gmane.mail.virus.mailscanner

Re: Scan Messages = %rules-dir%/scan.messages.rules

Robert Lopez — 2013-05-22T21:42:49

The situation I am trying to understand is email being scanned by
SpamAssassin when I thought
I had all the systems configured to not scan the email at all.

Email generated by an office where the persons use Outlook to compose
email goes to an Exchange server and it is then relayed to an email
gateway. These email are from CNM_Official_Info< at >cnm.edu to
students< at >cnm.edu. The email gateway relays the email to a Mailman ($
postmap -q students /etc/postfix/virtualaliases -> students< at >listserv)
server.

Mailman then sends the message to all the students who are members of
the students list.  So each student has a copy generated that is from
students-bounces< at >cnm.edu to <individual-student>< at >cnm.edu which is sent
back to the email gateways.

A Postfix rewrite via a virtualaliases map sends each email from
students-bounces< at >cnm.edu to <individual-student>< at >...gmail.com.

MailScanner.conf and conf.d/CNM-MailScanner.conf (newest gateway)
all have "Scan Messages = %rules-dir%/scan.messages.rules".
I had put both 'From' in

Re: Scan Messages = %rules-dir%/scan.messages.rules

Robert Lopez — 2013-05-22T21:26:42

On Wed, May 22, 2013 at 12:55 PM, Antony Stone
<Antony.Stone< at >mailscanner.open.source.it> wrote:



--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Re: Scan Messages = %rules-dir%/scan.messages.rules

Antony Stone — 2013-05-22T18:55:36


Not entirely true...



Which means the part before the < at > sign can be case-sensitive, and it's only 
the authoritative mail server for the domain which can decide whether there's 
a difference between j.smith and J.Smith.

Not often important, I know, but can catch you out when you're not expecting 
it :)


Regards,


Antony.

Re: Scan Messages = %rules-dir%/scan.messages.rules

Steve Campbell — 2013-05-22T18:28:43

Perhaps you should send us the "Scan Messages" line from your 
MailScanner.conf file and what you have in your file that is pointed to 
in by line above.

Have you restarted or reloaded MS since you changed the file?

Depending on what you have in that line and file, you probably shouldn't 
be seeing those lines in your mail log.

steve campbell

On 5/22/2013 1:45 PM, Robert Lopez wrote:

Re: Scan Messages = %rules-dir%/scan.messages.rules

Robert Lopez — 2013-05-22T17:45:17

Martin,

Please clarify to which rule "Normally this" refers.
I believe you are stating "Is definitely Not spam" is only used for
trusted ip-addresses not email 'from' addresses.

The situation I am trying to understand is email being scanned by
SpamAssassin when I thought
I had the system configured to not scan the email at all.

May 20 12:55:08 mg04 MailScanner[11127]: Message 55370642025.7712B
from 198.133.182.29 () to cnm.edu
is not spam, SpamAssassin (not cached, score=-1.699, required 6,
autolearn=disabled, CNM_EXCUSE 0.30,
CNM_FROM -1.00, CNM_ITS -1.00, HTML_MESSAGE 0.00)

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Any thing new on missing updates on blacklist in mailscanner / fix orworkaround?

Jesper Jensen — 2013-05-22T11:55:00


Hello ppl

Is there a work around - we are still not getting updates for scamnailer and Mailscanner blacklist

Log:

ok Checking that /var/cache/ScamNailer/cache/2013-164.6 exists... ok I am working with: Current: 2013-164 - 6 and Status: 2013-164 - 6 No base update required

And mailscanner still reads

:

Read 3966 hostnames from the phishing blacklists

Any input is appreciated, Thank you
 

/Jesper



-----Oprindelig meddelelse-----
Fra: mailscanner-bounces< at >lists.mailscanner.info [mailto:mailscanner-bounces< at >lists.mailscanner.info] På vegne af mailscanner-request< at >lists.mailscanner.info
Sendt: 22. maj 2013 13:00
Til: mailscanner< at >lists.mailscanner.info
Emne: MailScanner Digest, Vol 89, Issue 20

Send MailScanner mailing list submissions to
mailscanner< at >lists.mailscanner.info

To subscribe or unsubscribe via the World Wide Web, visit
http://lists.mailscanner.info/mailman/listinfo/mailscanner
or, via email, send a message with subject or body 'help' to
mailscanner-request< at >lists.mailscanner.info

You can

storing messages

Alessandro Dentella — 2013-05-22T09:40:32


Hi, 

I have several servers where storing messagges just works.
Now i'm fighting to get spam and nonspanm messages stored in a new server
that was not preared by me but seems correct, nevertheless I cant get
messages stored.

Relevant configuration directives are:

  Spam Actions = store
  High Scoring Spam Actions = store
  Spam Actions = store deliver header "
  Non Spam Actions = store deliver header "X-Spam-Status: No"

Quarantine dir is /var/spool/MailScanner/quarantine/ and permissions are
postfix.www-data 

  root< at >smtp:/etc/MailScanner# find /var/spool/MailScanner/quarantine/ -ls
  262148    4 drwxrwxr-x   3 postfix  www-data     4096 May 22 06:25 /var/spool/MailScanner/quarantine/
  262166    4 drwxrwx---   4 postfix  www-data     4096 May 22 06:53 /var/spool/MailScanner/quarantine/20130522
  262167    4 drwxrwx---   2 postfix  www-data     4096 May 22 11:37 /var/spool/MailScanner/quarantine/20130522/nonspam
  262168    4 drwxrwx---   2 postfix  www-data     4096 May 22 11:38 /var/spool/MailScanne

Re: Scan Messages = %rules-dir%/scan.messages.rules

Martin Hepworth — 2013-05-22T08:20:51

1) nope, email addresses are not case sensitive.
2) Envelope, MS always uses the Envelope-from in from parsing.
3) this is the 'big knob' that tells whether MailScanner scans the email or
not. Way before it's passed to SA, anti-virus or checked by mailScanner
again RBLS (independently of SA). etc. Be very careful with setting as it's
basically sending email through with zero scanning. Might want to look at
the the "Is definitely Not spam" setting. Normally this is only used for
trusted ip-addresses not email 'from' addresses.

hope that helps

Scan Messages = %rules-dir%/scan.messages.rules

Robert Lopez — 2013-05-22T01:18:11

wrt "Scan Messages = %rules-dir%/scan.messages.rules"

Three questions:

1) Does MailScanner do a case sensitive match when
scan.messages.rules file is used?

2) Which "From:" does scan.messages.rules use (Envelope or Email Body)?

3) Does MailScanner directly implement the match and action or is this
passed to SpamAssassin to do the match and action?

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

Re: permissions and ownership of /var/spool/incoming

Robert Lopez — 2013-05-21T23:17:18

On Mon, May 20, 2013 at 10:11 AM, Kevin Miller
<Kevin_Miller< at >ci.juneau.ak.us> wrote:

I am not at all certain it is related, but also pay attention to the
MailScanner.conf (or MailScanner/conf.d/your-conf-file) for the values
of Incoming Work Group and Incoming Work Permissions.

--
Robert Lopez
Unix Systems Administrator
Central New Mexico Community College (CNM)
525 Buena Vista SE
Albuquerque, New Mexico 87106

RES: MailScanner Digest, Vol 89, Issue 18

Informática - Astória Papéis LTDA — 2013-05-20T17:50:36

Sergio, apenas para seu conhecimento, recebi este e-mail, do mailscanner.



-----Mensagem original-----
De: mailscanner-bounces< at >lists.mailscanner.info
[mailto:mailscanner-bounces< at >lists.mailscanner.info] Em nome de
mailscanner-request< at >lists.mailscanner.info
Enviada em: domingo, 19 de maio de 2013 08:00
Para: mailscanner< at >lists.mailscanner.info
Assunto: MailScanner Digest, Vol 89, Issue 18

Send MailScanner mailing list submissions to
mailscanner< at >lists.mailscanner.info

To subscribe or unsubscribe via the World Wide Web, visit
http://lists.mailscanner.info/mailman/listinfo/mailscanner
or, via email, send a message with subject or body 'help' to
mailscanner-request< at >lists.mailscanner.info

You can reach the person managing the list at
mailscanner-owner< at >lists.mailscanner.info

When replying, please edit your Subject line so it is more specific than
"Re: Contents of MailScanner digest..."


Today's Topics:

   1. permissions and ownership of /var/spool/incoming (Dan Carl)


------------------------------------

RE: permissions and ownership of /var/spool/incoming

Kevin Miller — 2013-05-20T16:11:29

On both my SLES and CentOS boxes running MailScanner an clamAV the user is clamav not clam.  Double check the name of the account that clamav is actually running as.  It can vary from distribution to distribution...

 ...Kevin
--
Kevin Miller
Network/email Administrator, CBJ MIS Dept.
155 South Seward Street
Juneau, Alaska 99801
Phone: (907) 586-0242, Fax: (907) 586-4500
Registered Linux User No: 307357
-----Original Message-----
From: mailscanner-bounces< at >lists.mailscanner.info [mailto:mailscanner-bounces< at >lists.mailscanner.info] On Behalf Of Dan Carl
Sent: Saturday, May 18, 2013 7:24 AM
To: MailScanner discussion
Subject: permissions and ownership of /var/spool/incoming

Hi all,
I never have any issues with Mailscanner the thing just works and works well.
But when it comes to new installs that when you'll see me post here.
I'm running a shiny new CentOS 6.4 box with postfix.
I've tried everything but still getting error below when running MailScanner --lint.
Could not open file >/var/spool/MailScanner/incomi

permissions and ownership of /var/spool/incoming

Dan Carl — 2013-05-18T15:23:53

Hi all,
I never have any issues with Mailscanner the thing just works and works 
well.
But when it comes to new installs that when you'll see me post here.
I'm running a shiny new CentOS 6.4 box with postfix.
I've tried everything but still getting error below when running 
MailScanner --lint.
Could not open file >/var/spool/MailScanner/incoming/2614/1.header: 
Permission denied
Cannot create + lock headers file 
/var/spool/MailScanner/incoming/2614/1.header, Permission denied at 
/usr/lib/MailScanner/MailScanner/Message.pm line 523
I set the permissions and ownership to:
chown -R postfix.clam *
chmod -R 750 *
But Mailscanner sets the permissions to clam.root
Thanks in advance
Dan

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-18T03:11:39

If you don't define those in your custom config, it is using what is
defined in /etc/MailScanner/MailScanner.conf.


On Saturday, May 18, 2013, Robert Lopez wrote:

Re: Single email, multiple Spamassassin attempls

Robert Lopez — 2013-05-18T00:10:44

Commented out
#Incoming Work Group = clamav
#Incoming Work Permissions = 0640
in /etc/MailScanner/conf.d/CNM-MailScanner.conf

The notes in MailScanner.conf still convince me I should those in.
However, just went past the hourly time to receive a Problem Email
report and there has been none.


On Fri, May 17, 2013 at 4:53 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

Re: Single email, multiple Spamassassin attempls

Robert Lopez — 2013-05-17T22:53:14

Jerry,

Acknowledge the selinux tips. Logs say no problem there.

Made the -U change.  No affect on problem.  Thanks.


--
Robert Lopez

Re: MailScanner debug hanging

John Baker — 2013-05-17T19:35:41

Ok, thanks all. I didn't realize that dbug worked differently than --lint
in that way.


On Thu, May 16, 2013 at 2:21 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-17T20:14:49

Hit send on accident on the last email. Example using the group:

Incoming Work Group = mtagroup
Quarantine Group = mtagroup
Run As Group = mtagroup
Incoming Work Permissions = 0660
Quarantine Permissions = 0660




On Fri, May 17, 2013 at 10:12 PM, Jerry Benton
<jerry.benton< at >mailborder.com>wrote:

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-17T20:12:31

Does that mean they cleared?

I also use a third group called mtagroup for this. I add both postfix and
clamav to that group and in MailScanner.conf use the third group under Run
As Group. (WIth permission 0660) This allows both postfix and clamav to
access the files with no problem.



On Fri, May 17, 2013 at 9:20 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

Re: Single email, multiple Spamassassin attempls

Jerry Benton — 2013-05-17T19:56:16

As for Selinux, I wouldn't know without looking at the logs. I would of
course try putting it in permissive mode and testing. If it does turn out
to be Selinux, you can build your own policies from the logs.

MailScanner does is unsafe and therefore does not allow it. Hence adding
the -U flag. Same program (MailScanner) as before, just a different version
of Perl that will not let it do things it did in previous versions.

I could of course be totally wrong.




On Fri, May 17, 2013 at 9:08 PM, Robert Lopez <rlopezcnm< at >gmail.com> wrote:

Re: Single email, multiple Spamassassin attempls

Robert Lopez — 2013-05-17T19:20:48

[root< at >mg08 ~]# service clamd start
Starting Clam AntiVirus Daemon:                            [  OK  ]
[root< at >mg08 ~]# service MailScanner start
Starting MailScanner and postfix:
         postfix:                                          [  OK  ]
         MailScanner:                                      [  OK  ]
[root< at >mg08 ~]# find /var/spool -group clamav
/var/spool/MailScanner/incoming
/var/spool/MailScanner/incoming/18338
/var/spool/MailScanner/incoming/18315
[root< at >mg08 ~]# find /var/spool -group clamav -exec chgrp postfix {} \;
[root< at >mg08 ~]# find /var/spool -group clamav
[root< at >mg08 ~]# sed -i 's:#!/usr/bin/perl -I:#!/usr/bin/perl -U -I:g'
/usr/sbin/MailScanner
[root< at >mg08 ~]# head -1 /usr/sbin/MailScanner
#!/usr/bin/perl -U -I/usr/lib/MailScanner
[root< at >mg08 ~]# service clamd start
Starting Clam AntiVirus Daemon:                            [  OK  ]
[root< at >mg08 ~]# service MailScanner start
Starting MailScanner and postfix:
         postfix:                                          [  OK  ]
         MailSc