gmane.mail.virus.maiamailguard

Blacklist how-to

Koenraad Lelong — 2012-05-24T08:34:27

Hi,

I have a number of entries in my white/black list. But for some entries, 
I still get mail in the quarantaine. What am I missing ?
I have *< at >qaiglobal.com in the blacklist, but still I get mail from them 
in the quarantaine. How can I prevent this ? I thought those mails would 
just be discarded, so I never see them, not in my mail-client but also 
not in Maia.

Thanks,

Koenraad Lelong.

Auto-confirm items older than a date

Antonio Gutierrez — 2012-05-22T09:50:10

Hi all! 

I would like to create a new cron job to auto-confirm all the suspected spam older than X days (a week, maybe) 
and after, run process-quarantine.pl. Is there a way to do this with maia scripts... or should I build a  
custom query and run it out of the box? 

If 2) is enough marking the items with a C on maia_mail_recipients (before extracting mail_ids from maia_mail)  
and after run process-quarantine.pl ? 

Thanks all! 

Antonio. 
_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

process-quarantine.pl issue

Bob — 2012-05-19T18:07:49

I am not sure if this is active anymore. I can't find any archive 
articles to indicate activity.  After making endless searches I am out 
of ideas, so I am hoping someone is reading this.

A month or so ago I replaced qmail with postfix/maia/dovecot (I had been 
running dovecot with qmail). I have freeBSD  8.2 AMD64 (64-bit) OS.
I used the freeBSD ports to install. Everything works correctly with a 
single exception: process-quarantine.pl won't work correctly.

Initially, when I ran it I got a "no forks" "no threads" error. I have 
perl 10 and forks is indeed installed. To troubleshoot, I commented out 
the "die" in the search for forks/threads and ran the script again. It 
appears to process spam. However it doesn't seem to terminate cleanly. 
When I ran it with cron, I got this via email.

exiting at /var/maiad/maia/scripts/process-quarantine.pl line 767.

This is the "die" in do_exit.

I am not sure it is really processing, though it appears to be. The big issue is that when I check my running processes,

Spam getting through Mailguard

David Bell — 2012-05-07T22:59:19

Hello -

We have a client who's constantly receiving spam.

The client's Spam settings is set to mark an email as spam for anything that has a score of >=2.5.

As you can see via the provided link this particular client is receiving spam that is recording under 2.5 when it is clearly spam.

I would appreciate any recommendations on rectifying this situation.

http://www.impalanetworks.com/downloads/John_Doe-Spam_Cleanup.docx


Thank you,
David Bell
Impala Networks Inc
www.impalanetworks.com<http://www.impalanetworks.com/>
P: (505) 327-7300

_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

message size limit per user basis

Indunil Jayasooriya — 2012-05-02T03:28:55

Hi maia guys,

Is there a way to apply message size limit per user basis in maia or
amavisd.new ?


setting

message_size_limit = 10000000  in main.cf in postfix applies globally.

I Do NOT expect it. instead I need user level size limits.

Let's say.


Manager needs 20 MB mail size limit for incoming and outgoing.

secretary needs 10 MB mail size limit for incoming and outgoing.
The rest needs 5 MB mail size limit for incoming and outgoing.


How to achieve the above tasks with maia MailGuard 1.0.2a or amavisd-new?

 **

mime_decode-1 file utility failed

Torben Dam Jensen — 2012-04-10T08:57:09

I seem to have trouble with the /usr/bin/file utility, and simple can 
not grasp why. This is a brand new installation, everything latest build.

I run maia/avavis-new.
The mail will go through but I end up with lots of attachments in the 
amavis folder.

Apr  9 09:38:42 mail amavis[24972]: (24972-04) TROUBLE in check_mail: 
mime_decode-1 FAILED: 'file' utility (/usr/bin/file) failed, exit 1 at 
(eval 99) line 160.
Apr  9 09:38:42 mail amavis[24972]: (24972-04) PRESERVING EVIDENCE in 
/var/lib/amavis/tmp/amavis-20120409T080514-24972
Apr  9 09:38:42 mail postfix/smtp[26224]: 9A33E10AA290: 
to=<user-9IKiO1iGCm/QT0dZR+AlfA< at >public.gmane.org>, relay=127.0.0.1[127.0.0.1]:10024, delay=433116, 
delays=433115/0/0/1.3, dsn=4.5.0, status=deferred (host 
127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=24972-04, 
mime_decode-1 FAILED: 'file' utility (/usr/bin/file) failed, exit 1 at 
(eval 99) line 160. (in reply to end of DATA command)

"file" version is 5.03, and can be executed by amavis.
root< at >mail:/var/w

process-quarantine.pl: Segementation fault

Lists — 2012-04-04T15:38:48

Hi all,
 
I am running Maia v1.0.3 (svn 1575) on Debian 6.0.4.  I have emails from cron when running the "process-quaratnine.pl --learn --report" job; it says "Segmentation fault".
 
I have run the job from the shell as the maia user and it still gives the Segementation fault (I figured it would, but felt it was worth trying).  There is no core dump.
 
I saw a similar post in the archives, but it was for FreeBSD and had something to do with the libc version.  It turned out to be a benign error as the script still ran successfully.  I am wondering if it may be the same thng here?  Perhaps a benign error?
 
I ran the script again through strace hoping there would be something obvious.  There are a number of " ENOENT (No such file or directory)" entires for various files, but I am not sure if that is normal.  I can post a link tot he strace output, if that would help?
 
Please advise.  Thanks! :-)
 
-Alan
 
 
 
_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS

Quarantin settings

Alan Murrell — 2012-03-31T18:54:48

I have just installed Maia Mailguard (svn 1585) and have it  
authenticating against our Exchange Server using LDAP.  So far my  
testing is working quite well, but I do have a couple of  
questions/clarifications:

   1.) Domain-level Quarantine: I added my organisation's domain, then  
went into its settings to adjust the tagging and quartine levels.  I  
set the following options:

   Detected spam should be: Labeled
   Add a prefix to the sujects of spam?: Yes
   Add X-Spam: Headers when Score is >=: -999
   Consider mail 'Spam' when Score is >=: 6
   Quarantine Spam when Score is>=: 999 (this was set automatically  
and is unchangeable, I am guessing due to me not quarantining)

Now, if I set "Detected Spam should be: Quarantined", then the  
"Quarantine Spam" setting always changes to the same value as the  
"Consider mail 'Spam' when" score, which makes sense.

My question: Is there a way to configure it so I can set detected spam  
to, say "6" and quarantine spam at at 15, so spam with scores between

Bugs with Maia 1.0.3 Trunk 1581

Marcel Blenkers — 2012-03-28T19:38:02

_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

forks perl library and jailed environments: asuggestion

Matías Pizarro — 2012-03-28T18:33:46

I have deployed maia in a FreeBSD jailed environment. This makes the 
reference to 127.0.0.1 as the localhost loopback illegal.
This causes a problem with the perl forks library as it only allows 
"connections from the default local machine IPv4 loopback address"

http://linux.die.net/man/3/forks :
*INETsocketIPmask*

For security, inter-thread communicationINETsockets only will allow 
connections from the default local machine IPv4 loopback address (e.g 
127.0.0.1). However, this filter may be modified by defining the 
environment variable"THREADS_IP_MASK"with a standard perl regular 
expression (or with no value, which would disable the filter).


I have kludged past this by modifying by hand the default value of 
THREADS_IP_MASK in foirks.pm. I am not very familiar with Perl so I am 
not sure exactly how this can be handled. Could it be possible to set in 
maiad this environment variable to a value defined in maiad.conf. I 
guess it could be $inet_socket_bind though it would probably be better 
to add an

bugreport or error in setup

Marcel Blenkers — 2012-03-26T20:02:29

_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

Need help! Maia stopped working..

Marcel Blenkers — 2012-03-26T18:05:38

_______________________________________________
Maia-users mailing list
Maia-users-fBBSUI5vRLiWd6l5hS35sQ< at >public.gmane.org
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

Infected mail detected but passed clean

Matías Pizarro — 2012-03-23T11:17:11

Hi,

I am installing postfix + maia + clamAv on my server. The setup seems to 
work fine but clamAv positives seem to be ignored by Maia.
I have searched the mailing list and googled the issue but I don't seem 
to find anything related to my issue.
I am using Sanesecurity signatures.
I first thought clamAv was not called or was not spotting the signature 
but this part seems to work fine. I have pinning down the issue to 
clamAv reporting that a malicious signature was found but maia passing 
back the message to postfix, reporting it clean.
...
Mar 23 11:24:22 mail maiad[45224]: (45224-01) virus_scan: 
(Sanesecurity.TestSig_Type4_Hdr.2.UNOFFICIAL), detected by 1 scanners: 
ClamAV-clamd
...
Mar 23 11:24:22 mail maiad[45224]: (45224-01) Passed CLEAN, 
[209.85.161.170] [209.85.161.170] <sender-04z7ZWah5hHQT0dZR+AlfA< at >public.gmane.org> -> 
<recipient-zSUWd5d9zz0eIZ0/mPfg9Q< at >public.gmane.org>, Message-ID: 
<CAGZCfx8bfeoua_B9fWMzod6z7xKSbv+NXkDvECoLCxv3pJiKWw-JsoAwUIsXosN+BqQ9rBEUg< at >public.gmane.org>, 
Hits: 0, 295 m

Patch for maia-amavisd with spamassassin 3.3.1

Jonathan — 2012-03-15T23:01:11

Hi all:

When setting up my evaluation server for maia-mailguard, I came across
the issue described here with spamassassin 3.3.1 and perl 10.

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6290

I notice that someone else has posted to the mailing list about this,
but they didn't supply a patch.

I've attached a patch for amavisd-maia which should fix the issue.

I'm not sure if the line is needed for spamassassin 3.2.x. If it is,
maybe there's some way to check the version and call the line if needed.
Everything appears to be working fine for me without it.

Jonathan

diff -cr maia-1.0.2c/amavisd-maia maia/amavisd-maia
*** maia-1.0.2c/amavisd-maia2011-04-14 08:23:46.000000000 -0600
--- maia/amavisd-maia2012-03-15 15:26:45.157931903 -0600
***************
*** 13890,13896 ****
      my($addrlstfactory) = Mail::SpamAssassin::DBBasedAddrList->new;
      $spamassassin_obj->set_persistent_address_list_factory($addrlstfactory);
    }
!   $spamassassin_obj->{bayes_scanner} = new Mail::SpamAssassin::Bayes

Proposed patch for Trac ticket 441 (Mysql server goneaway)

Jonathan — 2012-03-15T22:59:56

Hi all:

I've been working on setting up an evaluation server with maia-mailguard
and this issue has been driving me crazy.

So, I've created a patch which should fix it.

In this case, I know the server is lightly loaded, and as such
amavisd-maia's mysql connections are timing out due to inactivity. Also,
this patch allows for amavisd-maia to survive a mysql restart.

The idea is that if the connection is timed out, clear the cached
connection and try to reconnect. If you've already tried to reconnect
once, the logic is the same as before.



Hopefully this works for someone else, and can be added to the next
revision.

Jonathan

PS: Yes, I know using goto is generally not good practice, but in this
case, simple is better. I could call the function recursively, but then
I have to re-create the return logic, which would be much more complicated.

*** maia-1.0.2c/amavisd-maia2011-04-14 08:23:46.000000000 -0600
--- maia/amavisd-maia2012-03-15 15:06:26.940438582 -0600
***************
*** 11679,11687 ****
---

Rules problem

Robert Fitzpatrick — 2012-03-14T13:22:47

I am trying to figure out why some rules are triggered when running a
test message on the command line versus in Maia 1.0.2c with Spamassassin
3.3.2.

For example, I have a false negative delivered yesterday to the
recipient that Maia shows in the non-spam cache with a score of 1.693.
When I 'View Raw' and copy the message to a file on the server and run a
test against spamassassin as the vscan user, some rules are triggered
that do not show in the Maia results. This message triggers the rule
NML_ADSP_CUSTOM_MED when tested from the command line, but does not show
in the Maia scores.

I'm thinking the rule is not in Maia, so I ran a query on the Maia
database and find that this rule was first triggered on 2/13 and last
today on other message for a total hit count of over 71K times matching
stats in Maia for this rule.

If find this quite a lot. What would cause a message to hit a rule from
the command line and not in Maia?

Thanks, Robert

Scripts to delete old SQL users

Douglas Mortensen — 2012-03-08T22:53:48

We have maia setup to auto-create local accounts in MySQL when new email addresses are discovered for our customers inbound email. But it doesn't auto-delete the old users after the employees are terminated from our customer's employment. So over time we get a lot of dead users stacked up. Then if we have daily digests going out to them, we get bounces, etc.

I am comfortable deleting any users with no cached email (we cache spam & ham for 7 days). Any user who doesn't have spam or  ham probably doesn't exist anymore.

I didn't see a way to do this built-in to another script, so I created the following script & SQL file & set the script to run as a nightly cron job for the root user.

Please review & let me know if I am not using the correct tables/fields, or if you see a better way to do it. But this definitely is working & seems accurate to me.

/root/scripts/select-old-users.sql:
====================================
SELECT DISTINCT user_name FROM maia_users LEFT JOIN maia_mail_recipients ON maia_users.id

Maia SQL Performance issues

Casartello, Thomas — 2012-03-08T19:06:40

Hello there,

I've been having some MySql performance issues with my maia system. I have two mail scanners running amavisd-maia and a separate SQL server that's also running the web interface and perl scripts. I'm having problems with the performance of the SQL database. We are looking to upgrade the server this year to something with more horsepower as we have a very large amount of users. One example is that I've had to change the process-quarantine job to run only once daily from every hour because it would always roll over into the next hour and two would start running and eventually the sql database would grind to a halt and start holding up all of our email messages from being delivered. For a while running once daily worked ok, but now the daily process quarantine job will take hours to run (I start it at 4 AM, and it'll still be running at 2 PM sometimes.) Any suggestions on what I can do about the process-quarantine script and any tips on how I can get some more performance out of this database?

To

postfix content_filter ?

Stefan G. Weichinger — 2012-03-06T13:37:32

I ran my maia system for years successfully and I mostly did not "touch
the running system".

Now, in the process of migrating to a new box, I also review my setup.

Back then I configured a special smtpd in postfix's master.cf:

smtp-amavis unix - - n - 2 lmtp
    -o lmtp_data_done_timeout=1800
    -o lmtp_send_xforward_command=yes
    -o disable_dns_lookups=yes
    -o max_use=20

and another block:

# maia-related stuff. sgw, aug-24-2005

# handle both the canonicalization and virtual_alias_maps later
# (this will provide content filter with largely unmodified addresses)
#
pre-cleanup  unix n-n-0cleanup
    -o virtual_alias_maps=
    -o canonical_maps=
    -o sender_canonical_maps=
    -o recipient_canonical_maps=
    -o masquerade_domains=


which I call in the main smtp:

my.ip.add.ress:smtp      inet  n       -       n       -       20
smtpd
    -o cleanup_service_name=pre-cleanup
    -o myhostname=my.fqdn

----

The smtp-amavis is called within main.cf:

content_filter = smtp-amavis:[127.0.0.1]:

Moving maia: from mysql 4.1 to 5.1

Stefan G. Weichinger — 2012-02-27T19:28:42

Please forgive me for maybe asking an faq.

I couldn't find it on the website right now and would like to ask for
your advice.

I have to move maia from an old Suse 10.1 system to a recent gentoo box.

The old system runs mysql-4.1.1.13 ... the maia-db has most of its
tables in InnoDB-format and with "latin1_swedish_ci" collation.

Don't ask why, I couldn't answer ...

I tried the naive way: as I use automysqlbackup on the old host, I
copied the tarball over and tried to import it into the newer
mysql-5.1.61 DB.

It failed with an error saying "duplicate primary key" or something, I
DROPPED the db as I now know that I have to somehow convert things, right?

The new DB runs utf8_unicode_ci collation.

Could someone point me at some how-to-convert-my-DB?

Thanks in advance, Stefan!

Undefined index util.php

Ronny Wagner — 2012-02-25T19:53:16

Hello Community,

i have a problem with a notice from the webinterface from maia.

Message:
Notice: Undefined index: button_rescue in /xxx/mail_b/maia_db/util.php on line 150 Notice: Undefined index: button_ns_delete in /xxx/mail_b/maia_db/util.php on line 150

Line 150
            return array($lang['button_rescue'], $lang['button_confirm_spam'], $lang['button_ns_delete']);

Notice: Undefined index: button_report_spam in /xxx/mail_b/maia_db/util.php on line 148 Notice: Undefined index: button_ns_delete in /xxx/mail/mail_b/maia_db/util.php on line 148

Line 148
            return array($lang['button_confirm_ham'], $lang['button_report_spam'], $lang['button_ns_delete']);

I use a froxler Account for my webinterface Version "svn 1578". Is here the php info level to high?

Have anybody any informations for me?

Thank you very much.

Ronny