MailScanner: Message attempted to kill MailScanner
Shawn Iverson
iversons at rushville.k12.in.us
Mon Aug 6 21:51:47 UTC 2018
Was this the root cause of the issue?
(sorry been a very busy day)
On Mon, Aug 6, 2018 at 11:16 AM, DobriL Dobrilov <dobril at stanga.net> wrote:
> Thank you for the hint.
> I find what exactly cause my issue with Webmail.
> During the Webmail upgrade , somehow disappeared $config['smtp_server'] =
> 'mail.stanga.net'; from the config file...
> I found it after install 2nd Webmail to test.....
> Although is very strange how the Webmail managed to send messages to
> foreign
> hosts.
>
> Sorry for disturbing all of you for this.
>
>
>
> Dobril Dobrilov
> IT Manager
> dobril at stanga.net
>
>
> 43, Cherni Vrah Blvd. | 1407 Sofia - Bulgaria
> Phone: +359 2 81 960 69 Fax: +359 2 81 960 70
> Mobile: +359 878 749 387
>
>
> We shape Digital www.stanga.net
>
> We re-invent Video www.bsbvision.com
>
> We build Apps www.shanga.co
>
> We support Start-Ups www.mysbar.net
>
>
>
>
> -----Original Message-----
> From: MailScanner
> [mailto:mailscanner-bounces+dobril=stanga.net at lists.mailscanner.info] On
> Behalf Of L.P.H. van Belle via MailScanner
> Sent: Monday, August 6, 2018 6:11 PM
> To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
> Cc: L.P.H. van Belle <belle at bazuin.nl>
> Subject: RE: MailScanner: Message attempted to kill MailScanner
>
> You webserver is not "localhost"... Pointing to : from mail.stanga.net
> (localhost [IPv6:::1]) Choose...
>
> By example. cat /etc/hosts
> 127.0.0.1 localhost
> 194.124.193.23 mail.domain.tld
> 192.168.1.1 mail.internal.domain.tld mail
>
>
> # The following lines are desirable for IPv6 capable hosts
> ::1 localhost ip6-localhost ip6-loopback
> ff02::1 ip6-allnodes
> ff02::2 ip6-allrouters
>
> Just beware when you change it, you might hit more, but if you fix that
> all
> your ok for the futere.
> Imo. Your resolving is giving the problems.
>
>
> Greetz,
>
> Louis
>
>
>
> > -----Oorspronkelijk bericht-----
> > Van: MailScanner
> > [mailto:mailscanner-bounces+belle=bazuin.nl at lists.mailscanner.
> info] Namens DobriL Dobrilov
> > Verzonden: maandag 6 augustus 2018 16:44
> > Aan: 'MailScanner Discussion'
> > Onderwerp: RE: MailScanner: Message attempted to kill MailScanner
> >
> > Webmail
> > ------------
> > Received: from mail.stanga.net (localhost [IPv6:::1])
> > by mail.stanga.net (Postfix) with ESMTPA id 5772D62C57
> > for <dobril at stanga.net>; Mon, 6 Aug 2018 14:52:00 +0300 (EEST)
> > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=stanga.net;
> > s=mail;
> > t=1533556320; bh=4I/hR/SP5y+TSO6ckrsWbUfz/ulzfgg21OOLy4t7Qcw=;
> > h=Date:From:To:Subject:Reply-To;
> >
> > b=LHHTCrdhwEuGskWyqw0sWd1Km3VgyVhuTGiQ+b00rQmMg5EoEvx0ro12ob/zWes9m
> >
> > jtgr30krr1OkHUcBPXOoYUyCDOzLU3VwKUjYO8mX2L1C3ZCZsvgFkbjtP7QbrIHzM6
> > EsRQn070GPV/w75A43jCSxetrKKtM6se6osKZvaM=
> > MIME-Version: 1.0
> > Content-Type: text/plain; charset=US-ASCII; format=flowed
> > Content-Transfer-Encoding: 7bit
> > Date: Mon, 06 Aug 2018 14:52:00 +0300
> > From: Dobril Dobrilov <dobril at stanga.net>
> > To: dobril at stanga.net
> > Subject: AAA
> > Organization: StangaOne1
> > Reply-To: dobril at stanga.net
> > Mail-Reply-To: dobril at stanga.net
> > Message-ID: <8e5ddc58218e715f2ec6286fe0b60f03 at stanga.net>
> > X-Sender: dobril at stanga.net
> > User-Agent: Roundcube Webmail/1.3.7
> >
> >
> > Outlook
> > ------------
> > Return-Path: <dobril at stanga.net>
> > X-Original-To: dobril at stanga.net
> > Delivered-To: dobril at stanga.net
> > Received: from DL (unknown [192.168.0.222])
> > (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
> > bits))
> > (No client certificate requested)
> > by mail.stanga.net (Postfix) with ESMTPSA id D6F6D62C8E
> > for <dobril at stanga.net>; Mon, 6 Aug 2018 17:42:45 +0300 (EEST)
> > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=stanga.net;
> > s=mail;
> > t=1533566565; bh=1ooy+DYxraTnYWXxssyteq3EYaC5wdAbrolTC0mL5bA=;
> > h=From:To:Subject:Date;
> >
> > b=XZzNLHycLcbdsjqXFtWJT96Q0lPhhtOS/+ZGIZpVWNfu68gw1nFHitcIUfV5zGCk2
> >
> > L419FGzTaLO9GiE1pAGnzruH5dh1BCHU+9AxLu3rB3oijr2BOEXeltH1TREFq4E0f+
> > erOPUx3jdywpL6vJFLR2YixmUfIrdLScxOTcUKk0=
> > From: "DobriL Dobrilov" <dobril at stanga.net>
> > To: "'DobriL Dobrilov'" <dobril at stanga.net>
> > Subject: Test
> > Date: Mon, 6 Aug 2018 17:42:52 +0300
> > Message-ID: <001701d42d93$c0ff3460$42fd9d20$@stanga.net>
> > MIME-Version: 1.0
> > Content-Type: multipart/mixed;
> > boundary="----=_NextPart_000_0018_01D42DAC.E64C6C60"
> > X-Mailer: Microsoft Outlook 16.0
> > Thread-Index: AdQtk77S62N7R+6qQV66SqVGhFQY4A==
> > Content-Language: bg
> > X-MS-TNEF-Correlator: 000000005234E38E73D4914094E5D7D34B79F6A504FD8F00
> > X-Stanga-MailScanner-Information: Please contact the ISP for more
> > information
> > X-Stanga-MailScanner-ID: D6F6D62C8E.AB5F9
> > X-Stanga-MailScanner: Not scanned: please contact your Internet E-Mail
> > Service Provider for details
> > X-Stanga-MailScanner-SpamCheck: not spam (whitelisted),
> > SpamAssassin (not cached, score=-99.887, required 5,
> > ALL_TRUSTED -1.00, DKIM_SIGNED 0.10, DKIM_VALID -0.10,
> > DKIM_VALID_AU -0.10, TVD_RCVD_SINGLE 1.21,
> > USER_IN_WHITELIST -100.00)
> > X-Stanga-MailScanner-From: dobril at stanga.net
> > X-Spam-Status: No
> > X-EsetId: 37303A2960736C61677D6A
> >
> >
> > -----Original Message-----
> > From: MailScanner
> > [mailto:mailscanner-bounces+dobril=stanga.net at lists.mailscanne
> r.info] On
> > Behalf Of Antony Stone
> > Sent: Monday, August 6, 2018 5:18 PM
> > To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
> > Subject: Re: MailScanner: Message attempted to kill MailScanner
> >
> > On Monday 06 August 2018 at 16:14:39, DobriL Dobrilov wrote:
> >
> > > Definitely this is something related only to my webmail and
> > only when
> > > I send emails to the same domain. I can send same message
> > without any
> > > issue if I'm using outlook or other mail client.
> > > I can send messages from Webmail to all external domain
> > without problem.
> > > All thing mean that the problem cannot be disk space , ram or bad
> > > permissions. echo Test |mail dobril at stanga.net , from the
> > same server
> > > deliver messages without problem.
> >
> > Can you show us full headers of an example email from webmail (which
> > MS can't
> > process) and another one to and from the same addresses, but not from
> > webmail (which MS processes okay)?
> >
> > Antony.
> >
> > > -----Original Message-----
> > > From: MailScanner
> > >
> > [mailto:mailscanner-bounces+dobril=stanga.net at lists.mailscanner.info]
> > > On Behalf Of L.P.H. van Belle via MailScanner
> > > Sent: Monday, August 6, 2018 4:22 PM
> > > To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
> > > Cc: L.P.H. van Belle <belle at bazuin.nl>
> > > Subject: RE: MailScanner: Message attempted to kill MailScanner
> > >
> > > Hai,
> > >
> > > What is the os your running?
> > > That might help me a bit.
> > >
> > > Did you follow a site for this upgrade, show me which one
> > if you did.
> > >
> > > Your group members are correct ?
> > > # *( im running debian 9 ) an i have these configured.
> > > mtagroup:x:1001:clamav,Debian-exim,postfix,mail,www-data
> > > clamav:x:119:postfix,www-data
> > > opendkim:x:122:postfix
> > >
> > >
> > > And can you post a more complete mail.log, if needed, pm it
> > to me or
> > > anonimize it here needed.
> > > Preffered from the time frame, when you try to send your
> > the message.
> > >
> > > I still say its your antivirus, if you did not remove the
> > old messages
> > > from your queue.
> > > And now its not working because postfix/mailscanner try to
> > deliver to
> > > clamd and thats turned of.
> > >
> > > If the AV is off then why is you log showing the av scanner?
> > > Your disk it not full?
> > >
> > > If upgrade my debian 7 + mailscanner 4.7x to debian 9 + mailscanner.
> > > I also reused my settings.
> > > I'll try to find if i can seen what i changed ( if so ), that was
> > > months ago..
> > >
> > >
> > > Greetz,
> > >
> > > Louis
> > >
> > > > -----Oorspronkelijk bericht-----
> > > > Van: DobriL Dobrilov [mailto:dobril at stanga.net]
> > > > Verzonden: maandag 6 augustus 2018 14:53
> > > > Aan: 'MailScanner Discussion'
> > > > CC: 'L.P.H. van Belle'
> > > > Onderwerp: RE: MailScanner: Message attempted to kill MailScanner
> > > >
> > > > AV scan is off , something else cause the issue.
> > > >
> > > >
> > > > Dobril Dobrilov
> > > > IT Manager
> > > > dobril at stanga.net
> > > >
> > > >
> > > > 43, Cherni Vrah Blvd. | 1407 Sofia - Bulgaria
> > > > Phone: +359 2 81 960 69 Fax: +359 2 81 960 70
> > > > Mobile: +359 878 749 387
> > > >
> > > >
> > > > We shape Digital www.stanga.net
> > > >
> > > > We re-invent Video www.bsbvision.com
> > > >
> > > > We build Apps www.shanga.co
> > > >
> > > > We support Start-Ups www.mysbar.net
> > > >
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: MailScanner
> > > > [mailto:mailscanner-bounces+dobril=stanga.net at lists.mailscanne
> > > > r.info] On
> > > > Behalf Of L.P.H. van Belle via MailScanner
> > > > Sent: Monday, August 6, 2018 3:45 PM
> > > > To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
> > > > Cc: L.P.H. van Belle <belle at bazuin.nl>
> > > > Subject: RE: MailScanner: Message attempted to kill MailScanner
> > > >
> > > > Are you using Yara rules or other clamav unoffical databases.
> > > > Remove these, restart clamav and try again.
> > > >
> > > > You might have a bad clamav database file.
> > > >
> > > > Greetz,
> > > >
> > > > Louis
> > > >
> > > > > -----Oorspronkelijk bericht-----
> > > > > Van: MailScanner
> > > > > [mailto:mailscanner-bounces+belle=bazuin.nl at lists.mailscanner.
> > > > > info] Namens Antony Stone
> > > > > Verzonden: maandag 6 augustus 2018 14:23
> > > > > Aan: MailScanner Discussion
> > > > > Onderwerp: Re: MailScanner: Message attempted to kill
> > MailScanner
> > > > >
> > > > > On Monday 06 August 2018 at 14:13:03, DobriL Dobrilov wrote:
> > > > > > Until now the Mail Server was with old postfix and
> > > > >
> > > > > MailScanner 4.79. I
> > > > >
> > > > > > migrated to new server with MailScanner 5.0.7. MS config
> > > >
> > > > is same as
> > > >
> > > > > > before.
> > > > >
> > > > > Maybe someone with more knowledge than of any configuration
> > > > > differences ebtween those version can comment on just
> > > >
> > > > keeping the same
> > > >
> > > > > configuration file...
> > > > >
> > > > > > From webmail I can send messages out of my domain without
> > > >
> > > > problems.
> > > >
> > > > > So, what *does* cause the problem?
> > > > >
> > > > > Your original email said "All emails sent from my
> > webmail to same
> > > > > domain cannot be processes by mailscanner."
> > > > >
> > > > > > Msg from webmail
> > > > > > Received: from mail.stanga.net (localhost [IPv6:::1])
> > > > > >
> > > > > > by mail.stanga.net (Postfix) with ESMTPA id 8990B62C7F
> > > > > > for <dobril at stanga.net>; Mon, 6 Aug 2018 14:33:37
> > > >
> > > > +0300 (EEST)
> > > >
> > > > > > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
> > > > >
> > > > > d=stanga.net; s=mail;
> > > > >
> > > > > > t=1533555217;
> > > >
> > > > bh=mZ+uaN6Z/8N6WGVqk2wnIiNbWhm5wweetthyGV+rcTs=;
> > > >
> > > > > > h=Date:From:To:Subject;
> > > > >
> > > > >
> > b=ex87f2OAPGbMz0sU6XWbhYCD03Et+mEjtKr925BfRPT5HgYLDlL8HqB+ZrCXHJwY
> > > > > F
> > > > >
> > > > >
> > YeklCaEhAz5eGuRaDcJThrwidzLyqdC8pAErnLbc49SmF0HIafTMMmnqxkhRqYefqz
> > > > >
> > > > > > EKNjrsrHGMMqNKqMUApcumMBXGt8zKEXw/S9HlrE=
> > > > > >
> > > > > > MIME-Version: 1.0
> > > > > > Content-Type: multipart/alternative;
> > > > > > boundary="=_75de8e069c6b4423276ecc8efe3eaa14"
> > > > > > Date: Mon, 06 Aug 2018 14:33:37 +0300
> > > > > > From: Dobril Dobrilov <dobril at stanga.net>
> > > > > > To: dobril at stanga.net
> > > > > > Subject: Test2
> > > > > > Organization: StangaOne1
> > > > > > Message-ID: <e836f2d9d2be88a49da5da675eba919e at stanga.net>
> > > > > > X-Sender: dobril at stanga.net
> > > > > > User-Agent: Roundcube Webmail/1.3.7
> > > > > >
> > > > > > Msg from Mail Client
> > > > > > Received: from DL (unknown [192.168.0.222])
> > > > > >
> > > > > > (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384
> > > > >
> > > > > (256/256 bits))
> > > > >
> > > > > > (No client certificate requested)
> > > > > > by mail.stanga.net (Postfix) with ESMTPSA id CB1BD62C84
> > > > > > for <dobril at stanga.net>; Mon, 6 Aug 2018 15:11:28
> > > >
> > > > +0300 (EEST)
> > > >
> > > > > > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
> > > > >
> > > > > d=stanga.net; s=mail;
> > > > >
> > > > > > t=1533557488;
> > > >
> > > > bh=PuTju5S6EPeO7sbRMZ/5jISvR+vw7+9AwwsxuKLvTZ8=;
> > > >
> > > > > > h=From:To:Subject:Date;
> > > > >
> > > > >
> > b=IcMCXoZ3cdkehwkEMYfCytEDcgduiWi8Bats1ypadvf6hD/Mq/I0s7k6Lc3lBzJp
> > > > > N
> > > > >
> > > > >
> > FNopdMhbJ7HQ1irLN8fyHRvMPFzyCAE3rPZjIDm1Olf23G4E510mYtRvE1A/i1Dt0a
> > > > >
> > > > > > rHJVnjxltdYZ6+aaENwzE/oXaaO1XSW1zaSciN6k=
> > > > > >
> > > > > > From: "DobriL Dobrilov" <dobril at stanga.net>
> > > > > > To: "'DobriL Dobrilov'" <dobril at stanga.net>
> > > > > > Subject: Test
> > > > > > Date: Mon, 6 Aug 2018 15:11:34 +0300
> > > > > > Message-ID: <00f901d42d7e$9e87dbe0$db9793a0$@stanga.net>
> > > > > > MIME-Version: 1.0
> > > > > > Content-Type: multipart/mixed;
> > > > > >
> > > > > > boundary="----=_NextPart_000_00FA_01D42D97.C3D513E0"
> > > > > >
> > > > > > X-Mailer: Microsoft Outlook 16.0
> > > > > > Thread-Index: AdQtfptmFdgLS/d8QKixvWPS7nKlOQ==
> > > > > > Content-Language: bg
> > > > >
> > > > > > X-MS-TNEF-Correlator:
> > > > > 000000005234E38E73D4914094E5D7D34B79F6A564F78F00
> > > > >
> > > > > Is one of the above emails an example which causes the
> > > >
> > > > problem and the
> > > >
> > > > > other an example which does not cause the problem (if so,
> > > >
> > > > which one is
> > > >
> > > > > which)?
> > > > >
> > > > > Or are both the above emails examples which do not cause
> > > >
> > > > the problem
> > > >
> > > > > (in which case please send us the headers from one which does
> > > > > cause the problem)?
> > > > >
> > > > >
> > > > > Regards,
> > > > >
> > > > >
> > > > > Antony.
> > > > >
> > > > > > -----Original Message-----
> > > > > > From: MailScanner
> > > > >
> > > > > [mailto:mailscanner-bounces+dobril=stanga.net at lists.mailscanne
> > > > > r.info] On
> > > > >
> > > > > > Behalf Of Antony Stone Sent: Monday, August 6, 2018 3:01 PM
> > > > > > To: MailScanner Discussion
> > <mailscanner at lists.mailscanner.info>
> > > > > > Subject: Re: MailScanner: Message attempted to kill
> > MailScanner
> > > > > >
> > > > > > On Monday 06 August 2018 at 13:55:36, DobriL Dobrilov wrote:
> > > > > > > Some other ideas, because unfortunately this Live system
> > > > >
> > > > > and It's very
> > > > >
> > > > > > > critical ?
> > > > > >
> > > > > > When did the problem start happening?
> > > > > >
> > > > > > What changed on the MS server around that time?
> > > > > >
> > > > > > Can you show us full headers of an example email from
> > > > >
> > > > > webmail (which MS
> > > > >
> > > > > > can't process) and another one to and from the same
> > > > >
> > > > > addresses, but not
> > > > >
> > > > > > from webmail (which MS processes okay)?
> > > > > >
> > > > > > Antony
> > > > >
> > > > > --
> > > > > Neurotics build castles in the sky; Psychotics live in them;
> > > > > Psychiatrists collect the rent.
> > > > >
> > > > >
> > Please reply to
> > > > >
> > > > > the list;
> > > > >
> > > > > please *don't* CC me.
> > > > >
> > > > >
> > > > > --
> > > > > MailScanner mailing list
> > > > > mailscanner at lists.mailscanner.info
> > > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > > >
> > > > --
> > > > MailScanner mailing list
> > > > mailscanner at lists.mailscanner.info
> > > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> > >
> > > --
> > > MailScanner mailing list
> > > mailscanner at lists.mailscanner.info
> > > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >
> > --
> > MailScanner mailing list
> > mailscanner at lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >
> >
> > --
> > MailScanner mailing list
> > mailscanner at lists.mailscanner.info
> > http://lists.mailscanner.info/mailman/listinfo/mailscanner
> >
> >
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>
--
Shawn Iverson, CETL
Director of Technology
Rush County Schools
765-932-3901 x1171
iversons at rushville.k12.in.us
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20180806/e47e0347/attachment.html>
More information about the MailScanner
mailing list