<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
..MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi Everyone,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am wondering if anyone would have any ideas as to why my mailscanners (I have 4 in total) would not block / quarantine attachments like .exe etc. I have been through all the configs and log files but I can’t find anything that points to a problem in my setup.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am running Mailscanner on Centos 6. MailScanner is version 4.84.6 and ClamAV is the Anti-Virus installed. Once the MailScanner works its magic on the incoming emails they are then relayed internally to an Exchange Server.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have not really changed much in the standard MailScanner.conf file. I have verified :<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Filename Rules = %etc-dir%/filename.rules.conf<o:p></o:p></p><p class=MsoNormal>Filetype Rules = %etc-dir%/filetype.rules.conf<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>And the 2 “default” Rules files exist and are standard out of the box.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>They contain :<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># These 2 added by popular demand - Very often used by viruses<o:p></o:p></p><p class=MsoNormal>deny \.com$ Windows/DOS Executable Executable DOS/Windows programs are dangerous in email<o:p></o:p></p><p class=MsoNormal>deny \.exe$ Windows/DOS Executable Executable DOS/Windows programs are dangerous in email<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My testing has so far been to use an external mail server to send an attached windows executable file (.exe) to an internal exchange account. I have tried both using an outlook external client and also a native Linux based web client with the same result (i.e. the exe file is delivered to the exchange account).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The maillog contains the follow entries when I send the test email in:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Nov 14 09:14:04 mailscanner postfix/smtpd[27736]: connect from unknown[XXX.XXX.XXX.XXX]<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:05 mailscanner postfix/smtpd[27736]: B32DF300F7A: client=unknown[XXX.XXX.XXX.XXX]<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:06 mailscanner postfix/cleanup[27980]: B32DF300F7A: hold: header Received: from XXXXX.XXX (unknown [XXX.XXX.XXX.XXX])??by mailscanner.XXXXX.XXX (Postfix) with SMTP id B32DF300F7A??for <jyoung@XXXXX.XXX>; Thu, 14 Nov 2013 09:14:05 +100 from unknown[XXX.XXX.XXX.XXX]; from=<jason@XXXXX.XXX> to=<jyoung@XXXXX.XXX> proto=SMTP helo=<XXXXX.XXXXX.XXX><o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:06 mailscanner postfix/cleanup[27980]: B32DF300F7A: message-id=<70df8fbcea6253ccee9a2a40329f09ce.squirrel@webmail.XXXXX.XXX><o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:08 mailscanner postfix/smtpd[27736]: disconnect from unknown[XXX.XXX.XXX.XXX]<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:09 mailscanner MailScanner[27843]: New Batch: Found 1 messages waiting<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:09 mailscanner MailScanner[27843]: New Batch: Scanning 1 messages, 151691 bytes<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:09 mailscanner MailScanner[27843]: Virus and Content Scanning: Starting<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:10 mailscanner MailScanner[27843]: Requeue: B32DF300F7A.AE0C2 to CCE03300F7F<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:10 mailscanner MailScanner[27843]: Uninfected: Delivered 1 messages<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:10 mailscanner postfix/qmgr[16933]: CCE03300F7F: from=<jason@XXXXX.XXX>, size=151040, nrcpt=1 (queue active)<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:10 mailscanner MailScanner[27843]: Deleted 1 messages from processing-database<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:10 mailscanner MailScanner[27843]: Logging message B32DF300F7A.AE0C2 to SQL<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:10 mailscanner MailScanner[20512]: B32DF300F7A.AE0C2: Logged to MailWatch SQL<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:11 mailscanner postfix/smtp[27944]: CCE03300F7F: to=<jyoung@XXXXX.XXX>, relay=10.10.10.12[10.10.10.12]:25, delay=5.9, delays=5.1/0/0/0.78, dsn=2.6.0, status=sent (250 2.6.0 <70df8fbcea6253ccee9a2a40329f09ce.squirrel@webmail.XXXXX.XXX> [InternalId=20096151978059] Queued mail for delivery)<o:p></o:p></p><p class=MsoNormal>Nov 14 09:14:11 mailscanner postfix/qmgr[16933]: CCE03300F7F: removed<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>And the email that arrives has the following header (extract):<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Content-Type: multipart/mixed; boundary="----=_20131114101356_40730"<o:p></o:p></p><p class=MsoNormal>X-Priority: 3 (Normal)<o:p></o:p></p><p class=MsoNormal>Importance: Normal<o:p></o:p></p><p class=MsoNormal>X-SXXXXXXXX-MailScanner-Information: Please contact the ISP for more information<o:p></o:p></p><p class=MsoNormal>X-SXXXXXXXX-MailScanner-ID: D5DB6FF800A.AF88E<o:p></o:p></p><p class=MsoNormal>X-SXXXXXXXX-MailScanner: Found to be clean<o:p></o:p></p><p class=MsoNormal>X-SXXXXXXXX-MailScanner-From: jason@XXXXX.XXX<o:p></o:p></p><p class=MsoNormal>X-Spam-Status: No, No<o:p></o:p></p><p class=MsoNormal>X-RXXXXXXXX -MailScanner-Information: Please contact the ISP for more information<o:p></o:p></p><p class=MsoNormal>X-RXXXXXXXX -MailScanner-ID: B32DF300F7A.AE0C2<o:p></o:p></p><p class=MsoNormal>X-RXXXXXXXX -MailScanner: Found to be clean<o:p></o:p></p><p class=MsoNormal>X-RXXXXXXXX -MailScanner-From: <a href="mailto:jason@XXXXX.XXX">jason@XXXXX.XXX</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Running MailScanner –lint gives the following output :<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>[root@mailscanner ~]# MailScanner --lint<o:p></o:p></p><p class=MsoNormal>Trying to setlogsock(unix)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Reading configuration file /etc/MailScanner/MailScanner.conf<o:p></o:p></p><p class=MsoNormal>Reading configuration file /etc/MailScanner/conf.d/README<o:p></o:p></p><p class=MsoNormal>Read 872 hostnames from the phishing whitelist<o:p></o:p></p><p class=MsoNormal>Read 6957 hostnames from the phishing blacklists<o:p></o:p></p><p class=MsoNormal>Config: calling custom init function MailWatchLogging<o:p></o:p></p><p class=MsoNormal>Started SQL Logging child<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Checking version numbers...<o:p></o:p></p><p class=MsoNormal>Version number in MailScanner.conf (4.84.6) is correct.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Your envelope_sender_header in spam.assassin.prefs.conf is correct.<o:p></o:p></p><p class=MsoNormal>MailScanner setting GID to (48)<o:p></o:p></p><p class=MsoNormal>MailScanner setting UID to (89)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Checking for SpamAssassin errors (if you use it)...<o:p></o:p></p><p class=MsoNormal>Using SpamAssassin results cache<o:p></o:p></p><p class=MsoNormal>Connected to SpamAssassin cache database<o:p></o:p></p><p class=MsoNormal>SpamAssassin reported no errors.<o:p></o:p></p><p class=MsoNormal>Connected to Processing Attempts Database<o:p></o:p></p><p class=MsoNormal>Created Processing Attempts Database successfully<o:p></o:p></p><p class=MsoNormal>There are 4 messages in the Processing Attempts Database<o:p></o:p></p><p class=MsoNormal>Using locktype = posix<o:p></o:p></p><p class=MsoNormal>MailScanner.conf says "Virus Scanners = clamd"<o:p></o:p></p><p class=MsoNormal>Found these virus scanners installed: clamd<o:p></o:p></p><p class=MsoNormal>===========================================================================<o:p></o:p></p><p class=MsoNormal>Filename Checks: Windows/DOS Executable (1 eicar.com)<o:p></o:p></p><p class=MsoNormal>Other Checks: Found 1 problems<o:p></o:p></p><p class=MsoNormal>Virus and Content Scanning: Starting<o:p></o:p></p><p class=MsoNormal>Clamd::INFECTED::Eicar-Test-Signature :: ../1/<o:p></o:p></p><p class=MsoNormal>Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com<o:p></o:p></p><p class=MsoNormal>Virus Scanning: Clamd found 2 infections<o:p></o:p></p><p class=MsoNormal>Infected message 1 came from 10.1.1.1<o:p></o:p></p><p class=MsoNormal>Virus Scanning: Found 2 viruses<o:p></o:p></p><p class=MsoNormal>===========================================================================<o:p></o:p></p><p class=MsoNormal>Virus Scanner test reports:<o:p></o:p></p><p class=MsoNormal>Clamd said "eicar.com was infected: Eicar-Test-Signature"<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If any of your virus scanners (clamd)<o:p></o:p></p><p class=MsoNormal>are not listed there, you should check that they are installed correctly<o:p></o:p></p><p class=MsoNormal>and that MailScanner is finding them correctly via its virus.scanners.conf.<o:p></o:p></p><p class=MsoNormal>Config: calling custom end function MailWatchLogging<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Does anyone have any ideas or suggestions as to why the attached files inbound are not being blocked. I am of course making the assumption that .exe file should by default be blocked <span style='font-family:Wingdings'>J</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Regards<o:p></o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-fareast-language:EN-AU'>Jason Young<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div>
<br /><br />
<hr style='border:none; color:#909090; background-color:#B0B0B0; height: 1px; width: 99%;' />
<table style='border-collapse:collapse;border:none;'>
<tr>
<td style='border:none;padding:0px 15px 0px 8px'>
<a href="http://www.avast.com/">
<img border=0 src="http://static.avast.com/emails/avast-mail-stamp.png" />
</a>
</td>
<td>
<p style='color:#3d4d5a; font-family:"Calibri","Verdana","Arial","Helvetica"; font-size:12pt;'>
This email is free from viruses and malware because <a href="http://www.avast.com/">avast! Antivirus</a> protection is active.
</p>
</td>
</tr>
</table>
<br />
</body></html>