Postfix - antispam and relay package

mschiek01 · Jul 27, 2012, 1:06 PM

@mschiek01:

Force the perl version:

change the first line of /usr/local/sbin/mailscanner

From:
#!/usr/bin/perl -U -I/usr/local/lib/MailScanner

To:
#!/usr/local/bin/perl5.12.4 -U -I/usr/local/lib/MailScanner

Then try to start from the command line. This should work

from

The first line is already "#!/usr/local/bin/perl5.12.4 -U -I/usr/local/lib/MailScanner".
I changed to "/usr/local/bin/perl5.12.4 -U -I/usr/local/lib/MailScanner" or "/usr/local/bin/perl5.10.1 -U -I/usr/local/lib/MailScanner"
There is no error if I tried to start the mailscanner. but it seems that the process is stuck at starting..

/usr/local/etc/rc.d/mailscanner start

Starting mailscanner.

Thanks very much for help:)

Zlyzwy

That won't work change it back to:

#!/usr/local/bin/perl5.12.4 -U -I/usr/local/lib/MailScanner

Then from the command line enter one of the following after it finishes try to start.

i386 only
pkg_add -f http://files.pfsense.org/packages/8/All/perl-5.12.4.tbz

amd64 only
pkg_add -f http://files.pfsense.org/packages/amd64/8/All/perl-5.12.4.tbz

zlyzwy · Jul 27, 2012, 1:29 PM

@mschiek01:

@zlyzwy:

@mschiek01:

Force the perl version:

change the first line of /usr/local/sbin/mailscanner

From:
#!/usr/bin/perl -U -I/usr/local/lib/MailScanner

To:
#!/usr/local/bin/perl5.12.4 -U -I/usr/local/lib/MailScanner

Then try to start from the command line. This should work

from

The first line is already "#!/usr/local/bin/perl5.12.4 -U -I/usr/local/lib/MailScanner".
I changed to "/usr/local/bin/perl5.12.4 -U -I/usr/local/lib/MailScanner" or "/usr/local/bin/perl5.10.1 -U -I/usr/local/lib/MailScanner"
There is no error if I tried to start the mailscanner. but it seems that the process is stuck at starting..

/usr/local/etc/rc.d/mailscanner start

Starting mailscanner.

Thanks very much for help:)

Zlyzwy

That won't work change it back to:

#!/usr/local/bin/perl5.12.4 -U -I/usr/local/lib/MailScanner

Then from the command line enter one of the following after it finishes try to start.

i386 only
pkg_add -f http://files.pfsense.org/packages/8/All/perl-5.12.4.tbz

amd64 only
pkg_add -f http://files.pfsense.org/packages/amd64/8/All/perl-5.12.4.tbz

HAHAHAHA~~~
Thank you very much~~~
It solved my problem totally….

Thanks again!
Zlyzwy

mschiek01 · Jul 27, 2012, 1:59 PM

Glad I could help :)

marcelloc · Jul 27, 2012, 2:32 PM

@mschiek01:

Jul 27 15:14:50 pfsense postfix/postfix-script[16474]: warning: not owned by postfix: /var/db/postfix/./2012-04-25.db
Jul 27 15:14:50 pfsense postfix/postfix-script[17029]: warning: not owned by postfix: /var/db/postfix/./2012-04-26.db
Jul 27 15:14:50 pfsense postfix/postfix-script[17082]: warning: not owned by postfix: /var/db/postfix/./2012-05-02.db
Jul 27 15:14:50 pfsense postfix/postfix-script[17087]: warning: not owned by postfix: /var/db/postfix/./2012-05-03.db
Jul 27 15:14:50 pfsense postfix/postfix-script[17153]: warning: not owned by postfix: /var/db/postfix/./2012-05-11.db

You can ignore these warnings.
These db files are the log files for mail search gui tab. Postfix complaint about it because it's on postfix db dir.

About the perl version, pfsense package forces version 5.12.4 but multiple perl version still need some checks/attention.

att,
Marcello Coutinho

note: Just to get easier to read the forum, prefer using [ code ] instead of [ quote ] when you need to include some logs on post. ;)

eri-- · Jul 31, 2012, 7:38 AM

Marcello,

since i was going through the package today, allow me some improvement comments.

Recipients (Get recipients from AD), can't this be integrated with the 2.0 Server manager?
There is all the code you need there!
Access Lists, can't you make an alias like interface so its easy to integrate and for consistency?
Just hid the complexity of postfix in the GUI and make it simple mail proxy? Look at endian for example for user interface guidelines.

Just my 2 cents.

marcelloc · Jul 31, 2012, 2:30 PM

Thanks ermal,

I'll take a look on this since I finish modsecurity and varnish3 new gui version.

att,
Marcello Coutinho

ics · Aug 7, 2012, 8:43 AM

Hi,

I've noticed that when a server is blocked because of its presence in a DNSBL, it is not logged in sqlite files.
We can only see that it has been blocked in maillog.

Is there a way to view it in search mail ?

Could we send logs to external syslog and keep track in sqlite ?

Thanks

mrfairsquare · Aug 7, 2012, 12:44 PM

I'm reposting here, as i think it's a better location than as it's own lonesome thread here –> http://forum.pfsense.org/index.php/topic,52293.0.html
–-

Hello to all who read this. After many days investigating and chewing on this particular issue, i have reached the conclusion, i need help... HELP!

ISSUE:
–-----
The postfix log db file is empty, and postfix does not or can not write to the db file.

Location i'm looking at: /var/db/postfix

TRIED SO FAR:
–-------------
1. Initially i found an error on line 54 when running this: /usr/local/bin/php -q /usr/local/www/postfix.php 01min - I fixed that, by changing the sync setting to "disabled", as was set to something else. So now it outputs just fine.

2. I made sure that sqlite was installed, by using the touch command as in an earlier post. -
"touch /etc/php_dynamodules/pdo
touch /etc/php_dynamodules/pdo_sqlite"

3. Discovered differences in permission in the /var/db/postfix folder, and attempted setting any any rules on file and folder permissions to no success or noticable effect, since reverted back to previous permissions.

4. Increased debugging level to 6, in an attempt to get more information.

5. Can find no errors or notable problems when using: # tail -f /var/log/mailog

6. Deleting the db files, restarting postfix and recieving a test e-mail to trigger a new db file.

7. Ensured set as follows: "Choose how often pfSense will transfer log files to Sqlite database.
To use Diagnostics -> Search mail you need to:
Select Loggin Destination to /var/log/maillog
Select update Sqlite frequency
Inlcude /^Subject:/ WARN line in Acl Headers after all your Subject rules. "

–-------------------
PROCESS INVOLVED:
–-------------------
This is the flow of what happens:

1. New e-mail comes in and shows in tail -f /var/log/maillog
2. If not already created, a db file is created for the current day in the /var/db/postfix folder
3. DB is created at 38,912 bytes.
4. 5 more e-mails come in, DB is still 38,912 bytes.

THEORY:
–-------
Postfix is not writing data to the log file, therefore either sqlite issue or permissions.

If anyone can help you'll be making me a very happy man, possibly enough to add a little spring in my step. ;D

VERSION:
–--------
2.0.1-RELEASE (i386)
FreeBSD pfsense-vm.***.com 8.1-RELEASE-p6 FreeBSD 8.1-RELEASE-p6

Peace. x

marcelloc · Aug 7, 2012, 3:11 PM

@ics:

I've noticed that when a server is blocked because of its presence in a DNSBL, it is not logged in sqlite files.
We can only see that it has been blocked in maillog.

Is there a way to view it in search mail ?

Did you tried to search it on noqueue ?

@ics:

Could we send logs to external syslog and keep track in sqlite ?

Not on current package version.

ics · Aug 8, 2012, 6:20 AM

@marcelloc:

@ics:

I've noticed that when a server is blocked because of its presence in a DNSBL, it is not logged in sqlite files.
We can only see that it has been blocked in maillog.

Is there a way to view it in search mail ?

Did you tried to search it on noqueue ?

Of course I did :)

marcelloc · Aug 10, 2012, 10:11 PM

"touch /etc/php_dynamodules/pdo
touch /etc/php_dynamodules/pdo_sqlite"

current package version use sqlite version2, so no need to enable pdo_sqlite.

you have selected update every minute, as well selected subject warn on access lists?

mrfairsquare · Aug 11, 2012, 7:27 AM

Hi Marcel,

I can confirm that i have settings set to update every minute and configured subject warn on access lists.

Unubtanium · Aug 24, 2012, 11:54 AM

I have two strange problems and hope someone can help to point me in the right direction of the solution to it!

Here goes:
On Page: In Services -> Postfix forwarder -> Access List (both problems are related to this page)

NR1: In the box/field Sender i have entered an email like this on its on line: info@club108.co.uk REJECT
BUT still on the 18th aug i got an email from them:


2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:41 postfix/postscreen[55280]: CONNECT from [216.75.30.240]:56243
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:41 postfix/postscreen[55280]: PASS OLD [216.75.30.240]:56243
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:41 postfix/smtpd[55431]: connect from mail.zoneedit.com[216.75.30.240]
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/smtpd[55431]: 148B811D31: client=mail.zoneedit.com[216.75.30.240]
2012-08-18 15:01:28	Local0.Info	LANIP	Aug 18 15:05:42 pf: 00:00:32.461734 rule 27/0(match): pass in on de0: (tos 0x0, ttl 49, id 16506, offset 0, flags [DF], proto TCP (6), length 60)
2012-08-18 15:01:28	Local0.Info	LANIP	Aug 18 15:05:42 pf:     216.75.30.240.56243 > WANIP.25: Flags [s], cksum 0xdc33 (correct), seq 1302170047, win 5840, options [mss 1460,sackOK,TS val 3096627653 ecr 0,nop,wscale 7], length 0
2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/cleanup[56044]: 148B811D31: warning: header Subject: CLUB 108 from mail.zoneedit.com[216.75.30.240]; from= <user29223@lws05.ldn5.groupnbt.net>to= <my@email.com>proto=ESMTP helo= <mail.zoneedit.com>2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/cleanup[56044]: 148B811D31: hold: header From: Club 108 <info@club108.co.uk>  from mail.zoneedit.com[216.75.30.240]; from= <user29223@lws05.ldn5.groupnbt.net>to= <my@email.com>proto=ESMTP helo= <mail.zoneedit.com>2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/cleanup[56044]: 148B811D31: message-id= <e1t2jem-0008eb-m2@lws05.ldn5.groupnbt.net>2012-08-18 15:01:28	Mail.Info	LANIP	Aug 18 15:05:42 postfix/smtpd[55431]: disconnect from mail.zoneedit.com[216.75.30.240]
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:42 MailScanner[61380]: New Batch: Scanning 1 messages, 1769 bytes
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:42 MailScanner[61380]: Filename Checks: Allowing 148B811D31.ACD2F msg-61380-1.txt
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Filetype Checks: Allowing 148B811D31.ACD2F msg-61380-1.txt
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Virus and Content Scanning: Starting
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Virus Scanning completed at 6753 bytes per second
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Spam Checks: Starting
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: SpamAssassin cache hit for message 148B811D31.ACD2F
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Message 148B811D31.ACD2F from 216.75.30.240 (user29223@lws05.ldn5.groupnbt.net) to evensen-it.com is not spam, SpamAssassin (cached, score=1.989, required 6, DKIM_ADSP_NXDOMAIN 0.80, RCVD_IN_DNSWL_NONE -0.00, UPPERCASE_75_100 1.19)
2012-08-18 15:01:29	Mail.Notice	LANIP	Aug 18 15:05:43 MailScanner[61380]: Delivery of nonspam: message 148B811D31.ACD2F from user29223@lws05.ldn5.groupnbt.net to my@email.com with subject CLUB 108
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Spam Checks completed at 75498 bytes per second
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Requeue: 148B811D31.ACD2F to 52D8711D36
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Uninfected: Delivered 1 messages
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Virus Processing completed at 10632 bytes per second
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 postfix/qmgr[42867]: 52D8711D36: from=<user29223@lws05.ldn5.groupnbt.net>, size=1084, nrcpt=1 (queue active)
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Deleted 1 messages from processing-database
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Batch completed at 3563 bytes per second (1769 / 0)
2012-08-18 15:01:29	Mail.Info	LANIP	Aug 18 15:05:43 MailScanner[61380]: Batch (1 message) processed in 0.50 seconds
2012-08-18 15:01:30	Mail.Info	LANIP	Aug 18 15:05:43 postfix/smtp[61179]: 52D8711D36: to=<my@email.com>, relay=MailServerLanIP[MailServerLanIP]:25, delay=1.6, delays=1.4/0/0.01/0.23, dsn=2.6.0, status=sent (250 2.6.0 <e1t2jem-0008eb-m2@lws05.ldn5.groupnbt.net> [InternalId=218] Queued mail for delivery)
2012-08-18 15:01:30	Mail.Info	LANIP	Aug 18 15:05:43 postfix/qmgr[42867]: 52D8711D36: removed

SO my question is, how can i make SURE that it uses my sender rules or is it using it but the email is not in the from field and 
this email info@club108.co.uk are presented in the header because this a forwarded email and i have to put this email in the MIME filed/box?

And NR2:

I have entered this domain in CIDR box/field on its own line: 
[b] venus.aleo.no OK[/b]

But when i check the log  see this??
[code]
postfix/postscreen[30282]: warning: cidr map /usr/local/etc/postfix/cal_cidr, line 4: bad address pattern: "venus.aleo.no": skipping this rule
[/code]

But in the description for the CIDR it says that i can use a domain but is this wrong? 
Because the IPs i have entered there are all oki?

Thanks to reading.. 

  ;D[/s]</e1t2jem-0008eb-m2@lws05.ldn5.groupnbt.net></my@email.com></user29223@lws05.ldn5.groupnbt.net></e1t2jem-0008eb-m2@lws05.ldn5.groupnbt.net></mail.zoneedit.com></my@email.com></user29223@lws05.ldn5.groupnbt.net></info@club108.co.uk></mail.zoneedit.com></my@email.com></user29223@lws05.ldn5.groupnbt.net>

louis-m · Aug 24, 2012, 12:20 PM

if you are using 2.1_x64, your gui config could show you one thing while postfix is doing another thing due to where it reads it's config from.
i don't think the package has been updated for 2.1_x64 yet if that's what you are using.
every time i do an upgrade of pfsense_x64, i have to copy /usr/local/etc/postfix to /usr/pbi/postfix-amd64/etc/postfix and then it works.

Unubtanium · Aug 24, 2012, 12:33 PM

Thanks for the heads up louis-m, but i am using 2.0.1 Release i386 .

Unubtanium · Aug 24, 2012, 2:07 PM

And one last question! 8)
how or why are an ip that are in a RBL being PASS NEW and not just automatically dropped after it is confirmed that the ip is on a rbl to save resources ?????????????


postfix/postscreen[8038]: DISCONNECT [190.167.194.178]:64340
postfix/postscreen[8038]: PASS NEW [190.167.194.178]:64340
postfix/postscreen[8038]: HANGUP after 2.2 from [190.167.194.178]:64340 in tests after SMTP handshake
postfix/postscreen[8038]: NOQUEUE: reject: RCPT from [190.167.194.178]:64340: 450 4.3.2 Service currently unavailable; from=<services@us-ups.com>, to=<novalidrecipients@domain.com>, proto=SMTP, helo= <us-ups.com>postfix/dnsblog[50328]: addr 190.167.194.178 listed by domain b.barracudacentral.org as 127.0.0.2
pf:     190.167.194.178.64340 > WANIP.25: Flags [s], cksum 0xf8f6 (correct), seq 5162395, win 8192, options [mss 1260,nop,nop,sackOK], length 0
postfix/postscreen[8038]: CONNECT from [190.167.194.178]:64340

[/s]</us-ups.com></novalidrecipients@domain.com></services@us-ups.com>

voona · Aug 29, 2012, 7:21 AM

Anyone? What permissions am i meant to use?

ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

Unubtanium · Aug 29, 2012, 7:46 AM

@voona:

Anyone? What permissions am i meant to use?

ERROR: Can't open /var/log/clamav/freshclam.log in append mode (check permissions!).
ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).

I did not even have this file when i did a fresh install so i created the file and just gave it rw-rw-rw-, maby not the smartest to do but it works.. and it is only my clamlog.. ;D

voona · Aug 30, 2012, 3:39 AM

Ok Clamd seems to be running now but im having issues with mail scanner actually enforcing the policy

For example i set the maximum attachment size to 0 (Blocking any attachments) and mail still flows through Postfix without being scanned / processed by mail scanner


Aug 30 10:08:13 	postfix/postscreen[3173]: CONNECT from [209.85.210.178]:38820
Aug 30 10:08:13 	postfix/postscreen[3173]: PASS OLD [209.85.210.178]:38820
Aug 30 10:08:13 	postfix/smtpd[3358]: connect from mail-iy0-f178.google.com[209.85.210.178]
Aug 30 10:08:14 	postfix/smtpd[3358]: 770AC739A6: client=mail-iy0-f178.google.com[209.85.210.178]
Aug 30 10:08:14 	postfix/cleanup[3948]: 770AC739A6: message-id= <canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>Aug 30 10:08:15 	postfix/qmgr[3429]: 770AC739A6: from=<xxxxxxxxxxxxxxx@gmail.com>, size=130538, nrcpt=1 (queue active)
Aug 30 10:08:16 	postfix/smtp[4255]: 770AC739A6: to=<xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxxxxxxxx.com.au>, relay=10.100.100.2[10.100.100.2]:25, delay=2.2, delays=2/0.02/0/0.23, dsn=2.6.0, status=sent (250 2.6.0 <canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>[InternalId=27] Queued mail for delivery)
Aug 30 10:08:16 	postfix/qmgr[3429]: 770AC739A6: removed
Aug 30 10:08:45 	postfix/smtpd[3358]: disconnect from mail-iy0-f178.google.com[209.85.210.178]</canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com></xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxxxxxxxx.com.au></xxxxxxxxxxxxxxx@gmail.com></canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>


Aug 30 10:09:59 	check_reload_status: Syncing firewall
Aug 30 10:09:59 	check_reload_status: Syncing firewall
Aug 30 10:10:00 	php: /pkg_edit.php: Restarting clamav-clamd daemon
Aug 30 10:10:07 	php: /pkg_edit.php: Restarting dccifd
Aug 30 10:10:07 	dccifd[56724]: 1.3.140 detected 0 spam, ignored for 0, rejected for 0, and discarded for 0 targets among 0 total messages for 5 targets since 08/30/12 10:00:13
Aug 30 10:10:07 	dccifd[15470]: 1.3.140 listening to /usr/local/dcc/dccifd for ASCII protocol
Aug 30 10:10:07 	php: /pkg_edit.php: Restarting MailScanner
Aug 30 10:10:11 	MailScanner[28826]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:11 	MailScanner[28826]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:11 	MailScanner[28826]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:11 	MailScanner[28826]: Using SpamAssassin results cache
Aug 30 10:10:11 	MailScanner[28826]: Connected to SpamAssassin cache database
Aug 30 10:10:11 	MailScanner[28826]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:16 	MailScanner[29081]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:16 	MailScanner[29081]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:16 	MailScanner[29081]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:16 	MailScanner[29081]: Using SpamAssassin results cache
Aug 30 10:10:16 	MailScanner[29081]: Connected to SpamAssassin cache database
Aug 30 10:10:16 	MailScanner[29081]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:21 	MailScanner[37257]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:21 	MailScanner[37257]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:21 	MailScanner[37257]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:21 	MailScanner[37257]: Using SpamAssassin results cache
Aug 30 10:10:21 	MailScanner[37257]: Connected to SpamAssassin cache database
Aug 30 10:10:21 	MailScanner[37257]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:26 	MailScanner[44670]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:26 	MailScanner[44670]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:26 	MailScanner[44670]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:26 	MailScanner[44670]: Using SpamAssassin results cache
Aug 30 10:10:26 	MailScanner[44670]: Connected to SpamAssassin cache database
Aug 30 10:10:26 	MailScanner[44670]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:31 	MailScanner[52918]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:31 	MailScanner[52918]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:31 	MailScanner[52918]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:31 	MailScanner[52918]: Using SpamAssassin results cache
Aug 30 10:10:31 	MailScanner[52918]: Connected to SpamAssassin cache database
Aug 30 10:10:31 	MailScanner[52918]: Enabling SpamAssassin auto-whitelist functionality...


postfix 28643  0.0  1.9 21916 19280  ??  Is   10:10AM   0:00.01 MailScanner: master waiting for children, sleeping (perl5.12.4)
postfix 28826  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.13 MailScanner: waiting for messages (perl5.12.4)
postfix 29081  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.14 MailScanner: waiting for messages (perl5.12.4)
postfix 37257  0.0  5.0 63832 51272  ??  S    10:10AM   0:02.16 MailScanner: waiting for messages (perl5.12.4)
postfix 44670  0.0  5.0 63832 51272  ??  S    10:10AM   0:02.23 MailScanner: waiting for messages (perl5.12.4)
postfix 52918  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.17 MailScanner: waiting for messages (perl5.12.4)

I have ticked the use 3rd Party Anti-Spam box in the postfix configuration. Anyone got a quick run through guide to get this setup and working properly ?

Unubtanium · Aug 30, 2012, 7:34 AM

@voona:

Ok Clamd seems to be running now but im having issues with mail scanner actually enforcing the policy

For example i set the maximum attachment size to 0 (Blocking any attachments) and mail still flows through Postfix without being scanned / processed by mail scanner


Aug 30 10:08:13 	postfix/postscreen[3173]: CONNECT from [209.85.210.178]:38820
Aug 30 10:08:13 	postfix/postscreen[3173]: PASS OLD [209.85.210.178]:38820
Aug 30 10:08:13 	postfix/smtpd[3358]: connect from mail-iy0-f178.google.com[209.85.210.178]
Aug 30 10:08:14 	postfix/smtpd[3358]: 770AC739A6: client=mail-iy0-f178.google.com[209.85.210.178]
Aug 30 10:08:14 	postfix/cleanup[3948]: 770AC739A6: message-id= <canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>Aug 30 10:08:15 	postfix/qmgr[3429]: 770AC739A6: from=<xxxxxxxxxxxxxxx@gmail.com>, size=130538, nrcpt=1 (queue active)
Aug 30 10:08:16 	postfix/smtp[4255]: 770AC739A6: to=<xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxxxxxxxx.com.au>, relay=10.100.100.2[10.100.100.2]:25, delay=2.2, delays=2/0.02/0/0.23, dsn=2.6.0, status=sent (250 2.6.0 <canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>[InternalId=27] Queued mail for delivery)
Aug 30 10:08:16 	postfix/qmgr[3429]: 770AC739A6: removed
Aug 30 10:08:45 	postfix/smtpd[3358]: disconnect from mail-iy0-f178.google.com[209.85.210.178]</canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com></xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxxxxxxxx.com.au></xxxxxxxxxxxxxxx@gmail.com></canygpjxck1vxv3szxtdz-vm-e8hqbjas5b3wtnnfvtvub_hjoq@mail.gmail.com>


Aug 30 10:09:59 	check_reload_status: Syncing firewall
Aug 30 10:09:59 	check_reload_status: Syncing firewall
Aug 30 10:10:00 	php: /pkg_edit.php: Restarting clamav-clamd daemon
Aug 30 10:10:07 	php: /pkg_edit.php: Restarting dccifd
Aug 30 10:10:07 	dccifd[56724]: 1.3.140 detected 0 spam, ignored for 0, rejected for 0, and discarded for 0 targets among 0 total messages for 5 targets since 08/30/12 10:00:13
Aug 30 10:10:07 	dccifd[15470]: 1.3.140 listening to /usr/local/dcc/dccifd for ASCII protocol
Aug 30 10:10:07 	php: /pkg_edit.php: Restarting MailScanner
Aug 30 10:10:11 	MailScanner[28826]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:11 	MailScanner[28826]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:11 	MailScanner[28826]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:11 	MailScanner[28826]: Using SpamAssassin results cache
Aug 30 10:10:11 	MailScanner[28826]: Connected to SpamAssassin cache database
Aug 30 10:10:11 	MailScanner[28826]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:16 	MailScanner[29081]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:16 	MailScanner[29081]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:16 	MailScanner[29081]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:16 	MailScanner[29081]: Using SpamAssassin results cache
Aug 30 10:10:16 	MailScanner[29081]: Connected to SpamAssassin cache database
Aug 30 10:10:16 	MailScanner[29081]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:21 	MailScanner[37257]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:21 	MailScanner[37257]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:21 	MailScanner[37257]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:21 	MailScanner[37257]: Using SpamAssassin results cache
Aug 30 10:10:21 	MailScanner[37257]: Connected to SpamAssassin cache database
Aug 30 10:10:21 	MailScanner[37257]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:26 	MailScanner[44670]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:26 	MailScanner[44670]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:26 	MailScanner[44670]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:26 	MailScanner[44670]: Using SpamAssassin results cache
Aug 30 10:10:26 	MailScanner[44670]: Connected to SpamAssassin cache database
Aug 30 10:10:26 	MailScanner[44670]: Enabling SpamAssassin auto-whitelist functionality...
Aug 30 10:10:31 	MailScanner[52918]: MailScanner E-Mail Virus Scanner version 4.83.5 starting...
Aug 30 10:10:31 	MailScanner[52918]: Reading configuration file /usr/local/etc/MailScanner/MailScanner.conf
Aug 30 10:10:31 	MailScanner[52918]: Reading configuration file /usr/local/etc/MailScanner/conf.d/README
Aug 30 10:10:31 	MailScanner[52918]: Using SpamAssassin results cache
Aug 30 10:10:31 	MailScanner[52918]: Connected to SpamAssassin cache database
Aug 30 10:10:31 	MailScanner[52918]: Enabling SpamAssassin auto-whitelist functionality...


postfix 28643  0.0  1.9 21916 19280  ??  Is   10:10AM   0:00.01 MailScanner: master waiting for children, sleeping (perl5.12.4)
postfix 28826  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.13 MailScanner: waiting for messages (perl5.12.4)
postfix 29081  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.14 MailScanner: waiting for messages (perl5.12.4)
postfix 37257  0.0  5.0 63832 51272  ??  S    10:10AM   0:02.16 MailScanner: waiting for messages (perl5.12.4)
postfix 44670  0.0  5.0 63832 51272  ??  S    10:10AM   0:02.23 MailScanner: waiting for messages (perl5.12.4)
postfix 52918  0.0  5.0 63832 51228  ??  S    10:10AM   0:02.17 MailScanner: waiting for messages (perl5.12.4)

I have ticked the use 3rd Party Anti-Spam box in the postfix configuration. Anyone got a quick run through guide to get this setup and working properly ?

Have a look here:
http://forum.pfsense.org/index.php/topic,43687.0.html
There might be some info there that might help.