Possible bug in Spam Actions = deliver attachment

[Valentin Laskov]

Hi Shawn,

this is in maillog:

Apr 26 19:39:48 ns MailScanner[14367]: Spam Actions: message 
x3QGKubV014105 actions are deliver,header,attachment
Apr 26 19:44:31 ns MailScanner[14480]: Making attempt 6 at processing 
message x3QGKubV014105
Apr 26 19:44:36 ns MailScanner[14480]: Message x3QGKubV014105 from 
91.196.126.199 (info at somedomain.bg) to festa.bg is spam, SpamAssassin 
(not cached, score=4.956, required 3, BAYES_05 -0.50, FUZZY_XPILL 2.80, 
HTML_IMAGE_ONLY_20 1.55, HTML_MESSAGE 0.00, HTML_MIME_NO_HTML_TAG 0.38, 
MIME_HTML_ONLY 0.72, T_REMOTE_IMAGE 0.01)
Apr 26 19:44:36 ns MailScanner[14480]: Spam Actions: message 
x3QGKubV014105 actions are deliver,header,attachment
Apr 26 19:44:37 ns MailScanner[12651]: Warning: skipping message 
x3QGKubV014105 as it has been attempted too many times
Apr 26 19:44:37 ns MailScanner[12651]: Quarantined message 
x3QGKubV014105 as it caused MailScanner to crash several times
Apr 26 19:44:37 ns MailScanner[12651]: Saved entire message to 
/var/spool/MailScanner/quarantine/20190426/x3QGKubV014105

Yesterday I removed "attachment" but forgot to delete custom.conf~ made 
by joe text editor and this overrided my changes in custom.conf

Will see and write tomorrow.

Now I saw this ERROR: The "envelope_ ... in

root at ns:/home/laskov# MailScanner --lint
Trying to setlogsock(unix)
Skipping Custom Function file CustomAction.pm.orig as its name does not 
end in .pm or .pl

Reading configuration file /etc/MailScanner/MailScanner.conf
Reading configuration file /etc/MailScanner/conf.d/README
Reading configuration file /etc/MailScanner/conf.d/custom.laskov.conf
Read 1501 hostnames from the phishing whitelist
Read 16624 hostnames from the phishing blacklists

Checking version numbers...
Version number in MailScanner.conf (5.1.3) is correct.

ERROR: The "envelope_sender_header" in your spamassassin.conf
ERROR: is not correct, it should match X-FestaHolding-MailScanner-From


Checking for SpamAssassin errors (if you use it)...
Using SpamAssassin results cache
Connected to SpamAssassin cache database
SpamAssassin reported no errors.
Connected to Processing Attempts Database
Created Processing Attempts Database successfully
There are 0 messages in the Processing Attempts Database
Using locktype = posix
MailScanner.conf says "Virus Scanners = clamd"
mktemp: invalid option -- '-'
Usage: mktemp [-V] | [-dqtu] [-p prefix] [template]
Found these virus scanners installed: clamd
===========================================================================
Filename Checks: Windows/DOS Executable (1 eicar.com)
Other Checks: Found 1 problems
Virus and Content Scanning: Starting
Clamd::INFECTED::Eicar-Test-Signature :: ./1/
Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com
Virus Scanning: Clamd found 2 infections
Infected message 1 came from 10.1.1.1
Virus Scanning: Found 2 viruses
===========================================================================
Virus Scanner test reports:
Clamd said "eicar.com was infected: Eicar-Test-Signature"

If any of your virus scanners (clamd)
are not listed there, you should check that they are installed correctly
and that MailScanner is finding them correctly via its virus.scanners.conf.
root at ns:/home/laskov#

... and now it says

Your envelope_sender_header in spamassassin.conf is correct.

"...
mktemp: invalid option -- '-'
Usage: mktemp [-V] | [-dqtu] [-p prefix] [template]
..."

persists from many MailScanner versions in the past. My OS is Slackware 14-2

Regards

Valentin

На 26.04.19 г. в 17:13 ч., Shawn Iverson via MailScanner написа:
> Valentin,
>
> Is there any additional information in the mail log to help explain 
> the "Message attempted to kill MainScanner" message?
>
> On Thu, Apr 25, 2019 at 12:09 PM Valentin Laskov <it at festa.bg 
> <mailto:it at festa.bg>> wrote:
>
>     Hello,
>
>     Yesterday I updated MailScanner from 5.0.7 to 5.1.3
>
>     I noticed messages like this
>
>     Subject: Other Bad Content Detected
>
>     Report: MailScanner: Message attempted to kill MailScanner
>
>     All of letters causing this are Spam. In MailScanner.conf I have
>
>     Spam Actions = deliver attachment header "X-Spam-Status: Yes"
>
>     Letters are not delivered but quarantined.
>
>     Regards!
>
>     Valentin Laskov
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20190427/90103a11/attachment.html>