Mailscanner + spamassassin + clamav package

rajbps

Working now but if you open this link on a web browser you get the following error "Access to the page has been denied

because the following virus was detected

Clamd: Eicar-Test-Signature-1"

Link : http://e-sac.siteseguro.ws/pfsense/8/amd64/All/MailScanner-4.83.5.tbz

Hope this is just a false positive :-)

Cheers,

Raj

rajbps

Hi Marcello,

In the system logs I have the following :

Oct 22 18:21:22 MailScanner: waiting for children to die: Process did not exit cleanly, returned 29 with signal 0
Oct 22 18:21:27 MailScanner: waiting for children to die: Process did not exit cleanly, returned 29 with signal 0
Oct 22 18:21:32 MailScanner: waiting for children to die: Process did not exit cleanly, returned 29 with signal 0
Oct 22 18:21:37 MailScanner: waiting for children to die: Process did not exit cleanly, returned 29 with signal 0
Oct 22 18:21:42 MailScanner: waiting for children to die: Process did not exit cleanly, returned 29 with signal 0
Oct 22 18:21:47 MailScanner: waiting for children to die: Process did not exit cleanly, returned 29 with signal 0
Oct 22 18:21:52 MailScanner: waiting for children to die: Process did not exit cleanly, returned 29 with signal 0

Also where do you configure the mail server details and so on pls?

Cheers,

Raj

ics

Hi,

I receive some emails that are not tagged (in the subject) as spam but they are spam.
However, these emails have a Mailscanner-spamscore: s or ssss

How can I get those kind of emails tagged with [spam] in the subject ?

Thanks

marcelloc

@ics:

How can I get those kind of emails tagged with [spam] in the subject ?

Changing mailscanner spam and highspam score on package config

ikbendeman

Hi Marcello,

I've enabled strong header verification in Postfix relay and antispam.

In the maillog I see this:

hostname xxxxxxxxxx verification failed: hostname nor servname provided, or not known (just one host which is OK)
Is it possible to whitelist this host or should I lower header verification to basic?

Bob

marcelloc

@ikbendeman:

hostname xxxxxxxxxx verification failed: hostname nor servname provided, or not known (just one host which is OK)
Is it possible to whitelist this host or should I lower header verification to basic?

I do recommend strong header verification.

On current package, you can include this misconfigured server on postfix forwarder acl tab. I could be on mynetwork field or on your /etc/hosts file

expert_az

hello,any way to Quarantine bad file,attachment or infected files?

ics

@expert_az:

hello,any way to Quarantine bad file,attachment or infected files?

I think it's still in marcelloc's roadmap (since a while… ;)).
But not done yet.

alessandroa

Hi,
excuse me but I not understand if mailscanner is working. The postfix is fine, no errors in log, but I'm not able to find any log or activity about mailscanner.

The service is up, the processes are up.. but where is the log?

My impression is that postfix forward direct to mail server.

Thank you,

bye

marcelloc

@alessandroa:

My impression is that postfix forward direct to mail server.

Did you enabled "Use Third part antispam" on postfix antispam tab?

check mailscanner logs with tail -f /var/log/maillog | grep -i mailscanner

postfix_mailscanner.png_thumb

expert_az

1)Check use third party anti spam
Message hold mode "manual mode using acls"
Choose mailscanner+spam assassin + clamav

2)put /^from:/ HOLD on header acls

alessandroa

@expert_az:

1)Check use third party anti spam
Message hold mode "manual mode using acls"
Choose mailscanner+spam assassin + clamav

2)put /^from:/ HOLD on header acls

Hi everyone, I come back from holiday today.

This work for me, thank you.
The problem now is that antivirus not work. Before to ask a help, my question is: do not exist a guide for this package? A base guide, no advanced instruction. For example, it is not clear if I must install the HAVP package.

Thank you qa lot.

Good new year

marcelloc

@alessandroa:

It is not clear if I must install the HAVP package.

No need to install havp pfsense package, clamav is installed during postfix install.

you can try to run fresclam on console to see if clamav is installed and updating.

alessandroa

@marcelloc:

No need to install havp pfsense package, clamav is installed during postfix install.

you can try to run fresclam on console to see if clamav is installed and updating.

I've just reinstalled my pfsense (2.0.1-RELEASE (i386)
built on Mon Dec 12 17:53:52 EST 2011
FreeBSD 8.1-RELEASE-p6), no firmware upgrade.
I've reisntalled postfix forwarder (2.8.7,1 pkg v.2.3.4_1 ) and I not find any clamv file and freschclam command…

Now I try to update my pfsense firmware and reinstall the package, after this I try to install mailscanner.

Thank you.

alessandroa

@alessandroa:

I've just reinstalled my pfsense (2.0.1-RELEASE (i386)
built on Mon Dec 12 17:53:52 EST 2011
FreeBSD 8.1-RELEASE-p6), no firmware upgrade.
I've reisntalled postfix forwarder (2.8.7,1 pkg v.2.3.4_1 ) and I not find any clamv file and freschclam command…

I've upgraded pfsense firmware and no clamv file or process are present. After I've installed mailscanner package and /var/log/clamav folder is present and /usr/local/etc/clamd.conf is present. User in conf file is clamv, now I change the user in "postfix" and I try.

Thank you

alessandroa

@alessandroa:

@alessandroa:

I've just reinstalled my pfsense (2.0.1-RELEASE (i386)
built on Mon Dec 12 17:53:52 EST 2011
FreeBSD 8.1-RELEASE-p6), no firmware upgrade.
I've reisntalled postfix forwarder (2.8.7,1 pkg v.2.3.4_1 ) and I not find any clamv file and freschclam command…

I've upgraded pfsense firmware and no clamv file or process are present. After I've installed mailscanner package and /var/log/clamav folder is present and /usr/local/etc/clamd.conf is present. User in conf file is clamv, now I change the user in "postfix" and I try.

Thank you

Ok, now is working right but I had to change permission in two folder, /var/run/clamav and /var/db/clamav

The question now is: how I can view the log of SPAM messages? The problem is the fine tuning of the system and I need to view the log.

Thank you.

marcelloc

@alessandroa:

The question now is: how I can view the log of SPAM messages? The problem is the fine tuning of the system and I need to view the log.

enable postfix log and do a tail -f /var/log/maillog | grep-i spam

alessandroa

@marcelloc:

@alessandroa:

The question now is: how I can view the log of SPAM messages? The problem is the fine tuning of the system and I need to view the log.

enable postfix log and do a tail -f /var/log/maillog | grep-i spam

Thank you marcelloc but this isn't a good solution for me. In my organization people want know if a message was arrived or not. The classic question is: "I'm waiting an e-mail from xxxx@yy.com, is it arrived?" then I check the log and I can change the antispam rules if was blocked.

Maybe the best solution is bouce spam in a mailbox with auto-deletion in 7 days.

Thank you marcelloc!!

marcelloc

@alessandroa:

In my organization people want know if a message was arrived or not. The classic question is: "I'm waiting an e-mail from xxxx@yy.com, is it arrived?" then I check the log and I can change the antispam rules if was blocked.

Just enable the database logs on package gui and search mails on search mail tab

You can also create users on pfsense with just search mail permissions.

alessandroa

@marcelloc:

Just enable the database logs on package gui and search mails on search mail tab

You can also create users on pfsense with just search mail permissions.

Thank you marcelloc, in postfix configuration I've set log destination in /var/log/maillog and update sqllite every minute, Search mail is already ok.
Now I receive a domain with only 10-15 mail at day and no spam so I can't check earnest the packages. I see only relay denied but no spam reject. At the end of month I'll point the MX of my principal domain, about 5500 spam messages at day.

Thank you.