<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<style type="text/css">body {min-height: 100px}
</style>
</head><body style="">
<p>Hi Mailing-List,</p>
<p> </p>
<p>I have set up a new MS installation and do not manage to get filetype/filename checks working inseid of rar-archives.</p>
<p> </p>
<p> </p>
<p>I am using MS with postfix and ClamAV as virus scanner. I have added the SaneSecurity files for ClamAV also.</p>
<p> </p>
<p>The filetype checks are working fine on 7z-archives and zip-archives are also searched for unwanted filetypes. even Excel files are unpacked and checked. I understand, that clamav is not able to check RAR-archives anymore, right?</p>
<p> </p>
<p> </p>
<p> </p>
<p>This are the relevant setting ( I hope ;-)</p>
<p> Maximum Archive Depth = 8</p>
<p>Find Archives By Content = yes</p>
<p>Unpack Microsoft Documents = no</p>
<p>Archives Are = zip rar</p>
<p>Archives: Deny Filenames = \.com$ \.exe$ \.cpl$ \.pif$</p>
<p>Archives: Deny Filetypes = executable</p>
<p> </p>
<p> </p>
<p>This are my settings:</p>
<p> </p>
<p>[root@mailscanner MailScanner]# cat /etc/redhat-release</p>
<p>CentOS release 6.6 (Final)</p>
<p>[root@mailscanner MailScanner]# rpm -q postfix</p>
<p>postfix-2.6.6-6.el6_5.i686</p>
<p> </p>
<p>[root@mailscanner MailScanner]# MailScanner --lint</p>
<p>Trying to setlogsock(unix)</p>
<p> </p>
<p>Reading configuration file /etc/MailScanner/MailScanner.conf</p>
<p>Reading configuration file /etc/MailScanner/conf.d/README</p>
<p>Read 1084 hostnames from the phishing whitelist</p>
<p>Read 11741 hostnames from the phishing blacklists</p>
<p>Config: calling custom init function SQLBlacklist</p>
<p>Starting up SQL Blacklist</p>
<p>Read 250 blacklist entries</p>
<p>Config: calling custom init function MailWatchLogging</p>
<p>Started SQL Logging child</p>
<p>Config: calling custom init function SQLWhitelist</p>
<p>Starting up SQL Whitelist</p>
<p>Read 499 whitelist entries</p>
<p> </p>
<p>Checking version numbers...</p>
<p>Version number in MailScanner.conf (4.84.6) is correct.</p>
<p> </p>
<p>Your envelope_sender_header in spam.assassin.prefs.conf is correct.</p>
<p>MailScanner setting GID to (89)</p>
<p>MailScanner setting UID to (89)</p>
<p> </p>
<p>Checking for SpamAssassin errors (if you use it)...</p>
<p>Using SpamAssassin results cache</p>
<p>Connected to SpamAssassin cache database</p>
<p>bayes: cannot open bayes databases /var/spool/MailScanner/bayes/bayes_* R/O: tie failed: Permission denied</p>
<p>bayes: cannot open bayes databases /var/spool/MailScanner/bayes/bayes_* R/O: tie failed: Permission denied</p>
<p>pyzor: check failed: internal error, python traceback seen in response</p>
<p>SpamAssassin reported no errors.</p>
<p>Connected to Processing Attempts Database</p>
<p>Created Processing Attempts Database successfully</p>
<p>There are 6 messages in the Processing Attempts Database</p>
<p>Using locktype = posix</p>
<p>MailScanner.conf says "Virus Scanners = f-prot-6 clamd"</p>
<p>Found these virus scanners installed: clamavmodule, f-prot-6, sophossavi, mcafee6, clamd</p>
<p>===========================================================================</p>
<p>Filename Checks: Windows/DOSExecutable (1 eicar.com)</p>
<p>Completed checking by /usr/local/bin/file_wrapper at /usr/lib/MailScanner/MailScanner/SweepOther.pm line 488</p>
<p>Completed checking by /usr/local/bin/file_wrapper -i at /usr/lib/MailScanner/MailScanner/SweepOther.pm line 570</p>
<p>Filetype Checks: Allowing 1 eicar.com : identified as ASCII text</p>
<p>Filetype Mime Checks: Allowing 1 eicar.com (no match found)</p>
<p>Other Checks: Found 1 problems</p>
<p>Virus and Content Scanning: Starting</p>
<p>Scanning: /</p>
<p>[Found virus] <EICAR_Test_File (exact)> ./1/eicar.com at /usr/lib/MailScanner/MailScanner/SweepViruses.pm line 2530</p>
<p>Virus Scanning: F-Prot6 found 1 infections</p>
<p>Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com</p>
<p>Virus Scanning: Clamd found 2 infections</p>
<p>Infected message 1 came from 10.1.1.1</p>
<p>Virus Scanning: Found 3 viruses</p>
<p>===========================================================================</p>
<p>Virus Scanner test reports:</p>
<p>F-Prot6 said "[Found virus] <EICAR_Test_File (exact)> ./1/eicar.com"</p>
<p>Clamd said "eicar.com was infected: Eicar-Test-Signature"</p>
<p> </p>
<p>If any of your virus scanners (clamavmodule,f-prot-6,sophossavi,mcafee6,clamd)</p>
<p>are not listed there, you should check that they are installed correctly</p>
<p>and that MailScanner is finding them correctly via its virus.scanners.conf.</p>
<p>Config: calling custom end function SQLBlacklist</p>
<p>Closing down by-domain spam blacklist</p>
<p>Config: calling custom end function MailWatchLogging</p>
<p>Config: calling custom end function SQLWhitelist</p>
<p>Closing down by-domain spam whitelist</p>
<p>[root@mailscanner MailScanner]</p>
<p> </p>
<p> </p>
<p> </p>
<p>Best regards</p>
<p>Volker</p>
</body></html>