From ms-list at alexb.ch Wed Apr 4 09:29:03 2012 From: ms-list at alexb.ch (Alex Broens) Date: Wed Apr 4 09:29:28 2012 Subject: SA phishing rule: 90_axb_phish.cf Message-ID: <4F7C064F.2050609@alexb.ch> Guys, A retired SARE Ninja is autogenerating SA phishing rules on https://sourceforge.net/projects/sare/. Too bad that atm, the phish corpus is very small so its hit rate will be limited until there's more samples to use for rule generation. If you can contribute with pristine phishing samples on a regular basis, please contact me offlist. Thanks Alex From tomb.stoney at gmail.com Wed Apr 4 10:08:15 2012 From: tomb.stoney at gmail.com (=?ISO-8859-2?Q?Tom=E1=B9_Kurinec?=) Date: Wed Apr 4 10:08:24 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: Message-ID: Nobody can help me? I don't know why is such a thing in mailscanner when nobody knows how to use it? Or? D?a 28. marca 2012 12:38, Tom?? Kurinec nap?sal/a: > Hi all, > > I'm trying to use mailscanner sql configuration capabilities mainly > for custom rulesets and spamassassin, but I can't find out how should > the tables looks like. > Could you be so kind and provide me SQL like this: > CREATE TABLE mailscanner_config ( > ?id int(11) NOT NULL auto_increment, > ?hostname varchar(100) NOT NULL, > ?value varchar(100) NOT NULL, > ?external varchar(100) NOT NULL, > ?options varchar(100) NOT NULL, > ?PRIMARY KEY (id) > ) ENGINE=MyISAM > > I don't know if this is a good table for such a purpose, but you > probably get the idea. > > Thank you very much! > > Tom From andrew at topdog.za.net Wed Apr 4 12:04:26 2012 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Wed Apr 4 12:04:50 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: Message-ID: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> On 04 Apr 2012, at 11:08 AM, Tom?? Kurinec wrote: > Nobody can help me? I don't know why is such a thing in mailscanner > when nobody knows how to use it? Or? Wow what away to ask for help, anyway there is a thread on this list already that provides an example of how you can do it. http://lists.mailscanner.info/pipermail/mailscanner/2012-March/099266.html To get it working however may require further digging on your part, and am not willing to hold anyone's hand. - Andrew -- www.baruwa.org From alex at vidadigital.com.pa Wed Apr 4 13:03:53 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Wed Apr 4 13:04:03 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> Message-ID: http://bit.ly/howtoaskq 2012/4/4 Andrew Colin Kissa : > > On 04 Apr 2012, at 11:08 AM, Tom?? Kurinec wrote: > >> Nobody can help me? I don't know why is such a thing in mailscanner >> when nobody knows how to use it? Or? > > Wow what away to ask for help, anyway there is a thread on this list > already that provides an example of how you can do it. > > http://lists.mailscanner.info/pipermail/mailscanner/2012-March/099266.html > > To get it working however may require further digging on your part, and am > not willing to hold anyone's hand. > > - Andrew > > -- > www.baruwa.org > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From tomb.stoney at gmail.com Wed Apr 4 13:57:33 2012 From: tomb.stoney at gmail.com (=?ISO-8859-2?Q?Tom=E1=B9_Kurinec?=) Date: Wed Apr 4 13:57:43 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> Message-ID: Sorry but I already read http://lists.mailscanner.info/pipermail/mailscanner/2012-March/099266.html and many others and there is nothing helpfull. The links provided there: https://github.com/akissa/baruwa/blob/master/extras/baruwa-mailscanner.conf https://github.com/akissa/baruwa/blob/master/src/baruwa/config/sql/domainsignature.sql It did tells how to use it, but it did not tell which specific tables to create it. The user also writes that he created a config table and nothing happens http://lists.mailscanner.info/pipermail/mailscanner/2012-March/099279.html so I don't see a solution for him too. Sorry, but I don't really know how can this help me. Believe me, I tried many tables, create them by myself, but nothing works. Rulesets are working fine untill I put them in the table. I even manually increase the SQL Serial Number and reload MailScanner, but the rulesets do not work. I don't know who else I should ask. If you think there is some other mailling list which I should ask, I would be glad if you point me to the right direction. I thought that creators of mailscanner would know it. Thank you for your time. Tom D?a 4. apr?la 2012 14:03, Alex Neuman nap?sal/a: > http://bit.ly/howtoaskq > > 2012/4/4 Andrew Colin Kissa : >> >> On 04 Apr 2012, at 11:08 AM, Tom?? Kurinec wrote: >> >>> Nobody can help me? I don't know why is such a thing in mailscanner >>> when nobody knows how to use it? Or? >> >> Wow what away to ask for help, anyway there is a thread on this list >> already that provides an example of how you can do it. >> >> http://lists.mailscanner.info/pipermail/mailscanner/2012-March/099266.html >> >> To get it working however may require further digging on your part, and am >> not willing to hold anyone's hand. >> >> - Andrew >> >> -- >> www.baruwa.org >> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > > -- > > -- > > Alex Neuman van der Hans > Reliant Technologies / Vida Digital > http://vidadigital.com.pa/ > > +507-6781-9505 > +507-832-6725 > +1-440-253-9789?(USA) > > Follow @AlexNeuman on Twitter > http://facebook.com/vidadigital > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From jeremy at fluxlabs.net Wed Apr 4 14:12:31 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Apr 4 14:12:49 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: Message-ID: Try looking at mailwatch ... Maybe their SQL will point you in the right direction. -- Jeremy McSpadden On Mar 28, 2012, at 5:43 AM, "Tom?? Kurinec" wrote: > Hi all, > > I'm trying to use mailscanner sql configuration capabilities mainly > for custom rulesets and spamassassin, but I can't find out how should > the tables looks like. > Could you be so kind and provide me SQL like this: > CREATE TABLE mailscanner_config ( > id int(11) NOT NULL auto_increment, > hostname varchar(100) NOT NULL, > value varchar(100) NOT NULL, > external varchar(100) NOT NULL, > options varchar(100) NOT NULL, > PRIMARY KEY (id) > ) ENGINE=MyISAM > > I don't know if this is a good table for such a purpose, but you > probably get the idea. > > Thank you very much! > > Tom > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From richard at fastnet.co.uk Wed Apr 4 14:40:52 2012 From: richard at fastnet.co.uk (Richard Mealing) Date: Wed Apr 4 14:41:08 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: Message-ID: <1251B5423222C446A299CABAA7B46FF43FC1A3@fn-exchange.fastnet.local> The create.sql script in mailwatch will have all the details you require (just download the latest mailwatch). You should look at the set-up links to mailwatch as to what to change in the mailscanner.conf file. Rich -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: 04 April 2012 14:13 To: MailScanner discussion Cc: mailscanner@lists.mailscanner.info Subject: Re: What tables to create for using SQL capability of MailScanner conf. Try looking at mailwatch ... Maybe their SQL will point you in the right direction. -- Jeremy McSpadden On Mar 28, 2012, at 5:43 AM, "Tom?? Kurinec" wrote: > Hi all, > > I'm trying to use mailscanner sql configuration capabilities mainly > for custom rulesets and spamassassin, but I can't find out how should > the tables looks like. > Could you be so kind and provide me SQL like this: > CREATE TABLE mailscanner_config ( > id int(11) NOT NULL auto_increment, > hostname varchar(100) NOT NULL, > value varchar(100) NOT NULL, > external varchar(100) NOT NULL, > options varchar(100) NOT NULL, > PRIMARY KEY (id) > ) ENGINE=MyISAM > > I don't know if this is a good table for such a purpose, but you > probably get the idea. > > Thank you very much! > > Tom > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From alex at vidadigital.com.pa Wed Apr 4 14:49:44 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Wed Apr 4 14:49:54 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> Message-ID: You should have started with stating what you tried. You could specify what "nothing works" means. You don't give any error messages or logs. You don't say what *has* worked, if anything at all. You might not be even running MS correctly. Instead of blaming the list for your problem, you should be a little more specific so people don't need to guess in order to help you. 2012/4/4 Tom?? Kurinec : > Sorry but I already read > http://lists.mailscanner.info/pipermail/mailscanner/2012-March/099266.html > and many others and there is nothing helpfull. The links provided > there: > https://github.com/akissa/baruwa/blob/master/extras/baruwa-mailscanner.conf > https://github.com/akissa/baruwa/blob/master/src/baruwa/config/sql/domainsignature.sql > > It did tells how to use it, but it did not tell which specific tables > to create it. > > The user also writes that he created a config table and nothing > happens http://lists.mailscanner.info/pipermail/mailscanner/2012-March/099279.html > so I don't see a solution for him too. > > Sorry, but I don't really know how can this help me. Believe me, I > tried many tables, create them by myself, but nothing works. Rulesets > are working fine untill I put them in the table. I even manually > increase the SQL Serial Number and reload MailScanner, but the > rulesets do not work. > > I don't know who else I should ask. If you think there is some other > mailling list which I should ask, I would be glad if you point me to > the right direction. I thought that creators of mailscanner would know > it. > > Thank you for your time. > > Tom > > D?a 4. apr?la 2012 14:03, Alex Neuman nap?sal/a: >> http://bit.ly/howtoaskq >> >> 2012/4/4 Andrew Colin Kissa : >>> >>> On 04 Apr 2012, at 11:08 AM, Tom?? Kurinec wrote: >>> >>>> Nobody can help me? I don't know why is such a thing in mailscanner >>>> when nobody knows how to use it? Or? >>> >>> Wow what away to ask for help, anyway there is a thread on this list >>> already that provides an example of how you can do it. >>> >>> http://lists.mailscanner.info/pipermail/mailscanner/2012-March/099266.html >>> >>> To get it working however may require further digging on your part, and am >>> not willing to hold anyone's hand. >>> >>> - Andrew >>> >>> -- >>> www.baruwa.org >>> >>> >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> >> -- >> >> Alex Neuman van der Hans >> Reliant Technologies / Vida Digital >> http://vidadigital.com.pa/ >> >> +507-6781-9505 >> +507-832-6725 >> +1-440-253-9789?(USA) >> >> Follow @AlexNeuman on Twitter >> http://facebook.com/vidadigital >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From andrew at topdog.za.net Wed Apr 4 15:14:49 2012 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Wed Apr 4 15:15:14 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> Message-ID: <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> On 04 Apr 2012, at 2:57 PM, Tom?? Kurinec wrote: > Sorry, but I don't really know how can this help me. Believe me, I > tried many tables, create them by myself, but nothing works. Rulesets > are working fine untill I put them in the table. I even manually > increase the SQL Serial Number and reload MailScanner, but the > rulesets do not work. > > I don't know who else I should ask. If you think there is some other > mailling list which I should ask, I would be glad if you point me to > the right direction. I thought that creators of mailscanner would know > it. If you RTFM you will find that all you are asking about is explained http://mailscanner.info/MailScanner.conf.index.html#SQL%20Ruleset -- www.baruwa.org From Sampson at p2sol.com Wed Apr 4 16:18:32 2012 From: Sampson at p2sol.com (Sampson, Aaron) Date: Wed Apr 4 16:18:57 2012 Subject: MailWatch / MailScanner issue Message-ID: <4ACB6FBB6E06074DA18D653BD3155A6637D685@COMM1.p2sol.com> I am running Mail Scanner 4.84.5 with postfix, spam assassin and clamd. Everything was working fine until I added Mail watch. I followed the mail watch install guide that I found online and changed the permissions that is instructed. My problem is that when I send out a test e-mail it gets stuck in the postfix/hold folder and Processing causing a looping error that just sends me e-mails to quarantine stating that the e-mail has been moved there due to it attempting to kill Mail Scanner, which causes another e-mail to go out to alert me (postmaster) which gets stuck and the process is repeated. This is a test box so has luck has it I have not messed up a live environment but I am wanting to set this up so that it will be easier for us to view the quarantine e-mails and release any back to the end user. I know that mail watch and mail scanner are supposed to work very well together and I am almost certain that it is a permission issue somewhere. Can anyone offer a suggestion or maybe a better forum for me to post to get this problem solved? Aaron Sampson IT Department -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120404/dedcf6a9/attachment.html From jeremy at fluxlabs.net Wed Apr 4 16:26:13 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Apr 4 16:26:42 2012 Subject: MailWatch / MailScanner issue In-Reply-To: <4ACB6FBB6E06074DA18D653BD3155A6637D685@COMM1.p2sol.com> References: <4ACB6FBB6E06074DA18D653BD3155A6637D685@COMM1.p2sol.com> Message-ID: Is recommend baruwa over mailwatch. -- Jeremy McSpadden On Apr 4, 2012, at 10:25 AM, "Sampson, Aaron" > wrote: I am running Mail Scanner 4.84.5 with postfix, spam assassin and clamd. Everything was working fine until I added Mail watch. I followed the mail watch install guide that I found online and changed the permissions that is instructed. My problem is that when I send out a test e-mail it gets stuck in the postfix/hold folder and Processing causing a looping error that just sends me e-mails to quarantine stating that the e-mail has been moved there due to it attempting to kill Mail Scanner, which causes another e-mail to go out to alert me (postmaster) which gets stuck and the process is repeated. This is a test box so has luck has it I have not messed up a live environment but I am wanting to set this up so that it will be easier for us to view the quarantine e-mails and release any back to the end user. I know that mail watch and mail scanner are supposed to work very well together and I am almost certain that it is a permission issue somewhere. Can anyone offer a suggestion or maybe a better forum for me to post to get this problem solved? Aaron Sampson IT Department -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120404/381daa9e/attachment.html From stef at aoc-uk.com Wed Apr 4 16:36:50 2012 From: stef at aoc-uk.com (Stef Morrell) Date: Wed Apr 4 16:36:36 2012 Subject: MailWatch / MailScanner issue In-Reply-To: References: Message-ID: <201204041536.q34FaRTH018675@safir.blacknight.ie> Have you added a -U to the top line of the main mailscanner script? I found a similar problem in the same environment with a lot of emails claiming to kill mailscanner and it turned out to be a taint issue. Stef ________________________________ From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Sampson, Aaron Sent: 04 April 2012 16:19 To: mailscanner@lists.mailscanner.info Subject: MailWatch / MailScanner issue I am running Mail Scanner 4.84.5 with postfix, spam assassin and clamd. Everything was working fine until I added Mail watch. I followed the mail watch install guide that I found online and changed the permissions that is instructed. My problem is that when I send out a test e-mail it gets stuck in the postfix/hold folder and Processing causing a looping error that just sends me e-mails to quarantine stating that the e-mail has been moved there due to it attempting to kill Mail Scanner, which causes another e-mail to go out to alert me (postmaster) which gets stuck and the process is repeated. This is a test box so has luck has it I have not messed up a live environment but I am wanting to set this up so that it will be easier for us to view the quarantine e-mails and release any back to the end user. I know that mail watch and mail scanner are supposed to work very well together and I am almost certain that it is a permission issue somewhere. Can anyone offer a suggestion or maybe a better forum for me to post to get this problem solved? Aaron Sampson IT Department -- This email has been scanned by the Alpha Omega Computers Ltd MailCrusader for viruses, spam and dangerous content. For more information please visit Alpha Omega Computers Ltd . -- This email has been scanned by the Alpha Omega Computers MailCrusader for viruses, spam and dangerous content. For more information please visit http://www.aoc-uk.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120404/a317e75e/attachment.html From Sampson at p2sol.com Wed Apr 4 17:31:52 2012 From: Sampson at p2sol.com (Sampson, Aaron) Date: Wed Apr 4 17:32:10 2012 Subject: MailWatch / MailScanner issue In-Reply-To: <201204041536.q34FaRTH018675@safir.blacknight.ie> References: <201204041536.q34FaRTH018675@safir.blacknight.ie> Message-ID: <4ACB6FBB6E06074DA18D653BD3155A6637D6DE@COMM1.p2sol.com> Yes I have added the -U to correct the Taint error that we were having which allowed me to get the quarantine folders to work properly. This problem didn't start until I have added Mail watch into the mix, and I am trying to figure out what I messed up lol. Here is the site that I followed to set up mail watch http://mailwatch.sourceforge.net/doku.php?id=mailwatch:documentation:install If you know of a better one I would be willing to wipe this and start over but I don't think that it will need that From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Stef Morrell Sent: Wednesday, April 04, 2012 10:37 AM To: MailScanner discussion Subject: RE: MailWatch / MailScanner issue Have you added a -U to the top line of the main mailscanner script? I found a similar problem in the same environment with a lot of emails claiming to kill mailscanner and it turned out to be a taint issue. Stef ________________________________ From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Sampson, Aaron Sent: 04 April 2012 16:19 To: mailscanner@lists.mailscanner.info Subject: MailWatch / MailScanner issue I am running Mail Scanner 4.84.5 with postfix, spam assassin and clamd. Everything was working fine until I added Mail watch. I followed the mail watch install guide that I found online and changed the permissions that is instructed. My problem is that when I send out a test e-mail it gets stuck in the postfix/hold folder and Processing causing a looping error that just sends me e-mails to quarantine stating that the e-mail has been moved there due to it attempting to kill Mail Scanner, which causes another e-mail to go out to alert me (postmaster) which gets stuck and the process is repeated. This is a test box so has luck has it I have not messed up a live environment but I am wanting to set this up so that it will be easier for us to view the quarantine e-mails and release any back to the end user. I know that mail watch and mail scanner are supposed to work very well together and I am almost certain that it is a permission issue somewhere. Can anyone offer a suggestion or maybe a better forum for me to post to get this problem solved? Aaron Sampson IT Department -- This email has been scanned by the Alpha Omega Computers Ltd MailCrusader for viruses, spam and dangerous content. For more information please visit Alpha Omega Computers Ltd. -- This email has been scanned by the Alpha Omega Computers Ltd MailCrusader for viruses, spam and dangerous content. For more information please visit Alpha Omega Computers Ltd. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120404/1c0e42eb/attachment.html From rcooper at dwford.com Wed Apr 4 18:46:15 2012 From: rcooper at dwford.com (Rick Cooper) Date: Wed Apr 4 18:46:39 2012 Subject: MailWatch / MailScanner issue In-Reply-To: References: <4ACB6FBB6E06074DA18D653BD3155A6637D685@COMM1.p2sol.com> Message-ID: <8BD1F63CE943489AB00FCA47AF482E59@SAHOMELT> First of all with the new development on MailWatch it is *much* improved. Second baruwa is only recommended if you want to install a huge (in my opinion) amount of requisites that have no use for anything in most installations except baruwa. I looked at it and I decided if they needed a soooo many prerequisites I wasn't too impresses with the final product given the bloat. MailWatch is far easier for the average bear to install and requires little in terns of additional programs. Now if I were a huge isp with tens of thousands of users baruwa would be my choice other wise, not a chance. To the OP have you asked in the MailWatch list, I don't recall seeing you there and they would certainly be happy to help you, I don't use postfix so I won't butt in further than the above comments _____ From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: Wednesday, April 04, 2012 11:26 AM To: MailScanner discussion Subject: Re: MailWatch / MailScanner issue Is recommend baruwa over mailwatch. -- Jeremy McSpadden On Apr 4, 2012, at 10:25 AM, "Sampson, Aaron" wrote: I am running Mail Scanner 4.84.5 with postfix, spam assassin and clamd. Everything was working fine until I added Mail watch. I followed the mail watch install guide that I found online and changed the permissions that is instructed. My problem is that when I send out a test e-mail it gets stuck in the postfix/hold folder and Processing causing a looping error that just sends me e-mails to quarantine stating that the e-mail has been moved there due to it attempting to kill Mail Scanner, which causes another e-mail to go out to alert me (postmaster) which gets stuck and the process is repeated. This is a test box so has luck has it I have not messed up a live environment but I am wanting to set this up so that it will be easier for us to view the quarantine e-mails and release any back to the end user. I know that mail watch and mail scanner are supposed to work very well together and I am almost certain that it is a permission issue somewhere. Can anyone offer a suggestion or maybe a better forum for me to post to get this problem solved? Aaron Sampson IT Department -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120404/ab1e177e/attachment.html From tomb.stoney at gmail.com Thu Apr 5 10:53:39 2012 From: tomb.stoney at gmail.com (=?ISO-8859-2?Q?Tom=E1=B9_Kurinec?=) Date: Thu Apr 5 10:53:50 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: Alex, I'm not blaming the list (I don't know how you figured this out) and I'm thankful for any help. I just put the rulesets in the table and the ruleset do not work. When I put the same rule to the file it worked so Mailscanner is configured properly. I had set up the database correctly and the MailScanner connect to it preperly (I did not see any errors when I start mailscanner --debug). Thank you for your responses. I will take a look at the mailwatch and try to create similar tables. I do not know why MailScanner do not have any create.sql file with SQL 'create tables' when Mailwatch have this. It would definitely save me and the others some time for searching the best tables for it. It will take you a little time to write it and save a lot to others. Think about it. Thank you. D?a 4. apr?la 2012 16:14, Andrew Colin Kissa nap?sal/a: > > On 04 Apr 2012, at 2:57 PM, Tom?? Kurinec wrote: > >> Sorry, but I don't really know how can this help me. Believe me, I >> tried many tables, create them by myself, but nothing works. Rulesets >> are working fine untill I put them in the table. I even manually >> increase the SQL Serial Number and reload MailScanner, but the >> rulesets do not work. >> >> I don't know who else I should ask. If you think there is some other >> mailling list which I should ask, I would be glad if you point me to >> the right direction. I thought that creators of mailscanner would know >> it. > > If you RTFM you will find that all you are asking about is explained > http://mailscanner.info/MailScanner.conf.index.html#SQL%20Ruleset > > -- > www.baruwa.org > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From lists at Tatorz.com Thu Apr 5 12:40:56 2012 From: lists at Tatorz.com (Mail Lists) Date: Thu Apr 5 12:41:12 2012 Subject: MailWatch / MailScanner issue In-Reply-To: <4ACB6FBB6E06074DA18D653BD3155A6637D6DE@COMM1.p2sol.com> References: <201204041536.q34FaRTH018675@safir.blacknight.ie> <4ACB6FBB6E06074DA18D653BD3155A6637D6DE@COMM1.p2sol.com> Message-ID: <4F7D84C8.3040103@Tatorz.com> On 04/04/2012 12:31 PM, Sampson, Aaron wrote: > > Yes I have added the --U to correct the Taint error that we were > having which allowed me to get the quarantine folders to work > properly. This problem didn't start until I have added Mail watch > into the mix, and I am trying to figure out what I messed up lol. > Here is the site that I followed to set up mail watch > http://mailwatch.sourceforge.net/doku.php?id=mailwatch:documentation:install > If you know of a better one I would be willing to wipe this and start > over but I don't think that it will need that > That has to be the worst howto I have been over in a long time. It has you all over the place. I too would like a better howto. I am interested in trying out mailwatch. -- Brian ----- Get the latest Fremont, OH Weather http://www.Fremont-OH-Weather.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120405/05a946ab/attachment.html From mailscanner at joolee.nl Thu Apr 5 14:11:20 2012 From: mailscanner at joolee.nl (Joolee) Date: Thu Apr 5 14:12:10 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: Well, if you did read the manual, you'd seen that there is a property called "SQL Debug" you can set to "Yes" to get more information from Mailscanner about the MySQL connection. You tell us MailScanner connected to MySQL properly? In that case, you can tell us what queries your MailScanner sends to MySQL and what answers it receives. How do you know that Mailscanner connects properly and the configured queries give the correct results? 2012/4/5 Tom?? Kurinec : > Alex, I'm not blaming the list (I don't know how you figured this out) > and I'm thankful for any help. I just put the rulesets in the table > and the ruleset do not work. When I put the same rule to the file it > worked so Mailscanner is configured properly. I had set up the > database correctly and the MailScanner connect to it preperly (I did > not see any errors when I start mailscanner --debug). > > Thank you for your responses. I will take a look at the mailwatch and > try to create similar tables. I do not know why MailScanner do not > have any create.sql file with SQL 'create tables' when Mailwatch have > this. It would definitely save me and the others some time for > searching the best tables for it. It will take you a little time to > write it and save a lot to others. Think about it. > > Thank you. > > D?a 4. apr?la 2012 16:14, Andrew Colin Kissa nap?sal/a: >> >> On 04 Apr 2012, at 2:57 PM, Tom?? Kurinec wrote: >> >>> Sorry, but I don't really know how can this help me. Believe me, I >>> tried many tables, create them by myself, but nothing works. Rulesets >>> are working fine untill I put them in the table. I even manually >>> increase the SQL Serial Number and reload MailScanner, but the >>> rulesets do not work. >>> >>> I don't know who else I should ask. If you think there is some other >>> mailling list which I should ask, I would be glad if you point me to >>> the right direction. I thought that creators of mailscanner would know >>> it. >> >> If you RTFM you will find that all you are asking about is explained >> http://mailscanner.info/MailScanner.conf.index.html#SQL%20Ruleset >> >> -- >> www.baruwa.org >> >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From mailscanner at joolee.nl Thu Apr 5 14:16:16 2012 From: mailscanner at joolee.nl (Joolee) Date: Thu Apr 5 14:17:05 2012 Subject: MailWatch / MailScanner issue In-Reply-To: <4F7D84C8.3040103@Tatorz.com> References: <201204041536.q34FaRTH018675@safir.blacknight.ie> <4ACB6FBB6E06074DA18D653BD3155A6637D6DE@COMM1.p2sol.com> <4F7D84C8.3040103@Tatorz.com> Message-ID: http://www.howtoforge.com/the-perfect-spamsnake-ubuntu-jeos-9.10 < Is the tutorial I mentioned. It's not up to date with DCC and Pyzor and I didn't try the Greylist functionality. There are tutorials for newer Ubuntu versions but they use Baruwa. (I personally would follow the newer tutorials and implement Mailscanner the way of the old tut.) On 5 April 2012 13:40, Mail Lists wrote: > On 04/04/2012 12:31 PM, Sampson, Aaron wrote: > > Yes I have added the ?U to correct the Taint error that we were having which > allowed me to get the quarantine folders to work properly.? This problem > didn?t start until I have added Mail watch into the mix, and I am trying to > figure out what I messed up lol.? Here is the site that I followed to set up > mail watch > http://mailwatch.sourceforge.net/doku.php?id=mailwatch:documentation:install > If you know of a better one I would be willing to wipe this and start over > but I don?t think that it will need that > > > ??? That has to be the worst howto I have been over in a long time. It has > you all over > the place. I too would like a better howto. I am interested in trying out > mailwatch. > > -- > Brian ----- Get the latest Fremont, OH Weather > http://www.Fremont-OH-Weather.com > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From bonivart at opencsw.org Thu Apr 5 14:41:07 2012 From: bonivart at opencsw.org (Peter Bonivart) Date: Thu Apr 5 14:41:37 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: On Thu, Apr 5, 2012 at 3:11 PM, Joolee wrote: > Well, if you did read the manual, you'd seen that there is a property > called "SQL Debug" you can set to "Yes" to get more information from > Mailscanner about the MySQL connection. > You tell us MailScanner connected to MySQL properly? In that case, you > can tell us what queries your MailScanner sends to MySQL and what > answers it receives. How do you know that Mailscanner connects > properly and the configured queries give the correct results? What he's asking for is to how to set up the database needed, he even gives an example of what he wants in his first post. Still people just post stuff like RTFM, turn debugging on, read the source, if you don't understand it you shouldn't run it and so on. I have snapped at people too but I have never seen so many feel obliged to reply to this guy without actually helping him the way he wants to be helped. If you can't or won't help him why do feel a need to tell him so? Can't you just ignore his post? If you have figured out how to set up a working database it wouldn't be so hard to dump the structure of it so he could import it. Maybe someone could post it to a wiki and help the next guy out as well. /peter From tomb.stoney at gmail.com Thu Apr 5 15:01:54 2012 From: tomb.stoney at gmail.com (=?ISO-8859-2?Q?Tom=E1=B9_Kurinec?=) Date: Thu Apr 5 15:02:05 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: Oh God THANK YOU Peter!!! You seems to be only one who really got it. I thought it's obvious what I meant, but I was probably wrong. Still I can't figure it out. Please creators of MailScanner the great great, may be the best free mighty tool. Can you write me the table structure that actually works with MailScanner? I'm probably stupid, because I can't get it from the manual. Can you accept my stupidity and write me the table structure? I would be very thankful and may be even donate your great project! Many many thanks. Tom D?a 5.4.2012 15:43, "Peter Bonivart" nap?sal(-a): > On Thu, Apr 5, 2012 at 3:11 PM, Joolee wrote: > > Well, if you did read the manual, you'd seen that there is a property > > called "SQL Debug" you can set to "Yes" to get more information from > > Mailscanner about the MySQL connection. > > You tell us MailScanner connected to MySQL properly? In that case, you > > can tell us what queries your MailScanner sends to MySQL and what > > answers it receives. How do you know that Mailscanner connects > > properly and the configured queries give the correct results? > > What he's asking for is to how to set up the database needed, he even > gives an example of what he wants in his first post. Still people just > post stuff like RTFM, turn debugging on, read the source, if you don't > understand it you shouldn't run it and so on. > > I have snapped at people too but I have never seen so many feel > obliged to reply to this guy without actually helping him the way he > wants to be helped. If you can't or won't help him why do feel a need > to tell him so? Can't you just ignore his post? > > If you have figured out how to set up a working database it wouldn't > be so hard to dump the structure of it so he could import it. Maybe > someone could post it to a wiki and help the next guy out as well. > > /peter > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120405/6da44c9c/attachment.html From campbell at cnpapers.com Thu Apr 5 15:24:56 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Apr 5 15:24:56 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: <4F7DAB38.30409@cnpapers.com> On 4/5/2012 9:41 AM, Peter Bonivart wrote: > What he's asking for is to how to set up the database needed, he even > gives an example of what he wants in his first post. Still people just > post stuff like RTFM, turn debugging on, read the source, if you don't > understand it you shouldn't run it and so on. I have snapped at people > too but I have never seen so many feel obliged to reply to this guy > without actually helping him the way he wants to be helped. If you > can't or won't help him why do feel a need to tell him so? Can't you > just ignore his post? /peter Quite a while back, when the online files were the main source of help and reference, many people would fill the list with such garbage such as what is happening here. And these negative posters were always the first ones to tell you to refer to the online help forum because it had a search lookup that could be used. Of course, when you went to the online forums, and did your search, mostly what you found were these poundings of a user for not using the on line search, and never did they have a solution. If you're going to ridicule people for not being able to find the answer for themselves, perhaps you should consider how you were clueless in the beginning and provide a little information to help them along (and show us how smart you are!). steve campbell From ms-list at alexb.ch Thu Apr 5 15:25:50 2012 From: ms-list at alexb.ch (Alex Broens) Date: Thu Apr 5 15:26:18 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: <4F7DAB6E.9070403@alexb.ch> On 04/05/2012 04:01 PM, Tom?? Kurinec wrote: > Oh God THANK YOU Peter!!! > > You seems to be only one who really got it. I thought it's obvious what I > meant, but I was probably wrong. Still I can't figure it out. > > Please creators of MailScanner the great great, may be the best free mighty > tool. Can you write me the table structure that actually works with > MailScanner? I'm probably stupid, because I can't get it from the manual. > Can you accept my stupidity and write me the table structure? I would be > very thankful and may be even donate your great project! Is everybody listening to the same airwave? MailScanner's SQL stuff has zero to do with Mailwatch's SQL schema. Seems to me Tom is referring to MailScanner's schema. or am I still listening AM radio ? Alex From mikoletic at gmail.com Thu Apr 5 15:38:35 2012 From: mikoletic at gmail.com (Milenko Letic) Date: Thu Apr 5 15:38:44 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: this is structure on my server: Tables_in_mailscanner | +-----------------------+ | audit_log | | blacklist | | geoip_country | | inq | | maillog | | mcp_rules | | mtalog | | outq | | sa_rules | | saved_filters | | spamscores | | user_filters | | users | | whitelist and tables look like this: describe audit_log; +------------+-------------+------+-----+-------------------+-----------------------------+ | Field | Type | Null | Key | Default | Extra | +------------+-------------+------+-----+-------------------+-----------------------------+ | timestamp | timestamp | NO | | CURRENT_TIMESTAMP | on update CURRENT_TIMESTAMP | | user | varchar(20) | NO | | | | | ip_address | varchar(15) | NO | | | | | action | text | NO | | NULL | | +------------+-------------+------+-----+-------------------+-----------------------------+ 4 rows in set (0.08 sec) describe blacklist; +--------------+---------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +--------------+---------+------+-----+---------+----------------+ | id | int(11) | NO | PRI | NULL | auto_increment | | to_address | text | YES | MUL | NULL | | | to_domain | text | YES | | NULL | | | from_address | text | YES | | NULL | | +--------------+---------+------+-----+---------+----------------+ 4 rows in set (0.00 sec) describe geoip_country; +------------------+-------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +------------------+-------------+------+-----+---------+-------+ | begin_ip | varchar(15) | YES | | NULL | | | end_ip | varchar(15) | YES | | NULL | | | begin_num | bigint(20) | YES | MUL | NULL | | | end_num | bigint(20) | YES | MUL | NULL | | | iso_country_code | char(2) | YES | | NULL | | | country | text | YES | | NULL | | +------------------+-------------+------+-----+---------+-------+ 6 rows in set (0.00 sec) describe inq; +--------------+------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +--------------+------+------+-----+---------+-------+ | id | text | YES | | NULL | | | cdate | date | YES | | NULL | | | ctime | time | YES | | NULL | | | from_address | text | YES | | NULL | | | to_address | text | YES | | NULL | | | subject | text | YES | | NULL | | | message | text | YES | | NULL | | | size | text | YES | | NULL | | | priority | text | YES | | NULL | | | attempts | text | YES | | NULL | | | lastattempt | text | YES | | NULL | | | hostname | text | YES | MUL | NULL | | +--------------+------+------+-----+---------+-------+ 12 rows in set (0.00 sec) describe maillog; +-----------------+--------------+------+-----+-------------------+-----------------------------+ | Field | Type | Null | Key | Default | Extra | +-----------------+--------------+------+-----+-------------------+-----------------------------+ | timestamp | timestamp | NO | | CURRENT_TIMESTAMP | on update CURRENT_TIMESTAMP | | id | text | YES | MUL | NULL | | | size | bigint(20) | YES | | 0 | | | from_address | text | YES | MUL | NULL | | | from_domain | text | YES | MUL | NULL | | | to_address | text | YES | MUL | NULL | | | to_domain | text | YES | MUL | NULL | | | subject | text | YES | | NULL | | | clientip | text | YES | MUL | NULL | | | archive | text | YES | | NULL | | | isspam | tinyint(1) | YES | | 0 | | | ishighspam | tinyint(1) | YES | | 0 | | | issaspam | tinyint(1) | YES | | 0 | | | isrblspam | tinyint(1) | YES | | 0 | | | isfp | tinyint(1) | YES | | 0 | | | isfn | tinyint(1) | YES | | 0 | | | spamwhitelisted | tinyint(1) | YES | | 0 | | | spamblacklisted | tinyint(1) | YES | | 0 | | | sascore | decimal(7,2) | YES | | 0.00 | | | spamreport | text | YES | | NULL | | | virusinfected | tinyint(1) | YES | | 0 | | | nameinfected | tinyint(1) | YES | | 0 | | | otherinfected | tinyint(1) | YES | | 0 | | | report | text | YES | | NULL | | | ismcp | tinyint(1) | YES | | 0 | | | ishighmcp | tinyint(1) | YES | | 0 | | | issamcp | tinyint(1) | YES | | 0 | | | mcpwhitelisted | tinyint(1) | YES | | 0 | | | mcpblacklisted | tinyint(1) | YES | | 0 | | | mcpsascore | decimal(7,2) | YES | | 0.00 | | | mcpreport | text | YES | | NULL | | | hostname | text | YES | MUL | NULL | | | date | date | YES | MUL | NULL | | | time | time | YES | | NULL | | | headers | text | YES | | NULL | | | quarantined | tinyint(1) | YES | MUL | 0 | | +-----------------+--------------+------+-----+-------------------+-----------------------------+ 36 rows in set (0.01 sec) describe mtalog; +-----------+-------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +-----------+-------------+------+-----+---------+-------+ | timestamp | datetime | YES | MUL | NULL | | | host | text | YES | | NULL | | | type | text | YES | MUL | NULL | | | msg_id | varchar(20) | YES | | NULL | | | relay | text | YES | | NULL | | | dsn | text | YES | | NULL | | | status | text | YES | | NULL | | | delay | time | YES | | NULL | | +-----------+-------------+------+-----+---------+-------+ 8 rows in set (0.00 sec) describe mcp_rules -> ; +-----------+-----------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +-----------+-----------+------+-----+---------+-------+ | rule | char(100) | NO | PRI | | | | rule_desc | char(200) | NO | | | | +-----------+-----------+------+-----+---------+-------+ 2 rows in set (0.00 sec) > describe outq; +--------------+------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +--------------+------+------+-----+---------+-------+ | id | text | YES | | NULL | | | cdate | date | YES | | NULL | | | ctime | time | YES | | NULL | | | from_address | text | YES | | NULL | | | to_address | text | YES | | NULL | | | subject | text | YES | | NULL | | | message | text | YES | | NULL | | | size | text | YES | | NULL | | | priority | text | YES | | NULL | | | attempts | text | YES | | NULL | | | lastattempt | text | YES | | NULL | | | hostname | text | YES | MUL | NULL | | +--------------+------+------+-----+---------+-------+ 12 rows in set (0.00 sec) describe sa_rules; +-----------+--------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +-----------+--------------+------+-----+---------+-------+ | rule | varchar(100) | NO | PRI | | | | rule_desc | varchar(200) | NO | | | | +-----------+--------------+------+-----+---------+-------+ 2 rows in set (0.00 sec) describe saved_filters; +----------+------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +----------+------+------+-----+---------+-------+ | name | text | NO | MUL | NULL | | | col | text | NO | | NULL | | | operator | text | NO | | NULL | | | value | text | NO | | NULL | | | username | text | NO | | NULL | | +----------+------+------+-----+---------+-------+ 5 rows in set (0.00 sec) describe spamscore; ERROR 1146 (42S02): Table 'mailscanner.spamscore' doesn't exist mysql> describe spamscores; +---------------+---------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +---------------+---------------+------+-----+---------+-------+ | user | varchar(40) | NO | PRI | | | | lowspamscore | decimal(10,0) | NO | | 0 | | | highspamscore | decimal(10,0) | NO | | 0 | | +---------------+---------------+------+-----+---------+-------+ 3 rows in set (0.00 sec) describe user_filters; +------------+---------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +------------+---------------+------+-----+---------+-------+ | username | varchar(60) | NO | MUL | | | | filter | text | YES | | NULL | | | verify_key | varchar(32) | NO | | | | | active | enum('N','Y') | YES | | N | | +------------+---------------+------+-----+---------+-------+ 4 rows in set (0.00 sec) describe users; +-------------------+---------------------------+------+-----+---------+-------+ | Field | Type | Null | Key | Default | Extra | +-------------------+---------------------------+------+-----+---------+-------+ | username | varchar(60) | NO | PRI | | | | password | varchar(32) | YES | | NULL | | | fullname | varchar(50) | NO | | | | | type | enum('A','D','U','R','H') | YES | | NULL | | | quarantine_report | tinyint(1) | YES | | 0 | | | spamscore | tinyint(4) | YES | | 0 | | | highspamscore | tinyint(4) | YES | | 0 | | | noscan | tinyint(1) | YES | | 0 | | | quarantine_rcpt | varchar(60) | YES | | NULL | | +-------------------+---------------------------+------+-----+---------+-------+ 9 rows in set (0.00 sec) describe whitelist; +--------------+---------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +--------------+---------+------+-----+---------+----------------+ | id | int(11) | NO | PRI | NULL | auto_increment | | to_address | text | YES | MUL | NULL | | | to_domain | text | YES | | NULL | | | from_address | text | YES | | NULL | | +--------------+---------+------+-----+---------+----------------+ 4 rows in set (0.00 sec) is this you looking for?? i hope this help you. Milenko Letic 2012/4/5 Tom?? Kurinec > Oh God THANK YOU Peter!!! > > You seems to be only one who really got it. I thought it's obvious what I > meant, but I was probably wrong. Still I can't figure it out. > > Please creators of MailScanner the great great, may be the best free > mighty tool. Can you write me the table structure that actually works with > MailScanner? I'm probably stupid, because I can't get it from the manual. > Can you accept my stupidity and write me the table structure? I would be > very thankful and may be even donate your great project! > > Many many thanks. > Tom > > D?a 5.4.2012 15:43, "Peter Bonivart" nap?sal(-a): > > On Thu, Apr 5, 2012 at 3:11 PM, Joolee wrote: >> > Well, if you did read the manual, you'd seen that there is a property >> > called "SQL Debug" you can set to "Yes" to get more information from >> > Mailscanner about the MySQL connection. >> > You tell us MailScanner connected to MySQL properly? In that case, you >> > can tell us what queries your MailScanner sends to MySQL and what >> > answers it receives. How do you know that Mailscanner connects >> > properly and the configured queries give the correct results? >> >> What he's asking for is to how to set up the database needed, he even >> gives an example of what he wants in his first post. Still people just >> post stuff like RTFM, turn debugging on, read the source, if you don't >> understand it you shouldn't run it and so on. >> >> I have snapped at people too but I have never seen so many feel >> obliged to reply to this guy without actually helping him the way he >> wants to be helped. If you can't or won't help him why do feel a need >> to tell him so? Can't you just ignore his post? >> >> If you have figured out how to set up a working database it wouldn't >> be so hard to dump the structure of it so he could import it. Maybe >> someone could post it to a wiki and help the next guy out as well. >> >> /peter >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120405/867f8a3e/attachment.html From tomb.stoney at gmail.com Thu Apr 5 16:01:13 2012 From: tomb.stoney at gmail.com (=?ISO-8859-2?Q?Tom=E1=B9_Kurinec?=) Date: Thu Apr 5 16:01:28 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: Thank you. It looks like mailwatch table structures, am I right? I have mailwatch fully functional, but in mailscanner.conf there is: # This should be a valid SQL statement that has a single placeholder argument # and must return two columns and one or more rows. The first column must be # a numeric starting at 1 and in ascending order and the second column should # be the rule string. The placeholder will contain the ruleset name. # # Example: SQL Ruleset = SELECT num, rule FROM ruleset WHERE rulesetname=? ORDER BY num ASC So it's saying that you need num and rule columns and rulesetname as placeholder. What do you have in SQL Ruleset = ? Or do you use just mailwatch without setting this? If yes, than this is not what I was loooking for, but thank you very much for the effort. Tom D?a 5. apr?la 2012 16:38, Milenko Letic nap?sal/a: > this is structure on my server: > Tables_in_mailscanner | > > > +-----------------------+ > > > | audit_log ? ? ? ? ? ? | > > > | blacklist ? ? ? ? ? ? | > > > | geoip_country ? ? ? ? | > > > | inq ? ? ? ? ? ? ? ? ? | > > > | maillog ? ? ? ? ? ? ? | > | mcp_rules ? ? ? ? ? ? | > | mtalog ? ? ? ? ? ? ? ?| > | outq ? ? ? ? ? ? ? ? ?| > | sa_rules ? ? ? ? ? ? ?| > | saved_filters ? ? ? ? | > | spamscores ? ? ? ? ? ?| > | user_filters ? ? ? ? ?| > | users ? ? ? ? ? ? ? ? | > | whitelist > and tables look like this: > describe audit_log; > +------------+-------------+------+-----+-------------------+-----------------------------+ > | Field ? ? ?| Type ? ? ? ?| Null | Key | Default ? ? ? ? ? | Extra > ? ? ? ? ? ? ? | > +------------+-------------+------+-----+-------------------+-----------------------------+ > | timestamp ?| timestamp ? | NO ? | ? ? | CURRENT_TIMESTAMP | on update > CURRENT_TIMESTAMP | > | user ? ? ? | varchar(20) | NO ? | ? ? | ? ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? | > | ip_address | varchar(15) | NO ? | ? ? | ? ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? | > | action ? ? | text ? ? ? ?| NO ? | ? ? | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? | > +------------+-------------+------+-----+-------------------+-----------------------------+ > 4 rows in set (0.08 sec) > describe blacklist; > +--------------+---------+------+-----+---------+----------------+ > | Field ? ? ? ?| Type ? ?| Null | Key | Default | Extra ? ? ? ? ?| > +--------------+---------+------+-----+---------+----------------+ > | id ? ? ? ? ? | int(11) | NO ? | PRI | NULL ? ?| auto_increment | > | to_address ? | text ? ?| YES ?| MUL | NULL ? ?| ? ? ? ? ? ? ? ?| > | to_domain ? ?| text ? ?| YES ?| ? ? | NULL ? ?| ? ? ? ? ? ? ? ?| > | from_address | text ? ?| YES ?| ? ? | NULL ? ?| ? ? ? ? ? ? ? ?| > +--------------+---------+------+-----+---------+----------------+ > 4 rows in set (0.00 sec) > describe geoip_country; > +------------------+-------------+------+-----+---------+-------+ > | Field ? ? ? ? ? ?| Type ? ? ? ?| Null | Key | Default | Extra | > +------------------+-------------+------+-----+---------+-------+ > | begin_ip ? ? ? ? | varchar(15) | YES ?| ? ? | NULL ? ?| ? ? ? | > | end_ip ? ? ? ? ? | varchar(15) | YES ?| ? ? | NULL ? ?| ? ? ? | > | begin_num ? ? ? ?| bigint(20) ?| YES ?| MUL | NULL ? ?| ? ? ? | > | end_num ? ? ? ? ?| bigint(20) ?| YES ?| MUL | NULL ? ?| ? ? ? | > | iso_country_code | char(2) ? ? | YES ?| ? ? | NULL ? ?| ? ? ? | > | country ? ? ? ? ?| text ? ? ? ?| YES ?| ? ? | NULL ? ?| ? ? ? | > +------------------+-------------+------+-----+---------+-------+ > 6 rows in set (0.00 sec) > describe inq; > +--------------+------+------+-----+---------+-------+ > | Field ? ? ? ?| Type | Null | Key | Default | Extra | > +--------------+------+------+-----+---------+-------+ > | id ? ? ? ? ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | cdate ? ? ? ?| date | YES ?| ? ? | NULL ? ?| ? ? ? | > | ctime ? ? ? ?| time | YES ?| ? ? | NULL ? ?| ? ? ? | > | from_address | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | to_address ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | subject ? ? ?| text | YES ?| ? ? | NULL ? ?| ? ? ? | > | message ? ? ?| text | YES ?| ? ? | NULL ? ?| ? ? ? | > | size ? ? ? ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | priority ? ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | attempts ? ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | lastattempt ?| text | YES ?| ? ? | NULL ? ?| ? ? ? | > | hostname ? ? | text | YES ?| MUL | NULL ? ?| ? ? ? | > +--------------+------+------+-----+---------+-------+ > 12 rows in set (0.00 sec) > describe maillog; > +-----------------+--------------+------+-----+-------------------+-----------------------------+ > | Field ? ? ? ? ? | Type ? ? ? ? | Null | Key | Default ? ? ? ? ? | Extra > ? ? ? ? ? ? ? ? ? ? | > +-----------------+--------------+------+-----+-------------------+-----------------------------+ > | timestamp ? ? ? | timestamp ? ?| NO ? | ? ? | CURRENT_TIMESTAMP | on > update CURRENT_TIMESTAMP | > | id ? ? ? ? ? ? ?| text ? ? ? ? | YES ?| MUL | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | size ? ? ? ? ? ?| bigint(20) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | from_address ? ?| text ? ? ? ? | YES ?| MUL | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | from_domain ? ? | text ? ? ? ? | YES ?| MUL | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | to_address ? ? ?| text ? ? ? ? | YES ?| MUL | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | to_domain ? ? ? | text ? ? ? ? | YES ?| MUL | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | subject ? ? ? ? | text ? ? ? ? | YES ?| ? ? | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | clientip ? ? ? ?| text ? ? ? ? | YES ?| MUL | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | archive ? ? ? ? | text ? ? ? ? | YES ?| ? ? | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | isspam ? ? ? ? ?| tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | ishighspam ? ? ?| tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | issaspam ? ? ? ?| tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | isrblspam ? ? ? | tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | isfp ? ? ? ? ? ?| tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | isfn ? ? ? ? ? ?| tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | spamwhitelisted | tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | spamblacklisted | tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | sascore ? ? ? ? | decimal(7,2) | YES ?| ? ? | 0.00 ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | spamreport ? ? ?| text ? ? ? ? | YES ?| ? ? | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | virusinfected ? | tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | nameinfected ? ?| tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | otherinfected ? | tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | report ? ? ? ? ?| text ? ? ? ? | YES ?| ? ? | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | ismcp ? ? ? ? ? | tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | ishighmcp ? ? ? | tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | issamcp ? ? ? ? | tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | mcpwhitelisted ?| tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | mcpblacklisted ?| tinyint(1) ? | YES ?| ? ? | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > | mcpsascore ? ? ?| decimal(7,2) | YES ?| ? ? | 0.00 ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | mcpreport ? ? ? | text ? ? ? ? | YES ?| ? ? | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | hostname ? ? ? ?| text ? ? ? ? | YES ?| MUL | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | date ? ? ? ? ? ?| date ? ? ? ? | YES ?| MUL | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | time ? ? ? ? ? ?| time ? ? ? ? | YES ?| ? ? | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | headers ? ? ? ? | text ? ? ? ? | YES ?| ? ? | NULL ? ? ? ? ? ? ?| > ? ? ? ? ? ? ? ? ? ? | > | quarantined ? ? | tinyint(1) ? | YES ?| MUL | 0 ? ? ? ? ? ? ? ? | > ? ? ? ? ? ? ? ? ? ? | > +-----------------+--------------+------+-----+-------------------+-----------------------------+ > 36 rows in set (0.01 sec) > describe mtalog; > +-----------+-------------+------+-----+---------+-------+ > | Field ? ? | Type ? ? ? ?| Null | Key | Default | Extra | > +-----------+-------------+------+-----+---------+-------+ > | timestamp | datetime ? ?| YES ?| MUL | NULL ? ?| ? ? ? | > | host ? ? ?| text ? ? ? ?| YES ?| ? ? | NULL ? ?| ? ? ? | > | type ? ? ?| text ? ? ? ?| YES ?| MUL | NULL ? ?| ? ? ? | > | msg_id ? ?| varchar(20) | YES ?| ? ? | NULL ? ?| ? ? ? | > | relay ? ? | text ? ? ? ?| YES ?| ? ? | NULL ? ?| ? ? ? | > | dsn ? ? ? | text ? ? ? ?| YES ?| ? ? | NULL ? ?| ? ? ? | > | status ? ?| text ? ? ? ?| YES ?| ? ? | NULL ? ?| ? ? ? | > | delay ? ? | time ? ? ? ?| YES ?| ? ? | NULL ? ?| ? ? ? | > +-----------+-------------+------+-----+---------+-------+ > 8 rows in set (0.00 sec) > > describe mcp_rules > ? ? -> ; > +-----------+-----------+------+-----+---------+-------+ > | Field ? ? | Type ? ? ?| Null | Key | Default | Extra | > +-----------+-----------+------+-----+---------+-------+ > | rule ? ? ?| char(100) | NO ? | PRI | ? ? ? ? | ? ? ? | > | rule_desc | char(200) | NO ? | ? ? | ? ? ? ? | ? ? ? | > +-----------+-----------+------+-----+---------+-------+ > 2 rows in set (0.00 sec) >> describe outq; > +--------------+------+------+-----+---------+-------+ > | Field ? ? ? ?| Type | Null | Key | Default | Extra | > +--------------+------+------+-----+---------+-------+ > | id ? ? ? ? ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | cdate ? ? ? ?| date | YES ?| ? ? | NULL ? ?| ? ? ? | > | ctime ? ? ? ?| time | YES ?| ? ? | NULL ? ?| ? ? ? | > | from_address | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | to_address ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | subject ? ? ?| text | YES ?| ? ? | NULL ? ?| ? ? ? | > | message ? ? ?| text | YES ?| ? ? | NULL ? ?| ? ? ? | > | size ? ? ? ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | priority ? ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | attempts ? ? | text | YES ?| ? ? | NULL ? ?| ? ? ? | > | lastattempt ?| text | YES ?| ? ? | NULL ? ?| ? ? ? | > | hostname ? ? | text | YES ?| MUL | NULL ? ?| ? ? ? | > +--------------+------+------+-----+---------+-------+ > 12 rows in set (0.00 sec) > describe sa_rules; > +-----------+--------------+------+-----+---------+-------+ > | Field ? ? | Type ? ? ? ? | Null | Key | Default | Extra | > +-----------+--------------+------+-----+---------+-------+ > | rule ? ? ?| varchar(100) | NO ? | PRI | ? ? ? ? | ? ? ? | > | rule_desc | varchar(200) | NO ? | ? ? | ? ? ? ? | ? ? ? | > +-----------+--------------+------+-----+---------+-------+ > 2 rows in set (0.00 sec) > ?describe saved_filters; > +----------+------+------+-----+---------+-------+ > | Field ? ?| Type | Null | Key | Default | Extra | > +----------+------+------+-----+---------+-------+ > | name ? ? | text | NO ? | MUL | NULL ? ?| ? ? ? | > | col ? ? ?| text | NO ? | ? ? | NULL ? ?| ? ? ? | > | operator | text | NO ? | ? ? | NULL ? ?| ? ? ? | > | value ? ?| text | NO ? | ? ? | NULL ? ?| ? ? ? | > | username | text | NO ? | ? ? | NULL ? ?| ? ? ? | > +----------+------+------+-----+---------+-------+ > 5 rows in set (0.00 sec) > describe spamscore; > ERROR 1146 (42S02): Table 'mailscanner.spamscore' doesn't exist > mysql> describe spamscores; > +---------------+---------------+------+-----+---------+-------+ > | Field ? ? ? ? | Type ? ? ? ? ?| Null | Key | Default | Extra | > +---------------+---------------+------+-----+---------+-------+ > | user ? ? ? ? ?| varchar(40) ? | NO ? | PRI | ? ? ? ? | ? ? ? | > | lowspamscore ?| decimal(10,0) | NO ? | ? ? | 0 ? ? ? | ? ? ? | > | highspamscore | decimal(10,0) | NO ? | ? ? | 0 ? ? ? | ? ? ? | > +---------------+---------------+------+-----+---------+-------+ > 3 rows in set (0.00 sec) > describe user_filters; > +------------+---------------+------+-----+---------+-------+ > | Field ? ? ?| Type ? ? ? ? ?| Null | Key | Default | Extra | > +------------+---------------+------+-----+---------+-------+ > | username ? | varchar(60) ? | NO ? | MUL | ? ? ? ? | ? ? ? | > | filter ? ? | text ? ? ? ? ?| YES ?| ? ? | NULL ? ?| ? ? ? | > | verify_key | varchar(32) ? | NO ? | ? ? | ? ? ? ? | ? ? ? | > | active ? ? | enum('N','Y') | YES ?| ? ? | N ? ? ? | ? ? ? | > +------------+---------------+------+-----+---------+-------+ > 4 rows in set (0.00 sec) > describe users; > +-------------------+---------------------------+------+-----+---------+-------+ > | Field ? ? ? ? ? ? | Type ? ? ? ? ? ? ? ? ? ? ?| Null | Key | Default | > Extra | > +-------------------+---------------------------+------+-----+---------+-------+ > | username ? ? ? ? ?| varchar(60) ? ? ? ? ? ? ? | NO ? | PRI | ? ? ? ? | > ? | > | password ? ? ? ? ?| varchar(32) ? ? ? ? ? ? ? | YES ?| ? ? | NULL ? ?| > ? | > | fullname ? ? ? ? ?| varchar(50) ? ? ? ? ? ? ? | NO ? | ? ? | ? ? ? ? | > ? | > | type ? ? ? ? ? ? ?| enum('A','D','U','R','H') | YES ?| ? ? | NULL ? ?| > ? | > | quarantine_report | tinyint(1) ? ? ? ? ? ? ? ?| YES ?| ? ? | 0 ? ? ? | > ? | > | spamscore ? ? ? ? | tinyint(4) ? ? ? ? ? ? ? ?| YES ?| ? ? | 0 ? ? ? | > ? | > | highspamscore ? ? | tinyint(4) ? ? ? ? ? ? ? ?| YES ?| ? ? | 0 ? ? ? | > ? | > | noscan ? ? ? ? ? ?| tinyint(1) ? ? ? ? ? ? ? ?| YES ?| ? ? | 0 ? ? ? | > ? | > | quarantine_rcpt ? | varchar(60) ? ? ? ? ? ? ? | YES ?| ? ? | NULL ? ?| > ? | > +-------------------+---------------------------+------+-----+---------+-------+ > 9 rows in set (0.00 sec) > describe whitelist; > +--------------+---------+------+-----+---------+----------------+ > | Field ? ? ? ?| Type ? ?| Null | Key | Default | Extra ? ? ? ? ?| > +--------------+---------+------+-----+---------+----------------+ > | id ? ? ? ? ? | int(11) | NO ? | PRI | NULL ? ?| auto_increment | > | to_address ? | text ? ?| YES ?| MUL | NULL ? ?| ? ? ? ? ? ? ? ?| > | to_domain ? ?| text ? ?| YES ?| ? ? | NULL ? ?| ? ? ? ? ? ? ? ?| > | from_address | text ? ?| YES ?| ? ? | NULL ? ?| ? ? ? ? ? ? ? ?| > +--------------+---------+------+-----+---------+----------------+ > 4 rows in set (0.00 sec) > > > is this you looking for?? > i hope this help you. > Milenko Letic > > 2012/4/5 Tom?? Kurinec >> >> Oh God THANK YOU Peter!!! >> >> You seems to be only one who really got it. I thought it's obvious what I >> meant, but I was probably wrong. Still I can't figure it out. >> >> Please creators of MailScanner the great great, may be the best free >> mighty tool. Can you write me the table structure that actually works with >> MailScanner? I'm probably stupid, because I can't get it from the manual. >> Can you accept my stupidity and write me the table structure? I would be >> very thankful and may be even donate your great project! >> >> Many many thanks. >> >> Tom >> >> D?a 5.4.2012 15:43, "Peter Bonivart" nap?sal(-a): >> >>> On Thu, Apr 5, 2012 at 3:11 PM, Joolee wrote: >>> > Well, if you did read the manual, you'd seen that there is a property >>> > called "SQL Debug" you can set to "Yes" to get more information from >>> > Mailscanner about the MySQL connection. >>> > You tell us MailScanner connected to MySQL properly? In that case, you >>> > can tell us what queries your MailScanner sends to MySQL and what >>> > answers it receives. How do you know that Mailscanner connects >>> > properly and the configured queries give the correct results? >>> >>> What he's asking for is to how to set up the database needed, he even >>> gives an example of what he wants in his first post. Still people just >>> post stuff like RTFM, turn debugging on, read the source, if you don't >>> understand it you shouldn't run it and so on. >>> >>> I have snapped at people too but I have never seen so many feel >>> obliged to reply to this guy without actually helping him the way he >>> wants to be helped. If you can't or won't help him why do feel a need >>> to tell him so? Can't you just ignore his post? >>> >>> If you have figured out how to set up a working database it wouldn't >>> be so hard to dump the structure of it so he could import it. Maybe >>> someone could post it to a wiki and help the next guy out as well. >>> >>> /peter >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > From campbell at cnpapers.com Thu Apr 5 16:06:56 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Apr 5 16:07:07 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: <4F7DAB6E.9070403@alexb.ch> References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> <4F7DAB6E.9070403@alexb.ch> Message-ID: <4F7DB510.7020308@cnpapers.com> On 4/5/2012 10:25 AM, Alex Broens wrote: > > > Is everybody listening to the same airwave? > > MailScanner's SQL stuff has zero to do with Mailwatch's SQL schema. > > Seems to me Tom is referring to MailScanner's schema. > > or am I still listening AM radio ? > > Alex > > I believe you're on FM and correct. I suppose MailWatch's database could be used for such a thing as required by the OP, but what he's asking for is a separate database that's referenced in the config file under the SQL section. The fields are described slightly in the config file's comments, but I could not find any creation information on this database anywhere. Maybe someone could point us all to the link of the manual that describes this? Now, for Tom: I for one have never used this database, but I do use MailWatch and it's database. I was under the impression that this database was a lot like MCP in it's utilization. In other words, not very many people used it even though it is described in the config file. My suggestion to the OP is to skip the database setup unless there is a real need to use it. I've been able to use MS for many years without the database and have opted instead for the text files of rules for both MS and SA. These are much easier to manage in the long run and use very little overhead that a database would require. Good luck, steve From mikoletic at gmail.com Thu Apr 5 16:17:52 2012 From: mikoletic at gmail.com (Milenko Letic) Date: Thu Apr 5 16:18:01 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: aha ok, so i am at home now, i will send you that info tomorow morrnig. Milenko Letic 2012/4/5 Tom?? Kurinec > Thank you. It looks like mailwatch table structures, am I right? I > have mailwatch fully functional, but in mailscanner.conf there is: > # This should be a valid SQL statement that has a single placeholder > argument > # and must return two columns and one or more rows. The first column must > be > # a numeric starting at 1 and in ascending order and the second column > should > # be the rule string. The placeholder will contain the ruleset name. > # > # Example: SQL Ruleset = SELECT num, rule FROM ruleset WHERE > rulesetname=? ORDER BY num ASC > > So it's saying that you need num and rule columns and rulesetname as > placeholder. What do you have in SQL Ruleset = ? Or do you use just > mailwatch without setting this? If yes, than this is not what I was > loooking for, but thank you very much for the effort. > > Tom > > D?a 5. apr?la 2012 16:38, Milenko Letic nap?sal/a: > > this is structure on my server: > > Tables_in_mailscanner | > > > > > > +-----------------------+ > > > > > > | audit_log | > > > > > > | blacklist | > > > > > > | geoip_country | > > > > > > | inq | > > > > > > | maillog | > > | mcp_rules | > > | mtalog | > > | outq | > > | sa_rules | > > | saved_filters | > > | spamscores | > > | user_filters | > > | users | > > | whitelist > > and tables look like this: > > describe audit_log; > > > +------------+-------------+------+-----+-------------------+-----------------------------+ > > | Field | Type | Null | Key | Default | Extra > > | > > > +------------+-------------+------+-----+-------------------+-----------------------------+ > > | timestamp | timestamp | NO | | CURRENT_TIMESTAMP | on update > > CURRENT_TIMESTAMP | > > | user | varchar(20) | NO | | | > > | > > | ip_address | varchar(15) | NO | | | > > | > > | action | text | NO | | NULL | > > | > > > +------------+-------------+------+-----+-------------------+-----------------------------+ > > 4 rows in set (0.08 sec) > > describe blacklist; > > +--------------+---------+------+-----+---------+----------------+ > > | Field | Type | Null | Key | Default | Extra | > > +--------------+---------+------+-----+---------+----------------+ > > | id | int(11) | NO | PRI | NULL | auto_increment | > > | to_address | text | YES | MUL | NULL | | > > | to_domain | text | YES | | NULL | | > > | from_address | text | YES | | NULL | | > > +--------------+---------+------+-----+---------+----------------+ > > 4 rows in set (0.00 sec) > > describe geoip_country; > > +------------------+-------------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +------------------+-------------+------+-----+---------+-------+ > > | begin_ip | varchar(15) | YES | | NULL | | > > | end_ip | varchar(15) | YES | | NULL | | > > | begin_num | bigint(20) | YES | MUL | NULL | | > > | end_num | bigint(20) | YES | MUL | NULL | | > > | iso_country_code | char(2) | YES | | NULL | | > > | country | text | YES | | NULL | | > > +------------------+-------------+------+-----+---------+-------+ > > 6 rows in set (0.00 sec) > > describe inq; > > +--------------+------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +--------------+------+------+-----+---------+-------+ > > | id | text | YES | | NULL | | > > | cdate | date | YES | | NULL | | > > | ctime | time | YES | | NULL | | > > | from_address | text | YES | | NULL | | > > | to_address | text | YES | | NULL | | > > | subject | text | YES | | NULL | | > > | message | text | YES | | NULL | | > > | size | text | YES | | NULL | | > > | priority | text | YES | | NULL | | > > | attempts | text | YES | | NULL | | > > | lastattempt | text | YES | | NULL | | > > | hostname | text | YES | MUL | NULL | | > > +--------------+------+------+-----+---------+-------+ > > 12 rows in set (0.00 sec) > > describe maillog; > > > +-----------------+--------------+------+-----+-------------------+-----------------------------+ > > | Field | Type | Null | Key | Default | Extra > > | > > > +-----------------+--------------+------+-----+-------------------+-----------------------------+ > > | timestamp | timestamp | NO | | CURRENT_TIMESTAMP | on > > update CURRENT_TIMESTAMP | > > | id | text | YES | MUL | NULL | > > | > > | size | bigint(20) | YES | | 0 | > > | > > | from_address | text | YES | MUL | NULL | > > | > > | from_domain | text | YES | MUL | NULL | > > | > > | to_address | text | YES | MUL | NULL | > > | > > | to_domain | text | YES | MUL | NULL | > > | > > | subject | text | YES | | NULL | > > | > > | clientip | text | YES | MUL | NULL | > > | > > | archive | text | YES | | NULL | > > | > > | isspam | tinyint(1) | YES | | 0 | > > | > > | ishighspam | tinyint(1) | YES | | 0 | > > | > > | issaspam | tinyint(1) | YES | | 0 | > > | > > | isrblspam | tinyint(1) | YES | | 0 | > > | > > | isfp | tinyint(1) | YES | | 0 | > > | > > | isfn | tinyint(1) | YES | | 0 | > > | > > | spamwhitelisted | tinyint(1) | YES | | 0 | > > | > > | spamblacklisted | tinyint(1) | YES | | 0 | > > | > > | sascore | decimal(7,2) | YES | | 0.00 | > > | > > | spamreport | text | YES | | NULL | > > | > > | virusinfected | tinyint(1) | YES | | 0 | > > | > > | nameinfected | tinyint(1) | YES | | 0 | > > | > > | otherinfected | tinyint(1) | YES | | 0 | > > | > > | report | text | YES | | NULL | > > | > > | ismcp | tinyint(1) | YES | | 0 | > > | > > | ishighmcp | tinyint(1) | YES | | 0 | > > | > > | issamcp | tinyint(1) | YES | | 0 | > > | > > | mcpwhitelisted | tinyint(1) | YES | | 0 | > > | > > | mcpblacklisted | tinyint(1) | YES | | 0 | > > | > > | mcpsascore | decimal(7,2) | YES | | 0.00 | > > | > > | mcpreport | text | YES | | NULL | > > | > > | hostname | text | YES | MUL | NULL | > > | > > | date | date | YES | MUL | NULL | > > | > > | time | time | YES | | NULL | > > | > > | headers | text | YES | | NULL | > > | > > | quarantined | tinyint(1) | YES | MUL | 0 | > > | > > > +-----------------+--------------+------+-----+-------------------+-----------------------------+ > > 36 rows in set (0.01 sec) > > describe mtalog; > > +-----------+-------------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +-----------+-------------+------+-----+---------+-------+ > > | timestamp | datetime | YES | MUL | NULL | | > > | host | text | YES | | NULL | | > > | type | text | YES | MUL | NULL | | > > | msg_id | varchar(20) | YES | | NULL | | > > | relay | text | YES | | NULL | | > > | dsn | text | YES | | NULL | | > > | status | text | YES | | NULL | | > > | delay | time | YES | | NULL | | > > +-----------+-------------+------+-----+---------+-------+ > > 8 rows in set (0.00 sec) > > > > describe mcp_rules > > -> ; > > +-----------+-----------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +-----------+-----------+------+-----+---------+-------+ > > | rule | char(100) | NO | PRI | | | > > | rule_desc | char(200) | NO | | | | > > +-----------+-----------+------+-----+---------+-------+ > > 2 rows in set (0.00 sec) > >> describe outq; > > +--------------+------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +--------------+------+------+-----+---------+-------+ > > | id | text | YES | | NULL | | > > | cdate | date | YES | | NULL | | > > | ctime | time | YES | | NULL | | > > | from_address | text | YES | | NULL | | > > | to_address | text | YES | | NULL | | > > | subject | text | YES | | NULL | | > > | message | text | YES | | NULL | | > > | size | text | YES | | NULL | | > > | priority | text | YES | | NULL | | > > | attempts | text | YES | | NULL | | > > | lastattempt | text | YES | | NULL | | > > | hostname | text | YES | MUL | NULL | | > > +--------------+------+------+-----+---------+-------+ > > 12 rows in set (0.00 sec) > > describe sa_rules; > > +-----------+--------------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +-----------+--------------+------+-----+---------+-------+ > > | rule | varchar(100) | NO | PRI | | | > > | rule_desc | varchar(200) | NO | | | | > > +-----------+--------------+------+-----+---------+-------+ > > 2 rows in set (0.00 sec) > > describe saved_filters; > > +----------+------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +----------+------+------+-----+---------+-------+ > > | name | text | NO | MUL | NULL | | > > | col | text | NO | | NULL | | > > | operator | text | NO | | NULL | | > > | value | text | NO | | NULL | | > > | username | text | NO | | NULL | | > > +----------+------+------+-----+---------+-------+ > > 5 rows in set (0.00 sec) > > describe spamscore; > > ERROR 1146 (42S02): Table 'mailscanner.spamscore' doesn't exist > > mysql> describe spamscores; > > +---------------+---------------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +---------------+---------------+------+-----+---------+-------+ > > | user | varchar(40) | NO | PRI | | | > > | lowspamscore | decimal(10,0) | NO | | 0 | | > > | highspamscore | decimal(10,0) | NO | | 0 | | > > +---------------+---------------+------+-----+---------+-------+ > > 3 rows in set (0.00 sec) > > describe user_filters; > > +------------+---------------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | Extra | > > +------------+---------------+------+-----+---------+-------+ > > | username | varchar(60) | NO | MUL | | | > > | filter | text | YES | | NULL | | > > | verify_key | varchar(32) | NO | | | | > > | active | enum('N','Y') | YES | | N | | > > +------------+---------------+------+-----+---------+-------+ > > 4 rows in set (0.00 sec) > > describe users; > > > +-------------------+---------------------------+------+-----+---------+-------+ > > | Field | Type | Null | Key | Default | > > Extra | > > > +-------------------+---------------------------+------+-----+---------+-------+ > > | username | varchar(60) | NO | PRI | | > > | > > | password | varchar(32) | YES | | NULL | > > | > > | fullname | varchar(50) | NO | | | > > | > > | type | enum('A','D','U','R','H') | YES | | NULL | > > | > > | quarantine_report | tinyint(1) | YES | | 0 | > > | > > | spamscore | tinyint(4) | YES | | 0 | > > | > > | highspamscore | tinyint(4) | YES | | 0 | > > | > > | noscan | tinyint(1) | YES | | 0 | > > | > > | quarantine_rcpt | varchar(60) | YES | | NULL | > > | > > > +-------------------+---------------------------+------+-----+---------+-------+ > > 9 rows in set (0.00 sec) > > describe whitelist; > > +--------------+---------+------+-----+---------+----------------+ > > | Field | Type | Null | Key | Default | Extra | > > +--------------+---------+------+-----+---------+----------------+ > > | id | int(11) | NO | PRI | NULL | auto_increment | > > | to_address | text | YES | MUL | NULL | | > > | to_domain | text | YES | | NULL | | > > | from_address | text | YES | | NULL | | > > +--------------+---------+------+-----+---------+----------------+ > > 4 rows in set (0.00 sec) > > > > > > is this you looking for?? > > i hope this help you. > > Milenko Letic > > > > 2012/4/5 Tom?? Kurinec > >> > >> Oh God THANK YOU Peter!!! > >> > >> You seems to be only one who really got it. I thought it's obvious what > I > >> meant, but I was probably wrong. Still I can't figure it out. > >> > >> Please creators of MailScanner the great great, may be the best free > >> mighty tool. Can you write me the table structure that actually works > with > >> MailScanner? I'm probably stupid, because I can't get it from the > manual. > >> Can you accept my stupidity and write me the table structure? I would be > >> very thankful and may be even donate your great project! > >> > >> Many many thanks. > >> > >> Tom > >> > >> D?a 5.4.2012 15:43, "Peter Bonivart" > nap?sal(-a): > >> > >>> On Thu, Apr 5, 2012 at 3:11 PM, Joolee wrote: > >>> > Well, if you did read the manual, you'd seen that there is a property > >>> > called "SQL Debug" you can set to "Yes" to get more information from > >>> > Mailscanner about the MySQL connection. > >>> > You tell us MailScanner connected to MySQL properly? In that case, > you > >>> > can tell us what queries your MailScanner sends to MySQL and what > >>> > answers it receives. How do you know that Mailscanner connects > >>> > properly and the configured queries give the correct results? > >>> > >>> What he's asking for is to how to set up the database needed, he even > >>> gives an example of what he wants in his first post. Still people just > >>> post stuff like RTFM, turn debugging on, read the source, if you don't > >>> understand it you shouldn't run it and so on. > >>> > >>> I have snapped at people too but I have never seen so many feel > >>> obliged to reply to this guy without actually helping him the way he > >>> wants to be helped. If you can't or won't help him why do feel a need > >>> to tell him so? Can't you just ignore his post? > >>> > >>> If you have figured out how to set up a working database it wouldn't > >>> be so hard to dump the structure of it so he could import it. Maybe > >>> someone could post it to a wiki and help the next guy out as well. > >>> > >>> /peter > >>> -- > >>> MailScanner mailing list > >>> mailscanner@lists.mailscanner.info > >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>> > >>> Before posting, read http://wiki.mailscanner.info/posting > >>> > >>> Support MailScanner development - buy the book off the website! > >> > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > >> > > > > > > -- > > MailScanner mailing list > > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120405/e2918330/attachment.html From tomb.stoney at gmail.com Thu Apr 5 16:25:13 2012 From: tomb.stoney at gmail.com (=?ISO-8859-2?Q?Tom=E1=B9_Kurinec?=) Date: Thu Apr 5 16:25:24 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: <4F7DB510.7020308@cnpapers.com> References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> <4F7DAB6E.9070403@alexb.ch> <4F7DB510.7020308@cnpapers.com> Message-ID: Thank you for suggestion Steve, but what I'm exactly trying to do is a web interface for customers in company where i work. In the interface the users should be able to write their own rules for their domains (accounts) using some combo boxes and text boxes and so on... So I thought it would be much easier to tell MailScanner to use the rulesets defined in the database. Of course, this database would be the same as for the web interface and mailscanner. The other solution for this would be to create separate database for the web interface and from this database the rulesets would be parsed to create rulesets files for mailscanner, but I probably do not need to explain which solution is much better, safer, effective... Do you think there is any better solution for my assignement? Tom D?a 5. apr?la 2012 17:06, Steve Campbell nap?sal/a: > > > On 4/5/2012 10:25 AM, Alex Broens wrote: >> >> >> >> Is everybody listening to the same airwave? >> >> MailScanner's SQL stuff has zero to do with Mailwatch's SQL schema. >> >> Seems to me Tom is referring to MailScanner's schema. >> >> or am I still listening AM radio ? >> >> Alex >> >> > I believe you're on FM and correct. I suppose MailWatch's database could be > used for such a thing as required by the OP, but what he's asking for is a > separate database that's referenced in the config file under the SQL > section. The fields are described slightly in the config file's comments, > but I could not find any creation information on this database anywhere. > Maybe someone could point us all to the link of the manual that describes > this? > > Now, for Tom: > > I for one have never used this database, but I do use MailWatch and it's > database. I was under the impression that this database was a lot like MCP > in it's utilization. In other words, not very many people used it even > though it is described in the config file. > > My suggestion to the OP is to skip the database setup unless there is a real > need to use it. I've been able to use MS for many years without the database > and have opted instead for the text files of rules for both MS and SA. These > are much easier to manage in the long run and use very little overhead that > a database would require. > > Good luck, > > steve > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From lhaig at haigmail.com Thu Apr 5 16:27:39 2012 From: lhaig at haigmail.com (Lance Haig) Date: Thu Apr 5 16:27:56 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: <4F7DB9EB.40209@haigmail.com> Peter I am with you on this one. I think we should try to set-up a wiki section dedicated to help people setting up DB integration. Unfortunately without help from the list it will take a while. Lance On 05/04/12 14:41, Peter Bonivart wrote: > On Thu, Apr 5, 2012 at 3:11 PM, Joolee wrote: >> Well, if you did read the manual, you'd seen that there is a property >> called "SQL Debug" you can set to "Yes" to get more information from >> Mailscanner about the MySQL connection. >> You tell us MailScanner connected to MySQL properly? In that case, you >> can tell us what queries your MailScanner sends to MySQL and what >> answers it receives. How do you know that Mailscanner connects >> properly and the configured queries give the correct results? > What he's asking for is to how to set up the database needed, he even > gives an example of what he wants in his first post. Still people just > post stuff like RTFM, turn debugging on, read the source, if you don't > understand it you shouldn't run it and so on. > > I have snapped at people too but I have never seen so many feel > obliged to reply to this guy without actually helping him the way he > wants to be helped. If you can't or won't help him why do feel a need > to tell him so? Can't you just ignore his post? > > If you have figured out how to set up a working database it wouldn't > be so hard to dump the structure of it so he could import it. Maybe > someone could post it to a wiki and help the next guy out as well. > > /peter -- This message was scanned by Better Hosted and is believed to be clean. http://www.betterhosted.com From mikoletic at gmail.com Thu Apr 5 16:31:20 2012 From: mikoletic at gmail.com (Milenko Letic) Date: Thu Apr 5 16:31:29 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> Message-ID: maybe this can help: http://www.mailscanner.info/MailScanner.conf.index.html#SQL%20Ruleset http://www.mailscanner.info/MailScanner.conf.index.html Milenko Letic 2012/4/5 Milenko Letic > aha ok, so i am at home now, i will send you that info tomorow morrnig. > Milenko Letic > > 2012/4/5 Tom?? Kurinec > >> Thank you. It looks like mailwatch table structures, am I right? I >> have mailwatch fully functional, but in mailscanner.conf there is: >> # This should be a valid SQL statement that has a single placeholder >> argument >> # and must return two columns and one or more rows. The first column >> must be >> # a numeric starting at 1 and in ascending order and the second column >> should >> # be the rule string. The placeholder will contain the ruleset name. >> # >> # Example: SQL Ruleset = SELECT num, rule FROM ruleset WHERE >> rulesetname=? ORDER BY num ASC >> >> So it's saying that you need num and rule columns and rulesetname as >> placeholder. What do you have in SQL Ruleset = ? Or do you use just >> mailwatch without setting this? If yes, than this is not what I was >> loooking for, but thank you very much for the effort. >> >> Tom >> >> D?a 5. apr?la 2012 16:38, Milenko Letic nap?sal/a: >> > this is structure on my server: >> > Tables_in_mailscanner | >> > >> > >> > +-----------------------+ >> > >> > >> > | audit_log | >> > >> > >> > | blacklist | >> > >> > >> > | geoip_country | >> > >> > >> > | inq | >> > >> > >> > | maillog | >> > | mcp_rules | >> > | mtalog | >> > | outq | >> > | sa_rules | >> > | saved_filters | >> > | spamscores | >> > | user_filters | >> > | users | >> > | whitelist >> > and tables look like this: >> > describe audit_log; >> > >> +------------+-------------+------+-----+-------------------+-----------------------------+ >> > | Field | Type | Null | Key | Default | Extra >> > | >> > >> +------------+-------------+------+-----+-------------------+-----------------------------+ >> > | timestamp | timestamp | NO | | CURRENT_TIMESTAMP | on update >> > CURRENT_TIMESTAMP | >> > | user | varchar(20) | NO | | | >> > | >> > | ip_address | varchar(15) | NO | | | >> > | >> > | action | text | NO | | NULL | >> > | >> > >> +------------+-------------+------+-----+-------------------+-----------------------------+ >> > 4 rows in set (0.08 sec) >> > describe blacklist; >> > +--------------+---------+------+-----+---------+----------------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +--------------+---------+------+-----+---------+----------------+ >> > | id | int(11) | NO | PRI | NULL | auto_increment | >> > | to_address | text | YES | MUL | NULL | | >> > | to_domain | text | YES | | NULL | | >> > | from_address | text | YES | | NULL | | >> > +--------------+---------+------+-----+---------+----------------+ >> > 4 rows in set (0.00 sec) >> > describe geoip_country; >> > +------------------+-------------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +------------------+-------------+------+-----+---------+-------+ >> > | begin_ip | varchar(15) | YES | | NULL | | >> > | end_ip | varchar(15) | YES | | NULL | | >> > | begin_num | bigint(20) | YES | MUL | NULL | | >> > | end_num | bigint(20) | YES | MUL | NULL | | >> > | iso_country_code | char(2) | YES | | NULL | | >> > | country | text | YES | | NULL | | >> > +------------------+-------------+------+-----+---------+-------+ >> > 6 rows in set (0.00 sec) >> > describe inq; >> > +--------------+------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +--------------+------+------+-----+---------+-------+ >> > | id | text | YES | | NULL | | >> > | cdate | date | YES | | NULL | | >> > | ctime | time | YES | | NULL | | >> > | from_address | text | YES | | NULL | | >> > | to_address | text | YES | | NULL | | >> > | subject | text | YES | | NULL | | >> > | message | text | YES | | NULL | | >> > | size | text | YES | | NULL | | >> > | priority | text | YES | | NULL | | >> > | attempts | text | YES | | NULL | | >> > | lastattempt | text | YES | | NULL | | >> > | hostname | text | YES | MUL | NULL | | >> > +--------------+------+------+-----+---------+-------+ >> > 12 rows in set (0.00 sec) >> > describe maillog; >> > >> +-----------------+--------------+------+-----+-------------------+-----------------------------+ >> > | Field | Type | Null | Key | Default | >> Extra >> > | >> > >> +-----------------+--------------+------+-----+-------------------+-----------------------------+ >> > | timestamp | timestamp | NO | | CURRENT_TIMESTAMP | on >> > update CURRENT_TIMESTAMP | >> > | id | text | YES | MUL | NULL | >> > | >> > | size | bigint(20) | YES | | 0 | >> > | >> > | from_address | text | YES | MUL | NULL | >> > | >> > | from_domain | text | YES | MUL | NULL | >> > | >> > | to_address | text | YES | MUL | NULL | >> > | >> > | to_domain | text | YES | MUL | NULL | >> > | >> > | subject | text | YES | | NULL | >> > | >> > | clientip | text | YES | MUL | NULL | >> > | >> > | archive | text | YES | | NULL | >> > | >> > | isspam | tinyint(1) | YES | | 0 | >> > | >> > | ishighspam | tinyint(1) | YES | | 0 | >> > | >> > | issaspam | tinyint(1) | YES | | 0 | >> > | >> > | isrblspam | tinyint(1) | YES | | 0 | >> > | >> > | isfp | tinyint(1) | YES | | 0 | >> > | >> > | isfn | tinyint(1) | YES | | 0 | >> > | >> > | spamwhitelisted | tinyint(1) | YES | | 0 | >> > | >> > | spamblacklisted | tinyint(1) | YES | | 0 | >> > | >> > | sascore | decimal(7,2) | YES | | 0.00 | >> > | >> > | spamreport | text | YES | | NULL | >> > | >> > | virusinfected | tinyint(1) | YES | | 0 | >> > | >> > | nameinfected | tinyint(1) | YES | | 0 | >> > | >> > | otherinfected | tinyint(1) | YES | | 0 | >> > | >> > | report | text | YES | | NULL | >> > | >> > | ismcp | tinyint(1) | YES | | 0 | >> > | >> > | ishighmcp | tinyint(1) | YES | | 0 | >> > | >> > | issamcp | tinyint(1) | YES | | 0 | >> > | >> > | mcpwhitelisted | tinyint(1) | YES | | 0 | >> > | >> > | mcpblacklisted | tinyint(1) | YES | | 0 | >> > | >> > | mcpsascore | decimal(7,2) | YES | | 0.00 | >> > | >> > | mcpreport | text | YES | | NULL | >> > | >> > | hostname | text | YES | MUL | NULL | >> > | >> > | date | date | YES | MUL | NULL | >> > | >> > | time | time | YES | | NULL | >> > | >> > | headers | text | YES | | NULL | >> > | >> > | quarantined | tinyint(1) | YES | MUL | 0 | >> > | >> > >> +-----------------+--------------+------+-----+-------------------+-----------------------------+ >> > 36 rows in set (0.01 sec) >> > describe mtalog; >> > +-----------+-------------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +-----------+-------------+------+-----+---------+-------+ >> > | timestamp | datetime | YES | MUL | NULL | | >> > | host | text | YES | | NULL | | >> > | type | text | YES | MUL | NULL | | >> > | msg_id | varchar(20) | YES | | NULL | | >> > | relay | text | YES | | NULL | | >> > | dsn | text | YES | | NULL | | >> > | status | text | YES | | NULL | | >> > | delay | time | YES | | NULL | | >> > +-----------+-------------+------+-----+---------+-------+ >> > 8 rows in set (0.00 sec) >> > >> > describe mcp_rules >> > -> ; >> > +-----------+-----------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +-----------+-----------+------+-----+---------+-------+ >> > | rule | char(100) | NO | PRI | | | >> > | rule_desc | char(200) | NO | | | | >> > +-----------+-----------+------+-----+---------+-------+ >> > 2 rows in set (0.00 sec) >> >> describe outq; >> > +--------------+------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +--------------+------+------+-----+---------+-------+ >> > | id | text | YES | | NULL | | >> > | cdate | date | YES | | NULL | | >> > | ctime | time | YES | | NULL | | >> > | from_address | text | YES | | NULL | | >> > | to_address | text | YES | | NULL | | >> > | subject | text | YES | | NULL | | >> > | message | text | YES | | NULL | | >> > | size | text | YES | | NULL | | >> > | priority | text | YES | | NULL | | >> > | attempts | text | YES | | NULL | | >> > | lastattempt | text | YES | | NULL | | >> > | hostname | text | YES | MUL | NULL | | >> > +--------------+------+------+-----+---------+-------+ >> > 12 rows in set (0.00 sec) >> > describe sa_rules; >> > +-----------+--------------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +-----------+--------------+------+-----+---------+-------+ >> > | rule | varchar(100) | NO | PRI | | | >> > | rule_desc | varchar(200) | NO | | | | >> > +-----------+--------------+------+-----+---------+-------+ >> > 2 rows in set (0.00 sec) >> > describe saved_filters; >> > +----------+------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +----------+------+------+-----+---------+-------+ >> > | name | text | NO | MUL | NULL | | >> > | col | text | NO | | NULL | | >> > | operator | text | NO | | NULL | | >> > | value | text | NO | | NULL | | >> > | username | text | NO | | NULL | | >> > +----------+------+------+-----+---------+-------+ >> > 5 rows in set (0.00 sec) >> > describe spamscore; >> > ERROR 1146 (42S02): Table 'mailscanner.spamscore' doesn't exist >> > mysql> describe spamscores; >> > +---------------+---------------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +---------------+---------------+------+-----+---------+-------+ >> > | user | varchar(40) | NO | PRI | | | >> > | lowspamscore | decimal(10,0) | NO | | 0 | | >> > | highspamscore | decimal(10,0) | NO | | 0 | | >> > +---------------+---------------+------+-----+---------+-------+ >> > 3 rows in set (0.00 sec) >> > describe user_filters; >> > +------------+---------------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +------------+---------------+------+-----+---------+-------+ >> > | username | varchar(60) | NO | MUL | | | >> > | filter | text | YES | | NULL | | >> > | verify_key | varchar(32) | NO | | | | >> > | active | enum('N','Y') | YES | | N | | >> > +------------+---------------+------+-----+---------+-------+ >> > 4 rows in set (0.00 sec) >> > describe users; >> > >> +-------------------+---------------------------+------+-----+---------+-------+ >> > | Field | Type | Null | Key | Default | >> > Extra | >> > >> +-------------------+---------------------------+------+-----+---------+-------+ >> > | username | varchar(60) | NO | PRI | | >> > | >> > | password | varchar(32) | YES | | NULL | >> > | >> > | fullname | varchar(50) | NO | | | >> > | >> > | type | enum('A','D','U','R','H') | YES | | NULL | >> > | >> > | quarantine_report | tinyint(1) | YES | | 0 | >> > | >> > | spamscore | tinyint(4) | YES | | 0 | >> > | >> > | highspamscore | tinyint(4) | YES | | 0 | >> > | >> > | noscan | tinyint(1) | YES | | 0 | >> > | >> > | quarantine_rcpt | varchar(60) | YES | | NULL | >> > | >> > >> +-------------------+---------------------------+------+-----+---------+-------+ >> > 9 rows in set (0.00 sec) >> > describe whitelist; >> > +--------------+---------+------+-----+---------+----------------+ >> > | Field | Type | Null | Key | Default | Extra | >> > +--------------+---------+------+-----+---------+----------------+ >> > | id | int(11) | NO | PRI | NULL | auto_increment | >> > | to_address | text | YES | MUL | NULL | | >> > | to_domain | text | YES | | NULL | | >> > | from_address | text | YES | | NULL | | >> > +--------------+---------+------+-----+---------+----------------+ >> > 4 rows in set (0.00 sec) >> > >> > >> > is this you looking for?? >> > i hope this help you. >> > Milenko Letic >> > >> > 2012/4/5 Tom?? Kurinec >> >> >> >> Oh God THANK YOU Peter!!! >> >> >> >> You seems to be only one who really got it. I thought it's obvious >> what I >> >> meant, but I was probably wrong. Still I can't figure it out. >> >> >> >> Please creators of MailScanner the great great, may be the best free >> >> mighty tool. Can you write me the table structure that actually works >> with >> >> MailScanner? I'm probably stupid, because I can't get it from the >> manual. >> >> Can you accept my stupidity and write me the table structure? I would >> be >> >> very thankful and may be even donate your great project! >> >> >> >> Many many thanks. >> >> >> >> Tom >> >> >> >> D?a 5.4.2012 15:43, "Peter Bonivart" >> nap?sal(-a): >> >> >> >>> On Thu, Apr 5, 2012 at 3:11 PM, Joolee wrote: >> >>> > Well, if you did read the manual, you'd seen that there is a >> property >> >>> > called "SQL Debug" you can set to "Yes" to get more information from >> >>> > Mailscanner about the MySQL connection. >> >>> > You tell us MailScanner connected to MySQL properly? In that case, >> you >> >>> > can tell us what queries your MailScanner sends to MySQL and what >> >>> > answers it receives. How do you know that Mailscanner connects >> >>> > properly and the configured queries give the correct results? >> >>> >> >>> What he's asking for is to how to set up the database needed, he even >> >>> gives an example of what he wants in his first post. Still people just >> >>> post stuff like RTFM, turn debugging on, read the source, if you don't >> >>> understand it you shouldn't run it and so on. >> >>> >> >>> I have snapped at people too but I have never seen so many feel >> >>> obliged to reply to this guy without actually helping him the way he >> >>> wants to be helped. If you can't or won't help him why do feel a need >> >>> to tell him so? Can't you just ignore his post? >> >>> >> >>> If you have figured out how to set up a working database it wouldn't >> >>> be so hard to dump the structure of it so he could import it. Maybe >> >>> someone could post it to a wiki and help the next guy out as well. >> >>> >> >>> /peter >> >>> -- >> >>> MailScanner mailing list >> >>> mailscanner@lists.mailscanner.info >> >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >>> >> >>> Before posting, read http://wiki.mailscanner.info/posting >> >>> >> >>> Support MailScanner development - buy the book off the website! >> >> >> >> >> >> -- >> >> MailScanner mailing list >> >> mailscanner@lists.mailscanner.info >> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> >> >> Support MailScanner development - buy the book off the website! >> >> >> > >> > >> > -- >> > MailScanner mailing list >> > mailscanner@lists.mailscanner.info >> > http://lists.mailscanner.info/mailman/listinfo/mailscanner >> > >> > Before posting, read http://wiki.mailscanner.info/posting >> > >> > Support MailScanner development - buy the book off the website! >> > >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120405/6ed2f428/attachment-0001.html From jeremy at fluxlabs.net Thu Apr 5 16:32:35 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Thu Apr 5 16:32:50 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> <4F7DAB6E.9070403@alexb.ch> <4F7DB510.7020308@cnpapers.com>, Message-ID: <97A0A27F-950B-4521-9F9F-774523216533@fluxlabs.net> You probably should have lead with that comment. -- Jeremy McSpadden On Apr 5, 2012, at 10:29 AM, "Tom?? Kurinec" wrote: > Thank you for suggestion Steve, but what I'm exactly trying to do is a > web interface for customers in company where i work. In the interface > the users should be able to write their own rules for their domains > (accounts) using some combo boxes and text boxes and so on... From mikoletic at gmail.com Fri Apr 6 08:08:00 2012 From: mikoletic at gmail.com (Milenko Letic) Date: Fri Apr 6 08:08:09 2012 Subject: What tables to create for using SQL capability of MailScanner conf. In-Reply-To: <97A0A27F-950B-4521-9F9F-774523216533@fluxlabs.net> References: <18EEAB06-4EDE-44CE-A74B-3917B3CFACBC@topdog.za.net> <648EE657-77AC-422B-B4A4-F21C5D727423@topdog.za.net> <4F7DAB6E.9070403@alexb.ch> <4F7DB510.7020308@cnpapers.com> <97A0A27F-950B-4521-9F9F-774523216533@fluxlabs.net> Message-ID: i have not this parametar in MailScanner.conf (SQL Ruleset). Sory . Good luck On Thu, Apr 5, 2012 at 5:32 PM, Jeremy McSpadden wrote: > You probably should have lead with that comment. > > > -- > Jeremy McSpadden > > On Apr 5, 2012, at 10:29 AM, "Tom?? Kurinec" > wrote: > > > Thank you for suggestion Steve, but what I'm exactly trying to do is a > > web interface for customers in company where i work. In the interface > > the users should be able to write their own rules for their domains > > (accounts) using some combo boxes and text boxes and so on... > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120406/6e12d3ae/attachment.html From brose at med.wayne.edu Fri Apr 6 16:44:08 2012 From: brose at med.wayne.edu (Rose, Bobby) Date: Fri Apr 6 16:44:23 2012 Subject: MailScanner and Spamassasin and Recipient count Message-ID: Does anyone know how to have MailScanner pass the expanded recipients to spamassassin? I know you can count the number of recipients in the header but when it's to a group or BCC, it's only one recipient or so in the headers so you can't count. I'm assuming MailScanner knows the recipients since it logs it to mailwatch. Just wondering if there is a way of passing that info to SA so it could count envelope recipients instead of headers. Thanks -=B ________________________________ This document may include proprietary and confidential information of Wayne State University Physician Group and may only be read by those person(s) to whom it is addressed. If you have received this e-mail message in error, please notify us immediately. This document may not be reproduced, copied, distributed, published, modified or furnished to third parties, without prior written consent of Wayne State University Physician Group. Thank you. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120406/23e3bedb/attachment.html From ms-list at alexb.ch Fri Apr 6 17:01:17 2012 From: ms-list at alexb.ch (Alex Broens) Date: Fri Apr 6 17:01:46 2012 Subject: MailScanner and Spamassasin and Recipient count In-Reply-To: References: Message-ID: <4F7F134D.6060901@alexb.ch> On 04/06/2012 05:44 PM, Rose, Bobby wrote: > Does anyone know how to have MailScanner pass the expanded recipients > to spamassassin? I know you can count the number of recipients in > the header but when it's to a group or BCC, it's only one recipient > or so in the headers so you can't count. I'm assuming MailScanner > knows the recipients since it logs it to mailwatch. Just wondering > if there is a way of passing that info to SA so it could count > envelope recipients instead of headers. AFAIK, this has to be done at MTA level for it to pass it on to MailScanner / SA Alex From brose at med.wayne.edu Fri Apr 6 17:12:49 2012 From: brose at med.wayne.edu (Rose, Bobby) Date: Fri Apr 6 17:13:06 2012 Subject: MailScanner and Spamassasin and Recipient count In-Reply-To: <4F7F134D.6060901@alexb.ch> References: <4F7F134D.6060901@alexb.ch> Message-ID: I'm not looking to record the recipients in the headers but MailScanner knows the envelope recipients for things like the "Ignore Spam Whitelist If Recipients Exceed" option. I'm looking for a way for SA to have either the envelope recipients for a count rule or maybe the envelope recipient count from MailScanner to be referenced in SA. Make sense? -=B -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Alex Broens Sent: Friday, April 06, 2012 12:01 PM To: mailscanner@lists.mailscanner.info Subject: Re: MailScanner and Spamassasin and Recipient count On 04/06/2012 05:44 PM, Rose, Bobby wrote: > Does anyone know how to have MailScanner pass the expanded recipients > to spamassassin? I know you can count the number of recipients in the > header but when it's to a group or BCC, it's only one recipient or so > in the headers so you can't count. I'm assuming MailScanner knows the > recipients since it logs it to mailwatch. Just wondering if there is > a way of passing that info to SA so it could count envelope recipients > instead of headers. AFAIK, this has to be done at MTA level for it to pass it on to MailScanner / SA Alex -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! ________________________________ This document may include proprietary and confidential information of Wayne State University Physician Group and may only be read by those person(s) to whom it is addressed. If you have received this e-mail message in error, please notify us immediately. This document may not be reproduced, copied, distributed, published, modified or furnished to third parties, without prior written consent of Wayne State University Physician Group. Thank you. From ka at pacific.net Fri Apr 6 17:13:33 2012 From: ka at pacific.net (Ken A) Date: Fri Apr 6 17:13:48 2012 Subject: MailScanner and Spamassasin and Recipient count In-Reply-To: References: Message-ID: <4F7F162D.3040906@pacific.net> If you mean so that SA could apply per recipient rules, then you'll need to split recipients at the MTA. http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:sendmail:how_to:split_mails_per_recipient Ken On 4/6/2012 10:44 AM, Rose, Bobby wrote: > Does anyone know how to have MailScanner pass the expanded recipients to spamassassin? I know you can count the number of recipients in the header but when it's to a group or BCC, it's only one recipient or so in the headers so you can't count. I'm assuming MailScanner knows the recipients since it logs it to mailwatch. Just wondering if there is a way of passing that info to SA so it could count envelope recipients instead of headers. > > Thanks > -=B > > ________________________________ > > This document may include proprietary and confidential information of Wayne State University Physician Group and may only be read by those person(s) to whom it is addressed. If you have received this e-mail message in error, please notify us immediately. This document may not be reproduced, copied, distributed, published, modified or furnished to third parties, without prior written consent of Wayne State University Physician Group. Thank you. > > > > -- Ken Anderson Pacific Internet - http://www.pacific.net Latest Pacific.Net Status - http://twitter.com/pacnetstatus From brose at med.wayne.edu Fri Apr 6 18:27:27 2012 From: brose at med.wayne.edu (Rose, Bobby) Date: Fri Apr 6 18:27:52 2012 Subject: MailScanner and Spamassasin and Recipient count In-Reply-To: <4F7F162D.3040906@pacific.net> References: <4F7F162D.3040906@pacific.net> Message-ID: Nope, not what I'm talking about... trying to get a count of recipients for some SA rules which depends only on the To and CC header fields which is useless when the message has BCC recipients or the recipient in the header is a mail group. But I think I got it. I added this to my sendmail mc to get the envelope recipient count into the headers H?1?X-Envelope-Nrcpts: ${nrcpts} Then this rule in SA to trip if greater than 1 to the max possible per transaction. header __MULTIPLE_NRCPTS X-Envelope-Nrcpts =~ /^([2-9]\d*|[1]\d{1}|[1-9]\d{2})$/ -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Ken A Sent: Friday, April 06, 2012 12:14 PM To: mailscanner@lists.mailscanner.info Subject: Re: MailScanner and Spamassasin and Recipient count If you mean so that SA could apply per recipient rules, then you'll need to split recipients at the MTA. http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:sendmail:how_to:split_mails_per_recipient Ken On 4/6/2012 10:44 AM, Rose, Bobby wrote: > Does anyone know how to have MailScanner pass the expanded recipients to spamassassin? I know you can count the number of recipients in the header but when it's to a group or BCC, it's only one recipient or so in the headers so you can't count. I'm assuming MailScanner knows the recipients since it logs it to mailwatch. Just wondering if there is a way of passing that info to SA so it could count envelope recipients instead of headers. > > Thanks > -=B > > ________________________________ > > This document may include proprietary and confidential information of Wayne State University Physician Group and may only be read by those person(s) to whom it is addressed. If you have received this e-mail message in error, please notify us immediately. This document may not be reproduced, copied, distributed, published, modified or furnished to third parties, without prior written consent of Wayne State University Physician Group. Thank you. > > > > -- Ken Anderson Pacific Internet - http://www.pacific.net Latest Pacific.Net Status - http://twitter.com/pacnetstatus -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! ________________________________ This document may include proprietary and confidential information of Wayne State University Physician Group and may only be read by those person(s) to whom it is addressed. If you have received this e-mail message in error, please notify us immediately. This document may not be reproduced, copied, distributed, published, modified or furnished to third parties, without prior written consent of Wayne State University Physician Group. Thank you. From rvdmerwe at mhg.co.za Tue Apr 10 15:49:34 2012 From: rvdmerwe at mhg.co.za (Rabie Van der Merwe) Date: Tue Apr 10 15:49:58 2012 Subject: MailScanner failing on CentOS 6. Message-ID: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/5296e464/attachment.html From jeremy at fluxlabs.net Tue Apr 10 16:13:31 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Apr 10 16:13:56 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> Message-ID: The pasted logs do not show it dying. Is the process stopped when you check? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From: Rabie Van der Merwe > Reply-To: MailScanner discussion > Date: Tue, 10 Apr 2012 16:49:34 +0200 To: MailScanner discussion > Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/1e652e2e/attachment.html From rvdmerwe at mhg.co.za Tue Apr 10 16:18:01 2012 From: rvdmerwe at mhg.co.za (Rabie Van der Merwe) Date: Tue Apr 10 16:18:13 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> Message-ID: <8C148A1461A6D7468D90F49CCD5BCA62028D9B89@cptwexc04.za.mhgad.com> It seems to choke after while extracting the content of the emails for scanning: [root@quazar MailScanner]# cd incoming/ [root@quazar incoming]# cd 10995/ [root@quazar 10995]# ls -la total 56 drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 . drwxr-xr-x 5 postfix postfix 4096 Apr 10 17:10 .. drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 26E3B2913.A3919 -rw-r----- 1 postfix postfix 586 Apr 10 17:10 26E3B2913.A3919.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 47F2928D6.AC41A -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 47F2928D6.AC41A.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6B76B28D8.ADEAE -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 6B76B28D8.ADEAE.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6F02C2909.A8164 -rw-r----- 1 postfix postfix 349 Apr 10 17:10 6F02C2909.A8164.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 8886328D5.AC7BD -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 8886328D5.AC7BD.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 C393928D7.A884D -rw-r----- 1 postfix postfix 2101 Apr 10 17:10 C393928D7.A884D.header [root@quazar 10995]# cd 26E3B2913.A3919 [root@quazar 26E3B2913.A3919]# ls -la total 8 drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 . drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 .. It doesn't (to me at least) doesn't seem to get past the header. I have checked SELINUX is disabled. Regards Rabie From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: 10 April 2012 16:50 To: mailscanner@lists.mailscanner.info Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/a6a79db5/attachment.html From Sampson at p2sol.com Tue Apr 10 16:19:03 2012 From: Sampson at p2sol.com (Sampson, Aaron) Date: Tue Apr 10 16:19:18 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> Message-ID: <4ACB6FBB6E06074DA18D653BD3155A6637ECEA@COMM1.p2sol.com> Sounds like the taint error that I was getting for a while from what you stated. Have you added the -U? Not sure if that taint error was an error in the earlier verisons. From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 9:50 AM To: mailscanner@lists.mailscanner.info Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/ed782fc4/attachment.html From rvdmerwe at mhg.co.za Tue Apr 10 16:22:43 2012 From: rvdmerwe at mhg.co.za (Rabie Van der Merwe) Date: Tue Apr 10 16:22:57 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> Message-ID: <8C148A1461A6D7468D90F49CCD5BCA62028D9B8B@cptwexc04.za.mhgad.com> Here: Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... And Here: Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... I think ... From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: 10 April 2012 17:14 To: MailScanner discussion Subject: Re: MailScanner failing on CentOS 6. The pasted logs do not show it dying. Is the process stopped when you check? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From: Rabie Van der Merwe Reply-To: MailScanner discussion Date: Tue, 10 Apr 2012 16:49:34 +0200 To: MailScanner discussion Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/7d727110/attachment-0001.html From jeremy at fluxlabs.net Tue Apr 10 16:22:44 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Apr 10 16:23:02 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B89@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> <8C148A1461A6D7468D90F49CCD5BCA62028D9B89@cptwexc04.za.mhgad.com> Message-ID: <54F1D554C257CD40B99DACFA0729B4EA0C53DA9D@BL2PRD0610MB374.namprd06.prod.outlook.com> Are you running -U on your mailscanner # line? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 10:18 AM To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. It seems to choke after while extracting the content of the emails for scanning: [root@quazar MailScanner]# cd incoming/ [root@quazar incoming]# cd 10995/ [root@quazar 10995]# ls -la total 56 drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 . drwxr-xr-x 5 postfix postfix 4096 Apr 10 17:10 .. drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 26E3B2913.A3919 -rw-r----- 1 postfix postfix 586 Apr 10 17:10 26E3B2913.A3919.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 47F2928D6.AC41A -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 47F2928D6.AC41A.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6B76B28D8.ADEAE -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 6B76B28D8.ADEAE.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6F02C2909.A8164 -rw-r----- 1 postfix postfix 349 Apr 10 17:10 6F02C2909.A8164.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 8886328D5.AC7BD -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 8886328D5.AC7BD.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 C393928D7.A884D -rw-r----- 1 postfix postfix 2101 Apr 10 17:10 C393928D7.A884D.header [root@quazar 10995]# cd 26E3B2913.A3919 [root@quazar 26E3B2913.A3919]# ls -la total 8 drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 . drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 .. It doesn't (to me at least) doesn't seem to get past the header. I have checked SELINUX is disabled. Regards Rabie From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: 10 April 2012 16:50 To: mailscanner@lists.mailscanner.info Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/f87883f2/attachment.html From Sampson at p2sol.com Tue Apr 10 16:31:42 2012 From: Sampson at p2sol.com (Sampson, Aaron) Date: Tue Apr 10 16:31:53 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B89@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> <8C148A1461A6D7468D90F49CCD5BCA62028D9B89@cptwexc04.za.mhgad.com> Message-ID: <4ACB6FBB6E06074DA18D653BD3155A6637ED15@COMM1.p2sol.com> What does your MailScanner -lint show you? From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 10:18 AM To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. It seems to choke after while extracting the content of the emails for scanning: [root@quazar MailScanner]# cd incoming/ [root@quazar incoming]# cd 10995/ [root@quazar 10995]# ls -la total 56 drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 . drwxr-xr-x 5 postfix postfix 4096 Apr 10 17:10 .. drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 26E3B2913.A3919 -rw-r----- 1 postfix postfix 586 Apr 10 17:10 26E3B2913.A3919.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 47F2928D6.AC41A -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 47F2928D6.AC41A.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6B76B28D8.ADEAE -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 6B76B28D8.ADEAE.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6F02C2909.A8164 -rw-r----- 1 postfix postfix 349 Apr 10 17:10 6F02C2909.A8164.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 8886328D5.AC7BD -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 8886328D5.AC7BD.header drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 C393928D7.A884D -rw-r----- 1 postfix postfix 2101 Apr 10 17:10 C393928D7.A884D.header [root@quazar 10995]# cd 26E3B2913.A3919 [root@quazar 26E3B2913.A3919]# ls -la total 8 drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 . drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 .. It doesn't (to me at least) doesn't seem to get past the header. I have checked SELINUX is disabled. Regards Rabie From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: 10 April 2012 16:50 To: mailscanner@lists.mailscanner.info Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/37e48e9b/attachment.html From rvdmerwe at mhg.co.za Tue Apr 10 16:36:20 2012 From: rvdmerwe at mhg.co.za (Rabie Van der Merwe) Date: Tue Apr 10 16:36:35 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <4ACB6FBB6E06074DA18D653BD3155A6637ECEA@COMM1.p2sol.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> <4ACB6FBB6E06074DA18D653BD3155A6637ECEA@COMM1.p2sol.com> Message-ID: <8C148A1461A6D7468D90F49CCD5BCA62028D9B8F@cptwexc04.za.mhgad.com> I recalled something like that from the list, but as luck would have it I had to purge my email archive :( Where do I have to run the '-U'? R From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Sampson, Aaron Sent: 10 April 2012 17:19 To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. Sounds like the taint error that I was getting for a while from what you stated. Have you added the -U? Not sure if that taint error was an error in the earlier verisons. From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 9:50 AM To: mailscanner@lists.mailscanner.info Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/e004c779/attachment.html From jeremy at fluxlabs.net Tue Apr 10 16:38:53 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Apr 10 16:39:29 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B8B@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> <8C148A1461A6D7468D90F49CCD5BCA62028D9B8B@cptwexc04.za.mhgad.com> Message-ID: <54F1D554C257CD40B99DACFA0729B4EA0C53DC46@BL2PRD0610MB374.namprd06.prod.outlook.com> That's not stopping/crashing .. that is each child process of MS. Notice PID 7022 & 7194. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 10:23 AM To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. Here: Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... And Here: Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... I think ... From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: 10 April 2012 17:14 To: MailScanner discussion Subject: Re: MailScanner failing on CentOS 6. The pasted logs do not show it dying. Is the process stopped when you check? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From: Rabie Van der Merwe > Reply-To: MailScanner discussion > Date: Tue, 10 Apr 2012 16:49:34 +0200 To: MailScanner discussion > Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/c5423fea/attachment-0001.html From ms-list at alexb.ch Tue Apr 10 16:44:56 2012 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 10 16:45:15 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> Message-ID: <4F845578.5050902@alexb.ch> On 04/10/2012 04:49 PM, Rabie Van der Merwe wrote: > Hi, > > I am trying to diagnose why MailScanner is dying after upgrading from > CentOS/RHEL5 to 6. > I am using Postfix, ClamD and MailWatch, so far I seem to have it down > to something to > do with the file permissions and setting the working group to clamav, if > I disable scanning > ie, no AV or Spam checking it passes email. > > Even if I change the output in MailScanner.conf to debug I dont get > much, any thoughts where to from here? > my working Pfix/Mailwatch settings are: # User to run as (not normally used for sendmail) # If you want to change the ownership or permissions of the quarantine or # temporary files created by MailScanner, please see the "Incoming Work" # settings later in this file. #Run As User = mail #Run As User = postfix Run As User = postfix # Group to run as (not normally used for sendmail) Run As Group = postfix Clamd conf: Allow supplementary is set to Yes for Mailwatch/MS: chown -R postfix:postfix /var/spool/MailScanner/incoming chown -R postfix:apache /var/spool/MailScanner/quarantine h2h From phaleintx at gmail.com Tue Apr 10 16:57:32 2012 From: phaleintx at gmail.com (Phil Hale) Date: Tue Apr 10 16:57:46 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <4ACB6FBB6E06074DA18D653BD3155A6637ED15@COMM1.p2sol.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> <8C148A1461A6D7468D90F49CCD5BCA62028D9B89@cptwexc04.za.mhgad.com> <4ACB6FBB6E06074DA18D653BD3155A6637ED15@COMM1.p2sol.com> Message-ID: <4F84586C.2000601@gmail.com> I'm successfully running MailScanner on CentOS 6 with SELinux turned on without issue. The only change I made is that I use Sendmail MTA enstead of Postfix. I've created some SELinux modules that are needed to allow the configuration to work correctly. On 04/10/2012 10:31 AM, Sampson, Aaron wrote: > > What does your MailScanner --lint show you? > > *From:*mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] *On Behalf Of > *Rabie Van der Merwe > *Sent:* Tuesday, April 10, 2012 10:18 AM > *To:* MailScanner discussion > *Subject:* RE: MailScanner failing on CentOS 6. > > It seems to choke after while extracting the content of the emails for > scanning: > [root@quazar MailScanner]# cd incoming/ > [root@quazar incoming]# cd 10995/ > [root@quazar 10995]# ls -la > total 56 > drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 . > drwxr-xr-x 5 postfix postfix 4096 Apr 10 17:10 .. > drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 26E3B2913.A3919 > -rw-r----- 1 postfix postfix 586 Apr 10 17:10 26E3B2913.A3919.header > drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 47F2928D6.AC41A > -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 47F2928D6.AC41A.header > drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6B76B28D8.ADEAE > -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 6B76B28D8.ADEAE.header > drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6F02C2909.A8164 > -rw-r----- 1 postfix postfix 349 Apr 10 17:10 6F02C2909.A8164.header > drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 8886328D5.AC7BD > -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 8886328D5.AC7BD.header > drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 C393928D7.A884D > -rw-r----- 1 postfix postfix 2101 Apr 10 17:10 C393928D7.A884D.header > [root@quazar 10995]# cd 26E3B2913.A3919 > [root@quazar 26E3B2913.A3919]# ls -la > total 8 > drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 . > drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 .. > > It doesn't (to me at least) doesn't seem to get past the header. > > I have checked SELINUX is disabled. > > Regards > Rabie > > > From: mailscanner-bounces@lists.mailscanner.info > > [mailto:mailscanner-bounces@lists.mailscanner.info] > On Behalf > Of Rabie > Van der Merwe > Sent: 10 April 2012 16:50 > To: mailscanner@lists.mailscanner.info > > Subject: MailScanner failing on CentOS 6. > > Hi, > > I am trying to diagnose why MailScanner is dying after upgrading from > CentOS/RHEL5 to 6. > I am using Postfix, ClamD and MailWatch, so far I seem to have it down > to something to > do with the file permissions and setting the working group to clamav, if > I disable scanning > ie, no AV or Spam checking it passes email. > > Even if I change the output in MailScanner.conf to debug I dont get > much, any thoughts where to from here? > > Regards > Rabie > > ---snip--- > Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus > Scanner version 4.84.5 starting... > Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file > /etc/MailScanner/MailScanner.conf > Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file > /etc/MailScanner/conf.d/README > Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the > phishing whitelist > Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the > phishing blacklists > Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init > function MailWatchLogging > Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child > Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results > cache > Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin > cache database > Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin > auto-whitelist functionality... > Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing > Attempts Database > Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the > Processing Attempts Database > Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType > = flock > Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 > Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock > Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing > message 2D55A28CE.AD4E6 > Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 > messages, 6458 bytes > Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 > messages > Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by > /usr/bin/file > Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: > Starting > Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by > clamd... > Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On > Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO > Apr 10 15:17:36 quazar MailScanner[7041]: Socket : > /var/run/clamav/clamd.socket > Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets > Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED > Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 > Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : > /var/spool/MailScanner/incoming/7022 > Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING > Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' > Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running > Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN > /var/spool/MailScanner/incoming/7022 > Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd > Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 > Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for > message 2D55A28CE.AD4E6 > Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus > Scanner version 4.84.5 starting... > ---snip--- > > > ---snip--- > Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus > Scanner version 4.84.5 starting... > Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file > /etc/MailScanner/MailScanner.conf > Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file > /etc/MailScanner/conf.d/README > Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the > phishing whitelist > Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the > phishing blacklists > Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init > function MailWatchLogging > Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child > Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results > cache > Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin > cache database > Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin > auto-whitelist functionality... > Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing > Attempts Database > Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the > Processing Attempts Database > Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType > = flock > Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 > Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock > Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages > waiting > Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 > messages, 202224 bytes > Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 > messages > ---snip--- > ********************************************************************** > --------- > NOTICE > --------- > This message (including attachments) contains privileged and > confidential information intended only for the person or entity to which > it is addressed. > Any review, retransmission, dissemination, copy or other use of, or > taking of any action in reliance upon this information by persons or > entities other than the intended recipient, is prohibited. > If you received this message in error, please notify the sender > immediately by e-mail, facsimile or telephone and thereafter delete the > material from any computer. > Metropolitan Health, its subsidiaries or associates, does not accept > liability for any personal views expressed in this message. > Metropolitan Health > PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 > www.mhg.co.za > ********************************************************************** > > ********************************************************************** > --------- > NOTICE > --------- > > This message (including attachments) contains privileged and > confidential information intended only for the person or entity to > which it is addressed. > > Any review, retransmission, dissemination, copy or other use of, or > taking of any action in reliance upon this information by persons or > entities other than the intended recipient, is prohibited. > > If you received this message in error, please notify the sender > immediately by e-mail, facsimile or telephone and thereafter delete > the material from any computer. > > Metropolitan Health, its subsidiaries or associates, does not accept > liability for any personal views expressed in this message. > > *Metropolitan Health** > *PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 > www.mhg.co.za > > ********************************************************************** > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/87a6ed2a/attachment.html From jeremy at fluxlabs.net Tue Apr 10 17:06:24 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Apr 10 17:06:40 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B8F@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> <4ACB6FBB6E06074DA18D653BD3155A6637ECEA@COMM1.p2sol.com>, <8C148A1461A6D7468D90F49CCD5BCA62028D9B8F@cptwexc04.za.mhgad.com> Message-ID: <091DF90F-7494-46F6-B35A-1C58CB6789F9@fluxlabs.net> In your MS perl script. First line. Add -U -- Jeremy McSpadden On Apr 10, 2012, at 11:05 AM, "Rabie Van der Merwe" > wrote: I recalled something like that from the list, but as luck would have it I had to purge my email archive :( Where do I have to run the '-U'? R From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Sampson, Aaron Sent: 10 April 2012 17:19 To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. Sounds like the taint error that I was getting for a while from what you stated. Have you added the ?U? Not sure if that taint error was an error in the earlier verisons. From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 9:50 AM To: mailscanner@lists.mailscanner.info Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/119f6d13/attachment.html From rvdmerwe at mhg.co.za Tue Apr 10 17:25:58 2012 From: rvdmerwe at mhg.co.za (Rabie Van der Merwe) Date: Tue Apr 10 17:26:11 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <54F1D554C257CD40B99DACFA0729B4EA0C53DC46@BL2PRD0610MB374.namprd06.prod.outlook.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com><8C148A1461A6D7468D90F49CCD5BCA62028D9B8B@cptwexc04.za.mhgad.com> <54F1D554C257CD40B99DACFA0729B4EA0C53DC46@BL2PRD0610MB374.namprd06.prod.outlook.com> Message-ID: <8C148A1461A6D7468D90F49CCD5BCA62028D9BA1@cptwexc04.za.mhgad.com> I have only one instance running, so 7194 is starting as 7022 no longer exists. Here is my lint: ---snip--- [root@quazar ~]# MailScanner --lint Trying to setlogsock(unix) Reading configuration file /etc/MailScanner/MailScanner.conf Reading configuration file /etc/MailScanner/conf.d/README Read 869 hostnames from the phishing whitelist Read 5484 hostnames from the phishing blacklists Config: calling custom init function MailWatchLogging Started SQL Logging child Checking version numbers... Version number in MailScanner.conf (4.84.5) is correct. Your envelope_sender_header in spam.assassin.prefs.conf is correct. MailScanner setting GID to (89) MailScanner setting UID to (89) Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 0 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = clamd" Found these virus scanners installed: clamd ======================================================================== === Filename Checks: Windows/DOS Executable (1 eicar.com) Other Checks: Found 1 problems Virus and Content Scanning: Starting ======================================================================== === If any of your virus scanners (clamd) are not listed there, you should check that they are installed correctly and that MailScanner is finding them correctly via its virus.scanners.conf. Config: calling custom end function MailWatchLogging commit ineffective with AutoCommit enabled at /usr/lib/MailScanner/MailScanner/CustomFunctions/MailWatch.pm line 93, line 1. ---snip--- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: 10 April 2012 17:39 To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. That's not stopping/crashing .. that is each child process of MS. Notice PID 7022 & 7194. -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 10:23 AM To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. Here: Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... And Here: Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... I think ... From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: 10 April 2012 17:14 To: MailScanner discussion Subject: Re: MailScanner failing on CentOS 6. The pasted logs do not show it dying. Is the process stopped when you check? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From: Rabie Van der Merwe Reply-To: MailScanner discussion Date: Tue, 10 Apr 2012 16:49:34 +0200 To: MailScanner discussion Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/9204e7a2/attachment-0001.html From Sampson at p2sol.com Tue Apr 10 17:27:43 2012 From: Sampson at p2sol.com (Sampson, Aaron) Date: Tue Apr 10 17:27:53 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9B8F@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com> <4ACB6FBB6E06074DA18D653BD3155A6637ECEA@COMM1.p2sol.com> <8C148A1461A6D7468D90F49CCD5BCA62028D9B8F@cptwexc04.za.mhgad.com> Message-ID: <4ACB6FBB6E06074DA18D653BD3155A6637ED5E@COMM1.p2sol.com> VI /usr/sbin/MailScanner This is where to put the -U it is the very first line and you add it to the end should look something like #!/usr/bin/perl -I/usr/lib/MailScanner -U From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 10:36 AM To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. I recalled something like that from the list, but as luck would have it I had to purge my email archive :( Where do I have to run the '-U'? R From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Sampson, Aaron Sent: 10 April 2012 17:19 To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. Sounds like the taint error that I was getting for a while from what you stated. Have you added the -U? Not sure if that taint error was an error in the earlier verisons. From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 9:50 AM To: mailscanner@lists.mailscanner.info Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/c89bfbe1/attachment.html From rvdmerwe at mhg.co.za Tue Apr 10 17:41:32 2012 From: rvdmerwe at mhg.co.za (Rabie Van der Merwe) Date: Tue Apr 10 17:41:45 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <091DF90F-7494-46F6-B35A-1C58CB6789F9@fluxlabs.net> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com><4ACB6FBB6E06074DA18D653BD3155A6637ECEA@COMM1.p2sol.com>, <8C148A1461A6D7468D90F49CCD5BCA62028D9B8F@cptwexc04.za.mhgad.com> <091DF90F-7494-46F6-B35A-1C58CB6789F9@fluxlabs.net> Message-ID: <8C148A1461A6D7468D90F49CCD5BCA62028D9BB9@cptwexc04.za.mhgad.com> The '-U' seems to have done the trick, everything is working. I have some repo's like epel, atrpms and freshrpms enable, I will check if I haven't accidentally updated some of the MailScanner required perl modules. I assume these will cause taint errors? R From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Jeremy McSpadden Sent: 10 April 2012 18:06 To: MailScanner discussion Subject: Re: MailScanner failing on CentOS 6. In your MS perl script. First line. Add -U -- Jeremy McSpadden On Apr 10, 2012, at 11:05 AM, "Rabie Van der Merwe" wrote: I recalled something like that from the list, but as luck would have it I had to purge my email archive :( Where do I have to run the '-U'? R From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Sampson, Aaron Sent: 10 April 2012 17:19 To: MailScanner discussion Subject: RE: MailScanner failing on CentOS 6. Sounds like the taint error that I was getting for a while from what you stated. Have you added the -U? Not sure if that taint error was an error in the earlier verisons. From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Rabie Van der Merwe Sent: Tuesday, April 10, 2012 9:50 AM To: mailscanner@lists.mailscanner.info Subject: MailScanner failing on CentOS 6. Hi, I am trying to diagnose why MailScanner is dying after upgrading from CentOS/RHEL5 to 6. I am using Postfix, ClamD and MailWatch, so far I seem to have it down to something to do with the file permissions and setting the working group to clamav, if I disable scanning ie, no AV or Spam checking it passes email. Even if I change the output in MailScanner.conf to debug I dont get much, any thoughts where to from here? Regards Rabie ---snip--- Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the phishing whitelist Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the phishing blacklists Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init function MailWatchLogging Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results cache Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin cache database Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the Processing Attempts Database Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType = flock Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0 Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing message 2D55A28CE.AD4E6 Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1 messages, 6458 bytes Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1 messages Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by /usr/bin/file Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning: Starting Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by clamd... Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO Apr 10 15:17:36 quazar MailScanner[7041]: Socket : /var/run/clamav/clamd.socket Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300 Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir : /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG' Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN /var/spool/MailScanner/incoming/7022 Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0 Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for message 2D55A28CE.AD4E6 Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... ---snip--- ---snip--- Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file /etc/MailScanner/conf.d/README Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the phishing whitelist Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the phishing blacklists Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init function MailWatchLogging Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results cache Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin cache database Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin auto-whitelist functionality... Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the Processing Attempts Database Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType = flock Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0 Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages waiting Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2 messages, 202224 bytes Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2 messages ---snip--- ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** ********************************************************************** --------- NOTICE --------- This message (including attachments) contains privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from any computer. Metropolitan Health, its subsidiaries or associates, does not accept liability for any personal views expressed in this message. Metropolitan Health PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 www.mhg.co.za ********************************************************************** -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/6ad30f1d/attachment.html From ssilva at sgvwater.com Tue Apr 10 20:08:26 2012 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Apr 10 20:09:03 2012 Subject: MailScanner failing on CentOS 6. In-Reply-To: <8C148A1461A6D7468D90F49CCD5BCA62028D9BB9@cptwexc04.za.mhgad.com> References: <8C148A1461A6D7468D90F49CCD5BCA62028D9B84@cptwexc04.za.mhgad.com><4ACB6FBB6E06074DA18D653BD3155A6637ECEA@COMM1.p2sol.com>, <8C148A1461A6D7468D90F49CCD5BCA62028D9B8F@cptwexc04.za.mhgad.com> <091DF90F-7494-46F6-B35A-1C58CB6789F9@fluxlabs.net> <8C148A1461A6D7468D90F49CCD5BCA62028D9BB9@cptwexc04.za.mhgad.com> Message-ID: on 4/10/2012 9:41 AM Rabie Van der Merwe spake the following: > The '-U' seems to have done the trick, everything is working. > > I have some repo's like epel, atrpms and freshrpms enable, I will check if I > haven't > > accidentally updated some of the MailScanner required perl modules. > > I assume these will cause taint errors? > > R I do believe the taint issues are because of newer versions of perl, not the modules themselves... From ms-list at alexb.ch Tue Apr 10 20:30:46 2012 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 10 20:30:58 2012 Subject: byebye MailScanner Message-ID: <4F848A66.7040702@alexb.ch> After 6 years of being a happy MailScanner, I've had to change a lighweight glue without the eternal Perl parties. Thanks to Jules, Glenn, Scott, Hugo & all the others which held my hand during my first steps with MailScanner. Also thanks to Steve Freegard for Mailwatch. I'll be unsubscribing in a couple of days. (for those who may want to contact, me this addr will remain active for quite a while) Alex PS: if curious, I'm moving my stuff to Fuglu. (https://sourceforge.net/apps/trac/fuglu/) From ka at pacific.net Tue Apr 10 20:59:14 2012 From: ka at pacific.net (Ken A) Date: Tue Apr 10 20:59:37 2012 Subject: byebye MailScanner In-Reply-To: <4F848A66.7040702@alexb.ch> References: <4F848A66.7040702@alexb.ch> Message-ID: <4F849112.9030306@pacific.net> On 4/10/2012 2:30 PM, Alex Broens wrote: > After 6 years of being a happy MailScanner, I've had to change a > lighweight glue without the eternal Perl parties. > > Thanks to Jules, Glenn, Scott, Hugo & all the others which held my hand > during my first steps with MailScanner. > Also thanks to Steve Freegard for Mailwatch. > > I'll be unsubscribing in a couple of days. > (for those who may want to contact, me this addr will remain active for > quite a while) > > Alex > > PS: if curious, I'm moving my stuff to Fuglu. > (https://sourceforge.net/apps/trac/fuglu/) > wow.. are there really only 2 subscribers to the fuglu-users mailing list, or is there another list somewhere ? Ken From steve.roy.wojciechowski at gmail.com Tue Apr 10 21:07:51 2012 From: steve.roy.wojciechowski at gmail.com (Steve Roy-Wojciechowski) Date: Tue Apr 10 21:07:59 2012 Subject: Archiving email and Remove These Headers = Disposition-Notification-To: Message-ID: I have a Mailscanner setup where we are archiving email for later sorting and also have a "Remove These Headers = Disposition-Notification-To:" Archiving is done via the "Archive Mail = " tag Mailscanner version is 4.74.15 For mail being delivered into an inbox the Disposition-Notification-To: is being stripped out, however mail that is archived still has this header. So the message is tossed into the archive before the header is stripped out. The issue is that is when a person later goes into the archives and reads an email it often is asking for a "read-receipt". This could be weeks or months after the original email was read in their inbox and often the user will send a "read receipt" which then arrives back at the sender months after they asked for it. How can I make sure the Disposition-Notification-To: is removed before it is archived? Thanks From steve.roy.wojciechowski at gmail.com Tue Apr 10 21:09:40 2012 From: steve.roy.wojciechowski at gmail.com (Steve Roy-Wojciechowski) Date: Tue Apr 10 21:09:48 2012 Subject: Archiving email and Remove These Headers = Disposition-Notification-To: In-Reply-To: References: Message-ID: Sorry - Mailscanner version is 4.70.6 From ms-list at alexb.ch Tue Apr 10 21:16:00 2012 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 10 21:16:12 2012 Subject: byebye MailScanner In-Reply-To: <4F849112.9030306@pacific.net> References: <4F848A66.7040702@alexb.ch> <4F849112.9030306@pacific.net> Message-ID: <4F849500.7010309@alexb.ch> On 04/10/2012 09:59 PM, Ken A wrote: > > On 4/10/2012 2:30 PM, Alex Broens wrote: >> After 6 years of being a happy MailScanner, I've had to change a >> lighweight glue without the eternal Perl parties. >> >> Thanks to Jules, Glenn, Scott, Hugo & all the others which held my hand >> during my first steps with MailScanner. >> Also thanks to Steve Freegard for Mailwatch. >> >> I'll be unsubscribing in a couple of days. >> (for those who may want to contact, me this addr will remain active for >> quite a while) >> >> Alex >> >> PS: if curious, I'm moving my stuff to Fuglu. >> (https://sourceforge.net/apps/trac/fuglu/) >> > > wow.. are there really only 2 subscribers to the fuglu-users mailing > list, or is there another list somewhere ? > Ken Mailing lists are only needed when you have problems. maybe its users just don't have any problems. .-) From alex at vidadigital.com.pa Tue Apr 10 21:23:38 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Tue Apr 10 21:23:47 2012 Subject: Archiving email and Remove These Headers = Disposition-Notification-To: In-Reply-To: References: Message-ID: Archiving *preserves everything* from the original e-mail. This is a feature, not a bug. On Tue, Apr 10, 2012 at 3:09 PM, Steve Roy-Wojciechowski < steve.roy.wojciechowski@gmail.com> wrote: > Sorry - Mailscanner version is 4.70.6 > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/5a62767b/attachment.html From alex at vidadigital.com.pa Tue Apr 10 21:40:29 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Tue Apr 10 21:40:39 2012 Subject: byebye MailScanner In-Reply-To: <4F849500.7010309@alexb.ch> References: <4F848A66.7040702@alexb.ch> <4F849112.9030306@pacific.net> <4F849500.7010309@alexb.ch> Message-ID: Too bad it only works with postfix. Otherwise I'd try it out. On Tue, Apr 10, 2012 at 3:16 PM, Alex Broens wrote: > On 04/10/2012 09:59 PM, Ken A wrote: > >> >> On 4/10/2012 2:30 PM, Alex Broens wrote: >> >>> After 6 years of being a happy MailScanner, I've had to change a >>> lighweight glue without the eternal Perl parties. >>> >>> Thanks to Jules, Glenn, Scott, Hugo & all the others which held my hand >>> during my first steps with MailScanner. >>> Also thanks to Steve Freegard for Mailwatch. >>> >>> I'll be unsubscribing in a couple of days. >>> (for those who may want to contact, me this addr will remain active for >>> quite a while) >>> >>> Alex >>> >>> PS: if curious, I'm moving my stuff to Fuglu. >>> (https://sourceforge.net/apps/**trac/fuglu/ >>> ) >>> >>> >> wow.. are there really only 2 subscribers to the fuglu-users mailing >> list, or is there another list somewhere ? >> Ken >> > > > Mailing lists are only needed when you have problems. > maybe its users just don't have any problems. > .-) > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info > http://lists.mailscanner.info/**mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/**posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/a8b8e3c1/attachment.html From ka at pacific.net Tue Apr 10 21:56:36 2012 From: ka at pacific.net (Ken Anderson) Date: Tue Apr 10 21:57:06 2012 Subject: byebye MailScanner In-Reply-To: <4F849500.7010309@alexb.ch> References: <4F848A66.7040702@alexb.ch> <4F849112.9030306@pacific.net> <4F849500.7010309@alexb.ch> Message-ID: <4F849E84.8060702@pacific.net> On 4/10/2012 3:16 PM, Alex Broens wrote: > On 04/10/2012 09:59 PM, Ken A wrote: >> >> On 4/10/2012 2:30 PM, Alex Broens wrote: >>> After 6 years of being a happy MailScanner, I've had to change a >>> lighweight glue without the eternal Perl parties. >>> >>> Thanks to Jules, Glenn, Scott, Hugo & all the others which held my hand >>> during my first steps with MailScanner. >>> Also thanks to Steve Freegard for Mailwatch. >>> >>> I'll be unsubscribing in a couple of days. >>> (for those who may want to contact, me this addr will remain active for >>> quite a while) >>> >>> Alex >>> >>> PS: if curious, I'm moving my stuff to Fuglu. >>> (https://sourceforge.net/apps/trac/fuglu/) >>> >> >> wow.. are there really only 2 subscribers to the fuglu-users mailing >> list, or is there another list somewhere ? >> Ken > > > Mailing lists are only needed when you have problems. > maybe its users just don't have any problems. > .-) > good point, maybe.. ;-) Projects with users who have no problems, are hard to evaluate in some ways.. I like to browse a project's mailing list archives to get a sense of the activity level, the user base, responsiveness of the developer(s), etc.. After years of MailScanner, a 'light' solution does sounds good though.. Ken From Sampson at p2sol.com Tue Apr 10 22:08:32 2012 From: Sampson at p2sol.com (Sampson, Aaron) Date: Tue Apr 10 22:08:42 2012 Subject: byebye MailScanner In-Reply-To: <4F848A66.7040702@alexb.ch> References: <4F848A66.7040702@alexb.ch> Message-ID: <4ACB6FBB6E06074DA18D653BD3155A6637EE8C@COMM1.p2sol.com> I am just wondering what prompted the change after so many years of using this system? Seems (to a new user) that by now you would be very familiar with M.S. therefore easier to work with, update, etc. -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Alex Broens Sent: Tuesday, April 10, 2012 2:31 PM To: mailscanner@lists.mailscanner.info Subject: byebye MailScanner After 6 years of being a happy MailScanner, I've had to change a lighweight glue without the eternal Perl parties. Thanks to Jules, Glenn, Scott, Hugo & all the others which held my hand during my first steps with MailScanner. Also thanks to Steve Freegard for Mailwatch. I'll be unsubscribing in a couple of days. (for those who may want to contact, me this addr will remain active for quite a while) Alex PS: if curious, I'm moving my stuff to Fuglu. (https://sourceforge.net/apps/trac/fuglu/) -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From bonivart at opencsw.org Tue Apr 10 22:09:07 2012 From: bonivart at opencsw.org (Peter Bonivart) Date: Tue Apr 10 22:09:37 2012 Subject: byebye MailScanner In-Reply-To: <4F849E84.8060702@pacific.net> References: <4F848A66.7040702@alexb.ch> <4F849112.9030306@pacific.net> <4F849500.7010309@alexb.ch> <4F849E84.8060702@pacific.net> Message-ID: On Tue, Apr 10, 2012 at 10:56 PM, Ken Anderson wrote: > After years of MailScanner, a 'light' solution does sounds good though.. Do you really have that much problems? I've been a MailScanner user for about 9 years running multiple installations of varying size and had almost zero problems during this whole time. >From what I can deduce from this mailing list those who have problems have Postfix (nice but not a good fit for MailScanner) and/or updates everything on their production systems without testing it first. /peter From ms-list at alexb.ch Tue Apr 10 22:24:23 2012 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 10 22:24:36 2012 Subject: byebye MailScanner In-Reply-To: <4ACB6FBB6E06074DA18D653BD3155A6637EE8C@COMM1.p2sol.com> References: <4F848A66.7040702@alexb.ch> <4ACB6FBB6E06074DA18D653BD3155A6637EE8C@COMM1.p2sol.com> Message-ID: <4F84A507.6030606@alexb.ch> On 04/10/2012 11:08 PM, Sampson, Aaron wrote: > I am just wondering what prompted the change after so many years of using this system? Seems (to a new user) that by now you would be very familiar with M.S. therefore easier to work with, update, etc. - Years of Perl dependency hell. - Postfix's support has always been hacky. - Weight - MailScanner has lots of cool features I've never needed. Don't get me wrong, MS is a great piece of software, and I can highly recommend it as it's user base is very supportive and its future loks bright. I just needed something more lightweight. Alex > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Alex Broens > Sent: Tuesday, April 10, 2012 2:31 PM > To: mailscanner@lists.mailscanner.info > Subject: byebye MailScanner > > After 6 years of being a happy MailScanner, I've had to change a lighweight glue without the eternal Perl parties. > > Thanks to Jules, Glenn, Scott, Hugo& all the others which held my hand during my first steps with MailScanner. > Also thanks to Steve Freegard for Mailwatch. > > I'll be unsubscribing in a couple of days. > (for those who may want to contact, me this addr will remain active for quite a while) > > Alex > > PS: if curious, I'm moving my stuff to Fuglu. > (https://sourceforge.net/apps/trac/fuglu/) > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ms-list at alexb.ch Tue Apr 10 22:28:58 2012 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 10 22:29:11 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <4F849112.9030306@pacific.net> <4F849500.7010309@alexb.ch> <4F849E84.8060702@pacific.net> Message-ID: <4F84A61A.7010309@alexb.ch> On 04/10/2012 11:09 PM, Peter Bonivart wrote: > On Tue, Apr 10, 2012 at 10:56 PM, Ken Anderson wrote: >> After years of MailScanner, a 'light' solution does sounds good though.. > > Do you really have that much problems? I've been a MailScanner user > for about 9 years running multiple installations of varying size and > had almost zero problems during this whole time. >> From what I can deduce from this mailing list those who have problems > have Postfix (nice but not a good fit for MailScanner) and/or updates > everything on their production systems without testing it first. Nope.. I didn't have any problems coz I never followed each upgrade which was available. (I'm embarrased to tell what version I'm still using- and it runs very nicely) I just needed something lighter than MS Alex From ka at pacific.net Tue Apr 10 22:31:19 2012 From: ka at pacific.net (Ken Anderson) Date: Tue Apr 10 22:32:01 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <4F849112.9030306@pacific.net> <4F849500.7010309@alexb.ch> <4F849E84.8060702@pacific.net> Message-ID: <4F84A6A7.7020605@pacific.net> On 4/10/2012 4:09 PM, Peter Bonivart wrote: > On Tue, Apr 10, 2012 at 10:56 PM, Ken Anderson wrote: >> After years of MailScanner, a 'light' solution does sounds good though.. > > Do you really have that much problems? I've been a MailScanner user > for about 9 years running multiple installations of varying size and > had almost zero problems during this whole time. I have had very few problems too. That doesn't make MailScanner a 'light' solution though. Being a bit 'fat' doesn't make it a bad solution, either. MailScanner is awesome! Ken > >> From what I can deduce from this mailing list those who have problems > have Postfix (nice but not a good fit for MailScanner) and/or updates > everything on their production systems without testing it first. > > /peter From cecil.stoll at sccc.edu Tue Apr 10 22:38:01 2012 From: cecil.stoll at sccc.edu (Cecil O. Stoll) Date: Tue Apr 10 22:38:11 2012 Subject: byebye MailScanner In-Reply-To: <4F848A66.7040702@alexb.ch> References: <4F848A66.7040702@alexb.ch> Message-ID: <1010557489BB264B8E560911B4AB26350BA028@xmail.sccc.edu> Alex, may I ask why?? Just curious. -----Original Message----- PS: if curious, I'm moving my stuff to Fuglu. (https://sourceforge.net/apps/trac/fuglu/) From ms-list at alexb.ch Tue Apr 10 22:54:40 2012 From: ms-list at alexb.ch (Alex Broens) Date: Tue Apr 10 22:54:54 2012 Subject: byebye MailScanner In-Reply-To: <1010557489BB264B8E560911B4AB26350BA028@xmail.sccc.edu> References: <4F848A66.7040702@alexb.ch> <1010557489BB264B8E560911B4AB26350BA028@xmail.sccc.edu> Message-ID: <4F84AC20.4070905@alexb.ch> On 04/10/2012 11:38 PM, Cecil O. Stoll wrote: > Alex, may I ask why?? Just curious. - weight - MS has many features I don't need. > -----Original Message----- > PS: if curious, I'm moving my stuff to Fuglu. > (https://sourceforge.net/apps/trac/fuglu/) > > > From carola at dicyt.umss.edu.bo Tue Apr 10 23:00:43 2012 From: carola at dicyt.umss.edu.bo (M.Sc. Carola Vargas) Date: Tue Apr 10 23:12:40 2012 Subject: Unsuscribe Message-ID: <00de01cd1765$5ff8a980$1fe9fc80$@umss.edu.bo> Unsuscribe ---------------------------------------------------------------------------- ----- M.Sc. Carola Vargas Funcionaria Departamento de Informaci?n Cient?fica y Tecnol?gica Direcci?n de Investigaci?n Cient?fica y Tecnol?gica - DICyT Universidad Mayor de San Sim?n Cochabamba, Bolivia _____ Estoy utilizando la versi?n gratuita de SPAMfighter para usuarios privados. Hasta ahora ha bloqueado 517 spam y me ha ahorrado mucho tiempo. ?Cansado de un PC lento? SLOW-PCfighter acelera su PC . -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/d4a1bdba/attachment.html From jeremy at fluxlabs.net Tue Apr 10 23:22:41 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Apr 10 23:22:54 2012 Subject: Unsuscribe In-Reply-To: <00de01cd1765$5ff8a980$1fe9fc80$@umss.edu.bo> Message-ID: See http://lists.mailscanner.info/mailman/listinfo/mailscanner to unsubscribe -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 From: "M.Sc. Carola Vargas" > Reply-To: MailScanner discussion > Date: Tue, 10 Apr 2012 18:00:43 -0400 To: MailScanner discussion > Subject: Unsuscribe Unsuscribe --------------------------------------------------------------------------------- M.Sc. Carola Vargas Funcionaria Departamento de Informaci?n Cient?fica y Tecnol?gica Direcci?n de Investigaci?n Cient?fica y Tecnol?gica - DICyT Universidad Mayor de San Sim?n Cochabamba, Bolivia ________________________________ Estoy utilizando la versi?n gratuita de SPAMfighter para usuarios privados. Hasta ahora ha bloqueado 517 spam y me ha ahorrado mucho tiempo. ?Cansado de un PC lento? SLOW-PCfighter acelera su PC. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/a9cbc9e6/attachment.html From noel.butler at ausics.net Wed Apr 11 00:31:37 2012 From: noel.butler at ausics.net (Noel Butler) Date: Wed Apr 11 00:31:51 2012 Subject: byebye MailScanner In-Reply-To: <4F848A66.7040702@alexb.ch> References: <4F848A66.7040702@alexb.ch> Message-ID: <1334100697.4124.12.camel@tardis> Skipped content of type multipart/related-------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 490 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120411/dcc87f8e/attachment.bin From peter at farrows.org Wed Apr 11 00:47:21 2012 From: peter at farrows.org (Peter Farrow) Date: Wed Apr 11 00:47:30 2012 Subject: byebye MailScanner In-Reply-To: <1334100697.4124.12.camel@tardis> References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> Message-ID: <4F84C689.8040004@farrows.org> It uses Postfix... /shudder/ Not sure I could stomach postfix even if it came with a winning lottery ticket. :-P P. On 11/04/2012 00:31, Noel Butler wrote: > On Tue, 2012-04-10 at 21:30 +0200, Alex Broens wrote: >> After 6 years of being a happy MailScanner, I've had to change a >> lighweight glue without the eternal Perl parties. >> > > I hear ya, though I don't care about light or fatyness, I need the > thing to work and it ceased to do so here 2 years ago, AFAIK Julian > still hasnt taken a serious look at it, or more than likely knowing > what he thinks of me, didnt bother in first place, but I moved to > amavisd-new and my headaches all went away, yeah, after using > mailscanner since around 2002, I miss some features of it, but its no > big deal, changed and got used to change, mail scanning just works > now. I stay subbed here for archiving in case I bother to try it again > one year, rarely read the list folder, dont even know why I looked in > the folder today, must have known something :") > > Best of luck Alex. > > > > > > -- horizontal ruler Peter Farrow avatar ______________________ Home: 01249 654183 Fax: 01249 461 548 Mobile: 07799605617 Skype: peter_farrow Web: www.peterfarrow.com -------------- next part -------------- Skipped content of type multipart/related From alex at vidadigital.com.pa Wed Apr 11 01:45:56 2012 From: alex at vidadigital.com.pa (Alex Neuman van der Hans) Date: Wed Apr 11 01:46:29 2012 Subject: byebye MailScanner In-Reply-To: <4F84C689.8040004@farrows.org> References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> Message-ID: <4F84D444.1000606@vidadigital.com.pa> A *golden* ticket, even! #wonkareference On 4/10/2012 6:47 PM, Peter Farrow wrote: > Not sure I could stomach postfix even if it came with a winning > lottery ticket. From andrew at topdog.za.net Wed Apr 11 01:52:31 2012 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Wed Apr 11 01:52:51 2012 Subject: byebye MailScanner In-Reply-To: <4F84AC20.4070905@alexb.ch> References: <4F848A66.7040702@alexb.ch> <1010557489BB264B8E560911B4AB26350BA028@xmail.sccc.edu> <4F84AC20.4070905@alexb.ch> Message-ID: <887721C6-E347-4D5F-8527-D4BB5806F8FB@topdog.za.net> On 10 Apr 2012, at 11:54 PM, Alex Broens wrote: > - weight > - MS has many features I don't need. How is performance on fuglu, now that you have tested it, i would think the fact that it has to use so many tcp connections to do stuff would be a bottleneck on a system with a lot of mail something mailscanner over comes by working mostly off the file system, i.e even clamd scanning in mailscanner is more efficient as the file is never streamed to the clamd daemon. -- www.baruwa.org From andrew at topdog.za.net Wed Apr 11 02:05:36 2012 From: andrew at topdog.za.net (Andrew Colin Kissa) Date: Wed Apr 11 02:05:55 2012 Subject: byebye MailScanner In-Reply-To: <4F84C689.8040004@farrows.org> References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> Message-ID: On 11 Apr 2012, at 1:47 AM, Peter Farrow wrote: > It uses Postfix... /shudder/ In all fairness, i do not think it would be had to use any other mta with this, it accepts messages on a unix socket and returns them back on a tcp socket. -- www.baruwa.org From jlarsen at richweb.com Wed Apr 11 02:13:21 2012 From: jlarsen at richweb.com (C. Jon Larsen) Date: Wed Apr 11 02:13:31 2012 Subject: byebye MailScanner In-Reply-To: <4F84C689.8040004@farrows.org> References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> Message-ID: On Wed, 11 Apr 2012, Peter Farrow wrote: > It uses Postfix... /shudder/ My 2c as along time user: Mailscanner works fine with postfix. Postfix is an excellent MTA. Compared to sendmail and qmail I much prefer it - configuration is easier to manage, especially in a cluster, performance is better (than sendmail) and the tools are better than qmail. Dont know much about exim, but postfix is supposed to have a better design from a security perspective. The folks that are having perl problems with MailScanner - its prob. your OS moreso than perl. As someone set, slapping in a poorly constructed OS (many Linux distros are these days) with random builds of perl is NOT a good idea. I have run MailScanner under Redhat (long ago) amavisd-net under Debian sarge/etch and went back to MailScanner after dabbling with the horrible commercial product that is MailFoundry. Been with MailScannner on debian now for 3 years or so. If you take the time to get a proper debian base OS setup, install the debian perl packages, install debian postfix, debian clamav, you should be in solid shape. The folks that chose OSes that are not as stable (especially Fedora) you are shooting yourself on the foot more or less. You will have less stable more bleeding edge packages and you will have to spend more time using CPAN and installing perl packages manually and fiddling with other levels of broken-ness. You need to take the time to learn SMTP, the ins and outs of being a mail admin, your MTA (postfix or other), learn a some perl basics and how to work with cpan, and basic clamav configuration and maintenance. If you have those skills, running MailScanner is a small step above that. If you dont have those skills, you should not be running anything until you do :) Pay someone else, or pay a vendor for a cloud solution. From noel.butler at ausics.net Wed Apr 11 05:20:53 2012 From: noel.butler at ausics.net (Noel Butler) Date: Wed Apr 11 05:21:08 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> Message-ID: <1334118053.7009.19.camel@tardis> Skipped content of type multipart/related-------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 490 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120411/28e7c86d/attachment.bin From jlarsen at richweb.com Wed Apr 11 05:40:11 2012 From: jlarsen at richweb.com (C. Jon Larsen) Date: Wed Apr 11 05:40:22 2012 Subject: byebye MailScanner In-Reply-To: <1334118053.7009.19.camel@tardis> References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> <1334118053.7009.19.camel@tardis> Message-ID: > What utter bullshit, many well respected distros, Slackware and Gentoo have had problems, I'd hardly say > either of them are poor distros, they just like to work in modern times unless debian and RHEL. > > /debian trolling material omitted, any enterprise grade distro is perfect for the task - this excludes fedora > and ubuntu which are just glorified desktops of their enterprise grade cousins. Theres a good reason why debian makes a good base for mailscanner. Its not an accident. The build of perl gave me a less trouble than Redhat over the course of 2-3 yrs. Redhats not bad, and debians not perfect, but for mailscanner I would suggest debian. Thats not trolling, its experience. From supunr at lankacom.net Wed Apr 11 05:48:22 2012 From: supunr at lankacom.net (Supun Rathnayake) Date: Wed Apr 11 05:48:36 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> <1334118053.7009.19.camel@tardis> Message-ID: <4F850D16.5090906@lankacom.net> On 04/11/2012 10:10 AM, C. Jon Larsen wrote: > >> What utter bullshit, many well respected distros, Slackware and >> Gentoo have had problems, I'd hardly say >> either of them are poor distros, they just like to work in modern >> times unless debian and RHEL. >> >> /debian trolling material omitted, any enterprise grade distro is >> perfect for the task - this excludes fedora >> and ubuntu which are just glorified desktops of their enterprise >> grade cousins. > > Theres a good reason why debian makes a good base for mailscanner. Its > not an accident. The build of perl gave me a less trouble than Redhat > over the course of 2-3 yrs. Redhats not bad, and debians not perfect, > but for mailscanner I would suggest debian. Thats not trolling, its > experience. I too agree with you, debian makes a good base for the MailScanner. We have been using MailScanner in this environment ( on Ubuntu Server base - which is very thin and current ) for the last 5-6 years Thanks, Supun. From noel.butler at ausics.net Wed Apr 11 06:02:24 2012 From: noel.butler at ausics.net (Noel Butler) Date: Wed Apr 11 06:02:37 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> <1334118053.7009.19.camel@tardis> Message-ID: <1334120544.7009.32.camel@tardis> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 490 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120411/56038c7f/attachment.bin From pparsons at techeez.com Wed Apr 11 08:51:42 2012 From: pparsons at techeez.com (Philip Parsons) Date: Wed Apr 11 08:55:30 2012 Subject: byebye MailScanner In-Reply-To: <1334120544.7009.32.camel@tardis> References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> <1334118053.7009.19.camel@tardis> , <1334120544.7009.32.camel@tardis> Message-ID: <0EAE1215-7A45-4AF4-AF0F-A11C33061CD3@techeez.com> come on guys this is like trying to discuss Mac or pc. you as the admin choose a distro and you like it and you move forward I have used MailScanner for 7 or 8. years on different distros and each have there issues. and from all of the different programs I have installed over the many years is has been the best and Julian needs to be given the kudos for that Here I am the guy who swore never Mac and I am writing this email from Belize on my iPad as that was the only device I needed to be able to do my job for multiple clients world wide. Thank you P Parsons On 2012-04-10, at 10:04 PM, "Noel Butler" wrote: > On Wed, 2012-04-11 at 00:40 -0400, C. Jon Larsen wrote: >> >> > What utter bullshit, many well respected distros, Slackware and Gentoo have had problems, I'd hardly say >> > either of them are poor distros, they just like to work in modern times unless debian and RHEL. >> > >> > /debian trolling material omitted, any enterprise grade distro is perfect for the task - this excludes fedora >> > and ubuntu which are just glorified desktops of their enterprise grade cousins. >> >> Theres a good reason why debian makes a good base for mailscanner. Its not >> an accident. The build of perl gave me a less trouble than Redhat over the >> course of 2-3 yrs. Redhats not bad, and debians not perfect, but for >> mailscanner I would suggest debian. Thats not trolling, its experience. > > 2 -3 years? experience? come back and give your " experience " after a decade or so of running multiple server OS's. > I found debian no better than redhat or suse. > > I find gentoo and slackware far better for any server that doesnt want to inherit a distros hacking mess, but you dont see me telling someone to piss off redhat and install slackware or gentoo because "that will fix their problem", no... > It comes down to what distro you know and prefer, but to sit here and tell people to use debian as the cure all is one of the stupidest and dumb assed things I've seen here to date, especially when it will yield far more questions than is necessary, and mostly all unrelated to mailscanner, and in the end will likely not solve the OP's problem, if it does it sure as hell will likely introduce new problems for them. > If it smells like trolling, it tastes like trolling, then it is trolling. > Think about it, how about we say install linux to every windows person who has a problem, yes, I'd love too, but hardly appropriate in the real world. > > BTW, debian lost most of any credibility a couple years ago when they caused the SSL debacle. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From bonivart at opencsw.org Wed Apr 11 09:07:36 2012 From: bonivart at opencsw.org (Peter Bonivart) Date: Wed Apr 11 09:08:07 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> Message-ID: On Wed, Apr 11, 2012 at 3:13 AM, C. Jon Larsen wrote: > performance is better (than sendmail) Are you talking in general here? I doubt very much that performance of Postfix is better than Sendmail when it comes to MailScanner due to the difference in mail files (Sendmails are split between queue and data). Since MailScanner needs to modify every single mail with at least inserting a header it should be slower on Postfix handling the whole file. Anyone tested it? /peter From jlarsen at richweb.com Wed Apr 11 13:55:31 2012 From: jlarsen at richweb.com (C. Jon Larsen) Date: Wed Apr 11 13:55:43 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> Message-ID: > On Wed, Apr 11, 2012 at 3:13 AM, C. Jon Larsen wrote: >> performance is better (than sendmail) > > Are you talking in general here? I doubt very much that performance of > Postfix is better than Sendmail when it comes to MailScanner due to > the difference in mail files (Sendmails are split between queue and > data). Since MailScanner needs to modify every single mail with at > least inserting a header it should be slower on Postfix handling the > whole file. Anyone tested it? In general postfix seems to be faster than sendmail in my testing and experience for MTA duties. Specific to mailscanner and the hold queue for postfix vs. running 2 instances for sendmail it may be a wash, but for outbound delivery of scanned mails it seems to work best for me. If I have queue backlogs it seems to handle that better than sendmail too. But honestly performance is a minor consideration. Config flexibility, debug capability, I liked better in postfix. I ran mailscanner+sendmail for 3 yrs or so (redhat), and switched to amavsid +postfix for 3 yrs or so (debian), found that leaner and faster. Switched back to mailscanner+postfix (debian) and like that the best of all the setups. My current setup is 5 clustered postfix based scanners in diverse datacenters. MySQL backend for config management, web admin tools, quarantine centralization, etc. Each box though can run independently so if the link to the mysql cluster is down, or if mysql cluster is down, they keep on processing email. > /peter > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > From jlarsen at richweb.com Wed Apr 11 14:07:06 2012 From: jlarsen at richweb.com (C. Jon Larsen) Date: Wed Apr 11 14:07:16 2012 Subject: byebye MailScanner In-Reply-To: <1334120544.7009.32.camel@tardis> References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> <1334118053.7009.19.camel@tardis> <1334120544.7009.32.camel@tardis> Message-ID: > I find gentoo and slackware far better for any server that doesnt want to inherit a distros hacking mess, but > you dont see me telling someone to piss off redhat and install slackware or gentoo because "that will fix > their problem", no... > It comes down to what distro you know and prefer, but to sit here and tell people to use debian as the cure > all is one of the stupidest and dumb assed things I've seen here to date, especially when it will yield far > more questions than is necessary, and mostly all unrelated to mailscanner, and in the end will likely not > solve the OP's problem, if it does it sure as hell will likely introduce new problems for them. > If it smells like trolling, it tastes like trolling, then it is trolling. > Think about it, how about we say install linux to every windows person who has a problem, yes, I'd love too, > but hardly appropriate in the real world. Noel, I did not tell anyone to install anything. Calm down. I simply said debian has pretty good versions of the packages needed for mailscanner. Its worth a look for those that maybe are less than happy. If you are happy where you are at, thats great. And anyone that would claim that installing an OS is going to make problems vanish is of course a fool. Go back to my last comment of my 1st post in this thread and re-read it. There are a lot of things an admin needs to have in place to run mailscanner. Putting a cd into a box is the least of those skills. In fact, 1 thing I probably should say just for the record, for anyone else reading this :) Is that the choice of your OS is LESS important for a mailscanner installation than whether you are virtualizing it or not. The first thing I do is virtualize the setup, That way I can snapshot the setup and if there is any breakage ... especially when updating to a new release ... rollback is easy. Someone who is afraid to update his Centos mailscanner box b/c of what may break would be better off spending time to virtualize it rather than switching to any other OS of course. -j > BTW, debian lost most of any credibility a couple years ago when they caused the SSL debacle. > > > From maxsec at gmail.com Wed Apr 11 14:21:29 2012 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Apr 11 14:21:38 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> <1334118053.7009.19.camel@tardis> <1334120544.7009.32.camel@tardis> Message-ID: of course no-ones mentioned the *BSD's which work nicely as well. ;-) lets face it guys ain;t it nice to have a choice! -- Martin Hepworth Oxford, UK On 11 April 2012 14:07, C. Jon Larsen wrote: > > > I find gentoo and slackware far better for any server that doesnt want to >> inherit a distros hacking mess, but >> you dont see me telling someone to piss off redhat and install slackware >> or gentoo because "that will fix >> their problem", no... >> It comes down to what distro you know and prefer, but to sit here and >> tell people to use debian as the cure >> all is one of the stupidest and dumb assed things I've seen here to date, >> especially when it will yield far >> more questions than is necessary, and mostly all unrelated to >> mailscanner, and in the end will likely not >> solve the OP's problem, if it does it sure as hell will likely introduce >> new problems for them. >> If it smells like trolling, it tastes like trolling, then it is trolling. >> Think about it, how about we say install linux to every windows person >> who has a problem, yes, I'd love too, >> but hardly appropriate in the real world. >> > > > Noel, I did not tell anyone to install anything. Calm down. I simply said > debian has pretty good versions of the packages needed for mailscanner. Its > worth a look for those that maybe are less than happy. If you are happy > where you are at, thats great. > > And anyone that would claim that installing an OS is going to make > problems vanish is of course a fool. Go back to my last comment of my 1st > post in this thread and re-read it. There are a lot of things an admin > needs to have in place to run mailscanner. Putting a cd into a box is the > least of those skills. > > In fact, 1 thing I probably should say just for the record, for anyone > else reading this :) Is that the choice of your OS is LESS important for a > mailscanner installation than whether you are virtualizing it or not. > > The first thing I do is virtualize the setup, That way I can snapshot the > setup and if there is any breakage ... especially when updating to a new > release ... rollback is easy. > > Someone who is afraid to update his Centos mailscanner box b/c of what may > break would be better off spending time to virtualize it rather than > switching to any other OS of course. > > -j > > > BTW, debian lost most of any credibility a couple years ago when they >> caused the SSL debacle. >> >> >> >> -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info > http://lists.mailscanner.info/**mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/**posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120411/2b03263c/attachment.html From campbell at cnpapers.com Wed Apr 11 14:58:37 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Wed Apr 11 14:58:38 2012 Subject: byebye MailScanner In-Reply-To: References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> <1334118053.7009.19.camel@tardis> <1334120544.7009.32.camel@tardis> Message-ID: <4F858E0D.5040007@cnpapers.com> Why would anyone want to leave the MailScanner environment where we have such a crazy mailing list where no one is every right or wrong. steve campbell On 4/11/2012 9:21 AM, Martin Hepworth wrote: > of course no-ones mentioned the *BSD's which work nicely as well. > > ;-) > > lets face it guys ain;t it nice to have a choice! > > -- > Martin Hepworth > Oxford, UK > > > On 11 April 2012 14:07, C. Jon Larsen > wrote: > > > > I find gentoo and slackware far better for any server that > doesnt want to inherit a distros hacking mess, but > you dont see me telling someone to piss off redhat and install > slackware or gentoo because "that will fix > their problem", no... > It comes down to what distro you know and prefer, but to sit > here and tell people to use debian as the cure > all is one of the stupidest and dumb assed things I've seen > here to date, especially when it will yield far > more questions than is necessary, and mostly all unrelated to > mailscanner, and in the end will likely not > solve the OP's problem, if it does it sure as hell will likely > introduce new problems for them. > If it smells like trolling, it tastes like trolling, then it > is trolling. > Think about it, how about we say install linux to every > windows person who has a problem, yes, I'd love too, > but hardly appropriate in the real world. > > > > Noel, I did not tell anyone to install anything. Calm down. I > simply said debian has pretty good versions of the packages needed > for mailscanner. Its worth a look for those that maybe are less > than happy. If you are happy where you are at, thats great. > > And anyone that would claim that installing an OS is going to make > problems vanish is of course a fool. Go back to my last comment of > my 1st post in this thread and re-read it. There are a lot of > things an admin needs to have in place to run mailscanner. Putting > a cd into a box is the least of those skills. > > In fact, 1 thing I probably should say just for the record, for > anyone else reading this :) Is that the choice of your OS is LESS > important for a mailscanner installation than whether you are > virtualizing it or not. > > The first thing I do is virtualize the setup, That way I can > snapshot the setup and if there is any breakage ... especially > when updating to a new release ... rollback is easy. > > Someone who is afraid to update his Centos mailscanner box b/c of > what may break would be better off spending time to virtualize it > rather than switching to any other OS of course. > > -j > > > BTW, debian lost most of any credibility a couple years ago > when they caused the SSL debacle. > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120411/a273395f/attachment.html From richard at fastnet.co.uk Wed Apr 11 15:25:53 2012 From: richard at fastnet.co.uk (Richard Mealing) Date: Wed Apr 11 15:26:07 2012 Subject: mktemp Message-ID: <1251B5423222C446A299CABAA7B46FF43FFA83@fn-exchange.fastnet.local> Hi, I'm just looking at the new mailscanner in the ports for freebsd. It looks fine but when I run a mailscanner -lint I get this - Checking for SpamAssassin errors (if you use it)... Using SpamAssassin results cache Connected to SpamAssassin cache database SpamAssassin reported no errors. Connected to Processing Attempts Database Created Processing Attempts Database successfully There are 63 messages in the Processing Attempts Database Using locktype = posix MailScanner.conf says "Virus Scanners = clamd" usage: mktemp [-d] [-q] [-t prefix] [-u] template ... mktemp [-d] [-q] [-u] -t prefix /usr/local/libexec/MailScanner/bitdefender-wrapper: Cannot create temporary file usage: mktemp [-d] [-q] [-t prefix] [-u] template ... mktemp [-d] [-q] [-u] -t prefix /usr/local/libexec/MailScanner/clamav-wrapper: Cannot make name for temporary dir Found these virus scanners installed: clamd In the wrapper file I see this - ###### IF YOU ARE RUNNING MAILSCANNER AS ROOT ###### # You need to set the following in MailScanner.conf so that external # unpackers can be used... # Incoming Work Group = clamav # Incoming Work Permissions = 0640 # You may want to check this script for bash-isms PATH=$PATH:/usr/local/bin export PATH #TempDir="/tmp/clamav.$$" TempDir=$(mktemp) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } ClamUser="clamav" ClamGroup="clamav" ScanOptions="" ExtraScanOptions="" I see lots of changes to these 2 files, from my previous version. I'm using the MailScanner-4.84.5_2 version. FreeBSD 8.2. I do use tmpfs and I have set the Incoming Work Group && Incoming Work Permissions accordingly - and rebooted. I didn't choose bitdefender from the make config and have never used bitdefender. I don't think I want to use an external unpacker, as far as I can tell things are working perfectly. I just thought I would report this. Many thanks, Rich -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120411/d73639b8/attachment.html From bonivart at opencsw.org Wed Apr 11 15:57:36 2012 From: bonivart at opencsw.org (Peter Bonivart) Date: Wed Apr 11 15:58:08 2012 Subject: mktemp In-Reply-To: <1251B5423222C446A299CABAA7B46FF43FFA83@fn-exchange.fastnet.local> References: <1251B5423222C446A299CABAA7B46FF43FFA83@fn-exchange.fastnet.local> Message-ID: On Wed, Apr 11, 2012 at 4:25 PM, Richard Mealing wrote: > usage: mktemp [-d] [-q] [-t prefix] [-u] template ... > > ?????? mktemp [-d] [-q] [-u] -t prefix > > /usr/local/libexec/MailScanner/bitdefender-wrapper: Cannot create temporary > file > > usage: mktemp [-d] [-q] [-t prefix] [-u] template ... > > ?????? mktemp [-d] [-q] [-u] -t prefix > > /usr/local/libexec/MailScanner/clamav-wrapper: Cannot make name for > temporary dir Seems like on your platform you can't use just mktemp with no args at all. On Solaris all args are optional: SYNOPSIS mktemp [-dtqu] [-p directory] [template] Try editing the wrapper files to something like this: TempDir=$(mktemp -t tmp.XXXXXX) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } /peter From ka at pacific.net Wed Apr 11 16:01:26 2012 From: ka at pacific.net (Ken A) Date: Wed Apr 11 16:01:49 2012 Subject: byebye MailScanner In-Reply-To: <4F858E0D.5040007@cnpapers.com> References: <4F848A66.7040702@alexb.ch> <1334100697.4124.12.camel@tardis> <4F84C689.8040004@farrows.org> <1334118053.7009.19.camel@tardis> <1334120544.7009.32.camel@tardis> <4F858E0D.5040007@cnpapers.com> Message-ID: <4F859CC6.1060503@pacific.net> Yep. I do miss Julian's input, but I've been a user/subscriber since 2003, and there's no list quite like it. The most docile email admins on the planet.. ;-) Ken On 4/11/2012 8:58 AM, Steve Campbell wrote: > Why would anyone want to leave the MailScanner environment where we have > such a crazy mailing list where no one is every right or wrong. > > steve campbell > > > On 4/11/2012 9:21 AM, Martin Hepworth wrote: >> of course no-ones mentioned the *BSD's which work nicely as well. >> >> ;-) >> >> lets face it guys ain;t it nice to have a choice! >> >> -- >> Martin Hepworth >> Oxford, UK >> >> >> On 11 April 2012 14:07, C. Jon Larsen > > wrote: >> >> >> >> I find gentoo and slackware far better for any server that >> doesnt want to inherit a distros hacking mess, but >> you dont see me telling someone to piss off redhat and install >> slackware or gentoo because "that will fix >> their problem", no... >> It comes down to what distro you know and prefer, but to sit >> here and tell people to use debian as the cure >> all is one of the stupidest and dumb assed things I've seen >> here to date, especially when it will yield far >> more questions than is necessary, and mostly all unrelated to >> mailscanner, and in the end will likely not >> solve the OP's problem, if it does it sure as hell will likely >> introduce new problems for them. >> If it smells like trolling, it tastes like trolling, then it >> is trolling. >> Think about it, how about we say install linux to every >> windows person who has a problem, yes, I'd love too, >> but hardly appropriate in the real world. >> >> >> >> Noel, I did not tell anyone to install anything. Calm down. I >> simply said debian has pretty good versions of the packages needed >> for mailscanner. Its worth a look for those that maybe are less >> than happy. If you are happy where you are at, thats great. >> >> And anyone that would claim that installing an OS is going to make >> problems vanish is of course a fool. Go back to my last comment of >> my 1st post in this thread and re-read it. There are a lot of >> things an admin needs to have in place to run mailscanner. Putting >> a cd into a box is the least of those skills. >> >> In fact, 1 thing I probably should say just for the record, for >> anyone else reading this :) Is that the choice of your OS is LESS >> important for a mailscanner installation than whether you are >> virtualizing it or not. >> >> The first thing I do is virtualize the setup, That way I can >> snapshot the setup and if there is any breakage ... especially >> when updating to a new release ... rollback is easy. >> >> Someone who is afraid to update his Centos mailscanner box b/c of >> what may break would be better off spending time to virtualize it >> rather than switching to any other OS of course. >> >> -j >> >> >> BTW, debian lost most of any credibility a couple years ago >> when they caused the SSL debacle. >> >> >> >> -- MailScanner mailing list >> mailscanner@lists.mailscanner.info >> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> >> >> > > > -- Ken Anderson Pacific Internet - http://www.pacific.net Latest Pacific.Net Status - http://twitter.com/pacnetstatus From mailscanner at pdscc.com Wed Apr 11 16:31:37 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Wed Apr 11 16:32:05 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <4F5E3602.4090102@alexb.ch> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, <4F5E3602.4090102@alexb.ch> Message-ID: <20120411153141.B20EB5A1C82@sinclaire.sibble.net> On 12 Mar 2012 at 18:44, Alex Broens wrote: > On 03/12/2012 06:25 PM, Harondel J. Sibble wrote: > > Kinda scratching my head here > > > > Client emailed to say that this weekend lots of spam started coming through. > > Other than moving the box from physical to virtual about a month ago, there > > haven't been any changes or updates. > > > > All the spam that's getting through has a listing of 0.00 Clean in > > Mailwatch, this is what I see in Mailwatch when I pull up the detailed > > info.. > > > > SpamAssassin > > Spam: N Action(s): store, deliver > > High Scoring Spam: N > > SpamAssassin Spam: N > > Listed in RBL: N > > Spam Whitelisted: N > > Spam Blacklisted: N > > SpamAssassin Autolearn: N > > SpamAssassin Score: 0.00 > > > > Spam Report: Score Matching Rule Description > > cached not > > out timed > > > > Some messages are being appropriately tagged as spam, even highscoring spam, > > but that's maybe 1 out of a hundred, the other 99 are just flowing through. > > > > I'm reviewing the configuration, but so far nothing seems out of the > > ordinary, > > > > Suggestions for next steps? > > I'd start with getting hold of missed messages, analyze, write SA rules, feed > bayes.... Ugh all of a sudden, same thing happening again, stuff that's clearly spam is getting marked with a 0.00 score and is not getting ANY spamassassin rule hits. > > Spam Report: Score Matching Rule Description > > cached not > > out timed Last time, after reclassifying say 10 pages of messages in mailwatch, everything was fine again until yesterday. It's not as bad as last time, but still happening.... once again scratching my head. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From bonivart at opencsw.org Wed Apr 11 17:04:19 2012 From: bonivart at opencsw.org (Peter Bonivart) Date: Wed Apr 11 17:04:49 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <20120411153141.B20EB5A1C82@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net> <4F5E3602.4090102@alexb.ch> <20120411153141.B20EB5A1C82@sinclaire.sibble.net> Message-ID: On Wed, Apr 11, 2012 at 5:31 PM, Harondel J. Sibble wrote: > Ugh all of a sudden, same thing happening again, stuff that's clearly spam is > getting marked with a 0.00 score and is not getting ANY spamassassin rule > hits. Could it be that the messages are too large to be scanned by SpamAssassin? Check your settings in MailScanner.conf. /peter From mailscanner at joolee.nl Wed Apr 11 17:04:01 2012 From: mailscanner at joolee.nl (Joolee) Date: Wed Apr 11 17:04:50 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <20120411153141.B20EB5A1C82@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net> <4F5E3602.4090102@alexb.ch> <20120411153141.B20EB5A1C82@sinclaire.sibble.net> Message-ID: Could you paste a sample of an E-mail on pastebin or some other service? On 11 April 2012 17:31, Harondel J. Sibble wrote: > > > On 12 Mar 2012 at 18:44, Alex Broens wrote: > >> On 03/12/2012 06:25 PM, Harondel J. Sibble wrote: >> > Kinda scratching my head here >> > >> > Client emailed to say that this weekend lots of spam started coming through. >> > Other than moving the box from physical to virtual about a month ago, there >> > haven't been any changes or updates. >> > >> > All the spam that's getting through has a listing of 0.00 Clean in >> > Mailwatch, this is what I see in Mailwatch when I pull up the detailed >> > info.. >> > >> > SpamAssassin >> > Spam: ?N ? Action(s): store, deliver >> > High Scoring Spam: ?N >> > SpamAssassin Spam: ?N >> > Listed in RBL: ?N >> > Spam Whitelisted: ?N >> > Spam Blacklisted: ?N >> > SpamAssassin Autolearn: ?N >> > SpamAssassin Score: 0.00 >> > >> > Spam Report: Score Matching Rule Description >> > cached not >> > out timed >> > >> > Some messages are being appropriately tagged as spam, even highscoring spam, >> > but that's maybe 1 out of a hundred, the other 99 are just flowing through. >> > >> > I'm reviewing the configuration, but so far nothing seems out of the >> > ordinary, >> > >> > Suggestions for next steps? >> >> I'd start with getting hold of missed messages, analyze, write SA rules, feed >> bayes.... > > > Ugh all of a sudden, same thing happening again, stuff that's clearly spam is > getting marked with a 0.00 score and is not getting ANY spamassassin rule > hits. > >> > Spam Report: Score Matching Rule Description >> > cached not >> > out timed > > Last time, after reclassifying ?say 10 pages of messages in mailwatch, > everything was fine again until yesterday. ?It's not as bad as last time, but > still happening.... > > once again scratching my head. > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ka at pacific.net Wed Apr 11 17:17:03 2012 From: ka at pacific.net (Ken A) Date: Wed Apr 11 17:17:25 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: References: <20120312172546.4106E5A1C81@sinclaire.sibble.net> <4F5E3602.4090102@alexb.ch> <20120411153141.B20EB5A1C82@sinclaire.sibble.net> Message-ID: <4F85AE7F.8040406@pacific.net> On 4/11/2012 11:04 AM, Peter Bonivart wrote: > On Wed, Apr 11, 2012 at 5:31 PM, Harondel J. Sibble > wrote: >> Ugh all of a sudden, same thing happening again, stuff that's clearly spam is >> getting marked with a 0.00 score and is not getting ANY spamassassin rule >> hits. > > Could it be that the messages are too large to be scanned by > SpamAssassin? Check your settings in MailScanner.conf. > > /peter or perhaps switching to a virtual machine has limited your resources in some way that MailScanner/SA doesn't like? Anything in the mail log? Ken -- From richard at fastnet.co.uk Wed Apr 11 17:24:05 2012 From: richard at fastnet.co.uk (Richard Mealing) Date: Wed Apr 11 17:24:20 2012 Subject: mktemp In-Reply-To: References: <1251B5423222C446A299CABAA7B46FF43FFA83@fn-exchange.fastnet.local> Message-ID: <1251B5423222C446A299CABAA7B46FF43FFC02@fn-exchange.fastnet.local> -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Peter Bonivart Sent: 11 April 2012 15:58 To: MailScanner discussion Subject: Re: mktemp On Wed, Apr 11, 2012 at 4:25 PM, Richard Mealing wrote: > usage: mktemp [-d] [-q] [-t prefix] [-u] template ... > > ?????? mktemp [-d] [-q] [-u] -t prefix > > /usr/local/libexec/MailScanner/bitdefender-wrapper: Cannot create > temporary file > > usage: mktemp [-d] [-q] [-t prefix] [-u] template ... > > ?????? mktemp [-d] [-q] [-u] -t prefix > > /usr/local/libexec/MailScanner/clamav-wrapper: Cannot make name for > temporary dir Seems like on your platform you can't use just mktemp with no args at all. On Solaris all args are optional: SYNOPSIS mktemp [-dtqu] [-p directory] [template] Try editing the wrapper files to something like this: TempDir=$(mktemp -t tmp.XXXXXX) || { echo "$0: Cannot make name for temporary dir" >&2; exit 1; } /peter Thanks Peter.. That works fine. I had already replaced it with mktemp -t tmp and that works. When I add the XXXXXX I just get a load of X's and then the unique letter combination. It was something like this - tmp.XXXXXX.GQm45Ohl But without I get this - ls -l tmp.* -rw------- 1 root clamav 0 Apr 11 17:18 tmp.XR8g1ILO -rw------- 1 root clamav 0 Apr 11 17:18 tmp.uobA8fLv I assume this is because it can't find the current process number or there isn't one. ? "The trailing `Xs' are replaced with the current process number and/or a unique letter combination. The number of unique file names mktemp can return depends on the number of `Xs' provided; six `Xs' will result in mktemp selecting 1 of 56800235584 (62 ** 6) possible file names." Thanks again. Rich -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From rout at tj.rs.gov.br Wed Apr 11 21:43:01 2012 From: rout at tj.rs.gov.br (Felipe Szczesny Rout) Date: Wed Apr 11 21:45:40 2012 Subject: unsubscribe Message-ID: <0D37F8D6F1DCEC43984D724AA2FE3B030112D34A7784@NPOATJ121.tj.rs> Felipe Szczesny Rout Analista de Suporte - TJRS 51 3210-7855 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120411/66e4211a/attachment.html From jeremy at fluxlabs.net Wed Apr 11 21:49:50 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Wed Apr 11 21:50:11 2012 Subject: unsubscribe In-Reply-To: <0D37F8D6F1DCEC43984D724AA2FE3B030112D34A7784@NPOATJ121.tj.rs> References: <0D37F8D6F1DCEC43984D724AA2FE3B030112D34A7784@NPOATJ121.tj.rs> Message-ID: Visit to unsubscribe http://lists.mailscanner.info/mailman/listinfo/mailscanner -- Jeremy McSpadden On Apr 11, 2012, at 3:48 PM, "Felipe Szczesny Rout" > wrote: Felipe Szczesny Rout Analista de Suporte ? TJRS 51 3210-7855 -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120411/960477fd/attachment.html From mailscanner at pdscc.com Thu Apr 12 05:19:39 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Apr 12 05:19:58 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <4F85AE7F.8040406@pacific.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, , <4F85AE7F.8040406@pacific.net> Message-ID: <20120412041942.6FF685A1C81@sinclaire.sibble.net> That's been on the back of my mind actually.... overall interactive responsiveness has definitely gone down since moving to virtual Nothing that I'd consider out of the ordinary showing up in maillog. We have at least 3 or 4 other settings with nearly identical config out there, this is the only site we've been having issues with, also only site virtualized, On 11 Apr 2012 at 11:17, Ken A wrote: > or perhaps switching to a virtual machine has limited your resources in > some way that MailScanner/SA doesn't like? > Anything in the mail log? -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From mailscanner at pdscc.com Thu Apr 12 05:19:39 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Apr 12 05:19:58 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, <20120411153141.B20EB5A1C82@sinclaire.sibble.net>, Message-ID: <20120412041942.8D2D85A1C82@sinclaire.sibble.net> Nope, SA is set to scan messages up to 20mb IIRC, messages getting through are pretty much all under 1mb in size On 11 Apr 2012 at 18:04, Peter Bonivart wrote: > On Wed, Apr 11, 2012 at 5:31 PM, Harondel J. Sibble > wrote: > > Ugh all of a sudden, same thing happening again, stuff that's clearly spam > > is getting marked with a 0.00 score and is not getting ANY spamassassin rule > > hits. > > Could it be that the messages are too large to be scanned by > SpamAssassin? Check your settings in MailScanner.conf. > -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From mailscanner at pdscc.com Thu Apr 12 05:34:41 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Apr 12 05:34:57 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, <20120411153141.B20EB5A1C82@sinclaire.sibble.net>, Message-ID: <20120412043443.D99295A1C82@sinclaire.sibble.net> http://pastebin.com/Szdxse3r all text copied from message page in Mailwatch along with text from the email body. On 11 Apr 2012 at 18:04, Joolee wrote: > Could you paste a sample of an E-mail on pastebin or some other service? -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From mailscanner at joolee.nl Thu Apr 12 06:15:10 2012 From: mailscanner at joolee.nl (Joolee) Date: Thu Apr 12 06:15:59 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <20120412041942.8D2D85A1C82@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net> <20120411153141.B20EB5A1C82@sinclaire.sibble.net> <20120412041942.8D2D85A1C82@sinclaire.sibble.net> Message-ID: As far as I can see from your snippet, there is no attachment, whatsoever in the E-mails, is that correct? Can you place the contents of http://pastebin.com/a2vWFBK4 in your mailwatch www directory as sa_debug.php? (copy needed permissions from any other file there) Go to an E-mail in Mailwatch, view the contents of the E-mail (viewmail.php) and change viewmail.php to sa_debug.php in your address bar. (leave stuff after the ? intact) Now you should get a nice timed overview of the output from SpamAssassin. All the way to the bottom, there is a line with "dbg: timing:". Could you copy that, along with other lines (and the ones around it!) giving red timings and paste it to the mailinglist? On 12 April 2012 06:19, Harondel J. Sibble wrote: > Nope, SA is set to scan messages up to 20mb IIRC, messages getting through > are pretty much all under 1mb in size > > On 11 Apr 2012 at 18:04, Peter Bonivart wrote: > >> On Wed, Apr 11, 2012 at 5:31 PM, Harondel J. Sibble >> wrote: >> > Ugh all of a sudden, same thing happening again, stuff that's clearly spam >> > is getting marked with a 0.00 score and is not getting ANY spamassassin rule >> > hits. >> >> Could it be that the messages are too large to be scanned by >> SpamAssassin? Check your settings in MailScanner.conf. >> > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From mailscanner at pdscc.com Thu Apr 12 06:51:28 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Apr 12 06:51:49 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, <20120412041942.8D2D85A1C82@sinclaire.sibble.net>, Message-ID: <20120412055131.5F41E5A1C81@sinclaire.sibble.net> Correct no attachments http://pastebin.com/LgmfZny8 only highlighted line is red, all the rest are green. On 12 Apr 2012 at 7:15, Joolee wrote: > As far as I can see from your snippet, there is no attachment, > whatsoever in the E-mails, is that correct? > > Can you place the contents of http://pastebin.com/a2vWFBK4 in your > mailwatch www directory as sa_debug.php? (copy needed permissions from > any other file there) > Go to an E-mail in Mailwatch, view the contents of the E-mail > (viewmail.php) and change viewmail.php to sa_debug.php in your address > bar. (leave stuff after the ? intact) > Now you should get a nice timed overview of the output from > SpamAssassin. All the way to the bottom, there is a line with "dbg: > timing:". Could you copy that, along with other lines (and the ones > around it!) giving red timings and paste it to the mailinglist? -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From pramod at mindspring.co.za Thu Apr 12 07:26:47 2012 From: pramod at mindspring.co.za (Pramod Daya) Date: Thu Apr 12 07:27:22 2012 Subject: Phishing Message-ID: <2810BE9BCD80A84DBDE4BC0505BF6C8C69548CC053@WILLOW.mindspringsbs.local> I'm having problems with phishing scams getting through - have installed ScamNailer 2.10, with the cron job running successfully, hourly, and also downloading the scamnailer.ndb file from www.mailscanner.eu (Should I be doing that as well as running the cron job ?) Most are trapped, but enough get through daily that I'm sure it can be improved. Can one expect 100% of phishing to be stopped, or is that an unreasonable expectation ? From mailscanner at pdscc.com Thu Apr 12 07:42:37 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Apr 12 07:43:04 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <20120412055131.5F41E5A1C81@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, , <20120412055131.5F41E5A1C81@sinclaire.sibble.net> Message-ID: <20120412064241.DA74F5A1C81@sinclaire.sibble.net> Whoops, missed a few red lines Apr 11 22:46:26.822 [8734] dbg: dkim: adsp: fetch or parse on domain naturalimpulse.com failed: DNS query timeout for naturalimpulse.com 20.00124 Apr 11 22:46:29.864 [8734] dbg: dns: providing a callback for id: 26345/q8e95ml.zogvjonxdlx9w.43aaldneg.com/TXT/IN 3.00099 Apr 11 22:46:31.863 [8734] dbg: spf: query for /123.23.145.46/q8e95ml.zogvjonxdlx9w.43aaldneg.com: result: timeout, comment: , text: 1.99703 On 11 Apr 2012 at 22:51, Harondel J. Sibble wrote: > Correct no attachments > > http://pastebin.com/LgmfZny8 > > only highlighted line is red, all the rest are green. > > On 12 Apr 2012 at 7:15, Joolee wrote: > > > As far as I can see from your snippet, there is no attachment, > > whatsoever in the E-mails, is that correct? > > > > Can you place the contents of http://pastebin.com/a2vWFBK4 in your > > mailwatch www directory as sa_debug.php? (copy needed permissions from > > any other file there) > > Go to an E-mail in Mailwatch, view the contents of the E-mail > > (viewmail.php) and change viewmail.php to sa_debug.php in your address > > bar. (leave stuff after the ? intact) > > Now you should get a nice timed overview of the output from > > SpamAssassin. All the way to the bottom, there is a line with "dbg: > > timing:". Could you copy that, along with other lines (and the ones > > around it!) giving red timings and paste it to the mailinglist? > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From Amelein at dantumadiel.eu Thu Apr 12 07:57:55 2012 From: Amelein at dantumadiel.eu (Arjan Melein) Date: Thu Apr 12 07:58:20 2012 Subject: Betr.: Re: lots of spam getting through with zero score since saturday In-Reply-To: <20120411153141.B20EB5A1C82@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, <4F5E3602.4090102@alexb.ch> <20120411153141.B20EB5A1C82@sinclaire.sibble.net> Message-ID: <4F8699130200008E0001E20C@10.1.0.206> Is it possible that there's a 'rogue' MTA running that is just bypassing MS ? I think your maillog would reveal the most info right now, or run MS in a non forked mode so you can see what its doing. - Arjan >>> Op 11-4-2012 om 17:31 is door "Harondel J. Sibble" geschreven: > > On 12 Mar 2012 at 18:44, Alex Broens wrote: > >> On 03/12/2012 06:25 PM, Harondel J. Sibble wrote: >> > Kinda scratching my head here >> > >> > Client emailed to say that this weekend lots of spam started coming > through. >> > Other than moving the box from physical to virtual about a month ago, there >> > haven't been any changes or updates. >> > >> > All the spam that's getting through has a listing of 0.00 Clean in >> > Mailwatch, this is what I see in Mailwatch when I pull up the detailed >> > info.. >> > >> > SpamAssassin >> > Spam: N Action(s): store, deliver >> > High Scoring Spam: N >> > SpamAssassin Spam: N >> > Listed in RBL: N >> > Spam Whitelisted: N >> > Spam Blacklisted: N >> > SpamAssassin Autolearn: N >> > SpamAssassin Score: 0.00 >> > >> > Spam Report: Score Matching Rule Description >> > cached not >> > out timed >> > >> > Some messages are being appropriately tagged as spam, even highscoring > spam, >> > but that's maybe 1 out of a hundred, the other 99 are just flowing through. >> > >> > I'm reviewing the configuration, but so far nothing seems out of the >> > ordinary, >> > >> > Suggestions for next steps? >> >> I'd start with getting hold of missed messages, analyze, write SA rules, > feed >> bayes.... > > > Ugh all of a sudden, same thing happening again, stuff that's clearly spam > is > getting marked with a 0.00 score and is not getting ANY spamassassin rule > hits. > >> > Spam Report: Score Matching Rule Description >> > cached not >> > out timed > > Last time, after reclassifying say 10 pages of messages in mailwatch, > everything was fine again until yesterday. It's not as bad as last time, > but > still happening.... > > once again scratching my head. From mailscanner at joolee.nl Thu Apr 12 08:27:55 2012 From: mailscanner at joolee.nl (Joolee) Date: Thu Apr 12 08:28:46 2012 Subject: Phishing In-Reply-To: <2810BE9BCD80A84DBDE4BC0505BF6C8C69548CC053@WILLOW.mindspringsbs.local> References: <2810BE9BCD80A84DBDE4BC0505BF6C8C69548CC053@WILLOW.mindspringsbs.local> Message-ID: I used to use the Google Safe Browsing Api Perl module as a Spamassassin plugin but since a few months, Google disabled the V1 API and I still need to put some time into finding or making a V2 implementation. I combined this with a modified "DecodeShortURLs.pm" that puts all found URL's in the SpamAssassin's URL List so Google (and other plugins) could also recognise shortened URL's. (I also modified DecodeShortURLs to be able to regocnise iframes (for beam.to) and interim pages by the form of "interim.php?url=***" (don't remember which service that was for) This combination worked really well. I only needed to add some country specific SpamAssassin rules (in my case, Rabobank, ING Bank and ABN Amro) Don't forget to report all found phishing url's to http://www.phishtank.com! I built a "report phishing" button into MailScanner :P On 12 April 2012 08:26, Pramod Daya wrote: > I'm having problems with phishing scams getting through - have installed ScamNailer 2.10, with the cron job running successfully, hourly, and also downloading the scamnailer.ndb file from www.mailscanner.eu (Should I be doing that as well as running the cron job ?) > > Most are trapped, but enough get through daily that I'm sure it can be improved. ?Can one expect 100% of phishing to be stopped, or is that an unreasonable expectation ? > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From mailscanner at joolee.nl Thu Apr 12 08:50:55 2012 From: mailscanner at joolee.nl (Joolee) Date: Thu Apr 12 08:51:44 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <20120412064241.DA74F5A1C81@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net> <20120412055131.5F41E5A1C81@sinclaire.sibble.net> <20120412064241.DA74F5A1C81@sinclaire.sibble.net> Message-ID: There are more messages about DNS timeouts in there so, your problem is probably DNS. Did you install a local DNS cache? On 12 April 2012 08:42, Harondel J. Sibble wrote: > Whoops, missed a few red lines > > Apr 11 22:46:26.822 [8734] dbg: dkim: adsp: fetch or parse on domain naturalimpulse.com failed: DNS query timeout for naturalimpulse.com ? ? ? ?20.00124 > Apr 11 22:46:29.864 [8734] dbg: dns: providing a callback for id: 26345/q8e95ml.zogvjonxdlx9w.43aaldneg.com/TXT/IN ? ? ?3.00099 > Apr 11 22:46:31.863 [8734] dbg: spf: query for /123.23.145.46/q8e95ml.zogvjonxdlx9w.43aaldneg.com: result: timeout, comment: , text: ? ?1.99703 > > On 11 Apr 2012 at 22:51, Harondel J. Sibble wrote: > >> Correct no attachments >> >> http://pastebin.com/LgmfZny8 >> >> only highlighted line is red, all the rest are green. >> >> On 12 Apr 2012 at 7:15, Joolee wrote: >> >> > As far as I can see from your snippet, there is no attachment, >> > whatsoever in the E-mails, is that correct? >> > >> > Can you place the contents of http://pastebin.com/a2vWFBK4 in your >> > mailwatch www directory as sa_debug.php? (copy needed permissions from >> > any other file there) >> > Go to an E-mail in Mailwatch, view the contents of the E-mail >> > (viewmail.php) and change viewmail.php to sa_debug.php in your address >> > bar. (leave stuff after the ? intact) >> > Now you should get a nice timed overview of the output from >> > SpamAssassin. All the way to the bottom, there is a line with "dbg: >> > timing:". Could you copy that, along with other lines (and the ones >> > around it!) giving red timings and paste it to the mailinglist? >> >> -- >> Harondel J. Sibble >> Sibble Computer Consulting >> Creating Solutions for the small and medium business computer user. >> help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com >> Blog: http://www.pdscc.com/blog >> (604) 739-3709 (voice) >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > > -- > Harondel J. Sibble > Sibble Computer Consulting > Creating Solutions for the small and medium business computer user. > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > Blog: http://www.pdscc.com/blog > (604) 739-3709 (voice) > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From maxsec at gmail.com Thu Apr 12 11:21:15 2012 From: maxsec at gmail.com (Martin Hepworth) Date: Thu Apr 12 11:21:25 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: References: <20120312172546.4106E5A1C81@sinclaire.sibble.net> <20120412055131.5F41E5A1C81@sinclaire.sibble.net> <20120412064241.DA74F5A1C81@sinclaire.sibble.net> Message-ID: further to that I'd check your timeout values for spamassassin in MailScanner and double check the MS logs to look for any timeout issues. -- Martin Hepworth Oxford, UK On 12 April 2012 08:50, Joolee wrote: > There are more messages about DNS timeouts in there so, your problem > is probably DNS. Did you install a local DNS cache? > > > On 12 April 2012 08:42, Harondel J. Sibble wrote: > > Whoops, missed a few red lines > > > > Apr 11 22:46:26.822 [8734] dbg: dkim: adsp: fetch or parse on domain > naturalimpulse.com failed: DNS query timeout for naturalimpulse.com > 20.00124 > > Apr 11 22:46:29.864 [8734] dbg: dns: providing a callback for id: 26345/ > q8e95ml.zogvjonxdlx9w.43aaldneg.com/TXT/IN 3.00099 > > Apr 11 22:46:31.863 [8734] dbg: spf: query for / > 123.23.145.46/q8e95ml.zogvjonxdlx9w.43aaldneg.com: result: timeout, > comment: , text: 1.99703 > > > > On 11 Apr 2012 at 22:51, Harondel J. Sibble wrote: > > > >> Correct no attachments > >> > >> http://pastebin.com/LgmfZny8 > >> > >> only highlighted line is red, all the rest are green. > >> > >> On 12 Apr 2012 at 7:15, Joolee wrote: > >> > >> > As far as I can see from your snippet, there is no attachment, > >> > whatsoever in the E-mails, is that correct? > >> > > >> > Can you place the contents of http://pastebin.com/a2vWFBK4 in your > >> > mailwatch www directory as sa_debug.php? (copy needed permissions from > >> > any other file there) > >> > Go to an E-mail in Mailwatch, view the contents of the E-mail > >> > (viewmail.php) and change viewmail.php to sa_debug.php in your address > >> > bar. (leave stuff after the ? intact) > >> > Now you should get a nice timed overview of the output from > >> > SpamAssassin. All the way to the bottom, there is a line with "dbg: > >> > timing:". Could you copy that, along with other lines (and the ones > >> > around it!) giving red timings and paste it to the mailinglist? > >> > >> -- > >> Harondel J. Sibble > >> Sibble Computer Consulting > >> Creating Solutions for the small and medium business computer user. > >> help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > >> Blog: http://www.pdscc.com/blog > >> (604) 739-3709 (voice) > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > > > > > > -- > > Harondel J. Sibble > > Sibble Computer Consulting > > Creating Solutions for the small and medium business computer user. > > help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com > > Blog: http://www.pdscc.com/blog > > (604) 739-3709 (voice) > > > > -- > > MailScanner mailing list > > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > > > Before posting, read http://wiki.mailscanner.info/posting > > > > Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120412/5cf5fe03/attachment.html From ssilva at sgvwater.com Thu Apr 12 15:37:50 2012 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Apr 12 15:38:17 2012 Subject: Phishing In-Reply-To: <2810BE9BCD80A84DBDE4BC0505BF6C8C69548CC053@WILLOW.mindspringsbs.local> References: <2810BE9BCD80A84DBDE4BC0505BF6C8C69548CC053@WILLOW.mindspringsbs.local> Message-ID: on 4/11/2012 11:26 PM Pramod Daya spake the following: > I'm having problems with phishing scams getting through - have installed ScamNailer 2.10, with the cron job running successfully, hourly, and also downloading the scamnailer.ndb file from www.mailscanner.eu (Should I be doing that as well as running the cron job ?) > > Most are trapped, but enough get through daily that I'm sure it can be improved. Can one expect 100% of phishing to be stopped, or is that an unreasonable expectation ? I think 100% trapping of anything is a bit unreasonable... Too loose and stuff gets through... But too tight, and legitimate mail gets eaten.... Now which one will your boss be more angry with? Mine would rather see a few spams than loose an important message... From ssilva at sgvwater.com Thu Apr 12 15:39:43 2012 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Apr 12 15:40:14 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <20120412043443.D99295A1C82@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, <20120411153141.B20EB5A1C82@sinclaire.sibble.net>, <20120412043443.D99295A1C82@sinclaire.sibble.net> Message-ID: on 4/11/2012 9:34 PM Harondel J. Sibble spake the following: > http://pastebin.com/Szdxse3r > > all text copied from message page in Mailwatch along with text from the email > body. > > On 11 Apr 2012 at 18:04, Joolee wrote: > >> Could you paste a sample of an E-mail on pastebin or some other service? > That isn't going to cut it... You need the actual message source for others to test... From ssilva at sgvwater.com Thu Apr 12 15:41:25 2012 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Apr 12 15:45:15 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <20120412041942.6FF685A1C81@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, , <4F85AE7F.8040406@pacific.net> <20120412041942.6FF685A1C81@sinclaire.sibble.net> Message-ID: on 4/11/2012 9:19 PM Harondel J. Sibble spake the following: > That's been on the back of my mind actually.... > > overall interactive responsiveness has definitely gone down since moving to > virtual > > Nothing that I'd consider out of the ordinary showing up in maillog. > > We have at least 3 or 4 other settings with nearly identical config out > there, this is the only site we've been having issues with, also only site > virtualized, > > On 11 Apr 2012 at 11:17, Ken A wrote: > >> or perhaps switching to a virtual machine has limited your resources in >> some way that MailScanner/SA doesn't like? >> Anything in the mail log? > Could the virtualization have broken the trusted ip path? From mailscanner at pdscc.com Thu Apr 12 16:02:40 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Apr 12 16:03:03 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, <20120412064241.DA74F5A1C81@sinclaire.sibble.net>, Message-ID: <20120412150247.722475A1C81@sinclaire.sibble.net> Yup, machine has ALWAYS had a dns cache on it from day 1. but I'll take a look at that also. On 12 Apr 2012 at 9:50, Joolee wrote: > There are more messages about DNS timeouts in there so, your problem > is probably DNS. Did you install a local DNS cache? -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From mailscanner at pdscc.com Thu Apr 12 17:18:15 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Apr 12 17:18:34 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, <20120412064241.DA74F5A1C81@sinclaire.sibble.net>, Message-ID: <20120412161818.090F05A1C81@sinclaire.sibble.net> Actually looks like that was the problem, though I made 2 changed, uppped SA timeout from 40 to 120 seconds and installed the caching-nameserver package. Things seem to be back to normal now. Though checking other boxes in the field that have been working without issues for years, none of them have the caching-nameserver installed.... or bind for that matter On 12 Apr 2012 at 9:50, Joolee wrote: > There are more messages about DNS timeouts in there so, your problem > is probably DNS. Did you install a local DNS cache? -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From mailscanner at pdscc.com Thu Apr 12 17:26:24 2012 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Apr 12 17:26:43 2012 Subject: lots of spam getting through with zero score since saturday In-Reply-To: <20120412150247.722475A1C81@sinclaire.sibble.net> References: <20120312172546.4106E5A1C81@sinclaire.sibble.net>, , <20120412150247.722475A1C81@sinclaire.sibble.net> Message-ID: <20120412162627.2EF635A1C81@sinclaire.sibble.net> So as per my previous message, this was obviously wrong :-( On 12 Apr 2012 at 8:02, Harondel J. Sibble wrote: > Yup, machine has ALWAYS had a dns cache on it from day 1. > > but I'll take a look at that also. -- Harondel J. Sibble Sibble Computer Consulting Creating Solutions for the small and medium business computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com Blog: http://www.pdscc.com/blog (604) 739-3709 (voice) From campbell at cnpapers.com Thu Apr 12 19:29:05 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Apr 12 19:29:11 2012 Subject: test Message-ID: <4F871EF1.3010807@cnpapers.com> just a test to see if I'm still receiving emails. Problem with server last night and probably created some bounces back. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From raubvogel at gmail.com Thu Apr 12 20:30:07 2012 From: raubvogel at gmail.com (Mauricio Tavares) Date: Thu Apr 12 20:30:17 2012 Subject: test In-Reply-To: <4F871EF1.3010807@cnpapers.com> References: <4F871EF1.3010807@cnpapers.com> Message-ID: On Thu, Apr 12, 2012 at 2:29 PM, Steve Campbell wrote: > just a test to see if I'm still receiving emails. > > Problem with server last night and probably created some bounces back. > Do you think it was fixed? > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From ssilva at sgvwater.com Thu Apr 12 21:03:23 2012 From: ssilva at sgvwater.com (Scott Silva) Date: Thu Apr 12 21:03:54 2012 Subject: test In-Reply-To: <4F871EF1.3010807@cnpapers.com> References: <4F871EF1.3010807@cnpapers.com> Message-ID: on 4/12/2012 11:29 AM Steve Campbell spake the following: > just a test to see if I'm still receiving emails. > > Problem with server last night and probably created some bounces back. > > A test? I didn't study... ;) From raubvogel at gmail.com Thu Apr 12 21:32:25 2012 From: raubvogel at gmail.com (Mauricio Tavares) Date: Thu Apr 12 21:32:36 2012 Subject: test In-Reply-To: References: <4F871EF1.3010807@cnpapers.com> Message-ID: On Thu, Apr 12, 2012 at 4:03 PM, Scott Silva wrote: > on 4/12/2012 11:29 AM Steve Campbell spake the following: > >> just a test to see if I'm still receiving emails. >> >> Problem with server last night and probably created some bounces back. >> >> > A test? ? I didn't study... ;) > Did you get plastered the night before? That will do in lieu of studying... > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From davidj at mail24-7.com Mon Apr 16 04:52:52 2012 From: davidj at mail24-7.com (David j) Date: Mon Apr 16 04:53:08 2012 Subject: Scan outgoing mail from web sites - Is it Possible? Message-ID: <6D5F4E80E0C34418A7216978652F5F58@bytes> Hi, I've installed MailScanner with postfix and it works nicely. I was wondering is it possible to configure MailScanner to check mail sent from the server like from web mail (for instance squirrelmail), web forms and/or applications in order to monitor for malicious programs. Thank-you David j. From mailscanner-list at okla.com Mon Apr 16 09:46:29 2012 From: mailscanner-list at okla.com (Tracy Greggs) Date: Mon Apr 16 09:47:00 2012 Subject: Scan outgoing mail from web sites - Is it Possible? In-Reply-To: <6D5F4E80E0C34418A7216978652F5F58@bytes> References: <6D5F4E80E0C34418A7216978652F5F58@bytes> Message-ID: <003601cd1bad$6e713ee0$4b53bca0$@okla.com> As long as the webmail , forms etc. use SMTP then all email generated by them will be scanned. Squirrelmail for example is configurable from its conf.pl and typically can be set to smtp or sendmail. Tracy -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of David j Sent: Sunday, April 15, 2012 10:53 PM To: mailscanner@lists.mailscanner.info Subject: Scan outgoing mail from web sites - Is it Possible? Hi, I've installed MailScanner with postfix and it works nicely. I was wondering is it possible to configure MailScanner to check mail sent from the server like from web mail (for instance squirrelmail), web forms and/or applications in order to monitor for malicious programs. Thank-you David j. -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From davidj at mail24-7.com Mon Apr 16 15:44:34 2012 From: davidj at mail24-7.com (David j) Date: Mon Apr 16 15:44:55 2012 Subject: Scan outgoing mail from web sites - Is it Possible? In-Reply-To: <003601cd1bad$6e713ee0$4b53bca0$@okla.com> References: <6D5F4E80E0C34418A7216978652F5F58@bytes> <003601cd1bad$6e713ee0$4b53bca0$@okla.com> Message-ID: <3E9BC4A1F2BF426A9D78AF9FB26D8081@bytes> Hi, Subject: RE: Scan outgoing mail from web sites - Is it Possible? As long as the webmail , forms etc. use SMTP then all email generated by them will be scanned. Squirrelmail for example is configurable from its conf.pl and typically can be set to smtp or sendmail. Thank-you. Yes I confirmed that its using the SMTP of postfix. a. I'd like to quarantine any suspected outbound email that's flagged as spam so that I can inspect it. Is this possible and if so what are the steps to do this. b. Also is there a way I can dbl check that the outbound email is being scanned by mailscanner. Thank-you David j. From timb at vwg.com Mon Apr 16 15:58:19 2012 From: timb at vwg.com (Timothy J. Barhorst) Date: Mon Apr 16 15:58:33 2012 Subject: USER_IN_WHITELIST Issue Message-ID: Hello, Currently using MailScanner-4.84.5-2 on Centos 5 with SpamAssassin 3.3.1 One of our users received an email from delta.com and it had the USER_IN_WHITELIST value shown below. What is triggering this? Is there something in SpamAssassin that should be tweaked? Delta.com was NOT in spam.whitelist.rules. score=-105.81 4.3 required spam autolearn=not -1.90 BAYES_00 Bayesian spam probability is 0 to 1% 0.00 HTML_MESSAGE HTML included in message 0.38 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag 0.72 MIME_HTML_ONLY Message only has text/html MIME parts -5.00 RCVD_IN_DNSWL_HI Sender listed at http://www.dnswl.org/, high trust -0.00 SPF_PASS SPF: sender matches SPF record -0.01 T_RP_MATCHES_RCVD -100.00 USER_IN_WHITELIST From: address is in the user's white-list -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120416/b43455b3/attachment.html From campbell at cnpapers.com Mon Apr 16 17:20:46 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Mon Apr 16 17:20:30 2012 Subject: OT Sendmail and Motorola smartphones Message-ID: <4F8C46DE.8050001@cnpapers.com> Completely off topic - just curious if anyone has had problems similar. I've upgraded email servers from an old Centos 3 to a new Centos 6 sendmail server. Just recently our company renewed it's contract and all smartphones were upgraded to the Motorola Milestone X2. These are used by our sales staff when they're out in the field and are allowed to relay through our servers using smtp auth. I have port 587 set up with smtp auth. I'm fairly certain that this was working shortly after the upgrade, but now smtp to this port does not work. It doesn't seem to matter what settings I put in the phone, my maillog returns: sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to MSA. I don't think it's sendmail because the sendmail.mc is identical to the old server's file. I can set up an account using things like Thunderbird just fine, but then I'm using our network, but I'm still able to use port 587. Originally the problem was with one of the dnsbl I was using. (Seems that our provider had blocked their own IPs in one of the spamhaus.org RBLs to protect themselves from spam and using that blocked us from using the IPs they had assigned their smartphones). I switched from zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. My main question is about the Motorola Milestone mail client. Anyone have an opinion on how reliable it is? Does it follow the settings I set on it and has anyone run into problems using this phone as I'm trying to use them? Thanks for any clues. steve campbell -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From ka at pacific.net Mon Apr 16 19:37:26 2012 From: ka at pacific.net (Ken A) Date: Mon Apr 16 19:37:45 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <4F8C46DE.8050001@cnpapers.com> References: <4F8C46DE.8050001@cnpapers.com> Message-ID: <4F8C66E6.3040800@pacific.net> On 4/16/2012 11:20 AM, Steve Campbell wrote: > Completely off topic - just curious if anyone has had problems similar. > > I've upgraded email servers from an old Centos 3 to a new Centos 6 > sendmail server. Just recently our company renewed it's contract and all > smartphones were upgraded to the Motorola Milestone X2. These are used > by our sales staff when they're out in the field and are allowed to > relay through our servers using smtp auth. > > I have port 587 set up with smtp auth. I'm fairly certain that this was > working shortly after the upgrade, but now smtp to this port does not > work. It doesn't seem to matter what settings I put in the phone, my > maillog returns: > > sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net > [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to MSA. That usually means that the client isn't sending the authentication info - user & pass. Do you have one of these new phones to test this with? You could turn up logging in sendmail - define(`confLOG_LEVEL', `14')dnl Ken > I don't think it's sendmail because the sendmail.mc is identical to the > old server's file. > > I can set up an account using things like Thunderbird just fine, but > then I'm using our network, but I'm still able to use port 587. > > Originally the problem was with one of the dnsbl I was using. (Seems > that our provider had blocked their own IPs in one of the spamhaus.org > RBLs to protect themselves from spam and using that blocked us from > using the IPs they had assigned their smartphones). I switched from > zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. > > My main question is about the Motorola Milestone mail client. Anyone > have an opinion on how reliable it is? Does it follow the settings I set > on it and has anyone run into problems using this phone as I'm trying to > use them? > > Thanks for any clues. > > steve campbell > > -- Ken Anderson Pacific Internet - http://www.pacific.net Latest Pacific.Net Status - http://twitter.com/pacnetstatus From alex at vidadigital.com.pa Mon Apr 16 19:50:21 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Mon Apr 16 19:50:31 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <4F8C66E6.3040800@pacific.net> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> Message-ID: Or saslauthd is down. Or the AUTH methods aren't specified properly. Or port 587 is being listened to on the wrong interface. Without some more investigation at layer 3, it's a bit hard to say. On Mon, Apr 16, 2012 at 1:37 PM, Ken A wrote: > > > On 4/16/2012 11:20 AM, Steve Campbell wrote: >> >> Completely off topic - just curious if anyone has had problems similar. >> >> I've upgraded email servers from an old Centos 3 to a new Centos 6 >> sendmail server. Just recently our company renewed it's contract and all >> smartphones were upgraded to the Motorola Milestone X2. These are used >> by our sales staff when they're out in the field and are allowed to >> relay through our servers using smtp auth. >> >> I have port 587 set up with smtp auth. I'm fairly certain that this was >> working shortly after the upgrade, but now smtp to this port does not >> work. It doesn't seem to matter what settings I put in the phone, my >> maillog returns: >> >> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to >> MSA. > > > That usually means that the client isn't sending the authentication info - > user & pass. > > Do you have one of these new phones to test this with? > > You could turn up logging in sendmail - > define(`confLOG_LEVEL', `14')dnl > > Ken > > > >> I don't think it's sendmail because the sendmail.mc is identical to the >> old server's file. >> >> I can set up an account using things like Thunderbird just fine, but >> then I'm using our network, but I'm still able to use port 587. >> >> Originally the problem was with one of the dnsbl I was using. (Seems >> that our provider had blocked their own IPs in one of the spamhaus.org >> RBLs to protect themselves from spam and using that blocked us from >> using the IPs they had assigned their smartphones). I switched from >> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >> >> My main question is about the Motorola Milestone mail client. Anyone >> have an opinion on how reliable it is? Does it follow the settings I set >> on it and has anyone run into problems using this phone as I'm trying to >> use them? >> >> Thanks for any clues. >> >> steve campbell >> >> > > -- > Ken Anderson > Pacific Internet - http://www.pacific.net > Latest Pacific.Net Status - http://twitter.com/pacnetstatus > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From campbell at cnpapers.com Mon Apr 16 20:17:04 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Mon Apr 16 20:16:48 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <4F8C66E6.3040800@pacific.net> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> Message-ID: <4F8C7030.3020601@cnpapers.com> On 4/16/2012 2:37 PM, Ken A wrote: > > > On 4/16/2012 11:20 AM, Steve Campbell wrote: >> Completely off topic - just curious if anyone has had problems similar. >> >> I've upgraded email servers from an old Centos 3 to a new Centos 6 >> sendmail server. Just recently our company renewed it's contract and all >> smartphones were upgraded to the Motorola Milestone X2. These are used >> by our sales staff when they're out in the field and are allowed to >> relay through our servers using smtp auth. >> >> I have port 587 set up with smtp auth. I'm fairly certain that this was >> working shortly after the upgrade, but now smtp to this port does not >> work. It doesn't seem to matter what settings I put in the phone, my >> maillog returns: >> >> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection >> to MSA. > > That usually means that the client isn't sending the authentication > info - user & pass. > > Do you have one of these new phones to test this with? > > You could turn up logging in sendmail - > define(`confLOG_LEVEL', `14')dnl > Thanks Ken, I don't have one of these phones. I told my boss it's like being a web developer and not being allowed to use a web browser. I'm kinda thinking the mail client on these phones might be a little flaky. The config level is a good idea. steve > Ken > > >> I don't think it's sendmail because the sendmail.mc is identical to the >> old server's file. >> >> I can set up an account using things like Thunderbird just fine, but >> then I'm using our network, but I'm still able to use port 587. >> >> Originally the problem was with one of the dnsbl I was using. (Seems >> that our provider had blocked their own IPs in one of the spamhaus.org >> RBLs to protect themselves from spam and using that blocked us from >> using the IPs they had assigned their smartphones). I switched from >> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >> >> My main question is about the Motorola Milestone mail client. Anyone >> have an opinion on how reliable it is? Does it follow the settings I set >> on it and has anyone run into problems using this phone as I'm trying to >> use them? >> >> Thanks for any clues. >> >> steve campbell >> >> > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From campbell at cnpapers.com Mon Apr 16 20:21:49 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Mon Apr 16 20:21:31 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> Message-ID: <4F8C714D.7040806@cnpapers.com> On 4/16/2012 2:50 PM, Alex Neuman wrote: > Or saslauthd is down. Or the AUTH methods aren't specified properly. > Or port 587 is being listened to on the wrong interface. > > Without some more investigation at layer 3, it's a bit hard to say. > > On Mon, Apr 16, 2012 at 1:37 PM, Ken A wrote: >> >> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>> Completely off topic - just curious if anyone has had problems similar. >>> >>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>> sendmail server. Just recently our company renewed it's contract and all >>> smartphones were upgraded to the Motorola Milestone X2. These are used >>> by our sales staff when they're out in the field and are allowed to >>> relay through our servers using smtp auth. >>> >>> I have port 587 set up with smtp auth. I'm fairly certain that this was >>> working shortly after the upgrade, but now smtp to this port does not >>> work. It doesn't seem to matter what settings I put in the phone, my >>> maillog returns: >>> >>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to >>> MSA. >> >> That usually means that the client isn't sending the authentication info - >> user& pass. >> >> Do you have one of these new phones to test this with? >> >> You could turn up logging in sendmail - >> define(`confLOG_LEVEL', `14')dnl >> >> Ken >> >> >> >>> I don't think it's sendmail because the sendmail.mc is identical to the >>> old server's file. >>> >>> I can set up an account using things like Thunderbird just fine, but >>> then I'm using our network, but I'm still able to use port 587. >>> >>> Originally the problem was with one of the dnsbl I was using. (Seems >>> that our provider had blocked their own IPs in one of the spamhaus.org >>> RBLs to protect themselves from spam and using that blocked us from >>> using the IPs they had assigned their smartphones). I switched from >>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >>> >>> My main question is about the Motorola Milestone mail client. Anyone >>> have an opinion on how reliable it is? Does it follow the settings I set >>> on it and has anyone run into problems using this phone as I'm trying to >>> use them? >>> >>> Thanks for any clues. >>> >>> steve campbell >>> >>> >> -- >> Ken Anderson >> Pacific Internet - http://www.pacific.net >> Latest Pacific.Net Status - http://twitter.com/pacnetstatus >> >> -- ps ax shows saslauthd running using Pam. my sendmail.mc has the following: define(`confAUTH_OPTIONS', `A')dnl TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl define(`confAUTH_MECHANISMS',`EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN') I can't think of any other options right now netstat is showing: tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN For the time being, I've only got one NIC active, one real address and one virtual on it. Thanks for the help steve >> >> -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From alex at vidadigital.com.pa Mon Apr 16 20:26:28 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Mon Apr 16 20:26:38 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <4F8C7030.3020601@cnpapers.com> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <4F8C7030.3020601@cnpapers.com> Message-ID: If you can configure any other account that uses port 587, such as GMail, correctly, it means it's not the flaky client. I'd read the imported .cf/.mc file, check what's changed from the defaults, document it and then implement it on the new .cf/.mc just in case. I've had problems in the past when I've trusted old .cf/.mc files which didn't really work because of quirky incompatibilities from one release to the next. On Mon, Apr 16, 2012 at 2:17 PM, Steve Campbell wrote: > > > On 4/16/2012 2:37 PM, Ken A wrote: >> >> >> >> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>> >>> Completely off topic - just curious if anyone has had problems similar. >>> >>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>> sendmail server. Just recently our company renewed it's contract and all >>> smartphones were upgraded to the Motorola Milestone X2. These are used >>> by our sales staff when they're out in the field and are allowed to >>> relay through our servers using smtp auth. >>> >>> I have port 587 set up with smtp auth. I'm fairly certain that this was >>> working shortly after the upgrade, but now smtp to this port does not >>> work. It doesn't seem to matter what settings I put in the phone, my >>> maillog returns: >>> >>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to >>> MSA. >> >> >> That usually means that the client isn't sending the authentication info - >> user & pass. >> >> Do you have one of these new phones to test this with? >> >> You could turn up logging in sendmail - >> define(`confLOG_LEVEL', `14')dnl >> > Thanks Ken, > > I don't have one of these phones. I told my boss it's like being a web > developer and not being allowed to use a web browser. > > I'm kinda thinking the mail client on these phones might be a little flaky. > > The config level is a good idea. > > steve > >> Ken >> >> >>> I don't think it's sendmail because the sendmail.mc is identical to the >>> old server's file. >>> >>> I can set up an account using things like Thunderbird just fine, but >>> then I'm using our network, but I'm still able to use port 587. >>> >>> Originally the problem was with one of the dnsbl I was using. (Seems >>> that our provider had blocked their own IPs in one of the spamhaus.org >>> RBLs to protect themselves from spam and using that blocked us from >>> using the IPs they had assigned their smartphones). I switched from >>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >>> >>> My main question is about the Motorola Milestone mail client. Anyone >>> have an opinion on how reliable it is? Does it follow the settings I set >>> on it and has anyone run into problems using this phone as I'm trying to >>> use them? >>> >>> Thanks for any clues. >>> >>> steve campbell >>> >>> >> > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From pjhealy at healyville.com Mon Apr 16 21:08:07 2012 From: pjhealy at healyville.com (Patrick Healy) Date: Mon Apr 16 21:08:48 2012 Subject: MailScanner / Postfix anomaly Message-ID: <4F8C7C27.8090807@healyville.com> Hi, I just finished an CentOS 6.2 installation followed by Postfix and then MailScanner. All seemed to be going well until I stopped MailScanner and then restarted it. For whatever reason, Postfix refuses to start and kicks out the following error: fatal: unable to set session and process group ID: Operation not permitted However, when I start them individually (i.e. postfix start; check_MailScanner) both subsystems start and mail is processed. Can anyone point me in a direction to start looking? I'm trying to wean myself off of Sendmail, so I'm relatively new to Postfix. Thank you, Pat From alex at vidadigital.com.pa Mon Apr 16 21:33:43 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Mon Apr 16 21:33:53 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <4F8C714D.7040806@cnpapers.com> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <4F8C714D.7040806@cnpapers.com> Message-ID: What happens when you telnet into port 587 and ask for capabilities? Can you share the 'net connection on the phone and do it from a computer "from the phone's point of view"? What does the log say right at the time when the phone connects? Can you try opening another port, such as 1587? Is there any sort of iptables filtering going on? On Mon, Apr 16, 2012 at 2:21 PM, Steve Campbell wrote: > > > On 4/16/2012 2:50 PM, Alex Neuman wrote: >> >> Or saslauthd is down. Or the AUTH methods aren't specified properly. >> Or port 587 is being ?listened to on the wrong interface. >> >> Without some more investigation at layer 3, it's a bit hard to say. >> >> On Mon, Apr 16, 2012 at 1:37 PM, Ken A ?wrote: >>> >>> >>> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>>> >>>> Completely off topic - just curious if anyone has had problems similar. >>>> >>>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>>> sendmail server. Just recently our company renewed it's contract and all >>>> smartphones were upgraded to the Motorola Milestone X2. These are used >>>> by our sales staff when they're out in the field and are allowed to >>>> relay through our servers using smtp auth. >>>> >>>> I have port 587 set up with smtp auth. I'm fairly certain that this was >>>> working shortly after the upgrade, but now smtp to this port does not >>>> work. It doesn't seem to matter what settings I put in the phone, my >>>> maillog returns: >>>> >>>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to >>>> MSA. >>> >>> >>> That usually means that the client isn't sending the authentication info >>> - >>> user& ?pass. >>> >>> >>> Do you have one of these new phones to test this with? >>> >>> You could turn up logging in sendmail - >>> define(`confLOG_LEVEL', `14')dnl >>> >>> Ken >>> >>> >>> >>>> I don't think it's sendmail because the sendmail.mc is identical to the >>>> old server's file. >>>> >>>> I can set up an account using things like Thunderbird just fine, but >>>> then I'm using our network, but I'm still able to use port 587. >>>> >>>> Originally the problem was with one of the dnsbl I was using. (Seems >>>> that our provider had blocked their own IPs in one of the spamhaus.org >>>> RBLs to protect themselves from spam and using that blocked us from >>>> using the IPs they had assigned their smartphones). I switched from >>>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >>>> >>>> My main question is about the Motorola Milestone mail client. Anyone >>>> have an opinion on how reliable it is? Does it follow the settings I set >>>> on it and has anyone run into problems using this phone as I'm trying to >>>> use them? >>>> >>>> Thanks for any clues. >>>> >>>> steve campbell >>>> >>>> >>> -- >>> Ken Anderson >>> Pacific Internet - http://www.pacific.net >>> Latest Pacific.Net Status - http://twitter.com/pacnetstatus >>> >>> -- > > ps ax shows saslauthd running using Pam. > > my sendmail.mc has the following: > define(`confAUTH_OPTIONS', `A')dnl > TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl > define(`confAUTH_MECHANISMS',`EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN > PLAIN') > > I can't think of any other options right now > > netstat is showing: > tcp ? ? ? ?0 ? ? ?0 0.0.0.0:587 ? ? ? ? ? ? ? ? 0.0.0.0:* > LISTEN > > For the time being, I've only got one NIC active, one real address and one > virtual on it. > > Thanks for the help > steve > > >>> >>> > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From maxsec at gmail.com Mon Apr 16 22:09:35 2012 From: maxsec at gmail.com (Martin Hepworth) Date: Mon Apr 16 22:09:44 2012 Subject: USER_IN_WHITELIST Issue In-Reply-To: References: Message-ID: Unlless the dnswl caused some sort of missfire?? Martin On Monday, 16 April 2012, Timothy J. Barhorst wrote: > Hello,**** > > ** ** > > Currently using MailScanner-4.84.5-2 on Centos 5 with SpamAssassin 3.3.1** > ** > > ** ** > > One of our users received an email from delta.com and it had the > USER_IN_WHITELIST value shown below.**** > > What is triggering this? Is there something in SpamAssassin that should > be tweaked?**** > > Delta.com was NOT in spam.whitelist.rules.**** > > ** ** > > ** ** > > score=-105.81**** > > **** > > 4.3**** > > required**** > > **** > > spam**** > > autolearn=not**** > > **** > > -1.90**** > > BAYES_00**** > > Bayesian spam probability is 0 to 1%**** > > 0.00**** > > HTML_MESSAGE**** > > HTML included in message**** > > 0.38**** > > HTML_MIME_NO_HTML_TAG**** > > HTML-only message, but there is no HTML tag**** > > 0.72**** > > MIME_HTML_ONLY**** > > Message only has text/html MIME parts**** > > -5.00**** > > RCVD_IN_DNSWL_HI**** > > Sender listed at http://www.dnswl.org/, high trust**** > > -0.00**** > > SPF_PASS**** > > SPF: sender matches SPF record**** > > -0.01**** > > T_RP_MATCHES_RCVD**** > > **** > > -100.00**** > > USER_IN_WHITELIST**** > > From: address is in the user's white-list**** > > ** ** > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120416/4d62cfa6/attachment.html From m.a.young at durham.ac.uk Tue Apr 17 14:50:01 2012 From: m.a.young at durham.ac.uk (M A Young) Date: Tue Apr 17 14:50:51 2012 Subject: USER_IN_WHITELIST Issue In-Reply-To: References: Message-ID: On Mon, 16 Apr 2012, Timothy J. Barhorst wrote: > One of our users received an email from delta.com and it had the > USER_IN_WHITELIST value shown below. > > What is triggering this? ?Is there something in SpamAssassin that should be > tweaked? > > Delta.com was NOT in spam.whitelist.rules. This is spamassassin's white list, not MailScanner's . You probably have a whitelist_from rule somewhere in a spamassassin configurations file, eg. /root/.spamassassin/user_prefs . It is probably also worth checking you have use_auto_whitelist 0 in /etc/MailScanner/spam.assassin.prefs.conf . Michael Young From bbecken at aafp.org Tue Apr 17 17:35:05 2012 From: bbecken at aafp.org (Brad Beckenhauer) Date: Tue Apr 17 17:36:45 2012 Subject: clamav-autoupdate is not reading the PACKAGEDIR variable Message-ID: <4F8D556902000068000B4676@smtp.aafp.org> Skipped content of type multipart/alternative From rcooper at dwford.com Tue Apr 17 18:39:46 2012 From: rcooper at dwford.com (Rick Cooper) Date: Tue Apr 17 18:39:58 2012 Subject: clamav-autoupdate is not reading the PACKAGEDIR variable In-Reply-To: <4F8D556902000068000B4676@smtp.aafp.org> References: <4F8D556902000068000B4676@smtp.aafp.org> Message-ID: My question is what is the point of using the mailscanner updater when using clamd? why not just run freshclamd or use a regular cron job? Mailscanner doesn't need to know when the sigs are updated when using clamd _____ From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Brad Beckenhauer Sent: Tuesday, April 17, 2012 12:35 PM To: mailscanner@lists.mailscanner.info Subject: clamav-autoupdate is not reading the PACKAGEDIR variable I recently switch from clamav to clamd on MailScanner 4.84.5 and found an error message in the maillog and I wanted to share the discovery and my fix: Here is the error in the maillog: ClamAV-autoupdate[18219]: ClamAV updater /usr/local/bin/freshclam cannot be run First, where is freshclam located. # which freshclam /usr/bin/freshclam Ok, so the third column in the virus.scanner.conf file needs to be just "/usr" I checked the virus.scanner.conf clamav /usr/lib/MailScanner/clamav-wrapper /usr Ok, the third parameter was set correctly. perform a manual check to see if the clamav-auto-update script was working and found that it failed clamav-autoupdate /usr /tmp ClamAV-autoupdate[19672]: ClamAV updater /usr/local/bin/freshclam cannot be run Check the update_virus_scanners perl script and found that the script is passing the PACKAGEDIR variable (which is extracted from the virus.scanners.conf file) to the clamav-autoupdate script. See line 58. line 56 # echo Updating $NAME line 57 logger -p mail.info -t update.virus.scanners Running autoupdate for $NAME line 58 ${UPDATER} "${PACKAGEDIR}" "${LOCK}" >/dev/null 2>&1 Line 58 executes the clamav-autoupdate scipt in the MailScanner library, so lets look at that file. The clamav-autoupdate script shows that the directory hard coded and is not reading the passed in PACKAGEDIR variable. $PackageDir = "/usr/local"; I changed the packageDir line so that if a parameter is passed in to use it otherwise set it to "/usr/local" $PackageDir = shift || "/usr/local"; Re-test clamav-autoupdate /usr /tmp ClamAV-autoupdate[18880]: ClamAV updated Perfect and fixes my issue. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120417/16294802/attachment.html From campbell at cnpapers.com Tue Apr 17 19:42:32 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Tue Apr 17 19:42:34 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <4F8C714D.7040806@cnpapers.com> Message-ID: <4F8DB998.9070603@cnpapers.com> On 4/16/2012 4:33 PM, Alex Neuman wrote: > What happens when you telnet into port 587 and ask for capabilities? Not sure how I ask for capablilities. I can definitely telnet in on that port though. > > Can you share the 'net connection on the phone and do it from a > computer "from the phone's point of view"? Again, I'm a little lost here on what you mean. > > What does the log say right at the time when the phone connects? The only thing I see in the logs for these connection attempts are something like the following: sendmail[15298]: q3F7XEBe015298: 70-32-205-105.unass igned.ntelos.net [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connec tion to MSA > > Can you try opening another port, such as 1587? I can give that a try, but I'm not sure why that would matter. What's your line of thinking here? > > Is there any sort of iptables filtering going on? iptables and ip6tables are both turned off. I run a perimeter firewall. The new machine replaced a machine that used to work fine. It assumed the hostname and IP addresses, so this firewall doesn't know the difference between the old and the new machine. I'm really a little unsure of what is right and wrong now as far as what I see when I google "smtp auth". In some instances I see where the Sendmail.conf for saslauthd should have the following: pwcheck_method:pam mech_list: plain login Others say just : pwcheck_method:pam And others say just: pwcheck_method:saslauthd I'm also seeing in my messages file errors like: sendmail[20640]: unable to open Berkeley db /etc/sasldb2: No such file or directory These seemed to have stopped once I changed the above from saslauthd to pam. It's hard to tell what's going on without a phone to test with. And nTelos has provided us with a relay we can use that seems to work. I'm not sure how far along word of that server has spread to our users. I've not been able to spend tons of time on this due to getting called away from my desk for problems elsewhere in the building. Sorry since everyone seems so willing to help and I can't even provide some of the details you all need. Thanks steve > > On Mon, Apr 16, 2012 at 2:21 PM, Steve Campbell wrote: >> >> On 4/16/2012 2:50 PM, Alex Neuman wrote: >>> Or saslauthd is down. Or the AUTH methods aren't specified properly. >>> Or port 587 is being listened to on the wrong interface. >>> >>> Without some more investigation at layer 3, it's a bit hard to say. >>> >>> On Mon, Apr 16, 2012 at 1:37 PM, Ken A wrote: >>>> >>>> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>>>> Completely off topic - just curious if anyone has had problems similar. >>>>> >>>>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>>>> sendmail server. Just recently our company renewed it's contract and all >>>>> smartphones were upgraded to the Motorola Milestone X2. These are used >>>>> by our sales staff when they're out in the field and are allowed to >>>>> relay through our servers using smtp auth. >>>>> >>>>> I have port 587 set up with smtp auth. I'm fairly certain that this was >>>>> working shortly after the upgrade, but now smtp to this port does not >>>>> work. It doesn't seem to matter what settings I put in the phone, my >>>>> maillog returns: >>>>> >>>>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>>>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to >>>>> MSA. >>>> >>>> That usually means that the client isn't sending the authentication info >>>> - >>>> user& pass. >>>> >>>> >>>> Do you have one of these new phones to test this with? >>>> >>>> You could turn up logging in sendmail - >>>> define(`confLOG_LEVEL', `14')dnl >>>> >>>> Ken >>>> >>>> >>>> >>>>> I don't think it's sendmail because the sendmail.mc is identical to the >>>>> old server's file. >>>>> >>>>> I can set up an account using things like Thunderbird just fine, but >>>>> then I'm using our network, but I'm still able to use port 587. >>>>> >>>>> Originally the problem was with one of the dnsbl I was using. (Seems >>>>> that our provider had blocked their own IPs in one of the spamhaus.org >>>>> RBLs to protect themselves from spam and using that blocked us from >>>>> using the IPs they had assigned their smartphones). I switched from >>>>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >>>>> >>>>> My main question is about the Motorola Milestone mail client. Anyone >>>>> have an opinion on how reliable it is? Does it follow the settings I set >>>>> on it and has anyone run into problems using this phone as I'm trying to >>>>> use them? >>>>> >>>>> Thanks for any clues. >>>>> >>>>> steve campbell >>>>> >>>>> >>>> -- >>>> Ken Anderson >>>> Pacific Internet - http://www.pacific.net >>>> Latest Pacific.Net Status - http://twitter.com/pacnetstatus >>>> >>>> -- >> ps ax shows saslauthd running using Pam. >> >> my sendmail.mc has the following: >> define(`confAUTH_OPTIONS', `A')dnl >> TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl >> define(`confAUTH_MECHANISMS',`EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN >> PLAIN') >> >> I can't think of any other options right now >> >> netstat is showing: >> tcp 0 0 0.0.0.0:587 0.0.0.0:* >> LISTEN >> >> For the time being, I've only got one NIC active, one real address and one >> virtual on it. >> >> Thanks for the help >> steve >> >> >>>> >> >> -- >> This message has been scanned for viruses and >> dangerous content by MailScanner, and is >> believed to be clean. >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From secmas at gmail.com Tue Apr 17 22:08:09 2012 From: secmas at gmail.com (Sergio) Date: Tue Apr 17 22:08:18 2012 Subject: best way to not check attachments over 1MB? Message-ID: Hello all, what is the best way to tweak MS to not check or scan for attachments larger than 1MB but that could delete messages with attachments larger than 15MB? I have already set the following settings, but when an email larger thatn 30MB enters, the load on the server goes high and the deliver is stopped until the message has been scanned: - *Gunzip Command: /bin/gunzip - **Gunzip Timeout: 50 - **Unrar Command: {blank} - **Unrar Timeout: 0 - **Maximum Message Size: %rules-dir%/max.message.size.rules - **Maximum Attachment Size: %rules-dir%/max.attach.size.rules - **Minimum Attachment Size: -1 - **Maximum Archive Depth: 0 - **Virus Scanners: clamd - **Virus Scanner Timeout: 60 - **ClamAVmodule Maximum Recursion Level: 8 - **ClamAVmodule Maximum Files: 1000 - **ClamAVmodule Maximum File Size: 1000000 # (1 Mbytes) - **ClamAVmodule Maximum Compression Ratio: 250 - **Clamd Use Threads: yes* *- **ClamAV Full Message Scan: no - **Max Spam Check Size: 200K - **Max SpamAssassin Size: 200K - **SpamAssassin Timeout: 75 - **Max SpamAssassin Timeouts: 10 I think all this commands are relevant to what I want to accomplish, if I need another one, please tell me and if this commands needs to be fixed, please tell me as well. Your help is appreciated. Regards, Sergio ** * -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120417/42c81149/attachment.html From glenn.steen at gmail.com Tue Apr 17 23:26:48 2012 From: glenn.steen at gmail.com (Glenn Steen) Date: Tue Apr 17 23:26:58 2012 Subject: MailScanner / Postfix anomaly In-Reply-To: <4F8C7C27.8090807@healyville.com> References: <4F8C7C27.8090807@healyville.com> Message-ID: I'd guess SElinux is to blame... Probably best to not let it enforce its acls/policies...:-) Den 16 apr 2012 22:14 skrev "Patrick Healy" : > Hi, > > I just finished an CentOS 6.2 installation followed by Postfix and then > MailScanner. All seemed to be going well until I stopped MailScanner and > then restarted it. For whatever reason, Postfix refuses to start and kicks > out the following error: > > fatal: unable to set session and process group ID: Operation not permitted > > However, when I start them individually (i.e. postfix start; > check_MailScanner) both subsystems start and mail is processed. Can anyone > point me in a direction to start looking? I'm trying to wean myself off of > Sendmail, so I'm relatively new to Postfix. > > Thank you, > > Pat > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info > http://lists.mailscanner.info/**mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/**posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120418/1c506345/attachment.html From ssilva at sgvwater.com Tue Apr 17 23:37:21 2012 From: ssilva at sgvwater.com (Scott Silva) Date: Tue Apr 17 23:37:53 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <4F8C66E6.3040800@pacific.net> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> Message-ID: on 4/16/2012 11:37 AM Ken A spake the following: > > > On 4/16/2012 11:20 AM, Steve Campbell wrote: >> Completely off topic - just curious if anyone has had problems similar. >> >> I've upgraded email servers from an old Centos 3 to a new Centos 6 >> sendmail server. Just recently our company renewed it's contract and all >> smartphones were upgraded to the Motorola Milestone X2. These are used >> by our sales staff when they're out in the field and are allowed to >> relay through our servers using smtp auth. >> >> I have port 587 set up with smtp auth. I'm fairly certain that this was >> working shortly after the upgrade, but now smtp to this port does not >> work. It doesn't seem to matter what settings I put in the phone, my >> maillog returns: >> >> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to MSA. > > That usually means that the client isn't sending the authentication info - > user & pass. > > Do you have one of these new phones to test this with? > > You could turn up logging in sendmail - > define(`confLOG_LEVEL', `14')dnl > > Ken > > >> I don't think it's sendmail because the sendmail.mc is identical to the >> old server's file. >> >> I can set up an account using things like Thunderbird just fine, but >> then I'm using our network, but I'm still able to use port 587. >> >> Originally the problem was with one of the dnsbl I was using. (Seems >> that our provider had blocked their own IPs in one of the spamhaus.org >> RBLs to protect themselves from spam and using that blocked us from >> using the IPs they had assigned their smartphones). I switched from >> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >> >> My main question is about the Motorola Milestone mail client. Anyone >> have an opinion on how reliable it is? Does it follow the settings I set >> on it and has anyone run into problems using this phone as I'm trying to >> use them? >> >> Thanks for any clues. >> >> steve campbell >> >> > I had something similar with some verizon android phones... the auth methods the phone supported didn't mesh with the auth methods that saslauth allowed... the md5 login wouldn't work, and the cram-md5 wouldn't either. I had to use a different mail app on the phones... From campbell at cnpapers.com Wed Apr 18 00:32:29 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Wed Apr 18 00:32:50 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> Message-ID: <1334705549.4f8dfd8d9027e@perdition.cnpapers.net> Quoting Scott Silva : > on 4/16/2012 11:37 AM Ken A spake the following: > > > > > > On 4/16/2012 11:20 AM, Steve Campbell wrote: > >> Completely off topic - just curious if anyone has had problems similar. > >> > >> I've upgraded email servers from an old Centos 3 to a new Centos 6 > >> sendmail server. Just recently our company renewed it's contract and all > >> smartphones were upgraded to the Motorola Milestone X2. These are used > >> by our sales staff when they're out in the field and are allowed to > >> relay through our servers using smtp auth. > >> > >> I have port 587 set up with smtp auth. I'm fairly certain that this was > >> working shortly after the upgrade, but now smtp to this port does not > >> work. It doesn't seem to matter what settings I put in the phone, my > >> maillog returns: > >> > >> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net > >> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to > MSA. > > > > That usually means that the client isn't sending the authentication info - > > user & pass. > > > > Do you have one of these new phones to test this with? > > > > You could turn up logging in sendmail - > > define(`confLOG_LEVEL', `14')dnl > > > > Ken > > > > > >> I don't think it's sendmail because the sendmail.mc is identical to the > >> old server's file. > >> > >> I can set up an account using things like Thunderbird just fine, but > >> then I'm using our network, but I'm still able to use port 587. > >> > >> Originally the problem was with one of the dnsbl I was using. (Seems > >> that our provider had blocked their own IPs in one of the spamhaus.org > >> RBLs to protect themselves from spam and using that blocked us from > >> using the IPs they had assigned their smartphones). I switched from > >> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. > >> > >> My main question is about the Motorola Milestone mail client. Anyone > >> have an opinion on how reliable it is? Does it follow the settings I set > >> on it and has anyone run into problems using this phone as I'm trying to > >> use them? > >> > >> Thanks for any clues. > >> > >> steve campbell > >> > >> > > > I had something similar with some verizon android phones... the auth methods > > the phone supported didn't mesh with the auth methods that saslauth > allowed... > the md5 login wouldn't work, and the cram-md5 wouldn't either. I had to use a > > different mail app on the phones... > > > > -- I originally thought I might have something going on like that with these Androids. But then, I'm not sure I have SASL set up properly anymore after all the googling. Thanks steve ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/ From rabellino at di.unito.it Wed Apr 18 01:07:56 2012 From: rabellino at di.unito.it (Rabellino Sergio) Date: Wed Apr 18 01:08:11 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <1334705549.4f8dfd8d9027e@perdition.cnpapers.net> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <1334705549.4f8dfd8d9027e@perdition.cnpapers.net> Message-ID: <6CA45B0E-1F9F-42E2-9975-444A776A2E61@di.unito.it> I think that the motorola client is failing the SSL handshake, and drop the connection to the smtps. double check the ca certificates on the client to be sure that the server cert is well known. The sendmail error shown it's fired when the client breaks without sending anything on the smtp protocol... hope this helps. -- Ing. Sergio Rabellino Il giorno 18/apr/2012, alle ore 01:32, Steve Campbell ha scritto: > Quoting Scott Silva : > >> on 4/16/2012 11:37 AM Ken A spake the following: >>> >>> >>> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>>> Completely off topic - just curious if anyone has had problems similar. >>>> >>>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>>> sendmail server. Just recently our company renewed it's contract and all >>>> smartphones were upgraded to the Motorola Milestone X2. These are used >>>> by our sales staff when they're out in the field and are allowed to >>>> relay through our servers using smtp auth. >>>> >>>> I have port 587 set up with smtp auth. I'm fairly certain that this was >>>> working shortly after the upgrade, but now smtp to this port does not >>>> work. It doesn't seem to matter what settings I put in the phone, my >>>> maillog returns: >>>> >>>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to >> MSA. >>> >>> That usually means that the client isn't sending the authentication info - >>> user & pass. >>> >>> Do you have one of these new phones to test this with? >>> >>> You could turn up logging in sendmail - >>> define(`confLOG_LEVEL', `14')dnl >>> >>> Ken >>> >>> >>>> I don't think it's sendmail because the sendmail.mc is identical to the >>>> old server's file. >>>> >>>> I can set up an account using things like Thunderbird just fine, but >>>> then I'm using our network, but I'm still able to use port 587. >>>> >>>> Originally the problem was with one of the dnsbl I was using. (Seems >>>> that our provider had blocked their own IPs in one of the spamhaus.org >>>> RBLs to protect themselves from spam and using that blocked us from >>>> using the IPs they had assigned their smartphones). I switched from >>>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >>>> >>>> My main question is about the Motorola Milestone mail client. Anyone >>>> have an opinion on how reliable it is? Does it follow the settings I set >>>> on it and has anyone run into problems using this phone as I'm trying to >>>> use them? >>>> >>>> Thanks for any clues. >>>> >>>> steve campbell >>>> >>>> >>> >> I had something similar with some verizon android phones... the auth methods >> >> the phone supported didn't mesh with the auth methods that saslauth >> allowed... >> the md5 login wouldn't work, and the cram-md5 wouldn't either. I had to use a >> >> different mail app on the phones... >> >> >> >> -- > I originally thought I might have something going on like that with these > Androids. But then, I'm not sure I have SASL set up properly anymore after all > the googling. > > Thanks > steve > > > > ------------------------------------------------- > This mail sent through IMP: http://horde.org/imp/ > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From maxsec at gmail.com Wed Apr 18 06:26:50 2012 From: maxsec at gmail.com (Martin Hepworth) Date: Wed Apr 18 06:26:59 2012 Subject: best way to not check attachments over 1MB? In-Reply-To: References: Message-ID: What are the content of the rules files used for max message and attachment size ? Martin On Tuesday, 17 April 2012, Sergio wrote: > Hello all, > what is the best way to tweak MS to not check or scan for attachments > larger than 1MB but that could delete messages with attachments larger than > 15MB? > > I have already set the following settings, but when an email larger thatn > 30MB enters, the load on the server goes high and the deliver is stopped > until the message has been scanned: > > - *Gunzip Command: /bin/gunzip > - **Gunzip Timeout: 50 > - **Unrar Command: {blank} > - **Unrar Timeout: 0 > - **Maximum Message Size: %rules-dir%/max.message.size.rules > - **Maximum Attachment Size: %rules-dir%/max.attach.size.rules > - **Minimum Attachment Size: -1 > - **Maximum Archive Depth: 0 > - **Virus Scanners: clamd > - **Virus Scanner Timeout: 60 > - **ClamAVmodule Maximum Recursion Level: 8 > - **ClamAVmodule Maximum Files: 1000 > - **ClamAVmodule Maximum File Size: 1000000 # (1 Mbytes) > - **ClamAVmodule Maximum Compression Ratio: 250 > - **Clamd Use Threads: yes* > *- **ClamAV Full Message Scan: no > - **Max Spam Check Size: 200K > - **Max SpamAssassin Size: 200K > - **SpamAssassin Timeout: 75 > - **Max SpamAssassin Timeouts: 10 > > I think all this commands are relevant to what I want to accomplish, if I > need another one, please tell me and if this commands needs to be fixed, > please tell me as well. > > Your help is appreciated. > > Regards, > > Sergio > ** > > * -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120418/61ed9f50/attachment.html From pjhealy at healyville.com Wed Apr 18 10:22:57 2012 From: pjhealy at healyville.com (Patrick Healy) Date: Wed Apr 18 10:23:14 2012 Subject: MailScanner / Postfix anomaly In-Reply-To: References: <4F8C7C27.8090807@healyville.com> Message-ID: <4F8E87F1.2060200@healyville.com> Glenn - you nailed it... I was working on an unrelated problem that was also solved by turning off SELinux. Now both problems are solved. Now to figure out SELinux... Thanks! Pat On 4/17/2012 6:26 PM, Glenn Steen wrote: > > I'd guess SElinux is to blame... Probably best to not let it enforce > its acls/policies...:-) > > Den 16 apr 2012 22:14 skrev "Patrick Healy" >: > > Hi, > > I just finished an CentOS 6.2 installation followed by Postfix and > then MailScanner. All seemed to be going well until I stopped > MailScanner and then restarted it. For whatever reason, Postfix > refuses to start and kicks out the following error: > > fatal: unable to set session and process group ID: Operation not > permitted > > However, when I start them individually (i.e. postfix start; > check_MailScanner) both subsystems start and mail is processed. > Can anyone point me in a direction to start looking? I'm trying > to wean myself off of Sendmail, so I'm relatively new to Postfix. > > Thank you, > > Pat > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120418/897c3bdd/attachment.html From secmas at gmail.com Wed Apr 18 14:03:56 2012 From: secmas at gmail.com (Sergio) Date: Wed Apr 18 14:04:06 2012 Subject: best way to not check attachments over 1MB? In-Reply-To: References: Message-ID: Thank you Marti for answering back, this is what I have on both rules: max.message.size.rules: FromOrTo: default 15M max.attach.size.rules: FromOrTo: default 15M Regards, Sergio On Tue, Apr 17, 2012 at 11:26 PM, Martin Hepworth wrote: > What are the content of the rules files used for max message and > attachment size ? > > Martin > > > On Tuesday, 17 April 2012, Sergio wrote: > >> Hello all, >> what is the best way to tweak MS to not check or scan for attachments >> larger than 1MB but that could delete messages with attachments larger than >> 15MB? >> >> I have already set the following settings, but when an email larger thatn >> 30MB enters, the load on the server goes high and the deliver is stopped >> until the message has been scanned: >> >> - *Gunzip Command: /bin/gunzip >> - **Gunzip Timeout: 50 >> - **Unrar Command: {blank} >> - **Unrar Timeout: 0 >> - **Maximum Message Size: %rules-dir%/max.message.size.rules >> - **Maximum Attachment Size: %rules-dir%/max.attach.size.rules >> - **Minimum Attachment Size: -1 >> - **Maximum Archive Depth: 0 >> - **Virus Scanners: clamd >> - **Virus Scanner Timeout: 60 >> - **ClamAVmodule Maximum Recursion Level: 8 >> - **ClamAVmodule Maximum Files: 1000 >> - **ClamAVmodule Maximum File Size: 1000000 # (1 Mbytes) >> - **ClamAVmodule Maximum Compression Ratio: 250 >> - **Clamd Use Threads: yes* >> *- **ClamAV Full Message Scan: no >> - **Max Spam Check Size: 200K >> - **Max SpamAssassin Size: 200K >> - **SpamAssassin Timeout: 75 >> - **Max SpamAssassin Timeouts: 10 >> >> I think all this commands are relevant to what I want to accomplish, if I >> need another one, please tell me and if this commands needs to be fixed, >> please tell me as well. >> >> Your help is appreciated. >> >> Regards, >> >> Sergio >> ** >> >> * > > > > -- > -- > Martin Hepworth > Oxford, UK > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120418/1d50d39c/attachment.html From alex at vidadigital.com.pa Wed Apr 18 20:37:25 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Wed Apr 18 20:37:35 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <6CA45B0E-1F9F-42E2-9975-444A776A2E61@di.unito.it> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <1334705549.4f8dfd8d9027e@perdition.cnpapers.net> <6CA45B0E-1F9F-42E2-9975-444A776A2E61@di.unito.it> Message-ID: I saw a client the other day (Samsung) whose settings included "encryption", which could be set to "None", "TLS", "SSL" and "Use SSL but don't care about the fact that it's a self-signed certificate". If I didn't choose the last option it wouldn't work. Most mail clients on mobiles have this option, albeit with different names. On Tue, Apr 17, 2012 at 7:07 PM, Rabellino Sergio wrote: > I think that the motorola client is failing the SSL handshake, and drop the connection to the smtps. double check the ca certificates on the client to be sure that the server cert is well known. > The sendmail error shown it's fired when the client breaks without sending anything on the smtp protocol... > > hope this helps. > > -- > Ing. Sergio Rabellino > > Il giorno 18/apr/2012, alle ore 01:32, Steve Campbell ha scritto: > >> Quoting Scott Silva : >> >>> on 4/16/2012 11:37 AM Ken A spake the following: >>>> >>>> >>>> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>>>> Completely off topic - just curious if anyone has had problems similar. >>>>> >>>>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>>>> sendmail server. Just recently our company renewed it's contract and all >>>>> smartphones were upgraded to the Motorola Milestone X2. These are used >>>>> by our sales staff when they're out in the field and are allowed to >>>>> relay through our servers using smtp auth. >>>>> >>>>> I have port 587 set up with smtp auth. I'm fairly certain that this was >>>>> working shortly after the upgrade, but now smtp to this port does not >>>>> work. It doesn't seem to matter what settings I put in the phone, my >>>>> maillog returns: >>>>> >>>>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>>>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to >>> MSA. >>>> >>>> That usually means that the client isn't sending the authentication info - >>>> user & pass. >>>> >>>> Do you have one of these new phones to test this with? >>>> >>>> You could turn up logging in sendmail - >>>> define(`confLOG_LEVEL', `14')dnl >>>> >>>> Ken >>>> >>>> >>>>> I don't think it's sendmail because the sendmail.mc is identical to the >>>>> old server's file. >>>>> >>>>> I can set up an account using things like Thunderbird just fine, but >>>>> then I'm using our network, but I'm still able to use port 587. >>>>> >>>>> Originally the problem was with one of the dnsbl I was using. (Seems >>>>> that our provider had blocked their own IPs in one of the spamhaus.org >>>>> RBLs to protect themselves from spam and using that blocked us from >>>>> using the IPs they had assigned their smartphones). I switched from >>>>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >>>>> >>>>> My main question is about the Motorola Milestone mail client. Anyone >>>>> have an opinion on how reliable it is? Does it follow the settings I set >>>>> on it and has anyone run into problems using this phone as I'm trying to >>>>> use them? >>>>> >>>>> Thanks for any clues. >>>>> >>>>> steve campbell >>>>> >>>>> >>>> >>> I had something similar with some verizon android phones... the auth methods >>> >>> the phone supported didn't mesh with the auth methods that saslauth >>> allowed... >>> the md5 login wouldn't work, and the cram-md5 wouldn't either. I had to use a >>> >>> different mail app on the phones... >>> >>> >>> >>> -- >> I originally thought I might have something going on like that with these >> Androids. But then, I'm not sure I have SASL set up properly anymore after all >> the googling. >> >> Thanks >> steve >> >> >> >> ------------------------------------------------- >> This mail sent through IMP: http://horde.org/imp/ >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From secmas at gmail.com Thu Apr 19 19:36:38 2012 From: secmas at gmail.com (Sergio) Date: Thu Apr 19 19:36:47 2012 Subject: best way to not check attachments over 1MB? In-Reply-To: References: Message-ID: Hello Martin, is there something else that I need to tweak in MS? Thanks in advance. On Wed, Apr 18, 2012 at 7:03 AM, Sergio wrote: > Thank you Martin for answering back, this is what I have on both rules: > > max.message.size.rules: > FromOrTo: default 15M > > max.attach.size.rules: > FromOrTo: default 15M > > Regards, > > Sergio > > On Tue, Apr 17, 2012 at 11:26 PM, Martin Hepworth wrote: > >> What are the content of the rules files used for max message and >> attachment size ? >> >> Martin >> >> >> On Tuesday, 17 April 2012, Sergio wrote: >> >>> Hello all, >>> what is the best way to tweak MS to not check or scan for attachments >>> larger than 1MB but that could delete messages with attachments larger than >>> 15MB? >>> >>> I have already set the following settings, but when an email larger >>> thatn 30MB enters, the load on the server goes high and the deliver is >>> stopped until the message has been scanned: >>> >>> - *Gunzip Command: /bin/gunzip >>> - **Gunzip Timeout: 50 >>> - **Unrar Command: {blank} >>> - **Unrar Timeout: 0 >>> - **Maximum Message Size: %rules-dir%/max.message.size.rules >>> - **Maximum Attachment Size: %rules-dir%/max.attach.size.rules >>> - **Minimum Attachment Size: -1 >>> - **Maximum Archive Depth: 0 >>> - **Virus Scanners: clamd >>> - **Virus Scanner Timeout: 60 >>> - **ClamAVmodule Maximum Recursion Level: 8 >>> - **ClamAVmodule Maximum Files: 1000 >>> - **ClamAVmodule Maximum File Size: 1000000 # (1 Mbytes) >>> - **ClamAVmodule Maximum Compression Ratio: 250 >>> - **Clamd Use Threads: yes* >>> *- **ClamAV Full Message Scan: no >>> - **Max Spam Check Size: 200K >>> - **Max SpamAssassin Size: 200K >>> - **SpamAssassin Timeout: 75 >>> - **Max SpamAssassin Timeouts: 10 >>> >>> I think all this commands are relevant to what I want to accomplish, if >>> I need another one, please tell me and if this commands needs to be fixed, >>> please tell me as well. >>> >>> Your help is appreciated. >>> >>> Regards, >>> >>> Sergio >>> ** >>> >>> * >> >> >> >> -- >> -- >> Martin Hepworth >> Oxford, UK >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> >> > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120419/f708c83e/attachment.html From campbell at cnpapers.com Thu Apr 19 20:14:53 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Apr 19 20:14:58 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <1334705549.4f8dfd8d9027e@perdition.cnpapers.net> <6CA45B0E-1F9F-42E2-9975-444A776A2E61@di.unito.it> Message-ID: <4F90642D.7000008@cnpapers.com> It's solved. Turns out the old phones required just the user name while the new Motorola phones require the complete email address in the Username field. Thanks for all the help from everyone. steve On 4/18/2012 3:37 PM, Alex Neuman wrote: > I saw a client the other day (Samsung) whose settings included > "encryption", which could be set to "None", "TLS", "SSL" and "Use SSL > but don't care about the fact that it's a self-signed certificate". If > I didn't choose the last option it wouldn't work. Most mail clients on > mobiles have this option, albeit with different names. > > On Tue, Apr 17, 2012 at 7:07 PM, Rabellino Sergio wrote: >> I think that the motorola client is failing the SSL handshake, and drop the connection to the smtps. double check the ca certificates on the client to be sure that the server cert is well known. >> The sendmail error shown it's fired when the client breaks without sending anything on the smtp protocol... >> >> hope this helps. >> >> -- >> Ing. Sergio Rabellino >> >> Il giorno 18/apr/2012, alle ore 01:32, Steve Campbell ha scritto: >> >>> Quoting Scott Silva: >>> >>>> on 4/16/2012 11:37 AM Ken A spake the following: >>>>> >>>>> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>>>>> Completely off topic - just curious if anyone has had problems similar. >>>>>> >>>>>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>>>>> sendmail server. Just recently our company renewed it's contract and all >>>>>> smartphones were upgraded to the Motorola Milestone X2. These are used >>>>>> by our sales staff when they're out in the field and are allowed to >>>>>> relay through our servers using smtp auth. >>>>>> >>>>>> I have port 587 set up with smtp auth. I'm fairly certain that this was >>>>>> working shortly after the upgrade, but now smtp to this port does not >>>>>> work. It doesn't seem to matter what settings I put in the phone, my >>>>>> maillog returns: >>>>>> >>>>>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>>>>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection to >>>> MSA. >>>>> That usually means that the client isn't sending the authentication info - >>>>> user& pass. >>>>> >>>>> Do you have one of these new phones to test this with? >>>>> >>>>> You could turn up logging in sendmail - >>>>> define(`confLOG_LEVEL', `14')dnl >>>>> >>>>> Ken >>>>> >>>>> >>>>>> I don't think it's sendmail because the sendmail.mc is identical to the >>>>>> old server's file. >>>>>> >>>>>> I can set up an account using things like Thunderbird just fine, but >>>>>> then I'm using our network, but I'm still able to use port 587. >>>>>> >>>>>> Originally the problem was with one of the dnsbl I was using. (Seems >>>>>> that our provider had blocked their own IPs in one of the spamhaus.org >>>>>> RBLs to protect themselves from spam and using that blocked us from >>>>>> using the IPs they had assigned their smartphones). I switched from >>>>>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a while. >>>>>> >>>>>> My main question is about the Motorola Milestone mail client. Anyone >>>>>> have an opinion on how reliable it is? Does it follow the settings I set >>>>>> on it and has anyone run into problems using this phone as I'm trying to >>>>>> use them? >>>>>> >>>>>> Thanks for any clues. >>>>>> >>>>>> steve campbell >>>>>> >>>>>> >>>> I had something similar with some verizon android phones... the auth methods >>>> >>>> the phone supported didn't mesh with the auth methods that saslauth >>>> allowed... >>>> the md5 login wouldn't work, and the cram-md5 wouldn't either. I had to use a >>>> >>>> different mail app on the phones... >>>> >>>> >>>> >>>> -- >>> I originally thought I might have something going on like that with these >>> Androids. But then, I'm not sure I have SASL set up properly anymore after all >>> the googling. >>> >>> Thanks >>> steve >>> >>> >>> >>> ------------------------------------------------- >>> This mail sent through IMP: http://horde.org/imp/ >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > From alex at vidadigital.com.pa Fri Apr 20 17:53:15 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Fri Apr 20 17:53:25 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <4F90642D.7000008@cnpapers.com> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <1334705549.4f8dfd8d9027e@perdition.cnpapers.net> <6CA45B0E-1F9F-42E2-9975-444A776A2E61@di.unito.it> <4F90642D.7000008@cnpapers.com> Message-ID: That's odd. Normally that depends on the *server* and not the client. On Thu, Apr 19, 2012 at 2:14 PM, Steve Campbell wrote: > It's solved. Turns out the old phones required just the user name while the > new Motorola phones require the complete email address in the Username > field. > > Thanks for all the help from everyone. > > steve > > On 4/18/2012 3:37 PM, Alex Neuman wrote: >> >> I saw a client the other day (Samsung) whose settings included >> "encryption", which could be set to "None", "TLS", "SSL" and "Use SSL >> but don't care about the fact that it's a self-signed certificate". If >> I didn't choose the last option it wouldn't work. Most mail clients on >> mobiles have this option, albeit with different names. >> >> On Tue, Apr 17, 2012 at 7:07 PM, Rabellino Sergio >> ?wrote: >>> >>> I think that the motorola client is failing the SSL handshake, and drop >>> the connection to the smtps. double check the ca certificates on the client >>> to be sure that the server cert is well known. >>> The sendmail error shown it's fired when the client breaks without >>> sending anything on the smtp protocol... >>> >>> hope this helps. >>> >>> -- >>> Ing. Sergio Rabellino >>> >>> Il giorno 18/apr/2012, alle ore 01:32, Steve >>> Campbell ?ha scritto: >>> >>>> Quoting Scott Silva: >>>> >>>>> on 4/16/2012 11:37 AM Ken A spake the following: >>>>>> >>>>>> >>>>>> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>>>>>> >>>>>>> Completely off topic - just curious if anyone has had problems >>>>>>> similar. >>>>>>> >>>>>>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>>>>>> sendmail server. Just recently our company renewed it's contract and >>>>>>> all >>>>>>> smartphones were upgraded to the Motorola Milestone X2. These are >>>>>>> used >>>>>>> by our sales staff when they're out in the field and are allowed to >>>>>>> relay through our servers using smtp auth. >>>>>>> >>>>>>> I have port 587 set up with smtp auth. I'm fairly certain that this >>>>>>> was >>>>>>> working shortly after the upgrade, but now smtp to this port does not >>>>>>> work. It doesn't seem to matter what settings I put in the phone, my >>>>>>> maillog returns: >>>>>>> >>>>>>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>>>>>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection >>>>>>> to >>>>> >>>>> MSA. >>>>>> >>>>>> That usually means that the client isn't sending the authentication >>>>>> info - >>>>>> user& ?pass. >>>>>> >>>>>> Do you have one of these new phones to test this with? >>>>>> >>>>>> You could turn up logging in sendmail - >>>>>> define(`confLOG_LEVEL', `14')dnl >>>>>> >>>>>> Ken >>>>>> >>>>>> >>>>>>> I don't think it's sendmail because the sendmail.mc is identical to >>>>>>> the >>>>>>> old server's file. >>>>>>> >>>>>>> I can set up an account using things like Thunderbird just fine, but >>>>>>> then I'm using our network, but I'm still able to use port 587. >>>>>>> >>>>>>> Originally the problem was with one of the dnsbl I was using. (Seems >>>>>>> that our provider had blocked their own IPs in one of the >>>>>>> spamhaus.org >>>>>>> RBLs to protect themselves from spam and using that blocked us from >>>>>>> using the IPs they had assigned their smartphones). I switched from >>>>>>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a >>>>>>> while. >>>>>>> >>>>>>> My main question is about the Motorola Milestone mail client. Anyone >>>>>>> have an opinion on how reliable it is? Does it follow the settings I >>>>>>> set >>>>>>> on it and has anyone run into problems using this phone as I'm trying >>>>>>> to >>>>>>> use them? >>>>>>> >>>>>>> Thanks for any clues. >>>>>>> >>>>>>> steve campbell >>>>>>> >>>>>>> >>>>> I had something similar with some verizon android phones... the auth >>>>> methods >>>>> >>>>> the phone supported didn't mesh with the auth methods that saslauth >>>>> allowed... >>>>> the md5 login wouldn't work, and the cram-md5 wouldn't either. I had to >>>>> use a >>>>> >>>>> different mail app on the phones... >>>>> >>>>> >>>>> >>>>> -- >>>> >>>> I originally thought I might have something going on like that with >>>> these >>>> Androids. But then, I'm not sure I have SASL set up properly anymore >>>> after all >>>> the googling. >>>> >>>> Thanks >>>> steve >>>> >>>> >>>> >>>> ------------------------------------------------- >>>> This mail sent through IMP: http://horde.org/imp/ >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> >> > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From campbell at cnpapers.com Fri Apr 20 18:18:37 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Apr 20 18:18:16 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <1334705549.4f8dfd8d9027e@perdition.cnpapers.net> <6CA45B0E-1F9F-42E2-9975-444A776A2E61@di.unito.it> <4F90642D.7000008@cnpapers.com> Message-ID: <4F919A6D.7060503@cnpapers.com> I'm guessing the older phones concatenated the username + domain name while the newer phone doesn't. The default setup would put the entire string in the username field, but because the old phone seemed to require just the user part, our old instructions for setting these up caused everyone to change that default entry. I'm thinking that some didn't bother changing it and their new phones worked. Others followed the instructions and theirs broke. Perhaps that's why I didn't get a flood of calls. Again, I'm just guessing. I'm just glad it's working for now. Thanks for all the clues everyone provided. steve On 4/20/2012 12:53 PM, Alex Neuman wrote: > That's odd. Normally that depends on the *server* and not the client. > > On Thu, Apr 19, 2012 at 2:14 PM, Steve Campbell wrote: >> It's solved. Turns out the old phones required just the user name while the >> new Motorola phones require the complete email address in the Username >> field. >> >> Thanks for all the help from everyone. >> >> steve >> >> On 4/18/2012 3:37 PM, Alex Neuman wrote: >>> I saw a client the other day (Samsung) whose settings included >>> "encryption", which could be set to "None", "TLS", "SSL" and "Use SSL >>> but don't care about the fact that it's a self-signed certificate". If >>> I didn't choose the last option it wouldn't work. Most mail clients on >>> mobiles have this option, albeit with different names. >>> >>> On Tue, Apr 17, 2012 at 7:07 PM, Rabellino Sergio >>> wrote: >>>> I think that the motorola client is failing the SSL handshake, and drop >>>> the connection to the smtps. double check the ca certificates on the client >>>> to be sure that the server cert is well known. >>>> The sendmail error shown it's fired when the client breaks without >>>> sending anything on the smtp protocol... >>>> >>>> hope this helps. >>>> >>>> -- >>>> Ing. Sergio Rabellino >>>> >>>> Il giorno 18/apr/2012, alle ore 01:32, Steve >>>> Campbell ha scritto: >>>> >>>>> Quoting Scott Silva: >>>>> >>>>>> on 4/16/2012 11:37 AM Ken A spake the following: >>>>>>> >>>>>>> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>>>>>>> Completely off topic - just curious if anyone has had problems >>>>>>>> similar. >>>>>>>> >>>>>>>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>>>>>>> sendmail server. Just recently our company renewed it's contract and >>>>>>>> all >>>>>>>> smartphones were upgraded to the Motorola Milestone X2. These are >>>>>>>> used >>>>>>>> by our sales staff when they're out in the field and are allowed to >>>>>>>> relay through our servers using smtp auth. >>>>>>>> >>>>>>>> I have port 587 set up with smtp auth. I'm fairly certain that this >>>>>>>> was >>>>>>>> working shortly after the upgrade, but now smtp to this port does not >>>>>>>> work. It doesn't seem to matter what settings I put in the phone, my >>>>>>>> maillog returns: >>>>>>>> >>>>>>>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>>>>>>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection >>>>>>>> to >>>>>> MSA. >>>>>>> That usually means that the client isn't sending the authentication >>>>>>> info - >>>>>>> user& pass. >>>>>>> >>>>>>> Do you have one of these new phones to test this with? >>>>>>> >>>>>>> You could turn up logging in sendmail - >>>>>>> define(`confLOG_LEVEL', `14')dnl >>>>>>> >>>>>>> Ken >>>>>>> >>>>>>> >>>>>>>> I don't think it's sendmail because the sendmail.mc is identical to >>>>>>>> the >>>>>>>> old server's file. >>>>>>>> >>>>>>>> I can set up an account using things like Thunderbird just fine, but >>>>>>>> then I'm using our network, but I'm still able to use port 587. >>>>>>>> >>>>>>>> Originally the problem was with one of the dnsbl I was using. (Seems >>>>>>>> that our provider had blocked their own IPs in one of the >>>>>>>> spamhaus.org >>>>>>>> RBLs to protect themselves from spam and using that blocked us from >>>>>>>> using the IPs they had assigned their smartphones). I switched from >>>>>>>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a >>>>>>>> while. >>>>>>>> >>>>>>>> My main question is about the Motorola Milestone mail client. Anyone >>>>>>>> have an opinion on how reliable it is? Does it follow the settings I >>>>>>>> set >>>>>>>> on it and has anyone run into problems using this phone as I'm trying >>>>>>>> to >>>>>>>> use them? >>>>>>>> >>>>>>>> Thanks for any clues. >>>>>>>> >>>>>>>> steve campbell >>>>>>>> >>>>>>>> >>>>>> I had something similar with some verizon android phones... the auth >>>>>> methods >>>>>> >>>>>> the phone supported didn't mesh with the auth methods that saslauth >>>>>> allowed... >>>>>> the md5 login wouldn't work, and the cram-md5 wouldn't either. I had to >>>>>> use a >>>>>> >>>>>> different mail app on the phones... >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>> I originally thought I might have something going on like that with >>>>> these >>>>> Androids. But then, I'm not sure I have SASL set up properly anymore >>>>> after all >>>>> the googling. >>>>> >>>>> Thanks >>>>> steve >>>>> >>>>> >>>>> >>>>> ------------------------------------------------- >>>>> This mail sent through IMP: http://horde.org/imp/ >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner@lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>> -- >>>> MailScanner mailing list >>>> mailscanner@lists.mailscanner.info >>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>> >>>> Before posting, read http://wiki.mailscanner.info/posting >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! > > From alex at vidadigital.com.pa Fri Apr 20 19:31:06 2012 From: alex at vidadigital.com.pa (Alex Neuman) Date: Fri Apr 20 19:31:18 2012 Subject: OT Sendmail and Motorola smartphones In-Reply-To: <4F919A6D.7060503@cnpapers.com> References: <4F8C46DE.8050001@cnpapers.com> <4F8C66E6.3040800@pacific.net> <1334705549.4f8dfd8d9027e@perdition.cnpapers.net> <6CA45B0E-1F9F-42E2-9975-444A776A2E61@di.unito.it> <4F90642D.7000008@cnpapers.com> <4F919A6D.7060503@cnpapers.com> Message-ID: If they did, they probably tried "as is", failed, then tried the proper way, and stuck with that. I've had that happen both ways before. On Fri, Apr 20, 2012 at 12:18 PM, Steve Campbell wrote: > I'm guessing the older phones concatenated the username + domain name while > the newer phone doesn't. The default setup would put the entire string in > the username field, but because the old phone seemed to require just the > user part, our old instructions for setting these up caused everyone to > change that default entry. > > I'm thinking that some didn't bother changing it and their new phones > worked. Others followed the instructions and theirs broke. Perhaps that's > why I didn't get a flood of calls. > > Again, I'm just guessing. I'm just glad it's working for now. > > Thanks for all the clues everyone provided. > > steve > > > On 4/20/2012 12:53 PM, Alex Neuman wrote: >> >> That's odd. Normally that depends on the *server* and not the client. >> >> On Thu, Apr 19, 2012 at 2:14 PM, Steve Campbell >> ?wrote: >>> >>> It's solved. Turns out the old phones required just the user name while >>> the >>> new Motorola phones require the complete email address in the Username >>> field. >>> >>> Thanks for all the help from everyone. >>> >>> steve >>> >>> On 4/18/2012 3:37 PM, Alex Neuman wrote: >>>> >>>> I saw a client the other day (Samsung) whose settings included >>>> "encryption", which could be set to "None", "TLS", "SSL" and "Use SSL >>>> but don't care about the fact that it's a self-signed certificate". If >>>> I didn't choose the last option it wouldn't work. Most mail clients on >>>> mobiles have this option, albeit with different names. >>>> >>>> On Tue, Apr 17, 2012 at 7:07 PM, Rabellino Sergio >>>> ?wrote: >>>>> >>>>> I think that the motorola client is failing the SSL handshake, and drop >>>>> the connection to the smtps. double check the ca certificates on the >>>>> client >>>>> to be sure that the server cert is well known. >>>>> The sendmail error shown it's fired when the client breaks without >>>>> sending anything on the smtp protocol... >>>>> >>>>> hope this helps. >>>>> >>>>> -- >>>>> Ing. Sergio Rabellino >>>>> >>>>> Il giorno 18/apr/2012, alle ore 01:32, Steve >>>>> Campbell ? ?ha scritto: >>>>> >>>>>> Quoting Scott Silva: >>>>>> >>>>>>> on 4/16/2012 11:37 AM Ken A spake the following: >>>>>>>> >>>>>>>> >>>>>>>> On 4/16/2012 11:20 AM, Steve Campbell wrote: >>>>>>>>> >>>>>>>>> Completely off topic - just curious if anyone has had problems >>>>>>>>> similar. >>>>>>>>> >>>>>>>>> I've upgraded email servers from an old Centos 3 to a new Centos 6 >>>>>>>>> sendmail server. Just recently our company renewed it's contract >>>>>>>>> and >>>>>>>>> all >>>>>>>>> smartphones were upgraded to the Motorola Milestone X2. These are >>>>>>>>> used >>>>>>>>> by our sales staff when they're out in the field and are allowed to >>>>>>>>> relay through our servers using smtp auth. >>>>>>>>> >>>>>>>>> I have port 587 set up with smtp auth. I'm fairly certain that this >>>>>>>>> was >>>>>>>>> working shortly after the upgrade, but now smtp to this port does >>>>>>>>> not >>>>>>>>> work. It doesn't seem to matter what settings I put in the phone, >>>>>>>>> my >>>>>>>>> maillog returns: >>>>>>>>> >>>>>>>>> sendmail[2765]: q3GG1Gng002765: 70-32-205-105.unassigned.ntelos.net >>>>>>>>> [70.32.205.105] did not issue MAIL/EXPN/VRFY/ETRN during connection >>>>>>>>> to >>>>>>> >>>>>>> MSA. >>>>>>>> >>>>>>>> That usually means that the client isn't sending the authentication >>>>>>>> info - >>>>>>>> user& ? ?pass. >>>>>>>> >>>>>>>> Do you have one of these new phones to test this with? >>>>>>>> >>>>>>>> You could turn up logging in sendmail - >>>>>>>> define(`confLOG_LEVEL', `14')dnl >>>>>>>> >>>>>>>> Ken >>>>>>>> >>>>>>>> >>>>>>>>> I don't think it's sendmail because the sendmail.mc is identical to >>>>>>>>> the >>>>>>>>> old server's file. >>>>>>>>> >>>>>>>>> I can set up an account using things like Thunderbird just fine, >>>>>>>>> but >>>>>>>>> then I'm using our network, but I'm still able to use port 587. >>>>>>>>> >>>>>>>>> Originally the problem was with one of the dnsbl I was using. >>>>>>>>> (Seems >>>>>>>>> that our provider had blocked their own IPs in one of the >>>>>>>>> spamhaus.org >>>>>>>>> RBLs to protect themselves from spam and using that blocked us from >>>>>>>>> using the IPs they had assigned their smartphones). I switched from >>>>>>>>> zen.spamhaus.org to sbl-xbl.spamhaus.org and that fixed it for a >>>>>>>>> while. >>>>>>>>> >>>>>>>>> My main question is about the Motorola Milestone mail client. >>>>>>>>> Anyone >>>>>>>>> have an opinion on how reliable it is? Does it follow the settings >>>>>>>>> I >>>>>>>>> set >>>>>>>>> on it and has anyone run into problems using this phone as I'm >>>>>>>>> trying >>>>>>>>> to >>>>>>>>> use them? >>>>>>>>> >>>>>>>>> Thanks for any clues. >>>>>>>>> >>>>>>>>> steve campbell >>>>>>>>> >>>>>>>>> >>>>>>> I had something similar with some verizon android phones... the auth >>>>>>> methods >>>>>>> >>>>>>> the phone supported didn't mesh with the auth methods that saslauth >>>>>>> allowed... >>>>>>> the md5 login wouldn't work, and the cram-md5 wouldn't either. I had >>>>>>> to >>>>>>> use a >>>>>>> >>>>>>> different mail app on the phones... >>>>>>> >>>>>>> >>>>>>> >>>>>>> -- >>>>>> >>>>>> I originally thought I might have something going on like that with >>>>>> these >>>>>> Androids. But then, I'm not sure I have SASL set up properly anymore >>>>>> after all >>>>>> the googling. >>>>>> >>>>>> Thanks >>>>>> steve >>>>>> >>>>>> >>>>>> >>>>>> ------------------------------------------------- >>>>>> This mail sent through IMP: http://horde.org/imp/ >>>>>> -- >>>>>> MailScanner mailing list >>>>>> mailscanner@lists.mailscanner.info >>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>>> >>>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> -- >>>>> MailScanner mailing list >>>>> mailscanner@lists.mailscanner.info >>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>>>> >>>>> Before posting, read http://wiki.mailscanner.info/posting >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> >> > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! -- -- Alex Neuman van der Hans Reliant Technologies / Vida Digital http://vidadigital.com.pa/ +507-6781-9505 +507-832-6725 +1-440-253-9789 (USA) Follow @AlexNeuman on Twitter http://facebook.com/vidadigital From lists at elasticmind.net Mon Apr 23 13:40:28 2012 From: lists at elasticmind.net (mog) Date: Mon Apr 23 13:40:10 2012 Subject: "Always Include SpamAssassin Report" doesn't seem to like filename rule-sets Message-ID: <4F954DBC.1050009@elasticmind.net> Hi, Has anyone tried setting "Always Include SpamAssassin Report" as a filename rule-set? I modified MailScanner.conf to add the rule-set file and created a .rules file like this: From: email@example.com yes FromOrTo: default no I restarted mailscanner and spamassassin (for good measure) and hoped to see spamassassin values when the email was processed (regardless of whether the message was considered spam or not). So far, that has not happened though :\ Just wondered if anyone else has experienced the same thing. Thanks, mog From maxsec at gmail.com Mon Apr 23 17:24:26 2012 From: maxsec at gmail.com (Martin Hepworth) Date: Mon Apr 23 17:24:34 2012 Subject: "Always Include SpamAssassin Report" doesn't seem to like filename rule-sets In-Reply-To: <4F954DBC.1050009@elasticmind.net> References: <4F954DBC.1050009@elasticmind.net> Message-ID: mailscanner calls Spamassassin by it's API so no need to run spamd (or restart it ) Doc says it can be a ruleset and you're sure the envelope-from actually contains the value within the ruleset for this? -- Martin Hepworth Oxford, UK On 23 April 2012 13:40, mog wrote: > Hi, > > Has anyone tried setting "Always Include SpamAssassin Report" as a > filename rule-set? > > I modified MailScanner.conf to add the rule-set file and created a .rules > file like this: > > From: email@example.com yes > FromOrTo: default no > > I restarted mailscanner and spamassassin (for good measure) and hoped to > see spamassassin values when the email was processed (regardless of whether > the message was considered spam or not). So far, that has not happened > though :\ > > Just wondered if anyone else has experienced the same thing. > > Thanks, > mog > -- > MailScanner mailing list > mailscanner@lists.mailscanner.**info > http://lists.mailscanner.info/**mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/**posting > > Support MailScanner development - buy the book off the website! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120423/5d77f78e/attachment.html From lists at tatorz.com Tue Apr 24 13:33:18 2012 From: lists at tatorz.com (Mail Lists) Date: Tue Apr 24 13:33:34 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server Message-ID: <4F969D8E.9090909@Tatorz.com> Hi List, I have a CentOS 6.2 Server running MailScanner 4.84.5-2 with mailwatch 1.1.5.1 and postfix. Almost on a daily basis I am running into mails that are killing MailScanner. I have captured one of the emails that will cause MailScanner to die. I also have the log entry to paste here. If anyone has an Idea where I should start looking for issues that would be great. One note also, I have added the -U to the /usr/sbin/MailScanner file as such. " #!/usr/bin/perl -I/usr/lib/MailScanner -U " Once I move the offending message to /var/spool/postfix/hold I will get this in the logs. root@poweredge > /var/spool/postfix/hold# Apr 24 08:19:07 poweredge MailScanner[25081]: New Batch: Scanning 1 messages, 1469 bytes Apr 24 08:19:07 poweredge MailScanner[25081]: Virus and Content Scanning: Starting Apr 24 08:19:07 poweredge MailScanner[25081]: Spam Checks: Starting Apr 24 08:19:08 poweredge MailScanner[25081]: SpamAssassin cache hit for message 774E9E30B5.A14B0 Apr 24 08:19:08 poweredge MailScanner[25081]: Message 774E9E30B5.A14B0 from 201.234.47.187 (aletajose@informaxinc.com) to tatorz.com is spam, SpamAssassin (cached, score=27.117, required 4, autolearn=spam, BAYES_50 0.80, DRUGS_ERECTILE 1.99, DRUG_ED_ONLINE 0.61, RCVD_IN_BL_SPAMCOP_NET 1.35, RCVD_IN_BRBL_LASTEXT 1.45, RCVD_IN_PBL 3.33, RCVD_IN_PSBL 2.70, RCVD_IN_RP_RNBL 1.31, RCVD_IN_XBL 0.38, RDNS_NONE 0.79, SERGIO_SUBJECT_VIAGRA01 0.00, URIBL_AB_SURBL 4.50, URIBL_BLACK 1.73, URIBL_DBL_SPAM 1.70, URIBL_JP_SURBL 1.25, URIBL_SBL 1.62, URIBL_WS_SURBL 1.61) Apr 24 08:19:08 poweredge MailScanner[25081]: Spam Checks: Found 1 spam messages Apr 24 08:19:08 poweredge MailScanner[25081]: Spam Actions: message 774E9E30B5.A14B0 actions are store Apr 24 08:19:08 poweredge MailScanner[25081]: writing to /var/spool/MailScanner/quarantine/20120424/spam/774E9E30B5.A14B0: 2 ==> messages <== Apr 24 08:19:08 poweredge MailScanner: Process did not exit cleanly, returned 255 with signal 0 So any help will be appreciated. thanks. -- Brian ----- Get the latest Fremont, OH Weather http://www.Fremont-OH-Weather.com -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From jeremy at fluxlabs.net Tue Apr 24 13:37:53 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Apr 24 13:38:06 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: <4F969D8E.9090909@Tatorz.com> References: <4F969D8E.9090909@Tatorz.com> Message-ID: <58870E69-E63A-4F07-86AC-F7DC774A97A8@fluxlabs.net> debug output ? -- Jeremy McSpadden On Apr 24, 2012, at 7:34 AM, "Mail Lists" wrote: > > Hi List, > > I have a CentOS 6.2 Server running MailScanner 4.84.5-2 with mailwatch 1.1.5.1 and postfix. Almost on a daily basis I am running into mails that are killing MailScanner. I have captured one of the emails that will cause MailScanner to die. I also have the log entry to paste here. If anyone has an Idea where I should start looking for issues that would be great. One note also, I have added the -U to the /usr/sbin/MailScanner file as such. " #!/usr/bin/perl -I/usr/lib/MailScanner -U " > > Once I move the offending message to /var/spool/postfix/hold I will get this in the logs. > > root@poweredge > /var/spool/postfix/hold# Apr 24 08:19:07 poweredge MailScanner[25081]: New Batch: Scanning 1 messages, 1469 bytes > Apr 24 08:19:07 poweredge MailScanner[25081]: Virus and Content Scanning: Starting > Apr 24 08:19:07 poweredge MailScanner[25081]: Spam Checks: Starting > Apr 24 08:19:08 poweredge MailScanner[25081]: SpamAssassin cache hit for message 774E9E30B5.A14B0 > Apr 24 08:19:08 poweredge MailScanner[25081]: Message 774E9E30B5.A14B0 from 201.234.47.187 (aletajose@informaxinc.com) to tatorz.com is spam, SpamAssassin (cached, score=27.117, required 4, autolearn=spam, BAYES_50 0.80, DRUGS_ERECTILE 1.99, DRUG_ED_ONLINE 0.61, RCVD_IN_BL_SPAMCOP_NET 1.35, RCVD_IN_BRBL_LASTEXT 1.45, RCVD_IN_PBL 3.33, RCVD_IN_PSBL 2.70, RCVD_IN_RP_RNBL 1.31, RCVD_IN_XBL 0.38, RDNS_NONE 0.79, SERGIO_SUBJECT_VIAGRA01 0.00, URIBL_AB_SURBL 4.50, URIBL_BLACK 1.73, URIBL_DBL_SPAM 1.70, URIBL_JP_SURBL 1.25, URIBL_SBL 1.62, URIBL_WS_SURBL 1.61) > Apr 24 08:19:08 poweredge MailScanner[25081]: Spam Checks: Found 1 spam messages > Apr 24 08:19:08 poweredge MailScanner[25081]: Spam Actions: message 774E9E30B5.A14B0 actions are store > Apr 24 08:19:08 poweredge MailScanner[25081]: writing to /var/spool/MailScanner/quarantine/20120424/spam/774E9E30B5.A14B0: 2 > > > ==> messages <== > Apr 24 08:19:08 poweredge MailScanner: Process did not exit cleanly, returned 255 with signal 0 > > So any help will be appreciated. thanks. > > > > -- > Brian ----- Get the latest Fremont, OH Weather http://www.Fremont-OH-Weather.com > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! From stef at aoc-uk.com Tue Apr 24 13:58:33 2012 From: stef at aoc-uk.com (Stef Morrell) Date: Tue Apr 24 13:58:14 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: References: <4F969D8E.9090909@Tatorz.com> Message-ID: <201204241258.q3OCw5AB016672@safir.blacknight.ie> On 24 April 2012 13:38 Jeremy McSpadden wrote: > debug output ? That's a bit mean. OP has gone to some effort to try and provide versioning and logs and has tried at least one common fix found in the list archive. Might be nice to tell him *how* to get the debug output. Brian - if you look towards the bottom of MailScanner.conf you will see a couple of settings # Set Debug to "yes" to stop it running as a daemon and just process # one batch of messages and then exit. Debug = no # Do you want to debug SpamAssassin from within MailScanner? Debug SpamAssassin = no Set Debug to yes and you will get a lot of additional output which is useful for diagnostics. It looks like it got through SpamAssassin fine, so I don't think you'll need to debug that as well. Regards Stef -- This email has been scanned by the Alpha Omega Computers MailCrusader for viruses, spam and dangerous content. For more information please visit http://www.aoc-uk.com From lists at tatorz.com Tue Apr 24 15:28:49 2012 From: lists at tatorz.com (Mail Lists) Date: Tue Apr 24 15:29:01 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: <201204241258.q3OCw5AB016672@safir.blacknight.ie> References: <4F969D8E.9090909@Tatorz.com> <201204241258.q3OCw5AB016672@safir.blacknight.ie> Message-ID: <4F96B8A1.5060203@Tatorz.com> On 04/24/2012 08:58 AM, Stef Morrell wrote: > Brian - if you look towards the bottom of MailScanner.conf you will > see a couple of settings # Set Debug to "yes" to stop it running as a > daemon and just process # one batch of messages and then exit. Debug = > no # Do you want to debug SpamAssassin from within MailScanner? Debug > SpamAssassin = no Set Debug to yes and you will get a lot of > additional output which is useful for diagnostics. It looks like it > got through SpamAssassin fine, so I don't think you'll need to debug > that as well. Regards Stef Thank you for this information. I will do this and report back. -- Brian ----- Get the latest Fremont, OH Weather http://www.Fremont-OH-Weather.com From lists at tatorz.com Tue Apr 24 15:42:41 2012 From: lists at tatorz.com (Mail Lists) Date: Tue Apr 24 15:44:48 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: <201204241258.q3OCw5AB016672@safir.blacknight.ie> References: <4F969D8E.9090909@Tatorz.com> <201204241258.q3OCw5AB016672@safir.blacknight.ie> Message-ID: <4F96BBE1.2030409@Tatorz.com> On 04/24/2012 08:58 AM, Stef Morrell wrote: > Brian - if you look towards the bottom of MailScanner.conf you will > see a couple of settings # Set Debug to "yes" to stop it running as a > daemon and just process # one batch of messages and then exit. Debug = > no # Do you want to debug SpamAssassin from within MailScanner? Debug > SpamAssassin = no Set Debug to yes and you will get a lot of > additional output which is useful for diagnostics. It looks like it > got through SpamAssassin fine, so I don't think you'll need to debug > that as well. Regards Stef Stef, Well debug shows no more to me then I already know.. Not much. here is the results. Starting MailScanner daemons: incoming postfix: [ OK ] outgoing postfix: Apr 24 10:39:16 poweredge postfix/postfix-script[30661]: starting the Postfix mail system [ OK ] MailScanner: Apr 24 10:39:16 poweredge postfix/master[30662]: daemon started -- version 2.6.6, configuration /etc/postfix Apr 24 10:39:20 poweredge MailScanner[30680]: MailScanner E-Mail Virus Scanner version 4.84.5 starting... Apr 24 10:39:20 poweredge MailScanner[30680]: Reading configuration file /etc/MailScanner/MailScanner.conf Apr 24 10:39:20 poweredge MailScanner[30680]: Reading configuration file /etc/MailScanner/conf.d/README Apr 24 10:39:20 poweredge MailScanner[30680]: Config: calling custom init function SQLBlacklist Apr 24 10:39:20 poweredge MailScanner[30680]: Starting up SQL Blacklist Apr 24 10:39:20 poweredge MailScanner[30680]: Read 2 blacklist entries Apr 24 10:39:20 poweredge MailScanner[30680]: Config: calling custom init function MailWatchLogging Apr 24 10:39:20 poweredge MailScanner[30680]: Started SQL Logging child Apr 24 10:39:20 poweredge MailScanner[30680]: Config: calling custom init function SQLWhitelist Apr 24 10:39:20 poweredge MailScanner[30680]: Starting up SQL Whitelist Apr 24 10:39:20 poweredge MailScanner[30680]: Read 3 whitelist entries Apr 24 10:39:21 poweredge MailScanner[30680]: Using SpamAssassin results cache Apr 24 10:39:21 poweredge MailScanner[30680]: Connected to SpamAssassin cache database Apr 24 10:39:21 poweredge MailScanner[30680]: Enabling SpamAssassin auto-whitelist functionality... Apr 24 10:39:26 poweredge MailScanner[30680]: Connected to Processing Attempts Database Apr 24 10:39:26 poweredge MailScanner[30680]: Found 0 messages in the Processing Attempts Database Apr 24 10:39:26 poweredge MailScanner[30680]: lock.pl sees Config LockType = flock Apr 24 10:39:26 poweredge MailScanner[30680]: lock.pl sees have_module = 0 Apr 24 10:39:26 poweredge MailScanner[30680]: Using locktype = flock Apr 24 10:39:26 poweredge MailScanner[30680]: New Batch: Scanning 1 messages, 1469 bytes Apr 24 10:39:26 poweredge MailScanner[30680]: Created attachment dirs for 1 messages Apr 24 10:39:26 poweredge MailScanner[30680]: Completed checking by /usr/bin/file Apr 24 10:39:26 poweredge MailScanner[30680]: Virus and Content Scanning: Starting Apr 24 10:39:26 poweredge MailScanner[30680]: Commencing scanning by clamd... Apr 24 10:39:26 poweredge MailScanner[30697]: Debug Mode Is On Apr 24 10:39:26 poweredge MailScanner[30697]: Use Threads : NO Apr 24 10:39:26 poweredge MailScanner[30697]: Socket : /tmp/clamd.socket Apr 24 10:39:26 poweredge MailScanner[30697]: IP : Using Sockets Apr 24 10:39:26 poweredge MailScanner[30697]: Lock File : NOT USED Apr 24 10:39:26 poweredge MailScanner[30697]: Time Out : 300 Apr 24 10:39:26 poweredge MailScanner[30697]: Scan Dir : /var/spool/MailScanner/incoming/30680 Apr 24 10:39:26 poweredge MailScanner[30697]: Clamd : Sending PING Apr 24 10:39:26 poweredge MailScanner[30697]: Clamd : GOT 'PONG' Apr 24 10:39:26 poweredge MailScanner[30697]: ClamD is running Apr 24 10:39:26 poweredge MailScanner[30697]: SENT : CONTSCAN /var/spool/MailScanner/incoming/30680 Apr 24 10:39:26 poweredge MailScanner[30680]: Completed scanning by clamd Apr 24 10:39:26 poweredge MailScanner[30680]: Spam Checks: Starting Apr 24 10:39:26 poweredge MailScanner[30680]: SpamAssassin cache hit for message 774E9E09EE.A14B0 Apr 24 10:39:26 poweredge MailScanner[30680]: Message 774E9E09EE.A14B0 from 201.234.47.187 (aletajose@informaxinc.com) to tatorz.com is spam, SpamAssassin (cached, score=27.117, required 4, autolearn=spam, BAYES_50 0.80, DRUGS_ERECTILE 1.99, DRUG_ED_ONLINE 0.61, RCVD_IN_BL_SPAMCOP_NET 1.35, RCVD_IN_BRBL_LASTEXT 1.45, RCVD_IN_PBL 3.33, RCVD_IN_PSBL 2.70, RCVD_IN_RP_RNBL 1.31, RCVD_IN_XBL 0.38, RDNS_NONE 0.79, SERGIO_SUBJECT_VIAGRA01 0.00, URIBL_AB_SURBL 4.50, URIBL_BLACK 1.73, URIBL_DBL_SPAM 1.70, URIBL_JP_SURBL 1.25, URIBL_SBL 1.62, URIBL_WS_SURBL 1.61) Apr 24 10:39:26 poweredge MailScanner[30680]: Spam Checks: Found 1 spam messages Apr 24 10:39:26 poweredge MailScanner[30680]: Spam Actions: message 774E9E09EE.A14B0 actions are store Apr 24 10:39:26 poweredge MailScanner[30680]: writing to /var/spool/MailScanner/quarantine/20120424/spam/774E9E09EE.A14B0: 2 [ OK ] Thanks -- Brian ----- Get the latest Fremont, OH Weather http://www.Fremont-OH-Weather.com From stef at aoc-uk.com Tue Apr 24 15:54:13 2012 From: stef at aoc-uk.com (Stef Morrell) Date: Tue Apr 24 15:53:53 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: References: <4F969D8E.9090909@Tatorz.com><201204241258.q3OCw5AB016672@safir.blacknight.ie> Message-ID: <201204241453.q3OErjIw018376@safir.blacknight.ie> Brian, On 24 April 2012 15:43 Mail Lists wrote: > Well debug shows no more to me then I already know.. Not > much. here > is the results. > That looks for all the world like it is running correctly, having processed a batch of (one) messages and terminated properly. Did the message get written to quarantine correctly? -- This email has been scanned by the Alpha Omega Computers MailCrusader for viruses, spam and dangerous content. For more information please visit http://www.aoc-uk.com From bbecken at aafp.org Tue Apr 24 15:53:51 2012 From: bbecken at aafp.org (Brad Beckenhauer) Date: Tue Apr 24 15:54:08 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: <201204241258.q3OCw5AB016672@safir.blacknight.ie> References: <4F969D8E.9090909@Tatorz.com> <201204241258.q3OCw5AB016672@safir.blacknight.ie> Message-ID: <4F96782F02000068000B5193@smtp.aafp.org> Skipped content of type multipart/alternative From jeremy at fluxlabs.net Tue Apr 24 15:55:22 2012 From: jeremy at fluxlabs.net (Jeremy McSpadden) Date: Tue Apr 24 15:55:37 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: <4F96BBE1.2030409@Tatorz.com> References: <4F969D8E.9090909@Tatorz.com> <201204241258.q3OCw5AB016672@safir.blacknight.ie>, <4F96BBE1.2030409@Tatorz.com> Message-ID: That looks like a clean process. What does mailscanner --debug ... Output ? Run it till you get an error. It's more than likely TNEF breaking. -- Jeremy McSpadden On Apr 24, 2012, at 9:47 AM, "Mail Lists" wrote: > 30697]: SENT : CONTSCAN /var/spool/MailScanner/incoming/30680 From lists at tatorz.com Tue Apr 24 16:28:56 2012 From: lists at tatorz.com (Mail Lists) Date: Tue Apr 24 16:29:11 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: <201204241453.q3OErjIw018376@safir.blacknight.ie> References: <4F969D8E.9090909@Tatorz.com><201204241258.q3OCw5AB016672@safir.blacknight.ie> <201204241453.q3OErjIw018376@safir.blacknight.ie> Message-ID: <4F96C6B8.10901@Tatorz.com> On 04/24/2012 10:54 AM, Stef Morrell wrote: > Brian, > > On 24 April 2012 15:43 Mail Lists wrote: >> Well debug shows no more to me then I already know.. Not >> much. here >> is the results. >> > > > That looks for all the world like it is running correctly, having > processed a batch of (one) messages and terminated properly. > > Did the message get written to quarantine correctly? > Stef, You hit the nail on the head. MailScanner was not able to write to the "/var/spool/MailScanner/incoming/quarantine" directory as soon as I changed permissions it let the mail through with no issue. Now the reason the permissions got changed was due to my mailwatch install. It said to change the setting in "/etc/MailScanner/MailScanner.conf" to the following. Quarantine User = root Quarantine Group = apache When i looked the messages were not being written to that dir. Any pointers as to how I should approach this? -- Brian ----- Get the latest Fremont, OH Weather http://www.Fremont-OH-Weather.com From bbecken at aafp.org Tue Apr 24 16:28:58 2012 From: bbecken at aafp.org (Brad Beckenhauer) Date: Tue Apr 24 16:29:48 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: References: <4F969D8E.9090909@Tatorz.com> <201204241258.q3OCw5AB016672@safir.blacknight.ie>, <4F96BBE1.2030409@Tatorz.com> Message-ID: <4F96806A02000068000B51BF@smtp.aafp.org> Skipped content of type multipart/alternative From stef at aoc-uk.com Tue Apr 24 16:38:57 2012 From: stef at aoc-uk.com (Stef Morrell) Date: Tue Apr 24 16:39:06 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: References: <4F969D8E.9090909@Tatorz.com><201204241258.q3OCw5AB016672@safir.blacknight.ie><201204241453.q3OErjIw018376@safir.blacknight.ie> Message-ID: <201204241539.q3OFcvco020220@safir.blacknight.ie> Brian, On 24 April 2012 16:29 Mail Lists wrote: > On 04/24/2012 10:54 AM, Stef Morrell wrote: > > Did the message get written to quarantine correctly? > > > You hit the nail on the head. MailScanner was not able to > write to the "/var/spool/MailScanner/incoming/quarantine" > directory as soon as I changed permissions it let the mail > through with no issue. Now the reason the permissions got > changed was due to my mailwatch install. It said to change > the setting in "/etc/MailScanner/MailScanner.conf" to the following. > > Quarantine User = root > Quarantine Group = apache > > When i looked the messages were not being written to that > dir. Any pointers as to how I should approach this? Those are the settings I am also using with my (old old old!) version of Mailwatch. I think you are using the new one released yesterday (lurking on mailwatch list too), perhaps there's something odd/new in there. I would say though, that if directory owner has write permission and quarantine user is root, it would be very strange if root could then not write the file. What ownership/permissions are/were on the quarantine directories? Stef -- This email has been scanned by the Alpha Omega Computers MailCrusader for viruses, spam and dangerous content. For more information please visit http://www.aoc-uk.com From lists at tatorz.com Tue Apr 24 17:00:46 2012 From: lists at tatorz.com (Mail Lists) Date: Tue Apr 24 17:01:01 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: <201204241539.q3OFcvco020220@safir.blacknight.ie> References: <4F969D8E.9090909@Tatorz.com><201204241258.q3OCw5AB016672@safir.blacknight.ie><201204241453.q3OErjIw018376@safir.blacknight.ie> <201204241539.q3OFcvco020220@safir.blacknight.ie> Message-ID: <4F96CE2E.9050602@Tatorz.com> On 04/24/2012 11:38 AM, Stef Morrell wrote: > > Those are the settings I am also using with my (old old old!) version of > Mailwatch. I think you are using the new one released yesterday (lurking > on mailwatch list too), perhaps there's something odd/new in there. > > I would say though, that if directory owner has write permission and > quarantine user is root, it would be very strange if root could then not > write the file. > > What ownership/permissions are/were on the quarantine directories? > > Stef > Stef, Permissions where root.apache for "/var/spool/MailScanner/quarantine" I have changed it to postfix.apache and that is when the messages got processed and MailScanner walked past with not issues. -- Brian ----- Get the latest Fremont, OH Weather http://www.Fremont-OH-Weather.com From stef at aoc-uk.com Tue Apr 24 17:13:10 2012 From: stef at aoc-uk.com (Stef Morrell) Date: Tue Apr 24 17:12:51 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: References: <4F969D8E.9090909@Tatorz.com><201204241258.q3OCw5AB016672@safir.blacknight.ie><201204241453.q3OErjIw018376@safir.blacknight.ie><201204241539.q3OFcvco020220@safir.blacknight.ie> Message-ID: <201204241612.q3OGChV4021367@safir.blacknight.ie> On 24 April 2012 17:01 Mail Lists wrote: > Permissions where root.apache for > "/var/spool/MailScanner/quarantine" > I have changed it to postfix.apache and that is when the > messages got processed and MailScanner walked past with not issues. That's the same as my setup, with 770 permissions on the directories, so that postfix (for MailScanner) & apache (for MailWatch) can read/write as required to do their jobs So if that's working, i.e. your messages are correctly getting into quarantine and you can access them properly via mailwatch, then I think you're sorted. Stef -- This email has been scanned by the Alpha Omega Computers MailCrusader for viruses, spam and dangerous content. For more information please visit http://www.aoc-uk.com From lists at tatorz.com Tue Apr 24 17:29:32 2012 From: lists at tatorz.com (Mail Lists) Date: Tue Apr 24 17:29:46 2012 Subject: MailScanner keeps dying on my CentOS 6.2 Server In-Reply-To: <201204241612.q3OGChV4021367@safir.blacknight.ie> References: <4F969D8E.9090909@Tatorz.com><201204241258.q3OCw5AB016672@safir.blacknight.ie><201204241453.q3OErjIw018376@safir.blacknight.ie><201204241539.q3OFcvco020220@safir.blacknight.ie> <201204241612.q3OGChV4021367@safir.blacknight.ie> Message-ID: <4F96D4EC.3020506@Tatorz.com> On 04/24/2012 12:13 PM, Stef Morrell wrote: > On 24 April 2012 17:01 Mail Lists wrote: >> Permissions where root.apache for >> "/var/spool/MailScanner/quarantine" >> I have changed it to postfix.apache and that is when the >> messages got processed and MailScanner walked past with not issues. > That's the same as my setup, with 770 permissions on the directories, so > that postfix (for MailScanner)& apache (for MailWatch) can read/write > as required to do their jobs > > So if that's working, i.e. your messages are correctly getting into > quarantine and you can access them properly via mailwatch, then I think > you're sorted. > > Stef > Sure looks that way.. And thank you and everyone else for there help.. -- Brian ----- Get the latest Fremont, OH Weather http://www.Fremont-OH-Weather.com From richard at fastnet.co.uk Wed Apr 25 16:42:41 2012 From: richard at fastnet.co.uk (Richard Mealing) Date: Wed Apr 25 16:42:56 2012 Subject: Clamd permission error In-Reply-To: <4EC6AA39.4040900@cnpapers.com> References: <4EC66F27.9020005@cnpapers.com> <4EC6861A.8030209@cnpapers.com> <4EC6A765.4040903@cnpapers.com> <4EC6AA39.4040900@cnpapers.com> Message-ID: <1251B5423222C446A299CABAA7B46FF409703298@fn-exchange.fastnet.local> Hi Steve, Old thread I know, but did you fix this in the end? I'm having this exact problem now and am thinking of changing the incoming folder to 0640 also. Thanks, Rich From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Steve Campbell Sent: 18 November 2011 18:56 To: MailScanner discussion Subject: Re: Clamd permission error Maybe I see the problem. Should the "incoming" folder itself be modded 640 instead of 600? I'll change it since it shouldn't matter. steve On 11/18/2011 1:43 PM, Steve Campbell wrote: I don't think anything that matters isn't 640 mod and clamav.clamav owned. The individual files created in the incoming directory are owned by clamav as well. An example: incoming]# ls -al total 2912 drwx------ 8 clamav clamav 4096 Nov 18 13:42 . drwxr-xr-x 4 root root 4096 May 18 2004 .. drwxr-x--- 2 clamav clamav 4096 Sep 9 07:02 26632 drwxr-x--- 4 clamav clamav 4096 Nov 18 13:41 5625 drwxr-x--- 4 clamav clamav 4096 Nov 18 13:41 5632 drwxr-x--- 7 clamav clamav 4096 Nov 18 13:41 5654 drwxr-x--- 2 root root 4096 Nov 18 11:14 Locks -rw------- 1 root root 17408 Nov 18 13:41 Processing.db -rw------- 1 root root 2722816 Nov 18 13:42 SpamAssassin.cache.db drwx------ 2 root root 200704 Nov 18 13:41 SpamAssassin-Temp Seems to me to be as it should be or those "Number" folders couldn't be created. steve On 11/18/2011 1:15 PM, Martin Hepworth wrote: Steve Double check nothing has altered any of the permissions further up the tree and the clamd user can access the files Martin On Friday, 18 November 2011, Steve Campbell > wrote: > I'm pretty certain I looked through there. The settings are spread out all across the config file, so I might have missed one (or four). I just don't understand why I'm seeing this now (just one email) without having changed anything. > > Thanks for all the help from everyone. > > steve > > On 11/18/2011 11:07 AM, Martin Hepworth wrote: > > yes you need to look carefully at the mailscanner.conf settings for permssions etc. Theres good documentation in the file about running clamdd and the things you need to setup > -- > Martin Hepworth > Oxford, UK > > > On 18 November 2011 14:53, Milenko Letic > wrote: >> >> this is mod in my MailScanner.conf : >> Incoming Work Permissions = 0644 >> maybe , maybe not help, but wish you luck >> On Fri, Nov 18, 2011 at 3:43 PM, Steve Campbell > wrote: >>> >>> I'm getting the following error in my logs: >>> >>> Clamd::ERROR:: lstat() failed: Permission denied. ERRORClamd::ERROR:: lstat() failed: Permission denied...... >>> >>> Looking back, I found a thread suggesting I should switch to the internal tnef expander, which I am trying now, and to ensure the "incoming" directory is accessible by the clam user (clamav). I've followed the suggestions in the MailScanner.conf file for the situation I am running under. The temp folders under the incoming directory, along with the incoming folder itself, where the winmail.dat is expanded IS owned by clamav. >>> >>> So I'm wondering if the 0640 mod on the folders is the proper mod. Should there be any sticky bits or anything set? >>> >>> Just curious, since this seems to be the first time I've run into this and I've been using MS for years. >>> >>> steve campbell >>> >>> -- >>> MailScanner mailing list >>> mailscanner@lists.mailscanner.info >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner >>> >>> Before posting, read http://wiki.mailscanner.info/posting >>> >>> Support MailScanner development - buy the book off the website! >> >> -- >> MailScanner mailing list >> mailscanner@lists.mailscanner.info >> http://lists.mailscanner.info/mailman/listinfo/mailscanner >> >> Before posting, read http://wiki.mailscanner.info/posting >> >> Support MailScanner development - buy the book off the website! >> > > > > -- -- Martin Hepworth Oxford, UK -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120425/454a20ef/attachment.html From campbell at cnpapers.com Wed Apr 25 17:07:02 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Wed Apr 25 17:06:40 2012 Subject: Clamd permission error In-Reply-To: <1251B5423222C446A299CABAA7B46FF409703298@fn-exchange.fastnet.local> References: <4EC66F27.9020005@cnpapers.com> <4EC6861A.8030209@cnpapers.com> <4EC6A765.4040903@cnpapers.com> <4EC6AA39.4040900@cnpapers.com> <1251B5423222C446A299CABAA7B46FF409703298@fn-exchange.fastnet.local> Message-ID: <4F982126.5030407@cnpapers.com> I'm not sure what fixed it. I have the /var/spool/MailScanner/incoming directory owned by clamav.clamav with 755 as the mod. One thing I had to do was turn off TNEF completely. It didn't matter which one I used, internal or external, there were just some of those winmail.dat files that would blow off MailScanner. It's a risk, I know, but that seemed to help a lot. I see a ton of files in /var/spool/MailScanner/incoming/SpamAssassin-Temp hanging around from older dates, but those don't seem to be hurting anything and I'll just delete them soon. These are partially old tnef* files, but some are named tmp.XXXXXXX. They are all owned by root.root, so there's still a little going on. Sorry to be so flaky on the answer. Wish I could remember what really fixed it. But I'd start with this and make sure your clamd.conf and MailScanner.conf lines up with each other. I seem to recall that the MailWatch instructions for recommendations on owner and group ownership and permissions really had me spinning for a while. so you have to read those carefully if you use MW. It's straight forward, I think, but I had a mess on my hands for a while until I started reading slower. Us old guys can't seem to handle as much as we used to do. If you need more, PM me or whatever and I'll go through all the files. steve On 4/25/2012 11:42 AM, Richard Mealing wrote: > > Hi Steve, > > Old thread I know, but did you fix this in the end? I'm having this > exact problem now and am thinking of changing the incoming folder to > 0640 also. > > Thanks, > > Rich > > *From:*mailscanner-bounces@lists.mailscanner.info > [mailto:mailscanner-bounces@lists.mailscanner.info] *On Behalf Of > *Steve Campbell > *Sent:* 18 November 2011 18:56 > *To:* MailScanner discussion > *Subject:* Re: Clamd permission error > > Maybe I see the problem. > > Should the "incoming" folder itself be modded 640 instead of 600? > > I'll change it since it shouldn't matter. > > steve > > On 11/18/2011 1:43 PM, Steve Campbell wrote: > > I don't think anything that matters isn't 640 mod and clamav.clamav > owned. The individual files created in the incoming directory are > owned by clamav as well. An example: > > incoming]# ls -al > total 2912 > drwx------ 8 clamav clamav 4096 Nov 18 13:42 . > drwxr-xr-x 4 root root 4096 May 18 2004 .. > drwxr-x--- 2 clamav clamav 4096 Sep 9 07:02 26632 > drwxr-x--- 4 clamav clamav 4096 Nov 18 13:41 5625 > drwxr-x--- 4 clamav clamav 4096 Nov 18 13:41 5632 > drwxr-x--- 7 clamav clamav 4096 Nov 18 13:41 5654 > drwxr-x--- 2 root root 4096 Nov 18 11:14 Locks > -rw------- 1 root root 17408 Nov 18 13:41 Processing.db > -rw------- 1 root root 2722816 Nov 18 13:42 > SpamAssassin.cache.db > drwx------ 2 root root 200704 Nov 18 13:41 SpamAssassin-Temp > > Seems to me to be as it should be or those "Number" folders couldn't > be created. > > steve > > > On 11/18/2011 1:15 PM, Martin Hepworth wrote: > > Steve > Double check nothing has altered any of the permissions further up the > tree and the clamd user can access the files > > Martin > > On Friday, 18 November 2011, Steve Campbell > wrote: > > I'm pretty certain I looked through there. The settings are spread > out all across the config file, so I might have missed one (or four). > I just don't understand why I'm seeing this now (just one email) > without having changed anything. > > > > Thanks for all the help from everyone. > > > > steve > > > > On 11/18/2011 11:07 AM, Martin Hepworth wrote: > > > > yes you need to look carefully at the mailscanner.conf settings for > permssions etc. Theres good documentation in the file about running > clamdd and the things you need to setup > > -- > > Martin Hepworth > > Oxford, UK > > > > > > On 18 November 2011 14:53, Milenko Letic > wrote: > >> > >> this is mod in my MailScanner.conf : > >> Incoming Work Permissions = 0644 > >> maybe , maybe not help, but wish you luck > >> On Fri, Nov 18, 2011 at 3:43 PM, Steve Campbell > > wrote: > >>> > >>> I'm getting the following error in my logs: > >>> > >>> Clamd::ERROR:: lstat() failed: Permission denied. > ERRORClamd::ERROR:: lstat() failed: Permission denied...... > >>> > >>> Looking back, I found a thread suggesting I should switch to the > internal tnef expander, which I am trying now, and to ensure the > "incoming" directory is accessible by the clam user (clamav). I've > followed the suggestions in the MailScanner.conf file for the > situation I am running under. The temp folders under the incoming > directory, along with the incoming folder itself, where the > winmail.dat is expanded IS owned by clamav. > >>> > >>> So I'm wondering if the 0640 mod on the folders is the proper mod. > Should there be any sticky bits or anything set? > >>> > >>> Just curious, since this seems to be the first time I've run into > this and I've been using MS for years. > >>> > >>> steve campbell > >>> > >>> -- > >>> MailScanner mailing list > >>> mailscanner@lists.mailscanner.info > > >>> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >>> > >>> Before posting, read http://wiki.mailscanner.info/posting > >>> > >>> Support MailScanner development - buy the book off the website! > >> > >> -- > >> MailScanner mailing list > >> mailscanner@lists.mailscanner.info > > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner > >> > >> Before posting, read http://wiki.mailscanner.info/posting > >> > >> Support MailScanner development - buy the book off the website! > >> > > > > > > > > > > -- > -- > Martin Hepworth > Oxford, UK > > > > > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120425/cdbe9bc4/attachment.html From campbell at cnpapers.com Thu Apr 26 17:03:45 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Apr 26 17:03:02 2012 Subject: files in SpamAssassin-Temp Message-ID: <4F9971E1.9010404@cnpapers.com> I'm wondering how all of this is supposed to be set up for the Incoming stuff. I've got MS running as root. I'm using the clamd virus scanner. I don't think MailWatch comes into play here. I've got the following set: Incoming Work User = clamav Incoming Work Group = clamav Incoming Work Permissions = 0640 All seems to be working well, with the exception of files in /var/spool/MailScanner/incoming/SpamAssassin-Temp, where I get a lot of files named MailScanner.XXXXXX that never go away. They're all 0 length and owned by root.root and permissions 400. The directory itself, var/spool/MailScanner/incoming/SpamAssassin-Temp, is owned by root.clamav, and permission 700. Is my "Incoming Work User" set improperly, or can anyone think of something else I might have misconfigured? Thanks steve campbell From richard at fastnet.co.uk Fri Apr 27 11:52:56 2012 From: richard at fastnet.co.uk (Richard Mealing) Date: Fri Apr 27 11:53:09 2012 Subject: files in SpamAssassin-Temp In-Reply-To: <4F9971E1.9010404@cnpapers.com> References: <4F9971E1.9010404@cnpapers.com> Message-ID: <1251B5423222C446A299CABAA7B46FF409705E1D@fn-exchange.fastnet.local> Hi Steve, I've been trying to figure out what permissions I should have set on my incoming queue dir. I'm running mailscanner as root and I upgraded to the latest version, but since then I am getting errors with tnef and there are lots of tnef files in my queue dir /var/spool/mqueue.in I have this set on my machine - Incoming Queue Dir = /var/spool/mqueue.in Outgoing Queue Dir = /var/spool/mqueue Incoming Work Dir = /tmpfs Incoming Work User = clamav Incoming Work Group = clamav Incoming Work Permissions = 0640 Since upgrading to version MailScanner-4.84.5_2 I'm seeing all of this - /var/spool/mqueue.in]# ls -l drwx------ 2 root wheel 512 Apr 26 13:17 tnefz8dqx2 drwx------ 2 root wheel 512 Apr 26 11:36 tnefzAiQ6p drwx------ 2 root wheel 512 Apr 27 09:51 tnefzEgotO drwx------ 2 root wheel 512 Apr 25 15:36 tnefzJmcCy drwx------ 2 root wheel 512 Apr 27 08:57 tnefzQN8Zj drwx------ 2 root wheel 512 Apr 27 09:43 tnefzbhK9B drwx------ 2 root wheel 512 Apr 25 15:09 tnefzetMGb drwx------ 2 root wheel 512 Apr 27 08:55 tnefzlNtXu drwx------ 2 root wheel 512 Apr 26 06:21 tnefzmadvg drwx------ 2 root wheel 512 Apr 25 16:25 tnefzuKuOS drwx------ 2 root wheel 512 Apr 26 13:19 tnefzv4NmM drwx------ 2 root wheel 512 Apr 26 14:19 tnefzwrjOI /var/spool]# ls -l drwxr-xr-x 676 root wheel 121344 Apr 27 11:47 mqueue.in Not sure what's happening at the moment but I'm still playing with the permissions. I just keep seeing Clamd::ERROR:: lstat() failed: Permission denied. ERROR :: ./q3RAbE8r059638/tnefZqlqTE etc etc. I've always used the tnef expander program with maxsize=100000000 I think the only difference between us if you don't use tmpfs.? Rich -----Original Message----- From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Steve Campbell Sent: 26 April 2012 17:04 To: mailscanner@lists.mailscanner.info Subject: files in SpamAssassin-Temp I'm wondering how all of this is supposed to be set up for the Incoming stuff. I've got MS running as root. I'm using the clamd virus scanner. I don't think MailWatch comes into play here. I've got the following set: Incoming Work User = clamav Incoming Work Group = clamav Incoming Work Permissions = 0640 All seems to be working well, with the exception of files in /var/spool/MailScanner/incoming/SpamAssassin-Temp, where I get a lot of files named MailScanner.XXXXXX that never go away. They're all 0 length and owned by root.root and permissions 400. The directory itself, var/spool/MailScanner/incoming/SpamAssassin-Temp, is owned by root.clamav, and permission 700. Is my "Incoming Work User" set improperly, or can anyone think of something else I might have misconfigured? Thanks steve campbell -- MailScanner mailing list mailscanner@lists.mailscanner.info http://lists.mailscanner.info/mailman/listinfo/mailscanner Before posting, read http://wiki.mailscanner.info/posting Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Fri Apr 27 13:38:50 2012 From: campbell at cnpapers.com (Steve Campbell) Date: Fri Apr 27 13:38:50 2012 Subject: files in SpamAssassin-Temp In-Reply-To: <1251B5423222C446A299CABAA7B46FF409705E1D@fn-exchange.fastnet.local> References: <4F9971E1.9010404@cnpapers.com> <1251B5423222C446A299CABAA7B46FF409705E1D@fn-exchange.fastnet.local> Message-ID: <4F9A935A.3040204@cnpapers.com> Richard, I eventually turned off TNEF expansion. Neither way seemed to work consistently. I saw those type of files you mentioned in my /var/spool/MailScanner/incoming/Spamassassin-Temp directory until I turned off TNEF. I'm still not sure why those other files named MailScanner.xXXxxx are being left behind. Seems they are purely MS/SA related (not TNEF) steve On 4/27/2012 6:52 AM, Richard Mealing wrote: > Hi Steve, > > I've been trying to figure out what permissions I should have set on my incoming queue dir. I'm running mailscanner as root and I upgraded to the latest version, but since then I am getting errors with tnef and there are lots of tnef files in my queue dir /var/spool/mqueue.in > > I have this set on my machine - > > Incoming Queue Dir = /var/spool/mqueue.in > Outgoing Queue Dir = /var/spool/mqueue > Incoming Work Dir = /tmpfs > Incoming Work User = clamav > Incoming Work Group = clamav > Incoming Work Permissions = 0640 > > Since upgrading to version MailScanner-4.84.5_2 I'm seeing all of this - > > /var/spool/mqueue.in]# ls -l > drwx------ 2 root wheel 512 Apr 26 13:17 tnefz8dqx2 > drwx------ 2 root wheel 512 Apr 26 11:36 tnefzAiQ6p > drwx------ 2 root wheel 512 Apr 27 09:51 tnefzEgotO > drwx------ 2 root wheel 512 Apr 25 15:36 tnefzJmcCy > drwx------ 2 root wheel 512 Apr 27 08:57 tnefzQN8Zj > drwx------ 2 root wheel 512 Apr 27 09:43 tnefzbhK9B > drwx------ 2 root wheel 512 Apr 25 15:09 tnefzetMGb > drwx------ 2 root wheel 512 Apr 27 08:55 tnefzlNtXu > drwx------ 2 root wheel 512 Apr 26 06:21 tnefzmadvg > drwx------ 2 root wheel 512 Apr 25 16:25 tnefzuKuOS > drwx------ 2 root wheel 512 Apr 26 13:19 tnefzv4NmM > drwx------ 2 root wheel 512 Apr 26 14:19 tnefzwrjOI > > > /var/spool]# ls -l > drwxr-xr-x 676 root wheel 121344 Apr 27 11:47 mqueue.in > > > Not sure what's happening at the moment but I'm still playing with the permissions. I just keep seeing Clamd::ERROR:: lstat() failed: Permission denied. ERROR :: ./q3RAbE8r059638/tnefZqlqTE etc etc. > > > I've always used the tnef expander program with maxsize=100000000 > > I think the only difference between us if you don't use tmpfs.? > > Rich > > -----Original Message----- > From: mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] On Behalf Of Steve Campbell > Sent: 26 April 2012 17:04 > To: mailscanner@lists.mailscanner.info > Subject: files in SpamAssassin-Temp > > I'm wondering how all of this is supposed to be set up for the Incoming stuff. > > I've got MS running as root. I'm using the clamd virus scanner. I don't think MailWatch comes into play here. I've got the following set: > > Incoming Work User = clamav > Incoming Work Group = clamav > Incoming Work Permissions = 0640 > > All seems to be working well, with the exception of files in /var/spool/MailScanner/incoming/SpamAssassin-Temp, where I get a lot of files named MailScanner.XXXXXX that never go away. They're all 0 length and owned by root.root and permissions 400. > > The directory itself, var/spool/MailScanner/incoming/SpamAssassin-Temp, > is owned by root.clamav, and permission 700. > > Is my "Incoming Work User" set improperly, or can anyone think of something else I might have misconfigured? > > Thanks > > steve campbell > > > > > > > -- > MailScanner mailing list > mailscanner@lists.mailscanner.info > http://lists.mailscanner.info/mailman/listinfo/mailscanner > > Before posting, read http://wiki.mailscanner.info/posting > > Support MailScanner development - buy the book off the website! > >