Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Mailscanner + spamassassin + clamav package

    Scheduled Pinned Locked Moved pfSense Packages
    313 Posts 54 Posters 305.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      andrew0401
      last edited by

      Unable to resolve e-sac.siteseguro.ws on a dns lookup.

      Regards

      Andrew

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        @andrew0401:

        Unable to resolve e-sac.siteseguro.ws on a dns lookup.

        I've tried access this url from many random web proxies and all listed site content.

        can you try changing you dns server to 8.8.8.8 (google)?

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • M
          Metu69salemi
          last edited by

          I got the page to view

          1 Reply Last reply Reply Quote 0
          • A
            andrew0401
            last edited by

            We run pfblocker on the firewall - disabled it and the page appears - I wonder which list your site is on?

            Regards

            Andrew

            1 Reply Last reply Reply Quote 0
            • A
              andrew0401
              last edited by

              Spoke too soon - yes I can see the page - but still unable to install the package - exact same fail message  "unable to download"

              Andrew

              1 Reply Last reply Reply Quote 0
              • A
                andrew0401
                last edited by

                Tried to download the package manually - Clamd rejected access to the page?

                Andrew

                1 Reply Last reply Reply Quote 0
                • marcellocM
                  marcelloc
                  last edited by

                  @andrew0401:

                  We run pfblocker on the firewall - disabled it and the page appears - I wonder which list your site is on?

                  The host is in Brazil, maybe you applied deny both on top spammers list.

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • A
                    andrew0401
                    last edited by

                    Tring to put an exception for your site above the pfblock list - otherwise I might have to be less harsh on what is blocked!

                    The package now seems to be installed OK - time to start tuning!

                    Andrew

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      @andrew0401:

                      I might have to be less harsh on what is blocked!

                      There are good guys on Brazil too  ;)

                      You can change pfBlocker top spammers action to alias online and then block access only to port 25.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • A
                        andrew0401
                        last edited by

                        After a bit of playing it appears that everything is working - I say appears because whilst known good messages get passed and deliberate bad messages do not appear, I seem unable to get any report/log/message about what mailscanner is actually doing. What is it rejecting beyond my known, deliberately introduced spam.  Looked at a few guides to mailscanner and finished up confused.

                        Is there a simple(!) "how to get activity reports out of mailscanner"

                        Thanks

                        Andrew

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          It's quite simple

                          If you have selected on general tab

                          • log destination = /var/log/maillog

                          • update frequency = every Xminutes

                          Simple go to diagnostics -> search mail

                          Select:

                          • log type = QUEUE

                          • iCTRL+CLICK Status info on Message fields

                          • select sqlite file(s) to search

                          • and press search

                          spam_search.png
                          spam_search.png_thumb

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • A
                            andrew0401
                            last edited by

                            Thanks, but what I was after is why things are rejected and potentially review rejected/quarantined items for subsequent approval (or have I missed something in my setup?)

                            Andrew

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              On this current version, you are able only to see amount of messages on quarantine.

                              status -> postfix queue

                              the mailscanner package use native sqlite2 databases while mailscanner use sqlite3 to store quarantine data.

                              There is a way to enable sqlite3 on mailscanner, but I'll need to rewrite a lot to update it to sqlite3 only.

                              Maybe next version I include a tab for quarantine.

                              Today I use only reject, attach or subject action for spam on my system.

                              If you really need this, you can make a donation to mailscanner package so I can write it for you.

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • A
                                andrew0401
                                last edited by

                                Just found the following in the log

                                php: : The command '/usr/local/dcc/dcc_conf stop' returned exit code '126', the output was '/usr/local/dcc/dcc_conf: Permission denied'

                                Also seem to be having some problems with what should be spam identified by rules in postfix is actually being passed - maybe best in the morning rather than late on a sunday night!

                                Andrew

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  Did you:

                                  Inlcude /^Subject:/ WARN line in Acl Headers after all your Subject rules.
                                  enabled thirdpart antispam, selected message hold mode and software?
                                  enabled all default options(yes) on mailscanner gui?

                                  Can you see mailscanner action with a tail -f /var/log/maillog | grep -i mailscanner

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    andrew0401
                                    last edited by

                                    Had the WARN line as the first line in the ACL header - trying as last line

                                    Mailscanner enables, queue set to auto and mailscanner+ spam+ virus selected.

                                    Exactly which option in mailscanner gui are you referring to?

                                    One discovery - it looks like most of the problems are related to mail retrieved from a pop3 mailbox by fetchmail.

                                    Andrew

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by

                                      @andrew0401:

                                      One discovery - it looks like most of the problems are related to mail retrieved from a pop3 mailbox by fetchmail.

                                      Mailscanner works together with postfix, how fetchmail forward these messages to postfix daemon?

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        andrew0401
                                        last edited by

                                        Fetchmail is running on another box (Ubuntu) and forwards to the pfsense box running the scanner.

                                        Just had a complete freeze of the scanner and had to rebuild from scratch - the install hung at

                                        PCRE-8.21-1.TBZ (Extracting) after I hit enter it continued.

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          andrew0401
                                          last edited by

                                          Not sure that my theory of using another machine to run fetchmail is going to work.  It appears that the SMTP traffic (going direct to pfsense scanner) is being processed correctly, but POP3 traffic collected by the other machine using fetchmail and then forwarded to the scanner is not being scanned for spam - my guess is that because it is on the same network it assumes it is whitelisted?  Or am I more confused than usual?

                                          Andrew

                                          1 Reply Last reply Reply Quote 0
                                          • N
                                            ncsidaho
                                            last edited by

                                            @marcelloc:

                                            On this current version, you are able only to see amount of messages on quarantine.

                                            status -> postfix queue

                                            the mailscanner package use native sqlite2 databases while mailscanner use sqlite3 to store quarantine data.

                                            There is a way to enable sqlite3 on mailscanner, but I'll need to rewrite a lot to update it to sqlite3 only.

                                            Maybe next version I include a tab for quarantine.

                                            Today I use only reject, attach or subject action for spam on my system.

                                            If you really need this, you can make a donation to mailscanner package so I can write it for you.

                                            I would be interested in a quarantine tab with a release and whitelist function for valid messages that get caught in the filter.
                                            please PM me with what you feel an appropriate donation would be

                                            UPDATE: After speaking to Marcello over PM, he has agreed to work on adding a quarantine tab to the mailscanner. I have made a donation to this effort and encourage anyone else that is interested to please donate as well. I feel a the addition of the quarantine / white list function adds a lot of value and functionality. Right now I have many clients using hosted solutions for spam filtering but would much prefer to have the it on my pfsense installations

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.