Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Mailscanner + spamassassin + clamav package

    Scheduled Pinned Locked Moved
    pfSense Packages
    54
    313
    257.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BismarckB
      Bismarck
      last edited by

      @capitangiaco:

      @marcelloc:

      What is broken on mailscanner? I'm pushing some fixes to packages on 2.2

      Does the reporting (Notices to System Administrators) works ?
      I have to manually modify the Mailscanner.conf

      Send Notices = yes
      Notices Include Full Headers = yes
      Hide Incoming Work Dir in Notices = no
      Notice Signature = – \nMailScanner\nEmail Virus Scanner\nwww.mailscanner.info
      Notices From =                                    <–------
      Notices To =                                        <–------
      Local Postmaster = Postmaster              <–------

      Giacomo

      A bit late but, better now than never. ;)

      I fixed (workaround) this by creating a file in

      /usr/pbi/mailscanner-amd64/etc/MailScanner/conf.d/my.conf

      and add

      Notices From = mailscanner@mydoamin.tld
      Notices To = admin@mydoamin.tld

      And restart mailscanner, from now on you will get email notification from infected files that have been blocked.

      This file also can used to add any extra config which otherwise will be ignored/overwritten in the Mailscanner.conf (eg. Max Spam Check Size etc.).

      Another problem I've noticed is that Org name (eg. pfSense in this case) is not correctly inherited to bayes_ignore_header at:

      Services: MailScanner > AntiSpam (Tab) > spam.assassin.prefs.conf

      bayes_ignore_header pfSense-MailScanner

      the X- is missing here and should look like instead:

      bayes_ignore_header **X-**pfSense-MailScanner

      This needs to be fixed in:

      /usr/local/pkg/mailscanner.inc

      and edit line 494 like:

      $replacement[]="bayes_ignore_header X-".($mailscanner['orgname']!=""?$mailscanner['orgname']:"Pfsense")."-MailScanner";

      So bayes can ignore those headers and don't waste tokens for that.

      1 Reply Last reply Reply Quote 0
      • M
        mflyagin
        last edited by

        I think there is a typo in the file /usr/local/pkg/mailscanner.conf.template

        39 Incoming Work User = postix
40 Incoming Work Group = postix
47 Quarantine User = postifx

        I also think that these two lines do not work, because when I put the values in the web interface, in the config lines left blank.

        307 Notices From = ${$notice_from}
308 Notices To = ${$notice_to}

        P.S. i have pfSense 2.1.5 and mailscanner 0.2.11

        1 Reply Last reply Reply Quote 0
        • M
          MDA
          last edited by

          Hi!

          Mailscanner blocks the content of messages and replace its contents for unknown reasons.
          Help to understand please.
          Here is a letter received at the reception and log pfsense.

          Received a letter

          Subject: [Filename?] Проблемы НПБ

          This is a message from the MailScanner E-Mail Virus Protection Service
          –--------------------------------------------------------------------
          The original e-mail attachment "the entire message"
          is on the list of unacceptable attachments for this site and has been replaced by this warning message.

          At Thu Jan 29 10:40:46 2015 the virus scanner said:
            MailScanner: No programs allowed (msg-85475-13.txt)

          Log pfSense

          Jan 29 10:40:44 mail postfix/smtpd[67659]: connect from mailex.ooo.ru[x.x.x.x]
          Jan 29 10:40:45 mail postfix/smtpd[67659]: 09C0521EADE: client=mailex.ooo.ru[x.x.x.x]
          Jan 29 10:40:45 mail postfix/cleanup[66101]: 09C0521EADE: hold: header Received: from mailex.ooo.ru (mailex.ooo.ru [x.x.x.x])??by mail.mydomain (Postfix) with ESMTP id 09C0521EADE??for user1@mydomain; Thu, 29 Jan 2015 10:40:44 +0300 (FET) from mailex.ooo.ru[x.x.x.x]; from= <remoteuser>to= user1@mydomainproto=ESMTP helo= <mailex.ooo.ru>Jan 29 10:40:45 mail postfix/cleanup[66101]: 09C0521EADE: message-id= ab7bbd27-5398-4a3d-8c74-5bc868666ec9@ooo.ruJan 29 10:40:46 mail postfix/smtpd[67659]: disconnect from mailex.ooo.ru[x.x.x.x]
          Jan 29 10:40:46 mail MailScanner[85475]: New Batch: Scanning 1 messages, 644494 bytes
          Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B msg-85475-11.txt
          Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B msg-85475-12.html (no rule matched)
          Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B image.pdf (no rule matched)
          Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B ATT00001.htm (no rule matched)
          Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B msg-85475-13.txt
          Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: No executables (09C0521EADE.A9E2B )
          Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: Allowing 09C0521EADE.A9E2B image.pdf (no match found)
          Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: Allowing 09C0521EADE.A9E2B msg-85475-11.txt
          Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: Allowing 09C0521EADE.A9E2B ATT00001.htm
          Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: Allowing 09C0521EADE.A9E2B msg-85475-12.html
          Jan 29 10:40:47 mail MailScanner[85475]: Other Checks: Found 1 problems
          Jan 29 10:40:47 mail MailScanner[85475]: Virus and Content Scanning: Starting
          Jan 29 10:40:47 mail MailScanner[85475]: <a>tag found in message 09C0521EADE.A9E2B from remoteuser
          Jan 29 10:40:47 mail MailScanner[85475]: Virus Scanning completed at 852675 bytes per second
          Jan 29 10:40:47 mail MailScanner[85475]: Spam Checks: Starting
          Jan 29 10:40:47 mail MailScanner[85475]: Message 09C0521EADE.A9E2B from x.x.x.x (remoteuser) to mydomain is too big for spam checks (644494 > 200000 bytes)
          Jan 29 10:40:47 mail MailScanner[85475]: Delivery of nonspam: message 09C0521EADE.A9E2B from remoteuser to user1@mydomain with subject рТПВМЕНЩ орв
          Jan 29 10:40:47 mail MailScanner[85475]: Requeue: 09C0521EADE.A9E2B to 2190621EAE1
          Jan 29 10:40:47 mail postfix/qmgr[25563]: 2190621EAE1: from=<remoteuser>, size=643819, nrcpt=1 (queue active)
          Jan 29 10:40:47 mail MailScanner[85475]: Cleaned: Delivered 1 cleaned messages
          Jan 29 10:40:47 mail postfix/smtp[66901]: warning: host 10.10.2.2[10.10.2.2]:25 greeted me with my own hostname mail.mydomain
          Jan 29 10:40:47 mail MailScanner[85475]: Deleted 1 messages from processing-database
          Jan 29 10:40:47 mail MailScanner[85475]: Batch completed at 612050 bytes per second (644494 / 1)
          Jan 29 10:40:47 mail MailScanner[85475]: Batch (1 message) processed in 1.05 seconds
          Jan 29 10:40:48 mail postfix/smtp[66901]: 2190621EAE1: to=user1@mydomain, relay=10.10.2.2[10.10.2.2]:25, delay=3.1, delays=2.9/0/0.01/0.28, dsn=2.6.0, status=sent (250 2.6.0 ab7bbd27-5398-4a3d-8c74-5bc868666ec9@oaosig.ru[InternalId=9478992822622, Hostname=msk-ex01.banknp.loc] Queued mail for delivery)
          Jan 29 10:40:48 mail postfix/qmgr[25563]: 2190621EAE1: removed
          J

          Tell me what could be the reason/ab7bbd27-5398-4a3d-8c74-5bc868666ec9@oaosig.ru/user1@mydomain</remoteuser></a>/ab7bbd27-5398-4a3d-8c74-5bc868666ec9@ooo.ru</mailex.ooo.ru>/user1@mydomain</remoteuser>/user1@mydomain

          1 Reply Last reply Reply Quote 0
          • F
            FlashPan
            last edited by

            Hi,

            I am in no way an expert here but I can see this entry in your log:

            Message 09C0521EADE.A9E2B from x.x.x.x (remoteuser) to mydomain is too big for spam checks (644494 > 200000 bytes)

            That is 0.2 megabytes.

            Have you changed the maximum email message size?  Without looking at my setup and If I remember correctly you can change this value in Postfix and Mailscanner.

            1 Reply Last reply Reply Quote 0
            • BismarckB
              Bismarck
              last edited by

              @MDA:

              Jan 29 10:40:47 mail postfix/smtp[66901]: warning: host 10.10.2.2[10.10.2.2]:25 greeted me with my own hostname mail.mydomain

              It looks like your internal mailhost using the same name as the pfSense/Postfix relay, you better change this. Nothing critical…

              1 Reply Last reply Reply Quote 0
              • M
                mflyagin
                last edited by

                @MDA:

                Hi!

                Mailscanner blocks the content of messages and replace its contents for unknown reasons.
                Help to understand please.
                Here is a letter received at the reception and log pfsense.

                Received a letter

                Subject: [Filename?] Проблемы НПБ

                This is a message from the MailScanner E-Mail Virus Protection Service
                –--------------------------------------------------------------------
                The original e-mail attachment "the entire message"
                is on the list of unacceptable attachments for this site and has been replaced by this warning message.

                At Thu Jan 29 10:40:46 2015 the virus scanner said:
                  MailScanner: No programs allowed (msg-85475-13.txt)

                Log pfSense

                Jan 29 10:40:44 mail postfix/smtpd[67659]: connect from mailex.ooo.ru[x.x.x.x]
                Jan 29 10:40:45 mail postfix/smtpd[67659]: 09C0521EADE: client=mailex.ooo.ru[x.x.x.x]
                Jan 29 10:40:45 mail postfix/cleanup[66101]: 09C0521EADE: hold: header Received: from mailex.ooo.ru (mailex.ooo.ru [x.x.x.x])??by mail.mydomain (Postfix) with ESMTP id 09C0521EADE??for user1@mydomain; Thu, 29 Jan 2015 10:40:44 +0300 (FET) from mailex.ooo.ru[x.x.x.x]; from= <remoteuser>to= user1@mydomainproto=ESMTP helo= <mailex.ooo.ru>Jan 29 10:40:45 mail postfix/cleanup[66101]: 09C0521EADE: message-id= ab7bbd27-5398-4a3d-8c74-5bc868666ec9@ooo.ruJan 29 10:40:46 mail postfix/smtpd[67659]: disconnect from mailex.ooo.ru[x.x.x.x]
                Jan 29 10:40:46 mail MailScanner[85475]: New Batch: Scanning 1 messages, 644494 bytes
                Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B msg-85475-11.txt
                Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B msg-85475-12.html (no rule matched)
                Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B image.pdf (no rule matched)
                Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B ATT00001.htm (no rule matched)
                Jan 29 10:40:46 mail MailScanner[85475]: Filename Checks: Allowing 09C0521EADE.A9E2B msg-85475-13.txt
                Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: No executables (09C0521EADE.A9E2B )
                Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: Allowing 09C0521EADE.A9E2B image.pdf (no match found)
                Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: Allowing 09C0521EADE.A9E2B msg-85475-11.txt
                Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: Allowing 09C0521EADE.A9E2B ATT00001.htm
                Jan 29 10:40:47 mail MailScanner[85475]: Filetype Checks: Allowing 09C0521EADE.A9E2B msg-85475-12.html
                Jan 29 10:40:47 mail MailScanner[85475]: Other Checks: Found 1 problems
                Jan 29 10:40:47 mail MailScanner[85475]: Virus and Content Scanning: Starting
                Jan 29 10:40:47 mail MailScanner[85475]: <a>tag found in message 09C0521EADE.A9E2B from remoteuser
                Jan 29 10:40:47 mail MailScanner[85475]: Virus Scanning completed at 852675 bytes per second
                Jan 29 10:40:47 mail MailScanner[85475]: Spam Checks: Starting
                Jan 29 10:40:47 mail MailScanner[85475]: Message 09C0521EADE.A9E2B from x.x.x.x (remoteuser) to mydomain is too big for spam checks (644494 > 200000 bytes)
                Jan 29 10:40:47 mail MailScanner[85475]: Delivery of nonspam: message 09C0521EADE.A9E2B from remoteuser to user1@mydomain with subject рТПВМЕНЩ орв
                Jan 29 10:40:47 mail MailScanner[85475]: Requeue: 09C0521EADE.A9E2B to 2190621EAE1
                Jan 29 10:40:47 mail postfix/qmgr[25563]: 2190621EAE1: from=<remoteuser>, size=643819, nrcpt=1 (queue active)
                Jan 29 10:40:47 mail MailScanner[85475]: Cleaned: Delivered 1 cleaned messages
                Jan 29 10:40:47 mail postfix/smtp[66901]: warning: host 10.10.2.2[10.10.2.2]:25 greeted me with my own hostname mail.mydomain
                Jan 29 10:40:47 mail MailScanner[85475]: Deleted 1 messages from processing-database
                Jan 29 10:40:47 mail MailScanner[85475]: Batch completed at 612050 bytes per second (644494 / 1)
                Jan 29 10:40:47 mail MailScanner[85475]: Batch (1 message) processed in 1.05 seconds
                Jan 29 10:40:48 mail postfix/smtp[66901]: 2190621EAE1: to=user1@mydomain, relay=10.10.2.2[10.10.2.2]:25, delay=3.1, delays=2.9/0/0.01/0.28, dsn=2.6.0, status=sent (250 2.6.0 ab7bbd27-5398-4a3d-8c74-5bc868666ec9@oaosig.ru[InternalId=9478992822622, Hostname=msk-ex01.banknp.loc] Queued mail for delivery)
                Jan 29 10:40:48 mail postfix/qmgr[25563]: 2190621EAE1: removed
                J

                Tell me what could be the reason/ab7bbd27-5398-4a3d-8c74-5bc868666ec9@oaosig.ru/user1@mydomain</remoteuser></a>/ab7bbd27-5398-4a3d-8c74-5bc868666ec9@ooo.ru</mailex.ooo.ru>/user1@mydomain</remoteuser>/user1@mydomain

                <a>problem with some txt files in Russian language. Sometimes mailscanner think this is a executable files.
                I have same problem. I comment this 2 lines in filetypes.rules.conf

                deny	executable	No executables		No programs allowed
deny	ELF		No executables		No programs allowed
```</a>
                1 Reply Last reply Reply Quote 0
                • A
                  akong
                  last edited by

                  Hello,
                  Have any friend test Mailscanner on pfsense 2.2.x.I has test can't start mailscanner service.

                  1 Reply Last reply Reply Quote 0
                  • K
                    konis
                    last edited by

                    Hi

                    It's confirmed : Mailscanner + pfSense 2.2.x = NOT LOVE. It's broken: https://redmine.pfsense.org/issues/4508

                    It's not working dccifd module: /usr/pbi/mailscanner-amd64/local/etc/rc.d/dccifd: WARNING: /usr/local/dcc is not a directory.

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      It's related to pbi. Once 2.3 is out it will work again.
                      For now, just a pbi remove and pkg install will workaround this issue just like I've suggested on postifx.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • BismarckB
                        Bismarck
                        last edited by

                        @marcelloc:

                        For now, just a pbi remove and pkg install will workaround this issue just like I've suggested on postifx.

                        For people still struggling with this package:

                        
pbi_delete mailscanner-4.84.6-amd64
rm -r -f /usr/pbi/bin/libexec/mailscanner
rm -r -f /usr/local/etc/mailscanner
rm -r -f /var/spool/MailScanner
pkg install mailscanner
y

                        edit /usr/local/pkg/mailscanner.inc (line 39)

                        $pf_version=substr(trim(file_get_contents("/etc/version")),0,3);
//if ($pf_version == "2.1" || $pf_version == "2.2") {
//	define('MAILSCANNER_PREFIX', '/usr/pbi/mailscanner-' . php_uname("m"));
//	if ($pf_version == "2.1")
//		define('MAILSCANNER_LOCALBASE', MAILSCANNER_PREFIX);
//	else
//		define('MAILSCANNER_LOCALBASE', MAILSCANNER_PREFIX . '/local');
//} else {
	define('MAILSCANNER_PREFIX', '/usr/local');
	define('MAILSCANNER_LOCALBASE', '/usr/local');
//}

                        This makes MailScanner start and run, further testing needed of general functionality…

                        1 Reply Last reply Reply Quote 0
                        • E
                          enriluis
                          last edited by

                          @marcelloc:

                          It's related to pbi. Once 2.3 is out it will work again.
                          For now, just a pbi remove and pkg install will workaround this issue just like I've suggested on postifx.

                          hi! my be is late to say this, but pfs 2.3 has been released, but removed  postfix+mailscanner so  what is news abaut this? please

                          1 Reply Last reply Reply Quote 0
                          • T
                            Tom7141
                            last edited by

                            Bump  still no  postfix+mailscanner ?

                            1 Reply Last reply Reply Quote 0
                            • BismarckB
                              Bismarck
                              last edited by

                              MAKE A BACKUP BEFORE YOU GO THIS ROUTE!

                              Those are the files needed, for the manual install of the MailScanner Package for pfSense 2.3.x

                              **/usr/local/pkg/mailscanner.conf.template
                              /usr/local/pkg/mailscanner.inc
                              /usr/local/pkg/mailscanner.xml
                              /usr/local/pkg/mailscanner_alerts.xml
                              /usr/local/pkg/mailscanner_antispam.xml
                              /usr/local/pkg/mailscanner_antivirus.xml
                              /usr/local/pkg/mailscanner_attachments.xml
                              /usr/local/pkg/mailscanner_content.xml
                              /usr/local/pkg/mailscanner_report.xml
                              /usr/local/pkg/mailscanner_sync.xml

                              /usr/local/www/mailscanner_about.php**

                              • Download the attached pfSense-2.3-MailScanner.zip, unzip and copy the files to your system root /.

                              • Unlock the FreeBSD repo in

                              /usr/local/etc/pkg/repos/FreeBSD.conf > enabled: yes

                              /usr/local/etc/pkg/repos/pfSense.conf > enabled: yes

                              • Install MailScanner and dependencies via pkg

                              pkg install mailscanner

                              • Next edit:

                              /conf/config.xml

                              • and add MailScanner to the Service Status and Menu:

                              <service><name>mailscanner</name>
                              <rcfile>mailscanner</rcfile>
                              <executable>perl_mailscanner</executable></service>

                              <menu>
                              <name>Mailscanner</name>
                              <tooltiptext>Configure MailScanner service</tooltiptext>
                              Services
                              <url>/pkg_edit.php?xml=mailscanner.xml&id=0</url>
                              </menu>

                              • Now cross your fingers and reboot!  :P

                              Advanced configuration:

                              • Check MS and SA for errors and missing modules etc. via spamassassin -D –lint and mailscanner -D –lint
                              • Additionally install DCC+razor2+pyzor, clamav-unofficial-sigs etc.

                              pfSense-2.3-MailScanner.zip

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                Automated Install instructions for complete mailscanner package on pfSense 2.3.x can be found here:

                                https://forum.pfsense.org/index.php?topic=128037.0

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                D 1 Reply Last reply Reply Quote 0
                                • D
                                  DannyB @marcelloc
                                  last edited by

                                  @marcelloc

                                  Hi Marcelloc, i have postfix and mailscanner running on pfsense 2.4.4-p1, i got the following warnings:

                                  MailScanner[64731]: Clamd::ERROR:: UNKNOWN CLAMD RETURN ./lstat() failed: Permission denied. ERROR :: /var/spool/MailScanner/incoming/64731

                                  Permissions looks fine, i did chown -R postfix:postfix /var/spool/MailScanner/incoming/, also chmod -R 6666 to the same folder.

                                  Runas user on MailScanner.conf and clamd.conf is postfix.

                                  Also mailscanner logs display syntax errors:

                                  Mar 6 16:09:51 pfsense2 MailScanner[56749]: Syntax error(s) in configuration file:
                                  Mar 6 16:09:51 pfsense2 MailScanner[56749]: Unrecognised keyword "deliversuspiciouspdf" at line 93
                                  Mar 6 16:09:51 pfsense2 MailScanner[56749]: Unrecognised keyword "pdfidcommand" at line 84
                                  Mar 6 16:09:51 pfsense2 MailScanner[56749]: Unrecognised keyword "pdfidtimeout" at line 87
                                  Mar 6 16:09:51 pfsense2 MailScanner[56749]: Unrecognised keyword "scanpdf" at line 90
                                  Mar 6 16:09:51 pfsense2 MailScanner[56749]: Warning: syntax errors in /usr/local/etc/MailScanner/MailScanner.conf.

                                  Please Help.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post