Any thing new on missing updates on blacklist in mailscanner / fix or workaround?

Wed May 22 12:55:00 IST 2013

Hello ppl

Is there a work around - we are still not getting updates for scamnailer and Mailscanner blacklist

Log:

ok Checking that /var/cache/ScamNailer/cache/2013-164.6 exists... ok I am working with: Current: 2013-164 - 6 and Status: 2013-164 - 6 No base update required

And mailscanner still reads

:

Read 3966 hostnames from the phishing blacklists

Any input is appreciated, Thank you

/Jesper

-----Oprindelig meddelelse-----
Fra: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] På vegne af mailscanner-request at lists.mailscanner.info
Sendt: 22. maj 2013 13:00
Til: mailscanner at lists.mailscanner.info
Emne: MailScanner Digest, Vol 89, Issue 20

Send MailScanner mailing list submissions to
	mailscanner at lists.mailscanner.info

To subscribe or unsubscribe via the World Wide Web, visit
	http://lists.mailscanner.info/mailman/listinfo/mailscanner
or, via email, send a message with subject or body 'help' to
	mailscanner-request at lists.mailscanner.info

You can reach the person managing the list at
	mailscanner-owner at lists.mailscanner.info

When replying, please edit your Subject line so it is more specific than "Re: Contents of MailScanner digest..."

Today's Topics:

   1. Re: permissions and ownership of /var/spool/incoming
      (Robert Lopez)
   2. Scan Messages = %rules-dir%/scan.messages.rules (Robert Lopez)
   3. Re: Scan Messages = %rules-dir%/scan.messages.rules
      (Martin Hepworth)

----------------------------------------------------------------------

Message: 1
Date: Tue, 21 May 2013 17:17:18 -0600
From: Robert Lopez <rlopezcnm at gmail.com>
Subject: Re: permissions and ownership of /var/spool/incoming
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID:
	<CAAJHbAqfXAgKN2CF7HZMLafrKCWRCgkFAn16hvuXPS1BCrD+GQ at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

On Mon, May 20, 2013 at 10:11 AM, Kevin Miller <Kevin_Miller at ci.juneau.ak.us> wrote:
> On both my SLES and CentOS boxes running MailScanner an clamAV the user is clamav not clam.  Double check the name of the account that clamav is actually running as.  It can vary from distribution to distribution...
>
>  ...Kevin
> --
> Kevin Miller
> Network/email Administrator, CBJ MIS Dept.
> 155 South Seward Street
> Juneau, Alaska 99801
> Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 
> 307357 -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info 
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Dan 
> Carl
> Sent: Saturday, May 18, 2013 7:24 AM
> To: MailScanner discussion
> Subject: permissions and ownership of /var/spool/incoming
>
> Hi all,
> I never have any issues with Mailscanner the thing just works and works well.
> But when it comes to new installs that when you'll see me post here.
> I'm running a shiny new CentOS 6.4 box with postfix.
> I've tried everything but still getting error below when running MailScanner --lint.
> Could not open file >/var/spool/MailScanner/incoming/2614/1.header:
> Permission denied
> Cannot create + lock headers file
> /var/spool/MailScanner/incoming/2614/1.header, Permission denied at /usr/lib/MailScanner/MailScanner/Message.pm line 523 I set the permissions and ownership to:
> chown -R postfix.clam *
> chmod -R 750 *
> But Mailscanner sets the permissions to clam.root Thanks in advance 
> Dan
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!

I am not at all certain it is related, but also pay attention to the MailScanner.conf (or MailScanner/conf.d/your-conf-file) for the values of Incoming Work Group and Incoming Work Permissions.

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

------------------------------

Message: 2
Date: Tue, 21 May 2013 19:18:11 -0600
From: Robert Lopez <rlopezcnm at gmail.com>
Subject: Scan Messages = %rules-dir%/scan.messages.rules
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID:
	<CAAJHbAonjeXxrgU+bwOkQUZdc+-qqjioCOcOLjp7tKHAJCC7xA at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

wrt "Scan Messages = %rules-dir%/scan.messages.rules"

Three questions:

1) Does MailScanner do a case sensitive match when scan.messages.rules file is used?

2) Which "From:" does scan.messages.rules use (Envelope or Email Body)?

3) Does MailScanner directly implement the match and action or is this passed to SpamAssassin to do the match and action?

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

------------------------------

Message: 3
Date: Wed, 22 May 2013 09:20:51 +0100
From: Martin Hepworth <maxsec at gmail.com>
Subject: Re: Scan Messages = %rules-dir%/scan.messages.rules
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID:
	<CAGDKorJK_NGwpGVKJEeLYzikdBoRCWaYxu1TJ_7d8JA8CaCHbg at mail.gmail.com>
Content-Type: text/plain; charset="iso-8859-1"

1) nope, email addresses are not case sensitive.
2) Envelope, MS always uses the Envelope-from in from parsing.
3) this is the 'big knob' that tells whether MailScanner scans the email or not. Way before it's passed to SA, anti-virus or checked by mailScanner again RBLS (independently of SA). etc. Be very careful with setting as it's basically sending email through with zero scanning. Might want to look at the the "Is definitely Not spam" setting. Normally this is only used for trusted ip-addresses not email 'from' addresses.

hope that helps

--
Martin Hepworth, CISSP
Oxford, UK

On 22 May 2013 02:18, Robert Lopez <rlopezcnm at gmail.com> wrote:

> wrt "Scan Messages = %rules-dir%/scan.messages.rules"
>
> Three questions:
>
> 1) Does MailScanner do a case sensitive match when
> scan.messages.rules file is used?
>
> 2) Which "From:" does scan.messages.rules use (Envelope or Email Body)?
>
> 3) Does MailScanner directly implement the match and action or is this
> passed to SpamAssassin to do the match and action?
>
> --
> Robert Lopez
> Unix Systems Administrator
> Central New Mexico Community College (CNM)
> 525 Buena Vista SE
> Albuquerque, New Mexico 87106
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130522/53090ad8/attachment-0001.html 

------------------------------

-- 
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read the Wiki (http://wiki.mailscanner.info/).

Support MailScanner development - buy the book off the website! 

End of MailScanner Digest, Vol 89, Issue 20
*******************************************

-- 
Denne meddelelse er blevet skannet for virus og farligt indhold
af MailScanner, og er fundet ufarlig.