ConfigServer Community Forum

I want to set up some rules in antivirus.exim for some targeted spam that is too large for MailScanner. When the rule triggers, I do get a log entry saying the message was cancelled. Then it just gets delivered anyway. I am wondering if it is because MS has a deliver statement in MS settings for non-spam actions?

Here is a sample of my antivirus rules:
if $header_subject contains keyword 1 or...

Noticing a lot of Excel 2007 files getting blocked in recent weeks from clients

seems to be when theres multiple workbooks saved as the one xlsx file

for example:

Mailscanner found workbook.xml1.rel within ASXPlantSim.xlsx

now these is a normal format so im a bit puzzled as to how i should modify the rules to allow this to not get blocked, without causing issues or without preventing things...

/home/MailScannerLogs/quarantine has reached 125GB. How do I tell Mailscanner to useless space? Fewer Days? etc...

Thanks
Jason

Im getting customers complianing of false positives

At Mon Mar 2 13:19:17 2009 the scanner said: Clamd: message was infected: Phishing.Heuristics.Email.SpoofedDomain

in mailscanner phishing is turned off

Find Phishing Fraud = NO
Also Find Numeric Phishing =YES

How can I tweak the phising filter to catch less false positives ?

got an issue installing mailscanner ( or re-installing actually) on a server thats been upgraded to perl 5.8.9

Can't locate LWP/UserAgent.pm in @INC (@INC contains: /usr/local/lib/perl5/5.8.9/i686-linux /usr/local/lib/perl5/5.8.9 /usr/local/lib/perl5/site_perl/5.8.9/i686-linux /usr/local/lib/perl5/site_perl/5.8.9 .) at msinstall.pl line 789.
BEGIN failed--compilation aborted at msinstall.pl...

isn't there some type of rule/setting I can set so that mailscanner only scans a file if its under a certain file size? I cant seem to find that setting. To much spam is getting through because the email file size is so large. Need to increase that setting.

I would like to mantain my own Spam Block List to improve the filter of spam in more than one server with MailScanner. Do you know how can I do it?

1- Subdomain delegation
rbl.mydomain.com. in ns rbl.mydomain.com.
rbl.mydomain.com. in a xx.xx.xx.xx

2- Spam.lists.conf

This file translates the names of the spam lists and spam domains lists into the real DNS domains to search....

Lately my log has been giving me this message.

At start of SA checks could not open /var/spool/MailScanner/incoming/Locks/MS.bayes.rebuild.lock, : 223 Time(s)
Could not open Bayes rebuild lock file /var/spool/MailScanner/incoming/Locks/MS.bayes.rebuild.lock, No such file or directory : 223 Time(s)

I am at a loss to know what this means or if it needs to be corrected and how.

Any help is...

Have more than 1200 emails and growing.
Happened after I upgraded the MailScanner script from MSFE interface.

Here are errors in the maillog:
Syntax error(s) in configuration file:
Unrecognised keyword spamlistdefinitions at line 1801

Warning: syntax errors in /usr/mailscanner/etc/MailScanner.conf.

Cannot read definitions from /etc/MailScanner/spam.lists.conf, No such file or directory...

Can anyone explain if I mark something as HAM then it is valid email?

What is the differences between HAM and SPAM?

Sorry for the dumb question but want to make sure I am doing this correctly?

Also what do most folks set there low scoring number to?

Thanks
Joe

Hi,

After upgrading to the latest version no emails are processed by MailScanner anymore. The maillog entries show:

Jan 12 15:01:20 server MailScanner : Virus and Content Scanning: Starting
Jan 12 15:01:23 server MailScanner : Content Checks: Detected and have disarmed web bug tags in HTML message in 1LMNK8-0002Tg-Qj from xxx@xxx.com
Jan 12 15:01:23 server MailScanner : Failed to link message...

Hi

today i tried to upgrade mailscanner latest version which updates some perl installer
from cpan but its getting stack after some stage.

CPAN: Compress::Zlib loaded ok (v1.42)
............................................................................DON
E
CPAN: LWP::UserAgent loaded ok (v5.810)
CPAN: Time::HiRes loaded ok (v1.9715)
Fetching with LWP:

its not going beyond from the...

I'm having a lot of issues lately with spam from my users , seems to be a spoofing issue. But i don't know any solution to stop this kind of spam

any of you have the same issues?

any idea to stop this?

best regards,

Heinz

I have a situation that is confusing me....

Here is the Mailscanner rule from cpanel:

Domain: harrison-township.org
Spam Scanning: yes
Low Scoring Spam: delete
High Scoring Spam: delete
Virus Scanning: yes
Deliver Cleaned Emails: no

Here is the MS info:

Spam: Y Action(s): deliver
High Scoring Spam: Y Action(s): deliver
SpamAssassin Spam: N
Listed in RBL: Y
Spam Whitelisted: N
Spam...

received this error when doing update

ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)

and in Mailwatch now read

Warning: mysql_pconnect() : Access denied for user 'mailwatch'@'localhost' (using password: YES) in /usr/local/cpanel/whostmgr/docroot/3rdparty/mailwatch/functions.php on line 508
Could not connect to database: Access denied for user...

New versions of CPanel are embracing Dovecot

What if any impact will switching have on Mail scanner - or the MS FE

The server load is non existent yet when I click in mailwatch to see the details about a certain message it hangs for at least 15 seconds before showing the results

the top 3 lines show right away its the rest of the page that hangs

Received on:12/12/08 06:59:33
Received by:hostname.com
Received from:216.xxx.xxx.xxx

When performing an upgrade to mailscanner tonight, I noticed this...

Detected spam handling in acls, disabling spamassassin in routers & transports!.
SpamAssassin method remains unchanged

And before you ask. Yes I have Spamassassin disabled in both Service Man and Tweak Settings. :)

WHM 11.23.2 cPanel 11.23.6-R27698
CENTOS Enterprise 5.2 i686 on standard - WHM X v3.1.0
* ConfigServer Mail Manage
* ConfigServer Mail Queues
* ConfigServer Security&Firewall
* ConfigServer MailScanner FE

I'm recieveing multiple emails of this:

From Subject Received Size Categories
cpanel@server.myhost.com clamav on server.myhost.com failed 6:53 PM 5 KB

chkservd.log file
]...cpsrvd...

I've been having problems with the clamd socket staying put on a Centos 3 box. The socket will sporadically become a directory, clamd will fail and I will have to reinstall. When you try to restart it tells me this:
Starting clamd: LibClamAV Error: cli_untgz: Cannot close file /tmp/clamav-03bab01719c80dd9b2d0ae36b11ad50a/main.fp
LibClamAV Error: cli_cvdload(): Can't unpack CVD file.
LibClamAV...