Mailscanner + spamassassin + clamav package

alex_ipx · Dec 21, 2011, 10:48 AM

Hello,

I am testing your mailscanner package for personal purpose and i have several questions and some ideas.

First about my topology i have one mail server stand alone and a pfsense running on a physical machine with postfix forwarder and mailscanner. Every mail that should end up in mail server, first arrive in pfsense box and mailscanner and clamav should search for spam and virus, then postfix forwarder send forward this message by relaying it to mail server.

For now the simple part its working. Every message that arrive in pfsense box it's send to mail server. But i see no searching from mailscanner. Here is a part of system log:

Dec 21 10:12:47 mx2 postfix/smtpd[20485]: connect from mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/smtpd[20485]: 34E6DEF5FB4: client=mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/cleanup[20858]: 34E6DEF5FB4: message-id=4EF194D9.5030404@domain.ro
Dec 21 10:12:47 mx2 postfix/smtpd[20485]: disconnect from mail.domain.ro[xxx.xxx.xxx.xxx]
Dec 21 10:12:47 mx2 postfix/qmgr[54348]: 34E6DEF5FB4: from=alexandru.munteanu@domain.ro, size=1350, nrcpt=1 (queue active)
Dec 21 10:12:47 mx2 postfix/smtp[21058]: 34E6DEF5FB4: to=user@dom2.ro, relay=xxx.xxx.xxx.xxx[yyy.yyy.yyy.yyy]:25, delay=0.09, delays=0.01/0/0.04/0.04, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 4A02223BCC)
Dec 21 10:12:47 mx2 postfix/qmgr[54348]: 34E6DEF5FB4: removed

As you can see, there is no verification by anyone. Usually in linux, there is a part in log where you can see even clamav searching for virus.

here are some commands and output:

ps ax | grep -i mailscanner

55907 ?? Is 0:00.02 MailScanner: master waiting for children, sleeping (perl5.12.4)
56088 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)
56228 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)
56252 ?? S 0:00.11 MailScanner: waiting for messages (perl5.12.4)
56349 ?? S 0:00.20 MailScanner: waiting for messages (perl5.12.4)

Is there a way to se actually that the mail was scanned?

Some ideas for mailscanner interface:

Add a tab for quarantine where administrator could release some important mails that have been marked as spam
Add a mailwatch interface for mailscanner.

Thank you very much /user@dom2.ro /alexandru.munteanu@domain.ro

marcelloc · Dec 21, 2011, 10:57 AM

Go on postfix antispam tab and enable mailscanner integration.

Mailwatch and quarantine tab are on my mind, it will take some time, but its on my todo list.

tojaktoty · Dec 22, 2011, 6:38 AM

How would this compare versus establishing a Windows 2010 Edge Transport mail server in a dmz to filter spam to the Hub Transport?

wagonza · Dec 22, 2011, 6:46 AM

OT but my experience of any Windows anti-spam filtering (forefront im looking at you) fails dismally.

alex_ipx · Dec 22, 2011, 7:21 AM

@marcelloc:

Go on postfix antispam tab and enable mailscanner integration.

Mailwatch and quarantine tab are on my mind, it will take some time, but its on my todo list.

I have already selected "Third part Antispam Settings > Software > Mailscanner + Spamassassin + clamav" but still doesn't appear in logs that any message it's checked for spam/virus.

I always download last version of i386 pc version, and even if i install postfix forwarder first or mailscanner first, i end up with errors that can't find some files or some errors in different config files etc. Usually i fix them step by step.

Should i try amd64 version? Did you work more at that version then i386?

Thank you very much. And you are doing a great job with this antispam filter, i hope soon it will be full functional.

marcelloc · Dec 22, 2011, 12:02 PM

Do you have this options on your current version?

files.pfsense.org are offline, if you tried installing it today, that's why you found missing files.

marcelloc · Dec 22, 2011, 12:51 PM

@tojaktoty:

How would this compare versus establishing a Windows 2010 Edge Transport mail server in a dmz to filter spam to the Hub Transport?

Take a look on features that postfix, mailscanner, spamassassin has to block spam.

Here are some options you can configure:

spf lookup
anti zombie daemon
strong header verification
only process valid exchange recipients
Rbl checks before message body transfer
phishing scan
Bayes,ryzor,pyzor,dcc scans
acls to deny or reject messages based on headers, subject, body, attachments, etc
message content protection(mcp) features to protects company's data
web bugs message scan

OT but my experience of any Windows anti-spam filtering (forefront im looking at you) fails dismally.

I have no idea about microsoft antispam features. I use a unix server in front of exchange server for about 10 years.

wagonza · Dec 22, 2011, 5:08 PM

@marcelloc:

I have no idea about microsoft antispam features. I use a unix server in front of exchange server for about 10 years.

likewise, actually close on 15 years now. The reason I mention this is because a fairly large hosted exchange environment required a unix layer to handle the spam as the MS portion was just not cutting it.

marcelloc · Jan 5, 2012, 2:17 AM

Hi all,

version 0.2.1 of mailscanner is out.

changes:

fix service status
fix missing dirs in clamav startup script
fix bug in mailscanner startup script

gwhynott · Jan 5, 2012, 5:52 PM

@marcelloc:

Hi all,
version 0.2.1 of mailscanner is out.

I too am having problems with the current version ( 4.83.5 pkg v0.2), the GUI does not reflect the newer version you have released, where might i install this from using pkg?

thanks,
greg

marcelloc · Jan 5, 2012, 5:58 PM

There is a post from Jimp saying that there is problem on replication to production server.

The solution is just wait. :(

gwhynott · Jan 5, 2012, 6:00 PM

standing by..

thanks!
g

marcelloc · Jan 6, 2012, 8:56 PM

Its up again, try to upgrade the package and feedback ;)

andrew0401 · Jan 12, 2012, 12:17 PM

Try to load the package and all I get is

Checking for package installation…
Downloading http://e-sac.siteseguro.ws/pfsense/8/All/MailScanner-4.83.5.tbz ... could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/MailScanner-4.83.5.tbz.
of MailScanner-4.83.5 failed!

Regards

Andrew

marcelloc · Jan 12, 2012, 12:28 PM

@andrew0401:

Try to load the package and all I get is

Checking for package installation…
Downloading http://e-sac.siteseguro.ws/pfsense/8/All/MailScanner-4.83.5.tbz ... could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/i386/packages-8.1-release/All/MailScanner-4.83.5.tbz.
of MailScanner-4.83.5 failed!

Regards

Andrew

Hi Andrew,

Can you try to browse this folder http://e-sac.siteseguro.ws/pfsense/8/All/

I just reinstalled the package to test and it worked.

andrew0401 · Jan 12, 2012, 1:48 PM

NO - tried IE & firefox

Andrew

marcelloc · Jan 12, 2012, 2:12 PM

I'll check with my host provider and feedback

andrew0401 · Jan 12, 2012, 2:30 PM

Unable to resolve e-sac.siteseguro.ws on a dns lookup.

Regards

Andrew

marcelloc · Jan 12, 2012, 5:47 PM

@andrew0401:

Unable to resolve e-sac.siteseguro.ws on a dns lookup.

I've tried access this url from many random web proxies and all listed site content.

can you try changing you dns server to 8.8.8.8 (google)?

Metu69salemi · Jan 12, 2012, 9:16 PM

I got the page to view