MailScanner Scan Twice (Intergrate with Zimbra)

Wed Jan 11 10:13:41 UTC 2017

Sorry Sin.

I thought you wanted to check only incoming messages. To scan all
messages put "static:hold" in smtp_recipient_restrictions.cf before
"permit_mynetworks" and "permit_sasl_authenticated" like below:

...
static:hold
permit_mynetworks
permit_sasl_authenticated
permit_tls_clientcerts
...

Marcelo Gomes

2017-01-11 0:59 GMT-02:00 Rin Pisarn <rin2013 at outlook.com>:
> Hi Gomes,
>
> Thanks for the solution, unfortunately disable the HOLD in header_checks and
> enable static:hold in smtp_recipient_restrictions.cf seems that mailscanner
> not scans at all. Please advise
>
> Thanks
> Rin
>
> Logs below
>
> Jan 11 09:10:24 zimbra postfix/submission/smtpd[28150]: connect from
> unknown[10.1.253.245]Jan 11 09:10:24 zimbra postfix/submission/smtpd[28150]:
> Anonymous TLS connection established from unknown[10.1.253.245]: TLSv1.2
> with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
> Jan 11 09:10:25 zimbra postfix/submission/smtpd[28150]: NOQUEUE: filter:
> RCPT from unknown[10.1.253.245]: <admin at zimbra.imperialhotels.com>: Sender
> address triggers FILTER smtp-amavis:[127.0.0.1]:10026;
> from=<admin at zimbra.imperialhotels.com> to=<admin at zimbra.imperialhotels.com>
> proto=ESMTP helo=<N4200007325>
> Jan 11 09:10:25 zimbra postfix/submission/smtpd[28150]: 5283CA2709:
> client=unknown[10.1.253.245], sasl_method=LOGIN,
> sasl_username=admin at zimbra.imperialhotels.com
> Jan 11 09:10:25 zimbra postfix/cleanup[28166]: 5283CA2709:
> message-id=<004101d26baf$df1e7610$9d5b6230$@zimbra.imperialhotels.com>
> Jan 11 09:10:25 zimbra postfix/qmgr[16289]: 5283CA2709:
> from=<admin at zimbra.imperialhotels.com>, size=2775, nrcpt=1 (queue active)
> Jan 11 09:10:26 zimbra postfix/dkimmilter/smtpd[28169]: connect from
> localhost[127.0.0.1]
> Jan 11 09:10:26 zimbra postfix/dkimmilter/smtpd[28169]: 26ECCA2C03:
> client=localhost[127.0.0.1]Jan 11 09:10:26 zimbra postfix/cleanup[28166]:
> 26ECCA2C03:
> message-d=<004101d26baf$df1e7610$9d5b6230$@zimbra.imperialhotels.com>
> Jan 11 09:10:26 zimbra postfix/qmgr[16289]: 26ECCA2C03:
> from=<admin at zimbra.imperialhotels.com>, size=3308, nrcpt=1 (queue active)
> Jan 11 09:10:26 zimbra postfix/dkimmilter/smtpd[28169]: disconnect from
> localhost[127.0.0.
> 1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5Jan 11 09:10:26 zimbra
> postfix/smtp[28167]: 5283CA2709: to=<admin at zimbra.imperialhotels.com>,
> relay=127.0.0.1 [127.0.0.1]:10026, delay=1, delays=0.23/0.12/0.06/0.61,
> dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10030): 250
> 2.0.0 Ok: queued as 26ECCA2C03)
> Jan 11 09:10:26 zimbra postfix/qmgr[16289]: 5283CA2709: removed
> Jan 11 09:10:27 zimbra postfix/submission/smtpd[28150]: disconnect from
> unknown[10.1.253.245] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1
> commands=8
>
>
> -----Original Message-----
> From: MailScanner
> [mailto:mailscanner-bounces+rin2013=outlook.com at lists.mailscanner.info] On
> Behalf Of Marcelo Machado
> Sent: Tuesday, January 10, 2017 4:53 PM
> To: MailScanner Discussion <mailscanner at lists.mailscanner.info>; MailScanner
> Discussion <mailscanner at lists.mailscanner.info>
> Subject: Re: MailScanner Scan Twice (Intergrate with Zimbra)
>
> Hi Rin.
>
> If you are using the "/ ^ Received: / HOLD" line in the header_checks file,
> try instead to use the "static:hold" parameter in the
> smtpd_recipient_restrictions.cf file like below:
>
> ...
> permit_sasl_authenticated
> permit_mynetworks
> reject_unlisted_recipient
> static:hold
> ...
>
> For me this solved this problem.
>
> Marcelo Gomes
>
> 2017-01-10 4:15 GMT-02:00 Rin Pisarn <rin2013 at outlook.com>:
>> Hello,
>>
>>
>>
>> We have been using MailScanner for many years along with Zimbra but
>> after we install new CentOS6.5 with Zimbra 8.7.1 integrate with
> MailScanner 5.0.3-7.
>> The problem is MailScanner scans a message twice and mailwatch logs 2
>> messages. Can you point me the direction of this cause and solution,
> please?
>>
>>
>>
>> Note : No problem with the old Zimbra 7.1.4 and MailScanner4.85.2-3
>>
>>
>>
>> Thank you in advance
>>
>>
>>
>> Logs below:
>>
>>
>>
>> Jan 10 12:52:47 zimbra /postfix-script[8394]: refreshing the Postfix
>> mail system
>>
>> Jan 10 12:52:47 zimbra postfix/master[23699]: reload -- version 3.1.1,
>> configuration /opt/zimbra/common/conf
>>
>> Jan 10 12:53:02 zimbra postfix/submission/smtpd[8418]: connect from
>> unknown[10.1.253.245]
>>
>> Jan 10 12:53:02 zimbra postfix/submission/smtpd[8418]: Anonymous TLS
>> connection established from unknown[10.1.253.245]: TLSv1.2 with cipher
>> ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
>>
>> Jan 10 12:53:02 zimbra postfix/submission/smtpd[8418]: NOQUEUE:
>> filter: RCPT from unknown[10.1.253.245]:
>> <admin at zimbra.imperialhotels.com>: Sender address triggers FILTER
>> smtp-amavis:[127.0.0.1]:10026; from=<admin at zimbra.imperialhotels.com>
>> to=<admin at zimbra.imperialhotels.com>
>> proto=ESMTP helo=<N4200007325>
>>
>> Jan 10 12:53:02 zimbra postfix/submission/smtpd[8418]: DC948A2BF3:
>> client=unknown[10.1.253.245], sasl_method=LOGIN,
>> sasl_username=admin at zimbra.imperialhotels.com
>>
>> Jan 10 12:53:02 zimbra postfix/cleanup[8424]: DC948A2BF3: hold: header
>> Received: from N4200007325 (unknown [10.1.253.245])??by
>> zimbra.imperialhotels.com (Postfix) with ESMTPSA id DC948A2BF3??for
>> <admin at zimbra.imperialhotels.com>; Tue, 10 Jan 2017 12:53:02 +0700
>> (ICT) from unknown[10.1.253.245];
>> from=<admin at zimbra.imperialhotels.com>
>> to=<admin at zimbra.imperialhotels.com> proto=ESMTP helo=<N4200007325>
>>
>> Jan 10 12:53:02 zimbra postfix/cleanup[8424]: DC948A2BF3:
>> message-id=<004f01d26b05$d374c760$7a5e5620$@zimbra.imperialhotels.com>
>>
>> Jan 10 12:53:04 zimbra MailScanner[30580]: New Batch: Scanning 1
>> messages,
>> 3580 bytes
>>
>> Jan 10 12:53:04 zimbra MailScanner[30580]: Virus and Content Scanning:
>> Starting
>>
>> Jan 10 12:53:04 zimbra MailScanner[30580]: Requeue: DC948A2BF3.A9381
>> to 05C31A2BFA
>>
>> Jan 10 12:53:04 zimbra MailScanner[30580]: Uninfected: Delivered 1
>> messages
>>
>> Jan 10 12:53:04 zimbra postfix/qmgr[8399]: 05C31A2BFA:
>> from=<admin at zimbra.imperialhotels.com>, size=2775, nrcpt=1 (queue
>> active)
>>
>> Jan 10 12:53:04 zimbra MailScanner[30580]: Deleted 1 messages from
>> processing-database
>>
>> Jan 10 12:53:04 zimbra MailScanner[30580]: Logging message
>> DC948A2BF3.A9381 to SQL
>>
>> Jan 10 12:53:04 zimbra postfix/dkimmilter/smtpd[8428]: connect from
>> localhost[127.0.0.1]
>>
>> Jan 10 12:53:04 zimbra postfix/dkimmilter/smtpd[8428]: 70057A2BF3:
>> client=localhost[127.0.0.1]
>>
>> Jan 10 12:53:04 zimbra postfix/cleanup[8424]: 70057A2BF3: hold: header
>> Received: from loca
>>
>> lhost (localhost [127.0.0.1])??by zimbra.imperialhotels.com (Postfix)
>> with ESMTP id 70057A2BF3??for <admin at zimbra.imperialhotels.com>; Tue,
>> 10 Jan 2017
>> 12:53:04 +0700 (ICT) from localhost[127.0.0.1];
>> from=<admin at zimbra.imperialhotels.com>
>> to=<admin at zimbra.imperialhotels.com>
>> proto=ESMTP helo=<localhost>
>>
>> Jan 10 12:53:04 zimbra postfix/cleanup[8424]: 70057A2BF3:
>> message-id=<004f01d26b05$d374c760$7a5e5620$@zimbra.imperialhotels.com>
>>
>> Jan 10 12:53:04 zimbra postfix/dkimmilter/smtpd[8428]: disconnect from
>> localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
>>
>> Jan 10 12:53:04 zimbra postfix/smtp[8426]: 05C31A2BFA:
>> to=<admin at zimbra.imperialhotels.com>,
>> relay=127.0.0.1[127.0.0.1]:10026, delay=1.7,
>> delays=1.4/0.03/0.02/0.32, dsn=2.0.0, status=sent (250 2.0.0 from
>> MTA(smtp:[127.0.0.1]:10030): 250 2.0.0 Ok: queued as 70057A2BF3)
>>
>> Jan 10 12:53:04 zimbra postfix/qmgr[8399]: 05C31A2BFA: removed
>>
>> Jan 10 12:53:04 zimbra MailScanner[30403]: New Batch: Scanning 1
>> messages,
>> 4373 bytes
>>
>> Jan 10 12:53:04 zimbra MailScanner[30403]: Requeue: 70057A2BF3.ADBEC
>> to 7BF78A2BFA
>>
>> Jan 10 12:53:04 zimbra MailScanner[30403]: Unscanned: Delivered 1
>> messages
>>
>> Jan 10 12:53:04 zimbra postfix/qmgr[8399]: 7BF78A2BFA:
>> from=<admin at zimbra.imperialhotels.com>, size=3599, nrcpt=1 (queue
>> active)
>>
>> Jan 10 12:53:04 zimbra MailScanner[30403]: Deleted 1 messages from
>> processing-database
>>
>> Jan 10 12:53:04 zimbra MailScanner[30403]: Logging message
>> 70057A2BF3.ADBEC to SQL
>>
>> Jan 10 12:53:05 zimbra postfix/submission/smtpd[8418]: disconnect from
>> unknown[10.1.253.245] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1
>> quit=1
>> commands=8
>>
>> Jan 10 12:53:14 zimbra postfix/amavisd/smtpd[8438]: connect from
>> localhost[127.0.0.1]
>>
>> Jan 10 12:53:14 zimbra postfix/amavisd/smtpd[8438]: AEF48A2BF3:
>> client=localhost[127.0.0.1]
>>
>> Jan 10 12:53:14 zimbra postfix/cleanup[8424]: AEF48A2BF3:
>> message-id=<004f01d26b05$d374c760$7a5e5620$@zimbra.imperialhotels.com>
>>
>> Jan 10 12:53:14 zimbra postfix/amavisd/smtpd[8438]: disconnect from
>> localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
>>
>> Jan 10 12:53:14 zimbra postfix/qmgr[8399]: AEF48A2BF3:
>> from=<admin at zimbra.imperialhotels.com>, size=4209, nrcpt=1 (queue
>> active)
>>
>> Jan 10 12:53:14 zimbra postfix/smtp[8426]: 7BF78A2BFA:
>> to=<admin at zimbra.imperialhotels.com>,
>> relay=127.0.0.1[127.0.0.1]:10032, delay=10, delays=0.17/0/0.02/10,
>> dsn=2.0.0, status=sent (250 2.0.0 from
>> MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as AEF48A2BF3)
>>
>> Jan 10 12:53:14 zimbra postfix/qmgr[8399]: 7BF78A2BFA: removed
>>
>> Jan 10 12:53:15 zimbra postfix/lmtp[8439]: AEF48A2BF3:
>> to=<admin at zimbra.imperialhotels.com>,
>> relay=zimbra.imperialhotels.com[10.1.253.2]:7025, delay=0.92,
>> delays=0.07/0.04/0.11/0.71, dsn=2.1.5, status=sent (250 2.1.5 Delivery
>> OK)
>>
>> Jan 10 12:53:15 zimbra postfix/qmgr[8399]: AEF48A2BF3: removed
>>
>>
>>
>>
>>
>>
>> --
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>