Home / server / Questions

Questions[mailscanner](server)

Martin Hope
Orphans
Asked: 2016-09-15 00:37:45 +0800 CST
  • 34

I have set up a working SMTP relay together with MailScanner. This SMTP relay is not — and will not be — able to relay email from the outside, only local email.

Is it possible to send a malicious email with the terminal? I have googled around but could not find anything that could answer my question. For example, I want to use:

echo "{malicious-string}" | mail [email protected]

What could the "{malicious-string}" be?

smtp postfix email-server mailscanner
Martin Hope
F12
Asked: 2012-06-06 00:57:44 +0800 CST
  • 1

Our sysadmin team edits the field Message-ID in exim4 header files (ending with -H) and substitues the first char after "<".

e.g:

077I Message-ID: <[email protected]>

-->

077I Message-ID: <[email protected]>

I'd like to write a script to release the mails. I changed the part between "<" and "@" in the field Message-ID and substituted a hash value so the Message-ID looks like:

077I Message-ID: <[email protected]>

Now exim says "format error" in the log and the mail is not released. There was no change except for this one field.

Why can't the ID be substituted like that? Does it need to be the exact same length? It's exim4 version 4.69-2ubuntu0.3.

email exim mailscanner
Martin Hope
Daniel C. Sobral
Asked: 2011-11-10 11:00:05 +0800 CST
  • 4

I decided to decrease the workload on my mail gateway by moving anti-virus processing to a separate server. I created the server, installed clamav-daemon on it, and tested it by running clamdscan from the mail gateway.

Satisfied, I then changed MailScanner as following:

Virus Scanners = clamd
Clamd Port = 3310
Clamd Socket = clamd server's IP address

I restarted mailscanner, and got the following result:

MailScanner[45946]: Clamd::ERROR:: UNKNOWN CLAMD RETURN ./lstat() failed: No such file or directory. ERROR :: /var/spool/MailScanner/incoming/45946

Obviously, MailScanner is not sending the file to be scanned. Instead, it is just telling it to scan a file which, obviously, does not exist on clamd's server.

I find it difficult to believe using clamd in this manner with mailscanner is not possible at all. Rather, I suspect I'm missing something. So... is it possible? If so, what configuration am I missing?

clamav mailscanner
Martin Hope
Zixyar
Asked: 2011-08-24 08:15:07 +0800 CST
  • 4

ATM I'm using the normal method to put all messages on HOLD to pass them from postfix to MailScanner as described on http://www.mailscanner.info/postfix.html:

In the Postfix configuration file /etc/postfix/main.cf add this line: 

header_checks = regexp:/etc/postfix/header_checks

In the file /etc/postfix/header_checks add this line: 

/^Received:/ HOLD

The effect of this is to tell Postfix to move all messages to the HOLD queue.

But I have some SMTP message that I have no need to pass them through MailScanner, messages identified by a custom header. I need to find a way to bypass MailScanner for these messages, but I can't find it, given I need to check the presence of a custom header and not i.e. the From: or To: address...

Tried modifying /etc/postfix/header_checks:

/^X-Custom-Header:/ FILTER smtp:[ip.addr.next.hop]:10025

in the mail.log I see the message filtered:

Aug 19 17:52:17 servername postfix/cleanup[19423]: AFB842E33A: filter: header X-Custom-Header: from relay.sender.foo[xx.yy.zz.kk]; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.sender.foo>: smtp:[ip.addr.next.hop]:10025

and if the one above is the only rule in header_checks it's delivered to the next hop via smtp.

Now I need to catch everything else in the Mailscanner (so in the Postfix HOLD queue), so how can I tell header_checks to do that? If I leave the /^Received:/ check even the AFB842E33A is held in the HOLD queue...

Maybe is just a dumb question, but... any idea?

postfix mailscanner
Martin Hope
gharper
Asked: 2009-06-26 11:42:48 +0800 CST
  • 3

I have mail gateway servers configured to use MailScanner + Postfix + SpamAssassin as described here, along with MailWatch as a web front end.

When sa-learn is run from MailWatch (it's run as the postfix user), it throws this error:

SA Learn: config: path "/root/.spamassassin" is inaccessible: Permission denied, Learned tokens from 0 message(s) (1 message(s) examined)

Running "sudo -u postfix spamassassin --lint -D" gives this bit of info:

dbg: config: read file /etc/mail/spamassassin/mailscanner.cf
warn: config: path "/root/.spamassassin" is inaccessible: Permission denied
dbg: config: mkdir /root/.spamassassin failed: mkdir /root/.spamassassin: Permission denied at /usr/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin.pm line 1577
dbg: config: Permission denied
dbg: config: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file

The bayes tokens are learned correctly, however this error is a minor annoyance and I'd like to fix it... Either by forcing SpamAssassin to not check the /root/.spamassassin/ directory for the config & prefs, or to fix MailWatch so it calls sa-learn correctly & doesn't throw this error.

postfix spamassassin mailscanner