Home / Browse / AMaViS - A Mail Virus Scanner / Mail / Archive

AMaViS - A Mail Virus Scanner

Email Archive: amavis-user (read-only)

2000:	_Jan	_Feb	_Mar	_Apr	_May	_Jun	_Jul (8)	_Aug (118)	_Sep (85)	_Oct (61)	_Nov (202)	_Dec (300)
2001:	_Jan (220)	_Feb (295)	_Mar (249)	_Apr (296)	_May (383)	_Jun (312)	_Jul (572)	_Aug (720)	_Sep (385)	_Oct (408)	_Nov (429)	_Dec (432)
2002:	_Jan (473)	_Feb (431)	_Mar (410)	_Apr (645)	_May (462)	_Jun (425)	_Jul (538)	_Aug (449)	_Sep (262)	_Oct (382)	_Nov (559)	_Dec (313)
2003:	_Jan (400)	_Feb (517)	_Mar (629)	_Apr (515)	_May (496)	_Jun (692)	_Jul (605)	_Aug (615)	_Sep (670)	_Oct (644)	_Nov (531)	_Dec (459)
2004:	_Jan (722)	_Feb (756)	_Mar (1070)	_Apr (781)	_May (615)	_Jun (628)	_Jul (537)	_Aug (608)	_Sep (641)	_Oct (619)	_Nov (650)	_Dec (526)
2005:	_Jan (539)	_Feb (419)	_Mar (469)	_Apr (423)	_May (496)	_Jun (522)	_Jul (465)	_Aug (569)	_Sep (455)	_Oct (396)	_Nov (317)	_Dec (407)
2006:	_Jan (266)	_Feb (278)	_Mar (383)	_Apr (228)	_May (273)	_Jun (311)	_Jul (223)	_Aug (316)	_Sep (329)	_Oct (522)	_Nov (400)	_Dec (429)
2007:	_Jan (354)	_Feb (316)	_Mar (316)	_Apr (291)	_May (298)	_Jun (383)	_Jul (214)	_Aug (324)	_Sep (206)	_Oct (214)	_Nov (186)	_Dec (153)
2008:	_Jan (238)	_Feb (207)	_Mar (238)	_Apr (166)	_May (225)	_Jun (295)	_Jul (153)	_Aug (207)	_Sep (177)	_Oct (223)	_Nov (107)	_Dec (178)
2009:	_Jan (174)	_Feb (152)	_Mar (152)	_Apr (203)	_May (205)	_Jun (183)	_Jul (209)	_Aug (151)	_Sep (232)	_Oct (109)	_Nov (101)	_Dec (54)
2010:	_Jan (102)	_Feb (115)	_Mar (132)	_Apr (164)	_May (87)	_Jun (90)	_Jul (61)	_Aug (79)	_Sep (87)	_Oct (84)	_Nov (61)	_Dec (89)
2011:	_Jan (110)	_Feb (99)	_Mar (37)	_Apr	_May	_Jun	_Jul	_Aug	_Sep	_Oct	_Nov	_Dec


S	M	T	W	T	F	S
	1	2	3	4	5	6
	(6)	(3)		(11)	(5)	(2)
7	8	9	10	11	12	13
(3)		(5)	(13)	(9)	(8)
14	15	16	17	18	19	20
	(1)	(10)	(2)	(2)
21	22	23	24	25	26	27
(6)	(4)	(3)	(6)	(7)	(7)	(2)
28

Re: [AMaViS-user] virus_scan FAILED .. filling up my disk space

From: miha vrhovnik @ domenca <miha.vrhovnik@do...> - 2010-02-24 09:37

"Michael Scheidell" <scheidell@...> wrote on 22.2.2010 16:20:15:

>On 2/22/10 3:30 AM, miha vrhovnik @ domenca wrote:
>> Hi Mark,
>>
>> On messages with large attachments or attachments that contain a zip file with other zip files and in that inside zip files a large quantity of files I get the following error.
>> amavis[3816]: (03816-11) (!!)TROUBLE in check_mail: virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED: CODE(0x8a065f4) Exceeded allowed time at (eval 45) line 292. at (eval 45) line 491.
>>
>> the problem here is that after that happens amavis doesn't clean up the temporary directory. Which could result in filling up a disk space and as Murphy says it will happen in the middle of the night.
>>
>> Any chances to cook up a quick patch for that?
>>
>>    
>you can already tell clamav not to unzip past (x) number of levels, and 
as zip is uncommented in amavis config file in @decoders section and a large amount (1000)of partX files was in ./parts directory I believe decoding is already done by amavis.
>you can already give it a max archive size.
>the tmp dir cleanup can be done with a cronjob and find -mtime options.
How old directories I'm supposed to remove? 1h, half a day? I doubt that this would help much in a case I had. I had 2 legit! messages one just under 20M in size (this is the max server would allow) which had a zip file with 20 or so bmp files zipped in.. uncompressed size was around 120M + message itself 140M. The other was 8M in size with 5,5M zip file which contained 14 zip files with total above 1000 files mostly js, html, gif, css.. also around good 100M of decompressed files. Both of this messages burnt 50G of free space during the night!


-- 
No system, however painstakingly designed, can withstand the destructive force of an idiot who's found the power switch. 
-
Z lepimi pozdravi / Kind regards,

Miha Vrhovnik

Re: [AMaViS-user] virus_scan FAILED .. filling up my disk space

From: Jernej Porenta <jernej.porenta@ar...> - 2010-02-24 11:57

Miha,

On Feb 24, 2010, at 10:37 AM, miha vrhovnik @ domenca wrote:
> "Michael Scheidell" <scheidell@...> wrote on 22.2.2010 16:20:15:
> 
>> On 2/22/10 3:30 AM, miha vrhovnik @ domenca wrote:
>>> 
>>> 
>> you can already tell clamav not to unzip past (x) number of levels, and 
> as zip is uncommented in amavis config file in @decoders section and a large amount (1000)of partX files was in ./parts directory I believe decoding is already done by amavis.

If you are checking the whole email (email.txt) (with $bypass_decode_parts = false), then you get the whole email and the whole parts combined together, so basically you clamav needs to check your emails (body part + attachments) at least twice. (Check the amavisd.conf settings for deep explanation of bypass_decode_parts and other settings).

My recommendation would be to turn off the clamav uncompressing features (ScanArchive no), or tune the limits for uncompressing to be able to scan such emails that your machine could handle (since I believe that your machine is unable to handle the full load of scanning your emails).

>> you can already give it a max archive size.
>> the tmp dir cleanup can be done with a cronjob and find -mtime options.
> How old directories I'm supposed to remove? 1h, half a day? I doubt that this would help much in a case I had. I had 2 legit! messages one just under 20M in size (this is the max server would allow) which had a zip file with 20 or so bmp files zipped in.. uncompressed size was around 120M + message itself 140M. The other was 8M in size with 5,5M zip file which contained 14 zip files with total above 1000 files mostly js, html, gif, css.. also around good 100M of decompressed files. Both of this messages burnt 50G of free space during the night!

If you stop amavisd, the daemon should remove all temporary files that were in use at particular time. For all other directories in $TEMPBASE directory, which are there after stopping amavisd, there is a reason for being there. Usually amavisd retains them for your analysis and you get log line something like "PRESERVING EVIDENCE in ..".

If I remember right, Michael already adviced a rule of a thumb a while ago for $TEMPBASE directory retention policy, which is I believe: you can safely delete $TEMPBASE/dirs which are older that one day, if you are not inspecting them, why there weren't processed sucessfully.

regards, Jernej

Re: [AMaViS-user] virus_scan FAILED .. filling up my disk space

From: Mark Martinec

Miha,

> On messages with large attachments or attachments that contain a zip file
> with other zip files and in that inside zip files a large quantity of
> files I get the following error.
>  amavis[3816]: (03816-11) (!!)TROUBLE in check_mail: virus_scan FAILED:
>  virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED:
>  CODE(0x8a065f4) Exceeded allowed time at (eval 45) line 292.
>  at (eval 45) line 491.
>
> the problem here is that after that happens amavis doesn't clean up the
> temporary directory. Which could result in filling up a disk space and
> as Murphy says it will happen in the middle of the night.
>
> Any chances to cook up a quick patch for that?

I quick-fix half-hearted solution is to add a dummy virus scanner entry
which always succeeds and claims a clean status, e.g.:

  ['always-clean', sub {0}],

Another quick and dirty solution is to hack both code sections
which test whether to preserve or not to preserve temporary
directories. Search for (two occurrences of):
  if ($self->{preserve} && !$self->{empty}) {
and replace them with:
  if (0) {

The coming version of amavisd provides a cleaner solution:

- adds a setting $allow_preserving_evidence, which (when turned off)
  essentially does the same as the hack above;

- adds the ability to specify a tempfailing *_destiny (D_TEMPFAIL);

- treats a failure of all virus scanners as just another
  reason to flag a message with CC_UNCHECKED, and allows the
  usual configuration facilities to treat it one way or another,
  e.g.:
    $final_unchecked_destiny = D_TEMPFAIL;  # defaults to D_PASS
    $unchecked_quarantine_method = 'local:unchecked/%m.gz';

Drop me a line if you'd like to try out the current snapshot.

  Mark

[AMaViS-user] Allowing only mail from user in whitelist (default blacklist)

From: Franck Pasquier <franckpasquier@gm...> - 2010-02-24 15:56

Hello,

I am trying to configure Amavis to answer my needs but I cannot find
the appropriate solution.

We are using Postfix/Amvis with our application and want the following
behavior :

1 - Users can send mail from the application to whatever mail adress
to the internet :
Amavis is doing the virus checking and the sent mail bypass the spam
checking using a MYNETS policy bank.

This is working as we want.

2 - Users can received mail only from a liste of specified mail address.
This list is user specific and is stored on a mysql database.
The database is as follow :
- table users : USER_ID, MAIL (user_id internal adress mail used by
the application)
- table users_wlist : USER_ID, MAIL_WLIST (mail adress that can send a
mail to this user)
If the sender adress is not on the recipient white list, the mail is
refused and returned to the sender.
If the mail is accepted a virus check is done and the mail is
delivered to the application.

I have searched on differents tutorials and on this mailing list for a
solution but cannot find it.

I would be glad to receive your input on that.

--
Franck

Re: [AMaViS-user] Allowing only mail from user in whitelist (default blacklist)

From: Michael Scheidell <scheidell@se...> - 2010-02-24 16:41

On 2/24/10 9:55 AM, Franck Pasquier wrote:
> Hello,
>
> I am trying to configure Amavis to answer my needs but I cannot find
> the appropriate solution.
>
>
> 2 - Users can received mail only from a liste of specified mail address.
> This list is user specific and is stored on a mysql database.
>    
use amavis policy based settings and wb listing.
set policy to only allow email with a score of -50 more less.  (then, 
basically, only whitelisted email for that user will get in)


-- 
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
 > *| *SECNAP Network Security Corporation

    * Certified SNORT Integrator
    * 2008-9 Hot Company Award Winner, World Executive Alliance
    * Five-Star Partner Program 2009, VARBusiness
    * Best Anti-Spam Product 2008, Network Products Guide
    * King of Spam Filters, SC Magazine 2008

______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________

[AMaViS-user] FuzzyOcr not working properly: Insecure dependency in exec while running with -T switch

From: Justin Piszcz <jpiszcz@lu...> - 2010-02-24 13:10

Package: fuzzyocr
Version: 3.5.1+svn135-1.2

Distribution: Debian Testing (x86_64)

Recommendations on how to fix this?  It used to work until a recent 
apt-get update.

Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping ocrad, image too small
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping ocrad-invert, image too small
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping ocrad-decolorize-invert, image too small
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping ocrad-decolorize, image too small
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) (!)SA error: FuzzyOcr: Unable to read output from "/var/lib/amavis/tmp/.spamassassin8592KARjTqtmp/scanset.tesseract.out.txt" for scanset tesseract
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Errors in Scanset "tesseract"
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Return code: 2048, Error: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping scanset because of errors, trying next...
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping ocrad, image too small
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping ocrad-invert, image too small
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping ocrad-decolorize-invert, image too small
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping ocrad-decolorize, image too small
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) (!)SA error: FuzzyOcr: Unable to read output from "/var/lib/amavis/tmp/.spamassassin8592KARjTqtmp/scanset.tesseract.out.txt" for scanset tesseract
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Errors in Scanset "tesseract"
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Return code: 2048, Error: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:46 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping scanset because of errors, trying next...
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) (!)SA error: FuzzyOcr: Error running preprocessor(ppmtopgm): /usr/bin/ppmtopgm
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Errors in Scanset "ocrad-decolorize-invert"
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Return code: 2048, Error: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping scanset because of errors, trying next...
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) (!)SA error: FuzzyOcr: Error running preprocessor(ppmtopgm): /usr/bin/ppmtopgm
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Errors in Scanset "ocrad-decolorize"
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Return code: 2048, Error: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping scanset because of errors, trying next...
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) (!)SA error: FuzzyOcr: Unable to read output from "/var/lib/amavis/tmp/.spamassassin8592KARjTqtmp/scanset.tesseract.out.txt" for scanset tesseract
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Errors in Scanset "tesseract"
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Return code: 2048, Error: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping scanset because of errors, trying next...
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) (!)SA error: FuzzyOcr: Error running preprocessor(ppmtopgm): /usr/bin/ppmtopgm
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Errors in Scanset "ocrad-decolorize-invert"
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Return code: 2048, Error: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping scanset because of errors, trying next...
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) (!)SA error: FuzzyOcr: Error running preprocessor(ppmtopgm): /usr/bin/ppmtopgm
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Errors in Scanset "ocrad-decolorize"
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Return code: 2048, Error: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping scanset because of errors, trying next...
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) (!)SA error: FuzzyOcr: Unable to read output from "/var/lib/amavis/tmp/.spamassassin8592KARjTqtmp/scanset.tesseract.out.txt" for scanset tesseract
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Errors in Scanset "tesseract"
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Return code: 2048, Error: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: save_execute: Insecure dependency in exec while running with -T switch at /usr/share/perl5/FuzzyOcr/Misc.pm line 188.
Feb 24 06:11:47 p34 amavis[8592]: (08592-01) SA warn: FuzzyOcr: Skipping scanset because of errors, trying next...