gmane.mail.virus.mailscanner

RES: MailScanner Digest, Vol 89, Issue 18

Informática - Astória Papéis LTDA — 2013-05-20T17:50:36

Sergio, apenas para seu conhecimento, recebi este e-mail, do mailscanner.



-----Mensagem original-----
De: mailscanner-bounces< at >lists.mailscanner.info
[mailto:mailscanner-bounces< at >lists.mailscanner.info] Em nome de
mailscanner-request< at >lists.mailscanner.info
Enviada em: domingo, 19 de maio de 2013 08:00
Para: mailscanner< at >lists.mailscanner.info
Assunto: MailScanner Digest, Vol 89, Issue 18

Send MailScanner mailing list submissions to
mailscanner< at >lists.mailscanner.info

To subscribe or unsubscribe via the World Wide Web, visit
http://lists.mailscanner.info/mailman/listinfo/mailscanner
or, via email, send a message with subject or body 'help' to
mailscanner-request< at >lists.mailscanner.info

You can reach the person managing the list at
mailscanner-owner< at >lists.mailscanner.info

When replying, please edit your Subject line so it is more specific than
"Re: Contents of MailScanner digest..."


Today's Topics:

   1. permissions and ownership of /var/spool/incoming (Dan Carl)


------------------------------------

RE: permissions and ownership of /var/spool/incoming

Kevin Miller — 2013-05-20T16:11:29

On both my SLES and CentOS boxes running MailScanner an clamAV the user is clamav not clam.  Double check the name of the account that clamav is actually running as.  It can vary from distribution to distribution...

 ...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4500
Registered Linux User No: 307357
-----Original Message-----
From: mailscanner-bounces< at >lists.mailscanner.info [mailto:mailscanner-bounces< at >lists.mailscanner.info] On Behalf Of Dan Carl
Sent: Saturday, May 18, 2013 7:24 AM
To: MailScanner discussion
Subject: permissions and ownership of /var/spool/incoming

Hi all,
I never have any issues with Mailscanner the thing just works and works well.
But when it comes to new installs that when you'll see me post here.
I'm running a shiny new CentOS 6.4 box with postfix.
I've tried everything but still getting error below when running MailScanner --lint.
Could not open file >/var/spool/MailScanner/incomi

permissions and ownership of /var/spool/incoming

Dan Carl — 2013-05-18T15:23:53

Hi all,
I never have any issues with Mailscanner the thing just works and works 
well.
But when it comes to new installs that when you'll see me post here.
I'm running a shiny new CentOS 6.4 box with postfix.
I've tried everything but still getting error below when running 
MailScanner --lint.
Could not open file >/var/spool/MailScanner/incoming/2614/1.header: 
Permission denied
Cannot create + lock headers file 
/var/spool/MailScanner/incoming/2614/1.header, Permission denied at 
/usr/lib/MailScanner/MailScanner/Message.pm line 523
I set the permissions and ownership to:
chown -R postfix.clam *
chmod -R 750 *
But Mailscanner sets the permissions to clam.root
Thanks in advance
Dan

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-18T03:11:39

If you don't define those in your custom config, it is using what is
defined in /etc/MailScanner/MailScanner.conf.


On Saturday, May 18, 2013, Robert Lopez wrote:

Re: Single email, multiple Spamassassin attempls

Robert Lopez — 2013-05-18T00:10:44

Commented out
#Incoming Work Group = clamav
#Incoming Work Permissions = 0640
in /etc/MailScanner/conf.d/CNM-MailScanner.conf

The notes in MailScanner.conf still convince me I should those in.
However, just went past the hourly time to receive a Problem Email
report and there has been none.


On Fri, May 17, 2013 at 4:53 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

Re: Single email, multiple Spamassassin attempls

Robert Lopez — 2013-05-17T22:53:14

Jerry,

Acknowledge the selinux tips. Logs say no problem there.

Made the -U change.  No affect on problem.  Thanks.


--
Robert Lopez

Re: MailScanner debug hanging

John Baker — 2013-05-17T19:35:41

Ok, thanks all. I didn't realize that dbug worked differently than --lint
in that way.


On Thu, May 16, 2013 at 2:21 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-17T20:14:49

Hit send on accident on the last email. Example using the group:

Incoming Work Group = mtagroup
Quarantine Group = mtagroup
Run As Group = mtagroup
Incoming Work Permissions = 0660
Quarantine Permissions = 0660




On Fri, May 17, 2013 at 10:12 PM, Jerry Benton
<jerry.benton< at >mailborder.com>wrote:

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-17T20:12:31

Does that mean they cleared?

I also use a third group called mtagroup for this. I add both postfix and
clamav to that group and in MailScanner.conf use the third group under Run
As Group. (WIth permission 0660) This allows both postfix and clamav to
access the files with no problem.



On Fri, May 17, 2013 at 9:20 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-17T19:56:16

As for Selinux, I wouldn't know without looking at the logs. I would of
course try putting it in permissive mode and testing. If it does turn out
to be Selinux, you can build your own policies from the logs.

MailScanner does is unsafe and therefore does not allow it. Hence adding
the -U flag. Same program (MailScanner) as before, just a different version
of Perl that will not let it do things it did in previous versions.

I could of course be totally wrong.




On Fri, May 17, 2013 at 9:08 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

Re: Single email, multiple Spamassassin attempls

Robert Lopez — 2013-05-17T19:20:48

[root< at >mg08 ~]# service clamd start
Starting Clam AntiVirus Daemon:                            [  OK  ]
[root< at >mg08 ~]# service MailScanner start
Starting MailScanner and postfix:
         postfix:                                          [  OK  ]
         MailScanner:                                      [  OK  ]
[root< at >mg08 ~]# find /var/spool -group clamav
/var/spool/MailScanner/incoming
/var/spool/MailScanner/incoming/18338
/var/spool/MailScanner/incoming/18315
[root< at >mg08 ~]# find /var/spool -group clamav -exec chgrp postfix {} \;
[root< at >mg08 ~]# find /var/spool -group clamav
[root< at >mg08 ~]# sed -i 's:#!/usr/bin/perl -I:#!/usr/bin/perl -U -I:g'
/usr/sbin/MailScanner
[root< at >mg08 ~]# head -1 /usr/sbin/MailScanner
#!/usr/bin/perl -U -I/usr/lib/MailScanner
[root< at >mg08 ~]# service clamd start
Starting Clam AntiVirus Daemon:                            [  OK  ]
[root< at >mg08 ~]# service MailScanner start
Starting MailScanner and postfix:
         postfix:                                          [  OK  ]
         MailSc

Re: Single email, multiple Spamassassin attempls

Robert Lopez — 2013-05-17T19:08:35

On Fri, May 17, 2013 at 10:52 AM, Jerry Benton
<jerry.benton< at >mailborder.com> wrote:

Jerry,

I really believe selinux not an issue in this case.

/etc/MailScanner/MailScanner.conf: Run As User =
/etc/MailScanner/MailScanner.conf:Run As Group =
/etc/MailScanner/conf.d/CNM-MailScanner.conf:Run As User = postfix
/etc/MailScanner/conf.d/CNM-MailScanner.conf:Run As Group = postfix

I have seen you advise the -U many times in this discussion group.
I have always been hesitant to allow unsafe operations, favouring
fixing them if possible.

I do see something is changing group of /var/spool/MailScanner/incoming to:
 drwxrwxr-x 9 postfix clamav 4096 May 17 12:50 /var/spool/MailScanner/incoming/

I have tried to change it to postfix postfix but it changes back to as above.
(To change I stop postfix, MailScanner, and clamd; make changes; start all)

Worse, I think, is I see this:
drwxr-x--- 2 postfix clamav    4096 May 17 12:45
/var/spool/MailScanner/incoming/17603/
drwxr-x--- 2 postfix clamav    4096 May 17 12:47
/var

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-17T16:52:19

Robert,

There are three primary things I check for when dealing with this problem:

1. Selinux. You know the drill for this one.
2. MailScanner Run As and directory ownership and permissions.
3. Making sure you add the -U option to MailScanner for the newer versions
of perl.

sed -i 's:#!/usr/bin/perl -I:#!/usr/bin/perl -U -I:g' /usr/sbin/MailScanner


Jerry Benton



On Wed, May 15, 2013 at 7:31 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

RE: Single email, multiple Spamassassin attempls

Richard Mealing — 2013-05-17T15:53:21

Robert,

You need to change user to postfix, so - su postfix

For Ubuntu, I would normally 'su' to root first, then - su postfix
http://manpages.ubuntu.com/manpages/jaunty/man1/su.1.html


Thanks,



-----Original Message-----
From: mailscanner-bounces< at >lists.mailscanner.info [mailto:mailscanner-bounces< at >lists.mailscanner.info] On Behalf Of Robert Lopez
Sent: 17 May 2013 01:09
To: MailScanner discussion
Subject: Re: Single email, multiple Spamassassin attempls

On Thu, May 16, 2013 at 4:24 AM, Martin Hepworth <maxsec< at >gmail.com> wrote:

You lost me on "logged in as postfix" ...

# grep postfix /etc/passwd
postfix:x:89:89::/var/spool/postfix:/sbin/nologin

The above is from the new RHEL gateway.

All our older Ubuntu gateways are ...
# grep postfix /etc/passwd
postfix:x:108:116::/var/spool/postfix:/bin/false

I never considered that

Run As User = postfix
Run As Group = postfix

actually required the postfix account to support being "logged into".

Do you mean sudo -u postfix MailScanner ...  ?

If I do "sudo -u

Re: Single email, multiple Spamassassin attempls

Robert Lopez — 2013-05-17T00:08:30

You lost me on "logged in as postfix" ...

# grep postfix /etc/passwd
postfix:x:89:89::/var/spool/postfix:/sbin/nologin

The above is from the new RHEL gateway.

All our older Ubuntu gateways are ...
# grep postfix /etc/passwd
postfix:x:108:116::/var/spool/postfix:/bin/false

I never considered that

Run As User = postfix
Run As Group = postfix

actually required the postfix account to support being "logged into".

Do you mean sudo -u postfix MailScanner ...  ?

If I do "sudo -u postfix MailScanner --lint" both this new and the older
gateways (which have been working for years) fail but fail differently
(different versions of MailScanner as well).

How do I "run the problem message through a debug session"?
In the man pages and in the book I have failed to see how to do that.


--
Robert Lopez

Re: ScamNailer info not updated [solved]

Mark Sapiro — 2013-05-16T21:48:36


As of now (over 59 hours later), this still doesn't work for me.

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>> txt
emails.msupdate.greylist.bastionmail.com < at >ns1.linode.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12860
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 5, ADDITIONAL: 10

;; QUESTION SECTION:
;emails.msupdate.greylist.bastionmail.com. IN TXT

;; ANSWER SECTION:
emails.msupdate.greylist.bastionmail.com. 3600 IN TXT "emails.2013-164.6"


Should I be querying a different domain?

Re: MailScanner debug hanging

Martin Hepworth — 2013-05-16T19:09:42

make sure you're permissions are good on the working directories etc

Re: MailScanner debug hanging

Robert Lopez — 2013-05-16T18:35:27

I think I must take back the running of lint with debug.
I just double checked that and all that really runs is the lint.

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Re: MailScanner debug hanging

Robert Lopez — 2013-05-16T18:21:50

run it again with --lint.

These will sit and wait for a batch:
MailScanner --debug
MailScanner --debug --debug-sa

These will not wait for a batch:
MailScanner --debug --lint
MailScanner --debug --debug-sa --lint

There is strace as in:
strace MailScanner --debug

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

RE: MailScanner debug hanging

Denis Beauchemin — 2013-05-16T17:25:16

John,

I believe this is normal as MailScanner waits for some emails to process. It should print debugging information as soon as it receives some emails and then exit.

Denis


De : mailscanner-bounces< at >lists.mailscanner.info [mailto:mailscanner-bounces< at >lists.mailscanner.info] De la part de John Baker
Envoyé : 16 mai 2013 12:37
À : mailscanner< at >lists.mailscanner.info
Objet : MailScanner debug hanging

Hi, I'm finishing a new mailserver build with the last stable MailScanner. I ran MailScanner --debug to check for problems and it keeps hanging after Building a message batch to scan...

However MailScanner --lint works ok.

How can I get debug information on why debug won't run properly? Any suggestions for sorting this out?

--
John Baker
Network Administrator
Marlboro College
Phone: 451-7551 Cell: 490-0066

MailScanner debug hanging

John Baker — 2013-05-16T16:28:20

Hi, I'm finishing a new mailserver build with the last stable MailScanner.
I ran MailScanner --debug to check for problems and it keeps hanging after
Building a message batch to scan...

However MailScanner --lint works ok.

How can I get debug information on why debug won't run properly? Any
suggestions for sorting this out?