MCP checks

Tue Sep 20 07:22:45 UTC 2016

Shawn,

Thanks, I will test it out.

-
Jerry Benton
www.mailborder.com
+1 - 844-436-6245

-----Original Message-----
From: Shawn Iverson <iversons at rushville.k12.in.us>
Reply: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Date: September 19, 2016 at 10:54:29 PM
To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
Subject:  Re: MCP checks

> Ok, I got it working, and I may have an explanation.
>
> In SA 3.4.1, it appears that the .pre files are expected to be in the same
> location as the prefs file.
>
> Symlinking the .pre files into /etc/MailScanner/mcp, and fixing my
> permissions on /var/spool/postfix/.spamassassin seems to have resolved the
> issue for me.
>
> MCP is now working.
>
>
> On Mon, Sep 19, 2016 at 9:40 PM, Shawn Iverson > > wrote:
>
> > A few other issues...look related to missing plugins...looks like SA is
> > not reading anything from /etc/mail/spamassassin...
> >
> > 21:38:18 Sep 19 21:38:18.141 [26246] info: config: failed to parse line,
> > skipping, in "/etc/MailScanner/mcp/mcp.spamassassin.conf": use_dcc 0
> > 21:38:18 Sep 19 21:38:18.141 [26246] info: config: failed to parse line,
> > skipping, in "/etc/MailScanner/mcp/mcp.spamassassin.conf": use_pyzor 0
> > 21:38:18 Sep 19 21:38:18.141 [26246] info: config: failed to parse line,
> > skipping, in "/etc/MailScanner/mcp/mcp.spamassassin.conf": use_razor1 0
> > 21:38:18 Sep 19 21:38:18.142 [26246] info: config: failed to parse line,
> > skipping, in "/etc/MailScanner/mcp/mcp.spamassassin.conf": use_razor2 0
> > 21:38:18 Sep 19 21:38:18.142 [26246] info: config: failed to parse line,
> > skipping, in "/etc/MailScanner/mcp/mcp.spamassassin.conf":
> > decode_attachments 1
> >
> > 21:38:18 Timeout::_run: check: no loaded plugin implements 'check_main':
> > cannot scan!
> > 21:38:18 Check that the necessary '.pre' files are in the config directory.
> > 21:38:18 At a minimum, v320.pre loads the Check plugin which is required.
> >
> >
> > On Mon, Sep 19, 2016 at 9:34 PM, Shawn Iverson <
> > iversons at rushville.k12.in.us> wrote:
> >
> >> Wait spoke too soon....still debugging....that was a problem, must be
> >> something else...
> >>
> >> On Mon, Sep 19, 2016 at 9:29 PM, Shawn Iverson <
> >> iversons at rushville.k12.in.us> wrote:
> >>
> >>> Found the problem...
> >>>
> >>> Sep 19 21:23:15.618 [21238] dbg: config: mkdir
> >>> /var/spool/postfix/.spamassassin failed: mkdir
> >>> /var/spool/postfix/.spamassassin: Permission denied at
> >>> /usr/share/perl5/vendor_perl/Mail/SpamAssassin.pm line 1902
> >>>
> >>> I created the /var/spool/postfix/.spamassassin directory and MCP
> >>> started working.
> >>>
> >>>
> >>> On Mon, Sep 19, 2016 at 6:26 PM, Shawn Iverson <
> >>> iversons at rushville.k12.in.us> wrote:
> >>>
> >>>> Same here. Starting but not triggering...doing some debugging now...
> >>>>
> >>>> On Mon, Sep 19, 2016 at 6:18 PM, Shawn Iverson <
> >>>> iversons at rushville.k12.in.us> wrote:
> >>>>
> >>>>> Doh! I have my logging off...digging some more...
> >>>>>
> >>>>> On Mon, Sep 19, 2016 at 6:10 PM, Jerry Benton <
> >>>>> jerry.benton at mailborder.com> wrote:
> >>>>>
> >>>>>> I see it being called and run, it just is not triggering.
> >>>>>>
> >>>>>>
> >>>>>> -
> >>>>>> Jerry Benton
> >>>>>> www.mailborder.com
> >>>>>> +1 - 844-436-6245
> >>>>>>
> >>>>>>
> >>>>>> -----Original Message-----
> >>>>>> From: Shawn Iverson
> >>>>>> Reply: MailScanner Discussion
> >>>>>> Date: September 19, 2016 at 6:07:00 PM
> >>>>>> To: MailScanner Discussion
> >>>>>> Subject: Re: MCP checks
> >>>>>>
> >>>>>> > I do not see MCP being called. I should at least see the following
> >>>>>> in the
> >>>>>> > maillog:
> >>>>>> >
> >>>>>> > MCP Checks: Starting
> >>>>>> >
> >>>>>> > On Mon, Sep 19, 2016 at 5:53 PM, Shawn Iverson > > wrote:
> >>>>>> >
> >>>>>> > > Confirmed issue with MCP.
> >>>>>> > >
> >>>>>> > > I cannot get MCP to fire either.
> >>>>>> > >
> >>>>>> > > On Mon, Sep 19, 2016 at 4:56 PM, Jerry Benton > > > wrote:
> >>>>>> > >
> >>>>>> > >> Yes. The latest.
> >>>>>> > >>
> >>>>>> > >>
> >>>>>> > >> -
> >>>>>> > >> Jerry Benton
> >>>>>> > >> www.mailborder.com
> >>>>>> > >> +1 - 844-436-6245
> >>>>>> > >>
> >>>>>> > >>
> >>>>>> > >> -----Original Message-----
> >>>>>> > >> From: Shawn Iverson
> >>>>>> > >> Reply: MailScanner Discussion
> >>>>>> > >> Date: September 19, 2016 at 4:56:27 PM
> >>>>>> > >> To: MailScanner Discussion
> >>>>>> > >> Subject: Re: MCP checks
> >>>>>> > >>
> >>>>>> > >> > I'll runs some tests. 5.0.3-7, right?
> >>>>>> > >> >
> >>>>>> > >> > On Mon, Sep 19, 2016 at 4:47 PM, Jerry Benton
> >>>>>> > >> > wrote:
> >>>>>> > >> >
> >>>>>> > >> > > Similar settings on my lab server. Not working =/
> >>>>>> > >> > >
> >>>>>> > >> > > This sucks.
> >>>>>> > >> > >
> >>>>>> > >> > >
> >>>>>> > >> > > -
> >>>>>> > >> > > Jerry Benton
> >>>>>> > >> > > www.mailborder.com
> >>>>>> > >> > > +1 - 844-436-6245
> >>>>>> > >> > >
> >>>>>> > >> > >
> >>>>>> > >> > > -----Original Message-----
> >>>>>> > >> > > From: Peter H. Lemieux
> >>>>>> > >> > > Reply: MailScanner Discussion
> >>>>>> > >> > > Date: September 19, 2016 at 4:38:16 PM
> >>>>>> > >> > > To: MailScanner Discussion
> >>>>>> > >> > > Subject: Re: MCP checks
> >>>>>> > >> > >
> >>>>>> > >> > > > # this contains the usual list of addresses to check or
> >>>>>> not to check
> >>>>>> > >> > > > MCP Checks = /etc/MailScanner/rules/mcp_checks.rules
> >>>>>> > >> > > >
> >>>>>> > >> > > > First Check = MCP
> >>>>>> > >> > > >
> >>>>>> > >> > > > MCP Required SpamAssassin Score = 5
> >>>>>> > >> > > > MCP High SpamAssassin Score = 9
> >>>>>> > >> > > > MCP Error Score = 1
> >>>>>> > >> > > >
> >>>>>> > >> > > > # we use "PHI" for "patient health information"
> >>>>>> > >> > > > MCP Header = X-XXCHC-PHI-Monitor:
> >>>>>> > >> > > > Non MCP Actions = deliver
> >>>>>> > >> > > >
> >>>>>> > >> > > > MCP Actions = store-nonmcp
> >>>>>> > >> > > > High Scoring MCP Actions = store-mcp
> >>>>>> > >> > > > Bounce MCP As Attachment = no
> >>>>>> > >> > > >
> >>>>>> > >> > > > MCP Modify Subject = no
> >>>>>> > >> > > > MCP Subject Text =
> >>>>>> > >> > > > High Scoring MCP Modify Subject = no
> >>>>>> > >> > > > High Scoring MCP Subject Text = {PHI}
> >>>>>> > >> > > >
> >>>>>> > >> > > > Is Definitely MCP = no
> >>>>>> > >> > > > Is Definitely Not MCP = no
> >>>>>> > >> > > > Definite MCP Is High Scoring = no
> >>>>>> > >> > > > Always Include MCP Report = yes
> >>>>>> > >> > > > Detailed MCP Report = yes
> >>>>>> > >> > > > Include Scores In MCP Report = yes
> >>>>>> > >> > > >
> >>>>>> > >> > > > In /etc/MailScanner/mcp I have rulesets like this one:
> >>>>>> > >> > > >
> >>>>>> > >> > > > File: /etc/MailScanner/mcp/20_Numbers_and_Codes.cf
> >>>>>> > >> > > >
> >>>>>> > >> > > > ### Patient Identification Codes
> >>>>>> > >> > > >
> >>>>>> > >> > > > header SUBJ_XXID1 Subject =~ /\b005[4-8]\d{4}\b/
> >>>>>> > >> > > > describe SUBJ_XXID1 XXCHC Patient ID with 0054-8 in
> >>>>>> Subject Header
> >>>>>> > >> > > > score SUBJ_XXID1 10
> >>>>>> > >> > > >
> >>>>>> > >> > > > header SUBJ_XXID2 Subject =~ /\b1005[89]\d+\b/
> >>>>>> > >> > > > describe SUBJ_XXID2 XXCHC Patient ID with 10058-9 in
> >>>>>> Subject Header
> >>>>>> > >> > > > score SUBJ_XXID2 10
> >>>>>> > >> > > >
> >>>>>> > >> > > > header SUBJ_XXID3 Subject =~ /\b1006[0123]\d+\b/
> >>>>>> > >> > > > describe SUBJ_XXID3 XXCHC Patient ID with 10060-63 in
> >>>>>> Subject Header
> >>>>>> > >> > > > score SUBJ_XXID3 10
> >>>>>> > >> > > >
> >>>>>> > >> > > > header SUBJ_XXID4 Subject =~ /\b00000\d{3}\b/
> >>>>>> > >> > > > describe SUBJ_XXID4 Possible XXCHC Patient ID in Subject
> >>>>>> Header
> >>>>>> > >> > > > score SUBJ_XXID4 5
> >>>>>> > >> > > >
> >>>>>> > >> > > > # They use some pretty generic patient IDs like 00001234.
> >>>>>> > >> > > > header SUBJ_XXID5 Subject =~ /\b0000\d{4}\b/
> >>>>>> > >> > > > describe SUBJ_XXID5 Possible XXCHC Patient ID in Subject
> >>>>>> Header
> >>>>>> > >> > > > score SUBJ_XXID5 5
> >>>>>> > >> > > >
> >>>>>> > >> > > > header SUBJ_SSN1 Subject =~ /\b\d{3}-\d{2}-\d{4}\b/
> >>>>>> > >> > > > describe SUBJ_SSN1 Likely Social Security Number in
> >>>>>> Subject Header
> >>>>>> > >> > > > score SUBJ_SSN1 10
> >>>>>> > >> > > >
> >>>>>> > >> > > > [etc.]
> >>>>>> > >> > > >
> >>>>>> > >> > > > A score of ten results in the message being quarantined
> >>>>>> and a notice
> >>>>>> > >> > > > sent to the administrator and the message sender. A score
> >>>>>> of five
> >>>>>> > >> sends
> >>>>>> > >> > > > notices but permits the message to be sent to its
> >>>>>> recipient.
> >>>>>> > >> > > >
> >>>>>> > >> > > > Hope this helps, Jerry!
> >>>>>> > >> > > >
> >>>>>> > >> > > > Peter
> >>>>>> > >> > > >
> >>>>>> > >> > > >
> >>>>>> > >> > > >
> >>>>>> > >> > > > On 09/19/2016 03:21 PM, Jerry Benton wrote:
> >>>>>> > >> > > > > What do your settings look like?
> >>>>>> > >> > > > >
> >>>>>> > >> > > > >
> >>>>>> > >> > > > > -
> >>>>>> > >> > > > > Jerry Benton
> >>>>>> > >> > > > > www.mailborder.com
> >>>>>> > >> > > > > +1 - 844-436-6245
> >>>>>> > >> > > > >
> >>>>>> > >> > > > >
> >>>>>> > >> > > > > -----Original Message-----
> >>>>>> > >> > > > > From: Peter H. Lemieux
> >>>>>> > >> > > > > Reply: MailScanner Discussion
> >>>>>> > >> > > > > Date: September 19, 2016 at 3:18:27 PM
> >>>>>> > >> > > > > To: MailScanner Discussion
> >>>>>> > >> > > > > Subject: Re: MCP checks
> >>>>>> > >> > > > >
> >>>>>> > >> > > > >> I do, but I'm using 4.85,2. We use MCP at a health
> >>>>>> center to
> >>>>>> > >> intercept
> >>>>>> > >> > > > >> outbound messages that may contain "patient health
> >>>>>> information"
> >>>>>> > >> as
> >>>>>> > >> > > > >> defined by the US HIPAA laws. Works as advertised.
> >>>>>> > >> > > > >>
> >>>>>> > >> > > > >> I haven't tried version 5 yet so I can't help with that.
> >>>>>> > >> > > > >>
> >>>>>> > >> > > > >> Peter
> >>>>>> > >> > > > >>
> >>>>>> > >> > > > >>
> >>>>>> > >> > > > >> On 09/19/2016 02:51 PM, Jerry Benton wrote:
> >>>>>> > >> > > > >>> Anyone using MCP? I can’t seem to get it to fire on
> >>>>>> any rules,
> >>>>>> > >> but
> >>>>>> > >> > > the
> >>>>>> > >> > > > >>> same rules will fire in regular spamassassin checks.
> >>>>>> > >> > > > >>>
> >>>>>> > >> > > > >>>
> >>>>>> > >> > > > >>> -
> >>>>>> > >> > > > >>> Jerry Benton
> >>>>>> > >> > > > >>> www.mailborder.com
> >>>>>> > >> > > > >>> +1 - 844-436-6245
> >>>>>> > >> > > > >>>
> >>>>>> > >> > > > >>>
> >>>>>> > >> > > > >>
> >>>>>> > >> > > > >>
> >>>>>> > >> > > > >> --
> >>>>>> > >> > > > >> MailScanner mailing list
> >>>>>> > >> > > > >> mailscanner at lists.mailscanner.info
> >>>>>> > >> > > > >> http://lists.mailscanner.info/
> >>>>>> mailman/listinfo/mailscanner
> >>>>>> > >> > > > >>
> >>>>>> > >> > > > >>
> >>>>>> > >> > > > >
> >>>>>> > >> > > > >
> >>>>>> > >> > > >
> >>>>>> > >> > > >
> >>>>>> > >> > > > --
> >>>>>> > >> > > > MailScanner mailing list
> >>>>>> > >> > > > mailscanner at lists.mailscanner.info
> >>>>>> > >> > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>>>>> > >> > > >
> >>>>>> > >> > > >
> >>>>>> > >> > >
> >>>>>> > >> > >
> >>>>>> > >> > > --
> >>>>>> > >> > > MailScanner mailing list
> >>>>>> > >> > > mailscanner at lists.mailscanner.info
> >>>>>> > >> > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>>>>> > >> > >
> >>>>>> > >> > >
> >>>>>> > >> >
> >>>>>> > >> >
> >>>>>> > >> > --
> >>>>>> > >> > Shawn Iverson
> >>>>>> > >> > Director of Technology
> >>>>>> > >> > Rush County Schools
> >>>>>> > >> > 765-932-3901 x271
> >>>>>> > >> > iversons at rushville.k12.in.us
> >>>>>> > >> >
> >>>>>> > >> >
> >>>>>> > >> > --
> >>>>>> > >> > MailScanner mailing list
> >>>>>> > >> > mailscanner at lists.mailscanner.info
> >>>>>> > >> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>>>>> > >> >
> >>>>>> > >> >
> >>>>>> > >>
> >>>>>> > >>
> >>>>>> > >> --
> >>>>>> > >> MailScanner mailing list
> >>>>>> > >> mailscanner at lists.mailscanner.info
> >>>>>> > >> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>>>>> > >>
> >>>>>> > >>
> >>>>>> > >
> >>>>>> > >
> >>>>>> > > --
> >>>>>> > > Shawn Iverson
> >>>>>> > > Director of Technology
> >>>>>> > > Rush County Schools
> >>>>>> > > 765-932-3901 x271
> >>>>>> > > iversons at rushville.k12.in.us
> >>>>>> > >
> >>>>>> > >
> >>>>>> > >
> >>>>>> >
> >>>>>> >
> >>>>>> > --
> >>>>>> > Shawn Iverson
> >>>>>> > Director of Technology
> >>>>>> > Rush County Schools
> >>>>>> > 765-932-3901 x271
> >>>>>> > iversons at rushville.k12.in.us
> >>>>>> >
> >>>>>> >
> >>>>>> > --
> >>>>>> > MailScanner mailing list
> >>>>>> > mailscanner at lists.mailscanner.info
> >>>>>> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>>>>> >
> >>>>>> >
> >>>>>>
> >>>>>>
> >>>>>> --
> >>>>>> MailScanner mailing list
> >>>>>> mailscanner at lists.mailscanner.info
> >>>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>>>>>
> >>>>>>
> >>>>>
> >>>>>
> >>>>> --
> >>>>> Shawn Iverson
> >>>>> Director of Technology
> >>>>> Rush County Schools
> >>>>> 765-932-3901 x271
> >>>>> iversons at rushville.k12.in.us
> >>>>>
> >>>>>
> >>>>>
> >>>>
> >>>>
> >>>> --
> >>>> Shawn Iverson
> >>>> Director of Technology
> >>>> Rush County Schools
> >>>> 765-932-3901 x271
> >>>> iversons at rushville.k12.in.us
> >>>>
> >>>>
> >>>>
> >>>
> >>>
> >>> --
> >>> Shawn Iverson
> >>> Director of Technology
> >>> Rush County Schools
> >>> 765-932-3901 x271
> >>> iversons at rushville.k12.in.us
> >>>
> >>>
> >>>
> >>
> >>
> >> --
> >> Shawn Iverson
> >> Director of Technology
> >> Rush County Schools
> >> 765-932-3901 x271
> >> iversons at rushville.k12.in.us
> >>
> >>
> >>
> >
> >
> > --
> > Shawn Iverson
> > Director of Technology
> > Rush County Schools
> > 765-932-3901 x271
> > iversons at rushville.k12.in.us
> >
> >
> >
>
>
> --
> Shawn Iverson
> Director of Technology
> Rush County Schools
> 765-932-3901 x271
> iversons at rushville.k12.in.us
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>