Mailscanner + spamassassin + clamav package

Guest · Nov 14, 2013, 4:35 PM

Do i need to install postfix?

Ivart · Nov 14, 2013, 5:02 PM

Yes. Install Postfix and then MailScanner, enable MailScanner in Antispam section of Postfix, Third part Antispam Settings.

m.mascheroni · Nov 18, 2013, 10:33 AM

I have 2 question about this package.

First of all i have installed it on a PFsense 2.1 appliance and it works perfectly, the mails flow without problem to a frakking Exchange 2007 Server.

My questions are:

how can modify the mail subject adding [SPAM] if the mail get > 5 spam points?
how can i setup a whitelist and blacklist based on mail address, maybe with wildcards for example *@contoso.com ?

expert_az · Nov 18, 2013, 2:28 PM

hello marcelloc,I installed PF2.1 amd64 on new box with postfix and mailscanner.

everything running well,but i'm getting some warning messages from postfix and maillscanner,is it normal?

mailscanner warning:

Nov 18 16:16:33 mx01 MailScanner[94836]: MailScanner E-Mail Virus Scanner version 4.84.5 starting…
Nov 18 16:16:33 mx01 MailScanner[94836]: Reading configuration file /usr/pbi/mailscanner-amd64/etc/MailScanner/MailScanner.conf
Nov 18 16:16:33 mx01 MailScanner[94836]: Reading configuration file /usr/pbi/mailscanner-amd64/etc/MailScanner/conf.d/README
Nov 18 16:16:33 mx01 MailScanner[94836]: Read 869 hostnames from the phishing whitelist
Nov 18 16:16:33 mx01 MailScanner[94836]: Read 5426 hostnames from the phishing blacklists
Nov 18 16:16:33 mx01 MailScanner[94836]: User's home directory /home/postfix does not exist
Nov 18 16:16:33 mx01 MailScanner[94836]: User's home directory /home/postfix is not writable
Nov 18 16:16:33 mx01 MailScanner[94836]: You need to set the "SpamAssassin User State Dir" to a directory that the "Run As User" can write to
Nov 18 16:16:33 mx01 MailScanner[94836]: Using SpamAssassin results cache
Nov 18 16:16:33 mx01 MailScanner[94836]: Connected to SpamAssassin cache database
Nov 18 16:16:33 mx01 MailScanner[94836]: Enabling SpamAssassin auto-whitelist functionality…
Nov 18 16:18:48 mx01 MailScanner[94836]: I have found clamd scanners installed, and will use them all by default.
Nov 18 16:18:48 mx01 MailScanner[94836]: Connected to Processing Attempts Database
Nov 18 16:18:48 mx01 MailScanner[94836]: Found 0 messages in the Processing Attempts Database
Nov 18 16:18:48 mx01 MailScanner[94836]: Using locktype = flock

postfix warning:

Nov 16 14:02:39 php: rc.start_packages: Postfix setup completed
Nov 16 14:02:39 php: rc.start_packages: Reloading/starting postfix
Nov 16 14:02:37 php: rc.start_packages: Writing rc_file
Nov 16 14:02:35 php: rc.start_packages: Writing out configuration
Nov 16 14:02:35 php: rc.start_packages: The command '/usr/local/sbin/postfix reload' returned exit code '1', the output was ''
Nov 16 14:02:35 postfix/postfix-script[94694]: fatal: the Postfix mail system is not running
Nov 16 14:02:35 syslogd: kernel boot file is /boot/kernel/kernel
Nov 16 14:02:35 syslogd: exiting on signal 15
Nov 16 14:02:33 php: rc.start_packages: sync_package_postfix called with via_rpc=no
Nov 16 14:02:33 php: rc.start_packages: Postfix setup completed
Nov 16 14:02:33 postfix/postfix-script[69449]: fatal: the Postfix mail system is not running
Nov 16 14:02:33 php: rc.start_packages: Reloading/starting postfix
Nov 16 14:02:31 php: rc.start_packages: Writing rc_file
Nov 16 14:02:31 php: rc.start_packages: The command '/usr/pbi/postfix-amd64/sbin/postmap /usr/pbi/postfix-amd64/etc/postfix/transport' returned exit code '1', the output was 'postmap: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix'
Nov 16 14:02:30 php: rc.start_packages: Starting MailScanner
Nov 16 14:02:29 php: rc.start_packages: Starting clamav-clamd daemon
Nov 16 14:02:29 postfix/postmap[38866]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:27 php: rc.start_packages: Writing out configuration
Nov 16 14:02:27 php: rc.start_packages: The command '/usr/local/sbin/postfix reload' returned exit code '1', the output was ''
Nov 16 14:02:25 postfix[38215]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:25 postfix[38032]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:24 php: rc.start_packages: Postfix setup completed
Nov 16 14:02:23 postfix/postmap[23753]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:23 syslogd: kernel boot file is /boot/kernel/kernel
Nov 16 14:02:23 syslogd: exiting on signal 15
Nov 16 14:02:23 check_reload_status: Syncing firewall
Nov 16 14:02:23 postfix[20523]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:23 php: rc.start_packages: sync_package_postfix called with via_rpc=no
Nov 16 14:02:23 php: rc.start_packages: Postfix setup completed
Nov 16 14:02:23 postfix[19402]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:23 php: rc.start_packages: Reloading/starting postfix
Nov 16 14:02:21 postfix[98592]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:21 php: rc.start_packages: Reloading/starting postfix
Nov 16 14:02:21 php: rc.start_packages: Writing rc_file
Nov 16 14:02:21 postfix/sendmail[97436]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:21 php: rc.start_packages: The command '/usr/pbi/postfix-amd64/sbin/postmap /usr/pbi/postfix-amd64/etc/postfix/sender_access' returned exit code '1', the output was 'postmap: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix'
Nov 16 14:02:19 php: rc.start_packages: Writing rc_file
Nov 16 14:02:19 postfix/sendmail[85730]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:19 php: rc.start_packages: The command '/usr/pbi/postfix-amd64/sbin/postmap /usr/pbi/postfix-amd64/etc/postfix/sender_access' returned exit code '1', the output was 'postmap: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix'
Nov 16 14:02:19 postfix/postmap[85628]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:19 php: rc.start_packages: The command '/usr/pbi/postfix-amd64/sbin/postmap /usr/pbi/postfix-amd64/etc/postfix/transport' returned exit code '1', the output was 'postmap: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix'
Nov 16 14:02:18 postfix/postmap[72952]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:17 postfix/postmap[72943]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:15 php: rc.start_packages: The command '/usr/pbi/postfix-amd64/sbin/postmap /usr/pbi/postfix-amd64/etc/postfix/transport' returned exit code '1', the output was 'postmap: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix'
Nov 16 14:02:15 php: rc.start_packages: Writing out configuration
Nov 16 14:02:15 php: rc.start_packages: The command '/usr/local/sbin/postfix reload' returned exit code '1', the output was ''
Nov 16 14:02:14 postfix/postmap[45331]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:13 postfix[45533]: fatal: file /usr/pbi/postfix-amd64/etc/postfix/main.cf: parameter mail_owner: unknown user name value: postfix
Nov 16 14:02:11 php: rc.start_packages: Writing out configuration
Nov 16 14:02:11 php: rc.start_packages: The command '/usr/local/sbin/postfix reload' returned exit code '1', the output was ''

marcelloc · Nov 18, 2013, 9:49 PM

@expert_az:

is it normal?

Does your postfix log errors stopped on Nov 16 or still alerting?

I'll check mailscanner user errors.

m.mascheroni · Nov 20, 2013, 1:02 PM

@m.mascheroni:

I have 2 question about this package.

First of all i have installed it on a PFsense 2.1 appliance and it works perfectly, the mails flow without problem to a frakking Exchange 2007 Server.

My questions are:

how can modify the mail subject adding [SPAM] if the mail get > 5 spam points?

how can i setup a whitelist and blacklist based on mail address, maybe with wildcards for example *@contoso.com ?

Any idea how to do this?
Plus i would like to know if is there a method, a service or even a specific log file to check mailscanner activity.

marcelloc · Nov 20, 2013, 3:02 PM

@m.mascheroni:

Any idea how to do this?

IIRC, just select send action on antispam tab.

@m.mascheroni:

Plus i would like to know if is there a method, a service or even a specific log file to check mailscanner activity.

it's on postfix log(/var/log/maillog).

m.mascheroni · Nov 20, 2013, 3:28 PM

Well, probably mailscanner was not active, i believe that change in Postfix Forwarder settings "Message Hold mode" from auto to manual acl and setting headers with /^from:/ HOLD did the trick.

Now all spam emails are tagged with [SPAM?] prefix or [Disarmed] prefix. Now it's perfect.

From previous posts on this thread i've found out that is better to set the log to /var/log/maillog, now it's easier to check postfix and mailscanner activity with a simple tail command.

Thank you for your time and for your precious work.

I still need to figure out how to setup a local whitelist.

marcelloc · Nov 20, 2013, 4:23 PM

@m.mascheroni:

I still need to figure out how to setup a local whitelist.

On postifix acls and/or on mailscanner spam.assassin.prefs.conf gui field

expert_az · Nov 22, 2013, 3:21 PM

@marcelloc:

@expert_az:

is it normal?

Does your postfix log errors stopped on Nov 16 or still alerting?

I'll check mailscanner user errors.

marcelloc there no any new log now,only on Nov16,when PF restarted.

Ivart · Nov 25, 2013, 6:33 PM

Any news marcelloc, about clamav errors?

@Ivart:

Thanks marcelloc, service status is ok but the clamd error is the same:


Nov 14 11:56:24 treknetgw MailScanner[73800]: Virus and Content Scanning: Starting
Nov 14 11:56:24 treknetgw MailScanner[73800]: Clamd::ERROR:: UNKNOWN CLAMD RETURN ./lstat() failed: Permission denied. ERROR :: /var/spool/MailScanner/incoming/73800
Nov 14 11:56:24 treknetgw MailScanner[73800]: Virus Scanning: Clamd found 1 infections
Nov 14 11:56:24 treknetgw MailScanner[73800]: Virus Scanning: Found 1 viruses

marcelloc · Nov 25, 2013, 6:35 PM

I could get it working only if I change user to root.

I'll keep trying to use it with unprivileged user.

capitangiaco · Dec 2, 2013, 4:32 PM

Strange thing here today:

Dec 2 17:31:54 172.16.0.201 Dec 2 17:32:58 mailscanner: Process did not exit cleanly, returned 0 with signal 11

I tryed to turn on Debug=yes flag and:

Dec 2 17:20:52 172.16.0.201 Dec 2 17:21:56 php: /pkg_edit.php: The command '/usr/pbi/mailscanner-i386/etc/rc.d/mailscanner start' returned exit code '1', the output was 'Starting mailscanner. perl: warning: Setting locale failed. perl: warning: Please check that your locale settings: LC_ALL = (unset), LANG = "en_US.ISO8859-1" are supported and installed on your system. perl: warning: Falling back to the standard locale ("C").

any hint ?
thanks

Giacomo

capitangiaco · Dec 3, 2013, 8:25 AM

@capitangiaco:

Strange thing here today:

Dec 2 17:31:54 172.16.0.201 Dec 2 17:32:58 mailscanner: Process did not exit cleanly, returned 0 with signal 11

Tried to reinstall the pkg, and disable virus and spam scan, but the problem persist.
Each Mailscanner children go zombie.
I also noticed that when disableing the third part scan from the postfix forwarder package mail remain in hold in queue (manually removed /^Received:/ HOLD from header_checks). New mails arrive, but old mails stay in the queue.

Giacomo

capitangiaco · Dec 3, 2013, 4:11 PM

@capitangiaco:

Each Mailscanner children go zombie.

I think I've isolated the problem.
I it's all about SpamAssassin
with Use SpamAssassin = no in MailScanner.conf it starts

Giacomo

ikbendeman · Dec 8, 2013, 6:43 AM

I've problems with starting mailscanner after an update to pfSense 2.1.

service mailscanner start
Starting mailscanner.
eval: /usr/pbi/mailscanner-i386/sbin/mailscanner: not found
/usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner

ll /usr/pbi/mailscanner-i386/sbin/mailscanner
-r-xr-xr-x 1 root wheel 67459 Dec 8 06:40 /usr/pbi/mailscanner-i386/sbin/mailscanner

I disabled mailscanner completely to keep receiving mail.

I also run: pfBlocker, nrpe v2 and OpenVPN client.

Please advice.

Packagelist:

bsdinstaller-2.0.2011.1212 BSD Installer mega-package
ca_root_nss-3.15.2_1 The root certificate bundle from the Mozilla Project
curl-7.33.0_1 Non-interactive tool to get files from FTP, GOPHER, HTTP(S)
cyrus-sasl-2.1.25_1 RFC 2222 SASL (Simple Authentication and Security Layer)
cyrus-sasl-2.1.26_3 RFC 2222 SASL (Simple Authentication and Security Layer)
db41-4.1.25_4 The Berkeley DB package, revision 4.1
freetype2-2.4.11 A free and portable TrueType font rendering engine
freetype2-2.4.7 A free and portable TrueType font rendering engine
gd-2.0.35_7,1 A graphics library for fast creation of images
gettext-0.18.1.1 GNU gettext package
gettext-0.18.3.1 GNU gettext package
grub-0.97_4 GRand Unified Bootloader
ipmitool-1.8.11_2 CLI to manage IPMI systems
jpeg-8_3 IJG's jpeg compression utilities
jpeg-8_4 IJG's jpeg compression utilities
libiconv-1.13.1_1 A character set conversion library
libiconv-1.14 A character set conversion library
libiconv-1.14_1 A character set conversion library
libltdl-2.4.2_2 System independent dlopen wrapper
libspf2-1.2.10_1 Sender Rewriting Scheme 2 C Implementation
libstatgrab-0.17 Provides a useful interface to system statistics
muse-0.2 Shows memory usage data
nagios-plugins-1.4.15_1,1 Plugins for Nagios
nrpe-2.12_3 Nagios Remote Plugin Executor
openldap-client-2.4.33_1 Open source LDAP client implementation
p5-Authen-NTLM-1.09 An NTLM authentication module
p5-Crypt-OpenSSL-Bignum-0.04 OpenSSL's multiprecision integer arithmetic
p5-Crypt-OpenSSL-RSA-0.28 Perl5 module to RSA encode and decode strings using OpenSSL
p5-Crypt-OpenSSL-Random-0.06 Perl5 interface to the OpenSSL pseudo-random number generat
p5-DBD-SQLite-1.40 Provides access to SQLite3 databases through the DBI
p5-DBI-1.630 The perl5 Database Interface. Required for DBD::* modules
p5-Digest-HMAC-1.03 Perl5 interface to HMAC Message-Digest Algorithms
p5-Digest-SHA1-2.13 Perl interface to the SHA-1 Algorithm
p5-Encode-Locale-1.03 Determine the locale encoding
p5-File-Listing-6.04 Parse directory listings
p5-Filesys-Df-0.92 Perl extension for filesystem space
p5-Geography-Countries-2009041301 Handle ISO-3166 country codes
p5-HTML-Parser-3.71 Perl5 module for parsing HTML documents
p5-HTML-Tagset-3.20 Some useful data table in parsing HTML
p5-HTTP-Cookies-6.01 HTTP Cookie jars
p5-HTTP-Daemon-6.01 Simple HTTP server class
p5-HTTP-Date-6.02 Conversion routines for the HTTP protocol date formats
p5-HTTP-Message-6.06_2 Representation of HTTP style messages
p5-HTTP-Negotiate-6.01 Implementation of the HTTP content negotiation algorithm
p5-IO-HTML-1.00 Open an HTML file with automatic charset detection
p5-IO-Socket-INET6-2.69 Perl module with object interface to AF_INET6 domain socket
p5-IO-Socket-IP-0.24 Drop-in replacement for IO::Socket::INET supporting IPv4 an
p5-IO-Socket-SSL-1.962 Perl5 interface to SSL sockets
p5-IO-stringy-2.110 Perl5 module for using IO handles with non-file objects
p5-Inline-0.49 Write Perl subroutines in other programming languages
p5-LWP-MediaTypes-6.02 Guess media type for a file or a URL
p5-Mail-DKIM-0.40 Perl5 module to process and/or create DKIM email
p5-Mail-Tools-2.12 Perl5 modules for dealing with Internet e-mail messages
p5-Net-CIDR-0.17 Perl module to manipulate IPv4/IPv6 netblocks in CIDR notat
p5-Net-DNS-0.73 Perl5 interface to the DNS resolver, and dynamic updates
p5-Net-HTTP-6.06 Low-level HTTP client
p5-Net-Ident-1.23 Lookup the username on the remote end of a TCP/IP connectio
p5-Net-SSLeay-1.55 Perl5 interface to SSL
p5-OLE-Storage_Lite-0.19 Perl module for OLE document interface
p5-Parse-RecDescent-1.965.001 A recursive descent parsing framework for Perl
p5-Socket-2.013 Networking constants and support functions
p5-Socket6-0.23 IPv6 related part of the C socket.h defines and structure m
p5-Sys-Hostname-Long-1.4 Try every conceivable way to get full hostname
p5-Sys-SigAction-0.20 Perl extension for Consistent Signal Handling
p5-Time-HiRes-1.9726,1 A perl5 module implementing High resolution time, sleep, an
p5-TimeDate-2.30_1,1 Perl5 module containing a better/faster date parser for abs
p5-URI-1.60 Perl5 interface to Uniform Resource Identifier (URI) refere
p5-WWW-RobotRules-6.02 Database of robots.txt-derived permissions
p7zip-9.20.1 File archiver with high compression ratio
pcre-8.33 Perl Compatible Regular Expressions library
perl5-5.16.3_4 Practical Extraction and Report Language
pkg-config-0.25_1 A utility to retrieve information about installed libraries
pkgconf-0.8.9 Utility to help to configure compiler and linker flags
png-1.4.8 Library for manipulating PNG images
postfix-2.10.2,1 Secure alternative to widely-used Sendmail
python27-2.7.6 Interpreted object-oriented programming language
razor-agents-2.84 A distributed, collaborative, spam detection and filtering
sqlite-2.8.17_1 An SQL database engine in a C library
sqlite3-3.7.9 An SQL database engine in a C library
tnef-1.4.9 Unpack data in MS Outlook TNEF format
zip-3.0 Create/update ZIP files compatible with pkzip

capitangiaco · Dec 8, 2013, 4:25 PM

@ikbendeman:

I've problems with starting mailscanner after an update to pfSense 2.1.

service mailscanner start
Starting mailscanner.
eval: /usr/pbi/mailscanner-i386/sbin/mailscanner: not found
/usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner

ll /usr/pbi/mailscanner-i386/sbin/mailscanner
-r-xr-xr-x 1 root wheel 67459 Dec 8 06:40 /usr/pbi/mailscanner-i386/sbin/mailscanner

I disabled mailscanner completely to keep receiving mail.

have you tried to reinstall the mailscanner pkg ?

Giacomo

ikbendeman · Dec 8, 2013, 4:49 PM

Hi Giacomo,

Yes, I did reinstall the package… but same result.
Even a fresh install did not fixed the problem. (Fresh install from 2.0.3 with update to 2.1)

EHN_Helpdesk · Dec 9, 2013, 1:46 AM

I am experiencing the same results of MailScanner on my pfSense 2.0.1 upgrade to 2.1-Release but on the AMD64 platform as ikbendeman. I even performed a clean install of pfSense 2.1-Release, then Postfix, then MailScanner. I have re-installed MailScanner package several times but it still fails to start with this response:

Dec 8 16:00:17 root: /usr/pbi/mailscanner-amd64/etc/rc.d/mailscanner: WARNING: failed to start mailscanner
Dec 8 16:00:17 php: /pkg_edit.php: The command '/usr/pbi/mailscanner-amd64/etc/rc.d/mailscanner start' returned exit code '1', the output was 'Starting mailscanner. eval: /usr/pbi/mailscanner-amd64/sbin/mailscanner: not found /usr/pbi/mailscanner-amd64/etc/rc.d/mailscanner: WARNING: failed to start mailscanner'

When I try and manually start from the Services GUI, I get this:

Dec 8 17:31:37 php: /status_services.php: The command '/usr/local/etc/rc.d/mailscanner stop' returned exit code '1', the output was 'mailscanner not running? (check /var/run/MailScanner.pid).'
Dec 8 17:31:39 root: /usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner

Being that pfSense 2.1 uses a different tree directory, it seems that MailScanner (4.84.5_3 pkg v.0.2.2 ) is not ready for pfSense 2.1.

I would hate to have to downgrade pfSense to 2.0.1 in order for MailScanner to work right.

capitangiaco · Dec 9, 2013, 7:10 AM

@EHN_Helpdesk:

Dec 8 16:00:17 root: /usr/pbi/mailscanner-amd64/etc/rc.d/mailscanner: WARNING: failed to start mailscanner
Dec 8 16:00:17 php: /pkg_edit.php: The command '/usr/pbi/mailscanner-amd64/etc/rc.d/mailscanner start' returned exit code '1', the output was 'Starting mailscanner. eval: /usr/pbi/mailscanner-amd64/sbin/mailscanner: not found /usr/pbi/mailscanner-amd64/etc/rc.d/mailscanner: WARNING: failed to start mailscanner'

When I try and manually start from the Services GUI, I get this:

Dec 8 17:31:37 php: /status_services.php: The command '/usr/local/etc/rc.d/mailscanner stop' returned exit code '1', the output was 'mailscanner not running? (check /var/run/MailScanner.pid).'
Dec 8 17:31:39 root: /usr/local/etc/rc.d/mailscanner: WARNING: failed to start mailscanner

Your manual start failed cause you are using the wrong rc script.
You have to use /usr/pbi/mailscanner-amd64/etc/rc.d/mailscanner start/stop
If you don't have, create the link:

ls -l /usr/local/sbin/mailscanner

lrwxr-xr-x 1 root wheel 43 Dec 2 18:33 /usr/local/sbin/mailscanner -> /usr/pbi/mailscanner-i386/.sbin/mailscanner
adapt to your architecture (amd64)

Giacomo