It did deliver it. The message listed below was something I sent to me from me as a test message. <br><br><div><span class="gmail_quote">On 7/31/07, <b class="gmail_sendername">Julian Field</b> <<a href="mailto:MailScanner@ecs.soton.ac.uk">
MailScanner@ecs.soton.ac.uk</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">But did it actually claim to deliver it?<br>
<br>Douglas Ward wrote:<br>> We have a properly functioning MailScanner server that I have recently<br>> downloaded the sanesecurity definitions to. I am hoping that it will<br>> reject the message the same way it does if there is a virus
<br>> detection. I have downloaded the update script and verified that the<br>> signature files are in the same location as the main clamav<br>> databases. I assume it is ok to have the following directory structure:
<br>><br>> [root@mailscanner MailScanner]# ls -lah /usr/local/share/clamav/<br>> total 4.4M<br>> drwxrwxr-x 4 clamav clamav 1.0K Jul 31 08:30 ./<br>> drwxr-xr-x 5 root root 1.0K Jul 3 17:09 ../<br>> drwxr-xr-x 2 clamav clamav
1.0K Jul 31 06:05 daily.inc/<br>> drwxr-xr-x 2 clamav clamav 1.0K Jul 20 13:07 main.inc/<br>> -rw------- 1 clamav clamav 1.4K Jul 31 08:30 mirrors.dat<br>> -rw-r--r-- 1 clamav clamav 514K Jul 31 07:50 MSRBL-Images.hdb
<br>> -rw-r--r-- 1 clamav clamav 224K Jul 31 05:15 MSRBL-SPAM.ndb<br>> -rw-rw-r-- 1 clamav clamav 1.1M Jul 31 08:07 phish.ndb<br>> -rw-rw-r-- 1 clamav clamav 182K Jul 31 03:19 phish.ndb.gz<br>> -rw-rw-r-- 1 clamav clamav
1.1M Jul 31 08:07 phish.old<br>> -rw-rw-r-- 1 clamav clamav 596K Jul 31 08:07 scam.ndb<br>> -rw-rw-r-- 1 clamav clamav 120K Jul 31 03:20 scam.ndb.gz<br>> -rw-rw-r-- 1 clamav clamav 596K Jul 31 08:07 scam.old<br>>
<br>><br>> This is what I am seeing in the log:<br>><br>> Jul 31 08:11:22 mailscanner MailScanner[12975]: Message<br>> C8DEF122D.8ACFF from 192.168.x.x (<a href="mailto:user@gmail.com">user@gmail.com</a><br>
> <mailto:<a href="mailto:user@gmail.com">user@gmail.com</a>>) to <a href="http://nccumc.org">nccumc.org</a> <<a href="http://nccumc.org">http://nccumc.org</a>> is not<br>> spam, SpamAssassin (not cached, score=-
0.909, required 6, AWL -0.53,<br>> BAYES_00 -2.60 , HTML_MESSAGE 0.00, TVD_SPACE_RATIO 2.22)<br>> Jul 31 08:11:23 mailscanner MailScanner[12975]:<br>> /var/spool/MailScanner/incoming/12975/./C8DEF122D.8ACFF/phish_sigtest.txt:
<br>> Html.Phishing.Sanesecurity.TestSig FOUND<br>> Jul 31 08:11:25 mailscanner MailScanner[12975]: Infected message<br>> C8DEF122D.8ACFF came from <<a href="http://192.168.10.25">http://192.168.10.25</a>><br>
> Jul 31 08:11:25 mailscanner MailScanner[12975]: Filename Checks:<br>> Allowing C8DEF122D.8ACFF msg-12975-4.txt<br>> Jul 31 08:11:25 mailscanner MailScanner[12975]: Filename Checks:<br>> Allowing C8DEF122D.8ACFF
phish_sigtest.txt<br>> Jul 31 08:11:25 mailscanner MailScanner[12975]: Filename Checks:<br>> Allowing C8DEF122D.8ACFF msg-12975-5.html (no rule matched)<br>> Jul 31 08:11:25 mailscanner MailScanner[12975]: Filetype Checks:
<br>> Allowing C8DEF122D.8ACFF msg-12975-4.txt<br>> Jul 31 08:11:25 mailscanner MailScanner[12975]: Filetype Checks:<br>> Allowing C8DEF122D.8ACFF msg-12975-5.html<br>> Jul 31 08:11:25 mailscanner MailScanner[12975]: Filetype Checks:
<br>> Allowing C8DEF122D.8ACFF phish_sigtest.txt<br>> Jul 31 08:11:25 mailscanner MailScanner[12975]: Logging message<br>> C8DEF122D.8ACFF to SQL<br>> Jul 31 08:11:25 mailscanner MailScanner[12900]: C8DEF122D.8ACFF
:<br>> Logged to MailWatch SQL<br>><br>> MailScanner dutifully sends the message on. It is flagged as a<br>> phishing scam but no action is taken. Is there something I need to<br>> change in MailScanner? It would appear that sanesecurity is doing its
<br>> job but the message still slips through. My apologies if this is not<br>> MailScanner related. I searched google, the clamav site, the<br>> sansecurity site and the MailScanner list archives extensively before
<br>> writing. I appreciate any help you could offer. Thank you.<br><br>Jules<br><br>--<br>Julian Field MEng CITP<br><a href="http://www.MailScanner.info">www.MailScanner.info</a><br>Buy the MailScanner book at <a href="http://www.MailScanner.info/store">
www.MailScanner.info/store</a><br><br>Need help customising MailScanner?<br>Contact me!<br>Need help fixing or optimising your systems?<br>Contact me!<br>Need help getting you started solving new requirements from your boss?
<br>Contact me!<br><br>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<br><br><br>--<br>This message has been scanned for viruses and<br>dangerous content by MailScanner, and is<br>believed to be clean.<br>
For all your IT requirements visit <a href="http://www.transtec.co.uk">www.transtec.co.uk</a><br><br>--<br>MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info
</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting
</a><br><br>Support MailScanner development - buy the book off the website!<br></blockquote></div><br>