From richard at fastnet.co.uk Tue Nov 1 10:20:32 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Tue Nov 1 10:20:45 2011 Subject: Maximum Message Size / attachment size not working. BUG? Message-ID: <1251B5423222C446A299CABAA7B46FF42AE5A9@fn-exchange.fastnet.local> Hi Jules, There appears to be a bug in that this feature doesn't work. Can this be looked into and added to a future release of mailscanner? I can't see any errors in debug mode and I can see by searching on google that other people are reporting this problem. Thanks for your help. Richard. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111101/e0315c48/attachment.html From kocisky at autistici.org Tue Nov 1 13:41:51 2011 From: kocisky at autistici.org (Kocisky) Date: Tue Nov 1 13:42:02 2011 Subject: MailScanner hanging process, cannot write to quarantine and not processing incoming mails In-Reply-To: References: Message-ID: it happend again and shame on me for not going through all the MailScanner.conf! i had this configuration: Quarantine User = root Quarantine Group = apache Run As User = postfix Run As Group = postfix changed to: Quarantine User = postfix Quarantine Group = clam Run As User = postfix Run As Group = postfix chown -R postfix.clam /var/spool/MailScanner/quarantine/ K. On 31 October 2011 15:15, Rob Verduijn wrote: > I already know that it was caused by changed access rights (for me it was > root:www-data on quarantine) > Something changed it and I still haven't found what. > > Rob > > > 2011/10/31 Kocisky > >> Hi Rob, >> >> i've fixed the permissions as in my previous email, afterwords i had some >> other issues. I still need to clear out everything. I'm also using the >> /etc/init.d/MailScanner from the original source instead of the Centos >> distribution version, the process was not stopping correctly and it seems a >> little bit different. >> >> k. >> >> >> On 31 October 2011 14:41, Rob Verduijn wrote: >> >>> Let me know if you find out, >>> I happened to stumble on exactly that problem as well. (on ubuntu lucid >>> though) >>> >>> Rob >>> >>> 2011/10/31 Kocisky >>> >>>> ok, which process changed the permissions >>>> to /var/spool/MailScanner/quarantine ? mailscanner? baruwa? >>>> >>>> [root@mail init.d]# ls -la /var/spool/MailScanner/ >>>> total 32 >>>> drwxr-xr-x. 5 root root 4096 Oct 22 09:00 . >>>> drwxr-xr-x. 14 root root 4096 Oct 28 11:27 .. >>>> drwxr-xr-x. 12 postfix clam 4096 Oct 31 12:54 incoming >>>> drwxr-xr-x. 24 root apache 4096 Oct 31 12:48 quarantine >>>> drwxr-x---. 2 postfix clam 4096 Oct 3 12:21 spamassassin >>>> [root@mail init.d]# chown -R postfix.clam >>>> /var/spool/MailScanner/quarantine/ >>>> >>>> #@^%#$^%$@^*$#%^*5476q%E*!!!???!!! >>>> >>>> On 31 October 2011 13:03, Kocisky wrote: >>>> >>>>> from the strace (below below) it seems that the process cannot create >>>>> the folder: >>>>> >>>>> [root@mail init.d]# ls -l /var/spool/MailScanner/quarantine/20111031 >>>>> ls: cannot access /var/spool/MailScanner/quarantine/20111031: No such >>>>> file or directory >>>>> >>>>> it should be a simple permission issue because selinux doesnt give any >>>>> audit.log and "setenforce 0" didn't change the situation. >>>>> >>>>> permission of MailScanner.conf: >>>>> >>>>> Run As User = postfix >>>>> Run As Group = postfix >>>>> >>>>> i'm definitively missing something !!! >>>>> >>>>> below some permissions where it seems to hang: >>>>> >>>>> [root@mail init.d]# ls -la /var/spool/MailScanner/quarantine/ >>>>> total 96 >>>>> drwxr-xr-x. 24 root apache 4096 Oct 22 09:00 . >>>>> drwxr-xr-x. 5 root root 4096 Oct 22 09:00 .. >>>>> drwx------. 3 postfix apache 4096 Oct 3 13:06 20111003 >>>>> drwxrwx---. 7 postfix apache 4096 Oct 4 13:51 20111004 >>>>> drwxrwx---. 6 postfix apache 4096 Oct 5 13:19 20111005 >>>>> drwxrwx---. 5 postfix apache 4096 Oct 6 20:51 20111006 >>>>> drwxrwx---. 15 postfix apache 4096 Oct 7 07:56 20111007 >>>>> drwxrwx---. 3 postfix apache 4096 Oct 8 00:19 20111008 >>>>> drwxrwx---. 3 postfix apache 4096 Oct 9 00:05 20111009 >>>>> drwxrwx---. 3 postfix apache 4096 Oct 10 00:16 20111010 >>>>> drwxrwx---. 20 postfix apache 4096 Oct 12 22:32 20111012 >>>>> drwxrwx---. 37 postfix postfix 4096 Oct 13 16:29 20111013 >>>>> drwxrwx---. 15 postfix celeryd 4096 Oct 14 13:30 20111014 >>>>> drwxrwx---. 6 postfix celeryd 4096 Oct 17 22:17 20111017 >>>>> drwxrwx---. 20 postfix celeryd 4096 Oct 18 20:42 20111018 >>>>> drwxrwx---. 3 postfix celeryd 4096 Oct 19 04:38 20111019 >>>>> drwxrwx---. 54 postfix celeryd 4096 Oct 20 21:31 20111020 >>>>> drwxrwx---. 11 postfix celeryd 4096 Oct 21 10:08 20111021 >>>>> drwxrwx---. 5 postfix celeryd 4096 Oct 24 15:48 20111024 >>>>> drwxrwx---. 142 postfix postfix 4096 Oct 25 23:32 20111025 >>>>> drwxrwx---. 118 postfix postfix 4096 Oct 26 18:12 20111026 >>>>> drwxrwx---. 15 postfix apache 4096 Oct 27 21:14 20111027 >>>>> drwxrwx---. 5 postfix apache 4096 Oct 28 06:27 20111028 >>>>> drwxr-x---. 3 postfix apache 4096 Oct 31 12:08 phishingupdate >>>>> [root@mail init.d]# ls -la /var/spool/MailScanner/quarantine/20111031 >>>>> ls: cannot access /var/spool/MailScanner/quarantine/20111031: No such >>>>> file or directory >>>>> [root@mail init.d]# ls -la /var/spool/MailScanner/ >>>>> total 32 >>>>> drwxr-xr-x. 5 root root 4096 Oct 22 09:00 . >>>>> drwxr-xr-x. 14 root root 4096 Oct 28 11:27 .. >>>>> drwxr-xr-x. 9 postfix clam 4096 Oct 31 12:41 incoming >>>>> drwxr-xr-x. 24 root apache 4096 Oct 22 09:00 quarantine >>>>> drwxr-x---. 2 postfix clam 4096 Oct 3 12:21 spamassassin >>>>> >>>>> >>>>> below the strace output: >>>>> >>>>> >>>>> unlink("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal") >>>>> = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=1073741824, >>>>> len=2}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 >>>>> gettimeofday({1320079287, 180287}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> gettimeofday({1320079287, 180496}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> select(8, [7], NULL, [7], {0, 0}) = 0 (Timeout) >>>>> write(7, "<22>Oct 31 12:41:27 MailScanner["..., 94) = 94 >>>>> gettimeofday({1320079287, 181930}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> gettimeofday({1320079287, 182134}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> select(8, [7], NULL, [7], {0, 0}) = 0 (Timeout) >>>>> write(7, "<22>Oct 31 12:41:27 MailScanner["..., 432) = 432 >>>>> gettimeofday({1320079287, 183021}, NULL) = 0 >>>>> gettimeofday({1320079287, 183150}, NULL) = 0 >>>>> lseek(26, 0, SEEK_SET) = 0 >>>>> lseek(26, 0, SEEK_CUR) = 0 >>>>> read(26, "CO 7091 69"..., 4096) = 4096 >>>>> lseek(26, 81, SEEK_SET) = 81 >>>>> lseek(26, 0, SEEK_CUR) = 81 >>>>> lseek(26, 691, SEEK_SET) = 691 >>>>> lseek(26, 0, SEEK_CUR) = 691 >>>>> read(26, "NJReceived: from mysubdomain.trac"..., 4096) = 4096 >>>>> lseek(26, 2049, SEEK_SET) = 2049 >>>>> lseek(26, 0, SEEK_CUR) = 2049 >>>>> lseek(26, 2049, SEEK_SET) = 2049 >>>>> lseek(26, 0, SEEK_CUR) = 2049 >>>>> read(26, "N\0N,This is a multi-part message"..., 4096) = 4096 >>>>> read(26, "realize friend letter be able.N "..., 4096) = 1641 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> access("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal", >>>>> F_OK) = -1 ENOENT (No such file or directory) >>>>> fstat(6, {st_mode=S_IFREG|0750, st_size=4264960, ...}) = 0 >>>>> lseek(6, 24, SEEK_SET) = 24 >>>>> read(6, "\0\2F\230\0\0\0\0\0\0\16\310\0\0\17\356", 16) = 16 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> access("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal", >>>>> F_OK) = -1 ENOENT (No such file or directory) >>>>> fstat(6, {st_mode=S_IFREG|0750, st_size=4264960, ...}) = 0 >>>>> lseek(6, 24, SEEK_SET) = 24 >>>>> read(6, "\0\2F\230\0\0\0\0\0\0\16\310\0\0\17\356", 16) = 16 >>>>> fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=1073741825, >>>>> len=1}) = 0 >>>>> open("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal", >>>>> O_RDWR|O_CREAT, 0644) = 38 >>>>> open("/var/spool/MailScanner/incoming", O_RDONLY) = 39 >>>>> fcntl(39, F_GETFD) = 0 >>>>> fcntl(39, F_SETFD, FD_CLOEXEC) = 0 >>>>> fcntl(38, F_GETFD) = 0 >>>>> fcntl(38, F_SETFD, FD_CLOEXEC) = 0 >>>>> lseek(38, 0, SEEK_SET) = 0 >>>>> write(38, >>>>> "\0\0\0\0\0\0\0\0\0\0\0\0\7\20\240\225\0\0\20E\0\0\2\0\0\0\4\0\0\0\0\0"..., >>>>> 512) = 512 >>>>> gettimeofday({1320079287, 191900}, NULL) = 0 >>>>> lseek(38, 512, SEEK_SET) = 512 >>>>> write(38, "\0\0\0\4", 4) = 4 >>>>> lseek(38, 516, SEEK_SET) = 516 >>>>> write(38, >>>>> "\n\2\362\0A\0\302\0\0\302\0\314\0\326\0\340\0\352\0\364\0\376\1\10\1\22\1\34\1&\0010"..., >>>>> 1024) = 1024 >>>>> lseek(38, 1540, SEEK_SET) = 1540 >>>>> write(38, "\7\20\240\261", 4) = 4 >>>>> lseek(38, 1544, SEEK_SET) = 1544 >>>>> write(38, "\0\0\v\33", 4) = 4 >>>>> lseek(38, 1548, SEEK_SET) = 1548 >>>>> write(38, "\r\0\0\0\2\0E\0\3\221\0E23.AFFF7\0 Wed Oct "..., 1024) = >>>>> 1024 >>>>> lseek(38, 2572, SEEK_SET) = 2572 >>>>> write(38, "\7\20\242\352", 4) = 4 >>>>> lseek(38, 2576, SEEK_SET) = 2576 >>>>> write(38, "\0\0\0\1", 4) = 4 >>>>> lseek(38, 2580, SEEK_SET) = 2580 >>>>> write(38, "SQLite format 3\0\4\0\1\1\0@ \0\2F\230\0\0\0\0"..., 1024) >>>>> = 1024 >>>>> lseek(38, 3604, SEEK_SET) = 3604 >>>>> write(38, "\7\20\241\25", 4) = 4 >>>>> lseek(38, 4096, SEEK_SET) = 4096 >>>>> read(38, "", 8) = 0 >>>>> fdatasync(38) = 0 >>>>> close(39) = 0 >>>>> lseek(38, 0, SEEK_SET) = 0 >>>>> write(38, "\331\325\5\371 \241c\327\0\0\0\3", 12) = 12 >>>>> fdatasync(38) = 0 >>>>> fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> lseek(6, 0, SEEK_SET) = 0 >>>>> write(6, "SQLite format 3\0\4\0\1\1\0@ \0\2F\231\0\0\0\0"..., 1024) >>>>> = 1024 >>>>> lseek(6, 3072, SEEK_SET) = 3072 >>>>> write(6, >>>>> "\n\2\350\0A\0\302\0\0\302\0\314\0\326\0\340\0\352\0\364\0\376\1\10\1\22\1\34\1&\0010"..., >>>>> 1024) = 1024 >>>>> lseek(6, 2910208, SEEK_SET) = 2910208 >>>>> write(6, "\r\0\0\0\2\0E\0\3\221\0E23.AFFF7\0 Wed Oct "..., 1024) = >>>>> 1024 >>>>> fdatasync(6) = 0 >>>>> close(38) = 0 >>>>> unlink("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal") >>>>> = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=1073741824, >>>>> len=2}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 >>>>> gettimeofday({1320079287, 246889}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> gettimeofday({1320079287, 247091}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> select(8, [7], NULL, [7], {0, 0}) = 0 (Timeout) >>>>> write(7, "<22>Oct 31 12:41:27 MailScanner["..., 94) = 94 >>>>> gettimeofday({1320079287, 248624}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> gettimeofday({1320079287, 248827}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> select(8, [7], NULL, [7], {0, 0}) = 0 (Timeout) >>>>> write(7, "<22>Oct 31 12:41:27 MailScanner["..., 343) = 343 >>>>> gettimeofday({1320079287, 249686}, NULL) = 0 >>>>> gettimeofday({1320079287, 249820}, NULL) = 0 >>>>> lseek(12, 0, SEEK_SET) = 0 >>>>> lseek(12, 0, SEEK_CUR) = 0 >>>>> read(12, "CO 42635 68"..., 4096) = 4096 >>>>> lseek(12, 81, SEEK_SET) = 81 >>>>> lseek(12, 0, SEEK_CUR) = 81 >>>>> lseek(12, 689, SEEK_SET) = 689 >>>>> lseek(12, 0, SEEK_CUR) = 689 >>>>> read(12, "NJReceived: from mysubdomain.trac"..., 4096) = 4096 >>>>> lseek(12, 3328, SEEK_SET) = 3328 >>>>> lseek(12, 0, SEEK_CUR) = 3328 >>>>> lseek(12, 3328, SEEK_SET) = 3328 >>>>> lseek(12, 0, SEEK_CUR) = 3328 >>>>> read(12, "N\6N\6N\24Sears</"..., 4096) = 4096 >>>>> read(12, "amai=2Enet/f/248/47562/14d/ig=2E"..., 4096) = 4096 >>>>> read(12, "b9VSRRYSUWV1b9X8w9GVbwzfTRSSSRUR"..., 4096) = 4096 >>>>> read(12, "NLYSUWzf1vSvWf2aRRVXLX=22 rilt=3"..., 4096) = 4096 >>>>> read(12, "klhuLjXpKVSYSARUSRVhilXlPiLXJhKL"..., 4096) = 4096 >>>>> read(12, "trong>Even more offers from Sear"..., 4096) = 4096 >>>>> read(12, "2011_Oc=NLtober_Week4/20111030_S"..., 4096) = 4096 >>>>> read(12, "e</a></td>NE <td width="..., 4096) = 4096 >>>>> read(12, "sys4=2Enet/servlet/cc6?kLHjkQDRY"..., 4096) = 4096 >>>>> read(12, " <td valign=3D=22"..., 4096) = 3136 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> access("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal", >>>>> F_OK) = -1 ENOENT (No such file or directory) >>>>> fstat(6, {st_mode=S_IFREG|0750, st_size=4264960, ...}) = 0 >>>>> lseek(6, 24, SEEK_SET) = 24 >>>>> read(6, "\0\2F\231\0\0\0\0\0\0\16\310\0\0\17\356", 16) = 16 >>>>> lseek(6, 3857408, SEEK_SET) = 3857408 >>>>> read(6, >>>>> "\0\0\0\0.l\326\373_\266_\327G\311\7Pm+E\311\317\367\275\344\233\340\371\250\27\33i\v"..., >>>>> 1024) = 1024 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> access("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal", >>>>> F_OK) = -1 ENOENT (No such file or directory) >>>>> fstat(6, {st_mode=S_IFREG|0750, st_size=4264960, ...}) = 0 >>>>> lseek(6, 24, SEEK_SET) = 24 >>>>> read(6, "\0\2F\231\0\0\0\0\0\0\16\310\0\0\17\356", 16) = 16 >>>>> fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=1073741825, >>>>> len=1}) = 0 >>>>> open("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal", >>>>> O_RDWR|O_CREAT, 0644) = 38 >>>>> open("/var/spool/MailScanner/incoming", O_RDONLY) = 39 >>>>> fcntl(39, F_GETFD) = 0 >>>>> fcntl(39, F_SETFD, FD_CLOEXEC) = 0 >>>>> fcntl(38, F_GETFD) = 0 >>>>> fcntl(38, F_SETFD, FD_CLOEXEC) = 0 >>>>> lseek(38, 0, SEEK_SET) = 0 >>>>> write(38, >>>>> "\0\0\0\0\0\0\0\0\0\0\0\0\274\244\2267\0\0\20E\0\0\2\0\0\0\4\0\0\0\0\0"..., >>>>> 512) = 512 >>>>> gettimeofday({1320079287, 269307}, NULL) = 0 >>>>> lseek(38, 512, SEEK_SET) = 512 >>>>> write(38, "\0\0\0\4", 4) = 4 >>>>> lseek(38, 516, SEEK_SET) = 516 >>>>> write(38, >>>>> "\n\2\350\0A\0\302\0\0\302\0\314\0\326\0\340\0\352\0\364\0\376\1\10\1\22\1\34\1&\0010"..., >>>>> 1024) = 1024 >>>>> lseek(38, 1540, SEEK_SET) = 1540 >>>>> write(38, "\274\244\226S", 4) = 4 >>>>> lseek(38, 1544, SEEK_SET) = 1544 >>>>> write(38, "\0\0\0\1", 4) = 4 >>>>> lseek(38, 1548, SEEK_SET) = 1548 >>>>> write(38, "SQLite format 3\0\4\0\1\1\0@ \0\2F\231\0\0\0\0"..., 1024) >>>>> = 1024 >>>>> lseek(38, 2572, SEEK_SET) = 2572 >>>>> write(38, "\274\244\226\267", 4) = 4 >>>>> lseek(38, 2576, SEEK_SET) = 2576 >>>>> write(38, "\0\0\16\310", 4) = 4 >>>>> lseek(38, 2580, SEEK_SET) = 2580 >>>>> write(38, >>>>> "\0\0\16N\0\0\0]\0\0\16>\0\0\7\317\0\0\16a\0\0\6\366\0\0\6\335\0\0\16\262"..., >>>>> 1024) = 1024 >>>>> lseek(38, 3604, SEEK_SET) = 3604 >>>>> write(38, "\274\244\226\244", 4) = 4 >>>>> lseek(38, 3608, SEEK_SET) = 3608 >>>>> write(38, "\0\0\16>", 4) = 4 >>>>> lseek(38, 3612, SEEK_SET) = 3612 >>>>> write(38, >>>>> "\0\0\0\0\233\306\0\367\310\355z\367\344\332f\v;;\f\315\223\215\20\5\217\326\266\320\214c\263z"..., >>>>> 1024) = 1024 >>>>> lseek(38, 4636, SEEK_SET) = 4636 >>>>> write(38, "\274\244\227F", 4) = 4 >>>>> lseek(38, 4640, SEEK_SET) = 4640 >>>>> write(38, "\0\0\t\334", 4) = 4 >>>>> lseek(38, 4644, SEEK_SET) = 4644 >>>>> write(38, >>>>> "\r\0\0\0\2\0\210\0\3\221\0\210d\303\265\3322(yy=J\276C\313`\217W\33Ik\220"..., >>>>> 1024) = 1024 >>>>> lseek(38, 5668, SEEK_SET) = 5668 >>>>> write(38, "\274\244\230\350", 4) = 4 >>>>> lseek(38, 6144, SEEK_SET) = 6144 >>>>> read(38, "", 8) = 0 >>>>> fdatasync(38) = 0 >>>>> close(39) = 0 >>>>> lseek(38, 0, SEEK_SET) = 0 >>>>> write(38, "\331\325\5\371 \241c\327\0\0\0\5", 12) = 12 >>>>> fdatasync(38) = 0 >>>>> fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=1073741824, >>>>> len=1}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> lseek(6, 0, SEEK_SET) = 0 >>>>> write(6, "SQLite format 3\0\4\0\1\1\0@ \0\2F\232\0\0\0\0"..., 1024) >>>>> = 1024 >>>>> lseek(6, 3072, SEEK_SET) = 3072 >>>>> write(6, >>>>> "\n\2\336\0A\0\302\0\0\302\0\314\0\326\0\340\0\352\0\364\0\376\1\10\1\22\1\34\1&\0010"..., >>>>> 1024) = 1024 >>>>> lseek(6, 2583552, SEEK_SET) = 2583552 >>>>> write(6, >>>>> "\r\0\0\0\2\0\210\0\3\221\0\210d\303\265\3322(yy=J\276C\313`\217W\33Ik\220"..., >>>>> 1024) = 1024 >>>>> lseek(6, 3732480, SEEK_SET) = 3732480 >>>>> write(6, >>>>> "\0\0\0\0.l\326\373_\266_\327G\311\7Pm+E\311\317\367\275\344\233\340\371\250\27\33i\v"..., >>>>> 1024) = 1024 >>>>> lseek(6, 3873792, SEEK_SET) = 3873792 >>>>> write(6, >>>>> "\0\0\16N\0\0\0]\0\0\n\n\0\0\7\317\0\0\16a\0\0\6\366\0\0\6\335\0\0\16\262"..., >>>>> 1024) = 1024 >>>>> fdatasync(6) = 0 >>>>> close(38) = 0 >>>>> unlink("/var/spool/MailScanner/incoming/SpamAssassin.cache.db-journal") >>>>> = 0 >>>>> fcntl(6, F_SETLK, {type=F_RDLCK, whence=SEEK_SET, start=1073741826, >>>>> len=510}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=1073741824, >>>>> len=2}) = 0 >>>>> fcntl(6, F_SETLK, {type=F_UNLCK, whence=SEEK_SET, start=0, len=0}) = 0 >>>>> gettimeofday({1320079287, 337396}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> gettimeofday({1320079287, 337599}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> select(8, [7], NULL, [7], {0, 0}) = 0 (Timeout) >>>>> write(7, "<22>Oct 31 12:41:27 MailScanner["..., 94) = 94 >>>>> gettimeofday({1320079287, 339319}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> gettimeofday({1320079287, 339522}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> select(8, [7], NULL, [7], {0, 0}) = 0 (Timeout) >>>>> write(7, "<21>Oct 31 12:41:27 MailScanner["..., 77) = 77 >>>>> gettimeofday({1320079287, 340458}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> gettimeofday({1320079287, 340662}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> select(8, [7], NULL, [7], {0, 0}) = 0 (Timeout) >>>>> write(7, "<21>Oct 31 12:41:27 MailScanner["..., 99) = 99 >>>>> umask(07) = 077 >>>>> stat("/var/spool/MailScanner/quarantine", {st_mode=S_IFDIR|0755, >>>>> st_size=4096, ...}) = 0 >>>>> stat("/var/spool/MailScanner/quarantine/20111031", 0x129c130) = -1 >>>>> ENOENT (No such file or directory) >>>>> mkdir("/var/spool/MailScanner/quarantine/20111031", 0777) = -1 EACCES >>>>> (Permission denied) >>>>> chown("/var/spool/MailScanner/quarantine/20111031", 89, 48) = -1 >>>>> ENOENT (No such file or directory) >>>>> stat("/var/spool/MailScanner/quarantine/20111031/spam", 0x129c130) = >>>>> -1 ENOENT (No such file or directory) >>>>> mkdir("/var/spool/MailScanner/quarantine/20111031/spam", 0777) = -1 >>>>> ENOENT (No such file or directory) >>>>> chown("/var/spool/MailScanner/quarantine/20111031/spam", 89, 48) = -1 >>>>> ENOENT (No such file or directory) >>>>> umask(0117) = 07 >>>>> open("/var/spool/MailScanner/quarantine/20111031/spam/BBA2A2024A1.AB0F1", >>>>> O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 ENOENT (No such file or directory) >>>>> gettimeofday({1320079287, 342597}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> gettimeofday({1320079287, 342797}, NULL) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0 >>>>> select(8, [7], NULL, [7], {0, 0}) = 0 (Timeout) >>>>> write(7, "<20>Oct 31 12:41:27 MailScanner["..., 145) = 145 >>>>> lseek(32, 7335, SEEK_SET) = 7335 >>>>> lseek(32, 0, SEEK_CUR) = 7335 >>>>> lseek(32, 0, SEEK_SET) = 0 >>>>> lseek(32, 0, SEEK_CUR) = 0 >>>>> read(32, "CO 6642 69"..., 4096) = 4096 >>>>> lseek(32, 81, SEEK_SET) = 81 >>>>> lseek(32, 0, SEEK_CUR) = 81 >>>>> lseek(32, 691, SEEK_SET) = 691 >>>>> lseek(32, 0, SEEK_CUR) = 691 >>>>> read(32, "NJReceived: from mysubdomain.trac"..., 4096) = 4096 >>>>> write(2, "Can't call method \"print\" on an "..., 111Can't call method >>>>> "print" on an undefined value at >>>>> /usr/share/MailScanner/MailScanner/PFDiskStore.pm line 755. >>>>> ) = 111 >>>>> lseek(8, 3860, SEEK_SET) = 3860 >>>>> lseek(8, 0, SEEK_CUR) = 3860 >>>>> lseek(9, 8388, SEEK_SET) = 8388 >>>>> lseek(9, 0, SEEK_CUR) = 8388 >>>>> lseek(10, 21849, SEEK_SET) = 21849 >>>>> lseek(10, 0, SEEK_CUR) = 21849 >>>>> lseek(11, 5590, SEEK_SET) = 5590 >>>>> lseek(11, 0, SEEK_CUR) = 5590 >>>>> lseek(12, 43326, SEEK_SET) = 43326 >>>>> lseek(12, 0, SEEK_CUR) = 43326 >>>>> lseek(13, 10434, SEEK_SET) = 10434 >>>>> lseek(13, 0, SEEK_CUR) = 10434 >>>>> lseek(14, 10074, SEEK_SET) = 10074 >>>>> lseek(14, 0, SEEK_CUR) = 10074 >>>>> lseek(15, 21625, SEEK_SET) = 21625 >>>>> lseek(15, 0, SEEK_CUR) = 21625 >>>>> lseek(16, 9794, SEEK_SET) = 9794 >>>>> lseek(16, 0, SEEK_CUR) = 9794 >>>>> lseek(17, 13493, SEEK_SET) = 13493 >>>>> lseek(17, 0, SEEK_CUR) = 13493 >>>>> lseek(18, 905, SEEK_SET) = 905 >>>>> lseek(18, 0, SEEK_CUR) = 905 >>>>> lseek(19, 3604, SEEK_SET) = 3604 >>>>> lseek(19, 0, SEEK_CUR) = 3604 >>>>> lseek(20, 15318, SEEK_SET) = 15318 >>>>> lseek(20, 0, SEEK_CUR) = 15318 >>>>> lseek(21, 27935, SEEK_SET) = 27935 >>>>> lseek(21, 0, SEEK_CUR) = 27935 >>>>> lseek(22, 5884, SEEK_SET) = 5884 >>>>> lseek(22, 0, SEEK_CUR) = 5884 >>>>> lseek(23, 6165, SEEK_SET) = 6165 >>>>> lseek(23, 0, SEEK_CUR) = 6165 >>>>> lseek(24, 54958, SEEK_SET) = 54958 >>>>> lseek(24, 0, SEEK_CUR) = 54958 >>>>> lseek(25, 7347, SEEK_SET) = 7347 >>>>> lseek(25, 0, SEEK_CUR) = 7347 >>>>> lseek(26, 7784, SEEK_SET) = 7784 >>>>> lseek(26, 0, SEEK_CUR) = 7784 >>>>> lseek(27, 11887, SEEK_SET) = 11887 >>>>> lseek(27, 0, SEEK_CUR) = 11887 >>>>> lseek(28, 10515, SEEK_SET) = 10515 >>>>> lseek(28, 0, SEEK_CUR) = 10515 >>>>> lseek(29, 3475, SEEK_SET) = 3475 >>>>> lseek(29, 0, SEEK_CUR) = 3475 >>>>> lseek(31, 6376, SEEK_SET) = 6376 >>>>> lseek(31, 0, SEEK_CUR) = 6376 >>>>> lseek(32, 767, SEEK_SET) = 767 >>>>> lseek(32, 0, SEEK_CUR) = 767 >>>>> lseek(33, 18203, SEEK_SET) = 18203 >>>>> lseek(33, 0, SEEK_CUR) = 18203 >>>>> lseek(34, 12058, SEEK_SET) = 12058 >>>>> lseek(34, 0, SEEK_CUR) = 12058 >>>>> lseek(35, 3818, SEEK_SET) = 3818 >>>>> lseek(35, 0, SEEK_CUR) = 3818 >>>>> lseek(36, 6967, SEEK_SET) = 6967 >>>>> lseek(36, 0, SEEK_CUR) = 6967 >>>>> lseek(37, 8868, SEEK_SET) = 8868 >>>>> lseek(37, 0, SEEK_CUR) = 8868 >>>>> close(37) = 0 >>>>> close(35) = 0 >>>>> close(36) = 0 >>>>> close(34) = 0 >>>>> close(32) = 0 >>>>> close(33) = 0 >>>>> close(31) = 0 >>>>> close(29) = 0 >>>>> close(30) = 0 >>>>> close(28) = 0 >>>>> close(27) = 0 >>>>> close(25) = 0 >>>>> close(26) = 0 >>>>> close(24) = 0 >>>>> close(22) = 0 >>>>> close(23) = 0 >>>>> close(21) = 0 >>>>> close(19) = 0 >>>>> close(20) = 0 >>>>> close(18) = 0 >>>>> close(16) = 0 >>>>> close(17) = 0 >>>>> close(15) = 0 >>>>> close(14) = 0 >>>>> close(13) = 0 >>>>> close(12) = 0 >>>>> close(10) = 0 >>>>> close(11) = 0 >>>>> close(9) = 0 >>>>> close(8) = 0 >>>>> stat("/usr/lib64/perl5/auto/DBI/DESTROY.al", 0x129c130) = -1 ENOENT >>>>> (No such file or directory) >>>>> stat("/usr/sbin/auto/DBI/DESTROY.al", 0x7ffffabb86f0) = -1 ENOENT (No >>>>> such file or directory) >>>>> stat("/usr/sbin/MailScanner/auto/DBI/DESTROY.al", 0x7ffffabb86f0) = -1 >>>>> ENOTDIR (Not a directory) >>>>> stat("/usr/share/MailScanner/auto/DBI/DESTROY.al", 0x7ffffabb86f0) = >>>>> -1 ENOENT (No such file or directory) >>>>> stat("/usr/local/lib64/perl5/auto/DBI/DESTROY.al", 0x7ffffabb86f0) = >>>>> -1 ENOENT (No such file or directory) >>>>> stat("/usr/local/share/perl5/auto/DBI/DESTROY.al", 0x7ffffabb86f0) = >>>>> -1 ENOENT (No such file or directory) >>>>> stat("/usr/lib64/perl5/vendor_perl/auto/DBI/DESTROY.al", >>>>> 0x7ffffabb86f0) = -1 ENOENT (No such file or directory) >>>>> stat("/usr/share/perl5/vendor_perl/auto/DBI/DESTROY.al", >>>>> 0x7ffffabb86f0) = -1 ENOENT (No such file or directory) >>>>> stat("/usr/lib64/perl5/auto/DBI/DESTROY.al", 0x7ffffabb86f0) = -1 >>>>> ENOENT (No such file or directory) >>>>> stat("/usr/share/perl5/auto/DBI/DESTROY.al", 0x7ffffabb86f0) = -1 >>>>> ENOENT (No such file or directory) >>>>> stat("/usr/share/MailScanner/auto/DBI/DESTROY.al", 0x7ffffabb86f0) = >>>>> -1 ENOENT (No such file or directory) >>>>> close(4) = 0 >>>>> close(5) = 0 >>>>> close(7) = 0 >>>>> exit_group(255) >>>>> >>>>> On 31 October 2011 12:37, Kocisky <kocisky@autistici.org> wrote: >>>>> >>>>>> Hi all, >>>>>> >>>>>> i've just installed Centos 6 and my system is up to date. I've tried >>>>>> to google a bit but didn't find any solutions: >>>>>> >>>>>> LOGS: >>>>>> >>>>>> ################################################ >>>>>> >>>>>> mailq with more than 2000 emails and messages are not delivered; >>>>>> >>>>>> ################################################ >>>>>> >>>>>> [root@mail init.d]# ps aux | grep MailScanner >>>>>> postfix 4074 0.0 2.2 302708 89248 ? S Oct28 0:05 >>>>>> MailScanner: compressing attachments >>>>>> postfix 4081 0.0 2.2 302708 89148 ? S Oct28 0:05 >>>>>> MailScanner: compressing attachments >>>>>> postfix 4086 0.0 2.2 302840 89284 ? S Oct28 0:04 >>>>>> MailScanner: compressing attachments >>>>>> root 8844 0.0 0.0 103156 812 pts/2 S+ 11:31 0:00 grep >>>>>> MailScanner >>>>>> >>>>>> ################################################ >>>>>> >>>>>> /var/log/maillog : >>>>>> >>>>>> Oct 31 11:50:27 mail MailScanner[9227]: writing to >>>>>> /var/spool/MailScanner/quarantine/20111031/spam/BBA2A2024A1.AB0F1: No such >>>>>> file or directory >>>>>> >>>>>> ################################################ >>>>>> >>>>>> [root@mail init.d]# MailScanner --debug >>>>>> >>>>>> Configuration: Failed to find any configuration files like >>>>>> /etc/MailScanner/conf.d/*, skipping them. at >>>>>> /usr/share/MailScanner/MailScanner/Config.pm line 2044 >>>>>> >>>>>> In Debugging mode, not forking... >>>>>> Trying to setlogsock(unix) >>>>>> Building a message batch to scan... >>>>>> Have a batch of 30 messages. >>>>>> Can't call method "print" on an undefined value at >>>>>> /usr/share/MailScanner/MailScanner/PFDiskStore.pm line 755. >>>>>> >>>>>> ################################################ >>>>>> >>>>>> VERSIONS: >>>>>> >>>>>> MailScanner --lint >>>>>> Trying to setlogsock(unix) >>>>>> >>>>>> Reading configuration file /etc/MailScanner/MailScanner.conf >>>>>> Configuration: Failed to find any configuration files like >>>>>> /etc/MailScanner/conf.d/*, skipping them. at >>>>>> /usr/share/MailScanner/MailScanner/Config.pm line 2044 >>>>>> Read 869 hostnames from the phishing whitelist >>>>>> Read 4051 hostnames from the phishing blacklists >>>>>> Config: calling custom init function SQLBlacklist >>>>>> Starting up SQL Blacklist >>>>>> Read 0 blacklist entries >>>>>> Config: calling custom init function MailWatchLogging >>>>>> Started SQL Logging child >>>>>> Config: calling custom init function SQLWhitelist >>>>>> Starting up SQL Whitelist >>>>>> Read 0 whitelist entries >>>>>> >>>>>> Checking version numbers... >>>>>> Version number in MailScanner.conf (4.84.3) is correct. >>>>>> >>>>>> Unrar is not installed, it should be in /usr/bin/unrar. >>>>>> This is required for RAR archives to be read to check >>>>>> filenames and filetypes. Virus scanning is not affected. >>>>>> >>>>>> >>>>>> Your envelope_sender_header in spam.assassin.prefs.conf is correct. >>>>>> MailScanner setting GID to (89) >>>>>> MailScanner setting UID to (89) >>>>>> >>>>>> Checking for SpamAssassin errors (if you use it)... >>>>>> Using SpamAssassin results cache >>>>>> Connected to SpamAssassin cache database >>>>>> SpamAssassin reported no errors. >>>>>> Connected to Processing Attempts Database >>>>>> Created Processing Attempts Database successfully >>>>>> There are 248 messages in the Processing Attempts Database >>>>>> lock.pl sees Config LockType = posix >>>>>> lock.pl sees have_module = 0 >>>>>> Using locktype = posix >>>>>> MailScanner.conf says "Virus Scanners = clamd" >>>>>> Debug Mode Is On >>>>>> Use Threads : NO >>>>>> Socket : /var/run/clamav/clamd.sock >>>>>> IP : Using Sockets >>>>>> Lock File : NOT USED >>>>>> Time Out : 300 >>>>>> Scan Dir : /var/spool/MailScanner/incoming/9341/ISITINSTALLED >>>>>> Clamd : Sending PING >>>>>> Clamd : GOT 'PONG' >>>>>> ClamD is running >>>>>> >>>>>> Found these virus scanners installed: clamd >>>>>> >>>>>> =========================================================================== >>>>>> Created attachment dirs for 1 messages >>>>>> Filename Checks: Windows/DOS Executable (1 eicar.com) >>>>>> Completed checking by /usr/bin/file >>>>>> Other Checks: Found 1 problems >>>>>> >>>>>> ################################### >>>>>> >>>>>> is the above "Configuration: Failed to find any configuration files >>>>>> like /etc/MailScanner/conf.d/*, skipping them. at >>>>>> /usr/share/MailScanner/MailScanner/Config.pm line 2044" an issue? am i >>>>>> really missing something? >>>>>> >>>>>> ################################### >>>>>> >>>>>> MailScanner -v >>>>>> Running on >>>>>> Linux mail.ny03.mydomain.org 2.6.32-71.29.1.el6.centos.plus.x86_64 >>>>>> #1 SMP Sun Jun 26 16:27:27 BST 2011 x86_64 x86_64 x86_64 GNU/Linux >>>>>> This is CentOS Linux release 6.0 (Final) >>>>>> This is Perl version 5.010001 (5.10.1) >>>>>> >>>>>> This is MailScanner version 4.84.3 >>>>>> Module versions are: >>>>>> 1.00 AnyDBM_File >>>>>> 1.30 Archive::Zip >>>>>> 0.23 bignum >>>>>> 1.11 Carp >>>>>> 2.02 Compress::Zlib >>>>>> 1.119 Convert::BinHex >>>>>> 0.17 Convert::TNEF >>>>>> 2.124 Data::Dumper >>>>>> 2.27 Date::Parse >>>>>> 1.03 DirHandle >>>>>> 1.06 Fcntl >>>>>> 2.77 File::Basename >>>>>> 2.14 File::Copy >>>>>> 2.02 FileHandle >>>>>> 2.08 File::Path >>>>>> 0.22 File::Temp >>>>>> 0.92 Filesys::Df >>>>>> 3.64 HTML::Entities >>>>>> 3.64 HTML::Parser >>>>>> 3.57 HTML::TokeParser >>>>>> 1.25 IO >>>>>> 1.14 IO::File >>>>>> 1.13 IO::Pipe >>>>>> 2.04 Mail::Header >>>>>> 1.89 Math::BigInt >>>>>> 0.22 Math::BigRat >>>>>> 3.08 MIME::Base64 >>>>>> 5.427 MIME::Decoder >>>>>> 5.427 MIME::Decoder::UU >>>>>> 5.427 MIME::Head >>>>>> 5.427 MIME::Parser >>>>>> 3.08 MIME::QuotedPrint >>>>>> 5.427 MIME::Tools >>>>>> 0.14 Net::CIDR >>>>>> 1.25 Net::IP >>>>>> 0.19 OLE::Storage_Lite >>>>>> 1.04 Pod::Escapes >>>>>> 3.13 Pod::Simple >>>>>> 1.17 POSIX >>>>>> 1.21 Scalar::Util >>>>>> 1.82 Socket >>>>>> 2.20 Storable >>>>>> 1.4 Sys::Hostname::Long >>>>>> 0.27 Sys::Syslog >>>>>> 1.40 Test::Pod >>>>>> 0.92 Test::Simple >>>>>> 1.9721 Time::HiRes >>>>>> 1.02 Time::localtime >>>>>> >>>>>> Optional module versions are: >>>>>> 1.58 Archive::Tar >>>>>> 0.23 bignum >>>>>> missing Business::ISBN >>>>>> missing Business::ISBN::Data >>>>>> missing Data::Dump >>>>>> 1.82 DB_File >>>>>> 1.27 DBD::SQLite >>>>>> 1.609 DBI >>>>>> 1.16 Digest >>>>>> 1.01 Digest::HMAC >>>>>> 2.39 Digest::MD5 >>>>>> 2.12 Digest::SHA1 >>>>>> 1.01 Encode::Detect >>>>>> missing Error >>>>>> 0.27 ExtUtils::CBuilder >>>>>> 2.2203 ExtUtils::ParseXS >>>>>> 2.38 Getopt::Long >>>>>> missing Inline >>>>>> missing IO::String >>>>>> 1.09 IO::Zlib >>>>>> missing IP::Country >>>>>> missing Mail::ClamAV >>>>>> 3.003001 Mail::SpamAssassin >>>>>> missing Mail::SPF >>>>>> missing Mail::SPF::Query >>>>>> 0.35 Module::Build >>>>>> missing Net::CIDR::Lite >>>>>> 0.65 Net::DNS >>>>>> missing Net::DNS::Resolver::Programmable >>>>>> missing Net::LDAP >>>>>> 4.027 NetAddr::IP >>>>>> missing Parse::RecDescent >>>>>> missing SAVI >>>>>> 3.17 Test::Harness >>>>>> missing Test::Manifest >>>>>> 2.0.0 Text::Balanced >>>>>> 1.40 URI >>>>>> 0.77 version >>>>>> missing YAML >>>>>> Virus and Content Scanning: Starting >>>>>> Commencing scanning by clamd... >>>>>> Debug Mode Is On >>>>>> Use Threads : NO >>>>>> Socket : /var/run/clamav/clamd.sock >>>>>> IP : Using Sockets >>>>>> Lock File : NOT USED >>>>>> Time Out : 300 >>>>>> Scan Dir : /var/spool/MailScanner/incoming/9341 >>>>>> Clamd : Sending PING >>>>>> Clamd : GOT 'PONG' >>>>>> ClamD is running >>>>>> >>>>>> SENT : CONTSCAN /var/spool/MailScanner/incoming/9341 >>>>>> Clamd::INFECTED::Eicar-Test-Signature :: ./1/ >>>>>> Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com >>>>>> Completed scanning by clamd >>>>>> Virus Scanning: Clamd found 2 infections >>>>>> Infected message 1 came from 10.1.1.1 >>>>>> Virus Scanning: Found 2 viruses >>>>>> >>>>>> =========================================================================== >>>>>> Virus Scanner test reports: >>>>>> Clamd said "eicar.com was infected: Eicar-Test-Signature" >>>>>> >>>>>> If any of your virus scanners (clamd) >>>>>> are not listed there, you should check that they are installed >>>>>> correctly >>>>>> and that MailScanner is finding them correctly via its >>>>>> virus.scanners.conf. >>>>>> Config: calling custom end function SQLBlacklist >>>>>> Closing down by-domain spam blacklist >>>>>> Config: calling custom end function MailWatchLogging >>>>>> Config: calling custom end function SQLWhitelist >>>>>> Closing down by-domain spam whitelist >>>>>> >>>>>> ######################################## >>>>>> >>>>>> I've tried also to disable selinux: >>>>>> >>>>>> [root@mail init.d]# setenforce 0 >>>>>> [root@mail init.d]# >>>>>> [root@mail init.d]# MailScanner -debug >>>>>> >>>>>> Configuration: Failed to find any configuration files like >>>>>> /etc/MailScanner/conf.d/*, skipping them. at >>>>>> /usr/share/MailScanner/MailScanner/Config.pm line 2044 >>>>>> >>>>>> In Debugging mode, not forking... >>>>>> Trying to setlogsock(unix) >>>>>> Building a message batch to scan... >>>>>> Have a batch of 30 messages. >>>>>> Can't call method "print" on an undefined value at >>>>>> /usr/share/MailScanner/MailScanner/PFDiskStore.pm line 755. >>>>>> [root@mail init.d]# >>>>>> [root@mail init.d]# >>>>>> [root@mail init.d]# >>>>>> >>>>>> [root@mail init.d]# postconf -d | grep mail_version >>>>>> mail_version = 2.6.6 >>>>>> >>>>>> any ideas ? thanks you !! >>>>>> >>>>>> >>>>>> milter_macro_v = $mail_name $mail_version >>>>>> [root@mail init.d]# >>>>>> >>>>> >>>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111101/7bf16ce4/attachment-0001.html From richard at fastnet.co.uk Tue Nov 1 14:54:10 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Tue Nov 1 14:54:28 2011 Subject: Maximum Message Size / attachment size not working. BUG? In-Reply-To: <1251B5423222C446A299CABAA7B46FF42AE5A9@fn-exchange.fastnet.local> References: <1251B5423222C446A299CABAA7B46FF42AE5A9@fn-exchange.fastnet.local> Message-ID: <1251B5423222C446A299CABAA7B46FF42AE9ED@fn-exchange.fastnet.local> Hi, Just ignore me, I had Dangerous Content Scanning = no set in my conf file, which would stop this from working. Thanks Rich From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Richard Mealing Sent: 01 November 2011 10:21 To: MailScanner discussion (mailscanner@lists.mailscanner.info) Subject: Maximum Message Size / attachment size not working. BUG? Hi Jules, There appears to be a bug in that this feature doesn't work. Can this be looked into and added to a future release of mailscanner? I can't see any errors in debug mode and I can see by searching on google that other people are reporting this problem. Thanks for your help. Richard. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111101/42b7e939/attachment.html From ssilva at sgvwater.com Tue Nov 1 15:05:45 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Nov 1 15:06:05 2011 Subject: oddity on ms start In-Reply-To: <CAGDKorLukMHFBXbpas+QwFKYuX-WF1B_GJYxY-uFAgAiPn3t=A@mail.gmail.com> References: <476C33F2-8E1A-4689-B202-C9B488444BFD@fluxlabs.net> <4EA99155.50702@alexb.ch> <CAGDKorJyEaER3FfpVEsXcCRngStbAG7O_KEfkQN9kf92YzNspQ@mail.gmail.com> <90FB6FF5-C63B-4DBC-8D6E-1A57FAB8BA85@fluxlabs.net> <CAGDKorJkhBfte_FKOk3MU6UP8FC7LFcH0-884W48f2SAe10stw@mail.gmail.com> <35DF622B-0E29-42E9-A47A-56AE2CC0F1A7@fluxlabs.net> <77F23E6E4DE9084BA33755BA403E53FC0B7852999C@S8.KD0YU.COM> <D41FD68B-815A-4F72-9227-093D1DD36041@fluxlabs.net> <77F23E6E4DE9084BA33755BA403E53FC0B7852999D@S8.KD0YU.COM> <434511A7-1887-494B-8871-64D7D16442E7@fluxlabs.net> <j8cc9s$j73$1@dough.gmane.org> <CAAug_B8K8M3Q4Ap621GPxL_FkDamw-BXN0jpmPwyttCCkPNUBA@mail.gmail.com> <j8cqlm$jpn$1@dough.gmane.org> <CAAug_B9cgR3ykDFk=GQpR2f+KGkzy_-FmKvXKiLgVm=hhdLgQg@mail.gmail.com> <CAGDKorLukMHFBXbpas+QwFKYuX-WF1B_GJYxY-uFAgAiPn3t=A@mail.gmail.com> Message-ID: <j8p1s8$j64$1@dough.gmane.org> on 10/28/2011 6:18 AM Martin Hepworth spake the following: > hey I did suggest rather than TELL ;-) > > but if anyone else wants to join us on the park bench, imparting sage advice > to each other quite welcome :-) > -- > Martin Hepworth > Oxford, UK I'll bring a nice single malt and a box of cigars... From ak6783 at gmail.com Wed Nov 2 02:43:33 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Wed Nov 2 02:44:04 2011 Subject: MailScanner 4.84.3-1 can't deny any file. Message-ID: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/cd9566e9/attachment.html From ak6783 at gmail.com Wed Nov 2 02:44:39 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Wed Nov 2 02:45:09 2011 Subject: MailScanner 4.84.3-1 can't deny any file Message-ID: <CAL2m58e90xfPSOKRk_wDcbFONEmAXdfcLAz30zpr=zg0g_zeXQ@mail.gmail.com> Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -V | more Running on Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/7a8e6a81/attachment.html From jeremy at fluxlabs.net Wed Nov 2 02:53:40 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Nov 2 02:54:36 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> Message-ID: <21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net> Can you verify Dangerous Content Scanning is set to yes ? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 9:43 PM, ??? wrote: Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com<http://tw14.linguitronics.com/> 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com<http://tw.linguitronics.com/> 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/bd1761cc/attachment.html From ak6783 at gmail.com Wed Nov 2 03:04:34 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Wed Nov 2 03:05:06 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> <21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net> Message-ID: <CAL2m58eC1E+raK_Txt-=SMb7XoMjOwcK7nH4rDu6aMoQeM00LQ@mail.gmail.com> It's my setup. # Do you want to scan the messages for potentially dangerous content? # Setting this to "no" will disable all the content-based checks except # Virus Scanning, Allow Partial Messages and Allow External Message Bodies. # This can also be the filename of a ruleset. Dangerous Content Scanning = yes I have set it to yes 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> > Can you verify Dangerous Content Scanning is set to yes ? > > --**** > Jeremy McSpadden**** > Flux Labs, Inc**** > http://www.fluxlabs.net > Endless Solutions**** > *Office* : 850-588-4626**** > *Cell* : 850-890-2543 > *Fax* : 850-254-2955 > > On Nov 1, 2011, at 9:43 PM, 吳汝剛 wrote: > > Hello, > I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. > It's can't deny any attachment at filetname.rules.conf list. > Example: > The default set deny .cur and .reg attachment. > But when I send mail with .cur or .reg attachment. > It's always can received this mail. > And I check maillog. > It's no show any error message. > Please check it. > I list fedora 13 and 14 some information. > > [root@tw14 MailScanner]# MailScanner -v > Running on > Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 > 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux > This is Fedora release 14 (Laughlin) > This is Perl version 5.012003 (5.12.3) > > This is MailScanner version 4.84.3 > > [root@tw ~]# MailScanner -v > Running on > Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 > 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux > This is Fedora release 13 (Goddard) > This is Perl version 5.010001 (5.10.1) > > This is MailScanner version 4.84.3 > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- 吳汝剛 個人網頁 http://pc.aspa.idv.tw 個人Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com 手機 : 0960599655 WebRep Overall rating -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/705c334d/attachment.html From jeremy at fluxlabs.net Wed Nov 2 03:11:31 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Nov 2 03:11:47 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58eC1E+raK_Txt-=SMb7XoMjOwcK7nH4rDu6aMoQeM00LQ@mail.gmail.com> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com><21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net> <CAL2m58eC1E+raK_Txt-=SMb7XoMjOwcK7nH4rDu6aMoQeM00LQ@mail.gmail.com> Message-ID: <AE3E08A1-00E5-4941-B850-D3A55D72C04C@fluxlabs.net> deny \.reg$ Windows registry attack deny \.cur$ Cursor File in filename.rules.conf -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 10:04 PM, ??? wrote: It's my setup. # Do you want to scan the messages for potentially dangerous content? # Setting this to "no" will disable all the content-based checks except # Virus Scanning, Allow Partial Messages and Allow External Message Bodies. # This can also be the filename of a ruleset. Dangerous Content Scanning = yes I have set it to yes 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net<mailto:jeremy@fluxlabs.net>> Can you verify Dangerous Content Scanning is set to yes ? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 9:43 PM, ??? wrote: Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com<http://tw14.linguitronics.com/> 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com<http://tw.linguitronics.com/> 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- ??? ???? http://pc.aspa.idv.tw<http://pc.aspa.idv.tw/> ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw<mailto:akong@aspa.idv.tw> Email (2) : ak6783@gmail.com<mailto:ak6783@gmail.com> ?? : 0960599655 WebRep [X] Overall rating [X] [X][X][X][X][X] [X][X][X][X][X] [X] -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/d1e1b502/attachment.html From ak6783 at gmail.com Wed Nov 2 03:22:06 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Wed Nov 2 03:22:37 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <AE3E08A1-00E5-4941-B850-D3A55D72C04C@fluxlabs.net> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> <21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net> <CAL2m58eC1E+raK_Txt-=SMb7XoMjOwcK7nH4rDu6aMoQeM00LQ@mail.gmail.com> <AE3E08A1-00E5-4941-B850-D3A55D72C04C@fluxlabs.net> Message-ID: <CAL2m58dOWkxedassZFGe51UeAx0K+sNMkW=pQgyJp0EG1C2suA@mail.gmail.com> It's my filename.rules.conf deny \.cur$ Windows cursor file security vulnerability Possible buffer overflow in Windows deny \.reg$ Possible Windows registry attack Windows registry entries are very dangerous in email It's default settings. I haven't change any setup. 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> > deny \.reg$ Windows registry attack > deny \.cur$ Cursor File > > in filename.rules.conf > -- > Jeremy McSpadden**** > Flux Labs, Inc**** > http://www.fluxlabs.net > Endless Solutions**** > *Office* : 850-588-4626**** > *Cell* : 850-890-2543 > *Fax* : 850-254-2955 > > On Nov 1, 2011, at 10:04 PM, 吳汝剛 wrote: > > It's my setup. > # Do you want to scan the messages for potentially dangerous content? > # Setting this to "no" will disable all the content-based checks except > # Virus Scanning, Allow Partial Messages and Allow External Message Bodies. > # This can also be the filename of a ruleset. > Dangerous Content Scanning = yes > > I have set it to yes > > 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> > >> Can you verify Dangerous Content Scanning is set to yes ? >> >> --**** >> Jeremy McSpadden**** >> Flux Labs, Inc**** >> http://www.fluxlabs.net >> Endless Solutions**** >> *Office* : 850-588-4626**** >> *Cell* : 850-890-2543 >> *Fax* : 850-254-2955 >> >> On Nov 1, 2011, at 9:43 PM, 吳汝剛 wrote: >> >> Hello, >> I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. >> It's can't deny any attachment at filetname.rules.conf list. >> Example: >> The default set deny .cur and .reg attachment. >> But when I send mail with .cur or .reg attachment. >> It's always can received this mail. >> And I check maillog. >> It's no show any error message. >> Please check it. >> I list fedora 13 and 14 some information. >> >> [root@tw14 MailScanner]# MailScanner -v >> Running on >> Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 >> 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux >> This is Fedora release 14 (Laughlin) >> This is Perl version 5.012003 (5.12.3) >> >> This is MailScanner version 4.84.3 >> >> [root@tw ~]# MailScanner -v >> Running on >> Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 >> 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux >> This is Fedora release 13 (Goddard) >> This is Perl version 5.010001 (5.10.1) >> >> This is MailScanner version 4.84.3 >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > > -- > 吳汝剛 > 個人網頁 http://pc.aspa.idv.tw > 個人Blog http://ak6783.blogspot.com/ > Twitter http://twitter.com/akong77 > Plurk http://www.plurk.com/akong77 > Facebook http://www.facebook.com/akong77 > Email (1) : akong@aspa.idv.tw > Email (2) : ak6783@gmail.com > 手機 : 0960599655 > WebRep > Overall rating > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- 吳汝剛 個人網頁 http://pc.aspa.idv.tw 個人Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com 手機 : 0960599655 WebRep Overall rating -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/e706934f/attachment-0001.html From jeremy at fluxlabs.net Wed Nov 2 03:29:19 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Nov 2 03:29:34 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58dOWkxedassZFGe51UeAx0K+sNMkW=pQgyJp0EG1C2suA@mail.gmail.com> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com><21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net><CAL2m58eC1E+raK_Txt-=SMb7XoMjOwcK7nH4rDu6aMoQeM00LQ@mail.gmail.com><AE3E08A1-00E5-4941-B850-D3A55D72C04C@fluxlabs.net> <CAL2m58dOWkxedassZFGe51UeAx0K+sNMkW=pQgyJp0EG1C2suA@mail.gmail.com> Message-ID: <A647E45C-5753-450E-9588-5508B7792859@fluxlabs.net> Filename Rules = %etc-dir%/filename.rules.conf -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 10:22 PM, ??? wrote: It's my filename.rules.conf deny \.cur$ Windows cursor file security vulnerability Possible buffer overflow in Windows deny \.reg$ Possible Windows registry attack Windows registry entries are very dangerous in email It's default settings. I haven't change any setup. 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net<mailto:jeremy@fluxlabs.net>> deny \.reg$ Windows registry attack deny \.cur$ Cursor File in filename.rules.conf -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 10:04 PM, ??? wrote: It's my setup. # Do you want to scan the messages for potentially dangerous content? # Setting this to "no" will disable all the content-based checks except # Virus Scanning, Allow Partial Messages and Allow External Message Bodies. # This can also be the filename of a ruleset. Dangerous Content Scanning = yes I have set it to yes 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net<mailto:jeremy@fluxlabs.net>> Can you verify Dangerous Content Scanning is set to yes ? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 9:43 PM, ??? wrote: Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com<http://tw14.linguitronics.com/> 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com<http://tw.linguitronics.com/> 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- ??? ???? http://pc.aspa.idv.tw<http://pc.aspa.idv.tw/> ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw<mailto:akong@aspa.idv.tw> Email (2) : ak6783@gmail.com<mailto:ak6783@gmail.com> ?? : 0960599655 WebRep [X] Overall rating [X] [X][X][X][X][X] [X][X][X][X][X] [X] -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- ??? ???? http://pc.aspa.idv.tw<http://pc.aspa.idv.tw/> ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw<mailto:akong@aspa.idv.tw> Email (2) : ak6783@gmail.com<mailto:ak6783@gmail.com> ?? : 0960599655 WebRep [X] Overall rating [X] [X][X][X][X][X] [X][X][X][X][X] [X] -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/f9e9ae04/attachment.html From ak6783 at gmail.com Wed Nov 2 03:50:02 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Wed Nov 2 03:50:33 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <A647E45C-5753-450E-9588-5508B7792859@fluxlabs.net> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> <21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net> <CAL2m58eC1E+raK_Txt-=SMb7XoMjOwcK7nH4rDu6aMoQeM00LQ@mail.gmail.com> <AE3E08A1-00E5-4941-B850-D3A55D72C04C@fluxlabs.net> <CAL2m58dOWkxedassZFGe51UeAx0K+sNMkW=pQgyJp0EG1C2suA@mail.gmail.com> <A647E45C-5753-450E-9588-5508B7792859@fluxlabs.net> Message-ID: <CAL2m58e-rOu8rrV1p2hrFdcbEUdxcn13JFY5e8YUtBG-E7DOsQ@mail.gmail.com> Yes, It's also default setup. # # Set where to find the attachment filename ruleset. # The structure of this file is explained elsewhere, but it is used to # accept or reject file attachments based on their name, regardless of # whether they are infected or not. # # This can also point to a ruleset, but the ruleset filename must end in # ".rules" so that MailScanner can determine if the filename given is # a ruleset or not! Filename Rules = %etc-dir%/filename.rules.conf I haven't change any setup. 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> > Filename Rules = %etc-dir%/filename.rules.conf > > --**** > Jeremy McSpadden**** > Flux Labs, Inc**** > http://www.fluxlabs.net > Endless Solutions**** > *Office* : 850-588-4626**** > *Cell* : 850-890-2543 > *Fax* : 850-254-2955 > > On Nov 1, 2011, at 10:22 PM, 吳汝剛 wrote: > > It's my filename.rules.conf > deny \.cur$ Windows cursor file security > vulnerability Possible buffer overflow > in Windows > deny \.reg$ Possible Windows registry > attack Windows registry > entries are very dangerous in email > It's default settings. > I haven't change any setup. > > 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> > >> deny \.reg$ Windows registry attack >> deny \.cur$ Cursor File >> >> in filename.rules.conf >> -- >> Jeremy McSpadden**** >> Flux Labs, Inc**** >> http://www.fluxlabs.net >> Endless Solutions**** >> *Office* : 850-588-4626**** >> *Cell* : 850-890-2543 >> *Fax* : 850-254-2955 >> >> On Nov 1, 2011, at 10:04 PM, 吳汝剛 wrote: >> >> It's my setup. >> # Do you want to scan the messages for potentially dangerous content? >> # Setting this to "no" will disable all the content-based checks except >> # Virus Scanning, Allow Partial Messages and Allow External Message >> Bodies. >> # This can also be the filename of a ruleset. >> Dangerous Content Scanning = yes >> >> I have set it to yes >> >> 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> >> >>> Can you verify Dangerous Content Scanning is set to yes ? >>> >>> --**** >>> Jeremy McSpadden**** >>> Flux Labs, Inc**** >>> http://www.fluxlabs.net >>> Endless Solutions**** >>> *Office* : 850-588-4626**** >>> *Cell* : 850-890-2543 >>> *Fax* : 850-254-2955 >>> >>> On Nov 1, 2011, at 9:43 PM, 吳汝剛 wrote: >>> >>> Hello, >>> I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. >>> It's can't deny any attachment at filetname.rules.conf list. >>> Example: >>> The default set deny .cur and .reg attachment. >>> But when I send mail with .cur or .reg attachment. >>> It's always can received this mail. >>> And I check maillog. >>> It's no show any error message. >>> Please check it. >>> I list fedora 13 and 14 some information. >>> >>> [root@tw14 MailScanner]# MailScanner -v >>> Running on >>> Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 >>> 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux >>> This is Fedora release 14 (Laughlin) >>> This is Perl version 5.012003 (5.12.3) >>> >>> This is MailScanner version 4.84.3 >>> >>> [root@tw ~]# MailScanner -v >>> Running on >>> Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 >>> 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux >>> This is Fedora release 13 (Goddard) >>> This is Perl version 5.010001 (5.10.1) >>> >>> This is MailScanner version 4.84.3 >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> >> -- >> 吳汝剛 >> 個人網頁 http://pc.aspa.idv.tw >> 個人Blog http://ak6783.blogspot.com/ >> Twitter http://twitter.com/akong77 >> Plurk http://www.plurk.com/akong77 >> Facebook http://www.facebook.com/akong77 >> Email (1) : akong@aspa.idv.tw >> Email (2) : ak6783@gmail.com >> 手機 : 0960599655 >> WebRep >> Overall rating >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > > -- > 吳汝剛 > 個人網頁 http://pc.aspa.idv.tw > 個人Blog http://ak6783.blogspot.com/ > Twitter http://twitter.com/akong77 > Plurk http://www.plurk.com/akong77 > Facebook http://www.facebook.com/akong77 > Email (1) : akong@aspa.idv.tw > Email (2) : ak6783@gmail.com > 手機 : 0960599655 > WebRep > Overall rating > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- 吳汝剛 個人網頁 http://pc.aspa.idv.tw 個人Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com 手機 : 0960599655 WebRep Overall rating -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/19e4732a/attachment.html From jeremy at fluxlabs.net Wed Nov 2 04:09:29 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Nov 2 04:09:46 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58e-rOu8rrV1p2hrFdcbEUdxcn13JFY5e8YUtBG-E7DOsQ@mail.gmail.com> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com><21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net><CAL2m58eC1E+raK_Txt-=SMb7XoMjOwcK7nH4rDu6aMoQeM00LQ@mail.gmail.com><AE3E08A1-00E5-4941-B850-D3A55D72C04C@fluxlabs.net><CAL2m58dOWkxedassZFGe51UeAx0K+sNMkW=pQgyJp0EG1C2suA@mail.gmail.com><A647E45C-5753-450E-9588-5508B7792859@fluxlabs.net> <CAL2m58e-rOu8rrV1p2hrFdcbEUdxcn13JFY5e8YUtBG-E7DOsQ@mail.gmail.com> Message-ID: <1529B249-2858-44C0-8197-96196056D215@fluxlabs.net> I would try loading a default MailScanner.conf file and only editing the necessary parts. Then see what happens. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 10:50 PM, ??? wrote: Yes, It's also default setup. # # Set where to find the attachment filename ruleset. # The structure of this file is explained elsewhere, but it is used to # accept or reject file attachments based on their name, regardless of # whether they are infected or not. # # This can also point to a ruleset, but the ruleset filename must end in # ".rules" so that MailScanner can determine if the filename given is # a ruleset or not! Filename Rules = %etc-dir%/filename.rules.conf I haven't change any setup. 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net<mailto:jeremy@fluxlabs.net>> Filename Rules = %etc-dir%/filename.rules.conf -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 10:22 PM, ??? wrote: It's my filename.rules.conf deny \.cur$ Windows cursor file security vulnerability Possible buffer overflow in Windows deny \.reg$ Possible Windows registry attack Windows registry entries are very dangerous in email It's default settings. I haven't change any setup. 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net<mailto:jeremy@fluxlabs.net>> deny \.reg$ Windows registry attack deny \.cur$ Cursor File in filename.rules.conf -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 10:04 PM, ??? wrote: It's my setup. # Do you want to scan the messages for potentially dangerous content? # Setting this to "no" will disable all the content-based checks except # Virus Scanning, Allow Partial Messages and Allow External Message Bodies. # This can also be the filename of a ruleset. Dangerous Content Scanning = yes I have set it to yes 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net<mailto:jeremy@fluxlabs.net>> Can you verify Dangerous Content Scanning is set to yes ? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 1, 2011, at 9:43 PM, ??? wrote: Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com<http://tw14.linguitronics.com/> 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com<http://tw.linguitronics.com/> 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- ??? ???? http://pc.aspa.idv.tw<http://pc.aspa.idv.tw/> ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw<mailto:akong@aspa.idv.tw> Email (2) : ak6783@gmail.com<mailto:ak6783@gmail.com> ?? : 0960599655 WebRep [X] Overall rating [X] [X][X][X][X][X] [X][X][X][X][X] [X] -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- ??? ???? http://pc.aspa.idv.tw<http://pc.aspa.idv.tw/> ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw<mailto:akong@aspa.idv.tw> Email (2) : ak6783@gmail.com<mailto:ak6783@gmail.com> ?? : 0960599655 WebRep [X] Overall rating [X] [X][X][X][X][X] [X][X][X][X][X] [X] -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- ??? ???? http://pc.aspa.idv.tw<http://pc.aspa.idv.tw/> ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw<mailto:akong@aspa.idv.tw> Email (2) : ak6783@gmail.com<mailto:ak6783@gmail.com> ?? : 0960599655 WebRep [X] Overall rating [X] [X][X][X][X][X] [X][X][X][X][X] [X] -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/263b5f0f/attachment-0001.html From ak6783 at gmail.com Wed Nov 2 04:57:58 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Wed Nov 2 04:58:30 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <1529B249-2858-44C0-8197-96196056D215@fluxlabs.net> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> <21A62787-0C83-4323-BCA6-DFE5D96446E3@fluxlabs.net> <CAL2m58eC1E+raK_Txt-=SMb7XoMjOwcK7nH4rDu6aMoQeM00LQ@mail.gmail.com> <AE3E08A1-00E5-4941-B850-D3A55D72C04C@fluxlabs.net> <CAL2m58dOWkxedassZFGe51UeAx0K+sNMkW=pQgyJp0EG1C2suA@mail.gmail.com> <A647E45C-5753-450E-9588-5508B7792859@fluxlabs.net> <CAL2m58e-rOu8rrV1p2hrFdcbEUdxcn13JFY5e8YUtBG-E7DOsQ@mail.gmail.com> <1529B249-2858-44C0-8197-96196056D215@fluxlabs.net> Message-ID: <CAL2m58cMoSGReZjWduEDn3jLSRpvMLY50fGRap7AjXu6SJnU=A@mail.gmail.com> OK,Thanks a lot. If you need me to try anything. Please tell me. Thank you 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> > I would try loading a default MailScanner.conf file and only editing the > necessary parts. Then see what happens. > > --**** > Jeremy McSpadden**** > Flux Labs, Inc**** > http://www.fluxlabs.net > Endless Solutions**** > *Office* : 850-588-4626**** > *Cell* : 850-890-2543 > *Fax* : 850-254-2955 > > On Nov 1, 2011, at 10:50 PM, 吳汝剛 wrote: > > Yes, > It's also default setup. > > # > # Set where to find the attachment filename ruleset. > # The structure of this file is explained elsewhere, but it is used to > # accept or reject file attachments based on their name, regardless of > # whether they are infected or not. > # > # This can also point to a ruleset, but the ruleset filename must end in > # ".rules" so that MailScanner can determine if the filename given is > # a ruleset or not! > Filename Rules = %etc-dir%/filename.rules.conf > > I haven't change any setup. > > 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> > >> Filename Rules = %etc-dir%/filename.rules.conf >> >> --**** >> Jeremy McSpadden**** >> Flux Labs, Inc**** >> http://www.fluxlabs.net >> Endless Solutions**** >> *Office* : 850-588-4626**** >> *Cell* : 850-890-2543 >> *Fax* : 850-254-2955 >> >> On Nov 1, 2011, at 10:22 PM, 吳汝剛 wrote: >> >> It's my filename.rules.conf >> deny \.cur$ Windows cursor file security >> vulnerability Possible buffer overflow >> in Windows >> deny \.reg$ Possible Windows registry >> attack Windows registry >> entries are very dangerous in email >> It's default settings. >> I haven't change any setup. >> >> 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> >> >>> deny \.reg$ Windows registry attack >>> deny \.cur$ Cursor File >>> >>> in filename.rules.conf >>> -- >>> Jeremy McSpadden**** >>> Flux Labs, Inc**** >>> http://www.fluxlabs.net >>> Endless Solutions**** >>> *Office* : 850-588-4626**** >>> *Cell* : 850-890-2543 >>> *Fax* : 850-254-2955 >>> >>> On Nov 1, 2011, at 10:04 PM, 吳汝剛 wrote: >>> >>> It's my setup. >>> # Do you want to scan the messages for potentially dangerous content? >>> # Setting this to "no" will disable all the content-based checks except >>> # Virus Scanning, Allow Partial Messages and Allow External Message >>> Bodies. >>> # This can also be the filename of a ruleset. >>> Dangerous Content Scanning = yes >>> >>> I have set it to yes >>> >>> 2011/11/2 Jeremy McSpadden <jeremy@fluxlabs.net> >>> >>>> Can you verify Dangerous Content Scanning is set to yes ? >>>> >>>> --**** >>>> Jeremy McSpadden**** >>>> Flux Labs, Inc**** >>>> http://www.fluxlabs.net >>>> Endless Solutions**** >>>> *Office* : 850-588-4626**** >>>> *Cell* : 850-890-2543 >>>> *Fax* : 850-254-2955 >>>> >>>> On Nov 1, 2011, at 9:43 PM, 吳汝剛 wrote: >>>> >>>> Hello, >>>> I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. >>>> It's can't deny any attachment at filetname.rules.conf list. >>>> Example: >>>> The default set deny .cur and .reg attachment. >>>> But when I send mail with .cur or .reg attachment. >>>> It's always can received this mail. >>>> And I check maillog. >>>> It's no show any error message. >>>> Please check it. >>>> I list fedora 13 and 14 some information. >>>> >>>> [root@tw14 MailScanner]# MailScanner -v >>>> Running on >>>> Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 >>>> 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux >>>> This is Fedora release 14 (Laughlin) >>>> This is Perl version 5.012003 (5.12.3) >>>> >>>> This is MailScanner version 4.84.3 >>>> >>>> [root@tw ~]# MailScanner -v >>>> Running on >>>> Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 >>>> 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux >>>> This is Fedora release 13 (Goddard) >>>> This is Perl version 5.010001 (5.10.1) >>>> >>>> This is MailScanner version 4.84.3 >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >>> >>> -- >>> 吳汝剛 >>> 個人網頁 http://pc.aspa.idv.tw >>> 個人Blog http://ak6783.blogspot.com/ >>> Twitter http://twitter.com/akong77 >>> Plurk http://www.plurk.com/akong77 >>> Facebook http://www.facebook.com/akong77 >>> Email (1) : akong@aspa.idv.tw >>> Email (2) : ak6783@gmail.com >>> 手機 : 0960599655 >>> WebRep >>> Overall rating >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> >> -- >> 吳汝剛 >> 個人網頁 http://pc.aspa.idv.tw >> 個人Blog http://ak6783.blogspot.com/ >> Twitter http://twitter.com/akong77 >> Plurk http://www.plurk.com/akong77 >> Facebook http://www.facebook.com/akong77 >> Email (1) : akong@aspa.idv.tw >> Email (2) : ak6783@gmail.com >> 手機 : 0960599655 >> WebRep >> Overall rating >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > > -- > 吳汝剛 > 個人網頁 http://pc.aspa.idv.tw > 個人Blog http://ak6783.blogspot.com/ > Twitter http://twitter.com/akong77 > Plurk http://www.plurk.com/akong77 > Facebook http://www.facebook.com/akong77 > Email (1) : akong@aspa.idv.tw > Email (2) : ak6783@gmail.com > 手機 : 0960599655 > WebRep > Overall rating > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- 吳汝剛 個人網頁 http://pc.aspa.idv.tw 個人Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com 手機 : 0960599655 WebRep Overall rating -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/2dd5b7d0/attachment.html From Denis.Beauchemin at usherbrooke.ca Wed Nov 2 12:31:24 2011 From: Denis.Beauchemin at usherbrooke.ca (Denis Beauchemin) Date: Wed Nov 2 12:31:44 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> Message-ID: <E4CD9F6A1A6FF745BCABA56BBD1008D503A5B6C3@XMBX01.sti.usherbrooke.ca> I wouldn?t be surprised if you forgot to stop the default sendmail (/sbin/chkconfig -list sendmail should say it is OFF at all levels). You must turn it off (/sbin/chkconfig sendmail off; /sbin/service sendmail stop) and then start/restart MailScanner. Are there any headers added by MailScanner in your received emails? You should have some. If you don?t have any, it?s because of what I described in the previous paragraph. Denis ________________________________ Denis Beauchemin Architecte Technologique - Section Infrastructure des serveurs Service des technologies de l?information (S.T.I.) Universite de Sherbrooke Courriel: Denis.Beauchemin@USherbrooke.ca<mailto:Denis.Beauchemin@USherbrooke.ca> Tel.: 819-821-8000 Poste: 62252 De : mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] De la part de ??? Envoye : 1 novembre 2011 22:44 A : mailscanner@lists.mailscanner.info Objet : MailScanner 4.84.3-1 can't deny any file. Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com<http://tw14.linguitronics.com> 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com<http://tw.linguitronics.com> 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/6e625578/attachment.html From ak6783 at gmail.com Wed Nov 2 13:02:09 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Wed Nov 2 13:02:40 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <E4CD9F6A1A6FF745BCABA56BBD1008D503A5B6C3@XMBX01.sti.usherbrooke.ca> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> <E4CD9F6A1A6FF745BCABA56BBD1008D503A5B6C3@XMBX01.sti.usherbrooke.ca> Message-ID: <CAL2m58eG74h7UBR_C90JNA6dXEMWrVkUsS1269iUYbu39QnweQ@mail.gmail.com> I check mail header. From: root <root@tw.linguitronics.com> Message-Id: <201111021300.pA2D05T0028238@tw.linguitronics.com> Date: Wed, 02 Nov 2011 21:00:05 +0800 To: akong@tw14.linguitronics.com Subject: Test mail User-Agent: Heirloom mailx 12.5 7/5/10 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Linguitronics-MailScanner: Found to be clean, Found to be clean X-Spam-Status: No, No X-Linguitronics-MailScanner-Information: Please contact the ISP for more information X-Linguitronics-MailScanner-ID: 6F7351403F3.ACAAE X-Linguitronics-MailScanner-From: root@tw.linguitronics.com I make sure Mailscanner is ok.And I have stop postfix only start MailScanner. 2011/11/2 Denis Beauchemin <Denis.Beauchemin@usherbrooke.ca> > I wouldn?t be surprised if you forgot to stop the default sendmail > (/sbin/chkconfig ?list sendmail should say it is OFF at all levels). You > must turn it off (/sbin/chkconfig sendmail off; /sbin/service sendmail > stop) and then start/restart MailScanner.**** > > ** ** > > Are there any headers added by MailScanner in your received emails? You > should have some. If you don?t have any, it?s because of what I described > in the previous paragraph.**** > > ** ** > > Denis**** > > ** ** > * > ------------------------------ > * > > *Denis Beauchemin** > **Architecte Technologique - Section Infrastructure des serveurs > *Service des technologies de l?information (S.T.I.) > Universit? de Sherbrooke > Courriel: Denis.Beauchemin@USherbrooke.ca > T?l.: 819-821-8000 Poste: 62252** > > ** ** > > *De :* mailscanner-bounces@lists.mailscanner.info [mailto: > mailscanner-bounces@lists.mailscanner.info] *De la part de* ??? > *Envoy? :* 1 novembre 2011 22:44 > *? :* mailscanner@lists.mailscanner.info > *Objet :* MailScanner 4.84.3-1 can't deny any file.**** > > ** ** > > Hello, > I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. > It's can't deny any attachment at filetname.rules.conf list. > Example: > The default set deny .cur and .reg attachment. > But when I send mail with .cur or .reg attachment. > It's always can received this mail. > And I check maillog. > It's no show any error message. > Please check it. > I list fedora 13 and 14 some information. > > [root@tw14 MailScanner]# MailScanner -v > Running on > Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 > 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux > This is Fedora release 14 (Laughlin) > This is Perl version 5.012003 (5.12.3) > > This is MailScanner version 4.84.3 > > [root@tw ~]# MailScanner -v > Running on > Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 > 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux > This is Fedora release 13 (Goddard) > This is Perl version 5.010001 (5.10.1) > > This is MailScanner version 4.84.3**** > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com ?? : 0960599655 WebRep Overall rating -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/c4452e14/attachment.html From bbecken at aafp.org Wed Nov 2 14:31:52 2011 From: bbecken at aafp.org (Brad Beckenhauer) Date: Wed Nov 2 14:33:21 2011 Subject: Maximum Message Size / Attachments. In-Reply-To: <1251B5423222C446A299CABAA7B46FF42A7240@fn-exchange.fastnet.local> References: <1251B5423222C446A299CABAA7B46FF42A7240@fn-exchange.fastnet.local> Message-ID: <4EB10E08020000680009EF90@smtp.aafp.org> per http://mailscanner.info/ChangeLog 5/5/2006 New in Version 4.53.8-1 - Added support for optional multipliers in numbers in MailScanner.conf. So you can now write "50M" instead of "50000000". The multipliers supported are "k", "m" and "g" to denote 1 thousand, 1 million and 1 billion (10^9) in upper or lower case. You must *not* put any spaces between the number and the multiplier character. examples: # Set addresses/domains to be limited as follows: # Direction Pattern Size Limit # From: user@good.domain.com 1m # Limit FROM specified user to 1MB # From: *@friendly.domain.com 10m # Limit FROM specified domain to 10MB # From: 123.234.567.2 1m # Limit FROM IP address to 1MB # From: 123.234. 1m # Limit FROM IP range to 1MB # From: /^192\.168\.13[4567]\./ 500k # Limit FROM IP range to 500K # To: abc@xyz.com 0 # No Attachments allowed TO this user # To: *@yahoo.com 1m # Limit all TO this Domain to 1MB # FromOrTo: *@xyz.org 25m # Limit xyz.org to 25MB FromOrTo: default 50m # Default. >>> On 10/24/2011 at 7:11 AM, Richard Mealing <richard@fastnet.co.uk> wrote: Hi everyone, I?m using MailScanner-4.83.5 and I?ve changed the Maximum Message size / attachment size to rulesets.. Maximum Message Size = %rules-dir%/max.message.size.rules In my rules file I have this set ? # Set the Maximum Message size. # Do not change this default line. FromOrTo: default 0 # ################################## To: *@adomain.co.uk 5M When I email my domain with an 11m attachment, it comes in fine and gets scanned, spamassassin says to big to scan, but the email gets delivered. I want to bounce the email using mailscanner. Is this possible or should I just give up and do this on sendmail somehow? I also tried setting Maximum Attachment size to a ruleset and creating this ruleset ? # Set the Maximum Message size. # Do not change this default line. FromOrTo: default -1 # ################################## To: *@mydomain.co.uk 5M Again the email just comes through nicely, but not what I want! I have restarted mailscanner and reloaded it, restarted the machine. I can?t see any problems in lint. Many thanks, Richard -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111102/b4373950/attachment.html From m.a.young at durham.ac.uk Wed Nov 2 17:22:12 2011 From: m.a.young at durham.ac.uk (M A Young) Date: Wed Nov 2 17:22:54 2011 Subject: adding extra addresses to ScamNailer In-Reply-To: <alpine.GSO.2.00.1110031538420.22777@algedi.dur.ac.uk> References: <alpine.GSO.2.00.1110031538420.22777@algedi.dur.ac.uk> Message-ID: <alpine.GSO.2.00.1111021718570.11189@algedi.dur.ac.uk> On Mon, 3 Oct 2011, M A Young wrote: > I would like to be able to add extra entries to the list handled by > ScamNailer. The web pages suggest that there should be a local file I can > use, but I have looked through the ScamNailer program and can't find it. I > am missing something obvious or do I have to modify the code myself to add > one. As I didn't get a reply, I did modify the code myself to use a local file to add and remove entries. I am attaching a patch of the changes I made in case it is useful to anyone else. Michael Young -------------- next part -------------- --- ScamNailer-2.09.orig 2011-09-28 14:15:05.000000000 +0100 +++ ScamNailer-2.09 2011-10-27 12:49:00.000000000 +0100 @@ -11,6 +11,7 @@ # users, then you can use it and change it freely, but please keep my # name and email address at the top. # +# Changes added to allow local edits Oct 2011 use strict; use File::Temp; @@ -140,6 +141,8 @@ my $urlbase = "http://www.mailscanner.tv/emails."; my $target= $emailscurrent . 'phishing.emails.list'; my $query="emails.msupdate.greylist.bastionmail.com"; + my $localedits = $emailscurrent . 'local.edits'; + my $localcache = $cache . 'local.temp.file'; my $baseupdated = 0; if (! -d $emailscurrent) { @@ -345,6 +348,76 @@ } + if ($generate && -s $localedits) { + my %localupdates=(); + open (FILE, "$localedits") or die + "Unable to open local edits file ($localedits)\n"; + while (<FILE>) { + chop; + my $line=$_; + # Is it an addition? + if ($line =~ /^\> (.+)$/) { + if (defined $localupdates{$1}) { + if ($localupdates{$1} eq "<") { + delete $localupdates{$1}; + } + } else { + $localupdates{$1}=">"; + } + } + # Is it an removal? + if ($line =~ /^\< (.+)$/) { + if (defined $localupdates{$1}) { + if ($localupdates{$1} eq ">") { + delete $localupdates{$1}; + } + } else { + $localupdates{$1}="<"; + } + } + } + close(FILE); + + # open latest cache file + my $file; + if ($currentupdate>0) { + $file="$cache/$currentbase.$currentupdate"; + } else { + $file="$cache/$currentbase"; + } + open (FILE, "$file") or die + "Unable to open file ($file)\n"; + # Now open the temporary cache file + open (FILEOUT, ">$localcache") or die + "Unable to write to temporary cache file ($localcache)"; + # Loop through the base file (or most recent update) + while (<FILE>) { + chop; + my $line=$_; + + if (defined ($localupdates{$line})) { + # Does the line need removing? + if ($localupdates{$line} eq "<") { + next; + } + # Is it marked as an addition but already present? + elsif ($localupdates{$line} eq ">") { + delete $localupdates{$line}; + } + } + print FILEOUT $line."\n"; + } + close (FILE); + my $line; + # Are there any additions left + foreach $line (keys %localupdates) { + if ($localupdates{$line} eq ">") { + print FILEOUT $line."\n" ; + } + } + close (FILEOUT); + } + # Changes have been made if ($generate) { print "Updating live file $target\n" unless $quiet; @@ -357,6 +430,9 @@ if ($file eq "") { die "Unable to work out file!\n"; } + if ( -f $localcache ) { + $file="$localcache"; + } system ("mv -f $target $target.old"); system ("cp $file $target"); From johnn at zylun.com Thu Nov 3 00:43:43 2011 From: johnn at zylun.com (John Mark Niar) Date: Thu Nov 3 00:44:00 2011 Subject: Spamassassin /root/.spamassassin is inaccessible: Permission denied Message-ID: <00a201cc99c1$a4dc9880$ee95c980$@com> Hey Guys, Anybody knows how to deal with this with MailScanner? My research tells me that I need to remove the per-user config of SpamAssassin which I did by adding "-x" option in the /etc/sysconfig/spamassassin. But still no changes. Thanks, John Mark Niar IT Manager Zylun Staffing -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111103/d7486850/attachment.html From ak6783 at gmail.com Thu Nov 3 09:56:36 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Thu Nov 3 09:57:07 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <E4CD9F6A1A6FF745BCABA56BBD1008D503A5B6C3@XMBX01.sti.usherbrooke.ca> References: <CAL2m58esmN0UjVeiZ1ix3t3AY7H5eKyc2Pk3sZ0nJfBowHKCuQ@mail.gmail.com> <E4CD9F6A1A6FF745BCABA56BBD1008D503A5B6C3@XMBX01.sti.usherbrooke.ca> Message-ID: <CAL2m58eOpnpZShN-R0THFpvkHHy0UWpiDVKur8Rnf_6gB+jz-Q@mail.gmail.com> Hello Is it found any problem? Why use 4.84.3-1 can't deny file? 2011/11/2 Denis Beauchemin <Denis.Beauchemin@usherbrooke.ca> > I wouldn?t be surprised if you forgot to stop the default sendmail > (/sbin/chkconfig ?list sendmail should say it is OFF at all levels). You > must turn it off (/sbin/chkconfig sendmail off; /sbin/service sendmail > stop) and then start/restart MailScanner.**** > > ** ** > > Are there any headers added by MailScanner in your received emails? You > should have some. If you don?t have any, it?s because of what I described > in the previous paragraph.**** > > ** ** > > Denis**** > > ** ** > * > ------------------------------ > * > > *Denis Beauchemin** > **Architecte Technologique - Section Infrastructure des serveurs > *Service des technologies de l?information (S.T.I.) > Universit? de Sherbrooke > Courriel: Denis.Beauchemin@USherbrooke.ca > T?l.: 819-821-8000 Poste: 62252** > > ** ** > > *De :* mailscanner-bounces@lists.mailscanner.info [mailto: > mailscanner-bounces@lists.mailscanner.info] *De la part de* ??? > *Envoy? :* 1 novembre 2011 22:44 > *? :* mailscanner@lists.mailscanner.info > *Objet :* MailScanner 4.84.3-1 can't deny any file.**** > > ** ** > > Hello, > I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. > It's can't deny any attachment at filetname.rules.conf list. > Example: > The default set deny .cur and .reg attachment. > But when I send mail with .cur or .reg attachment. > It's always can received this mail. > And I check maillog. > It's no show any error message. > Please check it. > I list fedora 13 and 14 some information. > > [root@tw14 MailScanner]# MailScanner -v > Running on > Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 > 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux > This is Fedora release 14 (Laughlin) > This is Perl version 5.012003 (5.12.3) > > This is MailScanner version 4.84.3 > > [root@tw ~]# MailScanner -v > Running on > Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 > 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux > This is Fedora release 13 (Goddard) > This is Perl version 5.010001 (5.10.1) > > This is MailScanner version 4.84.3**** > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com ?? : 0960599655 WebRep Overall rating -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111103/8bb06df4/attachment.html From maxsec at gmail.com Thu Nov 3 10:46:54 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Nov 3 10:47:02 2011 Subject: Spamassassin /root/.spamassassin is inaccessible: Permission denied In-Reply-To: <00a201cc99c1$a4dc9880$ee95c980$@com> References: <00a201cc99c1$a4dc9880$ee95c980$@com> Message-ID: <CAGDKorKyHwoftUE9j9xuHXv=3udtg+8Znrbs54PDv0bAvwNazg@mail.gmail.com> it's probably trying to create the bayes DB there, so make sure your bayes_path is forced somewhere sensible in the MailScanner.cf -- Martin Hepworth Oxford, UK On 3 November 2011 00:43, John Mark Niar <johnn@zylun.com> wrote: > Hey Guys,**** > > ** ** > > Anybody knows how to deal with this with MailScanner?**** > > My research tells me that I need to remove the per-user config of > SpamAssassin which I did by adding ?-x? option in the > /etc/sysconfig/spamassassin.**** > > But still no changes.**** > > ** ** > > ** ** > > ** ** > > Thanks,**** > > ** ** > > John Mark Niar**** > > IT Manager**** > > Zylun Staffing**** > > ** ** > > -- > This message has been scanned for viruses and > dangerous content by *MailScanner* <http://www.mailscanner.info/>, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111103/25a726f2/attachment.html From sandro at e-den.it Thu Nov 3 11:10:44 2011 From: sandro at e-den.it (Alessandro Dentella) Date: Thu Nov 3 11:10:55 2011 Subject: skipping message ... and stopping scanning until 'postsuper -r ALL' Message-ID: <20111103111044.GA6582@ubuntu> Hi, I have a debian squeeze box w/ MailScanner 4.84.3 and postfix 2.7.1 + baruwa 1.1.1. This should be almost a clone of a working setup I did myself some months ago and is still working. The problem =========== The problem now is that mailscanner stops processing mails until u run "postfix -r ALL", it processes the queue and stops again. I have mailscanner pick incoming postfix queue via 'header_checks'. If I commenti it (and bypass mailscanner) mail don't get stuck. The logs ======== When MS stops scanning mail, it starts complaining in mail.log that MailScanner[28558]: Warning: skipping message 06A602E1BA8.AFAE8 as it has been attempted too many times MailScanner[28558]: Quarantined message 06A602E1BA8.AFAE8 as it caused MailScanner to crash several times This goes on forever, content of Processing.db: baruwa:/var/spool/MailScanner/incoming# sqlite3 Processing.db .dump PRAGMA foreign_keys=OFF; BEGIN TRANSACTION; CREATE TABLE processing (id TEXT, count INT, nexttime INT); INSERT INTO "processing" VALUES('06A602E1BA8.AFAE8',6,1320255994); INSERT INTO "processing" VALUES('06CD02E06BC.A7D24',2,1320264046); CREATE TABLE archive (id TEXT, count INT, nexttime INT); CREATE UNIQUE INDEX id_uniq ON processing(id); COMMIT; Some questions to debug ======================= I'd like to understand: 1. Where is the message with id 06A602E1BA8.AFAE8 stored? I thought it was under /var/spool/MailScanner but I can't find it anywhere. 2. Why does MailScanner processes again the message if it believe it should be skipped? 3. How can I diagnose why MailScanner stops scanning new messages? syslog helps saying: Process did not exit cleanly, returned 255 with signal 0 but nothing more. MailScanner --lint seems not to complain of anything... (below the result). Any help is really appreciated thanks in advance sandro *:-) -- Sandro Dentella *:-) http://www.reteisi.org Soluzioni libere per le scuole http://sqlkit.argolinux.org SQLkit home page - PyGTK/python/sqlalchemy /var/log/mail.log =================== ... MailScanner[28558]: Warning: skipping message 06A602E1BA8.AFAE8 as it has been attempted too many times ... MailScanner[28558]: Quarantined message 06A602E1BA8.AFAE8 as it caused MailScanner to crash several times ... MailScanner[28563]: MailScanner E-Mail Virus Scanner version 4.84.3 starting... ... MailScanner[28563]: Reading configuration file /etc/MailScanner/MailScanner.conf ... MailScanner[28563]: Reading configuration file /etc/MailScanner/conf.d/baruwa.conf ... MailScanner[28563]: Reading configuration file /etc/MailScanner/conf.d/mit.conf ... MailScanner[28563]: Read 869 hostnames from the phishing whitelist ... MailScanner[28563]: Read 4252 hostnames from the phishing blacklists ... MailScanner[28563]: Config: calling custom init function BaruwaLowScore ... MailScanner[28563]: Baruwa: Populating spam score settings ... MailScanner[28563]: Baruwa: no spam score settings found using defaults ... MailScanner[28563]: Config: calling custom init function BaruwaBlacklist ... MailScanner[28563]: Baruwa: Starting blacklists ... MailScanner[28563]: Baruwa: Read 0 blacklist items ... MailScanner[28563]: Baruwa: Ip blocks blacklisted: ... MailScanner[28563]: Config: calling custom init function BaruwaSQL ... MailScanner[28564]: Baruwa: Starting SQL logger ... MailScanner[28563]: Config: calling custom init function BaruwaHighScore ... MailScanner[28563]: Baruwa: Populating high spam score settings ... MailScanner[28563]: Baruwa: no high spam score settings found using defaults ... MailScanner[28563]: Config: calling custom init function BaruwaWhitelist ... MailScanner[28563]: Baruwa: Starting whitelists ... MailScanner[28563]: Baruwa: Read 0 whitelist items ... MailScanner[28563]: Baruwa: Ip blocks whitelisted: ... MailScanner[28563]: Using SpamAssassin results cache ... MailScanner[28563]: Connected to SpamAssassin cache database ... MailScanner[28563]: Connected to Processing Attempts Database ... MailScanner[28563]: Found 1 messages in the Processing Attempts Database ... MailScanner[28563]: Using locktype = flock ... MailScanner[28563]: Warning: skipping message 06A602E1BA8.AFAE8 as it has been attempted too many times MailScanner --lint ===================== baruwa-thunder:/var/spool/MailScanner/incoming# MailScanner --lint Trying to setlogsock(unix) Reading configuration file /etc/MailScanner/MailScanner.conf Reading configuration file /etc/MailScanner/conf.d/baruwa.conf Reading configuration file /etc/MailScanner/conf.d/mit.conf Read 869 hostnames from the phishing whitelist Read 4252 hostnames from the phishing blacklists Config: calling custom init function BaruwaLowScore Baruwa: Populating spam score settings Baruwa: no spam score settings found using defaults Config: calling custom init function BaruwaBlacklist Baruwa: Starting blacklists Baruwa: Read 0 blacklist items Baruwa: Ip blocks blacklisted: Config: calling custom init function BaruwaSQL Baruwa: Starting SQL logger Config: calling custom init function BaruwaHighScore Baruwa: Populating high spam score settings Baruwa: no high spam score settings found using defaults Config: calling custom init function BaruwaWhitelist Baruwa: Starting whitelists Baruwa: Read 0 whitelist items Baruwa: Ip blocks whitelisted: Checking version numbers... Version number in MailScanner.conf (4.84.3) is correct. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (33) MailScanner setting UID to (103) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 2 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = clamd" Found these virus scanners installed: clamd =========================================================================== Virus and Content Scanning: Starting =========================================================================== If any of your virus scanners (clamd) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. Config: calling custom end function BaruwaLowScore Baruwa: Shutting down spam score settings Config: calling custom end function BaruwaBlacklist Baruwa: Shutting down blacklists Config: calling custom end function BaruwaSQL Baruwa: Shutting down SQL logger Config: calling custom end function BaruwaHighScore Baruwa: Shutting down high spam score settings Config: calling custom end function BaruwaWhitelist Baruwa: Shutting down whitelists From markus at markusoft.se Thu Nov 3 11:45:59 2011 From: markus at markusoft.se (Markus Nilsson) Date: Thu Nov 3 11:46:22 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58eOpnpZShN-R0THFpvkHHy0UWpiDVKur8Rnf_6gB+jz-Q@mail.gmail.com> Message-ID: <4f4e4433-d5d8-47c2-b8b4-ef6658053264@cronlabworkstation0> Please print the relevant configuration settings in MailScanner! Allow Filenames = Deny Filenames = Filename Rules = Allow Filetypes = Allow File MIME Types = Deny Filetypes = Deny File MIME Types = Filetype Rules = Thanks! /Markus ----- Ursprungligt meddelande ----- Fr?n: "???" <ak6783@gmail.com> Till: "MailScanner discussion" <mailscanner@lists.mailscanner.info> Skickat: torsdag, 3 nov 2011 10:56:36 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello Is it found any problem? Why use 4.84.3-1 can't deny file? 2011/11/2 Denis Beauchemin < Denis.Beauchemin@usherbrooke.ca > I wouldn?t be surprised if you forgot to stop the default sendmail (/sbin/chkconfig ?list sendmail should say it is OFF at all levels). You must turn it off (/sbin/chkconfig sendmail off; /sbin/service sendmail stop) and then start/restart MailScanner. Are there any headers added by MailScanner in your received emails? You should have some. If you don?t have any, it?s because of what I described in the previous paragraph. Denis Denis Beauchemin Architecte Technologique - Section Infrastructure des serveurs Service des technologies de l?information (S.T.I.) Universit? de Sherbrooke Courriel: Denis.Beauchemin@USherbrooke.ca T?l.: 819-821-8000 Poste: 62252 De : mailscanner-bounces@lists.mailscanner.info [mailto: mailscanner-bounces@lists.mailscanner.info ] De la part de ??? Envoy? : 1 novembre 2011 22:44 ? : mailscanner@lists.mailscanner.info Objet : MailScanner 4.84.3-1 can't deny any file. Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com 2.6.35.13-91 .fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com ?? : 0960599655 WebRep Overall rating MailScanner CronLabAntiSpamAppliance Signature Bearcom scanned this message. We don't think it was spam. Was it? Report here! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- Skipped content of type multipart/related From maxsec at gmail.com Thu Nov 3 19:43:12 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Nov 3 19:43:21 2011 Subject: skipping message ... and stopping scanning until 'postsuper -r ALL' In-Reply-To: <20111103111044.GA6582@ubuntu> References: <20111103111044.GA6582@ubuntu> Message-ID: <CAGDKor+GOa951q-TrBK9kVEWabTx8afAHmWyGzh0X3cQCcmRtg@mail.gmail.com> always this message or repeats it even if you remove that message? -- Martin Hepworth Oxford, UK On 3 November 2011 11:10, Alessandro Dentella <sandro@e-den.it> wrote: > Hi, > > > I have a debian squeeze box w/ MailScanner 4.84.3 and postfix 2.7.1 + > baruwa > 1.1.1. This should be almost a clone of a working setup I did myself some > months ago and is still working. > > The problem > =========== > > The problem now is that mailscanner stops processing mails until u run > "postfix -r ALL", it processes the queue and stops again. I have > mailscanner > pick incoming postfix queue via 'header_checks'. If I commenti it (and > bypass mailscanner) mail don't get stuck. > > The logs > ======== > > When MS stops scanning mail, it starts complaining in mail.log that > > MailScanner[28558]: Warning: skipping message 06A602E1BA8.AFAE8 as it > has been attempted too many times > MailScanner[28558]: Quarantined message 06A602E1BA8.AFAE8 as it caused > MailScanner to crash several times > > This goes on forever, content of Processing.db: > > > baruwa:/var/spool/MailScanner/incoming# sqlite3 Processing.db .dump > PRAGMA foreign_keys=OFF; > BEGIN TRANSACTION; > CREATE TABLE processing (id TEXT, count INT, nexttime INT); > INSERT INTO "processing" VALUES('06A602E1BA8.AFAE8',6,1320255994); > INSERT INTO "processing" VALUES('06CD02E06BC.A7D24',2,1320264046); > CREATE TABLE archive (id TEXT, count INT, nexttime INT); > CREATE UNIQUE INDEX id_uniq ON processing(id); > COMMIT; > > > Some questions to debug > ======================= > > I'd like to understand: > > 1. Where is the message with id 06A602E1BA8.AFAE8 stored? I thought it was > under /var/spool/MailScanner but I can't find it anywhere. > > 2. Why does MailScanner processes again the message if it believe it should > be skipped? > > 3. How can I diagnose why MailScanner stops scanning new messages? > syslog helps saying: > > Process did not exit cleanly, returned 255 with signal 0 > > but nothing more. MailScanner --lint seems not to complain of > anything... (below the result). > > Any help is really appreciated > > thanks in advance > sandro > *:-) > > -- > Sandro Dentella *:-) > http://www.reteisi.org Soluzioni libere per le scuole > http://sqlkit.argolinux.org SQLkit home page - > PyGTK/python/sqlalchemy > > > /var/log/mail.log > =================== > > ... MailScanner[28558]: Warning: skipping message 06A602E1BA8.AFAE8 as it > has been attempted too many times > ... MailScanner[28558]: Quarantined message 06A602E1BA8.AFAE8 as it caused > MailScanner to crash several times > ... MailScanner[28563]: MailScanner E-Mail Virus Scanner version 4.84.3 > starting... > ... MailScanner[28563]: Reading configuration file > /etc/MailScanner/MailScanner.conf > ... MailScanner[28563]: Reading configuration file > /etc/MailScanner/conf.d/baruwa.conf > ... MailScanner[28563]: Reading configuration file > /etc/MailScanner/conf.d/mit.conf > ... MailScanner[28563]: Read 869 hostnames from the phishing whitelist > ... MailScanner[28563]: Read 4252 hostnames from the phishing blacklists > ... MailScanner[28563]: Config: calling custom init function BaruwaLowScore > ... MailScanner[28563]: Baruwa: Populating spam score settings > ... MailScanner[28563]: Baruwa: no spam score settings found using defaults > ... MailScanner[28563]: Config: calling custom init function > BaruwaBlacklist > ... MailScanner[28563]: Baruwa: Starting blacklists > ... MailScanner[28563]: Baruwa: Read 0 blacklist items > ... MailScanner[28563]: Baruwa: Ip blocks blacklisted: > ... MailScanner[28563]: Config: calling custom init function BaruwaSQL > ... MailScanner[28564]: Baruwa: Starting SQL logger > ... MailScanner[28563]: Config: calling custom init function > BaruwaHighScore > ... MailScanner[28563]: Baruwa: Populating high spam score settings > ... MailScanner[28563]: Baruwa: no high spam score settings found using > defaults > ... MailScanner[28563]: Config: calling custom init function > BaruwaWhitelist > ... MailScanner[28563]: Baruwa: Starting whitelists > ... MailScanner[28563]: Baruwa: Read 0 whitelist items > ... MailScanner[28563]: Baruwa: Ip blocks whitelisted: > ... MailScanner[28563]: Using SpamAssassin results cache > ... MailScanner[28563]: Connected to SpamAssassin cache database > ... MailScanner[28563]: Connected to Processing Attempts Database > ... MailScanner[28563]: Found 1 messages in the Processing Attempts > Database > ... MailScanner[28563]: Using locktype = flock > ... MailScanner[28563]: Warning: skipping message 06A602E1BA8.AFAE8 as it > has been attempted too many times > > > > MailScanner --lint > ===================== > > baruwa-thunder:/var/spool/MailScanner/incoming# MailScanner --lint > Trying to setlogsock(unix) > > Reading configuration file /etc/MailScanner/MailScanner.conf > Reading configuration file /etc/MailScanner/conf.d/baruwa.conf > Reading configuration file /etc/MailScanner/conf.d/mit.conf > Read 869 hostnames from the phishing whitelist > Read 4252 hostnames from the phishing blacklists > Config: calling custom init function BaruwaLowScore > Baruwa: Populating spam score settings > Baruwa: no spam score settings found using defaults > Config: calling custom init function BaruwaBlacklist > Baruwa: Starting blacklists > Baruwa: Read 0 blacklist items > Baruwa: Ip blocks blacklisted: > Config: calling custom init function BaruwaSQL > Baruwa: Starting SQL logger > Config: calling custom init function BaruwaHighScore > Baruwa: Populating high spam score settings > Baruwa: no high spam score settings found using defaults > Config: calling custom init function BaruwaWhitelist > Baruwa: Starting whitelists > Baruwa: Read 0 whitelist items > Baruwa: Ip blocks whitelisted: > > Checking version numbers... > Version number in MailScanner.conf (4.84.3) is correct. > > Your envelope_sender_header in spam.assassin.prefs.conf is correct. > MailScanner setting GID to (33) > MailScanner setting UID to (103) > > Checking for SpamAssassin errors (if you use it)... > Using SpamAssassin results cache > Connected to SpamAssassin cache database > SpamAssassin reported no errors. > Connected to Processing Attempts Database > Created Processing Attempts Database successfully > There are 2 messages in the Processing Attempts Database > Using locktype = posix > MailScanner.conf says "Virus Scanners = clamd" > Found these virus scanners installed: clamd > =========================================================================== > Virus and Content Scanning: Starting > =========================================================================== > > If any of your virus scanners (clamd) > are not listed there, you should check that they are installed correctly > and that MailScanner is finding them correctly via its virus.scanners.conf. > Config: calling custom end function BaruwaLowScore > Baruwa: Shutting down spam score settings > Config: calling custom end function BaruwaBlacklist > Baruwa: Shutting down blacklists > Config: calling custom end function BaruwaSQL > Baruwa: Shutting down SQL logger > Config: calling custom end function BaruwaHighScore > Baruwa: Shutting down high spam score settings > Config: calling custom end function BaruwaWhitelist > Baruwa: Shutting down whitelists > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111103/4daae3d4/attachment.html From sandro at e-den.it Thu Nov 3 22:58:45 2011 From: sandro at e-den.it (Alessandro Dentella) Date: Thu Nov 3 23:09:24 2011 Subject: Insecure dependency: what is it? Message-ID: <20111103225844.GA11302@ubuntu> Hi, while trying to debug the setup I wrote about yesterday I realized that /var/log/syslog contains some messages as:: MailScanner: Process did not exit cleanly, returned 2 with signal 0 running with Debug = yes and Debug SpamAssassing = yes MS dies with:: 23:48:46 Nov 3 23:48:46.397 [14687] dbg: check: tests=MISSING_DATE,MISSING_HEADERS,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS 23:48:46 Nov 3 23:48:46.397 [14687] dbg: check: subtests=__GATED_THROUGH_RCVD_REMOVER,__HAS_MESSAGE_ID,__HAS_MSGID,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__TO_NO_ARROWS_R,__UNUSABLE_MSGID 23:48:46 Nov 3 23:48:46.398 [14687] dbg: plugin: Mail::SpamAssassin::Plugin::Bayes=HASH(0xa5b1a48) implements 'learner_close', priority 0 23:48:46 Building a message batch to scan... 23:48:46 Insecure dependency in mkdir while running with -T switch at /usr/share/MailScanner//MailScanner/Quarantine.pm line 189. The last row is issued while trying to create a directory under /var/spool/MailScanner/quadantine. Postfix that is the user MS "Run AS". Postfix is able to create such a directory so I don't really understand what it exacly means. This error prevents some mail from being processed but after some time googling around I wasn't able to understand how to fix it. Any hint is really appreciated. thanks sandro *:-) -- Sandro Dentella *:-) http://www.reteisi.org Soluzioni libere per le scuole http://sqlkit.argolinux.org SQLkit home page - PyGTK/python/sqlalchemy From jeremy at fluxlabs.net Thu Nov 3 23:12:27 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Thu Nov 3 23:13:19 2011 Subject: Insecure dependency: what is it? - Found word(s) list error in the Text body In-Reply-To: <20111103225844.GA11302@ubuntu> References: <20111103225844.GA11302@ubuntu> Message-ID: <14726F83-1408-460D-B7C1-D55641A60C7F@fluxlabs.net> Add -U -X to your # line of MailScanner file -- Jeremy McSpadden On Nov 3, 2011, at 6:10 PM, "Alessandro Dentella" <sandro@e-den.it> wrote: > Hi, > > > while trying to debug the setup I wrote about yesterday I realized that > /var/log/syslog contains some messages as:: > > MailScanner: Process did not exit cleanly, returned 2 with signal 0 > > running with Debug = yes and Debug SpamAssassing = yes MS dies with:: > > > 23:48:46 Nov 3 23:48:46.397 [14687] dbg: check: tests=MISSING_DATE,MISSING_HEADERS,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS > 23:48:46 Nov 3 23:48:46.397 [14687] dbg: check: subtests=__GATED_THROUGH_RCVD_REMOVER,__HAS_MESSAGE_ID,__HAS_MSGID,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__TO_NO_ARROWS_R,__UNUSABLE_MSGID > 23:48:46 Nov 3 23:48:46.398 [14687] dbg: plugin: Mail::SpamAssassin::Plugin::Bayes=HASH(0xa5b1a48) implements 'learner_close', priority 0 > 23:48:46 Building a message batch to scan... > 23:48:46 Insecure dependency in mkdir while running with -T switch at /usr/share/MailScanner//MailScanner/Quarantine.pm line 189. > > > The last row is issued while trying to create a directory under > /var/spool/MailScanner/quadantine. Postfix that is the user MS "Run > AS". Postfix is able to create such a directory so I don't really understand > what it exacly means. > > This error prevents some mail from being processed but after some time > googling around I wasn't able to understand how to fix it. Any hint is > really appreciated. > > thanks > sandro > *:-) > > > > -- > Sandro Dentella *:-) > http://www.reteisi.org Soluzioni libere per le scuole > http://sqlkit.argolinux.org SQLkit home page - PyGTK/python/sqlalchemy > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From johnn at zylun.com Thu Nov 3 23:57:51 2011 From: johnn at zylun.com (John Mark Niar) Date: Thu Nov 3 23:58:11 2011 Subject: Spamassassin /root/.spamassassin is inaccessible: Permission denied In-Reply-To: <CAGDKorKyHwoftUE9j9xuHXv=3udtg+8Znrbs54PDv0bAvwNazg@mail.gmail.com> References: <00a201cc99c1$a4dc9880$ee95c980$@com> <CAGDKorKyHwoftUE9j9xuHXv=3udtg+8Znrbs54PDv0bAvwNazg@mail.gmail.com> Message-ID: <008701cc9a84$672a7ca0$357f75e0$@com> I have this on my spam.assassin.prefs.conf: bayes_path /var/spool/MailScanner/spamassassin/bayes bayes_file_mode 0660 Thanks, John Mark Niar IT Manager Zylun Staffing From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Martin Hepworth Sent: Thursday, November 03, 2011 6:47 PM To: MailScanner discussion Subject: Re: Spamassassin /root/.spamassassin is inaccessible: Permission denied it's probably trying to create the bayes DB there, so make sure your bayes_path is forced somewhere sensible in the MailScanner.cf -- Martin Hepworth Oxford, UK On 3 November 2011 00:43, John Mark Niar <johnn@zylun.com> wrote: Hey Guys, Anybody knows how to deal with this with MailScanner? My research tells me that I need to remove the per-user config of SpamAssassin which I did by adding "-x" option in the /etc/sysconfig/spamassassin. But still no changes. Thanks, John Mark Niar IT Manager Zylun Staffing -- This message has been scanned for viruses and dangerous content by <http://www.mailscanner.info/> MailScanner, and is believed to be clean. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by <http://www.mailscanner.info/> MailScanner, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/ec3c1e2d/attachment.html From sandro at e-den.it Fri Nov 4 11:53:46 2011 From: sandro at e-den.it (Alessandro Dentella) Date: Fri Nov 4 11:54:01 2011 Subject: Insecure dependency: what is it? - Found word(s) list error in the Text body In-Reply-To: <14726F83-1408-460D-B7C1-D55641A60C7F@fluxlabs.net> References: <20111103225844.GA11302@ubuntu> <14726F83-1408-460D-B7C1-D55641A60C7F@fluxlabs.net> Message-ID: <20111104115345.GA14861@ubuntu> On Thu, Nov 03, 2011 at 11:12:27PM +0000, Jeremy McSpadden wrote: > Add -U -X to your # line of MailScanner file Thanks Jeremy, that seems to solve this and the other related problem: MailScanner stopping to process incomin mail until postgsuper -r ALL. I can't really understand why another twin system (almost a clone, debian squeeze with same rel packages) works cluelessly w/o need to add -U -X. Maybe different permissions? (even thought I couldn't find them...) By the way I did try adding -U (w/o -X that should just make it silent) but I had an error that I believed was due to that flag. sandro *:-) -- Sandro Dentella *:-) http://www.reteisi.org Soluzioni libere per le scuole http://sqlkit.argolinux.org SQLkit home page - PyGTK/python/sqlalchemy From sonidhaval at gmail.com Fri Nov 4 12:14:57 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Fri Nov 4 12:22:14 2011 Subject: WhiteList Issue Message-ID: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> Hello, We have MailScanner 4.79 with Centos5.7 installed. Also having spamassassin with mysql based whitelist facilty. Our emails are getting blocked even after adding from domain to whitelist entry. It is getting blocked due to Bayesian database or spamassassin score check. Is there any other way to bypass whitelist entries from spam checking ? As per my understanding, MailScanner or Spamassassin should not block such whitelisted emails but in my case it is not happening. Thank you, -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/3f5eac7b/attachment.html From jeremy at fluxlabs.net Fri Nov 4 12:23:43 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Fri Nov 4 12:24:33 2011 Subject: WhiteList Issue In-Reply-To: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> Message-ID: <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> Sounds like your W/L is setup wrong. Run in debug and see what it's showing. I'd also upgrade. -- Jeremy McSpadden On Nov 4, 2011, at 7:22 AM, "sonidhaval@gmail.com<mailto:sonidhaval@gmail.com>" <sonidhaval@gmail.com<mailto:sonidhaval@gmail.com>> wrote: Hello, We have MailScanner 4.79 with Centos5.7 installed. Also having spamassassin with mysql based whitelist facilty. Our emails are getting blocked even after adding from domain to whitelist entry. It is getting blocked due to Bayesian database or spamassassin score check. Is there any other way to bypass whitelist entries from spam checking ? As per my understanding, MailScanner or Spamassassin should not block such whitelisted emails but in my case it is not happening. Thank you, -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of LinuxArticles.org<http://LinuxArticles.org> -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/b1665ffa/attachment.html From sonidhaval at gmail.com Fri Nov 4 12:31:49 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Fri Nov 4 12:32:40 2011 Subject: WhiteList Issue In-Reply-To: <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> Message-ID: <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> Hello, Thanks for your reply. Should I enable Debug SpamAssassin or just Debug mode from MailScanner.conf ? Thank you, On Fri, Nov 4, 2011 at 5:53 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: > Sounds like your W/L is setup wrong. Run in debug and see what it's > showing. I'd also upgrade. > > > -- > Jeremy McSpadden > > On Nov 4, 2011, at 7:22 AM, "sonidhaval@gmail.com" <sonidhaval@gmail.com> > wrote: > > Hello, > > We have MailScanner 4.79 with Centos5.7 installed. Also having > spamassassin with mysql based whitelist facilty. > > Our emails are getting blocked even after adding from domain to whitelist > entry. It is getting blocked due to Bayesian database or spamassassin score > check. Is there any other way to bypass whitelist entries from spam > checking ? > > As per my understanding, MailScanner or Spamassassin should not block such > whitelisted emails but in my case it is not happening. > > Thank you, > > -- > Kind regards, > Dhaval Soni ( RHCA ) > > Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/768afd52/attachment.html From sonidhaval at gmail.com Fri Nov 4 12:59:02 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Fri Nov 4 12:59:52 2011 Subject: WhiteList Issue In-Reply-To: <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> Message-ID: <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> Hello, Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init function MailWatchLogging Nov 4 07:57:02 mx MailScanner[8624]: Started SQL Logging child Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init function SQLWhitelist Nov 4 07:57:02 mx MailScanner[8624]: Starting up SQL Whitelist Nov 4 07:57:02 mx MailScanner[8624]: Read 346 whitelist entries Nov 4 07:57:03 mx MailScanner[8624]: Using SpamAssassin results cache Nov 4 07:57:03 mx MailScanner[8624]: Connected to SpamAssassin cache database Nov 4 07:57:03 mx MailScanner[8624]: Expired 5 records from the SpamAssassin cache Nov 4 07:57:03 mx MailScanner[8624]: Enabling SpamAssassin auto-whitelist functionality... Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: from=<SRS0=uKTMcH=5S= abc.com=srinivas@srs.bis7.eu.blackberry.com>, size=24864, class=0, nrcpts=1, msgid=<800112686-1320411414-cardhu_decombobulator_blackberry.rim.net-1464515178-@b14.c16.bise7.blackberry>, proto=ESMTP, daemon=MTA, relay=smtp10.bis7.eu.blackberry.com [178.239.85.15] Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: to=<samirgosai@abc.com>, delay=00:00:00, mailer=esmtp, pri=54864, stat=queued Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: from=< nareshpanchal9@yahoo.co.in>, size=2064, class=0, nrcpts=1, msgid=df0157a74c4f3b8ea410d5c91181eaba@[192.168.1.1], proto=SMTP, daemon=MTA, relay=nm9.bullet.mail.sp2.yahoo.com [98.139.91.79] Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: to=<hr@cb1.com>, delay=00:00:00, mailer=esmtp, pri=32064, stat=queued Nov 4 07:57:04 mx sendmail[8631]: ruleset=check_relay, arg1=[69.163.36.221], arg2=127.0.0.2, relay= 69-163-34-221.in-addr.arpa.static.dsn1.net [69.163.36.221] (may be forged), reject=550 5.7.1 Rejected: 69.163.36.221 listed at b.barracudacentral.org Nov 4 07:58:06 mx MailScanner[8905]: Batch completed at 4358 bytes per second (24835 / 5) Nov 4 07:58:06 mx MailScanner[8905]: Batch (1 message) processed in 5.70 seconds Nov 4 07:58:06 mx MailScanner[8905]: "Always Looked Up Last" took 0.00 seconds Nov 4 07:58:07 mx sendmail[8974]: pA4Cvtu3008912: to=<mktg1@jklindia.com>, delay=00:00:07, xdelay=00:00:01, mailer=esmtp, pri=144294, relay= mail.jklindia.com. [74.86.58.248], dsn=2.0.0, stat=Sent (OK) Nov 4 07:58:07 mx MailScanner[8976]: MailScanner E-Mail Virus Scanner version 4.79.11 starting... Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file /etc/MailScanner/MailScanner.conf Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file /etc/MailScanner/conf.d/README Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init function SQLBlacklist Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Blacklist Nov 4 07:58:07 mx MailScanner[8976]: Read 1703 blacklist entries Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init function MailWatchLogging Nov 4 07:58:07 mx MailScanner[8976]: Started SQL Logging child Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init function SQLWhitelist Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Whitelist Nov 4 07:58:07 mx MailScanner[8976]: Read 346 whitelist entries Nov 4 07:58:08 mx MailScanner[8976]: Using SpamAssassin results cache Nov 4 07:58:08 mx MailScanner[8976]: Connected to SpamAssassin cache database Nov 4 07:58:08 mx MailScanner[8976]: Enabling SpamAssassin auto-whitelist functionality... Nov 4 07:58:08 mx sendmail[8575]: pA4CuvKK008575: timeout waiting for input from reverse.gdsz.cncnet.net during server cmd read Nov 4 07:58:09 mx MailScanner[8943]: Connected to Processing Attempts Database Nov 4 07:58:09 mx MailScanner[8943]: Found 2 messages in the Processing Attempts Database Nov 4 07:58:09 mx MailScanner[8943]: Using locktype = posix Nov 4 07:58:10 mx MailScanner[8885]: Virus Scanning completed at 311 bytes per second Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks: Starting Nov 4 07:58:10 mx MailScanner[8885]: Message pA4Cw17q008930 from 127.0.0.1 (root@mx.cm.net) is whitelisted Nov 4 07:58:10 mx MailScanner[8643]: Virus Scanning completed at 313 bytes per second Nov 4 07:58:10 mx MailScanner[8643]: Spam Checks: Starting Nov 4 07:58:10 mx MailScanner[8643]: Message pA4Cw1xZ008938 from 127.0.0.1 (root@mx.cm.net) is whitelisted Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks completed at 1545 bytes per second Nov 4 07:58:10 mx MailScanner[8885]: Uninfected: Delivered 1 messages Nov 4 07:58:10 mx MailScanner[8885]: Virus Processing completed at 46147 bytes per second Nov 4 07:58:10 mx MailScanner[8885]: Deleted 1 messages from processing-database Nov 4 07:58:10 mx MailScanner[8885]: Batch completed at 257 bytes per second (1211 / 4) Nov 4 07:58:10 mx MailScanner[8885]: Batch (1 message) processed in 4.70 seconds Nov 4 07:58:10 mx MailScanner[8885]: "Always Looked Up Last" took 0.00 seconds Nov 4 07:58:10 mx spamd[3141]: spamd: connection from localhost.localdomain [127.0.0.1] at port 55309 Nov 4 07:58:10 mx spamd[3141]: spamd: setuid to spamd succeeded Nov 4 07:58:10 mx spamd[3141]: spamd: processing message < 201111041258.pA4Cw1w9008928@mx.cm.net> for spamd:501 Nov 4 07:58:11 mx MailScanner[8643]: Spam Checks completed at 1457 bytes per second Nov 4 07:58:11 mx MailScanner[8643]: Uninfected: Delivered 1 messages Nov 4 07:58:11 mx MailScanner[8643]: Virus Processing completed at 43840 bytes per second Nov 4 07:58:11 mx MailScanner[8643]: Deleted 1 messages from processing-database Nov 4 07:58:11 mx MailScanner[8643]: Batch completed at 256 bytes per second (1225 / 4) Thank you, On Fri, Nov 4, 2011 at 6:01 PM, sonidhaval@gmail.com <sonidhaval@gmail.com>wrote: > Hello, > > Thanks for your reply. > > Should I enable Debug SpamAssassin or just Debug mode from > MailScanner.conf ? > > Thank you, > > > On Fri, Nov 4, 2011 at 5:53 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: > >> Sounds like your W/L is setup wrong. Run in debug and see what it's >> showing. I'd also upgrade. >> >> >> -- >> Jeremy McSpadden >> >> On Nov 4, 2011, at 7:22 AM, "sonidhaval@gmail.com" <sonidhaval@gmail.com> >> wrote: >> >> Hello, >> >> We have MailScanner 4.79 with Centos5.7 installed. Also having >> spamassassin with mysql based whitelist facilty. >> >> Our emails are getting blocked even after adding from domain to whitelist >> entry. It is getting blocked due to Bayesian database or spamassassin score >> check. Is there any other way to bypass whitelist entries from spam >> checking ? >> >> As per my understanding, MailScanner or Spamassassin should not block >> such whitelisted emails but in my case it is not happening. >> >> Thank you, >> >> -- >> Kind regards, >> Dhaval Soni ( RHCA ) >> >> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > > -- > Kind regards, > Dhaval Soni ( RHCA ) > > Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> > > -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/932c4f9e/attachment.html From maxsec at gmail.com Fri Nov 4 14:10:52 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Nov 4 14:11:02 2011 Subject: WhiteList Issue In-Reply-To: <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> Message-ID: <CAGDKorL+kjqrqc5z_GkT0bSQeugO3bJbdSvgzAYtUPi0UWaXoQ@mail.gmail.com> Ok looks like you are calling spamassassin twice - the spamd lines below MailScanner calls spamassassin directly via it's API so spamd should be off and make sure sendmail isn't configured to call spamd as well. -- Martin Hepworth Oxford, UK On 4 November 2011 12:59, sonidhaval@gmail.com <sonidhaval@gmail.com> wrote: > Hello, > > Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init function > MailWatchLogging > Nov 4 07:57:02 mx MailScanner[8624]: Started SQL Logging child > Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init function > SQLWhitelist > Nov 4 07:57:02 mx MailScanner[8624]: Starting up SQL Whitelist > Nov 4 07:57:02 mx MailScanner[8624]: Read 346 whitelist entries > Nov 4 07:57:03 mx MailScanner[8624]: Using SpamAssassin results cache > Nov 4 07:57:03 mx MailScanner[8624]: Connected to SpamAssassin cache > database > Nov 4 07:57:03 mx MailScanner[8624]: Expired 5 records from the > SpamAssassin cache > Nov 4 07:57:03 mx MailScanner[8624]: Enabling SpamAssassin auto-whitelist > functionality... > Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: from=<SRS0=uKTMcH=5S= > abc.com=srinivas@srs.bis7.eu.blackberry.com>, size=24864, class=0, > nrcpts=1, > msgid=<800112686-1320411414-cardhu_decombobulator_blackberry.rim.net-1464515178-@b14.c16.bise7.blackberry>, > proto=ESMTP, daemon=MTA, relay=smtp10.bis7.eu.blackberry.com[178.239.85.15] > Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: to=<samirgosai@abc.com>, > delay=00:00:00, mailer=esmtp, pri=54864, stat=queued > Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: from=< > nareshpanchal9@yahoo.co.in>, size=2064, class=0, nrcpts=1, > msgid=df0157a74c4f3b8ea410d5c91181eaba@[192.168.1.1], proto=SMTP, > daemon=MTA, relay=nm9.bullet.mail.sp2.yahoo.com [98.139.91.79] > Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: to=<hr@cb1.com>, > delay=00:00:00, mailer=esmtp, pri=32064, stat=queued > Nov 4 07:57:04 mx sendmail[8631]: ruleset=check_relay, > arg1=[69.163.36.221], arg2=127.0.0.2, relay= > 69-163-34-221.in-addr.arpa.static.dsn1.net [69.163.36.221] (may be > forged), reject=550 5.7.1 Rejected: 69.163.36.221 listed at > b.barracudacentral.org > > Nov 4 07:58:06 mx MailScanner[8905]: Batch completed at 4358 bytes per > second (24835 / 5) > Nov 4 07:58:06 mx MailScanner[8905]: Batch (1 message) processed in 5.70 > seconds > Nov 4 07:58:06 mx MailScanner[8905]: "Always Looked Up Last" took 0.00 > seconds > Nov 4 07:58:07 mx sendmail[8974]: pA4Cvtu3008912: to=<mktg1@jklindia.com>, > delay=00:00:07, xdelay=00:00:01, mailer=esmtp, pri=144294, relay= > mail.jklindia.com. [74.86.58.248], dsn=2.0.0, stat=Sent (OK) > Nov 4 07:58:07 mx MailScanner[8976]: MailScanner E-Mail Virus Scanner > version 4.79.11 starting... > Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file > /etc/MailScanner/MailScanner.conf > Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file > /etc/MailScanner/conf.d/README > Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init function > SQLBlacklist > Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Blacklist > Nov 4 07:58:07 mx MailScanner[8976]: Read 1703 blacklist entries > Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init function > MailWatchLogging > Nov 4 07:58:07 mx MailScanner[8976]: Started SQL Logging child > Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init function > SQLWhitelist > Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Whitelist > Nov 4 07:58:07 mx MailScanner[8976]: Read 346 whitelist entries > Nov 4 07:58:08 mx MailScanner[8976]: Using SpamAssassin results cache > Nov 4 07:58:08 mx MailScanner[8976]: Connected to SpamAssassin cache > database > Nov 4 07:58:08 mx MailScanner[8976]: Enabling SpamAssassin auto-whitelist > functionality... > Nov 4 07:58:08 mx sendmail[8575]: pA4CuvKK008575: timeout waiting for > input from reverse.gdsz.cncnet.net during server cmd read > Nov 4 07:58:09 mx MailScanner[8943]: Connected to Processing Attempts > Database > Nov 4 07:58:09 mx MailScanner[8943]: Found 2 messages in the Processing > Attempts Database > Nov 4 07:58:09 mx MailScanner[8943]: Using locktype = posix > Nov 4 07:58:10 mx MailScanner[8885]: Virus Scanning completed at 311 > bytes per second > Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks: Starting > Nov 4 07:58:10 mx MailScanner[8885]: Message pA4Cw17q008930 from > 127.0.0.1 (root@mx.cm.net) is whitelisted > Nov 4 07:58:10 mx MailScanner[8643]: Virus Scanning completed at 313 > bytes per second > Nov 4 07:58:10 mx MailScanner[8643]: Spam Checks: Starting > Nov 4 07:58:10 mx MailScanner[8643]: Message pA4Cw1xZ008938 from > 127.0.0.1 (root@mx.cm.net) is whitelisted > Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks completed at 1545 bytes > per second > Nov 4 07:58:10 mx MailScanner[8885]: Uninfected: Delivered 1 messages > Nov 4 07:58:10 mx MailScanner[8885]: Virus Processing completed at 46147 > bytes per second > Nov 4 07:58:10 mx MailScanner[8885]: Deleted 1 messages from > processing-database > Nov 4 07:58:10 mx MailScanner[8885]: Batch completed at 257 bytes per > second (1211 / 4) > Nov 4 07:58:10 mx MailScanner[8885]: Batch (1 message) processed in 4.70 > seconds > Nov 4 07:58:10 mx MailScanner[8885]: "Always Looked Up Last" took 0.00 > seconds > Nov 4 07:58:10 mx spamd[3141]: spamd: connection from > localhost.localdomain [127.0.0.1] at port 55309 > Nov 4 07:58:10 mx spamd[3141]: spamd: setuid to spamd succeeded > Nov 4 07:58:10 mx spamd[3141]: spamd: processing message < > 201111041258.pA4Cw1w9008928@mx.cm.net> for spamd:501 > Nov 4 07:58:11 mx MailScanner[8643]: Spam Checks completed at 1457 bytes > per second > Nov 4 07:58:11 mx MailScanner[8643]: Uninfected: Delivered 1 messages > Nov 4 07:58:11 mx MailScanner[8643]: Virus Processing completed at 43840 > bytes per second > Nov 4 07:58:11 mx MailScanner[8643]: Deleted 1 messages from > processing-database > Nov 4 07:58:11 mx MailScanner[8643]: Batch completed at 256 bytes per > second (1225 / 4) > > Thank you, > > > On Fri, Nov 4, 2011 at 6:01 PM, sonidhaval@gmail.com <sonidhaval@gmail.com > > wrote: > >> Hello, >> >> Thanks for your reply. >> >> Should I enable Debug SpamAssassin or just Debug mode from >> MailScanner.conf ? >> >> Thank you, >> >> >> On Fri, Nov 4, 2011 at 5:53 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: >> >>> Sounds like your W/L is setup wrong. Run in debug and see what it's >>> showing. I'd also upgrade. >>> >>> >>> -- >>> Jeremy McSpadden >>> >>> On Nov 4, 2011, at 7:22 AM, "sonidhaval@gmail.com" <sonidhaval@gmail.com> >>> wrote: >>> >>> Hello, >>> >>> We have MailScanner 4.79 with Centos5.7 installed. Also having >>> spamassassin with mysql based whitelist facilty. >>> >>> Our emails are getting blocked even after adding from domain to >>> whitelist entry. It is getting blocked due to Bayesian database or >>> spamassassin score check. Is there any other way to bypass whitelist >>> entries from spam checking ? >>> >>> As per my understanding, MailScanner or Spamassassin should not block >>> such whitelisted emails but in my case it is not happening. >>> >>> Thank you, >>> >>> -- >>> Kind regards, >>> Dhaval Soni ( RHCA ) >>> >>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> >> -- >> Kind regards, >> Dhaval Soni ( RHCA ) >> >> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >> >> > > > -- > Kind regards, > Dhaval Soni ( RHCA ) > > Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/164ff4f0/attachment.html From sonidhaval at gmail.com Fri Nov 4 14:28:55 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Fri Nov 4 14:29:44 2011 Subject: WhiteList Issue In-Reply-To: <CAGDKorL+kjqrqc5z_GkT0bSQeugO3bJbdSvgzAYtUPi0UWaXoQ@mail.gmail.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> <CAGDKorL+kjqrqc5z_GkT0bSQeugO3bJbdSvgzAYtUPi0UWaXoQ@mail.gmail.com> Message-ID: <CAPPibPgkUSM2HXkv_OtqaJFWZyO51E1F-wOEJdEcYEUKLXCLEw@mail.gmail.com> Hello, How to disable it ? Thanks, On Fri, Nov 4, 2011 at 7:40 PM, Martin Hepworth <maxsec@gmail.com> wrote: > Ok looks like you are calling spamassassin twice - the spamd lines below > > MailScanner calls spamassassin directly via it's API so spamd should be > off and make sure sendmail isn't configured to call spamd as well. > > -- > Martin Hepworth > Oxford, UK > > > > On 4 November 2011 12:59, sonidhaval@gmail.com <sonidhaval@gmail.com>wrote: > >> Hello, >> >> Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init >> function MailWatchLogging >> Nov 4 07:57:02 mx MailScanner[8624]: Started SQL Logging child >> Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init >> function SQLWhitelist >> Nov 4 07:57:02 mx MailScanner[8624]: Starting up SQL Whitelist >> Nov 4 07:57:02 mx MailScanner[8624]: Read 346 whitelist entries >> Nov 4 07:57:03 mx MailScanner[8624]: Using SpamAssassin results cache >> Nov 4 07:57:03 mx MailScanner[8624]: Connected to SpamAssassin cache >> database >> Nov 4 07:57:03 mx MailScanner[8624]: Expired 5 records from the >> SpamAssassin cache >> Nov 4 07:57:03 mx MailScanner[8624]: Enabling SpamAssassin >> auto-whitelist functionality... >> Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: from=<SRS0=uKTMcH=5S= >> abc.com=srinivas@srs.bis7.eu.blackberry.com>, size=24864, class=0, >> nrcpts=1, >> msgid=<800112686-1320411414-cardhu_decombobulator_blackberry.rim.net-1464515178-@b14.c16.bise7.blackberry>, >> proto=ESMTP, daemon=MTA, relay=smtp10.bis7.eu.blackberry.com[178.239.85.15] >> Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: to=<samirgosai@abc.com>, >> delay=00:00:00, mailer=esmtp, pri=54864, stat=queued >> Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: from=< >> nareshpanchal9@yahoo.co.in>, size=2064, class=0, nrcpts=1, >> msgid=df0157a74c4f3b8ea410d5c91181eaba@[192.168.1.1], proto=SMTP, >> daemon=MTA, relay=nm9.bullet.mail.sp2.yahoo.com [98.139.91.79] >> Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: to=<hr@cb1.com>, >> delay=00:00:00, mailer=esmtp, pri=32064, stat=queued >> Nov 4 07:57:04 mx sendmail[8631]: ruleset=check_relay, >> arg1=[69.163.36.221], arg2=127.0.0.2, relay= >> 69-163-34-221.in-addr.arpa.static.dsn1.net [69.163.36.221] (may be >> forged), reject=550 5.7.1 Rejected: 69.163.36.221 listed at >> b.barracudacentral.org >> >> Nov 4 07:58:06 mx MailScanner[8905]: Batch completed at 4358 bytes per >> second (24835 / 5) >> Nov 4 07:58:06 mx MailScanner[8905]: Batch (1 message) processed in 5.70 >> seconds >> Nov 4 07:58:06 mx MailScanner[8905]: "Always Looked Up Last" took 0.00 >> seconds >> Nov 4 07:58:07 mx sendmail[8974]: pA4Cvtu3008912: to=<mktg1@jklindia.com>, >> delay=00:00:07, xdelay=00:00:01, mailer=esmtp, pri=144294, relay= >> mail.jklindia.com. [74.86.58.248], dsn=2.0.0, stat=Sent (OK) >> Nov 4 07:58:07 mx MailScanner[8976]: MailScanner E-Mail Virus Scanner >> version 4.79.11 starting... >> Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file >> /etc/MailScanner/MailScanner.conf >> Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file >> /etc/MailScanner/conf.d/README >> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >> function SQLBlacklist >> Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Blacklist >> Nov 4 07:58:07 mx MailScanner[8976]: Read 1703 blacklist entries >> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >> function MailWatchLogging >> Nov 4 07:58:07 mx MailScanner[8976]: Started SQL Logging child >> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >> function SQLWhitelist >> Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Whitelist >> Nov 4 07:58:07 mx MailScanner[8976]: Read 346 whitelist entries >> Nov 4 07:58:08 mx MailScanner[8976]: Using SpamAssassin results cache >> Nov 4 07:58:08 mx MailScanner[8976]: Connected to SpamAssassin cache >> database >> Nov 4 07:58:08 mx MailScanner[8976]: Enabling SpamAssassin >> auto-whitelist functionality... >> Nov 4 07:58:08 mx sendmail[8575]: pA4CuvKK008575: timeout waiting for >> input from reverse.gdsz.cncnet.net during server cmd read >> Nov 4 07:58:09 mx MailScanner[8943]: Connected to Processing Attempts >> Database >> Nov 4 07:58:09 mx MailScanner[8943]: Found 2 messages in the Processing >> Attempts Database >> Nov 4 07:58:09 mx MailScanner[8943]: Using locktype = posix >> Nov 4 07:58:10 mx MailScanner[8885]: Virus Scanning completed at 311 >> bytes per second >> Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks: Starting >> Nov 4 07:58:10 mx MailScanner[8885]: Message pA4Cw17q008930 from >> 127.0.0.1 (root@mx.cm.net) is whitelisted >> Nov 4 07:58:10 mx MailScanner[8643]: Virus Scanning completed at 313 >> bytes per second >> Nov 4 07:58:10 mx MailScanner[8643]: Spam Checks: Starting >> Nov 4 07:58:10 mx MailScanner[8643]: Message pA4Cw1xZ008938 from >> 127.0.0.1 (root@mx.cm.net) is whitelisted >> Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks completed at 1545 bytes >> per second >> Nov 4 07:58:10 mx MailScanner[8885]: Uninfected: Delivered 1 messages >> Nov 4 07:58:10 mx MailScanner[8885]: Virus Processing completed at 46147 >> bytes per second >> Nov 4 07:58:10 mx MailScanner[8885]: Deleted 1 messages from >> processing-database >> Nov 4 07:58:10 mx MailScanner[8885]: Batch completed at 257 bytes per >> second (1211 / 4) >> Nov 4 07:58:10 mx MailScanner[8885]: Batch (1 message) processed in 4.70 >> seconds >> Nov 4 07:58:10 mx MailScanner[8885]: "Always Looked Up Last" took 0.00 >> seconds >> Nov 4 07:58:10 mx spamd[3141]: spamd: connection from >> localhost.localdomain [127.0.0.1] at port 55309 >> Nov 4 07:58:10 mx spamd[3141]: spamd: setuid to spamd succeeded >> Nov 4 07:58:10 mx spamd[3141]: spamd: processing message < >> 201111041258.pA4Cw1w9008928@mx.cm.net> for spamd:501 >> Nov 4 07:58:11 mx MailScanner[8643]: Spam Checks completed at 1457 bytes >> per second >> Nov 4 07:58:11 mx MailScanner[8643]: Uninfected: Delivered 1 messages >> Nov 4 07:58:11 mx MailScanner[8643]: Virus Processing completed at 43840 >> bytes per second >> Nov 4 07:58:11 mx MailScanner[8643]: Deleted 1 messages from >> processing-database >> Nov 4 07:58:11 mx MailScanner[8643]: Batch completed at 256 bytes per >> second (1225 / 4) >> >> Thank you, >> >> >> On Fri, Nov 4, 2011 at 6:01 PM, sonidhaval@gmail.com < >> sonidhaval@gmail.com> wrote: >> >>> Hello, >>> >>> Thanks for your reply. >>> >>> Should I enable Debug SpamAssassin or just Debug mode from >>> MailScanner.conf ? >>> >>> Thank you, >>> >>> >>> On Fri, Nov 4, 2011 at 5:53 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: >>> >>>> Sounds like your W/L is setup wrong. Run in debug and see what it's >>>> showing. I'd also upgrade. >>>> >>>> >>>> -- >>>> Jeremy McSpadden >>>> >>>> On Nov 4, 2011, at 7:22 AM, "sonidhaval@gmail.com" < >>>> sonidhaval@gmail.com> wrote: >>>> >>>> Hello, >>>> >>>> We have MailScanner 4.79 with Centos5.7 installed. Also having >>>> spamassassin with mysql based whitelist facilty. >>>> >>>> Our emails are getting blocked even after adding from domain to >>>> whitelist entry. It is getting blocked due to Bayesian database or >>>> spamassassin score check. Is there any other way to bypass whitelist >>>> entries from spam checking ? >>>> >>>> As per my understanding, MailScanner or Spamassassin should not block >>>> such whitelisted emails but in my case it is not happening. >>>> >>>> Thank you, >>>> >>>> -- >>>> Kind regards, >>>> Dhaval Soni ( RHCA ) >>>> >>>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >>> >>> -- >>> Kind regards, >>> Dhaval Soni ( RHCA ) >>> >>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>> >>> >> >> >> -- >> Kind regards, >> Dhaval Soni ( RHCA ) >> >> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/0466ee55/attachment.html From maxsec at gmail.com Fri Nov 4 15:22:36 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Nov 4 15:22:44 2011 Subject: WhiteList Issue In-Reply-To: <CAPPibPgkUSM2HXkv_OtqaJFWZyO51E1F-wOEJdEcYEUKLXCLEw@mail.gmail.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> <CAGDKorL+kjqrqc5z_GkT0bSQeugO3bJbdSvgzAYtUPi0UWaXoQ@mail.gmail.com> <CAPPibPgkUSM2HXkv_OtqaJFWZyO51E1F-wOEJdEcYEUKLXCLEw@mail.gmail.com> Message-ID: <CAGDKorLc0qtSBGvWXgz+GtvJB35PC6ECWXnoxR-7HtP86OE9ug@mail.gmail.com> check the sendmail config.. -- Martin Hepworth Oxford, UK On 4 November 2011 14:28, sonidhaval@gmail.com <sonidhaval@gmail.com> wrote: > Hello, > > How to disable it ? > > Thanks, > > > > On Fri, Nov 4, 2011 at 7:40 PM, Martin Hepworth <maxsec@gmail.com> wrote: > >> Ok looks like you are calling spamassassin twice - the spamd lines below >> >> MailScanner calls spamassassin directly via it's API so spamd should be >> off and make sure sendmail isn't configured to call spamd as well. >> >> -- >> Martin Hepworth >> Oxford, UK >> >> >> >> On 4 November 2011 12:59, sonidhaval@gmail.com <sonidhaval@gmail.com>wrote: >> >>> Hello, >>> >>> Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init >>> function MailWatchLogging >>> Nov 4 07:57:02 mx MailScanner[8624]: Started SQL Logging child >>> Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init >>> function SQLWhitelist >>> Nov 4 07:57:02 mx MailScanner[8624]: Starting up SQL Whitelist >>> Nov 4 07:57:02 mx MailScanner[8624]: Read 346 whitelist entries >>> Nov 4 07:57:03 mx MailScanner[8624]: Using SpamAssassin results cache >>> Nov 4 07:57:03 mx MailScanner[8624]: Connected to SpamAssassin cache >>> database >>> Nov 4 07:57:03 mx MailScanner[8624]: Expired 5 records from the >>> SpamAssassin cache >>> Nov 4 07:57:03 mx MailScanner[8624]: Enabling SpamAssassin >>> auto-whitelist functionality... >>> Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: from=<SRS0=uKTMcH=5S= >>> abc.com=srinivas@srs.bis7.eu.blackberry.com>, size=24864, class=0, >>> nrcpts=1, >>> msgid=<800112686-1320411414-cardhu_decombobulator_blackberry.rim.net-1464515178-@b14.c16.bise7.blackberry>, >>> proto=ESMTP, daemon=MTA, relay=smtp10.bis7.eu.blackberry.com[178.239.85.15] >>> Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: to=< >>> samirgosai@abc.com>, delay=00:00:00, mailer=esmtp, pri=54864, >>> stat=queued >>> Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: from=< >>> nareshpanchal9@yahoo.co.in>, size=2064, class=0, nrcpts=1, >>> msgid=df0157a74c4f3b8ea410d5c91181eaba@[192.168.1.1], proto=SMTP, >>> daemon=MTA, relay=nm9.bullet.mail.sp2.yahoo.com [98.139.91.79] >>> Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: to=<hr@cb1.com>, >>> delay=00:00:00, mailer=esmtp, pri=32064, stat=queued >>> Nov 4 07:57:04 mx sendmail[8631]: ruleset=check_relay, >>> arg1=[69.163.36.221], arg2=127.0.0.2, relay= >>> 69-163-34-221.in-addr.arpa.static.dsn1.net [69.163.36.221] (may be >>> forged), reject=550 5.7.1 Rejected: 69.163.36.221 listed at >>> b.barracudacentral.org >>> >>> Nov 4 07:58:06 mx MailScanner[8905]: Batch completed at 4358 bytes per >>> second (24835 / 5) >>> Nov 4 07:58:06 mx MailScanner[8905]: Batch (1 message) processed in >>> 5.70 seconds >>> Nov 4 07:58:06 mx MailScanner[8905]: "Always Looked Up Last" took 0.00 >>> seconds >>> Nov 4 07:58:07 mx sendmail[8974]: pA4Cvtu3008912: to=< >>> mktg1@jklindia.com>, delay=00:00:07, xdelay=00:00:01, mailer=esmtp, >>> pri=144294, relay=mail.jklindia.com. [74.86.58.248], dsn=2.0.0, >>> stat=Sent (OK) >>> Nov 4 07:58:07 mx MailScanner[8976]: MailScanner E-Mail Virus Scanner >>> version 4.79.11 starting... >>> Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file >>> /etc/MailScanner/MailScanner.conf >>> Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file >>> /etc/MailScanner/conf.d/README >>> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >>> function SQLBlacklist >>> Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Blacklist >>> Nov 4 07:58:07 mx MailScanner[8976]: Read 1703 blacklist entries >>> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >>> function MailWatchLogging >>> Nov 4 07:58:07 mx MailScanner[8976]: Started SQL Logging child >>> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >>> function SQLWhitelist >>> Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Whitelist >>> Nov 4 07:58:07 mx MailScanner[8976]: Read 346 whitelist entries >>> Nov 4 07:58:08 mx MailScanner[8976]: Using SpamAssassin results cache >>> Nov 4 07:58:08 mx MailScanner[8976]: Connected to SpamAssassin cache >>> database >>> Nov 4 07:58:08 mx MailScanner[8976]: Enabling SpamAssassin >>> auto-whitelist functionality... >>> Nov 4 07:58:08 mx sendmail[8575]: pA4CuvKK008575: timeout waiting for >>> input from reverse.gdsz.cncnet.net during server cmd read >>> Nov 4 07:58:09 mx MailScanner[8943]: Connected to Processing Attempts >>> Database >>> Nov 4 07:58:09 mx MailScanner[8943]: Found 2 messages in the Processing >>> Attempts Database >>> Nov 4 07:58:09 mx MailScanner[8943]: Using locktype = posix >>> Nov 4 07:58:10 mx MailScanner[8885]: Virus Scanning completed at 311 >>> bytes per second >>> Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks: Starting >>> Nov 4 07:58:10 mx MailScanner[8885]: Message pA4Cw17q008930 from >>> 127.0.0.1 (root@mx.cm.net) is whitelisted >>> Nov 4 07:58:10 mx MailScanner[8643]: Virus Scanning completed at 313 >>> bytes per second >>> Nov 4 07:58:10 mx MailScanner[8643]: Spam Checks: Starting >>> Nov 4 07:58:10 mx MailScanner[8643]: Message pA4Cw1xZ008938 from >>> 127.0.0.1 (root@mx.cm.net) is whitelisted >>> Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks completed at 1545 >>> bytes per second >>> Nov 4 07:58:10 mx MailScanner[8885]: Uninfected: Delivered 1 messages >>> Nov 4 07:58:10 mx MailScanner[8885]: Virus Processing completed at >>> 46147 bytes per second >>> Nov 4 07:58:10 mx MailScanner[8885]: Deleted 1 messages from >>> processing-database >>> Nov 4 07:58:10 mx MailScanner[8885]: Batch completed at 257 bytes per >>> second (1211 / 4) >>> Nov 4 07:58:10 mx MailScanner[8885]: Batch (1 message) processed in >>> 4.70 seconds >>> Nov 4 07:58:10 mx MailScanner[8885]: "Always Looked Up Last" took 0.00 >>> seconds >>> Nov 4 07:58:10 mx spamd[3141]: spamd: connection from >>> localhost.localdomain [127.0.0.1] at port 55309 >>> Nov 4 07:58:10 mx spamd[3141]: spamd: setuid to spamd succeeded >>> Nov 4 07:58:10 mx spamd[3141]: spamd: processing message < >>> 201111041258.pA4Cw1w9008928@mx.cm.net> for spamd:501 >>> Nov 4 07:58:11 mx MailScanner[8643]: Spam Checks completed at 1457 >>> bytes per second >>> Nov 4 07:58:11 mx MailScanner[8643]: Uninfected: Delivered 1 messages >>> Nov 4 07:58:11 mx MailScanner[8643]: Virus Processing completed at >>> 43840 bytes per second >>> Nov 4 07:58:11 mx MailScanner[8643]: Deleted 1 messages from >>> processing-database >>> Nov 4 07:58:11 mx MailScanner[8643]: Batch completed at 256 bytes per >>> second (1225 / 4) >>> >>> Thank you, >>> >>> >>> On Fri, Nov 4, 2011 at 6:01 PM, sonidhaval@gmail.com < >>> sonidhaval@gmail.com> wrote: >>> >>>> Hello, >>>> >>>> Thanks for your reply. >>>> >>>> Should I enable Debug SpamAssassin or just Debug mode from >>>> MailScanner.conf ? >>>> >>>> Thank you, >>>> >>>> >>>> On Fri, Nov 4, 2011 at 5:53 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: >>>> >>>>> Sounds like your W/L is setup wrong. Run in debug and see what it's >>>>> showing. I'd also upgrade. >>>>> >>>>> >>>>> -- >>>>> Jeremy McSpadden >>>>> >>>>> On Nov 4, 2011, at 7:22 AM, "sonidhaval@gmail.com" < >>>>> sonidhaval@gmail.com> wrote: >>>>> >>>>> Hello, >>>>> >>>>> We have MailScanner 4.79 with Centos5.7 installed. Also having >>>>> spamassassin with mysql based whitelist facilty. >>>>> >>>>> Our emails are getting blocked even after adding from domain to >>>>> whitelist entry. It is getting blocked due to Bayesian database or >>>>> spamassassin score check. Is there any other way to bypass whitelist >>>>> entries from spam checking ? >>>>> >>>>> As per my understanding, MailScanner or Spamassassin should not block >>>>> such whitelisted emails but in my case it is not happening. >>>>> >>>>> Thank you, >>>>> >>>>> -- >>>>> Kind regards, >>>>> Dhaval Soni ( RHCA ) >>>>> >>>>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner@lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner@lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>> >>>> >>>> -- >>>> Kind regards, >>>> Dhaval Soni ( RHCA ) >>>> >>>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>>> >>>> >>> >>> >>> -- >>> Kind regards, >>> Dhaval Soni ( RHCA ) >>> >>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > > -- > Kind regards, > Dhaval Soni ( RHCA ) > > Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/b7e15315/attachment-0001.html From glenn.steen at gmail.com Fri Nov 4 15:34:41 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Fri Nov 4 15:34:52 2011 Subject: Insecure dependency: what is it? In-Reply-To: <20111103225844.GA11302@ubuntu> References: <20111103225844.GA11302@ubuntu> Message-ID: <CAAug_B-1u77Qtms1CxSfM-CKFt_XWd-LdX=RQsv+UKtrNf1xow@mail.gmail.com> Very likely a permission problem, fix it and you'll be good. Also, you may have a corrupt message/file in the hold directory, creating the initial problem, or a taint problem. Den 4 nov 2011 00:16 skrev "Alessandro Dentella" <sandro@e-den.it>: > Hi, > > > while trying to debug the setup I wrote about yesterday I realized that > /var/log/syslog contains some messages as:: > > MailScanner: Process did not exit cleanly, returned 2 with signal 0 > > running with Debug = yes and Debug SpamAssassing = yes MS dies with:: > > > 23:48:46 Nov 3 23:48:46.397 [14687] dbg: check: > tests=MISSING_DATE,MISSING_HEADERS,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS > 23:48:46 Nov 3 23:48:46.397 [14687] dbg: check: > subtests=__GATED_THROUGH_RCVD_REMOVER,__HAS_MESSAGE_ID,__HAS_MSGID,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__TO_NO_ARROWS_R,__UNUSABLE_MSGID > 23:48:46 Nov 3 23:48:46.398 [14687] dbg: plugin: > Mail::SpamAssassin::Plugin::Bayes=HASH(0xa5b1a48) implements > 'learner_close', priority 0 > 23:48:46 Building a message batch to scan... > 23:48:46 Insecure dependency in mkdir while running with -T switch at > /usr/share/MailScanner//MailScanner/Quarantine.pm line 189. > > > The last row is issued while trying to create a directory under > /var/spool/MailScanner/quadantine. Postfix that is the user MS "Run > AS". Postfix is able to create such a directory so I don't really > understand > what it exacly means. > > This error prevents some mail from being processed but after some time > googling around I wasn't able to understand how to fix it. Any hint is > really appreciated. > > thanks > sandro > *:-) > > > > -- > Sandro Dentella *:-) > http://www.reteisi.org Soluzioni libere per le scuole > http://sqlkit.argolinux.org SQLkit home page - > PyGTK/python/sqlalchemy > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/0b3926f3/attachment.html From sonidhaval at gmail.com Fri Nov 4 17:42:41 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Fri Nov 4 17:43:32 2011 Subject: WhiteList Issue In-Reply-To: <CAGDKorLc0qtSBGvWXgz+GtvJB35PC6ECWXnoxR-7HtP86OE9ug@mail.gmail.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> <CAGDKorL+kjqrqc5z_GkT0bSQeugO3bJbdSvgzAYtUPi0UWaXoQ@mail.gmail.com> <CAPPibPgkUSM2HXkv_OtqaJFWZyO51E1F-wOEJdEcYEUKLXCLEw@mail.gmail.com> <CAGDKorLc0qtSBGvWXgz+GtvJB35PC6ECWXnoxR-7HtP86OE9ug@mail.gmail.com> Message-ID: <CAPPibPgKEdu3Et8ubPz=4dpUWsJR745B7tB5mMHgZn-WKqKdHQ@mail.gmail.com> Hello, I do not have any spamassassin entry in sendmail. Thank you, Regards, Dhaval Soni On Fri, Nov 4, 2011 at 8:52 PM, Martin Hepworth <maxsec@gmail.com> wrote: > check the sendmail config.. > > > -- > Martin Hepworth > Oxford, UK > > > On 4 November 2011 14:28, sonidhaval@gmail.com <sonidhaval@gmail.com>wrote: > >> Hello, >> >> How to disable it ? >> >> Thanks, >> >> >> >> On Fri, Nov 4, 2011 at 7:40 PM, Martin Hepworth <maxsec@gmail.com> wrote: >> >>> Ok looks like you are calling spamassassin twice - the spamd lines below >>> >>> MailScanner calls spamassassin directly via it's API so spamd should be >>> off and make sure sendmail isn't configured to call spamd as well. >>> >>> -- >>> Martin Hepworth >>> Oxford, UK >>> >>> >>> >>> On 4 November 2011 12:59, sonidhaval@gmail.com <sonidhaval@gmail.com>wrote: >>> >>>> Hello, >>>> >>>> Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init >>>> function MailWatchLogging >>>> Nov 4 07:57:02 mx MailScanner[8624]: Started SQL Logging child >>>> Nov 4 07:57:02 mx MailScanner[8624]: Config: calling custom init >>>> function SQLWhitelist >>>> Nov 4 07:57:02 mx MailScanner[8624]: Starting up SQL Whitelist >>>> Nov 4 07:57:02 mx MailScanner[8624]: Read 346 whitelist entries >>>> Nov 4 07:57:03 mx MailScanner[8624]: Using SpamAssassin results cache >>>> Nov 4 07:57:03 mx MailScanner[8624]: Connected to SpamAssassin cache >>>> database >>>> Nov 4 07:57:03 mx MailScanner[8624]: Expired 5 records from the >>>> SpamAssassin cache >>>> Nov 4 07:57:03 mx MailScanner[8624]: Enabling SpamAssassin >>>> auto-whitelist functionality... >>>> Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: from=<SRS0=uKTMcH=5S= >>>> abc.com=srinivas@srs.bis7.eu.blackberry.com>, size=24864, class=0, >>>> nrcpts=1, >>>> msgid=<800112686-1320411414-cardhu_decombobulator_blackberry.rim.net-1464515178-@b14.c16.bise7.blackberry>, >>>> proto=ESMTP, daemon=MTA, relay=smtp10.bis7.eu.blackberry.com[178.239.85.15] >>>> Nov 4 07:57:03 mx sendmail[8576]: pA4CuvD8008576: to=< >>>> samirgosai@abc.com>, delay=00:00:00, mailer=esmtp, pri=54864, >>>> stat=queued >>>> Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: from=< >>>> nareshpanchal9@yahoo.co.in>, size=2064, class=0, nrcpts=1, >>>> msgid=df0157a74c4f3b8ea410d5c91181eaba@[192.168.1.1], proto=SMTP, >>>> daemon=MTA, relay=nm9.bullet.mail.sp2.yahoo.com [98.139.91.79] >>>> Nov 4 07:57:04 mx sendmail[8578]: pA4CuwRK008578: to=<hr@cb1.com>, >>>> delay=00:00:00, mailer=esmtp, pri=32064, stat=queued >>>> Nov 4 07:57:04 mx sendmail[8631]: ruleset=check_relay, >>>> arg1=[69.163.36.221], arg2=127.0.0.2, relay= >>>> 69-163-34-221.in-addr.arpa.static.dsn1.net [69.163.36.221] (may be >>>> forged), reject=550 5.7.1 Rejected: 69.163.36.221 listed at >>>> b.barracudacentral.org >>>> >>>> Nov 4 07:58:06 mx MailScanner[8905]: Batch completed at 4358 bytes per >>>> second (24835 / 5) >>>> Nov 4 07:58:06 mx MailScanner[8905]: Batch (1 message) processed in >>>> 5.70 seconds >>>> Nov 4 07:58:06 mx MailScanner[8905]: "Always Looked Up Last" took 0.00 >>>> seconds >>>> Nov 4 07:58:07 mx sendmail[8974]: pA4Cvtu3008912: to=< >>>> mktg1@jklindia.com>, delay=00:00:07, xdelay=00:00:01, mailer=esmtp, >>>> pri=144294, relay=mail.jklindia.com. [74.86.58.248], dsn=2.0.0, >>>> stat=Sent (OK) >>>> Nov 4 07:58:07 mx MailScanner[8976]: MailScanner E-Mail Virus Scanner >>>> version 4.79.11 starting... >>>> Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file >>>> /etc/MailScanner/MailScanner.conf >>>> Nov 4 07:58:07 mx MailScanner[8976]: Reading configuration file >>>> /etc/MailScanner/conf.d/README >>>> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >>>> function SQLBlacklist >>>> Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Blacklist >>>> Nov 4 07:58:07 mx MailScanner[8976]: Read 1703 blacklist entries >>>> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >>>> function MailWatchLogging >>>> Nov 4 07:58:07 mx MailScanner[8976]: Started SQL Logging child >>>> Nov 4 07:58:07 mx MailScanner[8976]: Config: calling custom init >>>> function SQLWhitelist >>>> Nov 4 07:58:07 mx MailScanner[8976]: Starting up SQL Whitelist >>>> Nov 4 07:58:07 mx MailScanner[8976]: Read 346 whitelist entries >>>> Nov 4 07:58:08 mx MailScanner[8976]: Using SpamAssassin results cache >>>> Nov 4 07:58:08 mx MailScanner[8976]: Connected to SpamAssassin cache >>>> database >>>> Nov 4 07:58:08 mx MailScanner[8976]: Enabling SpamAssassin >>>> auto-whitelist functionality... >>>> Nov 4 07:58:08 mx sendmail[8575]: pA4CuvKK008575: timeout waiting for >>>> input from reverse.gdsz.cncnet.net during server cmd read >>>> Nov 4 07:58:09 mx MailScanner[8943]: Connected to Processing Attempts >>>> Database >>>> Nov 4 07:58:09 mx MailScanner[8943]: Found 2 messages in the >>>> Processing Attempts Database >>>> Nov 4 07:58:09 mx MailScanner[8943]: Using locktype = posix >>>> Nov 4 07:58:10 mx MailScanner[8885]: Virus Scanning completed at 311 >>>> bytes per second >>>> Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks: Starting >>>> Nov 4 07:58:10 mx MailScanner[8885]: Message pA4Cw17q008930 from >>>> 127.0.0.1 (root@mx.cm.net) is whitelisted >>>> Nov 4 07:58:10 mx MailScanner[8643]: Virus Scanning completed at 313 >>>> bytes per second >>>> Nov 4 07:58:10 mx MailScanner[8643]: Spam Checks: Starting >>>> Nov 4 07:58:10 mx MailScanner[8643]: Message pA4Cw1xZ008938 from >>>> 127.0.0.1 (root@mx.cm.net) is whitelisted >>>> Nov 4 07:58:10 mx MailScanner[8885]: Spam Checks completed at 1545 >>>> bytes per second >>>> Nov 4 07:58:10 mx MailScanner[8885]: Uninfected: Delivered 1 messages >>>> Nov 4 07:58:10 mx MailScanner[8885]: Virus Processing completed at >>>> 46147 bytes per second >>>> Nov 4 07:58:10 mx MailScanner[8885]: Deleted 1 messages from >>>> processing-database >>>> Nov 4 07:58:10 mx MailScanner[8885]: Batch completed at 257 bytes per >>>> second (1211 / 4) >>>> Nov 4 07:58:10 mx MailScanner[8885]: Batch (1 message) processed in >>>> 4.70 seconds >>>> Nov 4 07:58:10 mx MailScanner[8885]: "Always Looked Up Last" took 0.00 >>>> seconds >>>> Nov 4 07:58:10 mx spamd[3141]: spamd: connection from >>>> localhost.localdomain [127.0.0.1] at port 55309 >>>> Nov 4 07:58:10 mx spamd[3141]: spamd: setuid to spamd succeeded >>>> Nov 4 07:58:10 mx spamd[3141]: spamd: processing message < >>>> 201111041258.pA4Cw1w9008928@mx.cm.net> for spamd:501 >>>> Nov 4 07:58:11 mx MailScanner[8643]: Spam Checks completed at 1457 >>>> bytes per second >>>> Nov 4 07:58:11 mx MailScanner[8643]: Uninfected: Delivered 1 messages >>>> Nov 4 07:58:11 mx MailScanner[8643]: Virus Processing completed at >>>> 43840 bytes per second >>>> Nov 4 07:58:11 mx MailScanner[8643]: Deleted 1 messages from >>>> processing-database >>>> Nov 4 07:58:11 mx MailScanner[8643]: Batch completed at 256 bytes per >>>> second (1225 / 4) >>>> >>>> Thank you, >>>> >>>> >>>> On Fri, Nov 4, 2011 at 6:01 PM, sonidhaval@gmail.com < >>>> sonidhaval@gmail.com> wrote: >>>> >>>>> Hello, >>>>> >>>>> Thanks for your reply. >>>>> >>>>> Should I enable Debug SpamAssassin or just Debug mode from >>>>> MailScanner.conf ? >>>>> >>>>> Thank you, >>>>> >>>>> >>>>> On Fri, Nov 4, 2011 at 5:53 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: >>>>> >>>>>> Sounds like your W/L is setup wrong. Run in debug and see what it's >>>>>> showing. I'd also upgrade. >>>>>> >>>>>> >>>>>> -- >>>>>> Jeremy McSpadden >>>>>> >>>>>> On Nov 4, 2011, at 7:22 AM, "sonidhaval@gmail.com" < >>>>>> sonidhaval@gmail.com> wrote: >>>>>> >>>>>> Hello, >>>>>> >>>>>> We have MailScanner 4.79 with Centos5.7 installed. Also having >>>>>> spamassassin with mysql based whitelist facilty. >>>>>> >>>>>> Our emails are getting blocked even after adding from domain to >>>>>> whitelist entry. It is getting blocked due to Bayesian database or >>>>>> spamassassin score check. Is there any other way to bypass whitelist >>>>>> entries from spam checking ? >>>>>> >>>>>> As per my understanding, MailScanner or Spamassassin should not block >>>>>> such whitelisted emails but in my case it is not happening. >>>>>> >>>>>> Thank you, >>>>>> >>>>>> -- >>>>>> Kind regards, >>>>>> Dhaval Soni ( RHCA ) >>>>>> >>>>>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>>>>> >>>>>> -- >>>>>> MailScanner mailing list >>>>>> mailscanner@lists.mailscanner.info >>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>> >>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>>>> >>>>>> >>>>>> -- >>>>>> MailScanner mailing list >>>>>> mailscanner@lists.mailscanner.info >>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>> >>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> Kind regards, >>>>> Dhaval Soni ( RHCA ) >>>>> >>>>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>>>> >>>>> >>>> >>>> >>>> -- >>>> Kind regards, >>>> Dhaval Soni ( RHCA ) >>>> >>>> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >>>> >>>> >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >> >> >> -- >> Kind regards, >> Dhaval Soni ( RHCA ) >> >> Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111104/9744e84e/attachment.html From campbell at cnpapers.com Fri Nov 4 18:10:09 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Nov 4 18:09:56 2011 Subject: WhiteList Issue In-Reply-To: <CAPPibPgKEdu3Et8ubPz=4dpUWsJR745B7tB5mMHgZn-WKqKdHQ@mail.gmail.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> <CAGDKorL+kjqrqc5z_GkT0bSQeugO3bJbdSvgzAYtUPi0UWaXoQ@mail.gmail.com> <CAPPibPgkUSM2HXkv_OtqaJFWZyO51E1F-wOEJdEcYEUKLXCLEw@mail.gmail.com> <CAGDKorLc0qtSBGvWXgz+GtvJB35PC6ECWXnoxR-7HtP86OE9ug@mail.gmail.com> <CAPPibPgKEdu3Et8ubPz=4dpUWsJR745B7tB5mMHgZn-WKqKdHQ@mail.gmail.com> Message-ID: <4EB42A81.80703@cnpapers.com> I'd turn the SA auto-whitelist off. I seem to recall thats recommended. From my spam.assassin.prefs.conf # The --auto-whitelist and -a options for "spamd" and "spamassassin" to # turn on the auto-whitelist have been removed and replaced by the # "use_auto_whitelist" configuration option which is also now turned on by # default. # use_auto_whitelist 0 Maybe that's where it's happening. steve campbell On 11/4/2011 1:42 PM, sonidhaval@gmail.com wrote: > Nov 4 07:58:08 mx MailScanner[8976]: Enabling SpamAssassin > auto-whitelist functionality... From campbell at cnpapers.com Fri Nov 4 19:01:23 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Nov 4 19:01:08 2011 Subject: WhiteList Issue In-Reply-To: <4EB42A81.80703@cnpapers.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> <CAGDKorL+kjqrqc5z_GkT0bSQeugO3bJbdSvgzAYtUPi0UWaXoQ@mail.gmail.com> <CAPPibPgkUSM2HXkv_OtqaJFWZyO51E1F-wOEJdEcYEUKLXCLEw@mail.gmail.com> <CAGDKorLc0qtSBGvWXgz+GtvJB35PC6ECWXnoxR-7HtP86OE9ug@mail.gmail.com> <CAPPibPgKEdu3Et8ubPz=4dpUWsJR745B7tB5mMHgZn-WKqKdHQ@mail.gmail.com> <4EB42A81.80703@cnpapers.com> Message-ID: <4EB43683.6030701@cnpapers.com> Sorry, misread the problem. This would only make it worse. steve On 11/4/2011 2:10 PM, Steve Campbell wrote: > I'd turn the SA auto-whitelist off. I seem to recall thats recommended. > > From my spam.assassin.prefs.conf > > # The --auto-whitelist and -a options for "spamd" and "spamassassin" to > # turn on the auto-whitelist have been removed and replaced by the > # "use_auto_whitelist" configuration option which is also now turned > on by > # default. > > # use_auto_whitelist 0 > > Maybe that's where it's happening. > > steve campbell > > On 11/4/2011 1:42 PM, sonidhaval@gmail.com wrote: >> Nov 4 07:58:08 mx MailScanner[8976]: Enabling SpamAssassin >> auto-whitelist functionality... > From sonidhaval at gmail.com Fri Nov 4 21:41:03 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Fri Nov 4 21:41:53 2011 Subject: WhiteList Issue In-Reply-To: <4EB43683.6030701@cnpapers.com> References: <CAPPibPhLnjFm6yNy7hD=sLQxsS4nG9SKti0Nep1mW+WkuAyuOw@mail.gmail.com> <21DEA739-2B87-4805-AD8D-21F8B43201AC@fluxlabs.net> <CAPPibPivLpLMwKZ1asVKT7AMqbWqmZYCUSZZWWjphuFauxdTwg@mail.gmail.com> <CAPPibPgDQDFU6O1a7HmaBM0zHsPf3PwbL_Z0XyaO4G9q0+6YqQ@mail.gmail.com> <CAGDKorL+kjqrqc5z_GkT0bSQeugO3bJbdSvgzAYtUPi0UWaXoQ@mail.gmail.com> <CAPPibPgkUSM2HXkv_OtqaJFWZyO51E1F-wOEJdEcYEUKLXCLEw@mail.gmail.com> <CAGDKorLc0qtSBGvWXgz+GtvJB35PC6ECWXnoxR-7HtP86OE9ug@mail.gmail.com> <CAPPibPgKEdu3Et8ubPz=4dpUWsJR745B7tB5mMHgZn-WKqKdHQ@mail.gmail.com> <4EB42A81.80703@cnpapers.com> <4EB43683.6030701@cnpapers.com> Message-ID: <CAPPibPgSAqv1=qO_ZK5ZUMcb7uF60auykKWn8mGWqbhkB+u7cA@mail.gmail.com> Still not solved. On Sat, Nov 5, 2011 at 12:31 AM, Steve Campbell <campbell@cnpapers.com>wrote: > Sorry, misread the problem. This would only make it worse. > > steve > > > On 11/4/2011 2:10 PM, Steve Campbell wrote: > >> I'd turn the SA auto-whitelist off. I seem to recall thats recommended. >> >> From my spam.assassin.prefs.conf >> >> # The --auto-whitelist and -a options for "spamd" and "spamassassin" to >> # turn on the auto-whitelist have been removed and replaced by the >> # "use_auto_whitelist" configuration option which is also now turned on by >> # default. >> >> # use_auto_whitelist 0 >> >> Maybe that's where it's happening. >> >> steve campbell >> >> On 11/4/2011 1:42 PM, sonidhaval@gmail.com wrote: >> >>> Nov 4 07:58:08 mx MailScanner[8976]: Enabling SpamAssassin >>> auto-whitelist functionality... >>> >> >> > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info <mailscanner@lists.mailscanner.info> > http://lists.mailscanner.info/**mailman/listinfo/mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner> > > Before posting, read http://wiki.mailscanner.info/**posting<http://wiki.mailscanner.info/posting> > > Support MailScanner development - buy the book off the website! > -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111105/37fb18c6/attachment.html From ian at chopstixmedia.com Sat Nov 5 13:47:24 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Sat Nov 5 13:47:34 2011 Subject: Problem messages Message-ID: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> Hi, I have MailScanner 4.84.3-1 installed on a Redhat Enterprise Linux 5 box. Since upgrading I am receiving hourly emails to postmaster with the subject 'Problem messages'. Any advice on what I should do would be much appreciated. (I've seen previous discussions on this but outcome unclear.) Many thanks. All the best, -- Ian From jeremy at fluxlabs.net Sat Nov 5 14:16:32 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Sat Nov 5 14:17:21 2011 Subject: Problem messages In-Reply-To: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> Message-ID: <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> Debug and see what your output is. Mailscanner --debug -- Jeremy McSpadden On Nov 5, 2011, at 8:49 AM, "Ian Fenn" <ian@chopstixmedia.com> wrote: > Hi, > > I have MailScanner 4.84.3-1 installed on a Redhat Enterprise Linux 5 box. > > Since upgrading I am receiving hourly emails to postmaster with the subject 'Problem messages'. > > Any advice on what I should do would be much appreciated. (I've seen previous discussions on this but outcome unclear.) > > Many thanks. > > All the best, > > -- > Ian-- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ian at chopstixmedia.com Sat Nov 5 14:42:09 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Sat Nov 5 14:42:20 2011 Subject: Problem messages In-Reply-To: <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> Message-ID: <BFB1BE8E-4FF6-4CAE-AE51-602AADD816B9@chopstixmedia.com> On 5 Nov 2011, at 14:16, Jeremy McSpadden wrote: > Debug and see what your output is. Mailscanner --debug # MailScanner --debug From ian at chopstixmedia.com Sat Nov 5 14:54:45 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Sat Nov 5 14:55:03 2011 Subject: Problem messages In-Reply-To: <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> Message-ID: <5204043F-AB31-42D1-8142-0DA4B8F50A44@chopstixmedia.com> On 5 Nov 2011, at 14:16, Jeremy McSpadden wrote: > Debug and see what your output is. Mailscanner --debug # MailScanner --debug From ian at chopstixmedia.com Sat Nov 5 14:57:50 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Sat Nov 5 14:58:01 2011 Subject: Problem messages In-Reply-To: <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> Message-ID: <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> On 5 Nov 2011, at 14:16, Jeremy McSpadden wrote: > Debug and see what your output is. Hmm? Sorry for previous two emails. I appear to have found a bug in Apple Mail, namely it's truncating the output I'm sending. Here's hoping this works? > In Debugging mode, not forking... > Trying to setlogsock(unix) > Building a message batch to scan... > Have a batch of 1 message. > Stopping now as you are debugging me. That's the output. :-/ -- Ian From jeremy at fluxlabs.net Sat Nov 5 15:12:44 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Sat Nov 5 15:13:34 2011 Subject: Problem messages In-Reply-To: <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> Message-ID: <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> Should be more than that ... -- Jeremy McSpadden On Nov 5, 2011, at 10:07 AM, "Ian Fenn" <ian@chopstixmedia.com> wrote: > On 5 Nov 2011, at 14:16, Jeremy McSpadden wrote: >> Debug and see what your output is. > > Hmm? Sorry for previous two emails. I appear to have found a bug in Apple Mail, namely it's truncating the output I'm sending. Here's hoping this works? > >> In Debugging mode, not forking... >> Trying to setlogsock(unix) >> Building a message batch to scan... >> Have a batch of 1 message. >> Stopping now as you are debugging me. > > That's the output. :-/ > > -- > Ian-- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ian at chopstixmedia.com Sat Nov 5 15:24:23 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Sat Nov 5 15:24:42 2011 Subject: Problem messages In-Reply-To: <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> Message-ID: <425C78DC-3B3D-4621-8C6B-4B37FF507CEB@chopstixmedia.com> On 5 Nov 2011, at 15:12, Jeremy McSpadden wrote: > Should be more than that ? Sadly that's all I'm getting. -- Ian From jeremy at fluxlabs.net Sat Nov 5 15:34:52 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Sat Nov 5 15:35:56 2011 Subject: Problem messages In-Reply-To: <425C78DC-3B3D-4621-8C6B-4B37FF507CEB@chopstixmedia.com> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> <425C78DC-3B3D-4621-8C6B-4B37FF507CEB@chopstixmedia.com> Message-ID: <55ABD5EC-FE1D-4977-8C13-E325678C84BD@fluxlabs.net> I'm going to assume its a perl taint issue. Add -U -X to the MailScanner # line -- Jeremy McSpadden On Nov 5, 2011, at 10:25 AM, "Ian Fenn" <ian@chopstixmedia.com> wrote: > On 5 Nov 2011, at 15:12, Jeremy McSpadden wrote: >> Should be more than that ? > > Sadly that's all I'm getting. > > -- > Ian-- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ian at chopstixmedia.com Sat Nov 5 18:04:46 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Sat Nov 5 18:05:04 2011 Subject: Problem messages In-Reply-To: <55ABD5EC-FE1D-4977-8C13-E325678C84BD@fluxlabs.net> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> <425C78DC-3B3D-4621-8C6B-4B37FF507CEB@chopstixmedia.com> <55ABD5EC-FE1D-4977-8C13-E325678C84BD@fluxlabs.net> Message-ID: <75D198B0-84B9-4700-8D89-00C5961CC64C@chopstixmedia.com> On 5 Nov 2011, at 15:34, Jeremy McSpadden wrote: > I'm going to assume its a perl taint issue. Add -U -X to the MailScanner # line I did that, and restarted MailScanner. However, the problem message emails continue. :-/ All the best, -- Ian From sonidhaval at gmail.com Sun Nov 6 19:08:54 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Sun Nov 6 19:09:45 2011 Subject: MailScanner with Baruwa Message-ID: <CAPPibPi7RB_-payXmweesMu8nh8bHH6xxiz+z0DnVoY0AAH_Ug@mail.gmail.com> Hello, I am trying to configure MailScanner with Baruwa but getting so many errors. Does anyone have document on how to install the same? Thank you, -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111107/75f0f4bc/attachment.html From jeremy at fluxlabs.net Sun Nov 6 19:15:39 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Sun Nov 6 19:16:37 2011 Subject: MailScanner with Baruwa In-Reply-To: <CAPPibPi7RB_-payXmweesMu8nh8bHH6xxiz+z0DnVoY0AAH_Ug@mail.gmail.com> References: <CAPPibPi7RB_-payXmweesMu8nh8bHH6xxiz+z0DnVoY0AAH_Ug@mail.gmail.com> Message-ID: <BB74865E-AC04-4B5C-8848-B3D1A8A1D151@fluxlabs.net> Your cross posting. I will reply on Baruwa's ML. -- Jeremy McSpadden On Nov 6, 2011, at 1:11 PM, "sonidhaval@gmail.com<mailto:sonidhaval@gmail.com>" <sonidhaval@gmail.com<mailto:sonidhaval@gmail.com>> wrote: Hello, I am trying to configure MailScanner with Baruwa but getting so many errors. Does anyone have document on how to install the same? Thank you, -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of LinuxArticles.org<http://LinuxArticles.org> -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111106/a9e8a4d9/attachment.html From ak6783 at gmail.com Mon Nov 7 01:55:58 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Mon Nov 7 01:56:31 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <4f4e4433-d5d8-47c2-b8b4-ef6658053264@cronlabworkstation0> References: <CAL2m58eOpnpZShN-R0THFpvkHHy0UWpiDVKur8Rnf_6gB+jz-Q@mail.gmail.com> <4f4e4433-d5d8-47c2-b8b4-ef6658053264@cronlabworkstation0> Message-ID: <CAL2m58cWKYdTb+jA=nH5fBFu6eOZ9wzuvwiR35LiMaeZNCz8Kg@mail.gmail.com> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: image/gif Size: 368 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111107/29743157/attachment.gif From markus at markusoft.se Tue Nov 8 09:05:47 2011 From: markus at markusoft.se (Markus Nilsson) Date: Tue Nov 8 09:06:07 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58cWKYdTb+jA=nH5fBFu6eOZ9wzuvwiR35LiMaeZNCz8Kg@mail.gmail.com> Message-ID: <073cebc1-a15c-4618-bc51-5e64e83a2084@cronlabworkstation0> Did you try running MailScanner in debug with just one of these messages in the queue? /Markus ----- Ursprungligt meddelande ----- Fr?n: "???" <ak6783@gmail.com> Till: "MailScanner discussion" <mailscanner@lists.mailscanner.info> Skickat: m?ndag, 7 nov 2011 2:55:58 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello, Allow Filenames = N/A Deny Filenames = N/A Filename Rules = %etc-dir%/filename.rules.conf Allow Filetypes = N/A Allow File MIME Types = N/A Deny Filetypes = N/A Deny File MIME Types = N/A Filetype Rules = %etc-dir%/filetype.rules.conf N/A is not set anything. 2011/11/3 Markus Nilsson < markus@markusoft.se > Please print the relevant configuration settings in MailScanner! Allow Filenames = Deny Filenames = Filename Rules = Allow Filetypes = Allow File MIME Types = Deny Filetypes = Deny File MIME Types = Filetype Rules = Thanks! /Markus Fr?n: "???" < ak6783@gmail.com > Till: "MailScanner discussion" < mailscanner@lists.mailscanner.info > Skickat: torsdag, 3 nov 2011 10:56:36 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello Is it found any problem? Why use 4.84.3-1 can't deny file? 2011/11/2 Denis Beauchemin < Denis.Beauchemin@usherbrooke.ca > <blockquote> I wouldn?t be surprised if you forgot to stop the default sendmail (/sbin/chkconfig ?list sendmail should say it is OFF at all levels). You must turn it off (/sbin/chkconfig sendmail off; /sbin/service sendmail stop) and then start/restart MailScanner. Are there any headers added by MailScanner in your received emails? You should have some. If you don?t have any, it?s because of what I described in the previous paragraph. Denis Denis Beauchemin Architecte Technologique - Section Infrastructure des serveurs Service des technologies de l?information (S.T.I.) Universit? de Sherbrooke Courriel: Denis.Beauchemin@USherbrooke.ca T?l.: 819-821-8000 Poste: 62252 De : mailscanner-bounces@lists.mailscanner.info [mailto: mailscanner-bounces@lists.mailscanner.info ] De la part de ??? Envoy? : 1 novembre 2011 22:44 ? : mailscanner@lists.mailscanner.info Objet : MailScanner 4.84.3-1 can't deny any file. Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com 2.6.35.13-91 .fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 </blockquote> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111108/20e442fd/attachment.html From campbell at cnpapers.com Tue Nov 8 20:49:16 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Tue Nov 8 20:49:05 2011 Subject: Spamassassin usability Message-ID: <4EB995CC.40805@cnpapers.com> Just wondering about the default Spamassassin that is installed with CentOS 5.7: It's version 3..3.1-2, which is the same as what's listed in the easy install package on the website. Is there any difference in this package and what comes with Centos? Any reason not to use the Centos package until I need to update? Thanks steve campbell From jeremy at fluxlabs.net Tue Nov 8 20:52:43 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Nov 8 20:55:06 2011 Subject: Spamassassin usability In-Reply-To: <4EB995CC.40805@cnpapers.com> References: <4EB995CC.40805@cnpapers.com> Message-ID: <2EF7161C44942648B12941DD86C2CBDB08E59C35@xsrv.dc.fluxlabs.net> It is always recommended to use the version that comes with your distro. This makes upgrading and maintenance much easier. I have 5.7 on several machines and the distro version has no issues. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office: 850-588-4626 Cell: 850-890-2543 Fax: 850-254-2955 ________________________________________ From: mailscanner-bounces@lists.mailscanner.info [mailscanner-bounces@lists.mailscanner.info] on behalf of Steve Campbell [campbell@cnpapers.com] Sent: Tuesday, November 08, 2011 2:49 PM To: mailscanner@lists.mailscanner.info Subject: Spamassassin usability Just wondering about the default Spamassassin that is installed with CentOS 5.7: It's version 3..3.1-2, which is the same as what's listed in the easy install package on the website. Is there any difference in this package and what comes with Centos? Any reason not to use the Centos package until I need to update? Thanks steve campbell -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From ak6783 at gmail.com Tue Nov 8 22:56:49 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Tue Nov 8 22:57:20 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <073cebc1-a15c-4618-bc51-5e64e83a2084@cronlabworkstation0> References: <CAL2m58cWKYdTb+jA=nH5fBFu6eOZ9wzuvwiR35LiMaeZNCz8Kg@mail.gmail.com> <073cebc1-a15c-4618-bc51-5e64e83a2084@cronlabworkstation0> Message-ID: <CAL2m58dBUD095cFOinxvkfX9mSAZdTX2qKbrwGz6QrNrb-GVVQ@mail.gmail.com> Hello, This is test message. [root@mail ~]# MailScanner --debug In Debugging mode, not forking... Trying to setlogsock(unix) Building a message batch to scan... Have a batch of 1 message. But it's wait five minutes ago and not show any other message. 2011/11/8 Markus Nilsson <markus@markusoft.se> > Did you try running MailScanner in debug with just one of these messages > in the queue? > > /Markus > > ------------------------------ > *Fr?n: *"???" <ak6783@gmail.com> > *Till: *"MailScanner discussion" <mailscanner@lists.mailscanner.info> > *Skickat: *m?ndag, 7 nov 2011 2:55:58 > > *?mne: *Re: MailScanner 4.84.3-1 can't deny any file. > > Hello, > Allow Filenames = N/A > Deny Filenames = N/A > Filename Rules = %etc-dir%/filename.rules.conf > Allow Filetypes = N/A > Allow File MIME Types = N/A > Deny Filetypes = N/A > Deny File MIME Types = N/A > Filetype Rules = %etc-dir%/filetype.rules.conf > N/A is not set anything. > > 2011/11/3 Markus Nilsson <markus@markusoft.se> > >> Please print the relevant configuration settings in MailScanner! >> >> Allow Filenames = >> Deny Filenames = >> Filename Rules = >> Allow Filetypes = >> Allow File MIME Types = >> Deny Filetypes = >> Deny File MIME Types = >> Filetype Rules = >> >> Thanks! >> >> /Markus >> >> ------------------------------ >> *Fr?n: *"???" <ak6783@gmail.com> >> *Till: *"MailScanner discussion" <mailscanner@lists.mailscanner.info> >> *Skickat: *torsdag, 3 nov 2011 10:56:36 >> *?mne: *Re: MailScanner 4.84.3-1 can't deny any file. >> >> >> Hello >> Is it found any problem? >> Why use 4.84.3-1 can't deny file? >> >> 2011/11/2 Denis Beauchemin <Denis.Beauchemin@usherbrooke.ca> >> >>> I wouldn?t be surprised if you forgot to stop the default sendmail >>> (/sbin/chkconfig ?list sendmail should say it is OFF at all levels). You >>> must turn it off (/sbin/chkconfig sendmail off; /sbin/service sendmail >>> stop) and then start/restart MailScanner.**** >>> >>> ** ** >>> >>> Are there any headers added by MailScanner in your received emails? You >>> should have some. If you don?t have any, it?s because of what I described >>> in the previous paragraph.**** >>> >>> ** ** >>> >>> Denis**** >>> >>> ** ** >>> * >>> ------------------------------ >>> * >>> >>> *Denis Beauchemin** >>> **Architecte Technologique - Section Infrastructure des serveurs >>> *Service des technologies de l?information (S.T.I.) >>> Universit? de Sherbrooke >>> Courriel: Denis.Beauchemin@USherbrooke.ca >>> T?l.: 819-821-8000 Poste: 62252** >>> >>> ** ** >>> >>> *De :* mailscanner-bounces@lists.mailscanner.info [mailto: >>> mailscanner-bounces@lists.mailscanner.info] *De la part de* ??? >>> *Envoy? :* 1 novembre 2011 22:44 >>> *? :* mailscanner@lists.mailscanner.info >>> *Objet :* MailScanner 4.84.3-1 can't deny any file.**** >>> >>> ** ** >>> >>> Hello, >>> I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. >>> It's can't deny any attachment at filetname.rules.conf list. >>> Example: >>> The default set deny .cur and .reg attachment. >>> But when I send mail with .cur or .reg attachment. >>> It's always can received this mail. >>> And I check maillog. >>> It's no show any error message. >>> Please check it. >>> I list fedora 13 and 14 some information. >>> >>> [root@tw14 MailScanner]# MailScanner -v >>> Running on >>> Linux tw14.linguitronics.com 2.6.35.13-91.fc14.i686 #1 SMP Tue May 3 >>> 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux >>> This is Fedora release 14 (Laughlin) >>> This is Perl version 5.012003 (5.12.3) >>> >>> This is MailScanner version 4.84.3 >>> >>> [root@tw ~]# MailScanner -v >>> Running on >>> Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 >>> 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux >>> This is Fedora release 13 (Goddard) >>> This is Perl version 5.010001 (5.10.1) >>> >>> This is MailScanner version 4.84.3**** >>> >>> > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com ?? : 0960599655 WebRep Overall rating -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111109/dfb02b5b/attachment.html From nebano at gmail.com Wed Nov 9 13:17:32 2011 From: nebano at gmail.com (Osvaldo Alvarez Pozo) Date: Wed Nov 9 13:17:41 2011 Subject: Adding Inline HTMLand Text Signature to messages Message-ID: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> Hello I have a mailscanner configuation that is working but the Inline (Html, Text) are not being added. Wath should i do to make it work? In my conf i have Sign Clean Messages = yes Inline HTML Signature = %report-dir%/inline.sig.html Inline Text Signature = %report-dir%/inline.sig.txt From maxsec at gmail.com Wed Nov 9 13:41:03 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Nov 9 13:41:12 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> References: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> Message-ID: <CAGDKor+HwpTGMcAa-7-1rySTNSueeyuAWMohEvW_byQbKoBKEg@mail.gmail.com> And you restarted mailscanner after u altered the mailscanner.conf file ? On Wednesday, 9 November 2011, Osvaldo Alvarez Pozo <nebano@gmail.com> wrote: > Hello I have a mailscanner configuation that is working but the > Inline (Html, Text) are not being added. > > Wath should i do to make it work? > > In my conf i have > > Sign Clean Messages = yes > > > Inline HTML Signature = %report-dir%/inline.sig.html > Inline Text Signature = %report-dir%/inline.sig.txt > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111109/87def568/attachment.html From nebano at gmail.com Wed Nov 9 13:55:08 2011 From: nebano at gmail.com (Osvaldo Alvarez Pozo) Date: Wed Nov 9 13:55:17 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <CAGDKor+HwpTGMcAa-7-1rySTNSueeyuAWMohEvW_byQbKoBKEg@mail.gmail.com> References: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> <CAGDKor+HwpTGMcAa-7-1rySTNSueeyuAWMohEvW_byQbKoBKEg@mail.gmail.com> Message-ID: <CADD-rgqnAYkiz5t84Tp+OSja38EPUARcbPS9ZR8xTnBKVgfKOQ@mail.gmail.com> Hello, Thanks for answering so fast. Indeed this is the default configuration with mailscanner 4.84.3. Yes I have restarted Mailscanner and postfix severals times, but nothing changes. Thanks 2011/11/9 Martin Hepworth <maxsec@gmail.com>: > And you restarted mailscanner after u altered the mailscanner.conf file ? > > On Wednesday, 9 November 2011, Osvaldo Alvarez Pozo <nebano@gmail.com> > wrote: >> Hello ?I have a mailscanner configuation that is working but the >> Inline (Html, Text) are not being added. >> >> Wath should i do to make it work? >> >> In my conf i have >> >> Sign Clean Messages = yes >> >> >> Inline HTML Signature = %report-dir%/inline.sig.html >> Inline Text Signature = %report-dir%/inline.sig.txt >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > -- > -- > Martin Hepworth > Oxford, UK > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > From alexandru.ionica at gmail.com Wed Nov 9 14:19:09 2011 From: alexandru.ionica at gmail.com (Alexandru Ionica) Date: Wed Nov 9 14:27:02 2011 Subject: possible bug in 4.84.3-1 located in clamav-wrapper Message-ID: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> Hello, MailScanner 4.84.3-1 fresh install running on Centos-6 x86_64 . Running MailScanner --debug-sa i noticed the following: 12:54:12 LibClamAV Error: cli_scanhtml: Can't create temporary directory /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67 is a file and not a directory so this is why it was caused. I looked at /usr/lib/MailScanner/clamav-wrapper and changed TempDir=$(mktemp) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } to TempDir=$(mktemp -d --tmpdir=/var/spool/MailScanner/clamav) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } I presume the --tmpdir wouldn't have been needed but i wanted to also move it do a different folder. Anyway the cause seems to be the lack of the -d flag to mktemp so mktemp creates a file instead of a folder. After doing the above change i don't see any more errors or warnings from clamav. Regards. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111109/027ae555/attachment.html From jeremy at fluxlabs.net Wed Nov 9 14:36:11 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Nov 9 14:36:31 2011 Subject: possible bug in 4.84.3-1 located in clamav-wrapper In-Reply-To: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> References: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> Message-ID: <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> Looks more like a permissions issue than a bug -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 9, 2011, at 8:19 AM, Alexandru Ionica wrote: Hello, MailScanner 4.84.3-1 fresh install running on Centos-6 x86_64 . Running MailScanner --debug-sa i noticed the following: 12:54:12 LibClamAV Error: cli_scanhtml: Can't create temporary directory /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67 is a file and not a directory so this is why it was caused. I looked at /usr/lib/MailScanner/clamav-wrapper and changed TempDir=$(mktemp) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } to TempDir=$(mktemp -d --tmpdir=/var/spool/MailScanner/clamav) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } I presume the --tmpdir wouldn't have been needed but i wanted to also move it do a different folder. Anyway the cause seems to be the lack of the -d flag to mktemp so mktemp creates a file instead of a folder. After doing the above change i don't see any more errors or warnings from clamav. Regards. -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111109/77d0e5d3/attachment.html From nebano at gmail.com Wed Nov 9 15:10:09 2011 From: nebano at gmail.com (Osvaldo Alvarez Pozo) Date: Wed Nov 9 15:10:19 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <CADD-rgqnAYkiz5t84Tp+OSja38EPUARcbPS9ZR8xTnBKVgfKOQ@mail.gmail.com> References: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> <CAGDKor+HwpTGMcAa-7-1rySTNSueeyuAWMohEvW_byQbKoBKEg@mail.gmail.com> <CADD-rgqnAYkiz5t84Tp+OSja38EPUARcbPS9ZR8xTnBKVgfKOQ@mail.gmail.com> Message-ID: <CADD-rgoTNppS0R_fJWggvS7xGkNZy-HzjWxhU7-SNQ_5+UHc4g@mail.gmail.com> Hello Those are the logs I see nothing wrong Nov 9 15:58:25 Vdebian MailScanner[13577]: New Batch: Scanning 1 messages, 1314 bytes Nov 9 15:58:25 Vdebian MailScanner[13577]: Created attachment dirs for 1 messages Nov 9 15:58:25 Vdebian MailScanner[13577]: Completed checking by /usr/bin/file Nov 9 15:58:25 Vdebian MailScanner[13577]: Virus and Content Scanning: Starting Nov 9 15:58:25 Vdebian MailScanner[13577]: Commencing scanning by clamav... Nov 9 15:58:28 Vdebian MailScanner[13577]: Completed scanning by clamav Nov 9 15:58:29 Vdebian MailScanner[13577]: SpamAssassin returned 0 Nov 9 15:58:29 Vdebian MailScanner[13577]: Requeue: EF0FD1801D.A65E1 to A2A2E1801E Nov 9 15:58:29 Vdebian MailScanner[13577]: About to deliver 1 messages Nov 9 15:58:29 Vdebian postfix/qmgr[13009]: A2A2E1801E: from=<test@exemple.nett>, size=641, nrcpt=1 (queue active) Nov 9 15:58:29 Vdebian MailScanner[13577]: Uninfected: Delivered 1 messages Nov 9 15:58:29 Vdebian MailScanner[13577]: Deleted 1 messages from processing-database Nov 9 15:58:29 Vdebian MailScanner[13577]: MailScanner child dying of old age By this I understand that the mail is uninfected, so it shold be signed rigth? Thanks 2011/11/9 Osvaldo Alvarez Pozo <nebano@gmail.com>: > Hello, > > Thanks for answering so fast. Indeed this is the default configuration > with mailscanner 4.84.3. > > Yes I have restarted Mailscanner and postfix severals times, but > nothing changes. > > Thanks > > 2011/11/9 Martin Hepworth <maxsec@gmail.com>: >> And you restarted mailscanner after u altered the mailscanner.conf file ? >> >> On Wednesday, 9 November 2011, Osvaldo Alvarez Pozo <nebano@gmail.com> >> wrote: >>> Hello ?I have a mailscanner configuation that is working but the >>> Inline (Html, Text) are not being added. >>> >>> Wath should i do to make it work? >>> >>> In my conf i have >>> >>> Sign Clean Messages = yes >>> >>> >>> Inline HTML Signature = %report-dir%/inline.sig.html >>> Inline Text Signature = %report-dir%/inline.sig.txt >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >> >> -- >> -- >> Martin Hepworth >> Oxford, UK >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > From alexandru.ionica at gmail.com Wed Nov 9 15:19:04 2011 From: alexandru.ionica at gmail.com (Alexandru Ionica) Date: Wed Nov 9 15:19:14 2011 Subject: possible bug in 4.84.3-1 located in clamav-wrapper In-Reply-To: <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> References: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> Message-ID: <CAPwaGKYaZePxgNXXOQ2dDtHA=XX5dDE4vYYeuThtiFjisePO2g@mail.gmail.com> Ok, I don't know the innerworkings of Mailscanner but for me it looks like /var/spool/MailScanner/ incoming/SpamAssassin-Temp/tmp.vWQ4hixN67 is a file and clamav expects it to be a folder. On Wed, Nov 9, 2011 at 3:36 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: > Looks more like a permissions issue than a bug > --**** > Jeremy McSpadden**** > Flux Labs, Inc**** > http://www.fluxlabs.net > Endless Solutions**** > *Office* : 850-588-4626**** > *Cell* : 850-890-2543 > *Fax* : 850-254-2955 > > On Nov 9, 2011, at 8:19 AM, Alexandru Ionica wrote: > > Hello, > > MailScanner 4.84.3-1 fresh install running on Centos-6 x86_64 . > Running MailScanner --debug-sa i noticed the following: > 12:54:12 LibClamAV Error: cli_scanhtml: Can't create temporary directory > /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 > > /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67 is a file > and not a directory so this is why it was caused. > > I looked at /usr/lib/MailScanner/clamav-wrapper and changed > TempDir=$(mktemp) || { echo "$0: Cannot make name for temporary dir" >&2; > exit 1; } > to > TempDir=$(mktemp -d --tmpdir=/var/spool/MailScanner/clamav) || { echo "$0: > Cannot make name for temporary dir" >&2; exit 1; } > > I presume the --tmpdir wouldn't have been needed but i wanted to also move > it do a different folder. > Anyway the cause seems to be the lack of the -d flag to mktemp so mktemp > creates a file instead of a folder. > > After doing the above change i don't see any more errors or warnings from > clamav. > > Regards. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111109/dfebbd96/attachment.html From jeremy at fluxlabs.net Wed Nov 9 15:24:21 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Nov 9 15:24:41 2011 Subject: possible bug in 4.84.3-1 located in clamav-wrapper In-Reply-To: <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> References: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> Message-ID: <60391E3F-9DBD-4B9A-A01F-7D3499C2C9A4@fluxlabs.net> Can you verify which user is running clamav ? It should be the same user thats running your MTA -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 9, 2011, at 8:36 AM, Jeremy McSpadden wrote: Looks more like a permissions issue than a bug -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 9, 2011, at 8:19 AM, Alexandru Ionica wrote: Hello, MailScanner 4.84.3-1 fresh install running on Centos-6 x86_64 . Running MailScanner --debug-sa i noticed the following: 12:54:12 LibClamAV Error: cli_scanhtml: Can't create temporary directory /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67 is a file and not a directory so this is why it was caused. I looked at /usr/lib/MailScanner/clamav-wrapper and changed TempDir=$(mktemp) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } to TempDir=$(mktemp -d --tmpdir=/var/spool/MailScanner/clamav) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } I presume the --tmpdir wouldn't have been needed but i wanted to also move it do a different folder. Anyway the cause seems to be the lack of the -d flag to mktemp so mktemp creates a file instead of a folder. After doing the above change i don't see any more errors or warnings from clamav. Regards. -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111109/d64b22da/attachment.html From campbell at cnpapers.com Wed Nov 9 18:25:04 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Wed Nov 9 18:25:23 2011 Subject: OT: ZendTo and php 5.3 Message-ID: <4EBAC580.3060905@cnpapers.com> I realize there's a whole other list for this, but since it was announced here, thought I'd ask instead of join another list. Does anyone know if ZendTo will run on a machine that has php 5.3 instead of php 5.2. I'm not sure if the 5.2 stuff is still around, and I don't want to take a long time just to test ZendTo. Thanks for any help. steve campbell From jeremy at fluxlabs.net Wed Nov 9 18:29:54 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Nov 9 18:30:36 2011 Subject: OT: ZendTo and php 5.3 In-Reply-To: <4EBAC580.3060905@cnpapers.com> References: <4EBAC580.3060905@cnpapers.com> Message-ID: <39901A62-6173-433D-B914-E51F843955EB@fluxlabs.net> Yes .. It should run fine. -- Jeremy McSpadden On Nov 9, 2011, at 12:26 PM, "Steve Campbell" <campbell@cnpapers.com> wrote: > I realize there's a whole other list for this, but since it was announced here, thought I'd ask instead of join another list. > > Does anyone know if ZendTo will run on a machine that has php 5.3 instead of php 5.2. I'm not sure if the 5.2 stuff is still around, and I don't want to take a long time just to test ZendTo. > > Thanks for any help. > > steve campbell > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From davejones70 at gmail.com Wed Nov 9 20:06:48 2011 From: davejones70 at gmail.com (Dave Jones) Date: Wed Nov 9 20:06:58 2011 Subject: OT: ZendTo and php 5.3 Message-ID: <CAJmnxLXzKK+DbDh+QKhnjXXcgYLsx8xdhK4MCuhqw5NBKZ2+hA@mail.gmail.com> > I realize there's a whole other list for this, but since it was > announced here, thought I'd ask instead of join another list. > Does anyone know if ZendTo will run on a machine that has php 5.3 > instead of php 5.2. I'm not sure if the 5.2 stuff is still around, and I > don't want to take a long time just to test ZendTo. > > Thanks for any help. > > steve campbell Yes. I have ZendTo running on Scientific Linux 6.1 with no problems... # rpm -q php php-5.3.3-3.el6_1.3.x86_64 From campbell at cnpapers.com Wed Nov 9 20:35:33 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Wed Nov 9 20:35:00 2011 Subject: OT: ZendTo and php 5.3 In-Reply-To: <CAJmnxLXzKK+DbDh+QKhnjXXcgYLsx8xdhK4MCuhqw5NBKZ2+hA@mail.gmail.com> References: <CAJmnxLXzKK+DbDh+QKhnjXXcgYLsx8xdhK4MCuhqw5NBKZ2+hA@mail.gmail.com> Message-ID: <4EBAE415.1030507@cnpapers.com> Thanks for all the replies. Unfortunately, I found a little glitch. To install php 5.3 on Centos 5, you need to remove the php rpms and install php53 rpms. This causes a problem when installing the zendto rpm since it's looking for things like php-common. Following the php 5.2 instructions seems to work OK since they're still in the Centos Testing repo, and after an afternoon of farting around, I've got most of it done now. I'm guessing that Centos 6 just names them all php*. steve On 11/9/2011 3:06 PM, Dave Jones wrote: >> I realize there's a whole other list for this, but since it was >> announced here, thought I'd ask instead of join another list. >> Does anyone know if ZendTo will run on a machine that has php 5.3 >> instead of php 5.2. I'm not sure if the 5.2 stuff is still around, and I >> don't want to take a long time just to test ZendTo. >> >> Thanks for any help. >> >> steve campbell > Yes. I have ZendTo running on Scientific Linux 6.1 with no problems... > > # rpm -q php > php-5.3.3-3.el6_1.3.x86_64 From alexandru.ionica at gmail.com Wed Nov 9 21:50:02 2011 From: alexandru.ionica at gmail.com (Alexandru Ionica) Date: Wed Nov 9 21:50:12 2011 Subject: possible bug in 4.84.3-1 located in clamav-wrapper In-Reply-To: <60391E3F-9DBD-4B9A-A01F-7D3499C2C9A4@fluxlabs.net> References: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> <60391E3F-9DBD-4B9A-A01F-7D3499C2C9A4@fluxlabs.net> Message-ID: <CAPwaGKYH=eTCVsyBUNaHMtvpQeNpN_jrT8=bg+OR2KBx+ASM+A@mail.gmail.com> its postfix On Wed, Nov 9, 2011 at 4:24 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: > Can you verify which user is running clamav ? It should be the same user > thats running your MTA > > --**** > Jeremy McSpadden**** > Flux Labs, Inc**** > http://www.fluxlabs.net > Endless Solutions**** > *Office* : 850-588-4626**** > *Cell* : 850-890-2543 > *Fax* : 850-254-2955 > > On Nov 9, 2011, at 8:36 AM, Jeremy McSpadden wrote: > > Looks more like a permissions issue than a bug > -- > Jeremy McSpadden > Flux Labs, Inc > http://www.fluxlabs.net > Endless Solutions > *Office* : 850-588-4626 > *Cell* : 850-890-2543 > *Fax* : 850-254-2955 > > On Nov 9, 2011, at 8:19 AM, Alexandru Ionica wrote: > > Hello, > > MailScanner 4.84.3-1 fresh install running on Centos-6 x86_64 . > Running MailScanner --debug-sa i noticed the following: > 12:54:12 LibClamAV Error: cli_scanhtml: Can't create temporary directory > /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 > > /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67 is a file > and not a directory so this is why it was caused. > > I looked at /usr/lib/MailScanner/clamav-wrapper and changed > TempDir=$(mktemp) || { echo "$0: Cannot make name for temporary dir" >&2; > exit 1; } > to > TempDir=$(mktemp -d --tmpdir=/var/spool/MailScanner/clamav) || { echo "$0: > Cannot make name for temporary dir" >&2; exit 1; } > > I presume the --tmpdir wouldn't have been needed but i wanted to also move > it do a different folder. > Anyway the cause seems to be the lack of the -d flag to mktemp so mktemp > creates a file instead of a folder. > > After doing the above change i don't see any more errors or warnings from > clamav. > > Regards. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111109/fdd83b6b/attachment.html From jeremy at fluxlabs.net Wed Nov 9 21:52:10 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Nov 9 21:52:52 2011 Subject: possible bug in 4.84.3-1 located in clamav-wrapper - Found word(s) list error in the Text body In-Reply-To: <CAPwaGKYH=eTCVsyBUNaHMtvpQeNpN_jrT8=bg+OR2KBx+ASM+A@mail.gmail.com> References: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> <60391E3F-9DBD-4B9A-A01F-7D3499C2C9A4@fluxlabs.net> <CAPwaGKYH=eTCVsyBUNaHMtvpQeNpN_jrT8=bg+OR2KBx+ASM+A@mail.gmail.com> Message-ID: <2EFE3A29-58B2-49C5-9B4E-AAE09944F458@fluxlabs.net> So make sure your clamav is running as the postfix user. -- Jeremy McSpadden On Nov 9, 2011, at 3:51 PM, "Alexandru Ionica" <alexandru.ionica@gmail.com<mailto:alexandru.ionica@gmail.com>> wrote: its postfix On Wed, Nov 9, 2011 at 4:24 PM, Jeremy McSpadden <jeremy@fluxlabs.net<mailto:jeremy@fluxlabs.net>> wrote: Can you verify which user is running clamav ? It should be the same user thats running your MTA -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 9, 2011, at 8:36 AM, Jeremy McSpadden wrote: Looks more like a permissions issue than a bug -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Nov 9, 2011, at 8:19 AM, Alexandru Ionica wrote: Hello, MailScanner 4.84.3-1 fresh install running on Centos-6 x86_64 . Running MailScanner --debug-sa i noticed the following: 12:54:12 LibClamAV Error: cli_scanhtml: Can't create temporary directory /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67 is a file and not a directory so this is why it was caused. I looked at /usr/lib/MailScanner/clamav-wrapper and changed TempDir=$(mktemp) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } to TempDir=$(mktemp -d --tmpdir=/var/spool/MailScanner/clamav) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } I presume the --tmpdir wouldn't have been needed but i wanted to also move it do a different folder. Anyway the cause seems to be the lack of the -d flag to mktemp so mktemp creates a file instead of a folder. After doing the above change i don't see any more errors or warnings from clamav. Regards. -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info<mailto:mailscanner@lists.mailscanner.info> http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111109/68adbbce/attachment.html From michael at huntley.net Wed Nov 9 22:42:31 2011 From: michael at huntley.net (Michael Huntley) Date: Wed Nov 9 22:42:47 2011 Subject: OT: ZendTo and php 5.3 In-Reply-To: <4EBAC580.3060905@cnpapers.com> References: <4EBAC580.3060905@cnpapers.com> Message-ID: <4EBB01D7.5090002@huntley.net> No problem using php53 here with the EPEL repo. m On 11/9/2011 10:25 AM, Steve Campbell wrote: > I realize there's a whole other list for this, but since it was > announced here, thought I'd ask instead of join another list. > > Does anyone know if ZendTo will run on a machine that has php 5.3 > instead of php 5.2. I'm not sure if the 5.2 stuff is still around, and > I don't want to take a long time just to test ZendTo. > > Thanks for any help. > > steve campbell > From ak6783 at gmail.com Thu Nov 10 00:31:40 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Thu Nov 10 00:32:11 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> References: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> Message-ID: <CAL2m58eycObkg+OjKTnFPf8KvcvxUACRSB=n19_aJ+O9ehQd5w@mail.gmail.com> Me too. I already found this problem. I think this is 4.84.3 bug. 2011/11/9 Osvaldo Alvarez Pozo <nebano@gmail.com> > Hello I have a mailscanner configuation that is working but the > Inline (Html, Text) are not being added. > > Wath should i do to make it work? > > In my conf i have > > Sign Clean Messages = yes > > > Inline HTML Signature = %report-dir%/inline.sig.html > Inline Text Signature = %report-dir%/inline.sig.txt > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- 吳汝剛 個人網頁 http://pc.aspa.idv.tw 個人Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com 手機 : 0960599655 WebRep Overall rating -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111110/65b2faf3/attachment-0001.html From markus at markusoft.se Thu Nov 10 08:14:19 2011 From: markus at markusoft.se (Markus Nilsson) Date: Thu Nov 10 08:14:36 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58dBUD095cFOinxvkfX9mSAZdTX2qKbrwGz6QrNrb-GVVQ@mail.gmail.com> Message-ID: <94479621-6c47-4111-bdbe-4ea597611b32@cronlabworkstation0> Hi again, It's weird that your debug session hangs, I've not seen that. Maybe a lint would give more info? If not, you might need to try to debug the debug-run, maybe with strace and adding debug-prints to the MailScanner code. Or maybe try a slightly older version to verify that you only have problems with this specific version. (I have not yet stepped up to 4.84.3) /Markus ----- Ursprungligt meddelande ----- Fr?n: "???" <ak6783@gmail.com> Till: "MailScanner discussion" <mailscanner@lists.mailscanner.info> Skickat: tisdag, 8 nov 2011 23:56:49 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello, This is test message. [root@mail ~]# MailScanner --debug In Debugging mode, not forking... Trying to setlogsock(unix) Building a message batch to scan... Have a batch of 1 message. But it's wait five minutes ago and not show any other message. 2011/11/8 Markus Nilsson < markus@markusoft.se > Did you try running MailScanner in debug with just one of these messages in the queue? /Markus Fr?n: "???" < ak6783@gmail.com > Till: "MailScanner discussion" < mailscanner@lists.mailscanner.info > Skickat: m?ndag, 7 nov 2011 2:55:58 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello, Allow Filenames = N/A Deny Filenames = N/A Filename Rules = %etc-dir%/filename.rules.conf Allow Filetypes = N/A Allow File MIME Types = N/A Deny Filetypes = N/A Deny File MIME Types = N/A Filetype Rules = %etc-dir%/filetype.rules.conf N/A is not set anything. 2011/11/3 Markus Nilsson < markus@markusoft.se > <blockquote> Please print the relevant configuration settings in MailScanner! Allow Filenames = Deny Filenames = Filename Rules = Allow Filetypes = Allow File MIME Types = Deny Filetypes = Deny File MIME Types = Filetype Rules = Thanks! /Markus Fr?n: "???" < ak6783@gmail.com > Till: "MailScanner discussion" < mailscanner@lists.mailscanner.info > Skickat: torsdag, 3 nov 2011 10:56:36 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello Is it found any problem? Why use 4.84.3-1 can't deny file? 2011/11/2 Denis Beauchemin < Denis.Beauchemin@usherbrooke.ca > <blockquote> I wouldn?t be surprised if you forgot to stop the default sendmail (/sbin/chkconfig ?list sendmail should say it is OFF at all levels). You must turn it off (/sbin/chkconfig sendmail off; /sbin/service sendmail stop) and then start/restart MailScanner. Are there any headers added by MailScanner in your received emails? You should have some. If you don?t have any, it?s because of what I described in the previous paragraph. Denis Denis Beauchemin Architecte Technologique - Section Infrastructure des serveurs Service des technologies de l?information (S.T.I.) Universit? de Sherbrooke Courriel: Denis.Beauchemin@USherbrooke.ca T?l.: 819-821-8000 Poste: 62252 De : mailscanner-bounces@lists.mailscanner.info [mailto: mailscanner-bounces@lists.mailscanner.info ] De la part de ??? Envoy? : 1 novembre 2011 22:44 ? : mailscanner@lists.mailscanner.info Objet : MailScanner 4.84.3-1 can't deny any file. Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com 2.6.35.13-91 .fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 </blockquote> -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! </blockquote> -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com ?? : 0960599655 WebRep Overall rating MailScanner CronLabAntiSpamAppliance Signature Bearcom scanned this message. We don't think it was spam. Was it? Report here! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- Skipped content of type multipart/related From ak6783 at gmail.com Thu Nov 10 08:40:18 2011 From: ak6783 at gmail.com (=?UTF-8?B?5ZCz5rGd5Ymb?=) Date: Thu Nov 10 08:40:49 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <94479621-6c47-4111-bdbe-4ea597611b32@cronlabworkstation0> References: <CAL2m58dBUD095cFOinxvkfX9mSAZdTX2qKbrwGz6QrNrb-GVVQ@mail.gmail.com> <94479621-6c47-4111-bdbe-4ea597611b32@cronlabworkstation0> Message-ID: <CAL2m58ecfWpCTHfHHCogF54_RdWv7=VkOyBfiH7rfyK0Hqis3w@mail.gmail.com> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: image/gif Size: 368 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111110/92951b92/attachment.gif From alexandru.ionica at gmail.com Thu Nov 10 09:24:23 2011 From: alexandru.ionica at gmail.com (Alexandru Ionica) Date: Thu Nov 10 09:24:33 2011 Subject: possible bug in 4.84.3-1 located in clamav-wrapper - Found word(s) list error in the Text body In-Reply-To: <2EFE3A29-58B2-49C5-9B4E-AAE09944F458@fluxlabs.net> References: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> <60391E3F-9DBD-4B9A-A01F-7D3499C2C9A4@fluxlabs.net> <CAPwaGKYH=eTCVsyBUNaHMtvpQeNpN_jrT8=bg+OR2KBx+ASM+A@mail.gmail.com> <2EFE3A29-58B2-49C5-9B4E-AAE09944F458@fluxlabs.net> Message-ID: <CAPwaGKZTvHhwFqJ7s0tyZgygat3SAP-OXi3qcES0v-Bn2LRjCA@mail.gmail.com> Still i have the feeling we are talking about different things. Clamav , postfix and Mailscanner all run as postfix user. Now which part am i not making clear when i say that according to initial log entry , clamav was trying to create a folder in a file instead of creating a folder in a folder ??? Or at least this is what i understand and you are not pointing that i'm understanding it wrong but you keep saying that it's a permission problem. I still don't understand how running clamav as a different user will make it try to create a folder in a file . I will also draw it below, just in case it's still not clear what i am reporting here (let's hope the formatting isn't lost) /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 ^ ^ ^ ^ ^ ^ ^ | folder | folder | file !!!!!! | folder folder folder attempt to create this folder So i am running Postfix, MailScanner and Clamscan as user and group postfix. # grep -i postfix MailScanner.conf | grep -v ^# Run As User = postfix Run As Group = postfix Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = /var/spool/postfix/incoming MTA = postfix Incoming Work User = postfix Incoming Work Group = postfix # On Wed, Nov 9, 2011 at 10:52 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: > So make sure your clamav is running as the postfix user. > > > -- > Jeremy McSpadden > > On Nov 9, 2011, at 3:51 PM, "Alexandru Ionica" <alexandru.ionica@gmail.com> > wrote: > > its postfix > > On Wed, Nov 9, 2011 at 4:24 PM, Jeremy McSpadden <jeremy@fluxlabs.net>wrote: > >> Can you verify which user is running clamav ? It should be the same user >> thats running your MTA >> >> --**** >> Jeremy McSpadden**** >> Flux Labs, Inc**** >> http://www.fluxlabs.net >> Endless Solutions**** >> *Office* : 850-588-4626**** >> *Cell* : 850-890-2543 >> *Fax* : 850-254-2955 >> >> On Nov 9, 2011, at 8:36 AM, Jeremy McSpadden wrote: >> >> Looks more like a permissions issue than a bug >> -- >> Jeremy McSpadden >> Flux Labs, Inc >> http://www.fluxlabs.net >> Endless Solutions >> *Office* : 850-588-4626 >> *Cell* : 850-890-2543 >> *Fax* : 850-254-2955 >> >> On Nov 9, 2011, at 8:19 AM, Alexandru Ionica wrote: >> >> Hello, >> >> MailScanner 4.84.3-1 fresh install running on Centos-6 x86_64 . >> Running MailScanner --debug-sa i noticed the following: >> 12:54:12 LibClamAV Error: cli_scanhtml: Can't create temporary directory >> /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 >> >> /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67 is a >> file and not a directory so this is why it was caused. >> >> I looked at /usr/lib/MailScanner/clamav-wrapper and changed >> TempDir=$(mktemp) || { echo "$0: Cannot make name for temporary dir" >&2; >> exit 1; } >> to >> TempDir=$(mktemp -d --tmpdir=/var/spool/MailScanner/clamav) || { echo >> "$0: Cannot make name for temporary dir" >&2; exit 1; } >> >> I presume the --tmpdir wouldn't have been needed but i wanted to also >> move it do a different folder. >> Anyway the cause seems to be the lack of the -d flag to mktemp so mktemp >> creates a file instead of a folder. >> >> After doing the above change i don't see any more errors or warnings from >> clamav. >> >> Regards. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111110/1072d3af/attachment.html From campbell at cnpapers.com Thu Nov 10 12:13:46 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Nov 10 12:13:58 2011 Subject: OT: ZendTo and php 5.3 In-Reply-To: <4EBB01D7.5090002@huntley.net> References: <4EBAC580.3060905@cnpapers.com> <4EBB01D7.5090002@huntley.net> Message-ID: <4EBBBFFA.7090407@cnpapers.com> Then I'm not sure why I had so many problems. I kept getting a dependency problem with php-common conflicting with php53-common when trying to install pretty much everything. It could have been an rpm database problem, but I tried cleaning and everything. Since this would be a dedicated server, I guess there's no real reason to sweat it as long as I got it running. For now, it's just installed on a test VM, and I don't really know enough about xen to install the vm provided, so I had to take the long way around. Thanks for all the help and tips. I appreciate the OT responses. Guess it's time to join the zendto list. steve On 11/9/2011 5:42 PM, Michael Huntley wrote: > No problem using php53 here with the EPEL repo. > > m > > On 11/9/2011 10:25 AM, Steve Campbell wrote: >> I realize there's a whole other list for this, but since it was >> announced here, thought I'd ask instead of join another list. >> >> Does anyone know if ZendTo will run on a machine that has php 5.3 >> instead of php 5.2. I'm not sure if the 5.2 stuff is still around, >> and I don't want to take a long time just to test ZendTo. >> >> Thanks for any help. >> >> steve campbell >> From uxbod at splatnix.net Fri Nov 11 11:55:35 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Fri Nov 11 11:55:48 2011 Subject: Chinese characters in file names Message-ID: <a1444d50-63ea-4b53-86ef-4b7ad4fb3633@office.splatnix.net> Hi, am working on a project and have encountered an issue where file names that contain Chinese (Simplified) characters are being mangled when processed by MailScanner. An example is when one requires all attachments to be zipped up. When I examine the zipped file it now contains a file called ?????.doc. I have taken a look at the code and believe it is something to do with how $safename and $unsafename are being generated when the MIME sections are processed. When examaning an email using postcat one sees an attachment with the following name Content-Disposition: attachment; filename="=?gb2312?B?16u45bLEwc8uXYG9j?= The first part of the name between the question marks is the character encoding. I wonder whether something in Message.pm should be using the Perl module Encode and then do something like encode('utf-8', $filename). Thoughts ? -- Thanks, Phil -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111111/06762b29/attachment.html From nebano at gmail.com Sat Nov 12 00:17:30 2011 From: nebano at gmail.com (Osvaldo Alvarez Pozo) Date: Sat Nov 12 00:17:41 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <CAL2m58eycObkg+OjKTnFPf8KvcvxUACRSB=n19_aJ+O9ehQd5w@mail.gmail.com> References: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> <CAL2m58eycObkg+OjKTnFPf8KvcvxUACRSB=n19_aJ+O9ehQd5w@mail.gmail.com> Message-ID: <CADD-rgovgBm3topV5uL4k9zpDp-k46XAXCA-M_OXNi4V1bxvjQ@mail.gmail.com> Hello, Thanks for your answer. what do i do? downgrade? to wich version? Thanks again 2011/11/10 吳汝剛 <ak6783@gmail.com> > Me too. > I already found this problem. > I think this is 4.84.3 bug. > > 2011/11/9 Osvaldo Alvarez Pozo <nebano@gmail.com> > >> Hello I have a mailscanner configuation that is working but the >> Inline (Html, Text) are not being added. >> >> Wath should i do to make it work? >> >> In my conf i have >> >> Sign Clean Messages = yes >> >> >> Inline HTML Signature = %report-dir%/inline.sig.html >> Inline Text Signature = %report-dir%/inline.sig.txt >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > > > -- > 吳汝剛 > 個人網頁 http://pc.aspa.idv.tw > 個人Blog http://ak6783.blogspot.com/ > Twitter http://twitter.com/akong77 > Plurk http://www.plurk.com/akong77 > Facebook http://www.facebook.com/akong77 > Email (1) : akong@aspa.idv.tw > Email (2) : ak6783@gmail.com > 手機 : 0960599655 > WebRep > Overall rating > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111112/5152c20b/attachment.html From noel.butler at ausics.net Sat Nov 12 00:53:08 2011 From: noel.butler at ausics.net (Noel Butler) Date: Sat Nov 12 00:53:24 2011 Subject: Chinese characters in file names In-Reply-To: <a1444d50-63ea-4b53-86ef-4b7ad4fb3633@office.splatnix.net> References: <a1444d50-63ea-4b53-86ef-4b7ad4fb3633@office.splatnix.net> Message-ID: <1321059188.6362.7.camel@tardis> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 490 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111112/3800dcd2/attachment.bin From uxbod at splatnix.net Sat Nov 12 16:41:11 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Sat Nov 12 16:41:26 2011 Subject: Chinese characters in file names In-Reply-To: <1321059188.6362.7.camel@tardis> Message-ID: <5a4cca9d-cd98-4b4b-9621-b762df465c70@office.splatnix.net> An issue that I have to resolve in the next week! Getting a grip on it but it is slow progress. Thoughts Jules ? perhaps we could double team it ? -- Thanks, Phil ----- Original Message ----- > On Fri, 2011-11-11 at 11:55 +0000, --[ UxBoD ]-- wrote: > > Hi, > > > am working on a project and have encountered an issue where file > > names that contain Chinese (Simplified) characters are being > > mangled > > when processed by MailScanner. An example is when one requires all > > attachments to be zipped up. When I examine the zipped file it now > > contains a file called ?????.doc. I have taken a look at the code > > and believe it is something to do with how > > This added weight to us no longer using mailscanner, apart from the > constant child exit issues after spam tests, China is one of our > (AU) neighbours and a very important trade partner, I couldn't > understand it to save my life, but those who need to, do, and it was > affecting them, this is going back to last year. > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > Before posting, read http://wiki.mailscanner.info/posting > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111112/bac9e3b8/attachment.html From nebano at gmail.com Sat Nov 12 21:50:56 2011 From: nebano at gmail.com (Osvaldo Alvarez Pozo) Date: Sat Nov 12 21:51:06 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <CADD-rgovgBm3topV5uL4k9zpDp-k46XAXCA-M_OXNi4V1bxvjQ@mail.gmail.com> References: <CADD-rgqbPkbJ+0LqYMiPEZCB+LhST1d5b_ksCKO8s1iV8xzSYQ@mail.gmail.com> <CAL2m58eycObkg+OjKTnFPf8KvcvxUACRSB=n19_aJ+O9ehQd5w@mail.gmail.com> <CADD-rgovgBm3topV5uL4k9zpDp-k46XAXCA-M_OXNi4V1bxvjQ@mail.gmail.com> Message-ID: <CADD-rgqG+Tn10Mqh_Btjcd=v3GtDS5weXrfyMU4MU=QAm89sYA@mail.gmail.com> Hello does any body have an idea please?? Thanks 2011/11/12 Osvaldo Alvarez Pozo <nebano@gmail.com> > Hello, > > Thanks for your answer. > > what do i do? downgrade? to wich version? > > Thanks again > > > 2011/11/10 吳汝剛 <ak6783@gmail.com> > >> Me too. >> I already found this problem. >> I think this is 4.84.3 bug. >> >> 2011/11/9 Osvaldo Alvarez Pozo <nebano@gmail.com> >> >>> Hello I have a mailscanner configuation that is working but the >>> Inline (Html, Text) are not being added. >>> >>> Wath should i do to make it work? >>> >>> In my conf i have >>> >>> Sign Clean Messages = yes >>> >>> >>> Inline HTML Signature = %report-dir%/inline.sig.html >>> Inline Text Signature = %report-dir%/inline.sig.txt >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >>> >> >> >> >> -- >> 吳汝剛 >> 個人網頁 http://pc.aspa.idv.tw >> 個人Blog http://ak6783.blogspot.com/ >> Twitter http://twitter.com/akong77 >> Plurk http://www.plurk.com/akong77 >> Facebook http://www.facebook.com/akong77 >> Email (1) : akong@aspa.idv.tw >> Email (2) : ak6783@gmail.com >> 手機 : 0960599655 >> WebRep >> Overall rating >> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111112/c4105f9d/attachment.html From markus at markusoft.se Mon Nov 14 07:32:40 2011 From: markus at markusoft.se (Markus Nilsson) Date: Mon Nov 14 07:33:06 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <CADD-rgqG+Tn10Mqh_Btjcd=v3GtDS5weXrfyMU4MU=QAm89sYA@mail.gmail.com> Message-ID: <500107f8-5be9-4f98-be79-6b8f24d8ad18@cronlabworkstation0> So far I've only seen complaints from you two about this problem, I'm not sure if anyone else uses that version and have made it work? Myself I'm using a quite ancient version, 4.79.11, without any of these problems (but with a few modifications, e.g. the -U switch for the taint issue) It would be interesting to hear from others using 4.84.3... /Markus ----- Ursprungligt meddelande ----- Fr?n: "Osvaldo Alvarez Pozo" <nebano@gmail.com> Till: "MailScanner discussion" <mailscanner@lists.mailscanner.info> Skickat: l?rdag, 12 nov 2011 22:50:56 ?mne: Re: Adding Inline HTMLand Text Signature to messages Hello does any body have an idea please?? Thanks 2011/11/12 Osvaldo Alvarez Pozo < nebano@gmail.com > Hello, Thanks for your answer. what do i do? downgrade? to wich version? Thanks again 2011/11/10 ??? < ak6783@gmail.com > <blockquote> Me too. I already found this problem. I think this is 4.84.3 bug. 2011/11/9 Osvaldo Alvarez Pozo < nebano@gmail.com > <blockquote> Hello I have a mailscanner configuation that is working but the Inline (Html, Text) are not being added. Wath should i do to make it work? In my conf i have Sign Clean Messages = yes Inline HTML Signature = %report-dir%/inline.sig.html Inline Text Signature = %report-dir%/inline.sig.txt -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com ?? : 0960599655 WebRep Overall rating -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! </blockquote> </blockquote> MailScanner CronLabAntiSpamAppliance Signature Bearcom scanned this message. We don't think it was spam. Was it? Report here! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- Skipped content of type multipart/related From markus at markusoft.se Mon Nov 14 07:37:35 2011 From: markus at markusoft.se (Markus Nilsson) Date: Mon Nov 14 07:37:55 2011 Subject: MailScanner 4.84.3-1 can't deny any file. In-Reply-To: <CAL2m58ecfWpCTHfHHCogF54_RdWv7=VkOyBfiH7rfyK0Hqis3w@mail.gmail.com> Message-ID: <11eac1dd-0c8a-4a9d-964e-1a2fb03f6748@cronlabworkstation0> Yes that version is compatible with newer perl's without modification, but I'm using an older MailScanner version with new perl with the added "-U" switch successfully. Add -U to the hashbang of the MailScanner "binary" /usr/sbin/MailScanner #!/usr/bin/perl -I/usr/share/MailScanner/ -U /Markus ----- Ursprungligt meddelande ----- Fr?n: "???" <ak6783@gmail.com> Till: "MailScanner discussion" <mailscanner@lists.mailscanner.info> Skickat: torsdag, 10 nov 2011 9:40:18 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Because I use Fedora 13 and 14.If you update all package to newer.It's need install MailScanner 4.84.3. If not install 4.84.3. It's can't use MailScanner. Because the perl problem.You can see MailScanner changlog. 4.84.3 is use on new perl. So,I hope MailScanner can fix this problem. MailScanner 4.84.3 also can't add inline clean message on mail.It's have other user ask this question. 2011/11/10 Markus Nilsson < markus@markusoft.se > Hi again, It's weird that your debug session hangs, I've not seen that. Maybe a lint would give more info? If not, you might need to try to debug the debug-run, maybe with strace and adding debug-prints to the MailScanner code. Or maybe try a slightly older version to verify that you only have problems with this specific version. (I have not yet stepped up to 4.84.3) /Markus Fr?n: "???" < ak6783@gmail.com > Till: "MailScanner discussion" < mailscanner@lists.mailscanner.info > Skickat: tisdag, 8 nov 2011 23:56:49 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello, This is test message. [root@mail ~]# MailScanner --debug In Debugging mode, not forking... Trying to setlogsock(unix) Building a message batch to scan... Have a batch of 1 message. But it's wait five minutes ago and not show any other message. 2011/11/8 Markus Nilsson < markus@markusoft.se > <blockquote> Did you try running MailScanner in debug with just one of these messages in the queue? /Markus Fr?n: "???" < ak6783@gmail.com > Till: "MailScanner discussion" < mailscanner@lists.mailscanner.info > Skickat: m?ndag, 7 nov 2011 2:55:58 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello, Allow Filenames = N/A Deny Filenames = N/A Filename Rules = %etc-dir%/filename.rules.conf Allow Filetypes = N/A Allow File MIME Types = N/A Deny Filetypes = N/A Deny File MIME Types = N/A Filetype Rules = %etc-dir%/filetype.rules.conf N/A is not set anything. 2011/11/3 Markus Nilsson < markus@markusoft.se > <blockquote> Please print the relevant configuration settings in MailScanner! Allow Filenames = Deny Filenames = Filename Rules = Allow Filetypes = Allow File MIME Types = Deny Filetypes = Deny File MIME Types = Filetype Rules = Thanks! /Markus Fr?n: "???" < ak6783@gmail.com > Till: "MailScanner discussion" < mailscanner@lists.mailscanner.info > Skickat: torsdag, 3 nov 2011 10:56:36 ?mne: Re: MailScanner 4.84.3-1 can't deny any file. Hello Is it found any problem? Why use 4.84.3-1 can't deny file? 2011/11/2 Denis Beauchemin < Denis.Beauchemin@usherbrooke.ca > <blockquote> I wouldn?t be surprised if you forgot to stop the default sendmail (/sbin/chkconfig ?list sendmail should say it is OFF at all levels). You must turn it off (/sbin/chkconfig sendmail off; /sbin/service sendmail stop) and then start/restart MailScanner. Are there any headers added by MailScanner in your received emails? You should have some. If you don?t have any, it?s because of what I described in the previous paragraph. Denis Denis Beauchemin Architecte Technologique - Section Infrastructure des serveurs Service des technologies de l?information (S.T.I.) Universit? de Sherbrooke Courriel: Denis.Beauchemin@USherbrooke.ca T?l.: 819-821-8000 Poste: 62252 De : mailscanner-bounces@lists.mailscanner.info [mailto: mailscanner-bounces@lists.mailscanner.info ] De la part de ??? Envoy? : 1 novembre 2011 22:44 ? : mailscanner@lists.mailscanner.info Objet : MailScanner 4.84.3-1 can't deny any file. Hello, I test MailScanner 4.84.3-1 on Fedora 13 and Fedora 14. It's can't deny any attachment at filetname.rules.conf list. Example: The default set deny .cur and .reg attachment. But when I send mail with .cur or .reg attachment. It's always can received this mail. And I check maillog. It's no show any error message. Please check it. I list fedora 13 and 14 some information. [root@tw14 MailScanner]# MailScanner -v Running on Linux tw14.linguitronics.com 2.6.35.13-91 .fc14.i686 #1 SMP Tue May 3 13:36:36 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 14 (Laughlin) This is Perl version 5.012003 (5.12.3) This is MailScanner version 4.84.3 [root@tw ~]# MailScanner -v Running on Linux tw.linguitronics.com 2.6.34.9-69.fc13.i686 #1 SMP Tue May 3 09:20:30 UTC 2011 i686 i686 i386 GNU/Linux This is Fedora release 13 (Goddard) This is Perl version 5.010001 (5.10.1) This is MailScanner version 4.84.3 </blockquote> -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! </blockquote> -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com ?? : 0960599655 WebRep Overall rating MailScanner CronLabAntiSpamAppliance Signature Bearcom scanned this message. We don't think it was spam. Was it? Report here! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! </blockquote> -- ??? ???? http://pc.aspa.idv.tw ??Blog http://ak6783.blogspot.com/ Twitter http://twitter.com/akong77 Plurk http://www.plurk.com/akong77 Facebook http://www.facebook.com/akong77 Email (1) : akong@aspa.idv.tw Email (2) : ak6783@gmail.com ?? : 0960599655 -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- Skipped content of type multipart/related From richard at fastnet.co.uk Mon Nov 14 09:30:29 2011 From: richard at fastnet.co.uk (Richard Mealing) Date: Mon Nov 14 09:30:42 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <500107f8-5be9-4f98-be79-6b8f24d8ad18@cronlabworkstation0> References: <CADD-rgqG+Tn10Mqh_Btjcd=v3GtDS5weXrfyMU4MU=QAm89sYA@mail.gmail.com> <500107f8-5be9-4f98-be79-6b8f24d8ad18@cronlabworkstation0> Message-ID: <1251B5423222C446A299CABAA7B46FF42BA631@fn-exchange.fastnet.local> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: image001.gif Type: image/gif Size: 368 bytes Desc: image001.gif Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111114/cc75fda6/image001.gif From glenn.steen at gmail.com Mon Nov 14 22:13:52 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Mon Nov 14 22:14:00 2011 Subject: possible bug in 4.84.3-1 located in clamav-wrapper - Found word(s) list error in the Text body In-Reply-To: <CAPwaGKZTvHhwFqJ7s0tyZgygat3SAP-OXi3qcES0v-Bn2LRjCA@mail.gmail.com> References: <CAPwaGKZ9px8hLwdAESzfZ67_VDa6ZGg3Bjua_0jKyyWwdjzF0A@mail.gmail.com> <4552AE40-A6DA-4BED-BC62-F7E6166A9294@fluxlabs.net> <60391E3F-9DBD-4B9A-A01F-7D3499C2C9A4@fluxlabs.net> <CAPwaGKYH=eTCVsyBUNaHMtvpQeNpN_jrT8=bg+OR2KBx+ASM+A@mail.gmail.com> <2EFE3A29-58B2-49C5-9B4E-AAE09944F458@fluxlabs.net> <CAPwaGKZTvHhwFqJ7s0tyZgygat3SAP-OXi3qcES0v-Bn2LRjCA@mail.gmail.com> Message-ID: <CAAug_B8mQk8X=Oyp6s9FY_8r2WSMY3W1aHNwMH5K88vqBYb2Ww@mail.gmail.com> On 10 November 2011 10:24, Alexandru Ionica <alexandru.ionica@gmail.com> wrote: > Still i have the feeling we are talking about different things. > > Clamav , postfix and Mailscanner all run as postfix user. > > Now which part am i not making clear when i say that according to initial > log entry , clamav was trying to create a folder in a file instead of > creating a folder in a folder ???? Or at least this is what i understand and > you are not pointing that i'm understanding it wrong but you keep saying > that it's a permission problem. I still don't understand how running clamav > as a different user will make it try to create a folder in a file . > I will also draw it below, just in case it's still not clear what i am > reporting here (let's hope the formatting isn't lost) > /var/spool/MailScanner/incoming/SpamAssassin-Temp/tmp.vWQ4hixN67/clamav-497c230ffa4f39a4779ea7618dd8efa4 > ^?????? ^????????? ^???????????????? ^ > ^????????????????????????????????????? ^?????????????????? ^ > |???? folder?????? |????????????? folder > |???????????????????????????????? file !!!!!!?????????????? | > folder???????? folder > folder??????????????????????????????????????????????????? attempt to create > this folder > > So i am running Postfix, MailScanner and Clamscan as user and group postfix. > > # grep -i postfix MailScanner.conf | grep -v ^# > Run As User = postfix > Run As Group = postfix > Incoming Queue Dir = /var/spool/postfix/hold > Outgoing Queue Dir = /var/spool/postfix/incoming > MTA = postfix > Incoming Work User = postfix > Incoming Work Group = postfix > # > You should look at running clamd, not clamscan, and mend MailScanner permissions to fit that (there is info in the wiki on how to do that). I suspect noone is running pure clamscan anymore, from an efficiency/performance standpoint... So a bug may well have creapt in there:) Cheers -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From horiz at horizonte.com.ar Tue Nov 15 12:10:36 2011 From: horiz at horizonte.com.ar (Lic. Jorge P. Boland) Date: Tue Nov 15 12:10:52 2011 Subject: Mailscanner and centos 6 trouble Message-ID: <7.0.0.16.1.20111115090835.07b9f110@horizonte.com.ar> hi... i have some troubles with MailScanner 4.84.3, clamd 0.97.2, SpamAssassin 3.3.1 and Centos 6 (postfix) The configuration was done with the follow tuto http://www.linuxmail.info/mail-server-setup-centos-6/ The error in message log is: "MailScanner: Process did not exit cleanly, returned 255 with signal 0" and in the maillog log: "MailScanner E-Mail Virus Scanner version 4.84.3 starting..." Can anybody help me ?. Thanks in advance and sorry for my bad english. From Amelein at dantumadiel.eu Tue Nov 15 13:42:55 2011 From: Amelein at dantumadiel.eu (Arjan Melein) Date: Tue Nov 15 13:43:22 2011 Subject: Betr.: Mailscanner and centos 6 trouble In-Reply-To: <7.0.0.16.1.20111115090835.07b9f110@horizonte.com.ar> References: <7.0.0.16.1.20111115090835.07b9f110@horizonte.com.ar> Message-ID: <4EC27A6F0200008E0001BD41@10.1.0.206> Sounds like the perl tainting error. Try adding -U to /usr/sbin/MailScanner so it reads: #!/usr/bin/perl -I/usr/lib/MailScanner -U That's what makes it work on Fedora 15. If that does not work try MailScanner --debug and see what errors it produces. - Arjan >>> Op 15-11-2011 om 13:10 is door "Lic. Jorge P. Boland" <horiz@horizonte.com.ar> geschreven: > hi... i have some troubles with MailScanner 4.84.3, clamd 0.97.2, > SpamAssassin 3.3.1 and Centos 6 (postfix) > > The configuration was done with the follow tuto > http://www.linuxmail.info/mail-server-setup-centos-6/ > > The error in message log is: "MailScanner: Process did not exit > cleanly, returned 255 with signal 0" > > and in the maillog log: "MailScanner E-Mail Virus Scanner version > 4.84.3 starting..." > > Can anybody help me ?. > > Thanks in advance and sorry for my bad english. From glenn.steen at gmail.com Tue Nov 15 14:38:06 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Tue Nov 15 14:38:15 2011 Subject: Mailscanner and centos 6 trouble In-Reply-To: <7.0.0.16.1.20111115090835.07b9f110@horizonte.com.ar> References: <7.0.0.16.1.20111115090835.07b9f110@horizonte.com.ar> Message-ID: <CAAug_B-BgemyS-ddAEh73b3Nv5Ng_TYc3jy8LbSewzU=seWPmw@mail.gmail.com> Either a permission error, a taint issue, SE-linux or ... any combination thereof. -- -- Glenn On 15 November 2011 13:10, Lic. Jorge P. Boland <horiz@horizonte.com.ar> wrote: > hi... i have some troubles with MailScanner 4.84.3, clamd 0.97.2, > SpamAssassin ?3.3.1 and Centos 6 (postfix) > > The configuration was done with the follow tuto > http://www.linuxmail.info/mail-server-setup-centos-6/ > > The error in message log is: "MailScanner: Process did not exit cleanly, > returned 255 with signal 0" > > and in the maillog log: "MailScanner E-Mail Virus Scanner version 4.84.3 > starting..." > > Can anybody help me ?. > > Thanks in advance and sorry for my bad english. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From glenn.steen at gmail.com Tue Nov 15 14:42:15 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Tue Nov 15 14:42:23 2011 Subject: Mailscanner and centos 6 trouble In-Reply-To: <CAAug_B-BgemyS-ddAEh73b3Nv5Ng_TYc3jy8LbSewzU=seWPmw@mail.gmail.com> References: <7.0.0.16.1.20111115090835.07b9f110@horizonte.com.ar> <CAAug_B-BgemyS-ddAEh73b3Nv5Ng_TYc3jy8LbSewzU=seWPmw@mail.gmail.com> Message-ID: <CAAug_B_csMo0J_p1xa97zRmx2yT2bD0KPCOUG1KFWOKv7LbjaA@mail.gmail.com> On 15 November 2011 15:38, Glenn Steen <glenn.steen@gmail.com> wrote: > Either a permission error, a taint issue, SE-linux or ... any > combination thereof. > ... accidental premature send there, sorry for that... Log on as the postfix user (su - postfix -s /bin/bash) and check the lint output for errors /MailScanner --lint), and if that is OK also check a debug run for errors (MailScanner --debug --debug-sa 2>&1 | less -e ... Remeber that it will "hang" until you supply a message for it to scan (mail someone@yourplace.net ...). Cheers -- -- Glenn > On 15 November 2011 13:10, Lic. Jorge P. Boland <horiz@horizonte.com.ar> wrote: >> hi... i have some troubles with MailScanner 4.84.3, clamd 0.97.2, >> SpamAssassin ?3.3.1 and Centos 6 (postfix) >> >> The configuration was done with the follow tuto >> http://www.linuxmail.info/mail-server-setup-centos-6/ >> >> The error in message log is: "MailScanner: Process did not exit cleanly, >> returned 255 with signal 0" >> >> and in the maillog log: "MailScanner E-Mail Virus Scanner version 4.84.3 >> starting..." >> >> Can anybody help me ?. >> >> Thanks in advance and sorry for my bad english. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > > -- > -- Glenn > email: glenn < dot > steen < at > gmail < dot > com > work: glenn < dot > steen < at > ap1 < dot > se > -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From ian at chopstixmedia.com Tue Nov 15 15:02:19 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Tue Nov 15 15:02:39 2011 Subject: Problem messages In-Reply-To: <75D198B0-84B9-4700-8D89-00C5961CC64C@chopstixmedia.com> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> <425C78DC-3B3D-4621-8C6B-4B37FF507CEB@chopstixmedia.com> <55ABD5EC-FE1D-4977-8C13-E325678C84BD@fluxlabs.net> <75D198B0-84B9-4700-8D89-00C5961CC64C@chopstixmedia.com> Message-ID: <F00554B7-46A9-4098-B9B6-655EC84520E7@chopstixmedia.com> Hi, The 'Problem messages' emails continue, with contents such as: Archive: Number of messages: 22 Tries Message Last Tried ===== ======= ========== 6 pAE4lrZN010803 Mon Nov 14 05:13:23 2011 6 pADJflCP031936 Sun Nov 13 20:06:43 2011 6 pAD3MhUW025210 Sun Nov 13 03:44:50 2011 6 pACEssSh008313 Sat Nov 12 15:17:40 2011 6 pABBNB5X031529 Fri Nov 11 11:45:59 2011 6 pABBKG1f031450 Fri Nov 11 11:42:52 2011 6 pA8HDRnn014756 Tue Nov 8 17:35:30 2011 6 pA8AP2if000638 Tue Nov 8 10:46:47 2011 6 pA7MIJ2b017305 Mon Nov 7 22:45:57 2011 6 pA7HccgC008382 Mon Nov 7 17:59:29 2011 6 pA7CZ7Uo028612 Mon Nov 7 12:59:45 2011 6 pA7ARPAk024273 Mon Nov 7 10:50:58 2011 6 pA78VtIh020893 Mon Nov 7 08:52:35 2011 6 pA70d9Gj009491 Mon Nov 7 01:03:26 2011 6 pA6MVJo2006339 Sun Nov 6 22:53:25 2011 6 pA6CDoqs021135 Sun Nov 6 12:43:24 2011 6 pA6A9vUo018102 Sun Nov 6 10:31:34 2011 6 pA5NNIlU017875 Sat Nov 5 23:48:11 2011 6 pA5M9VvO015601 Sat Nov 5 22:35:51 2011 6 pA5M32NB015188 Sat Nov 5 22:32:34 2011 6 pA5AKK8i011598 Sat Nov 5 10:41:21 2011 6 pA4LurOv027214 Fri Nov 4 22:25:04 2011 Anybody have any thoughts on how I can debug this? Many thanks, -- Ian On 5 Nov 2011, at 18:04, Ian Fenn wrote: > On 5 Nov 2011, at 15:34, Jeremy McSpadden wrote: >> I'm going to assume its a perl taint issue. Add -U -X to the MailScanner # line > > I did that, and restarted MailScanner. However, the problem message emails continue. :-/ > > All the best, > > -- > Ian From jeremy at fluxlabs.net Tue Nov 15 15:05:51 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Nov 15 15:06:43 2011 Subject: Problem messages In-Reply-To: <F00554B7-46A9-4098-B9B6-655EC84520E7@chopstixmedia.com> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> <425C78DC-3B3D-4621-8C6B-4B37FF507CEB@chopstixmedia.com> <55ABD5EC-FE1D-4977-8C13-E325678C84BD@fluxlabs.net> <75D198B0-84B9-4700-8D89-00C5961CC64C@chopstixmedia.com> <F00554B7-46A9-4098-B9B6-655EC84520E7@chopstixmedia.com> Message-ID: <AA13967D-E522-4A3B-A26B-15231F342C6C@fluxlabs.net> With --debug -- Jeremy McSpadden On Nov 15, 2011, at 9:04 AM, "Ian Fenn" <ian@chopstixmedia.com> wrote: > Hi, > > The 'Problem messages' emails continue, with contents such as: > > Archive: > > Number of messages: 22 > > Tries Message Last Tried > ===== ======= ========== > 6 pAE4lrZN010803 Mon Nov 14 05:13:23 2011 > 6 pADJflCP031936 Sun Nov 13 20:06:43 2011 > 6 pAD3MhUW025210 Sun Nov 13 03:44:50 2011 > 6 pACEssSh008313 Sat Nov 12 15:17:40 2011 > 6 pABBNB5X031529 Fri Nov 11 11:45:59 2011 > 6 pABBKG1f031450 Fri Nov 11 11:42:52 2011 > 6 pA8HDRnn014756 Tue Nov 8 17:35:30 2011 > 6 pA8AP2if000638 Tue Nov 8 10:46:47 2011 > 6 pA7MIJ2b017305 Mon Nov 7 22:45:57 2011 > 6 pA7HccgC008382 Mon Nov 7 17:59:29 2011 > 6 pA7CZ7Uo028612 Mon Nov 7 12:59:45 2011 > 6 pA7ARPAk024273 Mon Nov 7 10:50:58 2011 > 6 pA78VtIh020893 Mon Nov 7 08:52:35 2011 > 6 pA70d9Gj009491 Mon Nov 7 01:03:26 2011 > 6 pA6MVJo2006339 Sun Nov 6 22:53:25 2011 > 6 pA6CDoqs021135 Sun Nov 6 12:43:24 2011 > 6 pA6A9vUo018102 Sun Nov 6 10:31:34 2011 > 6 pA5NNIlU017875 Sat Nov 5 23:48:11 2011 > 6 pA5M9VvO015601 Sat Nov 5 22:35:51 2011 > 6 pA5M32NB015188 Sat Nov 5 22:32:34 2011 > 6 pA5AKK8i011598 Sat Nov 5 10:41:21 2011 > 6 pA4LurOv027214 Fri Nov 4 22:25:04 2011 > > Anybody have any thoughts on how I can debug this? > > Many thanks, > > -- > Ian > > On 5 Nov 2011, at 18:04, Ian Fenn wrote: > >> On 5 Nov 2011, at 15:34, Jeremy McSpadden wrote: >>> I'm going to assume its a perl taint issue. Add -U -X to the MailScanner # line >> >> I did that, and restarted MailScanner. However, the problem message emails continue. :-/ >> >> All the best, >> >> -- >> Ian > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From horiz at horizonte.com.ar Tue Nov 15 16:32:06 2011 From: horiz at horizonte.com.ar (Lic. Jorge P. Boland) Date: Tue Nov 15 16:32:31 2011 Subject: Betr.: Mailscanner and centos 6 trouble In-Reply-To: <4EC27A6F0200008E0001BD41@10.1.0.206> References: <7.0.0.16.1.20111115090835.07b9f110@horizonte.com.ar> <4EC27A6F0200008E0001BD41@10.1.0.206> Message-ID: <7.0.0.16.1.20111115124905.06ea6190@horizonte.com.ar> i put "#!/usr/bin/perl -I/usr/lib/MailScanner -U --debug" in the /usr/sbin/MailScanner file its working fine now.... i'm checking that Thanks a lot. At 10:42 15/11/2011, you wrote: >Sounds like the perl tainting error. > >Try adding -U to /usr/sbin/MailScanner so it reads: >#!/usr/bin/perl -I/usr/lib/MailScanner -U > >That's what makes it work on Fedora 15. >If that does not work try MailScanner --debug and see what errors it produces. > >- >Arjan > > >>> Op 15-11-2011 om 13:10 is door "Lic. Jorge P. Boland" > <horiz@horizonte.com.ar> >geschreven: > > hi... i have some troubles with MailScanner 4.84.3, clamd 0.97.2, > > SpamAssassin 3.3.1 and Centos 6 (postfix) > > > > The configuration was done with the follow tuto > > http://www.linuxmail.info/mail-server-setup-centos-6/ > > > > The error in message log is: "MailScanner: Process did not exit > > cleanly, returned 255 with signal 0" > > > > and in the maillog log: "MailScanner E-Mail Virus Scanner version > > 4.84.3 starting..." > > > > Can anybody help me ?. > > > > Thanks in advance and sorry for my bad english. > > > > >-- >MailScanner mailing list >mailscanner@lists.mailscanner.info >http://lists.mailscanner.info/mailman/listinfo/mailscanner > >Before posting, read http://wiki.mailscanner.info/posting > >Support MailScanner development - buy the book off the website! -- Este mensaje fue escaneado por virus y contenido peligroso por los servidores de Horizonte S.A. From johnnyb at marlboro.edu Tue Nov 15 16:43:28 2011 From: johnnyb at marlboro.edu (John Baker) Date: Tue Nov 15 16:43:53 2011 Subject: false fraud positives with domain shorteners Message-ID: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> HI all, I had a complaint to day with mail scanner putting" MailScanner has detected definite fraud in the website at" in a perfectly legitimate link using google domain shorteners. Does anybody have any ideas on how to keep fraud checking on but allowing domain shorteners? -- John Baker Network Administrator Marlboro College Phone: 451-7551 Cell: 490-0066 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111115/6b63dc42/attachment.html From ssilva at sgvwater.com Tue Nov 15 17:55:59 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Nov 15 17:56:27 2011 Subject: false fraud positives with domain shorteners In-Reply-To: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> References: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> Message-ID: <j9u93h$d33$1@dough.gmane.org> on 11/15/2011 8:43 AM John Baker spake the following: > > HI all, > > I had a complaint to day with mail scanner putting" MailScanner has detected > definite fraud in the website at" in a perfectly legitimate link using google > domain shorteners. Does anybody have any ideas on how to keep fraud checking > on but allowing domain shorteners? The trouble is, you can't be sure that EVERY shortened domain is going to be legitimate... From mailscanner at joolee.nl Tue Nov 15 18:08:28 2011 From: mailscanner at joolee.nl (Joolee) Date: Tue Nov 15 18:09:18 2011 Subject: false fraud positives with domain shorteners In-Reply-To: <j9u93h$d33$1@dough.gmane.org> References: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> <j9u93h$d33$1@dough.gmane.org> Message-ID: <CA+Q-w8UfnwX0+Jn==Lh03RW9z0kOpEZwuZ6YjSvKAryWyeTNAw@mail.gmail.com> I'm using a modified version of a shortener decoder. I've modified it to be able to handle a few extra shortener services that don't use a http header and were being used in unrecognised spam. With this running and combined with all other url checks (retrieved urls are returned to SpamAssassin to be scanned by other rules and plugins), I've completely disabled the built in Mailscanner fraud detector. I can share the source if anyone is interested. On 15 November 2011 18:55, Scott Silva <ssilva@sgvwater.com> wrote: > on 11/15/2011 8:43 AM John Baker spake the following: > > >> HI all, >> >> I had a complaint to day with mail scanner putting" MailScanner has >> detected >> definite fraud in the website at" in a perfectly legitimate link using >> google >> domain shorteners. Does anybody have any ideas on how to keep fraud >> checking >> on but allowing domain shorteners? >> > The trouble is, you can't be sure that EVERY shortened domain is going to > be legitimate... > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info <mailscanner@lists.mailscanner.info> > http://lists.mailscanner.info/**mailman/listinfo/mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner> > > Before posting, read http://wiki.mailscanner.info/**posting<http://wiki.mailscanner.info/posting> > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111115/353994cd/attachment.html From mogens at fumlersoft.dk Wed Nov 16 09:06:23 2011 From: mogens at fumlersoft.dk (Mogens Melander) Date: Wed Nov 16 09:06:38 2011 Subject: false fraud positives with domain shorteners In-Reply-To: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> References: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> Message-ID: <21b17ce8afb1b79a17857f8ce3b6de5a.squirrel@mail.fumlersoft.dk> On Tue, November 15, 2011 17:43, John Baker wrote: > HI all, > > I had a complaint to day with mail scanner putting" MailScanner has > detected definite fraud in the website at" in a perfectly legitimate link > using Google domain shortener. Does anybody have any ideas on how to keep > fraud checking on but allowing domain shortener? Well, personally i consider any shortened link a fraud. Someone trying to hide who they really are. -- Later Mogens Melander -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mailscanner at joolee.nl Wed Nov 16 09:51:46 2011 From: mailscanner at joolee.nl (Joolee) Date: Wed Nov 16 09:52:36 2011 Subject: false fraud positives with domain shorteners In-Reply-To: <21b17ce8afb1b79a17857f8ce3b6de5a.squirrel@mail.fumlersoft.dk> References: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> <21b17ce8afb1b79a17857f8ce3b6de5a.squirrel@mail.fumlersoft.dk> Message-ID: <CA+Q-w8VcEV7jC3xvUoKOxLdMoGWNJ5Y12iVrW5bRXzv-6Y638g@mail.gmail.com> Than, what about stuff like http://youtu.be/Hw2K9SifAXk, other Google shorteners, shorteners used on twitter (automated mailing systems for tweets will send the shortened urls) or stuff like http://twk.rs/nj4D which is a service provided by tweakers.net and points to http://tweakers.net/nieuws/78119/. It's a bit to much to mark any E-mail that includes a shortened url as spam. I will give all E-mails containing a shortener a spam score of +2 but I let the other URL checkers in SpamAssassin and my plugins decide whether the url the shortened version points to is malicious. On 16 November 2011 10:06, Mogens Melander <mogens@fumlersoft.dk> wrote: > > On Tue, November 15, 2011 17:43, John Baker wrote: > > HI all, > > > > I had a complaint to day with mail scanner putting" MailScanner has > > detected definite fraud in the website at" in a perfectly legitimate link > > using Google domain shortener. Does anybody have any ideas on how to keep > > fraud checking on but allowing domain shortener? > > Well, personally i consider any shortened link a fraud. Someone trying > to hide who they really are. > > -- > Later > > Mogens Melander > > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111116/fd042518/attachment.html From peter at pele.spb.ru Thu Nov 17 08:52:18 2011 From: peter at pele.spb.ru (Peter A.Nesterov) Date: Thu Nov 17 08:52:38 2011 Subject: MailScanner[nnnn]: Could not use Custom Function code /usr/lib/MailScanner/... Message-ID: <4EC4CB42.5060703@pele.spb.ru> Hi, I've just implemented MailScanner 4.84.3 on CentOS 5.7 x64_86 with Postfix 2.3.3, spamassassin 3.3.1, ClamAV 0.97.2, Perl 5.8.8. I followed this guide to setting it up http://www.linuxmail.info/how-to-install-mailscanner-centos-5/ Everything works, but I see some error messages in maillog: ... Nov 15 12:45:17 mail MailScanner[3227]: MailScanner E-Mail Virus Scanner version 4.84.3 starting... Nov 15 12:45:17 mail MailScanner[3227]: Could not use Custom Function code /usr/lib/MailScanner/MailScanner/CustomFunctions/Ruleset-from-Function.pm, it could not be "require"d. Make sure the last line is "1;" and the module is correct with perl -wc (Error: Error in tempfile() using MailScanner.XXXXXX: Parent directory (.) is not writable Nov 15 12:45:17 mail MailScanner[3227]: at /usr/lib/MailScanner/MailScanner/CustomFunctions/Ruleset-from-Function.pm line 34 Nov 15 12:45:17 mail MailScanner[3227]: Compilation failed in require at /usr/lib/MailScanner/MailScanner/Config.pm line 760. Nov 15 12:45:17 mail MailScanner[3227]: ) Nov 15 12:45:17 mail MailScanner[3227]: Reading configuration file /etc/MailScanner/MailScanner.conf ... Any suggestions? Cheers, Peter -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/a356c139/attachment.html From mailscanner at joolee.nl Thu Nov 17 09:18:25 2011 From: mailscanner at joolee.nl (Joolee) Date: Thu Nov 17 09:19:15 2011 Subject: MailScanner[nnnn]: Could not use Custom Function code /usr/lib/MailScanner/... In-Reply-To: <4EC4CB42.5060703@pele.spb.ru> References: <4EC4CB42.5060703@pele.spb.ru> Message-ID: <CA+Q-w8WO+O89-7x0c6Vzs=NqWG+8_K4c7gjf5rUF1Man81qveQ@mail.gmail.com> You'll have to look at the content of Ruleset-from-Function.pm ? Especially line 34. It looks like it's trying to create a temp file but doesn't have the permissions to do so. Find out where and why it's making a temp file and disable that functionality or make sure it has the correct permissions. On 17 November 2011 09:52, Peter A.Nesterov <peter@pele.spb.ru> wrote: > Hi, > > I've just implemented MailScanner 4.84.3 on CentOS 5.7 x64_86 with Postfix > 2.3.3, spamassassin 3.3.1, ClamAV 0.97.2, Perl 5.8.8. > > I followed this guide to setting it up > > http://www.linuxmail.info/how-to-install-mailscanner-centos-5/ > > Everything works, but I see some error messages in maillog: > > ... > Nov 15 12:45:17 mail MailScanner[3227]: MailScanner E-Mail Virus Scanner > version 4.84.3 starting... > Nov 15 12:45:17 mail MailScanner[3227]: Could not use Custom Function code > /usr/lib/MailScanner/MailScanner/CustomFunctions/Ruleset-from-Function.pm, > it could not be "require"d. Make sure the last line is "1;" and the module > is correct with perl -wc (Error: Error in tempfile() using > MailScanner.XXXXXX: Parent directory (.) is not writable > Nov 15 12:45:17 mail MailScanner[3227]: at > /usr/lib/MailScanner/MailScanner/CustomFunctions/Ruleset-from-Function.pm > line 34 > Nov 15 12:45:17 mail MailScanner[3227]: Compilation failed in require at > /usr/lib/MailScanner/MailScanner/Config.pm line 760. > Nov 15 12:45:17 mail MailScanner[3227]: ) > Nov 15 12:45:17 mail MailScanner[3227]: Reading configuration file > /etc/MailScanner/MailScanner.conf > ... > > Any suggestions? > > Cheers, > Peter > > > -- > This message has been scanned for viruses and > dangerous content by *MailScanner* <http://www.mailscanner.info/>, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/76667350/attachment.html From markus at markusoft.se Thu Nov 17 09:24:04 2011 From: markus at markusoft.se (Markus Nilsson) Date: Thu Nov 17 09:24:25 2011 Subject: MailScanner[nnnn]: Could not use Custom Function code /usr/lib/MailScanner/... In-Reply-To: <4EC4CB42.5060703@pele.spb.ru> Message-ID: <ab44013d-a311-4df4-81a3-56d529716e74@cronlabworkstation0> ----- Original Message ----- > From: "Peter A.Nesterov" <peter@pele.spb.ru> > To: mailscanner@lists.mailscanner.info > Sent: torsdag, 17 nov 2011 9:52:18 > Subject: MailScanner[nnnn]: Could not use Custom Function code > /usr/lib/MailScanner/... > Hi, > I've just implemented MailScanner 4.84.3 on CentOS 5.7 x64_86 with > Postfix 2.3.3, spamassassin 3.3.1, ClamAV 0.97.2, Perl 5.8.8. > I followed this guide to setting it up > http://www.linuxmail.info/how-to-install-mailscanner-centos-5/ > Everything works, but I see some error messages in maillog: > ... > Nov 15 12:45:17 mail MailScanner[3227]: MailScanner E-Mail Virus > Scanner version 4.84.3 starting... > Nov 15 12:45:17 mail MailScanner[3227]: Could not use Custom Function > code > /usr/lib/MailScanner/MailScanner/CustomFunctions/Ruleset-from-Function.pm, > it could not be "require"d. Make sure the last line is "1;" and the > module is correct with perl -wc (Error: Error in tempfile() using > MailScanner.XXXXXX: Parent directory (.) is not writable > Nov 15 12:45:17 mail MailScanner[3227]: at > /usr/lib/MailScanner/MailScanner/CustomFunctions/Ruleset-from-Function.pm > line 34 Hi! Seems like there is a problem with a CustomFunction: Ruleset-from-Function.pm Have you written this yourself, or downloaded it from somewhere? (I don't immediately recognize it) It complains about write permissions, start by checking the Custom Function .pm file on the problematic line to see where it tries to create the tempfile(). /Markus > Nov 15 12:45:17 mail MailScanner[3227]: Compilation failed in require > at /usr/lib/MailScanner/MailScanner/Config.pm line 760. > Nov 15 12:45:17 mail MailScanner[3227]: ) > Nov 15 12:45:17 mail MailScanner[3227]: Reading configuration file > /etc/MailScanner/MailScanner.conf > ... > Any suggestions? > Cheers, > Peter -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/3f699680/attachment.html From eric_le_corre at msn.com Thu Nov 17 09:26:35 2011 From: eric_le_corre at msn.com (eric le corre) Date: Thu Nov 17 09:26:45 2011 Subject: Very bad score spamassassin Message-ID: <DUB110-W90ABD0F20B0B99899FC944B8C70@phx.gbl> Hello and sorry for my english, I have some trouble. I have SpamAssassin version 3.3.1, mailscanner 4.83.5, postfix 2.8.2 and mailwatch on Ubuntu. This server is configure as gateway for my exchange 2010. IT works fine, no problem to receive or send mails. The problem is that all my receive or send email have negative or very bad spamassassin score and I don?t know if it is normal or not. Sometimes Spamassasin find spam with score more than 10 but most of spam is not found or 0. For example, my last 10 email score. 4.86 -1.12 0.00 -1.90 0.00 0.00 1.75 0.00 1.01 0.00 0.00 -1.89 0.00 I dont use DCC client, razor or pyzor. When I do mailscanner ?lint, there is no error. About my bayes on the server : Bayes Database Information Number of Spam Messages: 1,035 Number of Ham Messages: 27,032 Number of Tokens: 997,996 Oldest Token: Fri, 04 Apr 2003 07:00:00 +0200 Newest Token: Tue, 15 Nov 2011 14:01:30 +0100 Last Journal Sync: Tue, 15 Nov 2011 13:26:01 +0100 Last Expiry: Thu, 01 Jan 1970 01:00:00 +0100 Last Expiry Reduction Count: 0 tokens I don?t know if it is normal ? someone can tell me Thanks. Ps : When we post new topic, wen send to mailscanner@lists.mailscanner.info, but how to respond to one topic open ? -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/5369d9e9/attachment.html From eric_le_corre at msn.com Thu Nov 17 09:53:08 2011 From: eric_le_corre at msn.com (eric le corre) Date: Thu Nov 17 09:53:17 2011 Subject: Emails lost ! Message-ID: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> hello and sorry for my enlish I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner, postfix 2.8.2 on Ubuntu and MailWatch. This Server is configured as gateway for my Exchange 2010. users complain of not receiving emails. Apparently it's quite often. Users give me the address of the sender which certifies sending an email. On my exchange, I have no trace of the mail in question. On Mailscanner either, MailWatch in the mail does not appear either. In short, nothing a all. What is even more annoying is that the sender does not receive an e-mail non-delivery. So emails that are lost. Mailscanner in the logs I find nothing wrong. If someone could help me find an explanation ..... I was wondering, but can be nothing to see there are a mailscanner script that restarts the service regularly. Are the mails could not be lost just when mailscanner restarts? possible? thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/e97d77ee/attachment.html From mailscanner at joolee.nl Thu Nov 17 10:00:35 2011 From: mailscanner at joolee.nl (Joolee) Date: Thu Nov 17 10:01:25 2011 Subject: Emails lost ! In-Reply-To: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> Message-ID: <CA+Q-w8V+Qye5M4H4OARea84cTR=dLfZeWe8WSauSj6TsOHSrqw@mail.gmail.com> Can you see any sign of the E-mails in the log? On 17 November 2011 10:53, eric le corre <eric_le_corre@msn.com> wrote: > hello and sorry for my enlish > > > I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner > , postfix 2.8.2 on Ubuntu and MailWatch. > This Server is configured as gateway for my Exchange 2010. > > users complain of not receiving emails. Apparently it's quite often. Users give > me the address of the sender which certifies sending an email. On my > exchange, I have no trace of the mail in question. On Mailscanner either, > MailWatch in the mail does not appear either. In short, nothing a all. What > is even more annoying is that the sender does not receive an e-mail > non-delivery. So emails that are lost. > > Mailscanner in the logs I find nothing wrong. > > If someone could help me find an explanation ..... > > I was wondering, but can be nothing to see there are a mailscanner script that > restarts the service regularly. Are the mails could not be lost just when > mailscanner restarts? possible? > > thanks > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/b3f29f20/attachment.html From markus at markusoft.se Thu Nov 17 10:06:49 2011 From: markus at markusoft.se (Markus Nilsson) Date: Thu Nov 17 10:07:08 2011 Subject: Very bad score spamassassin In-Reply-To: <DUB110-W90ABD0F20B0B99899FC944B8C70@phx.gbl> Message-ID: <ace70ff8-4ff0-4bd3-b834-967fbfed6f88@cronlabworkstation0> ----- Original Message ----- > From: "eric le corre" <eric_le_corre@msn.com> > To: mailscanner@lists.mailscanner.info > Sent: torsdag, 17 nov 2011 10:26:35 > Subject: Very bad score spamassassin > Hello and sorry for my english, > I have some trouble. I have SpamAssassin version 3.3.1, mailscanner > 4.83.5, postfix 2.8.2 and mailwatch on Ubuntu. > This server is configure as gateway for my exchange 2010. IT works > fine, no problem to receive or send mails. > The problem is that all my receive or send email have negative or > very bad spamassassin score and I don?t know if it is normal or not. > Sometimes Spamassasin find spam with score more than 10 but most of > spam is not found or 0. For example, my last 10 email score. > 4.86 > > -1.12 > > 0.00 > > -1.90 > > 0.00 > > 0.00 > > 1.75 > > 0.00 > > 1.01 > > 0.00 > > 0.00 > > -1.89 > > 0.00 Are these scores all for actual SPAM messages? > I dont use DCC client, razor or pyzor. When I do mailscanner ?lint, > there is no error. Using some of these services would probably improve your scoring. > About my bayes on the server : > > Bayes Database Information > Number of Spam Messages: > 1,035 > > Number of Ham Messages: > 27,032 > > Number of Tokens: > 997,996 > > Oldest Token: > Fri, 04 Apr 2003 07:00:00 +0200 > > Newest Token: > Tue, 15 Nov 2011 14:01:30 +0100 > > Last Journal Sync: > Tue, 15 Nov 2011 13:26:01 +0100 > > Last Expiry: > Thu, 01 Jan 1970 01:00:00 +0100 > > Last Expiry Reduction Count: > 0 tokens Do you manually train the BAYES database? Are the 27k Ham messages really only ham? Or does the dataabse contain wrongly trained messages? The oldest token is 8 years old, you should remove the old tokens from the database, and only keep more recent ones. Seems like you have never run an expiry run! > I don?t know if it is normal ? someone can tell me > Thanks. > Ps : When we post new topic, wen send to > mailscanner@lists.mailscanner.info , but how to respond to one topic > open ? Just reply to the message and it will end up in the same thread! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/fb32ea99/attachment.html From ms-list at alexb.ch Thu Nov 17 10:15:06 2011 From: ms-list at alexb.ch (Alex Broens) Date: Thu Nov 17 10:15:11 2011 Subject: Emails lost ! In-Reply-To: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> Message-ID: <4EC4DEAA.5070100@alexb.ch> On 2011-11-17 10:53, eric le corre wrote: > hello and sorry for my enlish I Have some trouble. I Have > SpamAssassin version 3.3.1, 4.83.5 mailscanner, postfix 2.8.2 on > Ubuntu and MailWatch. This Server is configured as gateway for my > Exchange 2010. > > users complain of not receiving emails. Apparently it's quite often. > Users give me the address of the sender which certifies sending an > email. On my exchange, I have no trace of the mail in question. On > Mailscanner either, MailWatch in the mail does not appear either. In > short, nothing a all. What is even more annoying is that the sender > does not receive an e-mail non-delivery. So emails that are lost. > > Mailscanner in the logs I find nothing wrong. > > If someone could help me find an explanation ..... > > I was wondering, but can be nothing to see there are a mailscanner > script that restarts the service regularly. Are the mails could not > be lost just when mailscanner restarts? possible? thanks If the msg doesn't show up in your MTA's log, then MAilScanner can't "loose" it. The obvious is to ask the sender to provide an smtp log snippet which shows that they did indeed send a msg and you accepted or rejected. Although the sender never likes that approach "Show me what you sent, before I loose sleep over it" will save you a lot of time and headaches. From eric_le_corre at msn.com Thu Nov 17 10:31:33 2011 From: eric_le_corre at msn.com (eric le corre) Date: Thu Nov 17 10:40:27 2011 Subject: Very bad score spamassassin References: <DUB110-W90ABD0F20B0B99899FC944B8C70@phx.gbl> <ace70ff8-4ff0-4bd3-b834-967fbfed6f88@cronlabworkstation0> Message-ID: <loom.20111117T112243-761@post.gmane.org> Spamassassin configuration is in autolearning. So there has to be found in spam HAM. Occasionally, I learn to SpamAssassin manually. But this problem has been the case since I installed mailscanner. Since the beginning I have negative cores. Do I have to disable the AutoLearn, how? how can your remove the old tokens? ? From markus at markusoft.se Thu Nov 17 11:01:00 2011 From: markus at markusoft.se (Markus Nilsson) Date: Thu Nov 17 11:01:17 2011 Subject: Very bad score spamassassin In-Reply-To: <loom.20111117T112243-761@post.gmane.org> Message-ID: <aee933e3-12e3-4a18-9d2c-3704d0776d30@cronlabworkstation0> Please reply to the previous mail to keep the thread! ----- Original Message ----- > From: "eric le corre" <eric_le_corre@msn.com> > To: mailscanner@lists.mailscanner.info > Sent: torsdag, 17 nov 2011 11:31:33 > Subject: Re: Very bad score spamassassin > > Spamassassin configuration is in autolearning. So there has to be > found in > spam HAM. > Occasionally, I learn to SpamAssassin manually. > > But this problem has been the case since I installed mailscanner. > Since the > beginning I have negative cores. > > Do I have to disable the AutoLearn, how? No you can keep autolearn, just make sure you manually train those that fail! > > how can your remove the old tokens? > e.g. by running sa-learn --force-expire -p /etc/MailScanner/spam.assassin.prefs.conf NOTE: This will remove lots of tokens from your Bayes DB, make sure you have reviewed your settings in the config file first, and make a backup of the bayes DB if you are unsure you want to do this! Specifically check your bayes_expiry_max_db_size setting /Markus From maxsec at gmail.com Thu Nov 17 11:09:30 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Nov 17 11:09:38 2011 Subject: Very bad score spamassassin In-Reply-To: <loom.20111117T112243-761@post.gmane.org> References: <DUB110-W90ABD0F20B0B99899FC944B8C70@phx.gbl> <ace70ff8-4ff0-4bd3-b834-967fbfed6f88@cronlabworkstation0> <loom.20111117T112243-761@post.gmane.org> Message-ID: <CAGDKorLb1s0_=UOiji_QWPJ2JZ3ThAMo3PWTc3CqSc7TFzvWCA@mail.gmail.com> yes disable auto learn by commenting out the plugin in one of the /usr/local/spamassassin/*.cf files you need to know WHAT spamassassin rule is dragging the score down, you should be able to see this in Mailwatch or alter the following settings in MailWatch.conf and you'll get more info in the email headers to help diagnose.. Spam Score Number Format = %5.2f Detailed Spam Report = yes Include Scores In SpamAssassin Report = yes Always Include SpamAssassin Report = yes Spam Score Number Format = %5.2f -- Martin Hepworth Oxford, UK On 17 November 2011 10:31, eric le corre <eric_le_corre@msn.com> wrote: > Spamassassin configuration is in autolearning. So there has to be found in > spam HAM. > Occasionally, I learn to SpamAssassin manually. > > But this problem has been the case since I installed mailscanner. Since > the > beginning I have negative cores. > > Do I have to disable the AutoLearn, how? > > how can your remove the old tokens? > > > > > > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/43febe9c/attachment.html From maxsec at gmail.com Thu Nov 17 11:15:47 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Nov 17 11:15:56 2011 Subject: MailScanner[nnnn]: Could not use Custom Function code /usr/lib/MailScanner/... In-Reply-To: <4EC4CB42.5060703@pele.spb.ru> References: <4EC4CB42.5060703@pele.spb.ru> Message-ID: <CAGDKorKx8hHex+msK47Va5fgSUXU2UQ3bA8VQgJ9O-7oBeUauw@mail.gmail.com> make sure the permission on the folders for quarantine/ Incoming work dir/ SpamAssassin Cache Database File etc allow Postfix to write su to postfix and run mailScanner in Debug, you'll be able to find out what it's trying to do in more detail to findout where you've not got the permissions correct -- Martin Hepworth Oxford, UK On 17 November 2011 08:52, Peter A.Nesterov <peter@pele.spb.ru> wrote: > Hi, > > I've just implemented MailScanner 4.84.3 on CentOS 5.7 x64_86 with Postfix > 2.3.3, spamassassin 3.3.1, ClamAV 0.97.2, Perl 5.8.8. > > I followed this guide to setting it up > > http://www.linuxmail.info/how-to-install-mailscanner-centos-5/ > > Everything works, but I see some error messages in maillog: > > ... > Nov 15 12:45:17 mail MailScanner[3227]: MailScanner E-Mail Virus Scanner > version 4.84.3 starting... > Nov 15 12:45:17 mail MailScanner[3227]: Could not use Custom Function code > /usr/lib/MailScanner/MailScanner/CustomFunctions/Ruleset-from-Function.pm, > it could not be "require"d. Make sure the last line is "1;" and the module > is correct with perl -wc (Error: Error in tempfile() using > MailScanner.XXXXXX: Parent directory (.) is not writable > Nov 15 12:45:17 mail MailScanner[3227]: at > /usr/lib/MailScanner/MailScanner/CustomFunctions/Ruleset-from-Function.pm > line 34 > Nov 15 12:45:17 mail MailScanner[3227]: Compilation failed in require at > /usr/lib/MailScanner/MailScanner/Config.pm line 760. > Nov 15 12:45:17 mail MailScanner[3227]: ) > Nov 15 12:45:17 mail MailScanner[3227]: Reading configuration file > /etc/MailScanner/MailScanner.conf > ... > > Any suggestions? > > Cheers, > Peter > > > -- > This message has been scanned for viruses and > dangerous content by *MailScanner* <http://www.mailscanner.info/>, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/67d850fc/attachment.html From mailscanner at joolee.nl Thu Nov 17 11:19:10 2011 From: mailscanner at joolee.nl (Joolee) Date: Thu Nov 17 11:20:01 2011 Subject: Very bad score spamassassin In-Reply-To: <aee933e3-12e3-4a18-9d2c-3704d0776d30@cronlabworkstation0> References: <loom.20111117T112243-761@post.gmane.org> <aee933e3-12e3-4a18-9d2c-3704d0776d30@cronlabworkstation0> Message-ID: <CA+Q-w8VVG8uq+webN0_DEQuNkecKUdrMtjCBUx94JUoaYeYY4Q@mail.gmail.com> EXTRA NOTE: This will take very long the first time and Mailscanner can be configured to skip Spamassassin checks during this time or hold all E-mail until finished. If it's a company server, I recommend configuring Mailscanner to hold all E-mails during expiry and starting the task at friday evening. You can run it with "2>&1 > ~/expire.log &" at the end so it redirects all output to ~/expire.log and rund in the background. (you can end your SSH session) (Can someone check this code? I'm not very fluent in output redirection) You could also delete the whole Bayes DB and download a recent copy of someone that does run expiry every now and than :P It is perfectly normal for an E-mail to have a negative score, this just means that the E-mail is definitely not spam. If there are SPAM E-mails that are getting a negative score, you got a problem ;) A spamfilter aims to give all HAM a score as low as possible and all SPAM a score as high as possible. Alle E-mails that hover around the threshold score (usually 6) are unsure and should be checked manually. On 17 November 2011 12:01, Markus Nilsson <markus@markusoft.se> wrote: > Please reply to the previous mail to keep the thread! > > ----- Original Message ----- > > From: "eric le corre" <eric_le_corre@msn.com> > > To: mailscanner@lists.mailscanner.info > > Sent: torsdag, 17 nov 2011 11:31:33 > > Subject: Re: Very bad score spamassassin > > > > Spamassassin configuration is in autolearning. So there has to be > > found in > > spam HAM. > > Occasionally, I learn to SpamAssassin manually. > > > > But this problem has been the case since I installed mailscanner. > > Since the > > beginning I have negative cores. > > > > Do I have to disable the AutoLearn, how? > > No you can keep autolearn, just make sure you manually train those that > fail! > > > > how can your remove the old tokens? > > > > e.g. by running > > sa-learn --force-expire -p /etc/MailScanner/spam.assassin.prefs.conf > > NOTE: This will remove lots of tokens from your Bayes DB, make sure you > have reviewed your settings in the config file first, and make a backup of > the bayes DB if you are unsure you want to do this! > > Specifically check your > > bayes_expiry_max_db_size > > setting > > /Markus > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/909a953c/attachment.html From maxsec at gmail.com Thu Nov 17 16:35:13 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Nov 17 16:35:22 2011 Subject: Very bad score spamassassin In-Reply-To: <CA+Q-w8VVG8uq+webN0_DEQuNkecKUdrMtjCBUx94JUoaYeYY4Q@mail.gmail.com> References: <loom.20111117T112243-761@post.gmane.org> <aee933e3-12e3-4a18-9d2c-3704d0776d30@cronlabworkstation0> <CA+Q-w8VVG8uq+webN0_DEQuNkecKUdrMtjCBUx94JUoaYeYY4Q@mail.gmail.com> Message-ID: <CAGDKorLbXqZCFOPjC-wQASvLN_+Gd0=+tEvgAxLQPWgRTXAvtQ@mail.gmail.com> FYI the "-p /etc/MailScanner/spam.assassin.prefs.conf" hasn't been required for quite a number of years as this file should be a symbolic link to /etc/mail/spassassin/mailscanner.conf (of whereever the SA config files are) -- Martin Hepworth Oxford, UK On 17 November 2011 11:19, Joolee <mailscanner@joolee.nl> wrote: > EXTRA NOTE: This will take very long the first time and Mailscanner can be > configured to skip Spamassassin checks during this time or hold all E-mail > until finished. If it's a company server, I recommend configuring > Mailscanner to hold all E-mails during expiry and starting the task at > friday evening. You can run it with "2>&1 > ~/expire.log &" at the end so > it redirects all output to ~/expire.log and rund in the background. (you > can end your SSH session) (Can someone check this code? I'm not very fluent > in output redirection) > > You could also delete the whole Bayes DB and download a recent copy of > someone that does run expiry every now and than :P > > It is perfectly normal for an E-mail to have a negative score, this just > means that the E-mail is definitely not spam. If there are SPAM E-mails > that are getting a negative score, you got a problem ;) > A spamfilter aims to give all HAM a score as low as possible and all SPAM > a score as high as possible. Alle E-mails that hover around the threshold > score (usually 6) are unsure and should be checked manually. > > > On 17 November 2011 12:01, Markus Nilsson <markus@markusoft.se> wrote: > >> Please reply to the previous mail to keep the thread! >> >> ----- Original Message ----- >> > From: "eric le corre" <eric_le_corre@msn.com> >> > To: mailscanner@lists.mailscanner.info >> > Sent: torsdag, 17 nov 2011 11:31:33 >> > Subject: Re: Very bad score spamassassin >> > >> > Spamassassin configuration is in autolearning. So there has to be >> > found in >> > spam HAM. >> > Occasionally, I learn to SpamAssassin manually. >> > >> > But this problem has been the case since I installed mailscanner. >> > Since the >> > beginning I have negative cores. >> > >> > Do I have to disable the AutoLearn, how? >> >> No you can keep autolearn, just make sure you manually train those that >> fail! >> > >> > how can your remove the old tokens? >> > >> >> e.g. by running >> >> sa-learn --force-expire -p /etc/MailScanner/spam.assassin.prefs.conf >> >> NOTE: This will remove lots of tokens from your Bayes DB, make sure you >> have reviewed your settings in the config file first, and make a backup of >> the bayes DB if you are unsure you want to do this! >> >> Specifically check your >> >> bayes_expiry_max_db_size >> >> setting >> >> /Markus >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/5ce497c6/attachment.html From ssilva at sgvwater.com Thu Nov 17 16:51:22 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Nov 17 16:51:50 2011 Subject: false fraud positives with domain shorteners In-Reply-To: <CA+Q-w8VcEV7jC3xvUoKOxLdMoGWNJ5Y12iVrW5bRXzv-6Y638g@mail.gmail.com> References: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> <21b17ce8afb1b79a17857f8ce3b6de5a.squirrel@mail.fumlersoft.dk> <CA+Q-w8VcEV7jC3xvUoKOxLdMoGWNJ5Y12iVrW5bRXzv-6Y638g@mail.gmail.com> Message-ID: <ja3e2b$eaa$1@dough.gmane.org> on 11/16/2011 1:51 AM Joolee spake the following: > Than, what about stuff like http://youtu.be/Hw2K9SifAXk, other Google > shorteners, shorteners used on twitter (automated mailing systems for tweets > will send the shortened urls) or stuff like http://twk.rs/nj4D which is a > service provided by tweakers.net <http://tweakers.net> and points to > http://tweakers.net/nieuws/78119/. > > It's a bit to much to mark any E-mail that includes a shortened url as spam. I > will give all E-mails containing a shortener a spam score? of +2 but I let > the other URL checkers in SpamAssassin and my plugins decide whether the url > the shortened version points to is malicious. > > But the OP was commenting on the fraud protection components, which was designed to warn about url hiding... Use it, don't use it... It was designed to uncover url hiding in html tags. From ssilva at sgvwater.com Thu Nov 17 16:53:39 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Nov 17 16:55:20 2011 Subject: Emails lost ! In-Reply-To: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> Message-ID: <ja3e6k$eaa$2@dough.gmane.org> on 11/17/2011 1:53 AM eric le corre spake the following: > hello and sorry for my enlish > > > I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner, > postfix 2.8.2 on Ubuntu and MailWatch. > This Server is configured as gateway for my Exchange 2010. > > users complain of not receiving emails. Apparently it's quite often. Users > give me the address of the sender which certifies sending an email. On my > exchange, I have no trace of the mail in question. On Mailscanner either, > MailWatch in the mail does not appear either. In short, nothing a all. What is > even more annoying is that the sender does not receive an e-mail non-delivery. > So emails that are lost. > > Mailscanner in the logs I find nothing wrong. > > If someone could help me find an explanation ..... > > I was wondering, but can be nothing to see there are a mailscanner script that > restarts the service regularly. Are the mails could not be lost just when > mailscanner restarts? possible? > > thanks > > And senders almost ALWAYS swear that they sent something, but when you ask them for proof like log snippets, they suddenly get silent... From jeremy at fluxlabs.net Thu Nov 17 17:00:48 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Thu Nov 17 17:01:35 2011 Subject: Emails lost ! In-Reply-To: <ja3e6k$eaa$2@dough.gmane.org> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> <ja3e6k$eaa$2@dough.gmane.org> Message-ID: <F443F57A-37B5-4707-8CEC-47949354E7C7@fluxlabs.net> Ate you doing any RBLs in postfix? Have you checked the sending domains are not listed and termite being blocked at the MTA level ? -- Jeremy McSpadden On Nov 17, 2011, at 10:59 AM, "Scott Silva" <ssilva@sgvwater.com> wrote: > on 11/17/2011 1:53 AM eric le corre spake the following: >> hello and sorry for my enlish >> >> >> I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner, >> postfix 2.8.2 on Ubuntu and MailWatch. >> This Server is configured as gateway for my Exchange 2010. >> >> users complain of not receiving emails. Apparently it's quite often. Users >> give me the address of the sender which certifies sending an email. On my >> exchange, I have no trace of the mail in question. On Mailscanner either, >> MailWatch in the mail does not appear either. In short, nothing a all. What is >> even more annoying is that the sender does not receive an e-mail non-delivery. >> So emails that are lost. >> >> Mailscanner in the logs I find nothing wrong. >> >> If someone could help me find an explanation ..... >> >> I was wondering, but can be nothing to see there are a mailscanner script that >> restarts the service regularly. Are the mails could not be lost just when >> mailscanner restarts? possible? >> >> thanks >> >> > And senders almost ALWAYS swear that they sent something, but when you ask them for proof like log snippets, they suddenly get silent... > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From uxbod at splatnix.net Thu Nov 17 17:02:10 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Thu Nov 17 17:02:24 2011 Subject: Chinese characters in file names In-Reply-To: <5a4cca9d-cd98-4b4b-9621-b762df465c70@office.splatnix.net> Message-ID: <4b1866b7-2f00-4902-876b-c64dcaac55bc@office.splatnix.net> Am making some progress on this now! Having to override a method in MIME::Parser::Filer called output_path() for it to understand encoded file names. Once I can get my test code to work then it should be fairly easy to implement it in MailScanner by creating a new package; something like MailScanner::Message::OurFiler . Am having to learn new things in Perl which is one good thing :) -- Thanks, Phil ----- Original Message ----- > An issue that I have to resolve in the next week! Getting a grip on > it but it is slow progress. Thoughts Jules ? perhaps we could double > team it ? > -- > Thanks, Phil > ----- Original Message ----- > > On Fri, 2011-11-11 at 11:55 +0000, --[ UxBoD ]-- wrote: > > > > Hi, > > > > > > am working on a project and have encountered an issue where file > > > names that contain Chinese (Simplified) characters are being > > > mangled > > > when processed by MailScanner. An example is when one requires > > > all > > > attachments to be zipped up. When I examine the zipped file it > > > now > > > contains a file called ?????.doc. I have taken a look at the code > > > and believe it is something to do with how > > > > > This added weight to us no longer using mailscanner, apart from the > > constant child exit issues after spam tests, China is one of our > > (AU) neighbours and a very important trade partner, I couldn't > > understand it to save my life, but those who need to, do, and it > > was > > affecting them, this is going back to last year. > > > -- > > > MailScanner mailing list > > > mailscanner@lists.mailscanner.info > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > Before posting, read http://wiki.mailscanner.info/posting > > > Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > Before posting, read http://wiki.mailscanner.info/posting > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/d36885bd/attachment.html From jeremy at fluxlabs.net Thu Nov 17 17:04:42 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Thu Nov 17 17:05:27 2011 Subject: Emails lost ! In-Reply-To: <F443F57A-37B5-4707-8CEC-47949354E7C7@fluxlabs.net> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> <ja3e6k$eaa$2@dough.gmane.org> <F443F57A-37B5-4707-8CEC-47949354E7C7@fluxlabs.net> Message-ID: <8BBEB716-860A-4247-B334-5B3AFF96CE37@fluxlabs.net> Wow.. That was an iPhone autocorrect fail! -- Jeremy McSpadden On Nov 17, 2011, at 11:02 AM, "Jeremy McSpadden" <jeremy@fluxlabs.net> wrote: > Ate you doing any RBLs in postfix? Have you checked the sending domains are not listed and termite being blocked at the MTA level ? > > > -- > Jeremy McSpadden > > On Nov 17, 2011, at 10:59 AM, "Scott Silva" <ssilva@sgvwater.com> wrote: > >> on 11/17/2011 1:53 AM eric le corre spake the following: >>> hello and sorry for my enlish >>> >>> >>> I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner, >>> postfix 2.8.2 on Ubuntu and MailWatch. >>> This Server is configured as gateway for my Exchange 2010. >>> >>> users complain of not receiving emails. Apparently it's quite often. Users >>> give me the address of the sender which certifies sending an email. On my >>> exchange, I have no trace of the mail in question. On Mailscanner either, >>> MailWatch in the mail does not appear either. In short, nothing a all. What is >>> even more annoying is that the sender does not receive an e-mail non-delivery. >>> So emails that are lost. >>> >>> Mailscanner in the logs I find nothing wrong. >>> >>> If someone could help me find an explanation ..... >>> >>> I was wondering, but can be nothing to see there are a mailscanner script that >>> restarts the service regularly. Are the mails could not be lost just when >>> mailscanner restarts? possible? >>> >>> thanks >>> >>> >> And senders almost ALWAYS swear that they sent something, but when you ask them for proof like log snippets, they suddenly get silent... >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From mikea at mikea.ath.cx Thu Nov 17 17:20:42 2011 From: mikea at mikea.ath.cx (Mike Andrews) Date: Thu Nov 17 17:20:53 2011 Subject: Emails lost ! In-Reply-To: <ja3e6k$eaa$2@dough.gmane.org> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> <ja3e6k$eaa$2@dough.gmane.org> Message-ID: <20111117172042.GA13822@mikea.ath.cx> On Thu, Nov 17, 2011 at 08:53:39AM -0800, Scott Silva wrote: > on 11/17/2011 1:53 AM eric le corre spake the following: > >hello and sorry for my enlish > > > > > >I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner, > >postfix 2.8.2 on Ubuntu and MailWatch. > >This Server is configured as gateway for my Exchange 2010. > > > >users complain of not receiving emails. Apparently it's quite often. Users > >give me the address of the sender which certifies sending an email. On my > >exchange, I have no trace of the mail in question. On Mailscanner either, > >MailWatch in the mail does not appear either. In short, nothing a all. > >What is > >even more annoying is that the sender does not receive an e-mail > >non-delivery. > >So emails that are lost. > > > >Mailscanner in the logs I find nothing wrong. > > > >If someone could help me find an explanation ..... > > > >I was wondering, but can be nothing to see there are a mailscanner script > >that > >restarts the service regularly. Are the mails could not be lost just when > >mailscanner restarts? possible? > > > >thanks > > > > > And senders almost ALWAYS swear that they sent something, but when you ask > them for proof like log snippets, they suddenly get silent... In my experience, the problem is almost always caused by a fat-fingered E-mail address. I've never seen MailScanner lose a mail. Now, that being said, if you have some sort of milter running that REJECTs a mail before it gets to the DATA phase, you won't see the headers from that mail, and the log entr(y|ies) can be much harder to track down. I run a milter that does nothing but log CONNECTs, so that I know when a given IP address connected to my inbound filter. -- Mike Andrews, W5EGO mikea@mikea.ath.cx Tired old sysadmin From ssilva at sgvwater.com Thu Nov 17 17:20:56 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Nov 17 17:21:18 2011 Subject: Emails lost ! In-Reply-To: <F443F57A-37B5-4707-8CEC-47949354E7C7@fluxlabs.net> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> <ja3e6k$eaa$2@dough.gmane.org> <F443F57A-37B5-4707-8CEC-47949354E7C7@fluxlabs.net> Message-ID: <ja3fpp$uhq$1@dough.gmane.org> > > On Nov 17, 2011, at 10:59 AM, "Scott Silva"<ssilva@sgvwater.com> wrote: > >> on 11/17/2011 1:53 AM eric le corre spake the following: >>> hello and sorry for my enlish >>> >>> >>> I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner, >>> postfix 2.8.2 on Ubuntu and MailWatch. >>> This Server is configured as gateway for my Exchange 2010. >>> >>> users complain of not receiving emails. Apparently it's quite often. Users >>> give me the address of the sender which certifies sending an email. On my >>> exchange, I have no trace of the mail in question. On Mailscanner either, >>> MailWatch in the mail does not appear either. In short, nothing a all. What is >>> even more annoying is that the sender does not receive an e-mail non-delivery. >>> So emails that are lost. >>> >>> Mailscanner in the logs I find nothing wrong. >>> >>> If someone could help me find an explanation ..... >>> >>> I was wondering, but can be nothing to see there are a mailscanner script that >>> restarts the service regularly. Are the mails could not be lost just when >>> mailscanner restarts? possible? >>> >>> thanks >>> >>> >> And senders almost ALWAYS swear that they sent something, but when you ask them for proof like log snippets, they suddenly get silent... >> > on 11/17/2011 9:00 AM Jeremy McSpadden spake the following: > Ate you doing any RBLs in postfix? Have you checked the sending domains are not listed and termite being blocked at the MTA level ? > > > -- > Jeremy McSpadden That should still leave some form of log entry... From jeremy at fluxlabs.net Thu Nov 17 17:28:13 2011 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Thu Nov 17 17:29:03 2011 Subject: Emails lost ! In-Reply-To: <ja3fpp$uhq$1@dough.gmane.org> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> <ja3e6k$eaa$2@dough.gmane.org> <F443F57A-37B5-4707-8CEC-47949354E7C7@fluxlabs.net> <ja3fpp$uhq$1@dough.gmane.org> Message-ID: <BFE51F46-CB2D-406F-997E-4C15B2FA9A68@fluxlabs.net> Assuming he is grep'n the servers IP. As the email from would not even be logged. -- Jeremy McSpadden On Nov 17, 2011, at 11:26 AM, "Scott Silva" <ssilva@sgvwater.com> wrote: >> >> On Nov 17, 2011, at 10:59 AM, "Scott Silva"<ssilva@sgvwater.com> wrote: >> >>> on 11/17/2011 1:53 AM eric le corre spake the following: >>>> hello and sorry for my enlish >>>> >>>> >>>> I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner, >>>> postfix 2.8.2 on Ubuntu and MailWatch. >>>> This Server is configured as gateway for my Exchange 2010. >>>> >>>> users complain of not receiving emails. Apparently it's quite often. Users >>>> give me the address of the sender which certifies sending an email. On my >>>> exchange, I have no trace of the mail in question. On Mailscanner either, >>>> MailWatch in the mail does not appear either. In short, nothing a all. What is >>>> even more annoying is that the sender does not receive an e-mail non-delivery. >>>> So emails that are lost. >>>> >>>> Mailscanner in the logs I find nothing wrong. >>>> >>>> If someone could help me find an explanation ..... >>>> >>>> I was wondering, but can be nothing to see there are a mailscanner script that >>>> restarts the service regularly. Are the mails could not be lost just when >>>> mailscanner restarts? possible? >>>> >>>> thanks >>>> >>>> >>> And senders almost ALWAYS swear that they sent something, but when you ask them for proof like log snippets, they suddenly get silent... >>> >> on 11/17/2011 9:00 AM Jeremy McSpadden spake the following: >> Ate you doing any RBLs in postfix? Have you checked the sending domains are not listed and termite being blocked at the MTA level ? >> >> >> -- >> Jeremy McSpadden > > That should still leave some form of log entry... > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From mailscanner at joolee.nl Thu Nov 17 19:41:15 2011 From: mailscanner at joolee.nl (Joolee) Date: Thu Nov 17 19:42:05 2011 Subject: false fraud positives with domain shorteners In-Reply-To: <ja3e2b$eaa$1@dough.gmane.org> References: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> <21b17ce8afb1b79a17857f8ce3b6de5a.squirrel@mail.fumlersoft.dk> <CA+Q-w8VcEV7jC3xvUoKOxLdMoGWNJ5Y12iVrW5bRXzv-6Y638g@mail.gmail.com> <ja3e2b$eaa$1@dough.gmane.org> Message-ID: <CA+Q-w8U_WGcq3WyQCqD7NmdiKR7re2BJdRnodmTKj7QzSd8XaQ@mail.gmail.com> My problem was that it activated on stuff like groupon mails containing something like: <a href="http://groupon.com/action/blaaa">Print your photos with makeyourownphotoalbum.com!</a> To counter the removal of the url hiding protection, I've added a few filters to SpamAssassin to add high scores for stuff like <a href="http:// ...">https://...</a> or <a href="http://.....html/.php">bank-name or website</a> (Got only 4 big banks that are used for phishing.) I think I've contacted the mailinglist before for that problem but the the answer was, as it almost always is, that all misbehaviour is "by design" and "should not be changed". On 17 November 2011 17:51, Scott Silva <ssilva@sgvwater.com> wrote: > on 11/16/2011 1:51 AM Joolee spake the following: > >> Than, what about stuff like http://youtu.be/Hw2K9SifAXk, other Google >> shorteners, shorteners used on twitter (automated mailing systems for >> tweets >> will send the shortened urls) or stuff like http://twk.rs/nj4D which is a >> service provided by tweakers.net <http://tweakers.net> and points to >> >> http://tweakers.net/nieuws/**78119/ <http://tweakers.net/nieuws/78119/>. >> >> It's a bit to much to mark any E-mail that includes a shortened url as >> spam. I >> will give all E-mails containing a shortener a spam score? of +2 but I >> let >> >> the other URL checkers in SpamAssassin and my plugins decide whether the >> url >> the shortened version points to is malicious. >> >> >> But the OP was commenting on the fraud protection components, which was > designed to warn about url hiding... Use it, don't use it... It was > designed to uncover url hiding in html tags. > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info <mailscanner@lists.mailscanner.info> > http://lists.mailscanner.info/**mailman/listinfo/mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner> > > Before posting, read http://wiki.mailscanner.info/**posting<http://wiki.mailscanner.info/posting> > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/8e2ac7c3/attachment.html From ssilva at sgvwater.com Thu Nov 17 21:57:48 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Nov 17 21:58:12 2011 Subject: false fraud positives with domain shorteners In-Reply-To: <CA+Q-w8U_WGcq3WyQCqD7NmdiKR7re2BJdRnodmTKj7QzSd8XaQ@mail.gmail.com> References: <CAKf3qpgjNO1WQANqfb7XaFbdgWaBBpusKZUxuv-DhzcE_5RouQ@mail.gmail.com> <21b17ce8afb1b79a17857f8ce3b6de5a.squirrel@mail.fumlersoft.dk> <CA+Q-w8VcEV7jC3xvUoKOxLdMoGWNJ5Y12iVrW5bRXzv-6Y638g@mail.gmail.com> <ja3e2b$eaa$1@dough.gmane.org> <CA+Q-w8U_WGcq3WyQCqD7NmdiKR7re2BJdRnodmTKj7QzSd8XaQ@mail.gmail.com> Message-ID: <ja400s$2c7$1@dough.gmane.org> on 11/17/2011 11:41 AM Joolee spake the following: > My problem was that it activated on stuff like groupon mails containing > something like: <a href="http://groupon.com/action/blaaa">Print your photos > with makeyourownphotoalbum.com <http://makeyourownphotoalbum.com>!</a> > To counter the removal of the url hiding protection, I've added a few filters > to SpamAssassin to add high scores for stuff like <a > href="http://...">https://...</a> or <a href="http://.....html/.php">bank-name > or website</a> (Got only 4 big banks that are used for phishing.) > > I think I've contacted the mailinglist before for that problem but the the > answer was, as it almost always is, that all misbehaviour is "by design" and > "should not be changed". > I never said it shouldn't be changed, I just said it was doing what it was designed for... If you want to code and test changes, Julian would probably look at them when he is free From uxbod at splatnix.net Thu Nov 17 22:06:44 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Thu Nov 17 22:07:01 2011 Subject: Chinese characters in file names In-Reply-To: <4b1866b7-2f00-4902-876b-c64dcaac55bc@office.splatnix.net> Message-ID: <a2b0fe22-e4f2-4769-a0a0-fc0598b66157@office.splatnix.net> Almost there now. MailScanner currently would extract as the files as: [uxbod@gateway mime]# ls -l extracted/ total 56 -rw-r--r-- 1 uxbod uxbod 25 Nov 17 22:03 1 -rw-r--r-- 1 uxbod uxbod 25 Nov 17 22:03 1-1 -rw-r--r-- 1 uxbod uxbod 3556 Nov 17 22:03 image001.gif -rw-r--r-- 1 uxbod uxbod 6163 Nov 17 22:03 image002.jpg -rw-r--r-- 1 uxbod uxbod 1416 Nov 17 22:03 msg-27353-1.txt -rw-r--r-- 1 uxbod uxbod 29271 Nov 17 22:03 msg-27353-2.html now I have extend the code to generate the extracted files as: uxbod@gateway mime]# ls -l extracted/ total 56 -rw-r--r-- 1 uxbod uxbod 25 Nov 17 21:51 360????O?y-12-01-Chi Trad.txt -rw-r--r-- 1 uxbod uxbod 25 Nov 17 21:51 360????-12-01-Chi Simp.txt -rw-r--r-- 1 uxbod uxbod 3556 Nov 17 21:51 image001.gif -rw-r--r-- 1 uxbod uxbod 6163 Nov 17 21:51 image002.jpg -rw-r--r-- 1 uxbod uxbod 1416 Nov 17 21:51 msg-26828-1.txt -rw-r--r-- 1 uxbod uxbod 29271 Nov 17 21:51 msg-26828-2.html -- Thanks, Phil ----- Original Message ----- > Am making some progress on this now! Having to override a method in > MIME::Parser::Filer called output_path() for it to understand > encoded file names. Once I can get my test code to work then it > should be fairly easy to implement it in MailScanner by creating a > new package; something like MailScanner::Message::OurFiler. > Am having to learn new things in Perl which is one good thing :) > -- > Thanks, Phil > ----- Original Message ----- > > An issue that I have to resolve in the next week! Getting a grip on > > it but it is slow progress. Thoughts Jules ? perhaps we could > > double > > team it ? > > > -- > > > Thanks, Phil > > > ----- Original Message ----- > > > > On Fri, 2011-11-11 at 11:55 +0000, --[ UxBoD ]-- wrote: > > > > > > > Hi, > > > > > > > > > > am working on a project and have encountered an issue where > > > > file > > > > names that contain Chinese (Simplified) characters are being > > > > mangled > > > > when processed by MailScanner. An example is when one requires > > > > all > > > > attachments to be zipped up. When I examine the zipped file it > > > > now > > > > contains a file called ?????.doc. I have taken a look at the > > > > code > > > > and believe it is something to do with how > > > > > > > > > This added weight to us no longer using mailscanner, apart from > > > the > > > constant child exit issues after spam tests, China is one of our > > > (AU) neighbours and a very important trade partner, I couldn't > > > understand it to save my life, but those who need to, do, and it > > > was > > > affecting them, this is going back to last year. > > > > > > -- > > > > > > MailScanner mailing list > > > > > > mailscanner@lists.mailscanner.info > > > > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > > > Support MailScanner development - buy the book off the website! > > > > > -- > > > MailScanner mailing list > > > mailscanner@lists.mailscanner.info > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > Before posting, read http://wiki.mailscanner.info/posting > > > Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > Before posting, read http://wiki.mailscanner.info/posting > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/17e1bd2e/attachment.html From uxbod at splatnix.net Thu Nov 17 22:21:23 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Thu Nov 17 22:21:38 2011 Subject: Chinese characters in file names In-Reply-To: <a2b0fe22-e4f2-4769-a0a0-fc0598b66157@office.splatnix.net> Message-ID: <f7231302-50d6-42bd-9393-bb238b141740@office.splatnix.net> Argh! package MIME::Parser::MailScanner already exists so I just need to add the necessary code to that! :) Tired eyes so better to start coding that in the morning. -- Thanks, Phil ----- Original Message ----- > Almost there now. MailScanner currently would extract as the files > as: > [uxbod@gateway mime]# ls -l extracted/ > total 56 > -rw-r--r-- 1 uxbod uxbod 25 Nov 17 22:03 1 > -rw-r--r-- 1 uxbod uxbod 25 Nov 17 22:03 1-1 > -rw-r--r-- 1 uxbod uxbod 3556 Nov 17 22:03 image001.gif > -rw-r--r-- 1 uxbod uxbod 6163 Nov 17 22:03 image002.jpg > -rw-r--r-- 1 uxbod uxbod 1416 Nov 17 22:03 msg-27353-1.txt > -rw-r--r-- 1 uxbod uxbod 29271 Nov 17 22:03 msg-27353-2.html > now I have extend the code to generate the extracted files as: > uxbod@gateway mime]# ls -l extracted/ > total 56 > -rw-r--r-- 1 uxbod uxbod 25 Nov 17 21:51 360????O?y-12-01-Chi > Trad.txt > -rw-r--r-- 1 uxbod uxbod 25 Nov 17 21:51 360????-12-01-Chi Simp.txt > -rw-r--r-- 1 uxbod uxbod 3556 Nov 17 21:51 image001.gif > -rw-r--r-- 1 uxbod uxbod 6163 Nov 17 21:51 image002.jpg > -rw-r--r-- 1 uxbod uxbod 1416 Nov 17 21:51 msg-26828-1.txt > -rw-r--r-- 1 uxbod uxbod 29271 Nov 17 21:51 msg-26828-2.html > -- > Thanks, Phil > ----- Original Message ----- > > Am making some progress on this now! Having to override a method in > > MIME::Parser::Filer called output_path() for it to understand > > encoded file names. Once I can get my test code to work then it > > should be fairly easy to implement it in MailScanner by creating a > > new package; something like MailScanner::Message::OurFiler. > > > Am having to learn new things in Perl which is one good thing :) > > > -- > > > Thanks, Phil > > > ----- Original Message ----- > > > > An issue that I have to resolve in the next week! Getting a grip > > > on > > > it but it is slow progress. Thoughts Jules ? perhaps we could > > > double > > > team it ? > > > > > > -- > > > > > > Thanks, Phil > > > > > > ----- Original Message ----- > > > > > > > On Fri, 2011-11-11 at 11:55 +0000, --[ UxBoD ]-- wrote: > > > > > > > > > > > Hi, > > > > > > > > > > > > > > > am working on a project and have encountered an issue where > > > > > file > > > > > names that contain Chinese (Simplified) characters are being > > > > > mangled > > > > > when processed by MailScanner. An example is when one > > > > > requires > > > > > all > > > > > attachments to be zipped up. When I examine the zipped file > > > > > it > > > > > now > > > > > contains a file called ?????.doc. I have taken a look at the > > > > > code > > > > > and believe it is something to do with how > > > > > > > > > > > > > > This added weight to us no longer using mailscanner, apart from > > > > the > > > > constant child exit issues after spam tests, China is one of > > > > our > > > > (AU) neighbours and a very important trade partner, I couldn't > > > > understand it to save my life, but those who need to, do, and > > > > it > > > > was > > > > affecting them, this is going back to last year. > > > > > > > > > > -- > > > > > > > > > > MailScanner mailing list > > > > > > > > > > mailscanner@lists.mailscanner.info > > > > > > > > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > > > > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > -- > > > > > > MailScanner mailing list > > > > > > mailscanner@lists.mailscanner.info > > > > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > > > Support MailScanner development - buy the book off the website! > > > > > -- > > > MailScanner mailing list > > > mailscanner@lists.mailscanner.info > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > Before posting, read http://wiki.mailscanner.info/posting > > > Support MailScanner development - buy the book off the website! > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > Before posting, read http://wiki.mailscanner.info/posting > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111117/cc40300f/attachment.html From eric_le_corre at msn.com Fri Nov 18 10:41:09 2011 From: eric_le_corre at msn.com (eric le corre) Date: Fri Nov 18 10:41:36 2011 Subject: Emails lost ! References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> <ja3e6k$eaa$2@dough.gmane.org> <20111117172042.GA13822@mikea.ath.cx> Message-ID: <loom.20111118T113051-642@post.gmane.org> Mike Andrews <mikea <at> mikea.ath.cx> writes: > > On Thu, Nov 17, 2011 at 08:53:39AM -0800, Scott Silva wrote: > > on 11/17/2011 1:53 AM eric le corre spake the following: > > >hello and sorry for my enlish > > > > > > > > >I Have some trouble. I Have SpamAssassin version 3.3.1, 4.83.5 mailscanner, > > >postfix 2.8.2 on Ubuntu and MailWatch. > > >This Server is configured as gateway for my Exchange 2010. > > > > > >users complain of not receiving emails. Apparently it's quite often. Users > > >give me the address of the sender which certifies sending an email. On my > > >exchange, I have no trace of the mail in question. On Mailscanner either, > > >MailWatch in the mail does not appear either. In short, nothing a all. > > >What is > > >even more annoying is that the sender does not receive an e-mail > > >non-delivery. > > >So emails that are lost. > > > > > >Mailscanner in the logs I find nothing wrong. > > > > > >If someone could help me find an explanation ..... > > > > > >I was wondering, but can be nothing to see there are a mailscanner script > > >that > > >restarts the service regularly. Are the mails could not be lost just when > > >mailscanner restarts? possible? > > > > > >thanks > > > > > > > > And senders almost ALWAYS swear that they sent something, but when you ask > > them for proof like log snippets, they suddenly get silent... > > In my experience, the problem is almost always caused by a fat-fingered > E-mail address. I've never seen MailScanner lose a mail. Now, that being > said, if you have some sort of milter running that REJECTs a mail before it > gets to the DATA phase, you won't see the headers from that mail, and the > log entr(y|ies) can be much harder to track down. I run a milter that does > nothing but log CONNECTs, so that I know when a given IP address connected > to my inbound filter. > Hello and thanks for help. It is difficult to me to understand english language, my breton language is better :-) In postfix, i dont use Blacklist, just in mailscanner. Postfix is configure like this : myhostname = mailhost.domain.fr myorigin = domain.fr mydomain = domain.fr alias_maps = hash:/etc/aliases mydestination = #mynetwork_style = host relay_recipient_maps = hash:/etc/postfix/relay_recipients transport_maps = hash:/etc/postfix/transport relay_domains = $transport_maps append_at_myorigin = yes local_recipient_maps = header_checks = regexp:/etc/postfix/header_checks #relayhost = mynetworks = 127.0.0.0/8 172.31.0.0/16 10.131.0.0/16 10 10.4.0.0/16 mailbox_size_limit = 0 message_size_limit = 0 recipient_delimiter = + inet_interfaces = all smtpd_client_connection_count_limit = 0 smtpd_client_connection_rate_limit = 0 what is surprising is that such an e-mail never arrived, apparently the sender has sent the same mail that is spent. "Assuming he is grep'n the servers IP. As the email from would not even be logged. " The problem is that we have a email gateway from our provider, so all emails come from the same IP "That should still leave some form of log entry..." Maybe but users say "i don t receive email" but i dont know the hour, difficult to find something ! From eric_le_corre at msn.com Fri Nov 18 13:11:44 2011 From: eric_le_corre at msn.com (eric le corre) Date: Fri Nov 18 13:12:09 2011 Subject: Very bad score spamassassin References: <DUB110-W90ABD0F20B0B99899FC944B8C70@phx.gbl> <ace70ff8-4ff0-4bd3-b834-967fbfed6f88@cronlabworkstation0> <loom.20111117T112243-761@post.gmane.org> <CAGDKorLb1s0_=UOiji_QWPJ2JZ3ThAMo3PWTc3CqSc7TFzvWCA@mail.gmail.com> Message-ID: <loom.20111118T140421-544@post.gmane.org> Martin Hepworth <maxsec <at> gmail.com> writes: > > > yes disable auto learn by commenting out the plugin in one of? the /usr/local/spamassassin/*.cf filesyou need to know WHAT spamassassin rule is dragging the score down, you should be able to see this in Mailwatch or alter the following settings in MailWatch.conf and you'll get more info in the email headers to help diagnose.. > > Spam Score Number Format = %5.2f > > > > Detailed Spam Report = yes > > > > Include Scores In SpamAssassin Report = yes > > > > Always Include SpamAssassin Report = yes > > > > Spam Score Number Format = %5.2f > > -- Martin HepworthOxford, UKOn 17 November 2011 10:31, eric le corre <eric_le_corre <at> msn.com> wrote: > Spamassassin configuration is in autolearning. So there has to be found in > spam HAM. > ?Occasionally, I learn to SpamAssassin manually. > ?But this problem has been the case since I installed mailscanner. Since the > beginning I have negative cores. > ?Do I have to disable the AutoLearn, how? > ?how can your remove the old tokens? > ? > -- > MailScanner mailing listmailscanner <at> lists.mailscanner.infohttp://lists.mailscanner.info/mailman/listinfo/mailscanne r > Before posting, read http://wiki.mailscanner.info/posting > Support MailScanner development - buy the book off the website! > for example, example of spam that is not considered as spam by spamassasin with score 4.90 in spam report, i can see : cached not score=4.904 5 requis 3.50 BAYES_99 Bayes spam probability is 99 to 100% 0.00 FROM_12LTRDOM 1.39 HTML_COMMENT_SAVED_URL HTML message is a saved web page 0.00 HTML_MESSAGE HTML included in message 0.00 SPF_FAIL SPF: sender does not match SPF record (fail) 0.01 T_KHOP_FOREIGN_CLICK an other one : cached not score=1.58 5 requis 0.80 BAYES_50 Bayes spam probability is 40 to 60% 0.10 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.10 DKIM_VALID Message has at least one valid DKIM or DK signature 0.00 HTML_MESSAGE HTML included in message 0.78 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) thanks From markus at markusoft.se Fri Nov 18 14:34:25 2011 From: markus at markusoft.se (Markus Nilsson) Date: Fri Nov 18 14:34:41 2011 Subject: Very bad score spamassassin In-Reply-To: <loom.20111118T140421-544@post.gmane.org> Message-ID: <7f73e08b-9f84-419f-865f-28bc4eaeefd1@cronlabworkstation0> > > Martin Hepworth <maxsec <at> gmail.com> writes: > > > > > > > yes disable auto learn by commenting out the plugin in one of > the /usr/local/spamassassin/*.cf filesyou need to know WHAT > spamassassin rule > is dragging the score down, you should be able to see this in > Mailwatch or > alter the following settings in MailWatch.conf and you'll get more > info in the > email headers to help diagnose.. > > > > Spam Score Number Format = %5.2f > > > > > > > > Detailed Spam Report = yes > > > > > > > > Include Scores In SpamAssassin Report = yes > > > > > > > > Always Include SpamAssassin Report = yes > > > > > > > > Spam Score Number Format = %5.2f > > > > -- Martin HepworthOxford, UKOn 17 November 2011 10:31, eric le > > corre > <eric_le_corre <at> msn.com> wrote: > > Spamassassin configuration is in autolearning. So there has to be > > found in > > spam HAM. > > ?Occasionally, I learn to SpamAssassin manually. > > ?But this problem has been the case since I installed mailscanner. > > ?Since the > > beginning I have negative cores. > > ?Do I have to disable the AutoLearn, how? > > ?how can your remove the old tokens? > > ? > > -- > > MailScanner mailing listmailscanner <at> > lists.mailscanner.infohttp://lists.mailscanner.info/mailman/listinfo/mailscanne > r > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > > for example, example of spam that is not considered as spam by > spamassasin > with score 4.90 > in spam report, i can see : > > cached not > score=4.904 > 5 requis > 3.50 BAYES_99 Bayes spam probability is 99 to 100% > 0.00 FROM_12LTRDOM > 1.39 HTML_COMMENT_SAVED_URL HTML message is a saved web page > 0.00 HTML_MESSAGE HTML included in message > 0.00 SPF_FAIL SPF: sender does not match SPF record (fail) > 0.01 T_KHOP_FOREIGN_CLICK > > an other one : > cached not > score=1.58 > 5 requis > 0.80 BAYES_50 Bayes spam probability is 40 to 60% > 0.10 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily > valid > -0.10 DKIM_VALID Message has at least one valid DKIM or DK signature > 0.00 HTML_MESSAGE HTML included in message > 0.78 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) > > > thanks > Did I understand correctly if all your mail come from the same IP? Then your rbl-checks might not work in SpamAssassin/MailScanner, since you are not seeing the correct IP. If this is wrongly setup, your RBL-checks will check the wrong IP, and your SPF checks will fail. You could try adding this header to your spamassassin config: add_header all RelaysUntrusted _RELAYSUNTRUSTED_ Then you will get a header in all mails showing which IP is used for RBL and SPF checks. Make sure this IP is not your provider's (which is the same for all mail). The header will look like this: X-Spam-!RelaysUntrusted: [ ip=140.211.11.3 rdns=hermes.apache.org.... Read more here: http://wiki.apache.org/spamassassin/TrustPath Also, this is more a SpamAssassin issue than MailScanner, so you might get even more help on that mailing list! /Markus From campbell at cnpapers.com Fri Nov 18 14:43:51 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Nov 18 14:43:47 2011 Subject: Clamd permission error Message-ID: <4EC66F27.9020005@cnpapers.com> I'm getting the following error in my logs: Clamd::ERROR:: lstat() failed: Permission denied. ERRORClamd::ERROR:: lstat() failed: Permission denied...... Looking back, I found a thread suggesting I should switch to the internal tnef expander, which I am trying now, and to ensure the "incoming" directory is accessible by the clam user (clamav). I've followed the suggestions in the MailScanner.conf file for the situation I am running under. The temp folders under the incoming directory, along with the incoming folder itself, where the winmail.dat is expanded IS owned by clamav. So I'm wondering if the 0640 mod on the folders is the proper mod. Should there be any sticky bits or anything set? Just curious, since this seems to be the first time I've run into this and I've been using MS for years. steve campbell From mailscanner at joolee.nl Fri Nov 18 14:52:32 2011 From: mailscanner at joolee.nl (Joolee) Date: Fri Nov 18 14:53:22 2011 Subject: Clamd permission error In-Reply-To: <4EC66F27.9020005@cnpapers.com> References: <4EC66F27.9020005@cnpapers.com> Message-ID: <CA+Q-w8WL_o75i_WK-bifeXixGRZAR0CyiX730KcRVRppgoGgRQ@mail.gmail.com> I saw in the changelogs that an update of Mailscanner can solve the problem but an update of Ubuntu 9 > 10 and with that updated perl and clamd solved the problem for me. On 18 November 2011 15:43, Steve Campbell <campbell@cnpapers.com> wrote: > I'm getting the following error in my logs: > > Clamd::ERROR:: lstat() failed: Permission denied. ERRORClamd::ERROR:: > lstat() failed: Permission denied...... > > Looking back, I found a thread suggesting I should switch to the internal > tnef expander, which I am trying now, and to ensure the "incoming" > directory is accessible by the clam user (clamav). I've followed the > suggestions in the MailScanner.conf file for the situation I am running > under. The temp folders under the incoming directory, along with the > incoming folder itself, where the winmail.dat is expanded IS owned by > clamav. > > So I'm wondering if the 0640 mod on the folders is the proper mod. Should > there be any sticky bits or anything set? > > Just curious, since this seems to be the first time I've run into this and > I've been using MS for years. > > steve campbell > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info <mailscanner@lists.mailscanner.info> > http://lists.mailscanner.info/**mailman/listinfo/mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner> > > Before posting, read http://wiki.mailscanner.info/**posting<http://wiki.mailscanner.info/posting> > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/bb0e5ab7/attachment.html From mikoletic at gmail.com Fri Nov 18 14:53:33 2011 From: mikoletic at gmail.com (Milenko Letic) Date: Fri Nov 18 14:53:44 2011 Subject: Clamd permission error In-Reply-To: <4EC66F27.9020005@cnpapers.com> References: <4EC66F27.9020005@cnpapers.com> Message-ID: <CALN_k4oB1EKZ5VrEuHN5mhFwZEXbKWbSVy2MUoyaGRn1ufCeTw@mail.gmail.com> this is mod in my MailScanner.conf : Incoming Work Permissions = 0644 maybe , maybe not help, but wish you luck On Fri, Nov 18, 2011 at 3:43 PM, Steve Campbell <campbell@cnpapers.com>wrote: > I'm getting the following error in my logs: > > Clamd::ERROR:: lstat() failed: Permission denied. ERRORClamd::ERROR:: > lstat() failed: Permission denied...... > > Looking back, I found a thread suggesting I should switch to the internal > tnef expander, which I am trying now, and to ensure the "incoming" > directory is accessible by the clam user (clamav). I've followed the > suggestions in the MailScanner.conf file for the situation I am running > under. The temp folders under the incoming directory, along with the > incoming folder itself, where the winmail.dat is expanded IS owned by > clamav. > > So I'm wondering if the 0640 mod on the folders is the proper mod. Should > there be any sticky bits or anything set? > > Just curious, since this seems to be the first time I've run into this and > I've been using MS for years. > > steve campbell > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info <mailscanner@lists.mailscanner.info> > http://lists.mailscanner.info/**mailman/listinfo/mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner> > > Before posting, read http://wiki.mailscanner.info/**posting<http://wiki.mailscanner.info/posting> > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/997be908/attachment.html From uxbod at splatnix.net Fri Nov 18 15:03:20 2011 From: uxbod at splatnix.net (--[ UxBoD ]--) Date: Fri Nov 18 15:03:33 2011 Subject: Chinese characters in file names In-Reply-To: <1321059188.6362.7.camel@tardis> Message-ID: <8c969336-5692-4bbe-84dd-1b372d7f3235@office.splatnix.net> After a lot of head scratching it would appear I have it working quite nicely now: uxbod@cyborg ~/Downloads/zip $ ls -l total 88 -rw-r--r-- 1 uxbod uxbod 25 2011-11-18 14:55 360????-12-01-Chi Trad.txt -rw-r--r-- 1 uxbod uxbod 25 2011-11-18 14:55 360????-12-01-Chi Simp.txt -rw-r--r-- 1 uxbod uxbod 10263 2011-11-18 15:01 MessageAttachments.zip -- Thanks, Phil ----- Original Message ----- > On Fri, 2011-11-11 at 11:55 +0000, --[ UxBoD ]-- wrote: > > Hi, > > > am working on a project and have encountered an issue where file > > names that contain Chinese (Simplified) characters are being > > mangled > > when processed by MailScanner. An example is when one requires all > > attachments to be zipped up. When I examine the zipped file it now > > contains a file called ?????.doc. I have taken a look at the code > > and believe it is something to do with how > > This added weight to us no longer using mailscanner, apart from the > constant child exit issues after spam tests, China is one of our > (AU) neighbours and a very important trade partner, I couldn't > understand it to save my life, but those who need to, do, and it was > affecting them, this is going back to last year. > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > Before posting, read http://wiki.mailscanner.info/posting > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/fd23cce7/attachment.html From eric_le_corre at msn.com Fri Nov 18 15:22:22 2011 From: eric_le_corre at msn.com (eric le corre) Date: Fri Nov 18 15:22:53 2011 Subject: Very bad score spamassassin References: <loom.20111118T140421-544@post.gmane.org> <7f73e08b-9f84-419f-865f-28bc4eaeefd1@cronlabworkstation0> Message-ID: <loom.20111118T162200-681@post.gmane.org> > Did I understand correctly if all your mail come from the same IP? Then your rbl-checks might not work in > SpamAssassin/MailScanner, since you are not seeing the correct IP. > > If this is wrongly setup, your RBL-checks will check the wrong IP, and your SPF checks will fail. You could > try adding this header to your spamassassin config: > > add_header all RelaysUntrusted _RELAYSUNTRUSTED_ > > Then you will get a header in all mails showing which IP is used for RBL and SPF checks. Make sure this IP is not > your provider's (which is the same for all mail). > > The header will look like this: > X-Spam-!RelaysUntrusted: [ ip=140.211.11.3 rdns=hermes.apache.org.... > > Read more here: > http://wiki.apache.org/spamassassin/TrustPath > > Also, this is more a SpamAssassin issue than MailScanner, so you might get even more help on that mailing list! > > /Markus Did I understand correctly if all your mail come from the same IP? yes, it is that ! all from the same IP add_header all RelaysUntrusted _RELAYSUNTRUSTED_ i have to put that in local.cf ? thanks From markus at markusoft.se Fri Nov 18 15:33:25 2011 From: markus at markusoft.se (Markus Nilsson) Date: Fri Nov 18 15:33:41 2011 Subject: Very bad score spamassassin In-Reply-To: <loom.20111118T162200-681@post.gmane.org> Message-ID: <3d2d1e00-fc79-428e-929a-cf334844bdc5@cronlabworkstation0> > > Did I understand correctly if all your mail come from the same IP? > > Then your > rbl-checks might not work in > > SpamAssassin/MailScanner, since you are not seeing the correct IP. > > > > If this is wrongly setup, your RBL-checks will check the wrong IP, > > and your > SPF checks will fail. You could > > try adding this header to your spamassassin config: > > > > add_header all RelaysUntrusted _RELAYSUNTRUSTED_ > > > > Then you will get a header in all mails showing which IP is used > > for RBL and > SPF checks. Make sure this IP is not > > your provider's (which is the same for all mail). > > > > The header will look like this: > > X-Spam-!RelaysUntrusted: [ ip=140.211.11.3 > > rdns=hermes.apache.org.... > > > > Read more here: > > http://wiki.apache.org/spamassassin/TrustPath > > > > Also, this is more a SpamAssassin issue than MailScanner, so you > > might get > even more help on that mailing list! > > > > /Markus > > > Did I understand correctly if all your mail come from the same IP? > yes, it is that ! all from the same IP > > add_header all RelaysUntrusted _RELAYSUNTRUSTED_ > i have to put that in local.cf ? > yes! From eric_le_corre at msn.com Fri Nov 18 15:34:06 2011 From: eric_le_corre at msn.com (eric le corre) Date: Fri Nov 18 15:34:28 2011 Subject: Very bad score spamassassin References: <loom.20111118T140421-544@post.gmane.org> <7f73e08b-9f84-419f-865f-28bc4eaeefd1@cronlabworkstation0> <loom.20111118T162200-681@post.gmane.org> Message-ID: <loom.20111118T163152-30@post.gmane.org> > Did I understand correctly if all your mail come from the same IP? > yes, it is that ! all from the same IP > > add_header all RelaysUntrusted _RELAYSUNTRUSTED_ > i have to put that in local.cf ? > maybe i have to put in local.cf IP of my mail provider like this : trusted_networks 62.62.128.91 From maxsec at gmail.com Fri Nov 18 16:07:47 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Nov 18 16:07:57 2011 Subject: Clamd permission error In-Reply-To: <CALN_k4oB1EKZ5VrEuHN5mhFwZEXbKWbSVy2MUoyaGRn1ufCeTw@mail.gmail.com> References: <4EC66F27.9020005@cnpapers.com> <CALN_k4oB1EKZ5VrEuHN5mhFwZEXbKWbSVy2MUoyaGRn1ufCeTw@mail.gmail.com> Message-ID: <CAGDKorJM1ZdpXp1PzjSB=v3_HDfeDV_jqobX7VKhW0i+UJNHUg@mail.gmail.com> yes you need to look carefully at the mailscanner.conf settings for permssions etc. Theres good documentation in the file about running clamdd and the things you need to setup -- Martin Hepworth Oxford, UK On 18 November 2011 14:53, Milenko Letic <mikoletic@gmail.com> wrote: > this is mod in my MailScanner.conf : > Incoming Work Permissions = 0644 > > maybe , maybe not help, but wish you luck > > On Fri, Nov 18, 2011 at 3:43 PM, Steve Campbell <campbell@cnpapers.com>wrote: > >> I'm getting the following error in my logs: >> >> Clamd::ERROR:: lstat() failed: Permission denied. ERRORClamd::ERROR:: >> lstat() failed: Permission denied...... >> >> Looking back, I found a thread suggesting I should switch to the internal >> tnef expander, which I am trying now, and to ensure the "incoming" >> directory is accessible by the clam user (clamav). I've followed the >> suggestions in the MailScanner.conf file for the situation I am running >> under. The temp folders under the incoming directory, along with the >> incoming folder itself, where the winmail.dat is expanded IS owned by >> clamav. >> >> So I'm wondering if the 0640 mod on the folders is the proper mod. Should >> there be any sticky bits or anything set? >> >> Just curious, since this seems to be the first time I've run into this >> and I've been using MS for years. >> >> steve campbell >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.**info <mailscanner@lists.mailscanner.info> >> http://lists.mailscanner.info/**mailman/listinfo/mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner> >> >> Before posting, read http://wiki.mailscanner.info/**posting<http://wiki.mailscanner.info/posting> >> >> Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/ed5ab243/attachment.html From maxsec at gmail.com Fri Nov 18 16:13:03 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Nov 18 16:13:11 2011 Subject: Very bad score spamassassin In-Reply-To: <loom.20111118T140421-544@post.gmane.org> References: <DUB110-W90ABD0F20B0B99899FC944B8C70@phx.gbl> <ace70ff8-4ff0-4bd3-b834-967fbfed6f88@cronlabworkstation0> <loom.20111117T112243-761@post.gmane.org> <CAGDKorLb1s0_=UOiji_QWPJ2JZ3ThAMo3PWTc3CqSc7TFzvWCA@mail.gmail.com> <loom.20111118T140421-544@post.gmane.org> Message-ID: <CAGDKorL6i5jiAZJF=jh7Vv5mF8fMdYo1W9H0r-AdnPFfHQjZqg@mail.gmail.com> and you're running stock spamassassin rules with no alterations? and running sa-update at least once per day? I'd turn on a couple of RBL's (zen and spamcop are useful), enable the rbl's and make sure all but the ones you want are given a zero score in local.cf and they won't run. -- Martin Hepworth Oxford, UK On 18 November 2011 13:11, eric le corre <eric_le_corre@msn.com> wrote: > Martin Hepworth <maxsec <at> gmail.com> writes: > > > > > > > yes disable auto learn by commenting out the plugin in one of > the /usr/local/spamassassin/*.cf filesyou need to know WHAT spamassassin > rule > is dragging the score down, you should be able to see this in Mailwatch or > alter the following settings in MailWatch.conf and you'll get more info in > the > email headers to help diagnose.. > > > > Spam Score Number Format = %5.2f > > > > > > > > Detailed Spam Report = yes > > > > > > > > Include Scores In SpamAssassin Report = yes > > > > > > > > Always Include SpamAssassin Report = yes > > > > > > > > Spam Score Number Format = %5.2f > > > > -- Martin HepworthOxford, UKOn 17 November 2011 10:31, eric le corre > <eric_le_corre <at> msn.com> wrote: > > Spamassassin configuration is in autolearning. So there has to be found > in > > spam HAM. > > Occasionally, I learn to SpamAssassin manually. > > But this problem has been the case since I installed mailscanner. Since > the > > beginning I have negative cores. > > Do I have to disable the AutoLearn, how? > > how can your remove the old tokens? > > > > -- > > MailScanner mailing listmailscanner <at> > lists.mailscanner.infohttp:// > lists.mailscanner.info/mailman/listinfo/mailscanne > r > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > > for example, example of spam that is not considered as spam by spamassasin > with score 4.90 > in spam report, i can see : > > cached not > score=4.904 > 5 requis > 3.50 BAYES_99 Bayes spam probability is 99 to 100% > 0.00 FROM_12LTRDOM > 1.39 HTML_COMMENT_SAVED_URL HTML message is a saved web page > 0.00 HTML_MESSAGE HTML included in message > 0.00 SPF_FAIL SPF: sender does not match SPF record (fail) > 0.01 T_KHOP_FOREIGN_CLICK > > an other one : > cached not > score=1.58 > 5 requis > 0.80 BAYES_50 Bayes spam probability is 40 to 60% > 0.10 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid > -0.10 DKIM_VALID Message has at least one valid DKIM or DK signature > 0.00 HTML_MESSAGE HTML included in message > 0.78 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) > > > thanks > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/cf5458cf/attachment.html From campbell at cnpapers.com Fri Nov 18 16:21:46 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Nov 18 16:23:23 2011 Subject: Clamd permission error In-Reply-To: <CAGDKorJM1ZdpXp1PzjSB=v3_HDfeDV_jqobX7VKhW0i+UJNHUg@mail.gmail.com> References: <4EC66F27.9020005@cnpapers.com> <CALN_k4oB1EKZ5VrEuHN5mhFwZEXbKWbSVy2MUoyaGRn1ufCeTw@mail.gmail.com> <CAGDKorJM1ZdpXp1PzjSB=v3_HDfeDV_jqobX7VKhW0i+UJNHUg@mail.gmail.com> Message-ID: <4EC6861A.8030209@cnpapers.com> I'm pretty certain I looked through there. The settings are spread out all across the config file, so I might have missed one (or four). I just don't understand why I'm seeing this now (just one email) without having changed anything. Thanks for all the help from everyone. steve On 11/18/2011 11:07 AM, Martin Hepworth wrote: > yes you need to look carefully at the mailscanner.conf settings for > permssions etc. Theres good documentation in the file about running > clamdd and the things you need to setup > -- > Martin Hepworth > Oxford, UK > > > On 18 November 2011 14:53, Milenko Letic <mikoletic@gmail.com > <mailto:mikoletic@gmail.com>> wrote: > > this is mod in my MailScanner.conf : > Incoming Work Permissions = 0644 > > maybe , maybe not help, but wish you luck > > On Fri, Nov 18, 2011 at 3:43 PM, Steve Campbell > <campbell@cnpapers.com <mailto:campbell@cnpapers.com>> wrote: > > I'm getting the following error in my logs: > > Clamd::ERROR:: lstat() failed: Permission denied. > ERRORClamd::ERROR:: lstat() failed: Permission denied...... > > Looking back, I found a thread suggesting I should switch to > the internal tnef expander, which I am trying now, and to > ensure the "incoming" directory is accessible by the clam user > (clamav). I've followed the suggestions in the > MailScanner.conf file for the situation I am running under. > The temp folders under the incoming directory, along with the > incoming folder itself, where the winmail.dat is expanded IS > owned by clamav. > > So I'm wondering if the 0640 mod on the folders is the proper > mod. Should there be any sticky bits or anything set? > > Just curious, since this seems to be the first time I've run > into this and I've been using MS for years. > > steve campbell > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > <mailto:mailscanner@lists.mailscanner.info> > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > <mailto:mailscanner@lists.mailscanner.info> > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/d6f0f528/attachment.html From maxsec at gmail.com Fri Nov 18 18:15:02 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Fri Nov 18 18:15:11 2011 Subject: Clamd permission error In-Reply-To: <4EC6861A.8030209@cnpapers.com> References: <4EC66F27.9020005@cnpapers.com> <CALN_k4oB1EKZ5VrEuHN5mhFwZEXbKWbSVy2MUoyaGRn1ufCeTw@mail.gmail.com> <CAGDKorJM1ZdpXp1PzjSB=v3_HDfeDV_jqobX7VKhW0i+UJNHUg@mail.gmail.com> <4EC6861A.8030209@cnpapers.com> Message-ID: <CAGDKorK-k7akvqWzY17+65NSA-NruscHhsf26=jSeSLVKs1fKw@mail.gmail.com> Steve Double check nothing has altered any of the permissions further up the tree and the clamd user can access the files Martin On Friday, 18 November 2011, Steve Campbell <campbell@cnpapers.com> wrote: > I'm pretty certain I looked through there. The settings are spread out all across the config file, so I might have missed one (or four). I just don't understand why I'm seeing this now (just one email) without having changed anything. > > Thanks for all the help from everyone. > > steve > > On 11/18/2011 11:07 AM, Martin Hepworth wrote: > > yes you need to look carefully at the mailscanner.conf settings for permssions etc. Theres good documentation in the file about running clamdd and the things you need to setup > -- > Martin Hepworth > Oxford, UK > > > On 18 November 2011 14:53, Milenko Letic <mikoletic@gmail.com> wrote: >> >> this is mod in my MailScanner.conf : >> Incoming Work Permissions = 0644 >> maybe , maybe not help, but wish you luck >> On Fri, Nov 18, 2011 at 3:43 PM, Steve Campbell <campbell@cnpapers.com> wrote: >>> >>> I'm getting the following error in my logs: >>> >>> Clamd::ERROR:: lstat() failed: Permission denied. ERRORClamd::ERROR:: lstat() failed: Permission denied...... >>> >>> Looking back, I found a thread suggesting I should switch to the internal tnef expander, which I am trying now, and to ensure the "incoming" directory is accessible by the clam user (clamav). I've followed the suggestions in the MailScanner.conf file for the situation I am running under. The temp folders under the incoming directory, along with the incoming folder itself, where the winmail.dat is expanded IS owned by clamav. >>> >>> So I'm wondering if the 0640 mod on the folders is the proper mod. Should there be any sticky bits or anything set? >>> >>> Just curious, since this seems to be the first time I've run into this and I've been using MS for years. >>> >>> steve campbell >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > > > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/ce4f3f9a/attachment.html From campbell at cnpapers.com Fri Nov 18 18:43:49 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Nov 18 18:44:02 2011 Subject: Clamd permission error In-Reply-To: <CAGDKorK-k7akvqWzY17+65NSA-NruscHhsf26=jSeSLVKs1fKw@mail.gmail.com> References: <4EC66F27.9020005@cnpapers.com> <CALN_k4oB1EKZ5VrEuHN5mhFwZEXbKWbSVy2MUoyaGRn1ufCeTw@mail.gmail.com> <CAGDKorJM1ZdpXp1PzjSB=v3_HDfeDV_jqobX7VKhW0i+UJNHUg@mail.gmail.com> <4EC6861A.8030209@cnpapers.com> <CAGDKorK-k7akvqWzY17+65NSA-NruscHhsf26=jSeSLVKs1fKw@mail.gmail.com> Message-ID: <4EC6A765.4040903@cnpapers.com> I don't think anything that matters isn't 640 mod and clamav.clamav owned. The individual files created in the incoming directory are owned by clamav as well. An example: incoming]# ls -al total 2912 drwx------ 8 clamav clamav 4096 Nov 18 13:42 . drwxr-xr-x 4 root root 4096 May 18 2004 .. drwxr-x--- 2 clamav clamav 4096 Sep 9 07:02 26632 drwxr-x--- 4 clamav clamav 4096 Nov 18 13:41 5625 drwxr-x--- 4 clamav clamav 4096 Nov 18 13:41 5632 drwxr-x--- 7 clamav clamav 4096 Nov 18 13:41 5654 drwxr-x--- 2 root root 4096 Nov 18 11:14 Locks -rw------- 1 root root 17408 Nov 18 13:41 Processing.db -rw------- 1 root root 2722816 Nov 18 13:42 SpamAssassin.cache.db drwx------ 2 root root 200704 Nov 18 13:41 SpamAssassin-Temp Seems to me to be as it should be or those "Number" folders couldn't be created. steve On 11/18/2011 1:15 PM, Martin Hepworth wrote: > Steve > Double check nothing has altered any of the permissions further up the > tree and the clamd user can access the files > > Martin > > On Friday, 18 November 2011, Steve Campbell <campbell@cnpapers.com > <mailto:campbell@cnpapers.com>> wrote: > > I'm pretty certain I looked through there. The settings are spread > out all across the config file, so I might have missed one (or four). > I just don't understand why I'm seeing this now (just one email) > without having changed anything. > > > > Thanks for all the help from everyone. > > > > steve > > > > On 11/18/2011 11:07 AM, Martin Hepworth wrote: > > > > yes you need to look carefully at the mailscanner.conf settings for > permssions etc. Theres good documentation in the file about running > clamdd and the things you need to setup > > -- > > Martin Hepworth > > Oxford, UK > > > > > > On 18 November 2011 14:53, Milenko Letic <mikoletic@gmail.com > <mailto:mikoletic@gmail.com>> wrote: > >> > >> this is mod in my MailScanner.conf : > >> Incoming Work Permissions = 0644 > >> maybe , maybe not help, but wish you luck > >> On Fri, Nov 18, 2011 at 3:43 PM, Steve Campbell > <campbell@cnpapers.com <mailto:campbell@cnpapers.com>> wrote: > >>> > >>> I'm getting the following error in my logs: > >>> > >>> Clamd::ERROR:: lstat() failed: Permission denied. > ERRORClamd::ERROR:: lstat() failed: Permission denied...... > >>> > >>> Looking back, I found a thread suggesting I should switch to the > internal tnef expander, which I am trying now, and to ensure the > "incoming" directory is accessible by the clam user (clamav). I've > followed the suggestions in the MailScanner.conf file for the > situation I am running under. The temp folders under the incoming > directory, along with the incoming folder itself, where the > winmail.dat is expanded IS owned by clamav. > >>> > >>> So I'm wondering if the 0640 mod on the folders is the proper mod. > Should there be any sticky bits or anything set? > >>> > >>> Just curious, since this seems to be the first time I've run into > this and I've been using MS for years. > >>> > >>> steve campbell > >>> > >>> -- > >>> MailScanner mailing list > >>> mailscanner@lists.mailscanner.info > <mailto:mailscanner@lists.mailscanner.info> > >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>> > >>> Before posting, read http://wiki.mailscanner.info/posting > >>> > >>> Support MailScanner development - buy the book off the website! > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > <mailto:mailscanner@lists.mailscanner.info> > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > >> > > > > > > > > > > -- > -- > Martin Hepworth > Oxford, UK > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/e6478ea0/attachment.html From campbell at cnpapers.com Fri Nov 18 18:55:53 2011 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Nov 18 18:55:54 2011 Subject: Clamd permission error In-Reply-To: <4EC6A765.4040903@cnpapers.com> References: <4EC66F27.9020005@cnpapers.com> <CALN_k4oB1EKZ5VrEuHN5mhFwZEXbKWbSVy2MUoyaGRn1ufCeTw@mail.gmail.com> <CAGDKorJM1ZdpXp1PzjSB=v3_HDfeDV_jqobX7VKhW0i+UJNHUg@mail.gmail.com> <4EC6861A.8030209@cnpapers.com> <CAGDKorK-k7akvqWzY17+65NSA-NruscHhsf26=jSeSLVKs1fKw@mail.gmail.com> <4EC6A765.4040903@cnpapers.com> Message-ID: <4EC6AA39.4040900@cnpapers.com> Maybe I see the problem. Should the "incoming" folder itself be modded 640 instead of 600? I'll change it since it shouldn't matter. steve On 11/18/2011 1:43 PM, Steve Campbell wrote: > I don't think anything that matters isn't 640 mod and clamav.clamav > owned. The individual files created in the incoming directory are > owned by clamav as well. An example: > > incoming]# ls -al > total 2912 > drwx------ 8 clamav clamav 4096 Nov 18 13:42 . > drwxr-xr-x 4 root root 4096 May 18 2004 .. > drwxr-x--- 2 clamav clamav 4096 Sep 9 07:02 26632 > drwxr-x--- 4 clamav clamav 4096 Nov 18 13:41 5625 > drwxr-x--- 4 clamav clamav 4096 Nov 18 13:41 5632 > drwxr-x--- 7 clamav clamav 4096 Nov 18 13:41 5654 > drwxr-x--- 2 root root 4096 Nov 18 11:14 Locks > -rw------- 1 root root 17408 Nov 18 13:41 Processing.db > -rw------- 1 root root 2722816 Nov 18 13:42 > SpamAssassin.cache.db > drwx------ 2 root root 200704 Nov 18 13:41 SpamAssassin-Temp > > Seems to me to be as it should be or those "Number" folders couldn't > be created. > > steve > > > On 11/18/2011 1:15 PM, Martin Hepworth wrote: >> Steve >> Double check nothing has altered any of the permissions further up >> the tree and the clamd user can access the files >> >> Martin >> >> On Friday, 18 November 2011, Steve Campbell <campbell@cnpapers.com >> <mailto:campbell@cnpapers.com>> wrote: >> > I'm pretty certain I looked through there. The settings are spread >> out all across the config file, so I might have missed one (or four). >> I just don't understand why I'm seeing this now (just one email) >> without having changed anything. >> > >> > Thanks for all the help from everyone. >> > >> > steve >> > >> > On 11/18/2011 11:07 AM, Martin Hepworth wrote: >> > >> > yes you need to look carefully at the mailscanner.conf settings for >> permssions etc. Theres good documentation in the file about running >> clamdd and the things you need to setup >> > -- >> > Martin Hepworth >> > Oxford, UK >> > >> > >> > On 18 November 2011 14:53, Milenko Letic <mikoletic@gmail.com >> <mailto:mikoletic@gmail.com>> wrote: >> >> >> >> this is mod in my MailScanner.conf : >> >> Incoming Work Permissions = 0644 >> >> maybe , maybe not help, but wish you luck >> >> On Fri, Nov 18, 2011 at 3:43 PM, Steve Campbell >> <campbell@cnpapers.com <mailto:campbell@cnpapers.com>> wrote: >> >>> >> >>> I'm getting the following error in my logs: >> >>> >> >>> Clamd::ERROR:: lstat() failed: Permission denied. >> ERRORClamd::ERROR:: lstat() failed: Permission denied...... >> >>> >> >>> Looking back, I found a thread suggesting I should switch to the >> internal tnef expander, which I am trying now, and to ensure the >> "incoming" directory is accessible by the clam user (clamav). I've >> followed the suggestions in the MailScanner.conf file for the >> situation I am running under. The temp folders under the incoming >> directory, along with the incoming folder itself, where the >> winmail.dat is expanded IS owned by clamav. >> >>> >> >>> So I'm wondering if the 0640 mod on the folders is the proper >> mod. Should there be any sticky bits or anything set? >> >>> >> >>> Just curious, since this seems to be the first time I've run into >> this and I've been using MS for years. >> >>> >> >>> steve campbell >> >>> >> >>> -- >> >>> MailScanner mailing list >> >>> mailscanner@lists.mailscanner.info >> <mailto:mailscanner@lists.mailscanner.info> >> >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >>> >> >>> Before posting, read http://wiki.mailscanner.info/posting >> >>> >> >>> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> >> MailScanner mailing list >> >> mailscanner@lists.mailscanner.info >> <mailto:mailscanner@lists.mailscanner.info> >> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> >> >> Support MailScanner development - buy the book off the website! >> >> >> > >> > >> > >> > >> >> -- >> -- >> Martin Hepworth >> Oxford, UK >> >> > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111118/26471f99/attachment-0001.html From glenn.steen at gmail.com Sat Nov 19 09:01:37 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Sat Nov 19 09:01:48 2011 Subject: Very bad score spamassassin In-Reply-To: <CAGDKorL6i5jiAZJF=jh7Vv5mF8fMdYo1W9H0r-AdnPFfHQjZqg@mail.gmail.com> References: <DUB110-W90ABD0F20B0B99899FC944B8C70@phx.gbl> <ace70ff8-4ff0-4bd3-b834-967fbfed6f88@cronlabworkstation0> <loom.20111117T112243-761@post.gmane.org> <CAGDKorLb1s0_=UOiji_QWPJ2JZ3ThAMo3PWTc3CqSc7TFzvWCA@mail.gmail.com> <loom.20111118T140421-544@post.gmane.org> <CAGDKorL6i5jiAZJF=jh7Vv5mF8fMdYo1W9H0r-AdnPFfHQjZqg@mail.gmail.com> Message-ID: <CAAug_B__Q9jJP04wkOmpf-yegp0e3_u=uRa4Hh5ZEVKxCj03rA@mail.gmail.com> And start using the digest tests! DCC and razor at least, and probably pyzor as well. But as Markus says... Fix your trust path (and corresponding MailScanner setting) first!!! A simple search will givevthe details on how (SA has a good wiki article...). Cheers -- -- Glenn Den 18 nov 2011 17:19 skrev "Martin Hepworth" <maxsec@gmail.com>: > and you're running stock spamassassin rules with no alterations? and > running sa-update at least once per day? > > I'd turn on a couple of RBL's (zen and spamcop are useful), enable the > rbl's and make sure all but the ones you want are given a zero score in > local.cf and they won't run. > > -- > Martin Hepworth > Oxford, UK > > > On 18 November 2011 13:11, eric le corre <eric_le_corre@msn.com> wrote: > >> Martin Hepworth <maxsec <at> gmail.com> writes: >> >> > >> > >> > yes disable auto learn by commenting out the plugin in one of >> the /usr/local/spamassassin/*.cf filesyou need to know WHAT spamassassin >> rule >> is dragging the score down, you should be able to see this in Mailwatch or >> alter the following settings in MailWatch.conf and you'll get more info >> in the >> email headers to help diagnose.. >> > >> > Spam Score Number Format = %5.2f >> > >> > >> > >> > Detailed Spam Report = yes >> > >> > >> > >> > Include Scores In SpamAssassin Report = yes >> > >> > >> > >> > Always Include SpamAssassin Report = yes >> > >> > >> > >> > Spam Score Number Format = %5.2f >> > >> > -- Martin HepworthOxford, UKOn 17 November 2011 10:31, eric le corre >> <eric_le_corre <at> msn.com> wrote: >> > Spamassassin configuration is in autolearning. So there has to be found >> in >> > spam HAM. >> > Occasionally, I learn to SpamAssassin manually. >> > But this problem has been the case since I installed mailscanner. >> Since the >> > beginning I have negative cores. >> > Do I have to disable the AutoLearn, how? >> > how can your remove the old tokens? >> > >> > -- >> > MailScanner mailing listmailscanner <at> >> lists.mailscanner.infohttp:// >> lists.mailscanner.info/mailman/listinfo/mailscanne >> r >> > Before posting, read http://wiki.mailscanner.info/posting >> > Support MailScanner development - buy the book off the website! >> > >> >> >> for example, example of spam that is not considered as spam by spamassasin >> with score 4.90 >> in spam report, i can see : >> >> cached not >> score=4.904 >> 5 requis >> 3.50 BAYES_99 Bayes spam probability is 99 to 100% >> 0.00 FROM_12LTRDOM >> 1.39 HTML_COMMENT_SAVED_URL HTML message is a saved web page >> 0.00 HTML_MESSAGE HTML included in message >> 0.00 SPF_FAIL SPF: sender does not match SPF record (fail) >> 0.01 T_KHOP_FOREIGN_CLICK >> >> an other one : >> cached not >> score=1.58 >> 5 requis >> 0.80 BAYES_50 Bayes spam probability is 40 to 60% >> 0.10 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid >> -0.10 DKIM_VALID Message has at least one valid DKIM or DK signature >> 0.00 HTML_MESSAGE HTML included in message >> 0.78 SPF_NEUTRAL SPF: sender does not match SPF record (neutral) >> >> >> thanks >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111119/0e513748/attachment.html From markus at markusoft.se Mon Nov 21 07:46:01 2011 From: markus at markusoft.se (Markus Nilsson) Date: Mon Nov 21 07:46:16 2011 Subject: Very bad score spamassassin In-Reply-To: <loom.20111118T163152-30@post.gmane.org> Message-ID: <55bcbdc2-1e53-4f6a-b8ba-37386e6c24d3@cronlabworkstation0> ----- Original Message ----- > From: "eric le corre" <eric_le_corre@msn.com> > To: mailscanner@lists.mailscanner.info > Sent: fredag, 18 nov 2011 16:34:06 > Subject: Re: Very bad score spamassassin > > > > Did I understand correctly if all your mail come from the same IP? > > yes, it is that ! all from the same IP > > > > add_header all RelaysUntrusted _RELAYSUNTRUSTED_ > > i have to put that in local.cf ? > > > > maybe i have to put in local.cf IP of my mail provider like this : > > trusted_networks 62.62.128.91 > Yes that sounds correct, maybe also add 127.0.0.1 (Unless you use SpamAssassin >= 3.2.x) /M From jayesha_shinde at yahoo.com Tue Nov 22 12:00:22 2011 From: jayesha_shinde at yahoo.com (jayesh shinde) Date: Tue Nov 22 12:00:32 2011 Subject: Query with Spam and virus check , Message-ID: <1321963222.81907.YahooMailClassic@web161914.mail.bf1.yahoo.com> Hi , I have query with Spam and virus check , I am using the MS version 4.74.13 and clamav f-prot-6 for anti-virus? >From last few days , some spam emails are coming with virus attachment. The MailScanner is detecting the email as SPAM email and stop doing the virus checking next. I have set the SPAM action as deliver. And because of that this setting such virus email is directly getting deliver to end user. The desktop antivirus is detecting the emails as virus. I do some google and read on list that? :-- --------------------------------------------- when the message marked as definitely spam and no further tests are performed to save processing time. ?I want to change this process flow. That I want to let mail to be do a SPAM and virus check further. I have servers which can handle the load. Is it possible to do this MailScanner config ? ?Regards Jayesh Shinde -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111122/61985448/attachment.html From mailscanner at joolee.nl Tue Nov 22 13:20:51 2011 From: mailscanner at joolee.nl (Joolee) Date: Tue Nov 22 13:21:41 2011 Subject: Query with Spam and virus check , In-Reply-To: <1321963222.81907.YahooMailClassic@web161914.mail.bf1.yahoo.com> References: <1321963222.81907.YahooMailClassic@web161914.mail.bf1.yahoo.com> Message-ID: <CA+Q-w8ULxT5QQCyCsB8AwNdEgqb_-1A-12zeKZmOxz+SDUZq7g@mail.gmail.com> Can you send a sample of the complete Email, with headers in a separate file? Virus checks should proceed Spam checks but I know a bug that might be bothering you. On 22 November 2011 13:00, jayesh shinde <jayesha_shinde@yahoo.com> wrote: > <http://compose?to=mailscanner@lists.mailscanner.info> Hi , > > I have query with Spam and virus check , > > I am using the MS version 4.74.13 and clamav f-prot-6 for anti-virus > > From last few days , some spam emails are coming with virus attachment. > The MailScanner is detecting the email as SPAM email and stop doing the > virus checking next. I have set the SPAM action as deliver. And because of > that this setting such virus email is directly getting deliver to end user. > The desktop antivirus is detecting the emails as virus. > > I do some google and read on list that :-- > --------------------------------------------- > when the message marked as definitely spam and no further tests are > performed to save processing time. > > I want to change this process flow. That I want to let mail to be do a > SPAM and virus check further. I have servers which can handle the load. > Is it possible to do this MailScanner config ? > > Regards > Jayesh Shinde > > > > > > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111122/c62f13f7/attachment.html From ssilva at sgvwater.com Tue Nov 22 15:55:04 2011 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Nov 22 15:55:44 2011 Subject: Query with Spam and virus check , In-Reply-To: <1321963222.81907.YahooMailClassic@web161914.mail.bf1.yahoo.com> References: <1321963222.81907.YahooMailClassic@web161914.mail.bf1.yahoo.com> Message-ID: <jaggl2$bdf$1@dough.gmane.org> on 11/22/2011 4:00 AM jayesh shinde spake the following: > <compose?to=mailscanner@lists.mailscanner.info>Hi , > > I have query with Spam and virus check , > > I am using the MS version 4.74.13 and clamav f-prot-6 for anti-virus > > From last few days , some spam emails are coming with virus attachment. > The MailScanner is detecting the email as SPAM email and stop doing the virus > checking next. I have set the SPAM action as deliver. And because of that this > setting such virus email is directly getting deliver to end user. > The desktop antivirus is detecting the emails as virus. > That version is almost 2 years old... I'm sure lots of bugs have been fixed since then... From peter at pele.spb.ru Tue Nov 22 18:03:36 2011 From: peter at pele.spb.ru (Peter A.Nesterov) Date: Tue Nov 22 18:04:00 2011 Subject: MailScanner[nnnn]: Could not use Custom Function code /usr/lib/MailScanner/... In-Reply-To: <CAGDKorKx8hHex+msK47Va5fgSUXU2UQ3bA8VQgJ9O-7oBeUauw@mail.gmail.com> References: <4EC4CB42.5060703@pele.spb.ru> <CAGDKorKx8hHex+msK47Va5fgSUXU2UQ3bA8VQgJ9O-7oBeUauw@mail.gmail.com> Message-ID: <4ECBE3F8.8020105@pele.spb.ru> Hi, at last I've resolved this problem. I've install new perl module File::Temp-0.22 (in my CentOS 5.7 was installed File::Temp-0.16). And now there is no error message in maillog! Thanks to all! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From eric_le_corre at msn.com Wed Nov 23 09:35:10 2011 From: eric_le_corre at msn.com (eric le corre) Date: Wed Nov 23 09:35:35 2011 Subject: Emails lost ! References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> <ja3e6k$eaa$2@dough.gmane.org> <20111117172042.GA13822@mikea.ath.cx> <loom.20111118T113051-642@post.gmane.org> Message-ID: <loom.20111123T102705-744@post.gmane.org> eric le corre <eric_le_corre <at> msn.com> writes: > > what is surprising is that such an e-mail never arrived, apparently the sender > has sent the same mail that is spent. > > "Assuming he is grep'n the servers IP. As the email from would not even be > logged. " > The problem is that we have a email gateway from our provider, so all emails > come from the same IP > > "That should still leave some form of log entry..." > Maybe but users say "i don t receive email" but i dont know the hour, > difficult to find something ! > So, i found a example of the problem. Sender send me email to my professional domain and other one personal. I dont receive the email in my professional domain ! i found no log of this in syslog of the server, nothing The email is just a message with PDF file. Siez of the mai : 3mo the email don t have subject ! this can be the problem ? i had forward the email from my personal mailbox to my domain, and no problem to receive the email ! thanks From glenn.steen at gmail.com Wed Nov 23 10:11:24 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Wed Nov 23 10:11:34 2011 Subject: Emails lost ! In-Reply-To: <loom.20111123T102705-744@post.gmane.org> References: <DUB110-W42A3E99CF7D67DDB75D4BFB8C70@phx.gbl> <ja3e6k$eaa$2@dough.gmane.org> <20111117172042.GA13822@mikea.ath.cx> <loom.20111118T113051-642@post.gmane.org> <loom.20111123T102705-744@post.gmane.org> Message-ID: <CAAug_B-RKoOd+8ftH2pDdUdcLB8Nh0TB-yC0T_QEsL9=SMYuSw@mail.gmail.com> No, "empty subject" is irrelevant... Much more likely that either of the two MTAs (at least two;-) are the culprits... Either it never leaves the sender properly, or your upstream ISP is dropping it. Have you talked to a technical contact at either org? Does the sender receive any delivery report (have them check any junkmail folder)? Cheers! Den 23 nov 2011 10:41 skrev "eric le corre" <eric_le_corre@msn.com>: > > eric le corre <eric_le_corre <at> msn.com> writes: > > > > what is surprising is that such an e-mail never arrived, apparently the > sender > > has sent the same mail that is spent. > > > > "Assuming he is grep'n the servers IP. As the email from would not even be > > logged. " > > The problem is that we have a email gateway from our provider, so all emails > > come from the same IP > > > > "That should still leave some form of log entry..." > > Maybe but users say "i don t receive email" but i dont know the hour, > > difficult to find something ! > > > > > So, i found a example of the problem. Sender send me email to my professional > domain and other one personal. I dont receive the email in my professional > domain ! > i found no log of this in syslog of the server, nothing > > The email is just a message with PDF file. Siez of the mai : 3mo > > the email don t have subject ! this can be the problem ? > > i had forward the email from my personal mailbox to my domain, and no problem > to receive the email ! > > thanks > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111123/f70298ae/attachment.html From sandrews at andrewscompanies.com Wed Nov 23 16:39:07 2011 From: sandrews at andrewscompanies.com (Steven Andrews) Date: Wed Nov 23 16:39:20 2011 Subject: easy install package update Message-ID: <F91088CB5AB4A248B91422AAD82A2237E9FC5DE381@SERVER.andrewscompanies.com> Any chance we can get a rollup of the latest SA and Clam in the easy install package? Thanks much! Steven R. Andrews, President Andrews Companies Incorporated Small Business Information Technology Consultants sandrews@andrewscompanies.com Phone: 317.536.1807 "If your only tool is a hammer, every problem looks like a nail." -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111123/c24226ad/attachment.html From djart at linux.gr Thu Nov 24 10:56:05 2011 From: djart at linux.gr (Thanos Kyritsis) Date: Thu Nov 24 10:56:16 2011 Subject: Troubles with Perl 5.14 on Debian Message-ID: <CAKovSWU+_A46O91CBRnyU4k_t1GpLuyf=-Bh03KDbYW-qWMbAw@mail.gmail.com> Hello, does anyone have any kinds of trouble when running MailScanner with Perl 5.14 ? I'm using vanilla MailScanner 4.84.3 (from tar distribution) on a Debian testing server and I recently upgraded Perl from 5.12 to 5.14. Mail processing keeps running normally, but utilizing start-stop-daemon for starting/stoping and for the hourly check job is troublesome because it cannot stop the already running childer, it keeps starting additional ones. There is already a Debian bug report as well: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649835 From nebano at gmail.com Thu Nov 24 20:20:58 2011 From: nebano at gmail.com (Osvaldo Alvarez Pozo) Date: Thu Nov 24 20:21:10 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <1251B5423222C446A299CABAA7B46FF42BA631@fn-exchange.fastnet.local> References: <CADD-rgqG+Tn10Mqh_Btjcd=v3GtDS5weXrfyMU4MU=QAm89sYA@mail.gmail.com> <500107f8-5be9-4f98-be79-6b8f24d8ad18@cronlabworkstation0> <1251B5423222C446A299CABAA7B46FF42BA631@fn-exchange.fastnet.local> Message-ID: <CADD-rgp7nuhC4kWsRAxmUMbKO8SBE6_fKvRXsD62hdgruoqw3Q@mail.gmail.com> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: image/gif Size: 368 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111124/51cb7cae/attachment.gif From michael at netdirect.ca Fri Nov 25 15:57:18 2011 From: michael at netdirect.ca (Michael Brown) Date: Fri Nov 25 15:57:32 2011 Subject: Lots of empty files in Spamassassin-Temp Message-ID: <4ECFBADE.1040602@netdirect.ca> I've just noticed that I have *tons* (44K) of empty files in /var/spool/MailScanner/incoming/Spamassassin-Temp: -rw-------. 1 postfix postfix 0 Nov 16 21:24 MailScanner.00AvcG -rw-------. 1 postfix postfix 0 Nov 16 23:35 MailScanner.00f27Y -rw-------. 1 postfix postfix 0 Nov 16 13:38 MailScanner.00GI_W -rw-------. 1 postfix postfix 0 Nov 16 17:16 MailScanner.00Jocy -rw-------. 1 postfix postfix 0 Nov 17 05:47 MailScanner.015y2t <?> -rw-------. 1 postfix postfix 0 Nov 16 19:48 tmp.zZxmXS6icA -rw-------. 1 postfix postfix 0 Nov 17 03:36 tmp.zzYqh6JZgv -rw-------. 1 postfix postfix 0 Nov 16 20:55 tmp.zZzDzv9mYt -rw-------. 1 postfix postfix 0 Nov 24 13:46 tnef0Pj8IZ -rw-------. 1 postfix postfix 0 Nov 24 14:11 tnef2nFqQ2 -rw-------. 1 postfix postfix 0 Nov 24 13:59 tnef3S7jFM <?> Any idea why they're there? Should I be running tmpwatch over this directory on a regular basis to keep it clean? Or is this a symptom of another problem? I'm running mailscanner-4.84.3-1 on RHEL 6.1 against postfix. M. -- Michael Brown | `One of the main causes of the fall of Systems Consultant | the Roman Empire was that, lacking zero, Net Direct Inc. | they had no way to indicate successful ?: +1 519 883 1172 x5106 | termination of their C programs.' - Firth From alexandru.ionica at gmail.com Fri Nov 25 20:35:57 2011 From: alexandru.ionica at gmail.com (Alexandru Ionica) Date: Fri Nov 25 20:36:06 2011 Subject: Lots of empty files in Spamassassin-Temp In-Reply-To: <4ECFBADE.1040602@netdirect.ca> References: <4ECFBADE.1040602@netdirect.ca> Message-ID: <CAPwaGKaovKOu4enRBPDH4SoYt=0vjv82zCcG2kQQGG5rb69o_g@mail.gmail.com> I have the same issue and i have set up a tmpwatch. On Fri, Nov 25, 2011 at 4:57 PM, Michael Brown <michael@netdirect.ca> wrote: > I've just noticed that I have *tons* (44K) of empty files in > /var/spool/MailScanner/incoming/Spamassassin-Temp: > > -rw-------. 1 postfix postfix 0 Nov 16 21:24 MailScanner.00AvcG > -rw-------. 1 postfix postfix 0 Nov 16 23:35 MailScanner.00f27Y > -rw-------. 1 postfix postfix 0 Nov 16 13:38 MailScanner.00GI_W > -rw-------. 1 postfix postfix 0 Nov 16 17:16 MailScanner.00Jocy > -rw-------. 1 postfix postfix 0 Nov 17 05:47 MailScanner.015y2t > <?> > -rw-------. 1 postfix postfix 0 Nov 16 19:48 tmp.zZxmXS6icA > -rw-------. 1 postfix postfix 0 Nov 17 03:36 tmp.zzYqh6JZgv > -rw-------. 1 postfix postfix 0 Nov 16 20:55 tmp.zZzDzv9mYt > -rw-------. 1 postfix postfix 0 Nov 24 13:46 tnef0Pj8IZ > -rw-------. 1 postfix postfix 0 Nov 24 14:11 tnef2nFqQ2 > -rw-------. 1 postfix postfix 0 Nov 24 13:59 tnef3S7jFM > <?> > > Any idea why they're there? Should I be running tmpwatch over this > directory on a regular basis to keep it clean? Or is this a symptom of > another problem? > > I'm running mailscanner-4.84.3-1 on RHEL 6.1 against postfix. > > M. > > > -- > Michael Brown | `One of the main causes of the fall of > Systems Consultant | the Roman Empire was that, lacking zero, > Net Direct Inc. | they had no way to indicate successful > ?: +1 519 883 1172 x5106 | termination of their C programs.' - Firth > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111125/13c28789/attachment.html From mailscanner at barendse.to Sat Nov 26 03:25:03 2011 From: mailscanner at barendse.to (Remco Barendse) Date: Sat Nov 26 03:25:23 2011 Subject: Mail-ClamAV-0.29 doesn't build Message-ID: <alpine.LRH.2.02.1111260419520.23305@raveon.vaag.nu> Hi list, I am trying to upgrade some boxes to Scientific Linux 6.1 (a RHEL6 rebuild). When installing mailscanner and the clam/spamass packages not all the perl modules will build. Most that wouldn't build (perl-Time-HiRes perl-Encode-Detect perl-Mail-SPF-Query perl-Mail-DKIM perl-Module-Build perl-Net-DNS-Resolver-Programmable) i found in the rpmforge repo. It seems however that Mail-ClamAV from install-Clam-0.96.5-SA-3.3.1 also doesn't want to build, when installing i get the output below. I thought it was missing lbzip2 but when i installed that, it still did not build. Where am i going wrong? Thanks! /usr/bin/ld: cannot find -lbz2 collect2: ld returned 1 exit status make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 make[1]: Leaving directory `/tmp/Mail-ClamAV-0.29/_Inline/build/Mail/ClamAV' A problem was encountered while attempting to compile and install your Inline C code. The command that failed was: make The build directory was: /tmp/Mail-ClamAV-0.29/_Inline/build/Mail/ClamAV To debug the problem, cd to the build directory, and inspect the output files. at /tmp/Mail-ClamAV-0.29/blib/lib/Mail/ClamAV.pm line 162 BEGIN failed--compilation aborted at /tmp/Mail-ClamAV-0.29/blib/lib/Mail/ClamAV.pm line 556. Compilation failed in require. BEGIN failed--compilation aborted. make: *** [ClamAV.inl] Error 25 From maxsec at gmail.com Sat Nov 26 08:32:00 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Sat Nov 26 08:32:08 2011 Subject: Mail-ClamAV-0.29 doesn't build In-Reply-To: <alpine.LRH.2.02.1111260419520.23305@raveon.vaag.nu> References: <alpine.LRH.2.02.1111260419520.23305@raveon.vaag.nu> Message-ID: <CAGDKorJfb0h_VASBV73gNwXX8GWPp5XqfxLcoEcdqJMUetmVBg@mail.gmail.com> install clamav independenly not a big job and you'll get a later version too. -- Martin Hepworth Oxford, UK On 26 November 2011 03:25, Remco Barendse <mailscanner@barendse.to> wrote: > Hi list, > > I am trying to upgrade some boxes to Scientific Linux 6.1 (a RHEL6 > rebuild). When installing mailscanner and the clam/spamass packages not all > the perl modules will build. Most that wouldn't build (perl-Time-HiRes > perl-Encode-Detect perl-Mail-SPF-Query perl-Mail-DKIM perl-Module-Build > perl-Net-DNS-Resolver-**Programmable) i found in the rpmforge repo. > > It seems however that Mail-ClamAV from install-Clam-0.96.5-SA-3.3.1 also > doesn't want to build, when installing i get the output below. I thought > it was missing lbzip2 but when i installed that, it still did not build. > > Where am i going wrong? > > Thanks! > > > > /usr/bin/ld: cannot find -lbz2 > collect2: ld returned 1 exit status > make[1]: *** [blib/arch/auto/Mail/ClamAV/**ClamAV.so] Error 1 > make[1]: Leaving directory `/tmp/Mail-ClamAV-0.29/_** > Inline/build/Mail/ClamAV' > > A problem was encountered while attempting to compile and install your > Inline > C code. The command that failed was: > make > > The build directory was: > /tmp/Mail-ClamAV-0.29/_Inline/**build/Mail/ClamAV > > To debug the problem, cd to the build directory, and inspect the output > files. > > at /tmp/Mail-ClamAV-0.29/blib/**lib/Mail/ClamAV.pm line 162 > BEGIN failed--compilation aborted at /tmp/Mail-ClamAV-0.29/blib/**lib/Mail/ClamAV.pm > line 556. > Compilation failed in require. > BEGIN failed--compilation aborted. > make: *** [ClamAV.inl] Error 25 > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info <mailscanner@lists.mailscanner.info> > http://lists.mailscanner.info/**mailman/listinfo/mailscanner<http://lists.mailscanner.info/mailman/listinfo/mailscanner> > > Before posting, read http://wiki.mailscanner.info/**posting<http://wiki.mailscanner.info/posting> > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111126/380f32a4/attachment.html From mailscanner at barendse.to Sat Nov 26 09:35:04 2011 From: mailscanner at barendse.to (Remco Barendse) Date: Sat Nov 26 09:35:25 2011 Subject: Mail-ClamAV-0.29 doesn't build In-Reply-To: <CAGDKorJfb0h_VASBV73gNwXX8GWPp5XqfxLcoEcdqJMUetmVBg@mail.gmail.com> References: <alpine.LRH.2.02.1111260419520.23305@raveon.vaag.nu> <CAGDKorJfb0h_VASBV73gNwXX8GWPp5XqfxLcoEcdqJMUetmVBg@mail.gmail.com> Message-ID: <alpine.LRH.2.02.1111261032460.23305@raveon.vaag.nu> Hi Martin! I installed clamav from rpmforge so it will autoupdate. Should i install clamav separately or mail-clamav? Cheers On Sat, 26 Nov 2011, Martin Hepworth wrote: > install clamav independenlynot a big job and you'll get a later version too. > > -- > Martin Hepworth > Oxford, UK > > > On 26 November 2011 03:25, Remco Barendse <mailscanner@barendse.to> wrote: > Hi list, > > I am trying to upgrade some boxes to Scientific Linux 6.1 (a RHEL6 rebuild). When installing mailscanner and the clam/spamass packages not all the perl > modules will build. Most that wouldn't build (perl-Time-HiRes perl-Encode-Detect perl-Mail-SPF-Query perl-Mail-DKIM perl-Module-Build > perl-Net-DNS-Resolver-Programmable) i found in the rpmforge repo. > > It seems however that Mail-ClamAV from install-Clam-0.96.5-SA-3.3.1 also doesn't want to build, when installing i get the output below. ?I thought it > was missing lbzip2 but when i installed that, it still did not build. > > Where am i going wrong? > > Thanks! > > > > /usr/bin/ld: cannot find -lbz2 > collect2: ld returned 1 exit status > make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 > make[1]: Leaving directory `/tmp/Mail-ClamAV-0.29/_Inline/build/Mail/ClamAV' > > A problem was encountered while attempting to compile and install your Inline > C code. The command that failed was: > ?make > > The build directory was: > /tmp/Mail-ClamAV-0.29/_Inline/build/Mail/ClamAV > > To debug the problem, cd to the build directory, and inspect the output files. > > ?at /tmp/Mail-ClamAV-0.29/blib/lib/Mail/ClamAV.pm line 162 > BEGIN failed--compilation aborted at /tmp/Mail-ClamAV-0.29/blib/lib/Mail/ClamAV.pm line 556. > Compilation failed in require. > BEGIN failed--compilation aborted. > make: *** [ClamAV.inl] Error 25 > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > From maxsec at gmail.com Sat Nov 26 13:53:28 2011 From: maxsec at gmail.com (Martin Hepworth) Date: Sat Nov 26 13:53:37 2011 Subject: Mail-ClamAV-0.29 doesn't build In-Reply-To: <alpine.LRH.2.02.1111261032460.23305@raveon.vaag.nu> References: <alpine.LRH.2.02.1111260419520.23305@raveon.vaag.nu> <CAGDKorJfb0h_VASBV73gNwXX8GWPp5XqfxLcoEcdqJMUetmVBg@mail.gmail.com> <alpine.LRH.2.02.1111261032460.23305@raveon.vaag.nu> Message-ID: <CAGDKor+7LFq2YUJyT7CsPWHt530Z1QjqzCpyByS-Yc3iu_kLjw@mail.gmail.com> Just clamav as mailscanner should be configured to use clamd to scan the messages Martin On Saturday, 26 November 2011, Remco Barendse <mailscanner@barendse.to> wrote: > Hi Martin! > > I installed clamav from rpmforge so it will autoupdate. > > Should i install clamav separately or mail-clamav? > > Cheers > > On Sat, 26 Nov 2011, Martin Hepworth wrote: > >> install clamav independenlynot a big job and you'll get a later version too. >> >> -- >> Martin Hepworth >> Oxford, UK >> >> >> On 26 November 2011 03:25, Remco Barendse <mailscanner@barendse.to> wrote: >> Hi list, >> >> I am trying to upgrade some boxes to Scientific Linux 6.1 (a RHEL6 rebuild). When installing mailscanner and the clam/spamass packages not all the perl >> modules will build. Most that wouldn't build (perl-Time-HiRes perl-Encode-Detect perl-Mail-SPF-Query perl-Mail-DKIM perl-Module-Build >> perl-Net-DNS-Resolver-Programmable) i found in the rpmforge repo. >> >> It seems however that Mail-ClamAV from install-Clam-0.96.5-SA-3.3.1 also doesn't want to build, when installing i get the output below. I thought it >> was missing lbzip2 but when i installed that, it still did not build. >> >> Where am i going wrong? >> >> Thanks! >> >> >> >> /usr/bin/ld: cannot find -lbz2 >> collect2: ld returned 1 exit status >> make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 >> make[1]: Leaving directory `/tmp/Mail-ClamAV-0.29/_Inline/build/Mail/ClamAV' >> >> A problem was encountered while attempting to compile and install your Inline >> C code. The command that failed was: >> make >> >> The build directory was: >> /tmp/Mail-ClamAV-0.29/_Inline/build/Mail/ClamAV >> >> To debug the problem, cd to the build directory, and inspect the output files. >> >> at /tmp/Mail-ClamAV-0.29/blib/lib/Mail/ClamAV.pm line 162 >> BEGIN failed--compilation aborted at /tmp/Mail-ClamAV-0.29/blib/lib/Mail/ClamAV.pm line 556. >> Compilation failed in require. >> BEGIN failed--compilation aborted. >> make: *** [ClamAV.inl] Error 25 >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111126/7da956e2/attachment.html From glenn.steen at gmail.com Sat Nov 26 14:28:03 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Sat Nov 26 14:28:13 2011 Subject: Adding Inline HTMLand Text Signature to messages In-Reply-To: <CADD-rgp7nuhC4kWsRAxmUMbKO8SBE6_fKvRXsD62hdgruoqw3Q@mail.gmail.com> References: <CADD-rgqG+Tn10Mqh_Btjcd=v3GtDS5weXrfyMU4MU=QAm89sYA@mail.gmail.com> <500107f8-5be9-4f98-be79-6b8f24d8ad18@cronlabworkstation0> <1251B5423222C446A299CABAA7B46FF42BA631@fn-exchange.fastnet.local> <CADD-rgp7nuhC4kWsRAxmUMbKO8SBE6_fKvRXsD62hdgruoqw3Q@mail.gmail.com> Message-ID: <CAAug_B8Lm-u8=a3RG0CyLDnCTko1B6G4c76mdsTVKCbqy53Guw@mail.gmail.com> On 24 November 2011 21:20, Osvaldo Alvarez Pozo <nebano@gmail.com> wrote: > > Hello all, > > Sorry if I answer late. > > Where can I download an older version of mailscanner. to use until a fix or new version is available? > > Thanks > > Osvaldo All versions of MailScanner are available from www.mailcanner.info, although the link from the D/L page always point to the latest version, they're all there. Look at the Changelog for available version (the actual nubers), then look at/copy the D/L link for the one you want, paste that into a browser, change the numbering accordingly and ... there you have it;-) Cheers! -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From glenn.steen at gmail.com Sat Nov 26 14:34:14 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Sat Nov 26 14:34:38 2011 Subject: Troubles with Perl 5.14 on Debian In-Reply-To: <CAKovSWU+_A46O91CBRnyU4k_t1GpLuyf=-Bh03KDbYW-qWMbAw@mail.gmail.com> References: <CAKovSWU+_A46O91CBRnyU4k_t1GpLuyf=-Bh03KDbYW-qWMbAw@mail.gmail.com> Message-ID: <CAAug_B9urkGy3N6jVpSzniLvfL+AsKUzaM-8c4nu2VfXV_XyXQ@mail.gmail.com> On 24 November 2011 11:56, Thanos Kyritsis <djart@linux.gr> wrote: > Hello, > > does anyone have any kinds of trouble when running MailScanner with Perl 5.14 ? > > I'm using vanilla MailScanner 4.84.3 (from tar distribution) on a > Debian testing server and I recently upgraded Perl from 5.12 to 5.14. > Mail processing keeps running normally, but utilizing > start-stop-daemon for starting/stoping and for the hourly check job is > troublesome because it cannot stop the already running childer, it > keeps starting additional ones. > > > There is already a Debian bug report as well: > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649835 Have you loked at what might be up? I mean, have you tried any form of debug actions (like actually reading the script and trying by hand to simulate the failure, or just doing "set +x" early on and running the int script with some stop/restart action)? The init script is mainly that, a shell script, so that shouldn't have been affected by a perl update. The periodic restart is a bit different though, so that might be as you say. Cheers! -- -- Glenn email: glenn < dot > steen < at > gmail < dot > com work: glenn < dot > steen < at > ap1 < dot > se From mailscanner at barendse.to Sat Nov 26 19:07:22 2011 From: mailscanner at barendse.to (Remco Barendse) Date: Sat Nov 26 19:07:36 2011 Subject: Mail-ClamAV-0.29 doesn't build In-Reply-To: <CAGDKor+7LFq2YUJyT7CsPWHt530Z1QjqzCpyByS-Yc3iu_kLjw@mail.gmail.com> References: <alpine.LRH.2.02.1111260419520.23305@raveon.vaag.nu> <CAGDKorJfb0h_VASBV73gNwXX8GWPp5XqfxLcoEcdqJMUetmVBg@mail.gmail.com> <alpine.LRH.2.02.1111261032460.23305@raveon.vaag.nu> <CAGDKor+7LFq2YUJyT7CsPWHt530Z1QjqzCpyByS-Yc3iu_kLjw@mail.gmail.com> Message-ID: <alpine.LRH.2.02.1111262006450.23305@raveon.vaag.nu> OK, great. So basically mail-clamav is not a requirement at all anymore? On Sat, 26 Nov 2011, Martin Hepworth wrote: > Just clamav as mailscanner should be configured to use clamd to scan the messages > > Martin > > On Saturday, 26 November 2011, Remco Barendse <mailscanner@barendse.to> wrote: > > Hi Martin! > > > > I installed clamav from rpmforge so it will autoupdate. > > > > Should i install clamav separately or mail-clamav? > > > > Cheers > > > > On Sat, 26 Nov 2011, Martin Hepworth wrote: > > > >> install clamav independenlynot a big job and you'll get a later version too. > >> > >> -- > >> Martin Hepworth > >> Oxford, UK > >> > >> > >> On 26 November 2011 03:25, Remco Barendse <mailscanner@barendse.to> wrote: > >> ? ? ?Hi list, > >> > >> ? ? ?I am trying to upgrade some boxes to Scientific Linux 6.1 (a RHEL6 rebuild). When installing mailscanner and the clam/spamass packages not all the perl > >> ? ? ?modules will build. Most that wouldn't build (perl-Time-HiRes perl-Encode-Detect perl-Mail-SPF-Query perl-Mail-DKIM perl-Module-Build > >> ? ? ?perl-Net-DNS-Resolver-Programmable) i found in the rpmforge repo. > >> > >> ? ? ?It seems however that Mail-ClamAV from install-Clam-0.96.5-SA-3.3.1 also doesn't want to build, when installing i get the output below. ?I thought it > >> ? ? ?was missing lbzip2 but when i installed that, it still did not build. > >> > >> ? ? ?Where am i going wrong? > >> > >> ? ? ?Thanks! > >> > >> > >> > >> ? ? ?/usr/bin/ld: cannot find -lbz2 > >> ? ? ?collect2: ld returned 1 exit status > >> ? ? ?make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 > >> ? ? ?make[1]: Leaving directory `/tmp/Mail-ClamAV-0.29/_Inline/build/Mail/ClamAV' > >> > >> ? ? ?A problem was encountered while attempting to compile and install your Inline > >> ? ? ?C code. The command that failed was: > >> ? ? ??make > >> > >> ? ? ?The build directory was: > >> ? ? ?/tmp/Mail-ClamAV-0.29/_Inline/build/Mail/ClamAV > >> > >> ? ? ?To debug the problem, cd to the build directory, and inspect the output files. > >> > >> ? ? ??at /tmp/Mail-ClamAV-0.29/blib/lib/Mail/ClamAV.pm line 162 > >> ? ? ?BEGIN failed--compilation aborted at /tmp/Mail-ClamAV-0.29/blib/lib/Mail/ClamAV.pm line 556. > >> ? ? ?Compilation failed in require. > >> ? ? ?BEGIN failed--compilation aborted. > >> ? ? ?make: *** [ClamAV.inl] Error 25 > >> > >> ? ? ?-- > >> ? ? ?MailScanner mailing list > >> ? ? ?mailscanner@lists.mailscanner.info > >> ? ? ?http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> ? ? ?Before posting, read http://wiki.mailscanner.info/posting > >> > >> ? ? ?Support MailScanner development - buy the book off the website! > >> > >> > >> > > > > -- > -- > Martin Hepworth > Oxford, UK > > From bonivart at opencsw.org Sat Nov 26 19:23:28 2011 From: bonivart at opencsw.org (Peter Bonivart) Date: Sat Nov 26 19:23:58 2011 Subject: Mail-ClamAV-0.29 doesn't build In-Reply-To: <alpine.LRH.2.02.1111262006450.23305@raveon.vaag.nu> References: <alpine.LRH.2.02.1111260419520.23305@raveon.vaag.nu> <CAGDKorJfb0h_VASBV73gNwXX8GWPp5XqfxLcoEcdqJMUetmVBg@mail.gmail.com> <alpine.LRH.2.02.1111261032460.23305@raveon.vaag.nu> <CAGDKor+7LFq2YUJyT7CsPWHt530Z1QjqzCpyByS-Yc3iu_kLjw@mail.gmail.com> <alpine.LRH.2.02.1111262006450.23305@raveon.vaag.nu> Message-ID: <CABY0g1W4GCZRQLUaUYS+xrvxYqcVhpsVBVwQ0uek=4A1pnGTXw@mail.gmail.com> On Sat, Nov 26, 2011 at 8:07 PM, Remco Barendse <mailscanner@barendse.to> wrote: > OK, great. So basically mail-clamav is not a requirement at all anymore? I don't think anyone has used it for years since clamd is faster and simpler. Once that got supported in MS everyone switched. From ian at chopstixmedia.com Sun Nov 27 17:03:06 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Sun Nov 27 17:03:17 2011 Subject: Problem messages In-Reply-To: <F00554B7-46A9-4098-B9B6-655EC84520E7@chopstixmedia.com> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> <425C78DC-3B3D-4621-8C6B-4B37FF507CEB@chopstixmedia.com> <55ABD5EC-FE1D-4977-8C13-E325678C84BD@fluxlabs.net> <75D198B0-84B9-4700-8D89-00C5961CC64C@chopstixmedia.com> <F00554B7-46A9-4098-B9B6-655EC84520E7@chopstixmedia.com> Message-ID: <56C93025-B940-40BF-89B6-2835FBF666EB@chopstixmedia.com> Hi, The 'Problem messages' emails continue. Any advice in terms of debugging MailScanner would be appreciated. Thanks, -- Ian On 15 Nov 2011, at 15:02, Ian Fenn wrote: > Hi, > > The 'Problem messages' emails continue, with contents such as: > > Archive: > > Number of messages: 22 > > Tries Message Last Tried > ===== ======= ========== > 6 pAE4lrZN010803 Mon Nov 14 05:13:23 2011 > 6 pADJflCP031936 Sun Nov 13 20:06:43 2011 > 6 pAD3MhUW025210 Sun Nov 13 03:44:50 2011 > 6 pACEssSh008313 Sat Nov 12 15:17:40 2011 > 6 pABBNB5X031529 Fri Nov 11 11:45:59 2011 > 6 pABBKG1f031450 Fri Nov 11 11:42:52 2011 > 6 pA8HDRnn014756 Tue Nov 8 17:35:30 2011 > 6 pA8AP2if000638 Tue Nov 8 10:46:47 2011 > 6 pA7MIJ2b017305 Mon Nov 7 22:45:57 2011 > 6 pA7HccgC008382 Mon Nov 7 17:59:29 2011 > 6 pA7CZ7Uo028612 Mon Nov 7 12:59:45 2011 > 6 pA7ARPAk024273 Mon Nov 7 10:50:58 2011 > 6 pA78VtIh020893 Mon Nov 7 08:52:35 2011 > 6 pA70d9Gj009491 Mon Nov 7 01:03:26 2011 > 6 pA6MVJo2006339 Sun Nov 6 22:53:25 2011 > 6 pA6CDoqs021135 Sun Nov 6 12:43:24 2011 > 6 pA6A9vUo018102 Sun Nov 6 10:31:34 2011 > 6 pA5NNIlU017875 Sat Nov 5 23:48:11 2011 > 6 pA5M9VvO015601 Sat Nov 5 22:35:51 2011 > 6 pA5M32NB015188 Sat Nov 5 22:32:34 2011 > 6 pA5AKK8i011598 Sat Nov 5 10:41:21 2011 > 6 pA4LurOv027214 Fri Nov 4 22:25:04 2011 > > Anybody have any thoughts on how I can debug this? > > Many thanks, > > -- > Ian > > On 5 Nov 2011, at 18:04, Ian Fenn wrote: > >> On 5 Nov 2011, at 15:34, Jeremy McSpadden wrote: >>> I'm going to assume its a perl taint issue. Add -U -X to the MailScanner # line >> >> I did that, and restarted MailScanner. However, the problem message emails continue. :-/ >> >> All the best, >> >> -- >> Ian > From glenn.steen at gmail.com Sun Nov 27 20:44:50 2011 From: glenn.steen at gmail.com (Glenn Steen) Date: Sun Nov 27 20:45:00 2011 Subject: Mail-ClamAV-0.29 doesn't build In-Reply-To: <CABY0g1W4GCZRQLUaUYS+xrvxYqcVhpsVBVwQ0uek=4A1pnGTXw@mail.gmail.com> References: <alpine.LRH.2.02.1111260419520.23305@raveon.vaag.nu> <CAGDKorJfb0h_VASBV73gNwXX8GWPp5XqfxLcoEcdqJMUetmVBg@mail.gmail.com> <alpine.LRH.2.02.1111261032460.23305@raveon.vaag.nu> <CAGDKor+7LFq2YUJyT7CsPWHt530Z1QjqzCpyByS-Yc3iu_kLjw@mail.gmail.com> <alpine.LRH.2.02.1111262006450.23305@raveon.vaag.nu> <CABY0g1W4GCZRQLUaUYS+xrvxYqcVhpsVBVwQ0uek=4A1pnGTXw@mail.gmail.com> Message-ID: <CAAug_B9HxoaaeV7wUheybJHP1P4qGRfqyQXHR_VbcTvMKUYeAg@mail.gmail.com> Actually... The speed advantage for actual scans was relatively minor, but the decrease in memory footprint (and restart time) was huge. Loading the once for the clamd server simply was far superior to Mail::ClamAV (load once/child at every restart) and clamav/clamscan (load once/batch)... And lacked the semiproblematic upgrades of Mail::ClamAV. Hence clamd is effectively the only recomended ClamAV implementation for MailScanner these days. Cheers! Den 26 nov 2011 20:29 skrev "Peter Bonivart" <bonivart@opencsw.org>: > On Sat, Nov 26, 2011 at 8:07 PM, Remco Barendse <mailscanner@barendse.to> > wrote: > > OK, great. So basically mail-clamav is not a requirement at all anymore? > > I don't think anyone has used it for years since clamd is faster and > simpler. Once that got supported in MS everyone switched. > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111127/cde07a0b/attachment.html From stephencoxmail at gmail.com Mon Nov 28 06:57:32 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Mon Nov 28 06:57:43 2011 Subject: Insecure dependency: what is it? In-Reply-To: <CAAug_B-1u77Qtms1CxSfM-CKFt_XWd-LdX=RQsv+UKtrNf1xow@mail.gmail.com> References: <20111103225844.GA11302@ubuntu> <CAAug_B-1u77Qtms1CxSfM-CKFt_XWd-LdX=RQsv+UKtrNf1xow@mail.gmail.com> Message-ID: <CAMgku6Q74cM2--kZf2HvLqUXTHFWhYuQs7cjUj2g8QF0MbXS=A@mail.gmail.com> On Fri, Nov 4, 2011 at 5:34 PM, Glenn Steen <glenn.steen@gmail.com> wrote: > Very likely a permission problem, fix it and you'll be good. > Also, you may have a corrupt message/file in the hold directory, creating > the initial problem, or a taint problem. > > Den 4 nov 2011 00:16 skrev "Alessandro Dentella" <sandro@e-den.it>: >> >> Hi, >> >> >> while trying to debug the setup I wrote about yesterday I realized that >> /var/log/syslog contains some messages as:: >> >> ? ?MailScanner: Process did not exit cleanly, returned 2 with signal 0 >> >> running with Debug = yes and Debug SpamAssassing = yes MS dies with:: >> >> >> 23:48:46 Nov ?3 23:48:46.397 [14687] dbg: check: >> tests=MISSING_DATE,MISSING_HEADERS,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS >> 23:48:46 Nov ?3 23:48:46.397 [14687] dbg: check: >> subtests=__GATED_THROUGH_RCVD_REMOVER,__HAS_MESSAGE_ID,__HAS_MSGID,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__TO_NO_ARROWS_R,__UNUSABLE_MSGID >> 23:48:46 Nov ?3 23:48:46.398 [14687] dbg: plugin: >> Mail::SpamAssassin::Plugin::Bayes=HASH(0xa5b1a48) implements >> 'learner_close', priority 0 >> 23:48:46 Building a message batch to scan... >> 23:48:46 Insecure dependency in mkdir while running with -T switch at >> /usr/share/MailScanner//MailScanner/Quarantine.pm line 189. >> >> >> The last row is issued while trying to create a directory under >> /var/spool/MailScanner/quadantine. Postfix that is the user MS "Run >> AS". Postfix is able to create such a directory so I don't really >> understand >> what it exacly means. >> >> This error prevents some mail from being processed but after some time >> googling around I wasn't able to understand how to fix it. Any hint is >> really appreciated. >> >> thanks >> sandro >> *:-) >> I have also seen this now. Adding -U -X to MailScanner helped. But it is only a temporary solution. I also saw this mail holding up the queue: http://pastebin.com/sfrDvreB -- Stephen Cox From markus at markusoft.se Mon Nov 28 08:00:04 2011 From: markus at markusoft.se (Markus Nilsson) Date: Mon Nov 28 08:00:24 2011 Subject: Problem messages In-Reply-To: <56C93025-B940-40BF-89B6-2835FBF666EB@chopstixmedia.com> Message-ID: <648d2f08-e425-448b-8098-cdee90f56b83@cronlabworkstation0> ----- Original Message ----- > From: "Ian Fenn" <ian@chopstixmedia.com> > To: "MailScanner discussion" <mailscanner@lists.mailscanner.info> > Sent: s?ndag, 27 nov 2011 18:03:06 > Subject: Re: Problem messages > > Hi, > > The 'Problem messages' emails continue. Any advice in terms of > debugging MailScanner would be appreciated. > > Thanks, Hi! I don't remember the story here, but what did a regular MailScanner --debug run give you with just one of the problem messages in the hold queue? /Markus > > -- > Ian > > On 15 Nov 2011, at 15:02, Ian Fenn wrote: > > > Hi, > > > > The 'Problem messages' emails continue, with contents such as: > > > > Archive: > > > > Number of messages: 22 > > > > Tries Message Last Tried > > ===== ======= ========== > > 6 pAE4lrZN010803 Mon Nov 14 05:13:23 2011 > > 6 pADJflCP031936 Sun Nov 13 20:06:43 2011 > > 6 pAD3MhUW025210 Sun Nov 13 03:44:50 2011 > > 6 pACEssSh008313 Sat Nov 12 15:17:40 2011 > > 6 pABBNB5X031529 Fri Nov 11 11:45:59 2011 > > 6 pABBKG1f031450 Fri Nov 11 11:42:52 2011 > > 6 pA8HDRnn014756 Tue Nov 8 17:35:30 2011 > > 6 pA8AP2if000638 Tue Nov 8 10:46:47 2011 > > 6 pA7MIJ2b017305 Mon Nov 7 22:45:57 2011 > > 6 pA7HccgC008382 Mon Nov 7 17:59:29 2011 > > 6 pA7CZ7Uo028612 Mon Nov 7 12:59:45 2011 > > 6 pA7ARPAk024273 Mon Nov 7 10:50:58 2011 > > 6 pA78VtIh020893 Mon Nov 7 08:52:35 2011 > > 6 pA70d9Gj009491 Mon Nov 7 01:03:26 2011 > > 6 pA6MVJo2006339 Sun Nov 6 22:53:25 2011 > > 6 pA6CDoqs021135 Sun Nov 6 12:43:24 2011 > > 6 pA6A9vUo018102 Sun Nov 6 10:31:34 2011 > > 6 pA5NNIlU017875 Sat Nov 5 23:48:11 2011 > > 6 pA5M9VvO015601 Sat Nov 5 22:35:51 2011 > > 6 pA5M32NB015188 Sat Nov 5 22:32:34 2011 > > 6 pA5AKK8i011598 Sat Nov 5 10:41:21 2011 > > 6 pA4LurOv027214 Fri Nov 4 22:25:04 2011 > > > > Anybody have any thoughts on how I can debug this? > > > > Many thanks, > > > > -- > > Ian > > > > On 5 Nov 2011, at 18:04, Ian Fenn wrote: > > > >> On 5 Nov 2011, at 15:34, Jeremy McSpadden wrote: > >>> I'm going to assume its a perl taint issue. Add -U -X to the > >>> MailScanner # line > >> > >> I did that, and restarted MailScanner. However, the problem > >> message emails continue. :-/ > >> > >> All the best, > >> > >> -- > >> Ian > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > > Bearcom scanned this message. We don't think it was spam. If it was, > please report by copying this link into your browser: > http://message3.bearnet.nu/mail/index.php?id=466BE9E03C.A5C21-&learn=spam&host=212.91.140.42 > > > From jaearick at colby.edu Mon Nov 28 19:24:04 2011 From: jaearick at colby.edu (Jeff Earickson) Date: Mon Nov 28 19:24:40 2011 Subject: Problem messages In-Reply-To: <56C93025-B940-40BF-89B6-2835FBF666EB@chopstixmedia.com> References: <F1B56678-7DE3-4A42-8A6A-6E2C9FD73440@chopstixmedia.com> <5DB45B95-1ED4-4FA5-96A2-5E3B7F919F3A@fluxlabs.net> <06B3B2C1-2E34-4E3A-9FC5-5C78072A468B@chopstixmedia.com> <5FF6613A-0530-4D86-A8B2-AB6FF9170074@fluxlabs.net> <425C78DC-3B3D-4621-8C6B-4B37FF507CEB@chopstixmedia.com> <55ABD5EC-FE1D-4977-8C13-E325678C84BD@fluxlabs.net> <75D198B0-84B9-4700-8D89-00C5961CC64C@chopstixmedia.com> <F00554B7-46A9-4098-B9B6-655EC84520E7@chopstixmedia.com> <56C93025-B940-40BF-89B6-2835FBF666EB@chopstixmedia.com> Message-ID: <CADU1O-2p4L9UH=A793MRgg=Ky9Q0Jeu+xXqFxZEVr8c6FfJY2A@mail.gmail.com> All, This problem continues to plague me too, I have been running with -U on the #! line of the MailScanner perl script for some time now. What would the -X (disable all warnings) option do for us? This problem of MailScanner hanging/looping on a message bites me a couple of times a week. Jeff Earickson Colby College On Sun, Nov 27, 2011 at 12:03 PM, Ian Fenn <ian@chopstixmedia.com> wrote: > Hi, > > The 'Problem messages' emails continue. Any advice in terms of debugging MailScanner would be appreciated. > > Thanks, > > -- > Ian > > On 15 Nov 2011, at 15:02, Ian Fenn wrote: > >> Hi, >> >> The 'Problem messages' emails continue, with contents such as: >> >> Archive: >> >> Number of messages: 22 >> >> Tries Message Last Tried >> ===== ======= ========== >> 6 ? ? pAE4lrZN010803 ?Mon Nov 14 05:13:23 2011 >> 6 ? ? pADJflCP031936 ?Sun Nov 13 20:06:43 2011 >> 6 ? ? pAD3MhUW025210 ?Sun Nov 13 03:44:50 2011 >> 6 ? ? pACEssSh008313 ?Sat Nov 12 15:17:40 2011 >> 6 ? ? pABBNB5X031529 ?Fri Nov 11 11:45:59 2011 >> 6 ? ? pABBKG1f031450 ?Fri Nov 11 11:42:52 2011 >> 6 ? ? pA8HDRnn014756 ?Tue Nov ?8 17:35:30 2011 >> 6 ? ? pA8AP2if000638 ?Tue Nov ?8 10:46:47 2011 >> 6 ? ? pA7MIJ2b017305 ?Mon Nov ?7 22:45:57 2011 >> 6 ? ? pA7HccgC008382 ?Mon Nov ?7 17:59:29 2011 >> 6 ? ? pA7CZ7Uo028612 ?Mon Nov ?7 12:59:45 2011 >> 6 ? ? pA7ARPAk024273 ?Mon Nov ?7 10:50:58 2011 >> 6 ? ? pA78VtIh020893 ?Mon Nov ?7 08:52:35 2011 >> 6 ? ? pA70d9Gj009491 ?Mon Nov ?7 01:03:26 2011 >> 6 ? ? pA6MVJo2006339 ?Sun Nov ?6 22:53:25 2011 >> 6 ? ? pA6CDoqs021135 ?Sun Nov ?6 12:43:24 2011 >> 6 ? ? pA6A9vUo018102 ?Sun Nov ?6 10:31:34 2011 >> 6 ? ? pA5NNIlU017875 ?Sat Nov ?5 23:48:11 2011 >> 6 ? ? pA5M9VvO015601 ?Sat Nov ?5 22:35:51 2011 >> 6 ? ? pA5M32NB015188 ?Sat Nov ?5 22:32:34 2011 >> 6 ? ? pA5AKK8i011598 ?Sat Nov ?5 10:41:21 2011 >> 6 ? ? pA4LurOv027214 ?Fri Nov ?4 22:25:04 2011 >> >> Anybody have any thoughts on how I can debug this? >> >> Many thanks, >> >> -- >> Ian >> >> On 5 Nov 2011, at 18:04, Ian Fenn wrote: >> >>> On 5 Nov 2011, at 15:34, Jeremy McSpadden wrote: >>>> I'm going to assume its a perl taint issue. Add -U -X to the MailScanner # line >>> >>> I did that, and restarted MailScanner. However, the problem message emails continue. :-/ >>> >>> All the best, >>> >>> -- >>> Ian >> > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From stephencoxmail at gmail.com Tue Nov 29 05:27:43 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Tue Nov 29 05:27:53 2011 Subject: Insecure dependency: what is it? In-Reply-To: <CAAug_B-1u77Qtms1CxSfM-CKFt_XWd-LdX=RQsv+UKtrNf1xow@mail.gmail.com> References: <20111103225844.GA11302@ubuntu> <CAAug_B-1u77Qtms1CxSfM-CKFt_XWd-LdX=RQsv+UKtrNf1xow@mail.gmail.com> Message-ID: <CAMgku6QHkhben8tnLSQpkDCeXSuAH-8CWwiZL5kFNyS8ADSyGw@mail.gmail.com> On Fri, Nov 4, 2011 at 5:34 PM, Glenn Steen <glenn.steen@gmail.com> wrote: > Very likely a permission problem, fix it and you'll be good. > Also, you may have a corrupt message/file in the hold directory, creating > the initial problem, or a taint problem. > > Den 4 nov 2011 00:16 skrev "Alessandro Dentella" <sandro@e-den.it>: > >> Hi, >> >> >> while trying to debug the setup I wrote about yesterday I realized that >> /var/log/syslog contains some messages as:: >> >> ? ?MailScanner: Process did not exit cleanly, returned 2 with signal 0 >> >> running with Debug = yes and Debug SpamAssassing = yes MS dies with:: >> >> >> 23:48:46 Nov ?3 23:48:46.397 [14687] dbg: check: >> tests=MISSING_DATE,MISSING_HEADERS,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS >> 23:48:46 Nov ?3 23:48:46.397 [14687] dbg: check: >> subtests=__GATED_THROUGH_RCVD_REMOVER,__HAS_MESSAGE_ID,__HAS_MSGID,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__TO_NO_ARROWS_R,__UNUSABLE_MSGID >> 23:48:46 Nov ?3 23:48:46.398 [14687] dbg: plugin: >> Mail::SpamAssassin::Plugin::Bayes=HASH(0xa5b1a48) implements >> 'learner_close', priority 0 >> 23:48:46 Building a message batch to scan... >> 23:48:46 Insecure dependency in mkdir while running with -T switch at >> /usr/share/MailScanner//MailScanner/Quarantine.pm line 189. >> >> >> The last row is issued while trying to create a directory under >> /var/spool/MailScanner/quadantine. Postfix that is the user MS "Run >> AS". Postfix is able to create such a directory so I don't really >> understand >> what it exacly means. >> >> This error prevents some mail from being processed but after some time >> googling around I wasn't able to understand how to fix it. Any hint is >> really appreciated. >> >> thanks >> sandro >> *:-) I have also seen this now. Adding -U -X to MailScanner helped. But it is only a temporary solution. I also saw this mail holding up the queue: http://pastebin.com/sfrDvreB -- Stephen Cox From markus at markusoft.se Tue Nov 29 09:06:30 2011 From: markus at markusoft.se (Markus Nilsson) Date: Tue Nov 29 09:06:54 2011 Subject: Problem messages In-Reply-To: <CADU1O-2p4L9UH=A793MRgg=Ky9Q0Jeu+xXqFxZEVr8c6FfJY2A@mail.gmail.com> Message-ID: <4337352d-85e5-4695-948f-63b0e90b4452@cronlabworkstation0> > All, > > This problem continues to plague me too, I have been running with -U > on the #! line of the MailScanner perl script for some time now. > What > would the -X (disable all warnings) option do for us? This problem > of > MailScanner hanging/looping on a message bites me a couple of times a > week. > > Jeff Earickson > Colby College > Have you been able to do a debug run on only one of these messages? /Markus > > > On Sun, Nov 27, 2011 at 12:03 PM, Ian Fenn <ian@chopstixmedia.com> > wrote: > > Hi, > > > > The 'Problem messages' emails continue. Any advice in terms of > > debugging MailScanner would be appreciated. > > > > Thanks, > > > > -- > > Ian > > > > On 15 Nov 2011, at 15:02, Ian Fenn wrote: > > > >> Hi, > >> > >> The 'Problem messages' emails continue, with contents such as: > >> > >> Archive: > >> > >> Number of messages: 22 > >> > >> Tries Message Last Tried > >> ===== ======= ========== > >> 6 ? ? pAE4lrZN010803 ?Mon Nov 14 05:13:23 2011 > >> 6 ? ? pADJflCP031936 ?Sun Nov 13 20:06:43 2011 > >> 6 ? ? pAD3MhUW025210 ?Sun Nov 13 03:44:50 2011 > >> 6 ? ? pACEssSh008313 ?Sat Nov 12 15:17:40 2011 > >> 6 ? ? pABBNB5X031529 ?Fri Nov 11 11:45:59 2011 > >> 6 ? ? pABBKG1f031450 ?Fri Nov 11 11:42:52 2011 > >> 6 ? ? pA8HDRnn014756 ?Tue Nov ?8 17:35:30 2011 > >> 6 ? ? pA8AP2if000638 ?Tue Nov ?8 10:46:47 2011 > >> 6 ? ? pA7MIJ2b017305 ?Mon Nov ?7 22:45:57 2011 > >> 6 ? ? pA7HccgC008382 ?Mon Nov ?7 17:59:29 2011 > >> 6 ? ? pA7CZ7Uo028612 ?Mon Nov ?7 12:59:45 2011 > >> 6 ? ? pA7ARPAk024273 ?Mon Nov ?7 10:50:58 2011 > >> 6 ? ? pA78VtIh020893 ?Mon Nov ?7 08:52:35 2011 > >> 6 ? ? pA70d9Gj009491 ?Mon Nov ?7 01:03:26 2011 > >> 6 ? ? pA6MVJo2006339 ?Sun Nov ?6 22:53:25 2011 > >> 6 ? ? pA6CDoqs021135 ?Sun Nov ?6 12:43:24 2011 > >> 6 ? ? pA6A9vUo018102 ?Sun Nov ?6 10:31:34 2011 > >> 6 ? ? pA5NNIlU017875 ?Sat Nov ?5 23:48:11 2011 > >> 6 ? ? pA5M9VvO015601 ?Sat Nov ?5 22:35:51 2011 > >> 6 ? ? pA5M32NB015188 ?Sat Nov ?5 22:32:34 2011 > >> 6 ? ? pA5AKK8i011598 ?Sat Nov ?5 10:41:21 2011 > >> 6 ? ? pA4LurOv027214 ?Fri Nov ?4 22:25:04 2011 > >> > >> Anybody have any thoughts on how I can debug this? > >> > >> Many thanks, > >> > >> -- > >> Ian > >> > >> On 5 Nov 2011, at 18:04, Ian Fenn wrote: > >> > >>> On 5 Nov 2011, at 15:34, Jeremy McSpadden wrote: > >>>> I'm going to assume its a perl taint issue. Add -U -X to the > >>>> MailScanner # line > >>> > >>> I did that, and restarted MailScanner. However, the problem > >>> message emails continue. :-/ > >>> > >>> All the best, > >>> > >>> -- > >>> Ian > >> > > > > -- > > MailScanner mailing list > > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -- > > Bearcom scanned this message. We don't think it was spam. If it was, > please report by copying this link into your browser: > http://message3.bearnet.nu/mail/index.php?id=7C2DC9E127.A5CE8-&learn=spam&host=212.91.140.42 > > > From jaearick at colby.edu Tue Nov 29 16:15:31 2011 From: jaearick at colby.edu (Jeff Earickson) Date: Tue Nov 29 16:16:03 2011 Subject: Problem messages In-Reply-To: <4337352d-85e5-4695-948f-63b0e90b4452@cronlabworkstation0> References: <CADU1O-2p4L9UH=A793MRgg=Ky9Q0Jeu+xXqFxZEVr8c6FfJY2A@mail.gmail.com> <4337352d-85e5-4695-948f-63b0e90b4452@cronlabworkstation0> Message-ID: <CADU1O-2tepERukXF9vfnVpZc_bE4CNc4dL-1WDomo_sER_sp1Q@mail.gmail.com> Nope, I haven't found a message that I can reproduce this with. :( ----------------------------------- Jeff A. Earickson, Ph.D Senior Server System Administrator Colby College, 4214 Mayflower Hill, Waterville ME, 04901-8842 207-859-4214 (fax 207-859-4186) Eastern Time Zone, USA ----------------------------------- On Tue, Nov 29, 2011 at 4:06 AM, Markus Nilsson <markus@markusoft.se> wrote: > >> All, >> >> This problem continues to plague me too, I have been running with -U >> on the #! line of the MailScanner perl script for some time now. >> ?What >> would the -X (disable all warnings) option do for us? ?This problem >> of >> MailScanner hanging/looping on a message bites me a couple of times a >> week. >> >> Jeff Earickson >> Colby College >> > > Have you been able to do a debug run on only one of these messages? > > /Markus > >> >> >> On Sun, Nov 27, 2011 at 12:03 PM, Ian Fenn <ian@chopstixmedia.com> >> wrote: >> > Hi, >> > >> > The 'Problem messages' emails continue. Any advice in terms of >> > debugging MailScanner would be appreciated. >> > >> > Thanks, >> > >> > -- >> > Ian >> > >> > On 15 Nov 2011, at 15:02, Ian Fenn wrote: >> > >> >> Hi, >> >> >> >> The 'Problem messages' emails continue, with contents such as: >> >> >> >> Archive: >> >> >> >> Number of messages: 22 >> >> >> >> Tries Message Last Tried >> >> ===== ======= ========== >> >> 6 ? ? pAE4lrZN010803 ?Mon Nov 14 05:13:23 2011 >> >> 6 ? ? pADJflCP031936 ?Sun Nov 13 20:06:43 2011 >> >> 6 ? ? pAD3MhUW025210 ?Sun Nov 13 03:44:50 2011 >> >> 6 ? ? pACEssSh008313 ?Sat Nov 12 15:17:40 2011 >> >> 6 ? ? pABBNB5X031529 ?Fri Nov 11 11:45:59 2011 >> >> 6 ? ? pABBKG1f031450 ?Fri Nov 11 11:42:52 2011 >> >> 6 ? ? pA8HDRnn014756 ?Tue Nov ?8 17:35:30 2011 >> >> 6 ? ? pA8AP2if000638 ?Tue Nov ?8 10:46:47 2011 >> >> 6 ? ? pA7MIJ2b017305 ?Mon Nov ?7 22:45:57 2011 >> >> 6 ? ? pA7HccgC008382 ?Mon Nov ?7 17:59:29 2011 >> >> 6 ? ? pA7CZ7Uo028612 ?Mon Nov ?7 12:59:45 2011 >> >> 6 ? ? pA7ARPAk024273 ?Mon Nov ?7 10:50:58 2011 >> >> 6 ? ? pA78VtIh020893 ?Mon Nov ?7 08:52:35 2011 >> >> 6 ? ? pA70d9Gj009491 ?Mon Nov ?7 01:03:26 2011 >> >> 6 ? ? pA6MVJo2006339 ?Sun Nov ?6 22:53:25 2011 >> >> 6 ? ? pA6CDoqs021135 ?Sun Nov ?6 12:43:24 2011 >> >> 6 ? ? pA6A9vUo018102 ?Sun Nov ?6 10:31:34 2011 >> >> 6 ? ? pA5NNIlU017875 ?Sat Nov ?5 23:48:11 2011 >> >> 6 ? ? pA5M9VvO015601 ?Sat Nov ?5 22:35:51 2011 >> >> 6 ? ? pA5M32NB015188 ?Sat Nov ?5 22:32:34 2011 >> >> 6 ? ? pA5AKK8i011598 ?Sat Nov ?5 10:41:21 2011 >> >> 6 ? ? pA4LurOv027214 ?Fri Nov ?4 22:25:04 2011 >> >> >> >> Anybody have any thoughts on how I can debug this? >> >> >> >> Many thanks, >> >> >> >> -- >> >> Ian >> >> >> >> On 5 Nov 2011, at 18:04, Ian Fenn wrote: >> >> >> >>> On 5 Nov 2011, at 15:34, Jeremy McSpadden wrote: >> >>>> I'm going to assume its a perl taint issue. Add -U -X to the >> >>>> MailScanner # line >> >>> >> >>> I did that, and restarted MailScanner. However, the problem >> >>> message emails continue. :-/ >> >>> >> >>> All the best, >> >>> >> >>> -- >> >>> Ian >> >> >> > >> > -- >> > MailScanner mailing list >> > mailscanner@lists.mailscanner.info >> > http://lists.mailscanner.info/mailman/listinfo/mailscanner >> > >> > Before posting, read http://wiki.mailscanner.info/posting >> > >> > Support MailScanner development - buy the book off the website! >> > >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> >> Bearcom scanned this message. We don't think it was spam. If it was, >> please report by copying this link into your browser: >> http://message3.bearnet.nu/mail/index.php?id=7C2DC9E127.A5CE8-&learn=spam&host=212.91.140.42 >> >> >> > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From ian at chopstixmedia.com Tue Nov 29 16:38:40 2011 From: ian at chopstixmedia.com (Ian Fenn) Date: Tue Nov 29 16:38:51 2011 Subject: Problem messages In-Reply-To: <CADU1O-2tepERukXF9vfnVpZc_bE4CNc4dL-1WDomo_sER_sp1Q@mail.gmail.com> References: <CADU1O-2p4L9UH=A793MRgg=Ky9Q0Jeu+xXqFxZEVr8c6FfJY2A@mail.gmail.com> <4337352d-85e5-4695-948f-63b0e90b4452@cronlabworkstation0> <CADU1O-2tepERukXF9vfnVpZc_bE4CNc4dL-1WDomo_sER_sp1Q@mail.gmail.com> Message-ID: <C6338AD0-53E0-4AEA-A662-9DB6F1DCD2D1@chopstixmedia.com> On 29 Nov 2011, at 16:15, Jeff Earickson wrote: > Nope, I haven't found a message that I can reproduce this with. :( Same here. -- Ian From stephencoxmail at gmail.com Tue Nov 29 19:30:11 2011 From: stephencoxmail at gmail.com (Stephen Cox) Date: Tue Nov 29 19:30:20 2011 Subject: Problem messages In-Reply-To: <C6338AD0-53E0-4AEA-A662-9DB6F1DCD2D1@chopstixmedia.com> References: <CADU1O-2p4L9UH=A793MRgg=Ky9Q0Jeu+xXqFxZEVr8c6FfJY2A@mail.gmail.com> <4337352d-85e5-4695-948f-63b0e90b4452@cronlabworkstation0> <CADU1O-2tepERukXF9vfnVpZc_bE4CNc4dL-1WDomo_sER_sp1Q@mail.gmail.com> <C6338AD0-53E0-4AEA-A662-9DB6F1DCD2D1@chopstixmedia.com> Message-ID: <CAMgku6RhSpGV4ZS4=C0Wz4XwQavKv6q6eUGah+0Ref42rn=mSA@mail.gmail.com> On Tue, Nov 29, 2011 at 6:38 PM, Ian Fenn <ian@chopstixmedia.com> wrote: > On 29 Nov 2011, at 16:15, Jeff Earickson wrote: >> Nope, I haven't found a message that I can reproduce this with. ?:( > > Same here. > > -- > Ian > -- This message, http://pastebin.com/sfrDvreB, broke my mailscanner. -- Stephen Cox From sonidhaval at gmail.com Wed Nov 30 06:39:29 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Wed Nov 30 06:40:21 2011 Subject: How to allow winmail.dat attachments in MailScanner Message-ID: <CAPPibPijyYQxFyQe64in=OuogDMF=dnq8CB30+HisKczb_-vBw@mail.gmail.com> Hello, Emails are getting blocked which are having winmail.dat attachment. How to allow it from MailScanner. I read couple of articles on google but not working for me. Thank you, -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111130/1fbb238b/attachment.html From markus at markusoft.se Wed Nov 30 07:45:00 2011 From: markus at markusoft.se (Markus Nilsson) Date: Wed Nov 30 07:45:13 2011 Subject: Problem messages In-Reply-To: <CAMgku6RhSpGV4ZS4=C0Wz4XwQavKv6q6eUGah+0Ref42rn=mSA@mail.gmail.com> Message-ID: <43cf2fc8-4586-42dd-921a-4cc7be7536b0@cronlabworkstation0> > > On Tue, Nov 29, 2011 at 6:38 PM, Ian Fenn <ian@chopstixmedia.com> > wrote: > > On 29 Nov 2011, at 16:15, Jeff Earickson wrote: > >> Nope, I haven't found a message that I can reproduce this with. > >> ?:( > > > > Same here. > > > > -- > > Ian > > -- > > This message, http://pastebin.com/sfrDvreB, broke my mailscanner. > > -- Then it seems we might have a candidate to run a debug run on! Ian or Jeff, are you able to to run this message through your setup with the debug-flag to see? /Markus From bonivart at opencsw.org Wed Nov 30 08:34:43 2011 From: bonivart at opencsw.org (Peter Bonivart) Date: Wed Nov 30 08:35:13 2011 Subject: How to allow winmail.dat attachments in MailScanner In-Reply-To: <CAPPibPijyYQxFyQe64in=OuogDMF=dnq8CB30+HisKczb_-vBw@mail.gmail.com> References: <CAPPibPijyYQxFyQe64in=OuogDMF=dnq8CB30+HisKczb_-vBw@mail.gmail.com> Message-ID: <CABY0g1U9AFuyj-SdS9R_4SVXLM5qE91r8uO9XufD9d8XaHPYtA@mail.gmail.com> On Wed, Nov 30, 2011 at 7:39 AM, sonidhaval@gmail.com <sonidhaval@gmail.com> wrote: > Hello, > > Emails are getting blocked which are having winmail.dat attachment. > > How to allow it from MailScanner. I read couple of articles on google but > not working for me. MailScanner.conf: Use TNEF Contents = no From Nikolaos.Pavlidis at beds.ac.uk Wed Nov 30 09:37:19 2011 From: Nikolaos.Pavlidis at beds.ac.uk (Nikolaos Pavlidis) Date: Wed Nov 30 09:37:36 2011 Subject: Numeric Phishing Ruleset Message-ID: <4ED5F94F0200002700082CB7@gwia2.beds.ac.uk> Hello all, I was reading http://www.mailscanner.info/MailScanner.conf.index.html#Also%20Find%20Numeric%20Phishing and I am not sure how that ruleset would be if I would it to ignore specific IP URLs or even specific sources from getting tagged. Any help would be much appreciated. Kind regards, Nik -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111130/b81e4435/attachment.html From markus at markusoft.se Wed Nov 30 09:55:55 2011 From: markus at markusoft.se (Markus Nilsson) Date: Wed Nov 30 09:56:12 2011 Subject: Numeric Phishing Ruleset In-Reply-To: <4ED5F94F0200002700082CB7@gwia2.beds.ac.uk> Message-ID: <0d6c722a-c176-4456-9ccd-ddbe2e078bcc@cronlabworkstation0> ----- Original Message ----- > From: "Nikolaos Pavlidis" <Nikolaos.Pavlidis@beds.ac.uk> > To: "MailScanner discussion" <mailscanner@lists.mailscanner.info> > Sent: onsdag, 30 nov 2011 10:37:19 > Subject: Numeric Phishing Ruleset > Hello all, > I was reading > http://www.mailscanner.info/MailScanner.conf.index.html#Also%20Find%20Numeric%20Phishing > and I am not sure how that ruleset would be if I would it to ignore > specific IP URLs or even specific sources from getting tagged. Any > help would be much appreciated. I made a patch to be able to whitelist IP numbers in the phishing safe list, this is partly what you are after I guess. You can see my patch here: http://lists.mailscanner.info/pipermail/mailscanner/2011-June/098059.html This plugin makes it possible to add (simple) nets to the safe list e.g. 192.168.0.0/16 /Markus -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111130/8c3a7814/attachment.html From sonidhaval at gmail.com Wed Nov 30 10:55:18 2011 From: sonidhaval at gmail.com (sonidhaval@gmail.com) Date: Wed Nov 30 10:56:07 2011 Subject: How to allow winmail.dat attachments in MailScanner In-Reply-To: <CABY0g1U9AFuyj-SdS9R_4SVXLM5qE91r8uO9XufD9d8XaHPYtA@mail.gmail.com> References: <CAPPibPijyYQxFyQe64in=OuogDMF=dnq8CB30+HisKczb_-vBw@mail.gmail.com> <CABY0g1U9AFuyj-SdS9R_4SVXLM5qE91r8uO9XufD9d8XaHPYtA@mail.gmail.com> Message-ID: <CAPPibPije2sPmbPRq4kWfNt4E1itKcCeKHwqrugOz0LguT-qOg@mail.gmail.com> Solved. Thanks. On Wed, Nov 30, 2011 at 2:04 PM, Peter Bonivart <bonivart@opencsw.org>wrote: > On Wed, Nov 30, 2011 at 7:39 AM, sonidhaval@gmail.com > <sonidhaval@gmail.com> wrote: > > Hello, > > > > Emails are getting blocked which are having winmail.dat attachment. > > > > How to allow it from MailScanner. I read couple of articles on google but > > not working for me. > > MailScanner.conf: > > Use TNEF Contents = no > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- Kind regards, Dhaval Soni ( RHCA ) Active Contributor of *LinuxArticles.org* <http://LinuxArticles.org> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20111130/ad788ded/attachment.html