First of all I know there have been lots of threads on this, I think I've seen them all and that's why I'm sending to the list, maybe someone out there can help...<div><br></div><div>Running Centos 6.3 and MailScanner 4.84.5 </div>
<div>in MailScanner.conf I have the following set up:</div><div><div><br></div><div>Run As Group = clamav</div><div>Incoming Work Group = clamav</div><div>Incoming Work Permissions = 0770 (I've tried 777 as well)</div>
<div><br></div><div>ClamAV is running as root</div></div><div>the permissions on the incoming dir look like this:</div><div><div>MailScanner]# ls -alF /var/spool/MailScanner/</div><div>total 20</div><div>drwxrwxr-x. 5 root root 4096 Mar 6 2012 ./</div>
<div>drwxrwxr-x. 16 root root 4096 Mar 6 2012 ../</div><div>drwxrwx---. 9 postfix clamav 4096 Nov 27 15:23 incoming/</div><div>drwxrwx---. 3 postfix clamav 4096 Nov 25 21:43 quarantine/</div><div>drwxrwx---. 2 postfix clamav 4096 Mar 7 2012 spamassassin/</div>
<div><br></div><div>The dirs that clamav is complaining about look like this:</div><div><br></div><div><div>MailScanner]# ls -alF /var/spool/MailScanner/incoming/</div><div>total 348</div><div>drwxrwx---. 9 postfix clamav 4096 Nov 27 15:23 ./</div>
<div>drwxrwxr-x. 5 root root 4096 Mar 6 2012 ../</div><div>drwxrwx---. 2 postfix clamav 4096 Nov 27 15:11 4374/</div><div>drwxrwx---. 2 postfix clamav 4096 Nov 27 15:11 4378/</div><div>drwxrwx---. 2 postfix clamav 4096 Nov 27 15:11 4379/</div>
<div>drwxrwx---. 2 postfix clamav 4096 Nov 27 15:12 4393/</div><div>drwxrwx---. 2 postfix clamav 4096 Nov 27 15:11 4397/</div></div><div><br></div><div>Clearly root should be able to do whatever he wishes with these files but the error persists, even if the clamd user is set to clamd?</div>
<div><br></div><div>This is happening on every email that is being sent but the emails do make it to their destination.</div><div><br></div><div>Here is the output of MailScanner --lint:</div><div><div>MailScanner --lint</div>
<div>Trying to setlogsock(unix)</div><div><br></div><div>Reading configuration file /etc/MailScanner/MailScanner.conf</div><div>Reading configuration file /etc/MailScanner/conf.d/README</div><div>Read 869 hostnames from the phishing whitelist</div>
<div>Read 4832 hostnames from the phishing blacklists</div><div><br></div><div>Checking version numbers...</div><div>Version number in MailScanner.conf (4.84.5) is correct.</div><div><br></div><div>Unrar is not installed, it should be in /usr/bin/unrar.</div>
<div>This is required for RAR archives to be read to check</div><div>filenames and filetypes. Virus scanning is not affected.</div><div><br></div><div><br></div><div>ERROR: The "envelope_sender_header" in your spam.assassin.prefs.conf</div>
<div>ERROR: is not correct, it should match X-data4-MailScanner-From</div><div><br></div><div>MailScanner setting GID to (488) **clamd</div><div>MailScanner setting UID to (89) **postfix</div><div><br></div><div>Checking for SpamAssassin errors (if you use it)...</div>
<div>Using SpamAssassin results cache</div><div>Connected to SpamAssassin cache database</div><div>SpamAssassin reported no errors.</div><div>Connected to Processing Attempts Database</div><div>Created Processing Attempts Database successfully</div>
<div>There are 0 messages in the Processing Attempts Database</div><div>Using locktype = posix</div><div>MailScanner.conf says "Virus Scanners = clamd"</div><div>Found these virus scanners installed: clamd</div>
<div>===========================================================================</div><div>Filename Checks: Windows/DOS Executable (1 <a href="http://eicar.com">eicar.com</a>)</div><div>Other Checks: Found 1 problems</div>
<div>Virus and Content Scanning: Starting</div><div>Clamd::ERROR:: UNKNOWN CLAMD RETURN ./lstat() failed: Permission denied. ERROR :: /var/spool/MailScanner/incoming/4911</div><div>Virus Scanning: Clamd found 1 infections</div>
<div>Virus Scanning: Found 1 viruses</div><div>===========================================================================</div><div><br></div><div>If any of your virus scanners (clamd)</div><div>are not listed there, you should check that they are installed correctly</div>
<div>and that MailScanner is finding them correctly via its virus.scanners.conf.</div></div><div><br></div><div>Sorry for the length of this, hope someone out there can help!</div><div><br></div><div><br></div><div><br></div>
<div><br></div></div><div><br></div><div><br></div><div><br></div><div><br></div>