MailScanner failing on CentOS 6.

[Phil Hale]

I'm successfully running MailScanner on CentOS 6 with SELinux turned on 
without issue.  The only change I made is that I use Sendmail MTA 
enstead of Postfix.  I've created some SELinux modules that are needed 
to allow the configuration to work correctly.

On 04/10/2012 10:31 AM, Sampson, Aaron wrote:
>
> What does your MailScanner --lint show you?
>
> *From:*mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] *On Behalf Of 
> *Rabie Van der Merwe
> *Sent:* Tuesday, April 10, 2012 10:18 AM
> *To:* MailScanner discussion
> *Subject:* RE: MailScanner failing on CentOS 6.
>
> It seems to choke after while extracting the content of the emails for
> scanning:
> [root at quazar MailScanner]# cd incoming/
> [root at quazar incoming]# cd 10995/
> [root at quazar 10995]# ls -la
> total 56
> drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 .
> drwxr-xr-x 5 postfix postfix 4096 Apr 10 17:10 ..
> drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 26E3B2913.A3919
> -rw-r----- 1 postfix postfix 586 Apr 10 17:10 26E3B2913.A3919.header
> drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 47F2928D6.AC41A
> -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 47F2928D6.AC41A.header
> drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6B76B28D8.ADEAE
> -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 6B76B28D8.ADEAE.header
> drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 6F02C2909.A8164
> -rw-r----- 1 postfix postfix 349 Apr 10 17:10 6F02C2909.A8164.header
> drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 8886328D5.AC7BD
> -rw-r----- 1 postfix postfix 2072 Apr 10 17:10 8886328D5.AC7BD.header
> drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 C393928D7.A884D
> -rw-r----- 1 postfix postfix 2101 Apr 10 17:10 C393928D7.A884D.header
> [root at quazar 10995]# cd 26E3B2913.A3919
> [root at quazar 26E3B2913.A3919]# ls -la
> total 8
> drwxr-x--- 2 postfix postfix 4096 Apr 10 17:10 .
> drwxr-x--- 8 postfix postfix 4096 Apr 10 17:10 ..
>
> It doesn't (to me at least) doesn't seem to get past the header.
>
> I have checked SELINUX is disabled.
>
> Regards
> Rabie
>
>
> From: mailscanner-bounces at lists.mailscanner.info 
> <mailto:mailscanner-bounces at lists.mailscanner.info>
> [mailto:mailscanner-bounces at lists.mailscanner.info] 
> <mailto:[mailto:mailscanner-bounces at lists.mailscanner.info]> On Behalf 
> Of Rabie
> Van der Merwe
> Sent: 10 April 2012 16:50
> To: mailscanner at lists.mailscanner.info 
> <mailto:mailscanner at lists.mailscanner.info>
> Subject: MailScanner failing on CentOS 6.
>
> Hi,
>
> I am trying to diagnose why MailScanner is dying after upgrading from
> CentOS/RHEL5 to 6.
> I am using Postfix, ClamD and MailWatch, so far I seem to have it down
> to something to
> do with the file permissions and setting the working group to clamav, if
> I disable scanning
> ie, no AV or Spam checking it passes email.
>
> Even if I change the output in MailScanner.conf to debug I dont get
> much, any thoughts where to from here?
>
> Regards
> Rabie
>
> ---snip---
> Apr 10 15:17:03 quazar MailScanner[7022]: MailScanner E-Mail Virus
> Scanner version 4.84.5 starting...
> Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file
> /etc/MailScanner/MailScanner.conf
> Apr 10 15:17:03 quazar MailScanner[7022]: Reading configuration file
> /etc/MailScanner/conf.d/README
> Apr 10 15:17:03 quazar MailScanner[7022]: Read 869 hostnames from the
> phishing whitelist
> Apr 10 15:17:03 quazar MailScanner[7022]: Read 5470 hostnames from the
> phishing blacklists
> Apr 10 15:17:03 quazar MailScanner[7022]: Config: calling custom init
> function MailWatchLogging
> Apr 10 15:17:03 quazar MailScanner[7022]: Started SQL Logging child
> Apr 10 15:17:03 quazar MailScanner[7022]: Using SpamAssassin results
> cache
> Apr 10 15:17:03 quazar MailScanner[7022]: Connected to SpamAssassin
> cache database
> Apr 10 15:17:03 quazar MailScanner[7022]: Enabling SpamAssassin
> auto-whitelist functionality...
> Apr 10 15:17:05 quazar MailScanner[7022]: Connected to Processing
> Attempts Database
> Apr 10 15:17:05 quazar MailScanner[7022]: Found 1 messages in the
> Processing Attempts Database
> Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees Config LockType
> = flock
> Apr 10 15:17:05 quazar MailScanner[7022]: lock.pl sees have_module = 0
> Apr 10 15:17:05 quazar MailScanner[7022]: Using locktype = flock
> Apr 10 15:17:35 quazar MailScanner[7022]: Making attempt 3 at processing
> message 2D55A28CE.AD4E6
> Apr 10 15:17:35 quazar MailScanner[7022]: New Batch: Scanning 1
> messages, 6458 bytes
> Apr 10 15:17:35 quazar MailScanner[7022]: Created attachment dirs for 1
> messages
> Apr 10 15:17:36 quazar MailScanner[7022]: Completed checking by
> /usr/bin/file
> Apr 10 15:17:36 quazar MailScanner[7022]: Virus and Content Scanning:
> Starting
> Apr 10 15:17:36 quazar MailScanner[7022]: Commencing scanning by
> clamd...
> Apr 10 15:17:36 quazar MailScanner[7041]: Debug Mode Is On
> Apr 10 15:17:36 quazar MailScanner[7041]: Use Threads : NO
> Apr 10 15:17:36 quazar MailScanner[7041]: Socket :
> /var/run/clamav/clamd.socket
> Apr 10 15:17:36 quazar MailScanner[7041]: IP : Using Sockets
> Apr 10 15:17:36 quazar MailScanner[7041]: Lock File : NOT USED
> Apr 10 15:17:36 quazar MailScanner[7041]: Time Out : 300
> Apr 10 15:17:36 quazar MailScanner[7041]: Scan Dir :
> /var/spool/MailScanner/incoming/7022
> Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : Sending PING
> Apr 10 15:17:36 quazar MailScanner[7041]: Clamd : GOT 'PONG'
> Apr 10 15:17:36 quazar MailScanner[7041]: ClamD is running
> Apr 10 15:17:36 quazar MailScanner[7041]: SENT : CONTSCAN
> /var/spool/MailScanner/incoming/7022
> Apr 10 15:17:36 quazar MailScanner[7022]: Completed scanning by clamd
> Apr 10 15:17:36 quazar MailScanner[7022]: RBL Checks: returned 0
> Apr 10 15:17:36 quazar MailScanner[7022]: SpamAssassin cache hit for
> message 2D55A28CE.AD4E6
> Apr 10 15:19:55 quazar MailScanner[7194]: MailScanner E-Mail Virus
> Scanner version 4.84.5 starting...
> ---snip---
>
>
> ---snip---
> Apr 10 16:39:57 quazar MailScanner[9060]: MailScanner E-Mail Virus
> Scanner version 4.84.5 starting...
> Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file
> /etc/MailScanner/MailScanner.conf
> Apr 10 16:39:57 quazar MailScanner[9060]: Reading configuration file
> /etc/MailScanner/conf.d/README
> Apr 10 16:39:57 quazar MailScanner[9060]: Read 869 hostnames from the
> phishing whitelist
> Apr 10 16:39:57 quazar MailScanner[9060]: Read 5470 hostnames from the
> phishing blacklists
> Apr 10 16:39:57 quazar MailScanner[9060]: Config: calling custom init
> function MailWatchLogging
> Apr 10 16:39:57 quazar MailScanner[9060]: Started SQL Logging child
> Apr 10 16:39:57 quazar MailScanner[9060]: Using SpamAssassin results
> cache
> Apr 10 16:39:57 quazar MailScanner[9060]: Connected to SpamAssassin
> cache database
> Apr 10 16:39:57 quazar MailScanner[9060]: Enabling SpamAssassin
> auto-whitelist functionality...
> Apr 10 16:40:04 quazar MailScanner[9060]: Connected to Processing
> Attempts Database
> Apr 10 16:40:04 quazar MailScanner[9060]: Found 1 messages in the
> Processing Attempts Database
> Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees Config LockType
> = flock
> Apr 10 16:40:04 quazar MailScanner[9060]: lock.pl sees have_module = 0
> Apr 10 16:40:04 quazar MailScanner[9060]: Using locktype = flock
> Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Found 3 messages
> waiting
> Apr 10 16:40:04 quazar MailScanner[9060]: New Batch: Scanning 2
> messages, 202224 bytes
> Apr 10 16:40:04 quazar MailScanner[9060]: Created attachment dirs for 2
> messages
> ---snip---
> **********************************************************************
> ---------
> NOTICE
> ---------
> This message (including attachments) contains privileged and
> confidential information intended only for the person or entity to which
> it is addressed.
> Any review, retransmission, dissemination, copy or other use of, or
> taking of any action in reliance upon this information by persons or
> entities other than the intended recipient, is prohibited.
> If you received this message in error, please notify the sender
> immediately by e-mail, facsimile or telephone and thereafter delete the
> material from any computer.
> Metropolitan Health, its subsidiaries or associates, does not accept
> liability for any personal views expressed in this message.
> Metropolitan Health
> PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535
> www.mhg.co.za <http://www.mhg.co.za>
> **********************************************************************
>
> **********************************************************************
> ---------
> NOTICE
> ---------
>
> This message (including attachments) contains privileged and 
> confidential information intended only for the person or entity to 
> which it is addressed.
>
> Any review, retransmission, dissemination, copy or other use of, or 
> taking of any action in reliance upon this information by persons or 
> entities other than the intended recipient, is prohibited.
>
> If you received this message in error, please notify the sender 
> immediately by e-mail, facsimile or telephone and thereafter delete 
> the material from any computer.
>
> Metropolitan Health, its subsidiaries or associates, does not accept 
> liability for any personal views expressed in this message.
>
> *Metropolitan Health**
> *PO Box 4313 Cape Town 8000 Tel: 021 480 4511 Fax: 021 480 4535 
> www.mhg.co.za <http://www.mhg.co.za/>
>
> **********************************************************************
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20120410/87a6ed2a/attachment.html