Denial Of Service attack

[Jason Waters]

Try setting all of that to postfix:postfix recursively, restart and then
see.  My guess if you have things wrong in the conf file.  What are all you
user settings  in MailScanner.conf

On Jan 21, 2017 11:52 AM, "Marcelo Machado" <mmgomess at gmail.com> wrote:

> ls -l /var/spool/MailScanner/
> total 16
> drwxrwxr-x  2 mail    mtagroup 4096 Dec 27 15:08 archive
> drwxrwx--- 24 clamav  mtagroup 4096 Jan 21 14:49 incoming
> drwxrwxr-x 20 clamav  mtagroup 4096 Jan 21 01:27 quarantine
> drwx------  2 postfix postfix  4096 Jan 21 14:31 spamassassin
>
> and my mtagroup - mtagroup:x:1001:clamav,postfix,mail
>
> 2017-01-21 14:12 GMT-02:00 Jason Waters <jason at geeknocity.com>:
> > What does ls -l /var/spool/MailScanner
> >
> > On Jan 21, 2017 10:24 AM, "Marcelo Machado" <mmgomess at gmail.com> wrote:
> >>
> >> I've tried several combinations but I still keep the same error.
> >>
> >> What are the correct settings and permissions?
> >>
> >> Marcelo
> >>
> >> 2017-01-20 15:21 GMT-02:00 Jason Waters <jason at geeknocity.com>:
> >> > I had a couple things wrong.  I had some of the user/group settings in
> >> > MailScanner.conf wrong, and then I needed to set the permissions on
> >> > /var/spool/MailScanner correctly.
> >> >
> >> > On Fri, Jan 20, 2017 at 11:21 AM, Marcelo Machado <mmgomess at gmail.com
> >
> >> > wrote:
> >> >>
> >> >> Yes. So many lines with this message.
> >> >>
> >> >> And how did you resolv this issue?
> >> >>
> >> >> 2017-01-20 13:29 GMT-02:00 Jason Waters <jason at geeknocity.com>:
> >> >> > Search your logs and see if it says status = 13, that is a
> permission
> >> >> > thing.
> >> >> > I had the same problem.
> >> >> >
> >> >> > cat /var/log/mail.log |grep "status = 13" -A4
> >> >> >
> >> >> >
> >> >> >
> >> >> > On Fri, Jan 20, 2017 at 10:18 AM, Marcelo Machado
> >> >> > <mmgomess at gmail.com>
> >> >> > wrote:
> >> >> >>
> >> >> >> Hi everyone.
> >> >> >>
> >> >> >> Many users of my domain are receiving the message below and the
> >> >> >> original message is lost:
> >> >> >>
> >> >> >> MailScanner was attacked by a Denial Of Service attack, and has
> >> >> >> therefore deleted this part of the message. Please contact your
> >> >> >> e-mail
> >> >> >> providers for more information if you need it, giving them the
> whole
> >> >> >> of this report. Attack in:
> >> >> >>
> >> >> >>
> >> >> >> /var/spool/MailScanner/incoming/5106/5B02C7C002C8.
> A3986/nmsg-5106-92.html
> >> >> >>
> >> >> >> In log mail.log the correspondent error is:
> >> >> >>
> >> >> >> "Content Checks: Detected and have disarmed KILLED tags in HTML
> >> >> >> message
> >> >> >> in"
> >> >> >>
> >> >> >> Anyone can help me?
> >> >> >>
> >> >> >>
> >> >> >> Marcelo Gomes
> >> >> >>
> >> >> >>
> >> >> >> --
> >> >> >> MailScanner mailing list
> >> >> >> mailscanner at lists.mailscanner.info
> >> >> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >> >> >>
> >> >> >
> >> >> >
> >> >> >
> >> >> >
> >> >> > --
> >> >> > MailScanner mailing list
> >> >> > mailscanner at lists.mailscanner.info
> >> >> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >> >> >
> >> >> >
> >> >>
> >> >>
> >> >> --
> >> >> MailScanner mailing list
> >> >> mailscanner at lists.mailscanner.info
> >> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >> >>
> >> >
> >> >
> >> >
> >> >
> >> > --
> >> > MailScanner mailing list
> >> > mailscanner at lists.mailscanner.info
> >> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >> >
> >> >
> >>
> >>
> >> --
> >> MailScanner mailing list
> >> mailscanner at lists.mailscanner.info
> >> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >>
> >
> >
> >
> > --
> > MailScanner mailing list
> > mailscanner at lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20170121/77f81d88/attachment.html>