<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
<link href="chrome://translator/skin/floatingPanel.css"
type="text/css" rel="stylesheet">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<tt>Hi, </tt><tt><br>
</tt><tt><br>
</tt><tt>Hopefully I'm in the right place and someone can hel</tt><tt>p,
sorry if not its my first message. </tt><tt><br>
</tt><tt><br>
</tt><tt>I have installed CentOS 6.5 using Minimal, installed the
prerequisite rpm's via yum, <br>
installed 4.84.6-1 for RedHat/CentOS via rpm. I am using clam for
AV and SpamAssassin.</tt><tt><br>
</tt><tt><br>
</tt><tt>Have decided to go with Postfix as MTA and this all works,
mail comes in, <br>
eicar virus detected and stopped(clam). </tt><tt><br>
</tt><tt>But sending in exe as an exe is allowed through. Exe hidden
in Zip is allowed through. </tt><tt><br>
Normal emails just seem to bypass MailScanner even though the logs
show MailScanner operating.<br>
</tt><tt><br>
</tt><tt>I also notice that the Notice Signature is not being added
to the bottom of emails on clean messages, </tt><tt><br>
</tt><tt>BUT in I am getting the following in the headers:</tt><tt><br>
</tt>
<pre>X-tttttcouk-MailScanner-Information: Please contact the ISP for more information
X-tttttcouk-MailScanner-ID: BAF6FC104F.A0BC6
X-tttttcouk-MailScanner: Found to be clean
X-tttttcouk-MailScanner-From: <a class="moz-txt-link-abbreviated" href="mailto:mailscanner-bounces@lists.mailscanner.info">mailscanner-bounces@lists.mailscanner.info</a>
I have compared the configuration files to my previous server that ran MailScanner
fine and everything is the same, except that one used Sendmail rather than Postfix
Audit.log does not show any issues (SELinux is enabled, same problem if permissive).
MailScanner --lint does not show any issues.
I have turned on all the Log options, even tried setting debug = true and seeing what turns up
in the maillog, not a lot :-(
Mar 11 14:22:28 centos65 MailScanner[3651]: New Batch: Found 3 messages waiting
Mar 11 14:22:28 centos65 MailScanner[3651]: New Batch: Scanning 1 messages, 156910 bytes
Mar 11 14:22:28 centos65 MailScanner[3651]: Virus and Content Scanning: Starting
Mar 11 14:22:37 centos65 MailScanner[3651]: Virus Scanning completed at 16770 bytes per second
Mar 11 14:22:37 centos65 MailScanner[3651]: Spam Checks: Starting
Mar 11 14:22:37 centos65 MailScanner[3651]: Message 4A318C10B0.A72CD from 127.0.0.1 (<a class="moz-txt-link-abbreviated" href="mailto:root@centos65.localdomain">root@centos65.localdomain</a>) to centos65 is not spam, SpamAssassin (not cached, score=1.804, required 6, ALL_TRUSTED -1.00, DKIM_ADSP_NXDOMAIN 0.80, NO_DNS_FOR_FROM 0.38, SUBJ_ALL_CAPS 1.62)
Mar 11 14:22:37 centos65 MailScanner[3651]: Delivery of nonspam: message 4A318C10B0.A72CD from <a class="moz-txt-link-abbreviated" href="mailto:root@centos65.localdomain">root@centos65.localdomain</a> to chris@centos65 with subject TEST EMAIL
Mar 11 14:22:37 centos65 MailScanner[3651]: Spam Checks completed at 284783 bytes per second
Mar 11 14:22:38 centos65 MailScanner[3651]: Requeue: 4A318C10B0.A72CD to C10EEC105F
Mar 11 14:22:38 centos65 MailScanner[3651]: Uninfected: Delivered 1 messages
Mar 11 14:22:38 centos65 postfix/qmgr[2783]: C10EEC105F: from=<a class="moz-txt-link-rfc2396E" href="mailto:root@centos65.localdomain"><root@centos65.localdomain></a>, size=156672, nrcpt=1 (queue active)
Mar 11 14:22:38 centos65 MailScanner[3651]: Deleted 1 messages from processing-database
Mar 11 14:22:38 centos65 MailScanner[3651]: Batch completed at 15603 bytes per second (156910 / 10)
Mar 11 14:22:38 centos65 MailScanner[3651]: Batch (1 message) processed in 10.06 seconds
Mar 11 14:22:38 centos65 postfix/local[3897]: C10EEC105F: to=<a class="moz-txt-link-rfc2396E" href="mailto:chris@centos65.localdomain"><chris@centos65.localdomain></a>, orig_to=<chris@centos65>, relay=local, delay=11, delays=11/0.03/0/0.04, dsn=2.0.0, status=sent (delivered to maildir)
Mar 11 14:22:38 centos65 postfix/qmgr[2783]: C10EEC105F: removed
All the .conf are out of the box only other modded file is rules/spam.whitelist.rules
From: <a class="moz-txt-link-abbreviated" href="mailto:CUUSIIKKJEMEe@MWKEIEM.co.uk">CUUSIIKKJEMEe@MWKEIEM.co.uk</a> yes
From: <a class="moz-txt-link-abbreviated" href="mailto:AAAAs@mILKKKK.co.uk">AAAAs@mILKKKK.co.uk</a> yes
From: <a class="moz-txt-link-abbreviated" href="mailto:oIIIIIe@IIRKKE.co.uk">oIIIIIe@IIRKKE.co.uk</a> yes
From: *@MMMMMay.co.uk yes
From: *@KKKKKe.com yes
From: *@EEEDFFy.com yes
FromOrTo: default no
======= MailScanner.conf [edited]
Run As User = postfix
Run As Group = postfix
Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming
Incoming Work Dir = /var/spool/MailScanner/incoming
Quarantine Dir = /var/spool/MailScanner/quarantine
MTA = postfix
Sendmail = /usr/sbin/sendmail
Sendmail2 = /usr/sbin/sendmail
Allow Filenames =
Deny Filenames =
Filename Rules = %etc-dir%/filename.rules.conf
Allow Filetypes =
Allow File MIME Types =
Deny Filetypes =
Deny File MIME Types =
Filetype Rules = %etc-dir%/filetype.rules.conf
Archives: Allow Filenames =
Archives: Deny Filenames =
Archives: Filename Rules = %etc-dir%/archives.filename.rules.conf
Archives: Allow Filetypes =
Archives: Allow File MIME Types =
Archives: Deny Filetypes =
Archives: Deny File MIME Types =
Archives: Filetype Rules = %etc-dir%/archives.filetype.rules.conf
Hostname = the %org-name% ($HOSTNAME) MailScanner
Sign Messages Already Processed = no
Sign Clean Messages = yes
Mark Infected Messages = yes
Mark Unscanned Messages = yes
Unscanned Header Value = Not scanned: please contact your Internet E-Mail Service Provider for details
Notice Signature = -- \nMailScanner\nEmail Virus Scanner\nwww.mailscanner.info
Log Speed = yes
Log Spam = yes
Log Non Spam = yes
Log Delivery And Non-Delivery = yes
Log Permitted Filenames = yes
Log Permitted Filetypes = yes
Log Permitted File MIME Types = yes
Log Silent Viruses = yes
Log Dangerous HTML Tags = yes
Log SpamAssassin Rule Actions = yes
======= END MailScanner.conf
Many apologies for the length and hopefully someone is able to point me in the right direction.
Many Thanks,
Chris.
</pre>
<br>
<br>
<br>
<div style="bottom: auto; left: 803px; right: auto; top: 493px;
display: none;" class="translator-theme-default"
id="translator-floating-panel">
<div title="Click to translate"
id="translator-floating-panel-button"></div>
</div>
<br />--
<br />This message has been scanned for viruses and dangerous content by <a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is believed to be clean.
</body>
</html>