<div dir="ltr">My bad, I misunderstood. Trying to get it to postmaster without rescanning with a null sender....I typically whitelist 127.0.0.1 instead of trying to whitelist the From: field.</div><br><div class="gmail_quote"><div dir="ltr">On Thu, Nov 1, 2018 at 9:52 AM Antony Stone <<a href="mailto:Antony.Stone@mailscanner.open.source.it">Antony.Stone@mailscanner.open.source.it</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Thursday 01 November 2018 at 14:46:53, Shawn Iverson via MailScanner wrote:<br>
<br>
> Notifications from mailer daemons are sent with a null return path<br>
> address. You should not send a notification back in this scenario.<br>
<br>
Is the OP trying to do that? I thought not.<br>
<br>
I thought the objective was to ensure that the notifications with the attached <br>
viruses were not re-scanned, but delivered to postmaster as-is.<br>
<br>
<br>
Antony.<br>
<br>
> This is a common spam vector as well, because spammers will hope you will<br>
> let the "notification" through since it does have a null return path.<br>
> <br>
> This is by design and avoids creating a mail loop, see RFC 1123, section<br>
> 5.3.3.<br>
> <br>
> <br>
> <br>
> On Thu, Nov 1, 2018 at 9:40 AM Nerijus Baliunas wrote:<br>
> > I added the rule:<br>
> > From: 127.0.0.1 and From: <a href="mailto:MAILER-DAEMON@mail.example.com" target="_blank">MAILER-DAEMON@mail.example.com</a> no<br>
> > <br>
> > It did not help.<br>
> > <br>
> > On Thu, 1 Nov 2018 12:55:16 +0100 Antony Stone wrote:<br>
> > > On Thursday 01 November 2018 at 12:42:50, Nerijus Baliunas wrote:<br>
> > > > I will paste the full message here:<br>
> > > The first thing that strikes me is that the original message does not<br>
> > > have "From: <a href="mailto:postmaster@example.com" target="_blank">postmaster@example.com</a>" - it is addressed to postmaster, but<br>
> > > the From address is <a href="mailto:MAILER-DAEMON@mail.example.com" target="_blank">MAILER-DAEMON@mail.example.com</a><br>
> > > <br>
> > > Try putting that into your virus_scanning.rules and see if things get<br>
> > > delivered as required.<br>
> > > <br>
> > > > The following e-mails were found to have: Virus Detected<br>
> > > > <br>
> > > > Sender:<br>
> > > > IP Address: 127.0.0.1<br>
> > > > <br>
> > > > Recipient: postmaster<br>
> > > > <br>
> > > > Subject: Mail delivery failed: returning message to sender<br>
> > > > <br>
> > > > MessageID: 58A002A14067.AE6A8<br>
> > > > <br>
> > > > Quarantine:<br>
> > /var/spool/MailScanner/quarantine/20181101/58A002A14067.AE6A8<br>
> > <br>
> > > > Report: Clamd: message was infected:<br>
> > > > winnow.spam.ts.xmailer.2.UNOFFICIAL<br>
> > > > <br>
> > > > Full headers are:<br>
> > > > Received: from <a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> (<a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> [127.0.0.1])<br>
> > > > <br>
> > > > by <a href="http://mail.example.com" rel="noreferrer" target="_blank">mail.example.com</a> (Postfix) with SMTP id 58A002A14067<br>
> > > > for <postmaster>; Thu, 1 Nov 2018 02:02:01 +0200 (EET)<br>
> > > > <br>
> > > > Subject: Mail delivery failed: returning message to sender<br>
> > > > From: Mail Delivery System <<a href="mailto:MAILER-DAEMON@mail.example.com" target="_blank">MAILER-DAEMON@mail.example.com</a>><br>
> > > > To: <a href="mailto:postmaster@mail.example.com" target="_blank">postmaster@mail.example.com</a><br>
> > > > MIME-Version: 1.0<br>
> > > > Content-Type: multipart/report; report-type=delivery-status;<br>
> > > > <br>
> > > > boundary="foo-mani-padme-hum-32284-1-1541030521"<br>
> > > > <br>
> > > > Message-Id: <<a href="mailto:20181101000201.58A002A14067@mail.example.com" target="_blank">20181101000201.58A002A14067@mail.example.com</a>><br>
> > > > Date: Thu, 1 Nov 2018 02:02:01 +0200 (EET)<br>
> > > > <br>
> > > > On Thu, 1 Nov 2018 13:38:16 +0200 Nerijus Baliunas wrote:<br>
> > > > > Hello,<br>
> > > > > <br>
> > > > > I have Virus Scanning = %rules-dir%/virus_scanning.rules<br>
> > > > > and in virus_scanning.rules:<br>
> > > > > From: 127.0.0.1 and From: <a href="mailto:postmaster@example.com" target="_blank">postmaster@example.com</a> no<br>
> > > > > <br>
> > > > > Today I got an email:<br>
> > > > > <br>
> > > > > The following e-mails were found to have: Virus Detected<br>
> > > > > <br>
> > > > > Sender:<br>
> > > > > IP Address: 127.0.0.1<br>
> > > > > <br>
> > > > > Recipient: postmaster<br>
> > > > > <br>
> > > > > Subject: Mail delivery failed: returning message to sender<br>
> > > > > <br>
> > > > > MessageID: 58A002A14067.AE6A8<br>
> > > > > <br>
> > > > > Quarantine:<br>
> > /var/spool/MailScanner/quarantine/20181101/58A002A14067.AE6A8<br>
> > <br>
> > > > > Report: Clamd: message was infected:<br>
> > > > > winnow.spam.ts.xmailer.2.UNOFFICIAL<br>
> > > > > <br>
> > > > > How to allow such messages to be received? There is no Sender<br>
> > > > > (Return-path:), how to adapt "From: 127.0.0.1 and From:<br>
> > > > > <a href="mailto:postmaster@example.com" target="_blank">postmaster@example.com</a> no" to also work with no From?<br>
<br>
-- <br>
Perfection in design is achieved not when there is nothing left to add, but <br>
rather when there is nothing left to take away.<br>
<br>
- Antoine de Saint-Exupery<br>
<br>
Please reply to the list;<br>
please *don't* CC me.<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr">Shawn Iverson, CETL<div>Director of Technology</div><div>Rush County Schools</div><div>765-932-3901 option 7</div><div><a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div><br></div><div><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_cy1OZFNIZ0drYVU&revid=0Bw5iD0ToYvs_UitIcHVIWkJVVTl2VGpxVUE0d0FQcHBIRXk4PQ" width="96" height="96" style="font-size:12.8px"><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_Zkh4eEs3R01yWXc&revid=0Bw5iD0ToYvs_QWpBK2Y2ajJtYjhOMDRFekZwK2xOamk5Q3Y0PQ" width="89" height="96"></div><div><img src="https://docs.google.com/uc?export=download&id=1aBrlQou4gjB04FY-twHN_0Dn3GHVNxqa&revid=0Bw5iD0ToYvs_RnQ0eDhHcm95WHBFdkNRbXhQRXpoYkR6SEEwPQ" style="font-size:12.8px"><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>