<div dir="ltr">Are the permissions the same alone the entire directory tree? from /var all the way down?<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 25, 2019 at 6:50 PM Kevin Miller <<a href="mailto:kevin.miller@juneau.org">kevin.miller@juneau.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_5629395854778121820WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">They are the same: 5.509 MIME::Parser<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">...Kevin<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">--<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">Kevin Miller<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">Network/email Administrator, CBJ MIS Dept.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">155 South Seward Street<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">Juneau, Alaska 99801<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10pt;font-family:"Tahoma","sans-serif""> MailScanner [mailto:<a href="mailto:mailscanner-bounces%2Bkevin.miller" target="_blank">mailscanner-bounces+kevin.miller</a>=<a href="mailto:juneau.org@lists.mailscanner.info" target="_blank">juneau.org@lists.mailscanner.info</a>]
<b>On Behalf Of </b>Shawn Iverson via MailScanner<br>
<b>Sent:</b> Monday, February 25, 2019 2:01 PM<br>
<b>To:</b> MailScanner Discussion<br>
<b>Cc:</b> Shawn Iverson<br>
<b>Subject:</b> Re: More antivirus fun...<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">The error message is pretty generic....could be it is not parsing properly, or can't write the file after parsing, or can't open the directory, or can't access the file...also add in the fact that MailScanner keeps the files very briefly
and dumps them after scanning...<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The <a href="http://neicar.com" target="_blank">neicar.com</a> is created as an attachment to the test message during MailScanner lint testing and subsequently parsed as a regular message. The n is just a prefix added as part of the disarming process.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Are the versions of MIME::Parser the same on all the hosts?<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Feb 25, 2019 at 3:33 PM Shawn Iverson <<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Is the clam user in the mtagroup on all hosts?<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Feb 25, 2019 at 3:30 PM Kevin Miller <<a href="mailto:kevin.miller@juneau.org" target="_blank">kevin.miller@juneau.org</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12pt">Following up on last weeks upgrades.<br>
<br>
To wit, on a couple of my hosts clamd is working as advertised. On a couple others, it's only partially working. I ran MailScanner --lint on a fully working box, mxt, and a partially working box, mx1 and compared the /var/log/clamav/clamav.log files.<br>
<br>
mxt:<br>
Mon Feb 25 10:47:48 2019 -> /var/spool/MailScanner/incoming/65439/1.message: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND<br>
Mon Feb 25 10:47:48 2019 -> /var/spool/MailScanner/incoming/65439/1/<a href="http://neicar.com" target="_blank">neicar.com</a>: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND<br>
<br>
mx1:<br>
Mon Feb 25 10:31:20 2019 -> /var/spool/MailScanner/incoming/13106/1.message: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND<br>
Mon Feb 25 10:31:20 2019 -> /var/spool/MailScanner/incoming/13106/1/<a href="http://neicar.com" target="_blank">neicar.com</a>: Can't open file or directory ERROR<br>
<br>
So it appears that for whatever reason "<a href="http://neicar.com" target="_blank">neicar.com</a>" isn't found on mx1, the partially working box. The directory is available, as evidenced by the fist log entry.<br>
<br>
I did a "locate <a href="http://neicar.com" target="_blank">neicar.com</a>" on both hosts and neither returned a location for that filename, but perhaps it's created on the fly by the lint process?<br>
<br>
Permissions match on both hosts.<br>
<br>
It's a puzzler...<br>
<br>
...Kevin<br>
--<br>
Kevin Miller<br>
Network/email Administrator, CBJ MIS Dept.<br>
155 South Seward Street<br>
Juneau, Alaska 99801<br>
Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357<br>
<br>
<br>
-----Original Message-----<br>
From: MailScanner [mailto:<a href="mailto:mailscanner-bounces%2Bkevin.miller" target="_blank">mailscanner-bounces+kevin.miller</a>=<a href="mailto:juneau.org@lists.mailscanner.info" target="_blank">juneau.org@lists.mailscanner.info</a>] On Behalf Of Kevin Miller<br>
Sent: Friday, February 22, 2019 4:36 PM<br>
To: 'MailScanner Discussion'<br>
Subject: RE: More antivirus fun...<br>
<br>
Thanks – it’s much appreciated!<br>
<br>
I have my boxes upgraded to MailScanner version: 5.1.3, and Sophos is working just jiffy on them.<br>
On two (of five) however, clamd is now acting sort of goofy. MailScanner –lint report this:<br>
<br>
Virus and Content Scanning: Starting<br>
Clamd::INFECTED::Eicar-Test-Signature :: ./1/<br>
Clamd::ERROR:: Can't open file or directory ERROR :: ./1/<a href="http://neicar.com" target="_blank">neicar.com</a><br>
Virus Scanning: Clamd found 2 infections<br>
>>> Virus 'EICAR-AV-Test' found in file /var/spool/MailScanner/incoming/2642/1/<a href="http://eicar.com" target="_blank">eicar.com</a><br>
Virus Scanning: Sophos found 1 infections<br>
Infected message 1 came from 10.1.1.1<br>
Virus Scanning: Found 3 viruses<br>
<br>
It's catching viruses, but note line three - for some reason it "Can't open file or directory ERROR :: ./1/<a href="http://neicar.com" target="_blank">neicar.com</a>"<br>
<br>
The config is (or should be) the same on all the boxes. I'm stumped. Not going to worry about it until Monday (it's quitting time) and clamd seems to be catching the viruses so I guess it's safe to ignore for a couple days.<br>
<br>
Have a great weekend all...<br>
<br>
<br>
...Kevin<br>
--<br>
Kevin Miller<br>
Network/email Administrator, CBJ MIS Dept.<br>
155 South Seward Street<br>
Juneau, Alaska 99801<br>
Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357<br>
<br>
From: MailScanner [mailto:<a href="mailto:mailscanner-bounces%2Bkevin.miller" target="_blank">mailscanner-bounces+kevin.miller</a>=<a href="mailto:juneau.org@lists.mailscanner.info" target="_blank">juneau.org@lists.mailscanner.info</a>] On Behalf Of Shawn Iverson
via MailScanner<br>
Sent: Friday, February 22, 2019 2:45 PM<br>
To: MailScanner Discussion<br>
Cc: Shawn Iverson<br>
Subject: Re: More antivirus fun...<br>
<br>
Kevin,<br>
<br>
You are in good hands :)<br>
<br>
My MailScanner test environment has grown to four physical hosts in a cluster running various distributions of MailScanner and upgrade paths :D I have (not kidding) about a dozen virtual machines with snapshots and now some LXC containers. The goal: blow
it up here first before releasing it.<br>
<br>
On Fri, Feb 22, 2019 at 6:15 PM Kevin Miller <<a href="mailto:kevin.miller@juneau.org" target="_blank">kevin.miller@juneau.org</a>> wrote:<br>
I should have said ramifications. But you're quite right. Good to know all the pieces are in place.<br>
<br>
I keep a test virtual Mailscanner/MailWatch/Postbox on hand for such purposes. Since I can create snapshots, it's easy to start over if I totally bollix it up.
<br>
<br>
...Kevin<br>
--<br>
Kevin Miller<br>
Network/email Administrator, CBJ MIS Dept.<br>
155 South Seward Street<br>
Juneau, Alaska 99801<br>
Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357<br>
<br>
<br>
-----Original Message-----<br>
From: MailScanner [mailto:<a href="mailto:mailscanner-bounces%2Bkevin.miller" target="_blank">mailscanner-bounces+kevin.miller</a>=<a href="mailto:juneau.org@lists.mailscanner.info" target="_blank">juneau.org@lists.mailscanner.info</a>] On Behalf Of Mark Sapiro<br>
Sent: Friday, February 22, 2019 12:23 PM<br>
To: <a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
Subject: Re: More antivirus fun...<br>
<br>
On 2/22/19 11:31 AM, Kevin Miller wrote:<br>
> <br>
> One quick question. The upgrade process asked "Do you wish to install the Sendmail::Milter interface? [yes]" I said yes as that was the default, but wasn't really sure what the implications of that are.<br>
<br>
<br>
The implication is should you now choose to configure the Postfix milter<br>
option in MailScanner, you have the necessary pieces.<br>
<br>
-- <br>
Mark Sapiro <<a href="mailto:mark@msapiro.net" target="_blank">mark@msapiro.net</a>> The highway is for gamblers,<br>
San Francisco Bay Area, California better use your sense - B. Dylan<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
<br>
-- <br>
Shawn Iverson, CETL<br>
Director of Technology<br>
Rush County Schools<br>
765-932-3901 option 7<br>
<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a><br>
<br>
<br>
<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Shawn Iverson, CETL<u></u><u></u></p>
<div>
<p class="MsoNormal">Director of Technology<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Rush County Schools<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">765-932-3901 option 7<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><img id="gmail-m_5629395854778121820_x0000_i1025" src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_cy1OZFNIZ0drYVU&revid=0Bw5iD0ToYvs_UitIcHVIWkJVVTl2VGpxVUE0d0FQcHBIRXk4PQ" width="96" height="96" border="0"><img id="gmail-m_5629395854778121820_x0000_i1026" src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_Zkh4eEs3R01yWXc&revid=0Bw5iD0ToYvs_QWpBK2Y2ajJtYjhOMDRFekZwK2xOamk5Q3Y0PQ" width="89" height="96" border="0"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><img id="gmail-m_5629395854778121820_x0000_i1027" src="https://docs.google.com/uc?export=download&id=1aBrlQou4gjB04FY-twHN_0Dn3GHVNxqa&revid=0Bw5iD0ToYvs_RnQ0eDhHcm95WHBFdkNRbXhQRXpoYkR6SEEwPQ" border="0"><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br clear="all">
<br>
-- <u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Shawn Iverson, CETL<u></u><u></u></p>
<div>
<p class="MsoNormal">Director of Technology<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Rush County Schools<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">765-932-3901 option 7<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><img id="gmail-m_5629395854778121820_x0000_i1028" src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_cy1OZFNIZ0drYVU&revid=0Bw5iD0ToYvs_UitIcHVIWkJVVTl2VGpxVUE0d0FQcHBIRXk4PQ" width="96" height="96" border="0"><img id="gmail-m_5629395854778121820_x0000_i1029" src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_Zkh4eEs3R01yWXc&revid=0Bw5iD0ToYvs_QWpBK2Y2ajJtYjhOMDRFekZwK2xOamk5Q3Y0PQ" width="89" height="96" border="0"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><img id="gmail-m_5629395854778121820_x0000_i1030" src="https://docs.google.com/uc?export=download&id=1aBrlQou4gjB04FY-twHN_0Dn3GHVNxqa&revid=0Bw5iD0ToYvs_RnQ0eDhHcm95WHBFdkNRbXhQRXpoYkR6SEEwPQ" border="0"><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr">Shawn Iverson, CETL<div>Director of Technology</div><div>Rush County Schools</div><div>765-932-3901 option 7</div><div><a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div><br></div><div><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_cy1OZFNIZ0drYVU&revid=0Bw5iD0ToYvs_UitIcHVIWkJVVTl2VGpxVUE0d0FQcHBIRXk4PQ" style="font-size: 12.8px;" width="96" height="96"><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_Zkh4eEs3R01yWXc&revid=0Bw5iD0ToYvs_QWpBK2Y2ajJtYjhOMDRFekZwK2xOamk5Q3Y0PQ" width="89" height="96"></div><div><img src="https://docs.google.com/uc?export=download&id=1aBrlQou4gjB04FY-twHN_0Dn3GHVNxqa&revid=0Bw5iD0ToYvs_RnQ0eDhHcm95WHBFdkNRbXhQRXpoYkR6SEEwPQ" style="font-size: 12.8px;"><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>