<div dir="ltr">Is the clam user in the mtagroup on all hosts?</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 25, 2019 at 3:30 PM Kevin Miller <<a href="mailto:kevin.miller@juneau.org">kevin.miller@juneau.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Following up on last weeks upgrades.<br>
<br>
To wit, on a couple of my hosts clamd is working as advertised. On a couple others, it's only partially working. I ran MailScanner --lint on a fully working box, mxt, and a partially working box, mx1 and compared the /var/log/clamav/clamav.log files.<br>
<br>
mxt:<br>
Mon Feb 25 10:47:48 2019 -> /var/spool/MailScanner/incoming/65439/1.message: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND<br>
Mon Feb 25 10:47:48 2019 -> /var/spool/MailScanner/incoming/65439/1/<a href="http://neicar.com" rel="noreferrer" target="_blank">neicar.com</a>: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND<br>
<br>
mx1:<br>
Mon Feb 25 10:31:20 2019 -> /var/spool/MailScanner/incoming/13106/1.message: Eicar-Test-Signature(44d88612fea8a8f36de82e1278abb02f:68) FOUND<br>
Mon Feb 25 10:31:20 2019 -> /var/spool/MailScanner/incoming/13106/1/<a href="http://neicar.com" rel="noreferrer" target="_blank">neicar.com</a>: Can't open file or directory ERROR<br>
<br>
So it appears that for whatever reason "<a href="http://neicar.com" rel="noreferrer" target="_blank">neicar.com</a>" isn't found on mx1, the partially working box. The directory is available, as evidenced by the fist log entry.<br>
<br>
I did a "locate <a href="http://neicar.com" rel="noreferrer" target="_blank">neicar.com</a>" on both hosts and neither returned a location for that filename, but perhaps it's created on the fly by the lint process?<br>
<br>
Permissions match on both hosts.<br>
<br>
It's a puzzler...<br>
<br>
...Kevin<br>
--<br>
Kevin Miller<br>
Network/email Administrator, CBJ MIS Dept.<br>
155 South Seward Street<br>
Juneau, Alaska 99801<br>
Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357<br>
<br>
<br>
-----Original Message-----<br>
From: MailScanner [mailto:<a href="mailto:mailscanner-bounces%2Bkevin.miller" target="_blank">mailscanner-bounces+kevin.miller</a>=<a href="mailto:juneau.org@lists.mailscanner.info" target="_blank">juneau.org@lists.mailscanner.info</a>] On Behalf Of Kevin Miller<br>
Sent: Friday, February 22, 2019 4:36 PM<br>
To: 'MailScanner Discussion'<br>
Subject: RE: More antivirus fun...<br>
<br>
Thanks – it’s much appreciated!<br>
<br>
I have my boxes upgraded to MailScanner version: 5.1.3, and Sophos is working just jiffy on them.<br>
On two (of five) however, clamd is now acting sort of goofy. MailScanner –lint report this:<br>
<br>
Virus and Content Scanning: Starting<br>
Clamd::INFECTED::Eicar-Test-Signature :: ./1/<br>
Clamd::ERROR:: Can't open file or directory ERROR :: ./1/<a href="http://neicar.com" rel="noreferrer" target="_blank">neicar.com</a><br>
Virus Scanning: Clamd found 2 infections<br>
>>> Virus 'EICAR-AV-Test' found in file /var/spool/MailScanner/incoming/2642/1/<a href="http://eicar.com" rel="noreferrer" target="_blank">eicar.com</a><br>
Virus Scanning: Sophos found 1 infections<br>
Infected message 1 came from 10.1.1.1<br>
Virus Scanning: Found 3 viruses<br>
<br>
It's catching viruses, but note line three - for some reason it "Can't open file or directory ERROR :: ./1/<a href="http://neicar.com" rel="noreferrer" target="_blank">neicar.com</a>"<br>
<br>
The config is (or should be) the same on all the boxes. I'm stumped. Not going to worry about it until Monday (it's quitting time) and clamd seems to be catching the viruses so I guess it's safe to ignore for a couple days.<br>
<br>
Have a great weekend all...<br>
<br>
<br>
...Kevin<br>
--<br>
Kevin Miller<br>
Network/email Administrator, CBJ MIS Dept.<br>
155 South Seward Street<br>
Juneau, Alaska 99801<br>
Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357<br>
<br>
From: MailScanner [mailto:<a href="mailto:mailscanner-bounces%2Bkevin.miller" target="_blank">mailscanner-bounces+kevin.miller</a>=<a href="mailto:juneau.org@lists.mailscanner.info" target="_blank">juneau.org@lists.mailscanner.info</a>] On Behalf Of Shawn Iverson via MailScanner<br>
Sent: Friday, February 22, 2019 2:45 PM<br>
To: MailScanner Discussion<br>
Cc: Shawn Iverson<br>
Subject: Re: More antivirus fun...<br>
<br>
Kevin,<br>
<br>
You are in good hands :)<br>
<br>
My MailScanner test environment has grown to four physical hosts in a cluster running various distributions of MailScanner and upgrade paths :D I have (not kidding) about a dozen virtual machines with snapshots and now some LXC containers. The goal: blow it up here first before releasing it.<br>
<br>
On Fri, Feb 22, 2019 at 6:15 PM Kevin Miller <<a href="mailto:kevin.miller@juneau.org" target="_blank">kevin.miller@juneau.org</a>> wrote:<br>
I should have said ramifications. But you're quite right. Good to know all the pieces are in place.<br>
<br>
I keep a test virtual Mailscanner/MailWatch/Postbox on hand for such purposes. Since I can create snapshots, it's easy to start over if I totally bollix it up. <br>
<br>
...Kevin<br>
--<br>
Kevin Miller<br>
Network/email Administrator, CBJ MIS Dept.<br>
155 South Seward Street<br>
Juneau, Alaska 99801<br>
Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357<br>
<br>
<br>
-----Original Message-----<br>
From: MailScanner [mailto:<a href="mailto:mailscanner-bounces%2Bkevin.miller" target="_blank">mailscanner-bounces+kevin.miller</a>=<a href="mailto:juneau.org@lists.mailscanner.info" target="_blank">juneau.org@lists.mailscanner.info</a>] On Behalf Of Mark Sapiro<br>
Sent: Friday, February 22, 2019 12:23 PM<br>
To: <a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
Subject: Re: More antivirus fun...<br>
<br>
On 2/22/19 11:31 AM, Kevin Miller wrote:<br>
> <br>
> One quick question. The upgrade process asked "Do you wish to install the Sendmail::Milter interface? [yes]" I said yes as that was the default, but wasn't really sure what the implications of that are.<br>
<br>
<br>
The implication is should you now choose to configure the Postfix milter<br>
option in MailScanner, you have the necessary pieces.<br>
<br>
-- <br>
Mark Sapiro <<a href="mailto:mark@msapiro.net" target="_blank">mark@msapiro.net</a>> The highway is for gamblers,<br>
San Francisco Bay Area, California better use your sense - B. Dylan<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
<br>
-- <br>
Shawn Iverson, CETL<br>
Director of Technology<br>
Rush County Schools<br>
765-932-3901 option 7<br>
<a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a><br>
<br>
<br>
<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
<br>
<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr">Shawn Iverson, CETL<div>Director of Technology</div><div>Rush County Schools</div><div>765-932-3901 option 7</div><div><a href="mailto:iversons@rushville.k12.in.us" target="_blank">iversons@rushville.k12.in.us</a></div><div><br></div><div><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_cy1OZFNIZ0drYVU&revid=0Bw5iD0ToYvs_UitIcHVIWkJVVTl2VGpxVUE0d0FQcHBIRXk4PQ" width="96" height="96" style="font-size: 12.8px;"><img src="https://docs.google.com/uc?export=download&id=0Bw5iD0ToYvs_Zkh4eEs3R01yWXc&revid=0Bw5iD0ToYvs_QWpBK2Y2ajJtYjhOMDRFekZwK2xOamk5Q3Y0PQ" width="89" height="96"></div><div><img src="https://docs.google.com/uc?export=download&id=1aBrlQou4gjB04FY-twHN_0Dn3GHVNxqa&revid=0Bw5iD0ToYvs_RnQ0eDhHcm95WHBFdkNRbXhQRXpoYkR6SEEwPQ" style="font-size: 12.8px;"><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>