Re: [Mailwatch-users] utterly stuck - no quarantine release button

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hi Neil,

quite a few errors here !

[root@hosting 20150911]# MailScanner --lint
Trying to setlogsock(unix)
Could not use Custom Function code /usr/share/MailScanner/MailScanner/CustomFunctions/SQLSpamSettings.pm, it could not be "require"d. Make sure the last line is "1;" and the module is correct with perl -wc (Error: Bad name after spamscore' at /usr/share/MailScanner/MailScanner/CustomFunctions/SQLSpamSettings.pm line 49.
Compilation failed in require at /usr/share/MailScanner/MailScanner/Config.pm line 760.
) at /usr/share/MailScanner/MailScanner/Config.pm line 762

Reading configuration file /etc/MailScanner/MailScanner.conf
Reading configuration file /etc/MailScanner/conf.d/README
Cannot open ruleset file /etc/MailScanner/rules/bounce.rules, No such file or directory at /usr/share/MailScanner/MailScanner/Config.pm line 2641
Cannot open ruleset file /etc/MailScanner/rules/spam.whitelist.rules, No such file or directory at /usr/share/MailScanner/MailScanner/Config.pm line 2641
Cannot open ruleset file /etc/MailScanner/rules/max.message.size.rules, No such file or directory at /usr/share/MailScanner/MailScanner/Config.pm line 2641
Read 463 hostnames from the phishing whitelist
Read 11644 hostnames from the phishing blacklists
Config: calling custom init function MailWatchLogging
Started SQL Logging child

Checking version numbers...
Version number in MailScanner.conf (4.85.2) is correct.

Your envelope_sender_header in spam.assassin.prefs.conf is correct.
MailScanner setting GID to  (89)
MailScanner setting UID to  (89)

Checking for SpamAssassin errors (if you use it)...
Using SpamAssassin results cache
Connected to SpamAssassin cache database
bayes: cannot open bayes databases /var/spool/MailScanner/spamassassin/bayes_* R/O: tie failed: Permission denied
bayes: cannot open bayes databases /var/spool/MailScanner/spamassassin/bayes_* R/O: tie failed: Permission denied
SpamAssassin reported no errors.
Connected to Processing Attempts Database
Created Processing Attempts Database successfully
There are 7 messages in the Processing Attempts Database
Using locktype = posix
MailScanner.conf says "Virus Scanners = clamav"
Found these virus scanners installed: clamavmodule, clamd
===========================================================================
Filename Checks: Windows/DOS Executable (1 eicar.com)
Other Checks: Found 1 problems
Virus and Content Scanning: Starting
1.message: Eicar-Test-Signature-1 FOUND

./1/eicar.com: Eicar-Test-Signature FOUND

Virus Scanning: ClamAV found 2 infections
Infected message 1 came from 10.1.1.1
Virus Scanning: Found 2 viruses
===========================================================================
Virus Scanner test reports:
ClamAV said "eicar.com contains Eicar-Test-Signature"

If any of your virus scanners (clamavmodule,clamd)
are not listed there, you should check that they are installed correctly
and that MailScanner is finding them correctly via its virus.scanners.conf.
Config: calling custom end function MailWatchLogging
From: Neil <nwi...@gm...>
Sent: Friday, 11 September 2015 19:49
To: mai...@li...
Subject: Re: [Mailwatch-users] utterly stuck - no quarantine release button

Please also do a MailScanner --lint and send through the output please.

Thanks!

On Fri, Sep 11, 2015 at 11:38 AM, Neil <nwi...@gm...<mailto:nwi...@gm...>> wrote:
If you don't mind Steve, please grep for the message ID in the maillog instead of just "saved" as I'd like to see the full action taken by MailScanner.

You can obviously remove all domains etc for privacy reasons.

Thanks.

On Fri, Sep 11, 2015 at 11:27 AM, Steve Rolfe <st...@le...<mailto:st...@le...>> wrote:

Hi Neil,

ok, I did that - the mail came through stripped of the attachment with warning message:

Warning: This message has had one or more attachments removed
Warning: (mytest.bat.exe).
Warning: Please read the "ITG-Attachment-Warning.txt" attachment(s) for more information.

I grep 'saved' in the maillog and nothing.

In the MailWatch interface, it shows that it has been quarantined.

________________________________
From: Neil <nwi...@gm...<mailto:nwi...@gm...>>
Sent: Friday, 11 September 2015 19:10

To: mai...@li...<mailto:mai...@li...>
Subject: Re: [Mailwatch-users] utterly stuck - no quarantine release button

Please look for a quarantined email from your MailWatch front end, look at the date it was quarantined and then search your older maillog file in the relevantly dated log file, perhaps your logs have rotated?
Or rather send a new email message through with a banned extension (eg: filename.bat.exe and tail -f /var/log/maillog while this goes through and check that it is being quarantined correctly please.

There should be something showing the email being saved onto your disk.

Thanks.

On Fri, Sep 11, 2015 at 10:59 AM, Steve Rolfe <st...@le...<mailto:st...@le...>> wrote:

thanks Neil - yes, quarantine enabled in conf.php.

[root@hosting MailScanner]# grep 'saved' /var/log/maillog

shows no results at all :(

________________________________
From: Neil <nwi...@gm...<mailto:nwi...@gm...>>
Sent: Friday, 11 September 2015 18:29

To: mai...@li...<mailto:mai...@li...>
Subject: Re: [Mailwatch-users] utterly stuck - no quarantine release button

No problem Steve,

That error you sent just looks like bayes permission issue, so I don't think it's related.

Please could you look in your logs for anything saying "Saved" which should show the files being quarantined correctly.

In your /var/www/html/mailscanner/conf.php I presume you have got your quarantine enabled?

define(QUARANTINE_USE_FLAG, true);

Regards.

Neil Wilson.

On Fri, Sep 11, 2015 at 10:20 AM, Steve Rolfe <st...@le...<mailto:st...@le...>> wrote:

thanks Neil. I have updated as you have below - restarted all services and still no button. No, I don't see any XML error, just no button. Output of grep 'MailScanner' /var/log/maillog is lots of these:

hosting spamd[2828]: plugin: eval failed: bayes: (in learn) locker: safe_lock: cannot create lockfile /var/spool/MailScanner/spamassassin/bayes.mutex: Permission denied

________________________________
From: Neil <nwi...@gm...<mailto:nwi...@gm...>>
Sent: Friday, 11 September 2015 17:23
To: mai...@li...<mailto:mai...@li...>
Subject: Re: [Mailwatch-users] utterly stuck - no quarantine release button

Hi Steve,

I use Centos 5/6/7 as well, my ownership and permissions are always set as follows...

chown -R postfix:apache /var/spool/MailScanner/quarantine
chmod -R g+xw /var/spool/MailScanner/quarantine
chown -R postfix:apache /var/spool/MailScanner/spamassassin

Then in my MailScanner.conf I use the following options...

Run As User = postfix
Run As Group = postfix
Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming
MTA = postfix
Quarantine User = apache
Quarantine Group = apache
Spam Actions = store
High Scoring Spam Actions = store
MCP Actions = store
High Scoring MCP Actions = store

When looking in your email logs, does it actually show the emails being stored/saved correctly?
EG:
Sep 8 00:55:47 MailScanner[13594]: Saved entire message to /var/spool/MailScanner/quarantine/20150908/BFFCA5BD8014.A4F3A

Also when you say your release button is missing, do you see an XML-RPC error by any chance where the quarantine info should be, or is it just not there at all without any errors?

Hope this helps.

Regards.

Neil Wilson.

On Fri, Sep 11, 2015 at 6:34 AM, Steve Rolfe <st...@le...<mailto:st...@le...>> wrote:
This is doing my head in :(
I have mailwatch working perfectly – BUT, there is NO release button for quarantine messages.  I have:

1.       Checked permissions on /var/spool/MailScanner/quarantine   and they are postfix:apache    (I am running centos)

2.       Modified and ran the fix it script

3.       Tried different permissions on quarantine directory (root:root   postfix:postfix  apache:apache)   and more !

4.       Uninstalled/reinstalled postfix

5.       All settings in MailScanner.conf are correct as per documentation

What on earth could it be?  I have been all over google and forums – they all say it is permissions, but I just can’t see for the life of me that it is !!

Please help !!

This e-mail, together with any attachments, is for the exclusive and confidential use of the addressee(s). Any other distribution, use of, or reproduction without prior written consent is strictly prohibited. Views expressed in this e-mail are those of the individual, except where specifically stated otherwise. If this e-mail has been sent to you in error, please delete the e-mail completely and immediately from your system. Leeton Shire Council does not warrant or guarantee this message to be free of errors, interference or viruses.

------------------------------------------------------------------------------

_______________________________________________
Mailwatch-users mailing list
Mai...@li...<mailto:Mai...@li...>
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

--
This message has been scanned for viruses and
dangerous content by MailScanner<http://www.mailscanner.info/>, and is
believed to be clean.
This e-mail, together with any attachments, is for the exclusive and confidential use of the addressee(s). Any other distribution, use of, or reproduction without prior written consent is strictly prohibited. Views expressed in this e-mail are those of the individual, except where specifically stated otherwise. If this e-mail has been sent to you in error, please delete the e-mail completely and immediately from your system. Leeton Shire Council does not warrant or guarantee this message to be free of errors, interference or viruses.

------------------------------------------------------------------------------

_______________________________________________
Mailwatch-users mailing list
Mai...@li...<mailto:Mai...@li...>
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

--
This message has been scanned for viruses and
dangerous content by MailScanner<http://www.mailscanner.info/>, and is
believed to be clean.
This e-mail, together with any attachments, is for the exclusive and confidential use of the addressee(s). Any other distribution, use of, or reproduction without prior written consent is strictly prohibited. Views expressed in this e-mail are those of the individual, except where specifically stated otherwise. If this e-mail has been sent to you in error, please delete the e-mail completely and immediately from your system. Leeton Shire Council does not warrant or guarantee this message to be free of errors, interference or viruses.

------------------------------------------------------------------------------

_______________________________________________
Mailwatch-users mailing list
Mai...@li...<mailto:Mai...@li...>
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

--
This message has been scanned for viruses and
dangerous content by MailScanner<http://www.mailscanner.info/>, and is
believed to be clean.
This e-mail, together with any attachments, is for the exclusive and confidential use of the addressee(s). Any other distribution, use of, or reproduction without prior written consent is strictly prohibited. Views expressed in this e-mail are those of the individual, except where specifically stated otherwise. If this e-mail has been sent to you in error, please delete the e-mail completely and immediately from your system. Leeton Shire Council does not warrant or guarantee this message to be free of errors, interference or viruses.

------------------------------------------------------------------------------

_______________________________________________
Mailwatch-users mailing list
Mai...@li...<mailto:Mai...@li...>
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

--
This message has been scanned for viruses and
dangerous content by MailScanner<http://www.mailscanner.info/>, and is
believed to be clean.
This e-mail, together with any attachments, is for the exclusive and confidential use of the addressee(s). Any other distribution, use of, or reproduction without prior written consent is strictly prohibited. Views expressed in this e-mail are those of the individual, except where specifically stated otherwise. If this e-mail has been sent to you in error, please delete the e-mail completely and immediately from your system. Leeton Shire Council does not warrant or guarantee this message to be free of errors, interference or viruses.