From anoman at merlin.mb.ca  Mon May  1 18:33:53 2023
From: anoman at merlin.mb.ca (Abdullah Al Noman)
Date: Mon, 1 May 2023 18:33:53 +0000
Subject: Integrating MailScanner in django App for web GUI
Message-ID: <YT2PR01MB977833BA4207DA43C77B5CF8E46E9@YT2PR01MB9778.CANPRD01.PROD.OUTLOOK.COM>


Hello there,

I am a Junior developer and I am working on a project for my company where they would like to build an email filtering system using MailScanner. So, I am starting from the scratch and have been struggling a lot to kick off the project. I am wondering if there are any documentation or resources available on how to integrate MailScanner in a Django application or if there are any python libraries available. Any help would be really appreciated.

Kind Regards,

Abdullah

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230501/3f9a9b33/attachment.html>

From mark at msapiro.net  Tue May  2 03:33:41 2023
From: mark at msapiro.net (Mark Sapiro)
Date: Mon, 1 May 2023 20:33:41 -0700
Subject: Integrating MailScanner in django App for web GUI
In-Reply-To: <YT2PR01MB977833BA4207DA43C77B5CF8E46E9@YT2PR01MB9778.CANPRD01.PROD.OUTLOOK.COM>
References: <YT2PR01MB977833BA4207DA43C77B5CF8E46E9@YT2PR01MB9778.CANPRD01.PROD.OUTLOOK.COM>
Message-ID: <fcd8b5f0-b412-6c18-16db-1dda9d02d4d1@msapiro.net>

On 5/1/23 11:33, Abdullah Al Noman wrote:
> Hello there,
> 
> I am a Junior developer and I am working on a project for my company 
> where they would like to build an email filtering system using 
> MailScanner. So, I am starting from the scratch and have been struggling 
> a lot to kick off the project. I am wondering if there are any 
> documentation or resources available on how to integrate MailScanner in 
> a Django application or if there are any python libraries available. Any 
> help would be really appreciated.


The short answer to your questions is No.

As far as a Django application is concerned, MailScanner per se has no 
web UI, so what exactly would you want in a Django application?

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan


From anoman at merlin.mb.ca  Tue May  2 13:57:57 2023
From: anoman at merlin.mb.ca (Abdullah Al Noman)
Date: Tue, 2 May 2023 13:57:57 +0000
Subject: Integrating MailScanner in django App for web GUI
In-Reply-To: <fcd8b5f0-b412-6c18-16db-1dda9d02d4d1@msapiro.net>
References: <YT2PR01MB977833BA4207DA43C77B5CF8E46E9@YT2PR01MB9778.CANPRD01.PROD.OUTLOOK.COM>
 <fcd8b5f0-b412-6c18-16db-1dda9d02d4d1@msapiro.net>
Message-ID: <YT2PR01MB9778BEA73875EEAE24007888E46F9@YT2PR01MB9778.CANPRD01.PROD.OUTLOOK.COM>

I would like to build an interface to use MailScanner instead of just command line utilities. The functionalities would be to see which emails are quarantined, which are in the black/white list etc. 

Kind Regards,

Abdullah 


-----Original Message-----
From: MailScanner <mailscanner-bounces+anoman=merlin.mb.ca at lists.mailscanner.info> On Behalf Of Mark Sapiro
Sent: Monday, May 1, 2023 10:34 PM
To: mailscanner at lists.mailscanner.info
Subject: Re: Integrating MailScanner in django App for web GUI

On 5/1/23 11:33, Abdullah Al Noman wrote:
> Hello there,
> 
> I am a Junior developer and I am working on a project for my company 
> where they would like to build an email filtering system using 
> MailScanner. So, I am starting from the scratch and have been 
> struggling a lot to kick off the project. I am wondering if there are 
> any documentation or resources available on how to integrate 
> MailScanner in a Django application or if there are any python 
> libraries available. Any help would be really appreciated.


The short answer to your questions is No.

As far as a Django application is concerned, MailScanner per se has no web UI, so what exactly would you want in a Django application?

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan



--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner


From mailscanner at feedmebits.nl  Tue May  2 14:04:08 2023
From: mailscanner at feedmebits.nl (Maarten)
Date: Tue, 02 May 2023 16:04:08 +0200
Subject: Integrating MailScanner in django App for web GUI
In-Reply-To: <YT2PR01MB9778BEA73875EEAE24007888E46F9@YT2PR01MB9778.CANPRD01.PROD.OUTLOOK.COM>
References: <YT2PR01MB977833BA4207DA43C77B5CF8E46E9@YT2PR01MB9778.CANPRD01.PROD.OUTLOOK.COM>
 <fcd8b5f0-b412-6c18-16db-1dda9d02d4d1@msapiro.net>
 <YT2PR01MB9778BEA73875EEAE24007888E46F9@YT2PR01MB9778.CANPRD01.PROD.OUTLOOK.COM>
Message-ID: <29626a30d5397cb62367cf0541f3e2e4@feedmebits.nl>

It already exists:

https://mailwatch.org
https://github.com/mailwatch/MailWatch

On 2023-05-02 15:57, Abdullah Al Noman wrote:
> I would like to build an interface to use MailScanner instead of just
> command line utilities. The functionalities would be to see which
> emails are quarantined, which are in the black/white list etc.
> 
> Kind Regards,
> 
> Abdullah
> 
> 
> -----Original Message-----
> From: MailScanner
> <mailscanner-bounces+anoman=merlin.mb.ca at lists.mailscanner.info> On
> Behalf Of Mark Sapiro
> Sent: Monday, May 1, 2023 10:34 PM
> To: mailscanner at lists.mailscanner.info
> Subject: Re: Integrating MailScanner in django App for web GUI
> 
> On 5/1/23 11:33, Abdullah Al Noman wrote:
>> Hello there,
>> 
>> I am a Junior developer and I am working on a project for my company
>> where they would like to build an email filtering system using
>> MailScanner. So, I am starting from the scratch and have been
>> struggling a lot to kick off the project. I am wondering if there are
>> any documentation or resources available on how to integrate
>> MailScanner in a Django application or if there are any python
>> libraries available. Any help would be really appreciated.
> 
> 
> The short answer to your questions is No.
> 
> As far as a Django application is concerned, MailScanner per se has no
> web UI, so what exactly would you want in a Django application?
> 
> --
> Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
> San Francisco Bay Area, California    better use your sense - B. Dylan
> 
> 
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner


From Andy.Macheta at warwick.ac.uk  Tue May  2 15:28:01 2023
From: Andy.Macheta at warwick.ac.uk (Macheta, Andy)
Date: Tue, 2 May 2023 15:28:01 +0000
Subject: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!
Message-ID: <AS4PR01MB89670A3B714049ADB0ACF2B9DF6F9@AS4PR01MB8967.eurprd01.prod.exchangelabs.com>

Hi all,
I'm hoping someone on the list can provide some fix for this as I'm struggling to!

I'm running a test VM (Alma Linux 9) with Spamassassin/Postfix/MailScanner/clamd at scan but it looks like the problem is with the socket even though it exists and has the right permissions:

srw-rw----. 1 clamscan virusgroup 0 May  2 15:09 /var/run/clamd.scan/clamd.sock

If I run /usr/lib/MailScanner/wrapper/clamav-wrapper /usr /tmp
it finds the EISCAR test virus in /tmp which makes me think that clamav install is all OK

The error message I'm seeing in 'Mailscanner --lint' is:

Virus Scanning: No virus scanners worked, so message batch will be tried again at /usr/share/MailScanner/perl/MailScanner/SweepViruses.pm line 583.
Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting! at /usr/share/MailScanner/perl/MailScanner/SweepViruses.pm line 2413.

Thanks in advance for any help/guidance.

Andy

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230502/b0b169b5/attachment.html>

From mailscanner-list at okla.com  Tue May  2 15:33:34 2023
From: mailscanner-list at okla.com (Tracy Greggs)
Date: Tue, 02 May 2023 15:33:34 +0000
Subject: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!
In-Reply-To: <AS4PR01MB89670A3B714049ADB0ACF2B9DF6F9@AS4PR01MB8967.eurprd01.prod.exchangelabs.com>
References: <AS4PR01MB89670A3B714049ADB0ACF2B9DF6F9@AS4PR01MB8967.eurprd01.prod.exchangelabs.com>
Message-ID: <emabfde2ae-f79b-45b1-bb0d-76b3213ec38d@18f84ba8.com>

Running under Ubuntu but my lock file is /var/run/clamav/clamd.ctl

MailScanner.conf:Clamd Socket = /var/run/clamav/clamd.ctl

srw-rw-rw-  1 clamav mtagroup    0 Apr 15 10:42 clamd.ctl

This is MailScanner version 5.4.4

ClamdTOP version 0.103.8   Tue May  2 10:33:03 2023
NO CONNTIME LIV IDL QUEUE  MAXQ   MEM ENGINE  DBVER DBTIME        HOST
  1 00:00:12  12  11     0     0 1.54G 0.103.8 26894 2023-05-02T02 local

Details for Clamd version:  ClamAV 0.103.8/26894/Tue May  2 02:23:02 
2023


------ Original Message ------
>From "Macheta, Andy via MailScanner" 
<mailscanner at lists.mailscanner.info>
To "mailscanner at lists.mailscanner.info" 
<mailscanner at lists.mailscanner.info>
Cc "Macheta, Andy" <Andy.Macheta at warwick.ac.uk>
Date 5/2/2023 10:28:01 AM
Subject Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!

>Hi all,
>I'm hoping someone on the list can provide some fix for this as I'm 
>struggling to!
>
>I'm running a test VM (Alma Linux 9) with 
>Spamassassin/Postfix/MailScanner/clamd at scan but it looks like the 
>problem is with the socket even though it exists and has the right 
>permissions:
>
>srw-rw----. 1 clamscan virusgroup 0 May  2 15:09 
>/var/run/clamd.scan/clamd.sock
>
>If I run /usr/lib/MailScanner/wrapper/clamav-wrapper /usr /tmp
>it finds the EISCAR test virus in /tmp which makes me think that clamav 
>install is all OK
>
>The error message I'm seeing in 'Mailscanner --lint' is:
>
>Virus Scanning: No virus scanners worked, so message batch will be 
>tried again at /usr/share/MailScanner/perl/MailScanner/SweepViruses.pm 
>line 583.
>Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting! at 
>/usr/share/MailScanner/perl/MailScanner/SweepViruses.pm line 2413.
>
>Thanks in advance for any help/guidance.
>
>Andy
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230502/dd84380e/attachment.html>

From mark at msapiro.net  Tue May  2 15:58:59 2023
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 2 May 2023 08:58:59 -0700
Subject: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!
In-Reply-To: <AS4PR01MB89670A3B714049ADB0ACF2B9DF6F9@AS4PR01MB8967.eurprd01.prod.exchangelabs.com>
References: <AS4PR01MB89670A3B714049ADB0ACF2B9DF6F9@AS4PR01MB8967.eurprd01.prod.exchangelabs.com>
Message-ID: <30c1d268-08e6-8963-b19e-1bc0f6be079b@msapiro.net>

On 5/2/23 08:28, Macheta, Andy via MailScanner wrote:
> 
> I'm running a test VM (Alma Linux 9) with 
> Spamassassin/Postfix/MailScanner/clamd at scan but it looks like the 
> problem is with the socket even though it exists and has the right 
> permissions:
> 
> srw-rw----. 1 clamscan virusgroup 0 May ?2 15:09 
> /var/run/clamd.scan/clamd.sock


What is your setting for `Run As Group`? Is that group a member of 
`virusgroup`?


-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan


From Andy.Macheta at warwick.ac.uk  Tue May  2 19:43:45 2023
From: Andy.Macheta at warwick.ac.uk (Macheta, Andy)
Date: Tue, 2 May 2023 19:43:45 +0000
Subject: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!
In-Reply-To: <30c1d268-08e6-8963-b19e-1bc0f6be079b@msapiro.net>
References: <AS4PR01MB89670A3B714049ADB0ACF2B9DF6F9@AS4PR01MB8967.eurprd01.prod.exchangelabs.com>
 <30c1d268-08e6-8963-b19e-1bc0f6be079b@msapiro.net>
Message-ID: <AS4PR01MB8967D23D9024A020B8055E25DF6F9@AS4PR01MB8967.eurprd01.prod.exchangelabs.com>


Thanks Mark (and Tracy),

My 'Run As Group' was set to 'postfix' and this was not a member of 'virusgroup'.
I changed this from 'postfix' to 'virusgroup' and restarted MailScanner and it looks like it fixed things as I'm now getting mail flow to the inbox and extended mail headers show that it's being spam checked and
virus checked ?

Thank you!!!!
Best,

Andy
________________________________
From: MailScanner <mailscanner-bounces+andy.macheta=warwick.ac.uk at lists.mailscanner.info> on behalf of Mark Sapiro <mark at msapiro.net>
Sent: 02 May 2023 16:58
To: mailscanner at lists.mailscanner.info <mailscanner at lists.mailscanner.info>
Subject: Re: Cannot find Socket (/var/run/clamd.scan/clamd.sock) Exiting!

On 5/2/23 08:28, Macheta, Andy via MailScanner wrote:
>
> I'm running a test VM (Alma Linux 9) with
> Spamassassin/Postfix/MailScanner/clamd at scan but it looks like the
> problem is with the socket even though it exists and has the right
> permissions:
>
> srw-rw----. 1 clamscan virusgroup 0 May  2 15:09
> /var/run/clamd.scan/clamd.sock


What is your setting for `Run As Group`? Is that group a member of
`virusgroup`?


--
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan



--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230502/22a219fd/attachment.html>

From Jason at SYO.Com  Wed May  3 03:24:43 2023
From: Jason at SYO.Com (Jason Gottschalk)
Date: Tue, 2 May 2023 23:24:43 -0400
Subject: My System Filter is not working
Message-ID: <551899374.20230502232443@SYO.Com>

Hello Mailscanner,

?
?
I am trying to create a filter to rewrite the from and to of messages we send to our internal fax service.
?
My requirements are:
Determine if the message is from one of three allowed domains
If yes, then determine if the message is being sent to our fax software.
if yes, then
? ? change the from address to the address our fax software will respond to
? ??change the to address to the format our fax software knows how to handle
? ? add some headers for our own tracking.
?
This filter is in a new file in /usr/local/cpanel/etc/exim/sysfilter/options
?
?
This is what I have so far,?
?
if ($h_from: contains "@(companya.org|companyb.net|companyc.com)"
then if $h_to: contains "@fax.companya.org"
then
headers add "Actual-From: $h_from:"
headers remove From
headers add "From:?sendfax at companya.org"
headers remove Reply-To
headers add "Reply-To: $h_from"
headers add "Actual-To: $h_to:"
headers remove To
headers add "To: $local_part at companyc.com"
endif
endif
?
?
?
Any pointers or suggestions would be most appreciated!
?
Thanks
Jason
?
?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230502/74cc643f/attachment.html>

From mark at msapiro.net  Wed May  3 05:17:25 2023
From: mark at msapiro.net (Mark Sapiro)
Date: Tue, 2 May 2023 22:17:25 -0700
Subject: My System Filter is not working
In-Reply-To: <551899374.20230502232443@SYO.Com>
References: <551899374.20230502232443@SYO.Com>
Message-ID: <5df571be-a9b9-4fc6-6b67-7842aead4834@msapiro.net>

On 5/2/23 20:24, Jason Gottschalk wrote:
> Hello Mailscanner,
> 
> I am trying to create a filter to rewrite the from and to of messages we 
> send to our internal fax service.
> 
> My requirements are:
> 
> Determine if the message is from one of three allowed domains
> 
> If yes, then determine if the message is being sent to our fax software.
> 
> if yes, then
> 
>  ? ? change the from address to the address our fax software will respond to
> 
>  ? ??change the to address to the format our fax software knows how to 
> handle
> 
>  ? ? add some headers for our own tracking.
> 
> This filter is in a new file in /usr/local/cpanel/etc/exim/sysfilter/options
> 
> This is what I have so far,
> 
> if ($h_from: contains "@(companya.org|companyb.net|companyc.com)"
> 
> then if $h_to: contains "@fax.companya.org"
> 
> then
> 
> headers add "Actual-From: $h_from:"
> 
> headers remove From
> 
> headers add "From: sendfax at companya.org <sendfax at companya.org>"
> 
> headers remove Reply-To
> 
> headers add "Reply-To: $h_from"
> 
> headers add "Actual-To: $h_to:"
> 
> headers remove To
> 
> headers add "To: $local_part at companyc.com"
> 
> endif
> 
> endif
> 
> Any pointers or suggestions would be most appreciated!


This appears to be an exim question, unrelated to MailScanner.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan


From jp.methot at planethoster.info  Thu May  4 20:46:51 2023
From: jp.methot at planethoster.info (J-P Methot)
Date: Thu, 4 May 2023 16:46:51 -0400
Subject: Out of office email stuck in queue as MSMilter give out a 4.7.1
 Service unavailable
Message-ID: <cd218147-d559-0791-a38f-2caee116cf9d@planethoster.info>

Hi,

I'm testing Mailscanner 5.3.3 and Postfix 3.6.2. Postfix and Mailscanner 
are on two different servers. Everything works properly, except if I set 
an autoresponse in roundcube, the email gets stuck in the postfix queue 
with a temporary failure message :

milter-reject: MAIL from localhost[127.0.0.1]: 4.7.1 Service unavailable 
- try again later; from=<>

Postfix has three milter setup : opendkim, opendmarc and MSMilter, 
though that last one is written as an IP + port. If I remove MSMilter 
from the list, the email go through without issue. So what I understand 
is that the? Mailscanner milter is not even accepting my email to scan 
it, but instead rejecting it with a temporary failure message, as if the 
server was greylisted. Yet, nothing inside Mailscanner indicates that, 
as the email just sits in queue inside postfix on the origin server.


What could explain this behavior? I've tried setting Treat Invalid 
Watermarks With No Sender as Spam = nothing, but that didn't change 
anything and as far as I'm aware, the email isn't even given a score.


-- 
Jean-Philippe M?thot
Senior Openstack system administrator
Administrateur syst?me Openstack s?nior
PlanetHoster inc.


From jp.methot at planethoster.info  Fri May  5 18:31:42 2023
From: jp.methot at planethoster.info (J-P Methot)
Date: Fri, 5 May 2023 14:31:42 -0400
Subject: Out of office email stuck in queue as MSMilter give out a 4.7.1
 Service unavailable
In-Reply-To: <CACg3fsaA72cJNE5hw1nC=8Ja_LtcfHVHCGPBvhgJ5W=1bQgGdw@mail.gmail.com>
References: <cd218147-d559-0791-a38f-2caee116cf9d@planethoster.info>
 <CACg3fsaA72cJNE5hw1nC=8Ja_LtcfHVHCGPBvhgJ5W=1bQgGdw@mail.gmail.com>
Message-ID: <966691fa-52dc-ac32-d260-210efd3b21e3@planethoster.info>

I may have found something regarding this.

With debug enabled, I can see in the journalctl logs the following error 
every time the server should send me an autoresponse :

SMFIC_MAIL: bad packet

The message then repeat itself every minute or so until I manually 
discard messages in the queue, then it doesn't reappear. A google search 
for that error message leads me there:

https://github.com/avar/sendmail-pmilter/issues/5

We are indeed working with non-smtp mail in this case, so could it be 
hitting a similar bug? What I think could be happening is that postfix 
tries to flush its queue every minute or so but can't as it hits this 
bug, thus generating a recurring bad packet error in MSmilter.

On 5/4/23 18:16, Shawn Iverson wrote:
> I'm not sure why that is happening and may require setting Debug in 
> MailScanner and restarting msmilter to see what is happening via mail 
> log or journalctl.
>
> Another option since that is 127.0.0.1 is to set Milter Ignore 
> Loopback = true but I'm not sure you want that behavior since emails 
> will bypass MailScanner coming from the localhost.
>
>
>
> On Thu, May 4, 2023, 6:05 PM J-P Methot via MailScanner 
> <mailscanner at lists.mailscanner.info> wrote:
>
>     Hi,
>
>     I'm testing Mailscanner 5.3.3 and Postfix 3.6.2. Postfix and
>     Mailscanner
>     are on two different servers. Everything works properly, except if
>     I set
>     an autoresponse in roundcube, the email gets stuck in the postfix
>     queue
>     with a temporary failure message :
>
>     milter-reject: MAIL from localhost[127.0.0.1]: 4.7.1 Service
>     unavailable
>     - try again later; from=<>
>
>     Postfix has three milter setup : opendkim, opendmarc and MSMilter,
>     though that last one is written as an IP + port. If I remove MSMilter
>     from the list, the email go through without issue. So what I
>     understand
>     is that the? Mailscanner milter is not even accepting my email to
>     scan
>     it, but instead rejecting it with a temporary failure message, as
>     if the
>     server was greylisted. Yet, nothing inside Mailscanner indicates
>     that,
>     as the email just sits in queue inside postfix on the origin server.
>
>
>     What could explain this behavior? I've tried setting Treat Invalid
>     Watermarks With No Sender as Spam = nothing, but that didn't change
>     anything and as far as I'm aware, the email isn't even given a score.
>
>
>     -- 
>     Jean-Philippe M?thot
>     Senior Openstack system administrator
>     Administrateur syst?me Openstack s?nior
>     PlanetHoster inc.
>
>
>
>     -- 
>     MailScanner mailing list
>     mailscanner at lists.mailscanner.info
>     http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
-- 
Jean-Philippe M?thot
Senior Openstack system administrator
Administrateur syst?me Openstack s?nior
PlanetHoster inc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230505/1e4d82bf/attachment.html>

From adrian at pa0rda.nl  Tue May  9 09:12:09 2023
From: adrian at pa0rda.nl (Adrian van Bloois)
Date: Tue, 9 May 2023 11:12:09 +0200
Subject: When is 5.5.1.1 loose it's predicate (beta)?
Message-ID: <20230509091208.GA2031@pa0rda.nl>

It's been out there quite long now.


-- 
	Adri P. van Bloois


	It's never too late for early music!!!




From wbaudler at gb.nrao.edu  Tue May  9 19:50:01 2023
From: wbaudler at gb.nrao.edu (Wolfgang Baudler)
Date: Tue, 9 May 2023 15:50:01 -0400
Subject: MailScanner-5.4.5-3 ms-configure fails when building SpamAssassin
In-Reply-To: <3864fcbb-2ba1-15c2-8356-8d9895089813@zimbra.soltecsis.com>
References: <3864fcbb-2ba1-15c2-8356-8d9895089813@zimbra.soltecsis.com>
Message-ID: <fd08342f209d75b94a0e8b532c397806.squirrel@webmail.gb.nrao.edu>

When I run "/usr/sbin/ms-configure --update" after installing the latest
MailScanner-5.4.5-3.rhel.noarch.rpm (this is on a RHEL7.9 system, fully
patched), the ms-configure hangs for a while trying to build and test
Mail-SpamAssassin-4.000000 and then fails with this error:

Building and testing Mail-SpamAssassin-4.000000 ... FAIL
! Timed out (> 1800s). Use --verbose to retry.
Terminated

When I run a strace on one of the perl processes during the "hang" period,
I get these repeated syscalls:

select(8, [3 5], NULL, NULL, NULL)      = 1 (in [5])
read(5, "spam_pid not found: Sleeping 7 -"..., 65536) = 44
write(2, "spam_pid not found: Sleeping 7 -"..., 44) = 44
...

Looks like it is trying to start and test spamd, but fails for some reason.

Any insights why this might be happening? Thanks.

PS:
https://www.mail-archive.com/users at spamassassin.apache.org/msg110257.html
seems to mention the same issue on an Ubuntu system




From mailscanner-list at okla.com  Wed May 10 20:51:47 2023
From: mailscanner-list at okla.com (Tracy Greggs)
Date: Wed, 10 May 2023 20:51:47 +0000
Subject: Newish domains scoring
Message-ID: <emeada4bb1-eaae-409e-98e3-3eb73d0fd5d8@0df0371d.com>

I know this is a question for the SA users group but I wanted to throw 
it in here in the even anyone has any ideas or existing solutions.

So, here we go.

We almost never get any phishing email from domains over 1 year old.

We get a lot of phishing email from domains less than 1 year old.

I would love to be able to have an accurate way of scoring up email from 
domains less than fill in the blank days old.  In my case 380 days.  
This way we could review them for validity and release them if they are 
good.

An accurate way of performing this check would save us quite a bit of 
grief.

Ideas or solutions to this anyone?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230510/790913eb/attachment.html>

From peter.farrow at togethia.net  Wed May 10 20:58:33 2023
From: peter.farrow at togethia.net (Peter Farrow)
Date: Wed, 10 May 2023 21:58:33 +0100
Subject: Newish domains scoring
In-Reply-To: <emeada4bb1-eaae-409e-98e3-3eb73d0fd5d8@0df0371d.com>
References: <emeada4bb1-eaae-409e-98e3-3eb73d0fd5d8@0df0371d.com>
Message-ID: <2583274b-e71b-7920-f400-f2c8da14a97c@togethia.net>

Try these:

https://spameatingmonkey.com/services

SEM-FRESH? etc for domains registered recently.

On 10/05/2023 21:51, Tracy Greggs via MailScanner wrote:
> I know this is a question for the SA users group but I wanted to throw 
> it in here in the even anyone has any ideas or existing solutions.
>
> So, here we go.
>
> We almost never get any phishing email from domains over 1 year old.
>
> We get a lot of phishing email from domains less than 1 year old.
>
> I would love to be able to have an accurate way of scoring up email 
> from domains less than fill in the blank days old.? In my case 380 
> days.? This way we could review them for validity and release them if 
> they are good.
>
> An accurate way of performing this check would save us quite a bit of 
> grief.
>
> Ideas or solutions to this anyone?
>
>
-- 
	
Peter Farrow BEng(hons) BBC ETSI
Office: 01249 736180 | <tel:01249 736181>
Mobile: +44 (0) 7799605617 <tel:+44 (0) 7799605617>
Email: peter.farrow at togethia.net <mail:peter.farrow at togethia.net>
Website: www.togethia.it <https://www.togethia.it>
<https://facebook.com/togethiait> <skype:peter_farrow>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230510/920a80e5/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x67CA5C7785A4003A.asc
Type: application/pgp-keys
Size: 2456 bytes
Desc: OpenPGP public key
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230510/920a80e5/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 665 bytes
Desc: OpenPGP digital signature
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230510/920a80e5/attachment.sig>

From mailscanner-list at okla.com  Wed May 10 21:14:33 2023
From: mailscanner-list at okla.com (Tracy Greggs)
Date: Wed, 10 May 2023 21:14:33 +0000
Subject: {Disarmed} Re: {Disarmed} Re: Newish domains scoring
In-Reply-To: <2583274b-e71b-7920-f400-f2c8da14a97c@togethia.net>
References: <emeada4bb1-eaae-409e-98e3-3eb73d0fd5d8@0df0371d.com>
 <2583274b-e71b-7920-f400-f2c8da14a97c@togethia.net>
Message-ID: <em0ec23af7-16fa-4785-ba21-2486b09407a7@0df0371d.com>

Thanks Peter, this would help.


------ Original Message ------
From "Peter Farrow via MailScanner" <mailscanner at lists.mailscanner.info>
To "Tracy Greggs via MailScanner" <mailscanner at lists.mailscanner.info>
Cc "Peter Farrow" <peter.farrow at togethia.net>
Date 5/10/2023 3:58:33 PM
Subject {Disarmed} Re: Newish domains scoring

>Try these:
>
>https://spameatingmonkey.com/services
>
>SEM-FRESH  etc for domains registered recently.
>
>On 10/05/2023 21:51, Tracy Greggs via MailScanner wrote:
>>I know this is a question for the SA users group but I wanted to throw 
>>it in here in the even anyone has any ideas or existing solutions.
>>
>>So, here we go.
>>
>>We almost never get any phishing email from domains over 1 year old.
>>
>>We get a lot of phishing email from domains less than 1 year old.
>>
>>I would love to be able to have an accurate way of scoring up email 
>>from domains less than fill in the blank days old.  In my case 380 
>>days.  This way we could review them for validity and release them if 
>>they are good.
>>
>>An accurate way of performing this check would save us quite a bit of 
>>grief.
>>
>>Ideas or solutions to this anyone?
>>
>--
>Peter Farrow BEng(hons) BBC ETSI
>Office: 01249 736180 | <tel:01249 736181>
>Mobile: +44 (0) 7799605617 <tel:+44 (0) 7799605617>
>Email:MailScanner has detected a possible fraud attempt from 
>"mail:peter.farrow at togethia.net" claiming to be 
>peter.farrow at togethia.net <mail:peter.farrow at togethia.net>
>Website: www.togethia.it <https://www.togethia.it>
><https://facebook.com/togethiait> <skype:peter_farrow>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20230510/5d762259/attachment.html>

From thomasl at mtl.mit.edu  Tue May 16 13:50:02 2023
From: thomasl at mtl.mit.edu (Thomas Lohman)
Date: Tue, 16 May 2023 09:50:02 -0400
Subject: problem updating the bad/safe phishing site files
Message-ID: <040dba43-2c38-0cad-3300-2258d1cce348@mtl.mit.edu>

Hi,

This morning it looks like the safe site phishing file

BADURL='http://phishing.mailscanner.info/phishing.bad.sites.conf.gz';
SAFEURL='http://phishing.mailscanner.info/phishing.safe.sites.conf.gz';

has nothing listed in it although the file was updated/timestamped.

The bad site file looks like it updated OK.

Was there any recent change where those URLs are no longer valid or 
should be used?

thanks very much!

--tom