busy at work and some other stuff isn't going too well right now. Many thanks to all of you for providing support for users despite my absence, it is very much appreciated! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM 'Teach a man to reason, and he will think for a lifetime.' - Phil Plait 'All programs have a desire to be useful' - Tron, 1982 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From alex at vidadigital.com.pa Mon Jun 27 00:15:54 2011 From: alex at vidadigital.com.pa (Alex Neuman) Date: Mon Jun 27 00:16:05 2011 Subject: Released fix for taint errors In-Reply-To: References: <4E06418F.4060307@ecs.soton.ac.uk> Message-ID: Hope your other stuff starts to go well again... :-) On Sat, Jun 25, 2011 at 3:14 PM, Jules Field wrote: > I have just released version 4.84.1 beta, which I hope will avoid the taint > errors that have been plaguing people running new versions of Perl. > > Please let me know how you get on. > > Sorry for the lack of contact, I've been really busy at work and some other > stuff isn't going too well right now. > > Many thanks to all of you for providing support for users despite my > absence, it is very much appreciated! > > Jules > > -- > Julian Field MEng CITP CEng > www.MailScanner.info > > Buy the MailScanner book at www.MailScanner.info/store > Need help customising MailScanner? Contact me! > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > Follow me at twitter.com/JulesFM > > 'Teach a man to reason, and he will think for a lifetime.' - Phil Plait > ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 'All programs have a desire to be useful' > - Tron, 1982 > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From john at tradoc.fr Mon Jun 27 08:35:13 2011 From: john at tradoc.fr (John Wilcock) Date: Mon Jun 27 08:35:31 2011 Subject: Released fix for taint errors In-Reply-To: References: <4E06418F.4060307@ecs.soton.ac.uk> Message-ID: <4E0832B1.3090507@tradoc.fr> Le 25/06/2011 22:14, Jules Field a ?crit : > I have just released version 4.84.1 beta, which I hope will avoid the > taint errors that have been plaguing people running new versions of Perl. > > Please let me know how you get on. > > Sorry for the lack of contact, I've been really busy at work and some > other stuff isn't going too well right now. > > Many thanks to all of you for providing support for users despite my > absence, it is very much appreciated! Hi Jules, Firstly, good luck with the "other stuff". Secondly, thanks for this fix. You're nearly there, but there are a few left I'm afraid: > Insecure dependency in open while running with -T switch at /usr/lib64/perl5/vendor_perl/5.12.3/x86_64-linux/IO/File.pm line 185, <$fh> line 6. > Insecure dependency in open while running with -T switch at /usr/lib64/perl5/vendor_perl/5.12.3/x86_64-linux/IO/File.pm line 185. > Insecure dependency in chown while running with -T switch at /usr/lib/MailScanner/MailScanner/Message.pm line 1381. > Insecure dependency in chown while running with -T switch at /usr/lib/MailScanner/MailScanner/Message.pm line 1381. > Insecure dependency in chown while running with -T switch at /usr/lib/MailScanner/MailScanner/Message.pm line 1381. This is on a gentoo box, so perl modules may not be the same versions as those in your tarballs. See MailScanner --version output below: > This is Perl version 5.012003 (5.12.3) > > This is MailScanner version 4.84.1 > Module versions are: > 1.00 AnyDBM_File > 1.30 Archive::Zip > 0.23 bignum > 1.17 Carp > 2.02401 Compress::Zlib > 1.119 Convert::BinHex > 0.17 Convert::TNEF > 2.125 Data::Dumper > 2.27 Date::Parse > 1.03 DirHandle > 1.06 Fcntl > 2.78 File::Basename > 2.18 File::Copy > 2.02 FileHandle > 2.08_01 File::Path > 0.22 File::Temp > 0.92 Filesys::Df > 3.64 HTML::Entities > 3.67 HTML::Parser > 3.57 HTML::TokeParser > 1.25 IO > 1.14 IO::File > 1.13 IO::Pipe > 2.06 Mail::Header > 1.89_01 Math::BigInt > 0.24 Math::BigRat > 3.08 MIME::Base64 > 5.427 MIME::Decoder > 5.427 MIME::Decoder::UU > 5.427 MIME::Head > 5.427 MIME::Parser > 3.08 MIME::QuotedPrint > 5.427 MIME::Tools > 0.14 Net::CIDR > 1.25 Net::IP > 0.19 OLE::Storage_Lite > 1.04 Pod::Escapes > 3.14 Pod::Simple > 1.19 POSIX > 1.23 Scalar::Util > 1.87_01 Socket > 2.20 Storable > 1.4 Sys::Hostname::Long > 0.27 Sys::Syslog > missing Test::Pod > 0.94 Test::Simple > 1.9719 Time::HiRes > 1.02 Time::localtime > > Optional module versions are: > 1.54 Archive::Tar > 0.23 bignum > missing Business::ISBN > missing Business::ISBN::Data > missing Data::Dump > 1.82 DB_File > 1.31 DBD::SQLite > 1.615 DBI > 1.16 Digest > 1.01 Digest::HMAC > 2.39 Digest::MD5 > 2.12 Digest::SHA1 > 1.01 Encode::Detect > 0.17016 Error > 0.2703 ExtUtils::CBuilder > 2.2205 ExtUtils::ParseXS > 2.38 Getopt::Long > missing Inline > missing IO::String > 1.10 IO::Zlib > 2.23 IP::Country > missing Mail::ClamAV > 3.003002 Mail::SpamAssassin > v2.007 Mail::SPF > missing Mail::SPF::Query > 0.3607 Module::Build > missing Net::CIDR::Lite > 0.66 Net::DNS > v0.003 Net::DNS::Resolver::Programmable > missing Net::LDAP > 4.028 NetAddr::IP > missing Parse::RecDescent > missing SAVI > 3.17 Test::Harness > missing Test::Manifest > 2.02 Text::Balanced > 1.55 URI > 0.82 version > missing YAML John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From MailScanner at ecs.soton.ac.uk Mon Jun 27 09:27:55 2011 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Jun 27 09:28:09 2011 Subject: Released fix for taint errors In-Reply-To: <4E0832B1.3090507@tradoc.fr> References: <4E06418F.4060307@ecs.soton.ac.uk> <4E0832B1.3090507@tradoc.fr> <4E083F0B.50806@ecs.soton.ac.uk> Message-ID: On 27/06/2011 08:35, John Wilcock wrote: > Le 25/06/2011 22:14, Jules Field a ?crit : >> I have just released version 4.84.1 beta, which I hope will avoid the >> taint errors that have been plaguing people running new versions of >> Perl. >> >> Please let me know how you get on. >> >> Sorry for the lack of contact, I've been really busy at work and some >> other stuff isn't going too well right now. >> >> Many thanks to all of you for providing support for users despite my >> absence, it is very much appreciated! > > Hi Jules, > > Firstly, good luck with the "other stuff". Thanks. It's vaguely medical inevitably... At least it doesn't involve anyone else :) > > Secondly, thanks for this fix. You're nearly there, but there are a > few left I'm afraid: > >> Insecure dependency in open while running with -T switch at >> /usr/lib64/perl5/vendor_perl/5.12.3/x86_64-linux/IO/File.pm line 185, >> <$fh> line 6. >> Insecure dependency in open while running with -T switch at >> /usr/lib64/perl5/vendor_perl/5.12.3/x86_64-linux/IO/File.pm line 185. Not sure quite how to fix this one as it doesn't tell me where I am calling File.pm from. :-( >> Insecure dependency in chown while running with -T switch at >> /usr/lib/MailScanner/MailScanner/Message.pm line 1381. >> Insecure dependency in chown while running with -T switch at >> /usr/lib/MailScanner/MailScanner/Message.pm line 1381. >> Insecure dependency in chown while running with -T switch at >> /usr/lib/MailScanner/MailScanner/Message.pm line 1381. Replace line 1381 with these 4 lines: $tempid = $this->{id}; $tempid =~ /^(.*)$/; $tempid = $1; chown $uid, $gid, "$spamdir/" . $tempid; # Harmless if this fails and then let me know if that gets rid of that one. If you can possibly track down where the File.pm error comes from, it would be a great help. Unfortunately it's in the "open()" function, which opens a file. Something MailScanner does rather a lot of! Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM 'All programs have a desire to be useful' - Tron, 1982 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From john at tradoc.fr Mon Jun 27 09:51:03 2011 From: john at tradoc.fr (John Wilcock) Date: Mon Jun 27 09:51:21 2011 Subject: Released fix for taint errors In-Reply-To: References: <4E06418F.4060307@ecs.soton.ac.uk> <4E0832B1.3090507@tradoc.fr> <4E083F0B.50806@ecs.soton.ac.uk> Message-ID: <4E084477.3070205@tradoc.fr> Le 27/06/2011 10:27, Julian Field a ?crit : > Replace line 1381 with these 4 lines: > $tempid = $this->{id}; > $tempid =~ /^(.*)$/; > $tempid = $1; > chown $uid, $gid, "$spamdir/" . $tempid; # Harmless if this fails > > and then let me know if that gets rid of that one. That gave me Global symbol "$tempid" requires explicit package name at /usr/lib/MailScanner/MailScanner/Message.pm line 1381. (and on the following lines too of course). Qualifying the first $tempid with a "my" did the trick. However the error on IO::File remains. > If you can possibly track down where the File.pm error comes from, it > would be a great help. Unfortunately it's in the "open()" function, > which opens a file. Something MailScanner does rather a lot of! Any suggestions as to how I might go about that? John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From john at tradoc.fr Mon Jun 27 10:53:13 2011 From: john at tradoc.fr (John Wilcock) Date: Mon Jun 27 10:53:32 2011 Subject: Released fix for taint errors In-Reply-To: <4E084477.3070205@tradoc.fr> References: <4E06418F.4060307@ecs.soton.ac.uk> <4E0832B1.3090507@tradoc.fr> <4E083F0B.50806@ecs.soton.ac.uk> <4E084477.3070205@tradoc.fr> Message-ID: <4E085309.4080202@tradoc.fr> Le 27/06/2011 10:51, John Wilcock a ?crit : >> If you can possibly track down where the File.pm error comes from, it >> would be a great help. Unfortunately it's in the "open()" function, >> which opens a file. Something MailScanner does rather a lot of! > > Any suggestions as to how I might go about that? Replying to myself, presumably just about the only way is to put in print("blabla") statements before and after every open() call. I might have time to give that a go this afternoon - unless you can suggest a better method... John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From MailScanner at ecs.soton.ac.uk Mon Jun 27 11:41:13 2011 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Mon Jun 27 11:41:31 2011 Subject: Released fix for taint errors In-Reply-To: <4E085309.4080202@tradoc.fr> References: <4E06418F.4060307@ecs.soton.ac.uk> <4E0832B1.3090507@tradoc.fr> <4E083F0B.50806@ecs.soton.ac.uk> <4E084477.3070205@tradoc.fr> <4E085309.4080202@tradoc.fr> <4E085E49.4040407@ecs.soton.ac.uk> Message-ID: On 27/06/2011 10:53, John Wilcock wrote: > Le 27/06/2011 10:51, John Wilcock a ?crit : >>> If you can possibly track down where the File.pm error comes from, it >>> would be a great help. Unfortunately it's in the "open()" function, >>> which opens a file. Something MailScanner does rather a lot of! >> >> Any suggestions as to how I might go about that? > > Replying to myself, presumably just about the only way is to put in > print("blabla") statements before and after every open() call. I might > have time to give that a go this afternoon - unless you can suggest a > better method... Yes, that's the only way. A pain, I agree. Jules -- Julian Field MEng CITP CEng www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Need help customising MailScanner? Contact me! PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me at twitter.com/JulesFM 'All programs have a desire to be useful' - Tron, 1982 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From john at tradoc.fr Mon Jun 27 14:22:19 2011 From: john at tradoc.fr (John Wilcock) Date: Mon Jun 27 14:22:37 2011 Subject: Released fix for taint errors In-Reply-To: References: <4E06418F.4060307@ecs.soton.ac.uk> <4E0832B1.3090507@tradoc.fr> <4E083F0B.50806@ecs.soton.ac.uk> <4E084477.3070205@tradoc.fr> <4E085309.4080202@tradoc.fr> <4E085E49.4040407@ecs.soton.ac.uk> Message-ID: <4E08840B.70803@tradoc.fr> Le 27/06/2011 12:41, Julian Field a ?crit : >> Replying to myself, presumably just about the only way is to put in >> print("blabla") statements before and after every open() call. I might >> have time to give that a go this afternoon - unless you can suggest a >> better method... > Yes, that's the only way. A pain, I agree. Well, I've just spent over an hour gradually inserting print() statements and running debug sessions, but have failed to pin down the tainted open() call. Either I missed something (possible) or the tainted open() is done indirectly by something that MS calls, but I'm at a loss as to where to look next (not to mention that I've got Real Work? to do!). John. -- -- Over 4000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr From uxbod at splatnix.net Mon Jun 27 20:51:24 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Mon Jun 27 20:51:43 2011 Subject: Custom Function Message-ID: Jules, is there any way to call a custom function per email like AlwaysLookedUpLast does ? Or would that involve modifying the main MailScanner code to add a new capability ? -- Thanks, Phil -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110627/f4ce54d1/attachment.html From uxbod at splatnix.net Mon Jun 27 22:59:03 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Mon Jun 27 22:59:16 2011 Subject: Custom Function In-Reply-To: Message-ID: ----- Original Message ----- > Jules, > is there any way to call a custom function per email like > AlwaysLookedUpLast does ? Or would that involve modifying the main > MailScanner code to add a new capability ? Hmm, I believe it actually makes more sense to duplicate the CheckAttachmentSizes() size function in SweepContent.pm and add some new configurable parameters eg. ZendToURL ZendToAccessKey ZendToMinMessageSize ZendToMaxMessageSize This was individual attachments can be checked, stripped, added to an array then a single call to ZendTo to create the dropoff and the add the passcode as a text attachment. -- Thanks, Phil From ecasarero at gmail.com Mon Jun 27 23:44:34 2011 From: ecasarero at gmail.com (Eduardo Casarero) Date: Mon Jun 27 23:45:00 2011 Subject: Fwd: [spamassasin-news] EMERGENCY: SEM rules mistakenly enabled again In-Reply-To: <4E08F84E.60603@togami.com> References: <4E08F84E.60603@togami.com> Message-ID: FYI. ---------- Forwarded message ---------- From: Warren Togami Jr. Date: 2011/6/27 Subject: [spamassasin-news] EMERGENCY: SEM rules mistakenly enabled again To: spamassassin-news@lists.fedoraproject.org http://www.spamtips.org/2011/06/emergency-sem-rules-mistaken-enabled.html Due to a bug in the rule auto-promotion system, SEM rules were again mistakenly pushed to the active rules, causing a flood of unexpected DNS queries to this service provider. A very similar issue happened back in March 2011. Upstream spamassassin needs to make an emergency sa-update rule update to correct this situation. Meanwhile, all spamassassin admins should mitigate this issue by adding the following workaround to their local.cf then restarting their spamd. score T_RCVD_IN_SEMBLACK 0 score T_URIBL_SEM 0 score T_URIBL_SEM_FRESH 0 score T_URIBL_SEM_FRESH_10 0 score T_URIBL_SEM_FRESH_15 0 score T_URIBL_SEM_RED 0 http://www.spamtips.org/2011/06/apache-spamassassin-332-released.html This bug was introduced simultaneously with the release of Spamassassin 3.3.2. But since it was pushed in the sa-update channel, 3.3.1 users are now effected. Everyone should still upgrade to 3.3.2 in order to fix other bugs. Warren Togami warren@togami.com _______________________________________________ spamassassin-news mailing list spamassassin-news@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/spamassassin-news -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110627/90f452fe/attachment.html From richard at fastnet.co.uk Tue Jun 28 15:00:26 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Tue Jun 28 15:00:39 2011 Subject: Clamd crashed. Message-ID: <1251B5423222C446A299CABAA7B46FF414EBED@fn-exchange.fastnet.local> From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Richard Mealing Sent: 24 June 2011 16:37 To: MailScanner discussion (mailscanner@lists.mailscanner.info) Subject: Mailscanner crashed. Hi, I've put my signatures back with the link, but all my nodes started crashing with the message - Quarantined message p5OCISoJ080926 as it caused MailScanner to crash several times There is a signature that is causing this issue. Does anyone know which one it is? I've had to remove all of them for the time being, as it causes my nodes to crash with all different versions of perl. Many thanks, Rich Hi, My clamd just crashed out again, I put these back into the loop and everything was fine for a few hours, then I get the usual; Making attempt 3 at processing.... It just doesn't process any mail until I remove all the extra databases and restart clamd, everything is now processing and going out again. I am using the following - junk.ndb jurlbl.ndb phish.ndb rogue.hdb sanesecurity.ftm scam.ndb spamimg.hdb spamattach.hdb sigwhitelist.ign2 I'm now using the latest version of clamd, I get this problem on 64 / 32 bit machines, different versions of perl etc. Can anyone confirm which database would be causing this problem and why? Rich -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110628/fe0f81d3/attachment.html From uxbod at splatnix.net Tue Jun 28 21:25:18 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Tue Jun 28 21:43:08 2011 Subject: Custom Function In-Reply-To: Message-ID: <4d52ff47-b2fe-490d-99a6-7092f5a520b5@office.splatnix.net> ----- Original Message ----- > ----- Original Message ----- > > > Jules, > > > is there any way to call a custom function per email like > > AlwaysLookedUpLast does ? Or would that involve modifying the main > > MailScanner code to add a new capability ? > > Hmm, I believe it actually makes more sense to duplicate the > CheckAttachmentSizes() size function in SweepContent.pm and add some > new configurable parameters eg. > > ZendToURL > ZendToAccessKey > ZendToMinMessageSize > ZendToMaxMessageSize > > This was individual attachments can be checked, stripped, added to an > array then a single call to ZendTo to create the dropoff and the add > the passcode as a text attachment. I have added into MessageBatch.pm a call to a new module called ZendTo.pm but when I run in debug mode I get: Undefined subroutine &MailScanner::ZendTo::ScanBatch called at /usr/lib/MailScanner/MailScanner/MessageBatch.pm line 574. looking at SweepContent.pm I appear to be making the correct call and registering the package: package MailScanner::ZendTo; and if I execute perl -wc ZendTo.pm it lints okay: perl -wc ZendTo.pm Name "global::MS" used only once: possible typo at ZendTo.pm line 109. ZendTo.pm syntax OK Do I need to be doing anything else ? -- Thanks, Phil From maillists at conactive.com Wed Jun 29 13:31:13 2011 From: maillists at conactive.com (Kai Schaetzl) Date: Wed Jun 29 13:31:25 2011 Subject: Clamd crashed. In-Reply-To: <1251B5423222C446A299CABAA7B46FF414EBED@fn-exchange.fastnet.local> References: <1251B5423222C446A299CABAA7B46FF414EBED@fn-exchange.fastnet.local> Message-ID: Richard Mealing wrote on Tue, 28 Jun 2011 14:00:26 +0000: > Can anyone confirm which database would be causing this problem and why? because it is a third-party add-on that is not fully compatible with the latest clamd? You should ask on a clamd mailing list, not here. There is a reason why many administrators do not add any third-party db's. There's also a reason why SA does such tests, the FP risk is *much* lower. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com From vernon at comp-wiz.com Wed Jun 29 23:25:56 2011 From: vernon at comp-wiz.com (Vernon Webb) Date: Wed Jun 29 23:37:21 2011 Subject: Is the Anti-Virus installed or not? Message-ID: <024B7D3DF59FF841B9D48FC091024D9F5D30F0@server.home.comp-wiz.com> Below is a message I am getting when doing a lint test on a new MailScanner install on a CentOS box with the latest MailScanner build and the ClamAV download from the MailSacnner.info website. I'm confused as I have Free AVG and Clam installed however it gives conflicting info in the output below. First it says there are no virus scanners installed and this is bad, then it says there was a virus found. So is it using calm and AVG or no? Thanks Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. I have found scanners installed, and will use them all by default. You appear to have no virus scanners installed at all! This is not good. If you have installed any, then check your virus.scanners.conf file to make sure the locations of your scanners are correct at /usr/lib/MailScanner/MailScanner/SweepViruses.pm line 518 Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 0 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = auto" Found these virus scanners installed: ======================================================================== === Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting ======================================================================== === If any of your virus scanners () are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. From iveymr at gmail.com Thu Jun 30 02:10:46 2011 From: iveymr at gmail.com (Ryan Ivey) Date: Thu Jun 30 02:10:55 2011 Subject: Is the Anti-Virus installed or not? In-Reply-To: <024B7D3DF59FF841B9D48FC091024D9F5D30F0@server.home.comp-wiz.com> References: <024B7D3DF59FF841B9D48FC091024D9F5D30F0@server.home.comp-wiz.com> Message-ID: On Wed, Jun 29, 2011 at 6:25 PM, Vernon Webb wrote: > Below is a message I am getting when doing a lint test on a new > MailScanner install on a CentOS box with the latest MailScanner build > and the ClamAV download from the MailSacnner.info website. I'm confused > as I have Free AVG and Clam installed however it gives conflicting info > in the output below. First it says there are no virus scanners installed > and this is bad, then it says there was a virus found. It doesn't say it found a virus, it says it found a problem. > So is it using > calm and AVG or no? Thanks > > No, you should be seeing something telling you it's installed and then a test check on eicar, for example: MailScanner.conf says "Virus Scanners = clamd" Found these virus scanners installed: clamd =========================================================================== Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com Virus Scanning: Clamd found 1 infections Infected message 1 came from 10.1.1.1 Virus Scanning: Found 1 viruses =========================================================================== In MailScanner.conf you have VirusScanners set to auto which *should* be finding both. Try setting explicitly to either clam or avg. Sounds like you need to verify that the scanners are in fact installed. Ryan Ivey www.initialss.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110629/6b486255/attachment.html From vernon at comp-wiz.com Thu Jun 30 04:22:20 2011 From: vernon at comp-wiz.com (Vernon Webb) Date: Thu Jun 30 04:33:44 2011 Subject: Is the Anti-Virus installed or not? In-Reply-To: References: <024B7D3DF59FF841B9D48FC091024D9F5D30F0@server.home.comp-wiz.com> Message-ID: <024B7D3DF59FF841B9D48FC091024D9F5D30F1@server.home.comp-wiz.com> Not sure what the problem was, but I uninstalled and reinstalled clam and it is working now, not sure why it's not picking up AVG, but at least I got clam working ~v From bbecken at aafp.org Thu Jun 30 14:58:27 2011 From: bbecken at aafp.org (Brad Beckenhauer) Date: Thu Jun 30 14:59:01 2011 Subject: Clamav and Spamassassin update Message-ID: <4E0C3AB30200006800090A7F@smtp.aafp.org> Julian, Since both the ClamAV (v0.97.1) and Spamassassin (v3.3.2) packages have been updated this month, would you please look at updating your handy installer on the MailScanner website. thank you Brad -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20110630/e5135f01/attachment.html From agross at gcpsite.com Thu Jun 30 14:57:53 2011 From: agross at gcpsite.com (Adam Gross) Date: Thu Jun 30 14:59:45 2011 Subject: Correct Blacklist Syntax Message-ID: <93B4D13F118B8244B2A34197EFFF196401F3C12A43ED@gcpex01.gcpsite.local> Here's an easy question for you guys. What is the correct syntax for blacklists? I'm trying to do *@domain.tld but it doesn't appear to be working. Is there somewhere special domain BL entries go? Thanks. -Adam -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From maillists at conactive.com Thu Jun 30 16:36:28 2011 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Jun 30 16:36:39 2011 Subject: Is the Anti-Virus installed or not? In-Reply-To: <024B7D3DF59FF841B9D48FC091024D9F5D30F1@server.home.comp-wiz.com> References: <024B7D3DF59FF841B9D48FC091024D9F5D30F0@server.home.comp-wiz.com> <024B7D3DF59FF841B9D48FC091024D9F5D30F1@server.home.comp-wiz.com> Message-ID: > If you have installed any, then check your virus.scanners.conf file to > make sure the locations of your scanners are correct Kai -- Get your web at Conactive Internet Services: http://www.conactive.com From maillists at conactive.com Thu Jun 30 16:36:28 2011 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Jun 30 16:36:40 2011 Subject: Correct Blacklist Syntax In-Reply-To: <93B4D13F118B8244B2A34197EFFF196401F3C12A43ED@gcpex01.gcpsite.local> References: <93B4D13F118B8244B2A34197EFFF196401F3C12A43ED@gcpex01.gcpsite.local> Message-ID: I'm trying to start the car and press that button, but it doesn't start .. You may want to give more information. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com From richard at fastnet.co.uk Thu Jun 30 17:15:23 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Thu Jun 30 17:15:33 2011 Subject: Clamd crashed. In-Reply-To: References: <1251B5423222C446A299CABAA7B46FF414EBED@fn-exchange.fastnet.local> Message-ID: <1251B5423222C446A299CABAA7B46FF41503E1@fn-exchange.fastnet.local> -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Kai Schaetzl Sent: 29 June 2011 13:31 To: mailscanner@lists.mailscanner.info Subject: Re: Clamd crashed. Richard Mealing wrote on Tue, 28 Jun 2011 14:00:26 +0000: > Can anyone confirm which database would be causing this problem and why? because it is a third-party add-on that is not fully compatible with the latest clamd? You should ask on a clamd mailing list, not here. There is a reason why many administrators do not add any third-party db's. There's also a reason why SA does such tests, the FP risk is *much* lower. Kai - - - - - - - - Hi Kai, Understood. I never really found a reason to why this happened. I did see some error messages - Jun 28 12:56:32 mailfilterv3 MailScanner[78328]: clamd: Failed to complete, timed out Jun 28 12:56:41 mailfilterv3 MailScanner[18857]: Commercial scanner clamd timed out! Jun 28 12:56:41 mailfilterv3 MailScanner[18857]: clamd: Failed to complete, timed out Then mailscanner just stopped in the maillog, literally - after the timeout it went over in a loop and the queue built up, all emails got quarantined. After removing the 3rd party databases and restarting clamd everything worked again. I've eased all the databases back into place now and I've had no problems all day. I thougth I found the database in question but I'm using it again now without problems. I will keep monitoring and speak to the clamd mailing lists if this problem comes up again. Rich -- Get your web at Conactive Internet Services: http://www.conactive.com -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From maillists at conactive.com Thu Jun 30 18:31:16 2011 From: maillists at conactive.com (Kai Schaetzl) Date: Thu Jun 30 18:31:30 2011 Subject: Clamd crashed. In-Reply-To: <1251B5423222C446A299CABAA7B46FF41503E1@fn-exchange.fastnet.local> References: <1251B5423222C446A299CABAA7B46FF414EBED@fn-exchange.fastnet.local> <1251B5423222C446A299CABAA7B46FF41503E1@fn-exchange.fastnet.local> Message-ID: it may happen only with certains versions of a db, of course. e.g. after an update. clamd will start using it once it gets restarted. The db may have already been "cleaned" by now. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com From uxbod at splatnix.net Thu Jun 30 23:03:15 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Thu Jun 30 23:03:30 2011 Subject: MailScanner and ZendTo In-Reply-To: <037003c3-0e29-4da3-9df4-e38803654af5@office.splatnix.net> Message-ID: If anybody is interested I now have MailScanner talking to ZendTo and generated dropoffs. More work to be done but it is looking very promising :) -- Thanks, Phil ----- Original Message ----- > ----- Original Message ----- > > > Fabulous idea, would make a good Ironport replacement. > > > Will the code be released publically? > > > Cheers, > > > Phil > > > -- > > Phil Randal | Infrastructure Engineer > > NHS Herefordshire & Herefordshire Council | Deputy Chief > > Executive's > > Office | I.C.T. Services Division > > Thorn Office Centre, Rotherwas, Hereford, HR2 6JT > > Tel: 01432 260160 > > > From: mailscanner-bounces@lists.mailscanner.info > > [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of > > --[ > > UxBoD ]-- > > Sent: 16 June 2011 10:55 > > To: MailScanner discussion > > Subject: MailScanner and ZendTo > > > Hello all, > > > I have been tasked with writing a custom function to integrate > > MailScanner with ZendTo and looking for a little bit of help with > > anybody who knows the MailScanner internals. I thought about using > > something like "Always Looked Up Last" though that is called > > whether > > the message is deleted or not. Therefore I believe it will have to > > be a complete new option with MailScanner but wondering at what > > point the attachment should be stripped and replaced with the > > ZendTo > > URL and key. I guess after virii scanning would be the most obvious > > so would like to ask which piece of code would be best to start > > looking at please to inject a new function ? > > Hi Phil, > > I am of the understanding that the code will be contributed back to > the community; like all good code :) > -- > Thanks, Phil > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From Kevin_Miller at ci.juneau.ak.us Thu Jun 30 23:15:38 2011 From: Kevin_Miller at ci.juneau.ak.us (Kevin Miller) Date: Thu Jun 30 23:15:51 2011 Subject: MailScanner and ZendTo In-Reply-To: References: <037003c3-0e29-4da3-9df4-e38803654af5@office.splatnix.net> Message-ID: <4A09477D575C2C4B86497161427DD94C162F20F561@city-exchange07> -- wrote: > If anybody is interested I now have MailScanner talking to ZendTo and > generated dropoffs. More work to be done but it is looking very > promising :) -- > Thanks, Phil What exactly is being dropped off? Maybe I'm just lacking in imagination but I just don't see the junction point between the two. Can you give a brief description of what functionality this is providing? Thanks... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 From uxbod at splatnix.net Thu Jun 30 23:45:38 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Thu Jun 30 23:45:56 2011 Subject: MailScanner and ZendTo In-Reply-To: <4A09477D575C2C4B86497161427DD94C162F20F561@city-exchange07> Message-ID: ZendTo is fantastic for transferring files between users. MailScanner is great at content scanning. Lots of MTAs do not allow attachments > xSize. So I am blending the two and writing a new module for MailScanner that when emails pass through the attachments are stripped, sent to ZendTo, and then a new attachment added to the original email with how they can be downloaded. -- Thanks, Phil ----- Original Message ----- > -- wrote: > > If anybody is interested I now have MailScanner talking to ZendTo > > and > > generated dropoffs. More work to be done but it is looking very > > promising :) -- > > Thanks, Phil > > What exactly is being dropped off? Maybe I'm just lacking in > imagination but I just don't see the junction point between the two. > Can you give a brief description of what functionality this is > providing? > > Thanks... > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! >