Mailscanner + spamassassin + clamav package

capitangiaco

hi all

I am trying the mailscanner-dev pkg and I am receiving this on the logs:

Mar 7 15:42:43 firewalla MailScanner[14828]: MailScanner E-Mail Virus Scanner version 4.83.5 starting…
Mar 7 15:42:43 firewalla MailScanner[14828]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Mar 7 15:42:43 firewalla MailScanner[14828]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Mar 7 15:42:43 firewalla MailScanner[14828]: Could not read file /usr/local/share/MailScanner/reports//inline.spam.warning.txt
Mar 7 15:42:43 firewalla MailScanner[14828]: Error in line 393, file "/usr/local/share/MailScanner/reports//inline.spam.warning.txt" for inlinespamwarning does not exist (or can not be read)
Mar 7 15:42:43 firewalla MailScanner[14828]: Could not read file /usr/local/share/MailScanner/reports//languages.conf
Mar 7 15:42:43 firewalla MailScanner[14828]: Error in line 187, file "/usr/local/share/MailScanner/reports//languages.conf" for languagestrings does not exist (or can not be read)
Mar 7 15:42:43 firewalla MailScanner[14828]: Syntax error in line 143, value "" for allowiframetags is not one of allowed values "yes","disarm","no"
Mar 7 15:42:43 firewalla MailScanner[14828]: Syntax error in line 144, value "" for allowformtags is not one of allowed values "yes","disarm","no"
Mar 7 15:42:43 firewalla MailScanner[14828]: Syntax error in line 150, value "" for allowobjecttags is not one of allowed values "yes","disarm","no"
Mar 7 15:42:43 firewalla MailScanner[14828]: Syntax error in line 145, value "" for allowscripttags is not one of allowed values "yes","disarm","no"
Mar 7 15:42:43 firewalla MailScanner[14828]: Syntax error in line 146, value "" for allowwebbugtags is not one of allowed values "yes","disarm","no"
Mar 7 15:42:43 firewalla MailScanner[14828]: Connected to Processing Attempts Database
Mar 7 15:42:43 firewalla MailScanner[14828]: Found 0 messages in the Processing Attempts Database
Mar 7 15:42:43 firewalla postfix/postscreen[54168]: DNSBL rank 3 for [177.103.221.63]:2184
Mar 7 15:42:43 firewalla MailScanner[14828]: Using locktype = flock

Giacomo

marcelloc

I tools like you need to select another language report.

reports//languages.conf

should be

reports/some_language/languages.conf

capitangiaco

thanks now it works!
compliments for the great job!!!!

(I needed to set 'no' and again 'disarm' "Removing/Logging dangerous or potentially offensive content" directives to make it works).

Giacomo

capitangiaco

I tried to re-install the system (I am using I386) from scratch, and I wrote some notes that may be of help:

sa-spamd and clamd start
manually added:
clamav_clamd_enable="YES"
clamav_freshclam_enable="YES"
spamd_enable="YES"
to /etc/rc.conf/local

Deliver from postfix to mailscanner, manually added:
header_checks = regexp:/usr/local/etc/postfix/header_checks to /usr/local/etc/postfix/main.cf
created the /usr/local/etc/postfix/header_checks with '/^Received:/ HOLD' inside
restarted with postfix reload
I didn't find the options that make this work from the web configurator <– help please! :)

Cannot lock /var/spool/MailScanner/incoming/Locks/clamavBusy.lock, No such file or directory
chown -R postfix /var/spool/MailScanner/incoming/Locks.

This is a very usefull pkg, thanks to Marcello for the great work!

Giacomo

marcelloc

I use all these options with no file hacking.

Did you installed postfix pfsense package to work with mailscanner?

capitangiaco

@marcelloc:

I use all these options with no file hacking.

Did you installed postfix pfsense package to work with mailscanner?

Installed first postfix forward and then mailscanner-dev

Giacomo

packages.jpg_thumb

marcelloc

header checks are on services -> postfix forwarder -> access lists

ncsidaho

Hello all
I have installed Posfix Forwarder and the mailscanner + spamassassin + clamav package. Postfix is working wonderfully but I think I must have somthing wrong in my configuration with mailscanner. In Postfix I have the 3rd party option enabled / The mode is set to auto. I have the mailscanner package enabled as well as the CLAMAV and spam assassin options enabled. But when I run the GFI Security Test EVERYTHING get through.

When I look at the process list for mailscanner I see
55735 ?? S 0:05.39 MailScanner: waiting for messages (perl5.12.4)
56936 ?? S 0:04.45 MailScanner: waiting for messages (perl5.12.4)
59478 ?? S 0:04.08 MailScanner: waiting for messages (perl5.12.4)
60031 ?? S 0:04.05 MailScanner: waiting for messages (perl5.12.4)

when I run tail -f /var/log/maillog |grep -i mailscanner

I get nothing?

if I restart mailscanner I get this

Mar 9 11:06:58 mailgateway MailScanner[55777]: Using locktype = flock
Mar 9 11:07:02 mailgateway MailScanner[57182]: MailScanner E-Mail Virus Scanner version 4.83.5 starting…
Mar 9 11:07:02 mailgateway MailScanner[57182]: Reading configuration file /usr/ local/etc/MailScanner/MailScanner.conf
Mar 9 11:07:02 mailgateway MailScanner[57182]: Reading configuration file /usr/ local/etc/MailScanner/conf.d/README
Mar 9 11:07:07 mailgateway MailScanner[56126]: Connected to Processing Attempts Database
Mar 9 11:07:07 mailgateway MailScanner[56126]: Found 0 messages in the Processi ng Attempts Database
Mar 9 11:07:07 mailgateway MailScanner[56126]: Using locktype = flock
Mar 9 11:07:07 mailgateway MailScanner[58764]: MailScanner E-Mail Virus Scanner version 4.83.5 starting…
Mar 9 11:07:07 mailgateway MailScanner[58764]: Reading configuration file /usr/ local/etc/MailScanner/MailScanner.conf
Mar 9 11:07:07 mailgateway MailScanner[58764]: Reading configuration file /usr/ local/etc/MailScanner/conf.d/README
Mar 9 11:07:08 mailgateway MailScanner[57182]: Connected to Processing Attempts Database
Mar 9 11:07:08 mailgateway MailScanner[57182]: Found 0 messages in the Processi ng Attempts Database
Mar 9 11:07:08 mailgateway MailScanner[57182]: Using locktype = flock
Mar 9 11:07:16 mailgateway MailScanner[58764]: Connected to Processing Attempts Database
Mar 9 11:07:16 mailgateway MailScanner[58764]: Found 0 messages in the Processing Attempts Database
Mar 9 11:07:16 mailgateway MailScanner[58764]: Using locktype = flock

any help is apperciated

marcelloc

check if you can find /^from:/ HOLD on view configuration -> header check

If not, change mailscanner Message Hold mode on antispam tab to manual and include the above line on access lists -> header

ncsidaho

@marcelloc:

check if you can find /^from:/ HOLD on view configuration -> header check

If not, change mailscanner Message Hold mode on antispam tab to manual and include the above line on access lists -> header

That worked
thank you marcello

tanhosy

I have a question (can be a bit stupid!). Can MailScanner + Postfix run in transparent mode?.
The reason is I have a pfsense box with 4 interfaces + 01 mail server stand alone. I want to run pfsense without intervention on the mail server.

marcelloc

Well, I did no transparent mode on this package but if you know how to do it on postfix I can merge this on next release.

capitangiaco

anyindea to rotate the /var/log/maillog ?

thanks

Giacomo

marcelloc

@capitangiaco:

anyindea to rotate the /var/log/maillog ?

Not yet but sometime in the future ;)

capitangiaco

I noticed a 'strange' thing, incoming attachments files become zipped, cool feature, but who is the author of this ?

Giacomo

marcelloc

It`s a mailscanner feature but you can disable it on gui(I'm not in front of one right now to point the option ;)).

capitangiaco

Hi Marcelloc

zip attachments:
Mailscanner - Attachments - Attachments features

very cool dude! I love my mail-firewall
I added squirrelmail-imapproxy, I am gonna try to create a pkg.
You are my hero :)

thanks again

Giacomo

ics

Hi all,

I've installed mailscanner + spamassassin + clamav package and I cannot get spamassassin working…

Clamav works great (tested with eicar file) but the GTUBE test for spamassassin fails : spam is not detected, score is 0, and message is delivered.
I've made the test from inside and outside the local network. Both fails.

May 2 10:07:52 srvmx06 MailScanner[22383]: Spam Checks: Starting
May 2 10:07:52 srvmx06 MailScanner[22383]: Expired 2 records from the SpamAssassin cache
May 2 10:07:53 srvmx06 MailScanner[22383]: Message 4DAC68A939.ABA57 from xx.xx.xx.xx (whatever@yahoo.com) to domain.com is not spam, SpamAssassin (not cached, score=0, required 6, autolearn=not spam)
May 2 10:07:53 srvmx06 MailScanner[22383]: Delivery of nonspam: message 4DAC68A939.ABA57 from whatever@yahoo.com to user@domain.com with subject GUARANTEED
May 2 10:07:53 srvmx06 MailScanner[22383]: Spam Checks completed at 2784 bytes per second

Can you help me to solve that ?

Thanks

ics

I've found the solution myself :
just run sa-update to download spamassassin's rules.

:)

zlyzwy

Hi ,

I am receiving the error in maillog

May  2 21:40:50 pfsense MailScanner[44759]: MailScanner E-Mail Virus Scanner version 4.83.5 starting... 
May  2 21:40:50 pfsense MailScanner[44759]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf 
May  2 21:40:50 pfsense MailScanner[44759]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README 
May  2 21:40:50 pfsense MailScanner[44759]: Syntax error in line 143, value "" for allowiframetags is not one of allowed values "yes","disarm","no" 
May  2 21:40:50 pfsense MailScanner[44759]: Syntax error in line 144, value "" for allowformtags is not one of allowed values "yes","disarm","no" 
May  2 21:40:50 pfsense MailScanner[44759]: Syntax error in line 150, value "" for allowobjecttags is not one of allowed values "yes","disarm","no" 
May  2 21:40:50 pfsense MailScanner[44759]: Syntax error in line 145, value "" for allowscripttags is not one of allowed values "yes","disarm","no" 
May  2 21:40:50 pfsense MailScanner[44759]: Syntax error in line 146, value "" for allowwebbugtags is not one of allowed values "yes","disarm","no" 
May  2 21:40:50 pfsense MailScanner[44759]: Connected to Processing Attempts Database

Does anyone know what's the problem?

Another newbie question…
How can I change the default value in Mailscanner?
Double Click or change in .conf file?

Thanks in advance!

Zlyzwy