Another log this time user1 sending to me, I didnt get the dangerous content message nor the Corrupt TNEF
winmail.dat that cannot be analysed in message AF5657FF98.75B99 <br><br>Sep 18 10:23:01 mailbeta MailScanner[31952]: Message BFF1F7FF98.052FB from <a href="http://10.10.10.49">10.10.10.49</a> (<a href="mailto:user1@mydomain.com.br">
user1@mydomain.com.br</a>) to <a href="http://mfplan.com.br">mfplan.com.br</a> is not spam, SpamAssassin (not cached, score=-103.754, required 3, autolearn=not spam, ALL_TRUSTED -1.80, AWL 0.53, BAYES_00 -2.60, HTML_90_100
0.11, HTML_MESSAGE 0.00, USER_IN_WHITELIST -100.00) <br>Sep 18 10:23:01 mailbeta MailScanner[31952]: Spam Checks completed at 3791 bytes per second <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Virus and Content Scanning: Starting
<br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --unzip <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --jar <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --tar
<br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --tgz <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --deb <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --max-ratio
<br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --tempdir <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --recursive (-r) <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: WARNING: Ignoring option --unrar
<br>Sep 18 10:23:02 mailbeta MailScanner[31952]: /var/spool/MailScanner/incoming/31952/.: lstat() failed. ERROR <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Filename Checks: Allowing BFF1F7FF98.052FB msg-31952-4.txt <br>
Sep 18 10:23:02 mailbeta MailScanner[31952]: Filename Checks: Allowing BFF1F7FF98.052FB msg-31952-5.html (no rule matched) <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Filename Checks: Allowing BFF1F7FF98.052FB COMUNICA%%C7%%C3O
IN.doc (no rule matched) <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Filetype Checks: Allowing BFF1F7FF98.052FB msg-31952-5.html <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Filetype Checks: Allowing BFF1F7FF98.052FB
msg-31952-4.txt <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Filetype Checks: Allowing BFF1F7FF98.052FB COMUNICA%%C7%%C3O IN.doc (no match found) <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Virus Scanning completed at 172635 bytes per second
<br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Requeue: BFF1F7FF98.052FB to D0A537FF9B <br>Sep 18 10:23:02 mailbeta postfix/qmgr[31781]: D0A537FF9B: from=<<a href="mailto:user1@mydomain.com.br">user1@mydomain.com.br</a>
>, size=46994, nrcpt=2 (queue active)<br>Sep 18 10:23:02 mailbeta postfix/virtual[32275]: D0A537FF9B: to=<<a href="mailto:getall@mydomain.com.br">getall@mydomain.com.br</a>>, relay=virtual, delay=13, delays=13/0.02/0/0.08, dsn=
2.0.0, status=sent (delivered to maildir)<br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Uninfected: Delivered 1 messages <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Virus Processing completed at 96012 bytes per second
<br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Batch completed at 3562 bytes per second (45049 / 12) <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Batch (1 message) processed in 12.65 seconds <br>Sep 18 10:23:02 mailbeta MailScanner[31952]: New Batch: Scanning 1 messages, 32156 bytes
<br>Sep 18 10:23:02 mailbeta MailScanner[31952]: Spam Checks: Starting <br>Sep 18 10:23:02 mailbeta postfix/virtual[32277]: D0A537FF9B: to=<<a href="mailto:teste@mydomain.com.br">teste@mydomain.com.br</a>>, relay=virtual, delay=13, delays=13/0.08/0/0.07, dsn=
2.0.0, status=sent (delivered to maildir)<br>Sep 18 10:23:02 mailbeta postfix/qmgr[31781]: D0A537FF9B: removed<br><br><div><span class="gmail_quote">2007/9/18, infolistas listas <<a href="mailto:grupolistas@gmail.com">
grupolistas@gmail.com</a>>:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">I was viewing the log I hope its usefull<br><br>---<br>
<br>Sep 18 09:34:44 mailbeta MailScanner[30405]: Message AF5657FF98.75B99 from <a href="http://10.10.10.49" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.10.10.49</a> (<a href="mailto:user1@mydomain.com.br" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
user1@mydomain.com.br
</a>) to <a href="http://mfplan.com.br" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mfplan.com.br</a> is not spam, SpamAssassin (not cached, score=-102.971, required 3, autolearn=not spam, ALL_TRUSTED -
1.80, AWL -0.38, BAYES_00 -2.60, BLANK_LINES_70_80 1.80, USER_IN_WHITELIST -
100.00) <br>Sep 18 09:34:44 mailbeta MailScanner[30405]: Spam Checks completed at 3925 bytes per second <br>Sep 18 09:34:44 mailbeta MailScanner[30405]: Expanding TNEF archive at /var/spool/MailScanner/incoming/30405/AF5657FF98.75B99/winmail.dat
<br>Sep 18 09:34:44 mailbeta MailScanner[30836]: TNEF decoder failed with real error: Can't run tnef decoder: Arquivo ou diretório inexistente at /usr/share/MailScanner/MailScanner/TNEF.pm line 238. <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Corrupt TNEF
winmail.dat that cannot be analysed in message AF5657FF98.75B99 <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Virus and Content Scanning: Starting <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --unzip
<br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --jar <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --tar <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --tgz
<br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --deb <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --max-ratio <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --tempdir
<br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --recursive (-r) <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: WARNING: Ignoring option --unrar <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: /var/spool/MailScanner/incoming/30405/.: lstat() failed. ERROR
<br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Filename Checks: Allowing AF5657FF98.75B99 msg-30405-6.txt <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Filename Checks: Allowing AF5657FF98.75B99 winmail.dat (no rule matched)
<br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Filename Checks: Allowing AF5657FF98.75B99 msg-30405-5.txt <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Filetype Checks: Allowing AF5657FF98.75B99 winmail.dat (no match found)
<br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Filetype Checks: Allowing AF5657FF98.75B99 msg-30405-6.txt <br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Filetype Checks: Allowing AF5657FF98.75B99 msg-30405-5.txt <br>
Sep 18 09:34:45 mailbeta MailScanner[30405]: Virus Scanning completed at 161675 bytes per second
<br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Requeue: AF5657FF98.75B99 to 8FBF77FF99 <br>Sep 18 09:34:45 mailbeta postfix/qmgr[30480]: 8FBF77FF99: from=<<a href="mailto:user1@mydomain.com.br" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
user1@mydomain.com.br</a>
>, size=2922, nrcpt=2 (queue active)<br>Sep 18 09:34:45 mailbeta MailScanner[30405]: Cleaned: Delivered 1 cleaned messages <br>Sep 18 09:34:45 mailbeta postfix/virtual[30737]: 8FBF77FF99: to=<<a href="mailto:user2@mydomain.com.br" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
user2@mydomain.com.br</a>>, relay=virtual, delay=17, delays=17/0.01/0/0.02, dsn=2.0.0, status=sent (delivered to maildir)<br>Sep 18 09:34:45 mailbeta postfix/virtual[30739]: 8FBF77FF99: to=<<a href="mailto:getall@mydomain.com.br" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
getall@mydomain.com.br</a>>, relay=virtual, delay=17, delays=17/0.01/0/0.02, dsn=2.0.0, status=sent (delivered to maildir)<br>Sep 18 09:34:45 mailbeta postfix/qmgr[30480]: 8FBF77FF99: removed<br>Sep 18 09:34:45 mailbeta postfix[30846]: error: to submit mail, use the Postfix sendmail command
<br>Sep 18 09:34:45 mailbeta postfix[30846]: fatal: the postfix command is reserved for the superuser<br>Sep 18 09:34:45 mailbeta imapd: Connection, ip=[::ffff:<a href="http://10.10.10.29" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
10.10.10.29</a>]<br><br><div><span class="gmail_quote">
2007/9/18, infolistas listas <<a href="mailto:grupolistas@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">grupolistas@gmail.com</a>>:</span><div><span class="e" id="q_11518b79d2f69902_1">
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
That user isnt sending anything more than is set on the rules. ( atachments of all type are allowed to be send). Only 9 users are allowed to send attachments outside,all attachments are allowed inside domain, that user is one of them, the problem is only with her and another specific user, thats from our own domain.
<br>how do I turn the dangerous content checking out? will it interfeer with the incoming checking of outside domain?<br>How can I make an exception for only one user?<br>I couldnt find anything, that pointed to the problem , the only thing strange is that the messages coming from that user to the other specific user where requeued, nor mailscanner nor spamassassin pointed anything diferent.
<br>Do you need logs?<br>Thanks<br><br><div><span class="gmail_quote">2007/9/17, Scott Silva <<a href="mailto:ssilva@sgvwater.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">ssilva@sgvwater.com
</a>>:</span><div><span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
infolistas listas spake the following on 9/17/2007 4:16 PM:<br>> Hi all,<br>> I'm getting a problem from a specific user,<br>> when this users send an email to another specific user the mail arrives<br>> with the { dangerous content} flag.
<br>> How can I solve this?<br>><br>><br>1) Tell user to stop sending dangerous content.<br>2) Write ruleset to exempt the user from dangerous content rules.<br>3) Turn off dangerous content checking.<br><br>You gave very limited info in your question, so I had to give a very general
<br>answer.<br><br>--<br><br>MailScanner is like deodorant...<br>You hope everybody uses it, and<br>you notice quickly if they don't!!!!<br><br>--<br>MailScanner mailing list<br><a href="mailto:mailscanner@lists.mailscanner.info" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mailscanner@lists.mailscanner.info</a><br><a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://lists.mailscanner.info/mailman/listinfo/mailscanner
</a><br><br>Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://wiki.mailscanner.info/posting</a><br><br>Support MailScanner development - buy the book off the website!<br></blockquote></span></div></div><br>
</blockquote></span></div></div><br>
</blockquote></div><br>