Thanks Martin for the quick reply, i didn't find anything on <a href="http://wiki.mailscanner.info/">http://wiki.mailscanner.info/</a> <div><br></div><div>I'm actually using Maildir format for emails with postfix as mta, this is the filesystem structure for the quarantine files:</div>
<div><br></div><div><div>[root@mail quarantine]# ls -l 20120227/</div><div>total 420</div><div>drwxrwx---. 2 postfix clam 4096 Feb 27 00:41 00C2D202033.A443F</div><div>drwxrwx---. 2 postfix clam 4096 Feb 27 02:45 020CF202034.AD42E</div>
<div><br></div><div><div>[root@mail quarantine]# ls -l 20120227/00C2D202033.A443F/message </div><div>-rw-rw----. 1 postfix clam 80013 Feb 27 00:41 20120227/00C2D202033.A443F/message</div><div>[root@mail quarantine]#</div>
<div><br></div><div><br></div><div>i've tried to move the messages in /var/spool/postfix/incoming/ and changed the ownership but nothing happend.</div><div><br></div><div>*EDIT*</div><div><br></div><div>i've just noticed that since the update the mta is not delivering messages:</div>
<div><br></div><div>Found 250 messages in the Processing Attempts Database</div><div>Feb 27 18:11:56 mail MailScanner[12839]: Using locktype = flock</div><div>Feb 27 18:11:56 mail MailScanner[12839]: Warning: skipping message CFA4E2003F7.AF18F as it has been attempted too many times</div>
<div>Feb 27 18:11:56 mail MailScanner[12839]: Quarantined message CFA4E2003F7.AF18F as it caused MailScanner to crash several times</div><div>Feb 27 18:11:59 mail MailScanner[12844]: MailScanner E-Mail Virus Scanner version 4.84.3 starting...</div>
<div>Feb 27 18:11:59 mail MailScanner[12844]: Reading configuration file /etc/MailScanner/MailScanner.conf </div><div><br></div><div><br></div><div>my MailScanner --lint:</div><div><br></div><div><div>[root@mail bayes]# MailScanner --lint</div>
<div>Trying to setlogsock(unix)</div><div><br></div><div>Reading configuration file /etc/MailScanner/MailScanner.conf</div><div>Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*, skipping them. at /usr/share/MailScanner/MailScanner/Config.pm line 2044</div>
<div>Read 869 hostnames from the phishing whitelist</div><div>Read 5361 hostnames from the phishing blacklists</div><div>Config: calling custom init function SQLBlacklist</div><div>Starting up SQL Blacklist</div><div>Read 0 blacklist entries</div>
<div>Config: calling custom init function MailWatchLogging</div><div>Started SQL Logging child</div><div>Config: calling custom init function SQLWhitelist</div><div>Starting up SQL Whitelist</div><div>Read 0 whitelist entries</div>
<div><br></div><div>Checking version numbers...</div><div>Version number in MailScanner.conf (4.84.3) is correct.</div><div><br></div><div>Unrar is not installed, it should be in /usr/bin/unrar.</div><div>This is required for RAR archives to be read to check</div>
<div>filenames and filetypes. Virus scanning is not affected.</div><div><br></div><div><br></div><div>Your envelope_sender_header in spam.assassin.prefs.conf is correct.</div><div>MailScanner setting GID to (89)</div><div>
MailScanner setting UID to (89)</div><div><br></div><div>Checking for SpamAssassin errors (if you use it)...</div><div>Using SpamAssassin results cache</div><div>Connected to SpamAssassin cache database</div><div>bayes: cannot write to /etc/MailScanner/bayes/bayes_journal, bayes db update ignored: Permission denied</div>
<div>SpamAssassin reported no errors.</div><div>Connected to Processing Attempts Database</div><div>Created Processing Attempts Database successfully</div><div>There are 250 messages in the Processing Attempts Database</div>
<div>Using locktype = posix</div><div>MailScanner.conf says "Virus Scanners = clamd"</div><div>Found these virus scanners installed: clamd</div><div>===========================================================================</div>
<div>Filename Checks: Windows/DOS Executable (1 <a href="http://eicar.com">eicar.com</a>)</div><div>Other Checks: Found 1 problems</div><div>Virus and Content Scanning: Starting</div><div>Clamd::INFECTED::Eicar-Test-Signature :: ./1/</div>
<div>Clamd::INFECTED:: Eicar-Test-Signature :: ./1/<a href="http://eicar.com">eicar.com</a></div><div>Virus Scanning: Clamd found 2 infections</div><div>Infected message 1 came from 10.1.1.1</div><div>Virus Scanning: Found 2 viruses</div>
<div>===========================================================================</div><div>Virus Scanner test reports:</div><div>Clamd said "<a href="http://eicar.com">eicar.com</a> was infected: Eicar-Test-Signature"</div>
<div><br></div><div>If any of your virus scanners (clamd)</div><div>are not listed there, you should check that they are installed correctly</div><div>and that MailScanner is finding them correctly via its virus.scanners.conf.</div>
<div>Config: calling custom end function SQLBlacklist</div><div>Closing down by-domain spam blacklist</div><div>Config: calling custom end function MailWatchLogging</div><div>Config: calling custom end function SQLWhitelist</div>
<div>Closing down by-domain spam whitelist</div><div>[root@mail bayes]#</div></div><div><br><div class="gmail_quote">On 27 February 2012 16:09, Martin Hepworth <span dir="ltr"><<a href="mailto:maxsec@gmail.com">maxsec@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Depends on how u saved the file as mbox files or queue files<div><br></div><div>Should be info on the wiki on how to rerun depending on the mta etc </div>
<span class="HOEnZb"><font color="#888888"><div><br></div></font></span><div><span class="HOEnZb"><font color="#888888">Martin </font></span><div><div class="h5"><br><br>On Monday, 27 February 2012, Kocisky wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi all, <div><br></div><div>I had the same issue, updating the os it updated also that perl/archive package, my question now is how do i re run MailScanner over all the messages that have been quarantined?</div>
<div><br></div>
<div>in particular that perl/archive pkg was crashing because of docx and xlsx files, the problem is that all those are valid files/emails and i need to reprocess them.</div><div><br></div><div>Thanks!</div><div>Kociscky</div>
<div><br></div><div><div>Feb 27 15:29:04 mail MailScanner[30697]: Warning: skipping message CFA4E2003F7.AF18F as it has been attempted too many times</div><div>Feb 27 15:29:04 mail MailScanner[30697]: Quarantined message CFA4E2003F7.AF18F as it caused MailScanner to crash several times</div>
<div>Feb 27 15:29:07 mail MailScanner[30702]: MailScanner E-Mail Virus Scanner version 4.84.3 starting...</div></div><div><br><div class="gmail_quote">On 2 December 2011 01:32, Martin Hepworth <span dir="ltr"><<a>maxsec@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">That's a perl issue and patch<span><font color="#888888"><br><br>Martin</font></span><div>
<div><br><br><br>On Thursday, 1 December 2011, Michel Bulgado <<a>michel@casa.co.cu</a>> wrote:<br>> John Wilcock wrote:<br>
><br>> Le 01/12/2011 18:44, Michel Bulgado a écrit :<br>
><br>> Insecure dependency in chmod while running with -T switch at<br>> /usr/share/perl5/Archive/Zip/Member.pm line 490. Failed.<br>><br>> There's a patch for that in <a href="https://rt.cpan.org/Public/Bug/Display.html?id=61930" target="_blank">https://rt.cpan.org/Public/Bug/Display.html?id=61930</a><br>
><br>> Ok, i download the patch file, i see the patch is for perl files, so i ask , the problem is perl o MailScanner?<br>><br>> So, when a go to apply the patch, I get a error, he can't find the file 10_chmod.t<br>
><br>> [root@server MailScanner]# patch -p1 < patch_MailScanner.txt<br>> can't find file to patch at input line 5<br>> Perhaps you used the wrong -p or --strip option?<br>> The text leading up to this was:<br>
> --------------------------<br>> |diff --git a/lib/Archive/Zip/Member.pm b/lib/Archive/Zip/Member.pm<br>> |index f86ef75..4bb2171 100644<br>> |--- a/lib/Archive/Zip/Member.pm<br>> |+++ b/lib/Archive/Zip/Member.pm<br>
> --------------------------<br>> File to patch: /usr/share/perl5/Archive/Zip/Member.pm<br>> patching file /usr/share/perl5/Archive/Zip/Member.pm<br>> can't find file to patch at input line 46<br>> Perhaps you used the wrong -p or --strip option?<br>
> The text leading up to this was:<br>> --------------------------<br>> |diff --git a/t/10_chmod.t b/t/10_chmod.t<br>> |index 7ae647f..0495062 100644<br>> |--- a/t/10_chmod.t<br>> |+++ b/t/10_chmod.t<br>
> --------------------------<br>> File to patch:<br>> Skip this patch? [y] n<br>> File to patch:<br>> Skip this patch? [y] y<br>> Skipping patch.<br>> 1 out of 1 hunk ignored<br>> Searching for the 10_chmod.t, his belong to "perl-Archive-Zip", i have installed this packages from rpm : perl-Archive-Zip-1.30-2.el6.noarch<br>
><br>> Ideas?<br>><br>><br>><br><br></div></div><div><div>-- <br>-- <br>Martin Hepworth<br>Oxford, UK<br>
</div></div><br>--<br>
MailScanner mailing list<br>
<a>mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div><br></div>
</blockquote></div></div></div><div class="HOEnZb"><div class="h5"><br><br>-- <br>-- <br>Martin Hepworth<br>Oxford, UK<br>
</div></div><br>--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div><br></div></div></div>