AMaViS - A Mail Virus Scanner

Joe,

| Is there anyway to get the original message ID, or the senders IP
| address, into the log for SPAM?  I want to create a report for top spam
| sending networks, etc...

Message ID is available in macro %m and is normally
included in the log template for the level-0 log entry:

  # log both infected and noninfected messages (default):
  $log_templ = '[? %#V |[? %#F ...
  <%o> -> [<%R>|,][? %i ||, quarantine %i], Message-ID: %m, Hits: %c';
                                            ^^^^^^^^^^^^^^

Sender IP address is not available to amavisd-new,
except by parsing Received headers. With sendmail milter interface
this will some day be available, but we are not there yet.

  Mark

Jon,

| I have corrected my database structure and now amavis appears to be
| operating mostly correctly except that I cannot in any way get it to
| modify the subject tag.

amavisd.conf:
  $sa_spam_subject_tag = '***SPAM*** ';

(it is undef (=empty) by default).

  Mark

Florian,

| anyone knows what happens if all virus scanners fail (e.g. cannot be
| executed) on amavisd-new? Will the message be requeued until a virus scanner
| is available or will it be sent nontheless?

Temporary failure will be declared to the MTA, so the mail
will stay in the mailer queue and be retried from time to time
my MTA, until the situation is cleared or the message expires
from the mailer queue after a couple of days.

If you would prefer the message to be passed in case all virus
scanners fail, add a dummy scanner to the @av_scanners_backup
which would always say 'clean':

  ['always-clean', sub {0}],


Mark

Florian,

| running amavisd-new, I have the following directories in /var/amavis:
|   amavis-20031214T123636-02085/
|   amavis-20031214T124141-02086/
| Inside these, there are
|   email.txt
|   parts/
| I have disabled quarantining, and the messages in email.txt are not virus
| infected or spam, they are test messages I sent some days ago.
| Why do these directories exist?

These are temporary work places. There are $max_servers of them
during normal operation all the time, one for each amavisd child process.

See  http://www.ijs.si/software/amavisd/#faq-gen

  Mark

Bill,

| I am a bit baffled as to why uvscan, when invoked by amavisd-new, cannot
| detect a virus in this e-mail attachment:
| Dec 13 22:19:21 mgw1.pointshare.com amavisd[5711]: (05711-01-2) run_command:
|   [5744] /usr/local/bin/uvscan -rv --secure --noboot --summary
|   /var/amavisd/tmp/amavis-20031213T221900-05711/parts </dev/null 2>&1
| Dec 13 22:19:22 mgw1.pointshare.com amavisd[5711]: (05711-01-2) run_av:
|   /usr/local/bin/uvscan status=0 ..
| However, if I save the attachment and scan it manually,
| uvscan finds the virus just fine:

Could be a decoding issue. Check how the mail gets decoded
in the temporary directory (subdirectory parts), and try
to run uvscan manually (as user amavis!) on decoded parts.

You may force amavisd-new to leave the decoded parts undeleted
by specifying test sender address in @debug_sender_acl:
  @debug_sender_acl = qw( debug@... );

Mark

Venkatesh,

| i have installed clamav + amavis + postfix 
| in clamav, the TCP port is bind to 3310 and or to localport.

Don't let clamd bind to TCP port, it has no access restrictions
(last time I checked). It should only listen on its Unix socket.

LocalSocket is what is needed, and its value should match
the socket name in the amavisd.conf clamd entry.

| i have enabled clamav in amavis.conf and started amavis with postfix.
| the problme is that when i see the tail -f /var/log/maillog, i see that
| its connecting to socket and /usr/local/sbin/clamd failed with no
| permssions retrying in (sec's)
| ... in amavis.conf its given that
| the user should be the same user that is using amavis for clamav.conf
| so i changed the user in clamav.conf to amavis or root also.  inspite of
| that also , its giving the same problem, what should i do, plzz help me
| out with this.

Don't run clamd or amavisd as root.

Did you check what the actual ownership of the clamd socket is?
And the directories above it, are they accessible?

The clamd should be running as user amavis (or vscan or vhatever
you use), and its socket owned by that uid. Alternatively, clamd
may be kept running as clamav:clamav, and the user amavis must then
be a member of group clamav (file /etc/group).

  Mark

I have corrected my database structure and now amavis appears to be
operating mostly correctly except that I cannot in any way get it to
modify the subject tag.

I have this header from the email that was tagged as spam:
Return-Path: <blacklisted@...>
X-Original-To: jnewman@...
Delivered-To: jnewman@...
Received: from localhost (localhost [127.0.0.1])
     by mail.oplnk.net (Postfix) with ESMTP id 95D5C16D39
     for <jnewman@...>; Mon, 15 Dec 2003 10:00:16 -0600 (CST)
Received: from ([127.0.0.1])
     by localhost (mail [127.0.0.1]) (amavisd-new, port 10024) with SMTP
     id 20923-04 for <jnewman@...>; Mon, 15 Dec 2003 10:00:16 -0600
(CST)
Subject: TEST SPAM
X-Virus-Scanned: by oplink.net virus shield
X-Spam-Status: Yes, hits=5.8 tagged_above=1.0 required=1.0
tests=DATE_MISSING,
     FROM_NO_LOWER, MORTGAGE_PITCH, MORTGAGE_RATES, PENIS_ENLARGE
X-Spam-Level: *****
X-Spam-Flag: YES
Message-Id: <20031215160016.95D5C16D39@...>
Date: Mon, 15 Dec 2003 10:00:16 -0600 (CST)
From: blacklisted@...
To: undisclosed-recipients:;

------and the sql policy looks like:
mysql> select
users.email,policy.spam_modifies_subj,policy.spam_tag_level,policy.spam_tag2_level
from users,policy where users.policy_id=policy.id and
users.email="jnewman@...";
+--------------------+--------------------+----------------+-----------------+
| email              | spam_modifies_subj | spam_tag_level |
spam_tag2_level |
+--------------------+--------------------+----------------+-----------------+
| jnewman@... | Y                  |              1 |              
1 |
+--------------------+--------------------+----------------+-----------------+

And like I said, everything else appears to work
(spam_kill_level,spam_quarantine_to). I have not tried doing any WB
lists...but that is next after I fix this issue. Any help is appreciated.

Sincerely,
Jon Newman

-- 
Jon Newman (jnewman@...)
Systems Administrator/Software Engineer
The Optimal Link (http://www.oplink.net)

Is there anyway to get the original message ID, or the senders IP
address, into the log for SPAM?  I want to create a report for top spam
sending networks, etc...


-- 

Thanks,

---------------------------------------------------------
Joseph W. Breu, CCNA              phone : +1.319.268.5228
Senior Network Administrator        fax : +1.319.266.8158
Cedar Falls Utilities              cell : +1.319.493.1686
support: +1.319.268.5221            url : http://www.cfu.net

hi everyone, 

plzz help out with this problem, 

i have installed clamav + amavis + postfix 
in clamav, the TCP port is bind to 3310 and or to localport.  i have
enabled clamav in amavis.conf and started amavis with postfix.
the problme is that when i see the tail -f /var/log/maillog, i see that
its connecting to socket and /usr/local/sbin/clamd failed with no
permssions retrying in (sec's)
all virus scanners fails, what should i do, in amavis.conf its given that
the user should be the same user that is using amavis for clamav.conf
so i changed the user in clamav.conf to amavis or root also.  inspite of
that also , its giving the same problem, what should i do, plzz help me
out with this.

thanking you

venkatesh

-- 
http://www.fastmail.fm - A fast, anti-spam email service.

Hi there,

anyone knows what happens if all virus scanners fail (e.g. cannot be
executed) on amavisd-new? Will the message be requeued until a virus scanner
is available or will it be sent nontheless?

Thanks
Florian

Hi there,

running amavisd-new, I have the following directories in /var/amavis:

amavis-20031214T123636-02085/
amavis-20031214T124141-02086/

Inside these, there are

email.txt
parts/

I have disabled quarantining, and the messages in email.txt are not virus
infected or spam, they are test messages I sent some days ago.

Why do these directories exist?

Thanks!
Florian

Anne,

| the /var/amavis/tmp directory becomes very large very quickly.
| Is there any way to control it's growth other than a 
| cron job to delete the files every night?

The /var/amavis/tmp directory should't be growing unless there is
some unresolvable problem (e.g. permission problem, or all virus scanners
failing) in which case you will find the problem report
in the log and amavisd-new retains the temporary directory.
Normally there should be $max_servers directories present at any time,
plus perhaps an occasional leftover.

Cron job is normally not necessary, but you may consider
removing such files before starting amavisd, perhaps in an init script.

See http://www.ijs.si/software/amavisd/#faq-gen

| It appears to be creating each message contents twice in this folder...
| Why is this done.

If you mean the original mail contents in file email.txt,
plus its unpacked components in subdirectory parts, this is part
of normal operation unless you have $bypass_decode_parts disabled.
If you see some other duplication, then I don't know, you will
have to investigate.

  Mark

Oliver,

| iam using amavisd-new now, ans i tries all versions before!!
| but now everthing looks good in the amavis.log file but the
| e-mails comes not to there mailboxes...
| iam using send,ail. 8.12.3 with non milter...
| 
| Dec 12 23:04:42 gruenfail amavisd[2357]: (XXy7m1tx)
|   warnsender_with_pass=, dsn_needed=0, exit=0, 250 2.5.0 Ok,
|   id=XXy7m1tx, continue delivery

You have $forward_method in amavisd.conf empty, so amavisd-new does
not do explicit forwarding by itself, it just tells the helper program
its verdict. This is appropriate for milter setup, and the setup
where amavis.c helper program calls local delivery agent.

You did not tell which setup you are using. If using old sendmail
relay setup, you need to follow 'SENDMAIL (old non-milter setup, as relay)'
comment in amavisd.conf, setting $forward_method to 'pipe:...'.

If you want amavis(.c) helper prigram to call LDA,
then you need to specify it as amavis(.c) arguments,
following the '--' argument.

Hardly anyone still uses these two setups.

  Mark