Upgrade Wrecks MailScanner

Wed Oct 12 07:03:39 UTC 2016

I am not sure if MailWatch has updated their code for MailScanner v5.
I would imagine they have or already started the process. For
MailWatch logging, you need to get the MailWatch.pm, put it in
/usr/share/MailScanner/perl/custom and them add this to a custom file
in /conf.d/

Always Looked Up Last = &MailWatchLogging
Detailed Spam Report = yes
Quarantine Whole Message = yes
Quarantine Whole Messages As Queue Files = no
Include Scores In SpamAssassin Report = yes
Quarantine User = root
Quarantine Group = apache (this should be the same group as your web server)
Quarantine Permissions = 0660

After looking, I see they have updated their locations. The guide is
here: http://docs.mailwatch.org/doc/installing.html

-
Jerry Benton
www.mailborder.com
+1 - 844-436-6245

-----Original Message-----
From: Paul Scott <sales at edenusa.com>
Reply: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Date: October 12, 2016 at 2:45:41 AM
To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Subject:  RE: Upgrade Wrecks MailScanner

> Hello Jerry,
>
> Thank you for your email. I don't think I am quite as sophisticated an Administrator as
> you are, so unfortunately, I don't understand what you mean.
>
> I have used MailScanner for more than 10-years, and got very used to where everything
> was, and how to use it, such as the "required_hits" file under the "rules" directory.
> As I am an extremely busy programmer working on a massive project outside of this IT work,
> I am now suffering from the old "I should have never updated", and wish I could return to
> v4.85. I see that MailScanner is no longer a script, but is a service, so it is much faster,
> and that is great, but for me, it is now allowing tons of SPAM to get through. This does not
> bode well with my colleagues, who think I am an idiot for upgrading.
>
> I know some folks are or will take offense, but I don't understand why the install.sh script
> did not take care of these path changes, and why didn't it allow an existing MailWatch
> installation to continue to work as before (the functions.php and mailq.php are erroring
> out, so now MailWatch no longer works). I cannot find this README file which contains
> all of the path changes. I cannot find any instructions on how to get MailWatch working
> properly again.
>
> Naturally, any help is most appreciated, as I am at this point quite frustrated and at
> a loss as to why this happened.
>
> Thank you, Paul Scott
>
> -----Original Message-----
> From: MailScanner [mailto:mailscanner-bounces+sales=edenusa.com at lists.mailscanner.info]
> On Behalf Of Jerry Benton
> Sent: Tuesday, October 11, 2016 11:20 PM
> To: MailScanner Discussion
> Subject: RE: Upgrade Wrecks MailScanner
>
> Paul,
>
> Adjust your rules by adding specific items to a file in /conf.d/
> directory. You do not have to add every configuration item. Just the
> ones you want to change. You more than likely need to update your
> Required Spam Assassin Score, etc.
>
>
> -
> Jerry Benton
> www.mailborder.com
> +1 - 844-436-6245
>
>
> -----Original Message-----
> From: Paul Scott
> Reply: MailScanner Discussion
> Date: October 12, 2016 at 1:49:59 AM
> To: MailScanner Discussion
> Subject: RE: Upgrade Wrecks MailScanner
>
> > Hello Jerry,
> >
> > Yes, I saw that too...good catch! I moved the BACKUP directory and left the README and
> > restarted.
> >
> > I still do not get any mailscanner messages like I used to, in the /var/log/maillog file,
> > like this:
> >
> > Sep 18 04:09:19 mail MailScanner[4260]: New Batch: Scanning 1 messages, 4729 bytes
> > Sep 18 04:09:19 mail MailScanner[4260]: Virus and Content Scanning: Starting
> > Sep 18 04:09:58 mail MailScanner[4260]: MCP Checks: Starting
> > Sep 18 04:09:58 mail MailScanner[4260]: Expired 1 records from the SpamAssassin cache
> > Sep 18 04:09:58 mail MailScanner[4260]: Whitelist refresh time reached
> > Sep 18 04:09:58 mail MailScanner[4260]: Starting up SQL Whitelist
> > Sep 18 04:09:58 mail MailScanner[4260]: Read 17 whitelist entries
> > Sep 18 04:09:58 mail MailScanner[4260]: Blacklist refresh time reached
> > Sep 18 04:09:58 mail MailScanner[4260]: Starting up SQL Blacklist
> > Sep 18 04:09:58 mail MailScanner[4260]: Read 51 blacklist entries
> > Sep 18 04:10:07 mail MailScanner[4260]: Spam Checks: Found 1 spam messages
> > Sep 18 04:10:07 mail MailScanner[4260]: Deleted 1 messages from processing-database
> > Sep 18 04:10:07 mail MailScanner[4260]: Logging message u8IB9DGY006316 to SQL
> > Sep 18 04:10:07 mail MailScanner[4260]: Config: calling custom end function SQLBlacklist
> > Sep 18 04:10:07 mail MailScanner[4260]: Closing down by-domain spam blacklist
> > Sep 18 04:10:07 mail MailScanner[4260]: Config: calling custom end function MailWatchLogging
> > Sep 18 04:10:07 mail MailScanner[4260]: Config: calling custom end function SQLWhitelist
> > Sep 18 04:10:07 mail MailScanner[4260]: Closing down by-domain spam whitelist
> > Sep 18 04:10:07 mail MailScanner[4260]: MailScanner child dying of old age
> > Sep 18 04:10:07 mail MailScanner[6266]: u8IB9DGY006316: Logged to MailWatch SQL
> >
> > That is, I don't know if MailScanner is still performing the job that it used to, and my
> > users are all reporting a flood of SPAM.
> >
> >
> >
> > -----Original Message-----
> > From: MailScanner [mailto:mailscanner-bounces+sales=edenusa.com at lists.mailscanner.info]
> > On Behalf Of Jerry Benton
> > Sent: Tuesday, October 11, 2016 9:51 PM
> > To: MailScanner Discussion
> > Subject: RE: Upgrade Wrecks MailScanner
> >
> > Or move it rather.
> >
> >
> > -
> > Jerry Benton
> > www.mailborder.com
> > +1 - 844-436-6245
> >
> >
> > -----Original Message-----
> > From: Jerry Benton
> > Reply: Jerry Benton
> > Date: October 12, 2016 at 12:50:17 AM
> > To: MailScanner Discussion
> > Subject: RE: Upgrade Wrecks MailScanner
> >
> > > Remove that BACKUP file from the /conf.d/ directory. It is still being read.
> > >
> > >
> > > -
> > > Jerry Benton
> > > www.mailborder.com
> > > +1 - 844-436-6245
> > >
> > >
> > > -----Original Message-----
> > > From: Paul Scott
> > > Reply: MailScanner Discussion
> > > Date: October 12, 2016 at 12:06:05 AM
> > > To: MailScanner Discussion
> > > Subject: RE: Upgrade Wrecks MailScanner
> > >
> > > > Hello Mark,
> > > >
> > > > There are two files in the /etc/MailScanner/conf.d directory, as follows:
> > > >
> > > > MyMailScannerConfig.conf
> > > >
> > > > -and-
> > > >
> > > > README
> > > >
> > > > The MyMailScannerConfig.conf file appears to be a copy of my OLD
> > > > MailScanner.conf
> > > file.
> > > > So that explains partially what is going on, if indeed, the ENTIRE
> > > > new MailScanner.conf is being wiped out by this "include" file. So I
> > > > renamed that file, and now, lo-and-behold, the --lint test works much better, but
> > still has some errors:
> > > >
> > > > [root at mail conf.d]# MailScanner --lint Trying to setlogsock(unix)
> > > >
> > > > Reading configuration file /etc/MailScanner/MailScanner.conf Reading
> > > > configuration file /etc/MailScanner/conf.d/BACKUP Reading
> > > > configuration file /etc/MailScanner/conf.d/README Read 501 hostnames
> > > > from the phishing whitelist Read 19129 hostnames from the phishing
> > > > blacklists
> > > > Config: calling custom init function SQLBlacklist
> > > > Config: calling custom init function MailWatchLogging
> > > > Config: calling custom init function SQLWhitelist
> > > >
> > > > Checking version numbers...
> > > > Version number in MailScanner.conf (5.0.3) is correct.
> > > >
> > > > Your envelope_sender_header in spamassassin.conf is correct.
> > > >
> > > > Checking for SpamAssassin errors (if you use it)...
> > > > Using SpamAssassin results cache
> > > > Connected to SpamAssassin cache database
> > > > dcc: dccifd -> check skipped: dcc: failed to connect to a socket
> > > > /var/dcc/dccifd: Connection refused SpamAssassin reported no errors.
> > > > Connected to Processing Attempts Database Created Processing
> > > > Attempts Database successfully There are 0 messages in the
> > > > Processing Attempts Database Using locktype = flock MailScanner.conf
> > > > says "Virus Scanners = clamav avg"
> > > > mktemp: invalid option -- -
> > > > Usage: mktemp [-V] | [-dqtu] [-p prefix] [template] Found these
> > > > virus scanners installed: clamavmodule
> > > > ====================================================================
> > > > ======= Virus and Content Scanning: Starting
> > > > mktemp: invalid option -- -
> > > > Usage: mktemp [-V] | [-dqtu] [-p prefix] [template]
> > > > ERROR: Option --tempdir requires a non-empty string argument
> > > > ERROR: Can't parse command line options
> > > > ====================================================================
> > > > =======
> > > >
> > > > If any of your virus scanners (clamavmodule) are not listed there,
> > > > you should check that they are installed correctly and that
> > > > MailScanner is finding them correctly via its virus.scanners.conf.
> > > > Config: calling custom end function SQLBlacklist
> > > > Config: calling custom end function MailWatchLogging
> > > > Config: calling custom end function SQLWhitelist
> > > >
> > > > So it looks better now, but I don't see the normal MailScanner
> > > > messages in the maillog.log, like I used to. All of the startup
> > > > messages appear, for each child, but after that, all I see are
> > > > standard sendmail and popper messages in the log. No MailScanner messages, like
> these:
> > > >
> > > > Sep 11 05:36:17 mail MailScanner[3147]: New Batch: Scanning 1
> > > > messages, 6510 bytes Sep 11 05:36:17 mail MailScanner[3147]: Virus
> > > > and Content Scanning: Starting Sep 11 05:36:57 mail
> > > > MailScanner[3147]: MCP Checks: Starting Sep 11 05:36:57 mail
> > > > MailScanner[3147]: Expired 1 records from the SpamAssassin cache Sep
> > > > 11 05:37:02 mail MailScanner[3147]: Spam Checks: Found 1 spam
> > > > messages Sep 11 05:37:02 mail MailScanner[3147]: Deleted 1 messages
> > > > from processing-database Sep 11 05:37:02 mail MailScanner[3147]:
> > > > Logging message u8BCaA1A003322 to SQL Sep 11 05:37:02 mail
> > > > MailScanner[3240]: u8BCaA1A003322: Logged to MailWatch SQL Sep 11
> > > > 05:40:07 mail MailScanner[3163]: New Batch: Scanning 1 messages,
> > > > 8208 bytes Sep 11 05:40:07 mail MailScanner[3163]: Virus and Content
> > > > Scanning: Starting Sep 11 05:40:47 mail MailScanner[3163]: MCP
> > > > Checks: Starting Sep 11 05:40:47 mail MailScanner[3163]: Whitelist
> > > > refresh time reached Sep 11 05:40:47 mail MailScanner[3163]:
> > > > Starting up SQL Whitelist Sep 11 05:40:47 mail MailScanner[3163]:
> > > > Read 17 whitelist entries Sep 11 05:40:47 mail MailScanner[3163]:
> > > > Blacklist refresh time reached Sep 11 05:40:47 mail
> > > > MailScanner[3163]: Starting up SQL Blacklist Sep 11 05:40:47 mail
> > > > MailScanner[3163]: Read 51 blacklist entries Sep 11 05:40:53 mail
> > > > MailScanner[3163]: Spam Checks: Found 1 spam messages Sep 11
> > > > 05:40:53 mail MailScanner[3163]: Deleted 1 messages from
> > > > processing-database
> > > >
> > > > Not sure why this is. Any ideas?
> > > >
> > > > Thank you again! Paul
> > > >
> > > > -----Original Message-----
> > > > From: MailScanner
> > > > [mailto:mailscanner-bounces+sales=edenusa.com at lists.mailscanner.info
> > > > ]
> > > > On Behalf Of Mark Sapiro
> > > > Sent: Tuesday, October 11, 2016 8:46 PM
> > > > To: mailscanner at lists.mailscanner.info
> > > > Subject: Re: Upgrade Wrecks MailScanner
> > > >
> > > > On 10/11/2016 08:29 PM, Paul Scott wrote:
> > > > >
> > > > > At this moment, I am still getting the following error using the --lint tests:
> > > > > Checking version numbers...
> > > > > Version installed (5.0.3) does not match version stated in
> > > > > MailScanner.conf file (4.84.5), you may want to run
> > > > > ms-upgrade-conf to ensure your MailScanner.conf file contains all the latest
> settings.
> > > > >
> > > > > But I don't understand why, since the MailScanner.conf which is in
> > > > > the /etc/MailScanner
> > > > directory, has this line in it, and it IS the correct version:
> > > > >
> > > > > # This is the version number of the MailScanner distribution that
> > > > > created # this configuration file. Please do not change this value.
> > > > > MailScanner Version Number = 5.0.3
> > > >
> > > >
> > > > What's in /etc/MailScanner/conf.d/? and anywhere else that might be
> > > > included from /etc/MailScanner/MailScanner.conf?
> > > >
> > > > --
> > > > Mark Sapiro The highway is for gamblers, San Francisco Bay Area,
> > > > California better use your sense - B. Dylan
> > > >
> > > >
> > > > --
> > > > MailScanner mailing list
> > > > mailscanner at lists.mailscanner.info
> > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > > >
> > > >
> > > >
> > > > --
> > > > MailScanner mailing list
> > > > mailscanner at lists.mailscanner.info
> > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > > >
> > > >
> > >
> >
> >
> > --
> > MailScanner mailing list
> > mailscanner at lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >
> >
> > --
> > MailScanner mailing list
> > mailscanner at lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>