Tag Info

Hot answers tagged

11

The problem is your Amavis setup. Your quarantine destination seems to be a mail address. So Amavis injects the virus mail back into Postfix to be delivered to that address. Postfix now decides to scan the mail first and delegates to Amavis. Amavis recognizes the virus and tries to quarantine it by delivering to the quarantine mail address. So ... You get ...


6

Just send an email with the eicar test file attached. This file has a signature which any virus scanner should know and detect. As for the monitoring of the clamd process itself, there are many possibilities. I personally prefer using monit for it.


6

It appears that some checks that weren't supposed to be released into all update streams have been. See eg http://unix.stackexchange.com/questions/183763/spamassassin-object-method-location-problems-after-restart for more details, but that the upshot is that the errors should go away following the next update after the errant rule(s) have been pulled. ...


5

You order of rules is very bad. If you want to keep all of them and not add anything else, the order must be: smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, reject_invalid_hostname, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_destination, reject_unknown_recipient_domain, ...


5

Silly me. Just found out about this page: http://www.postfix.org/addon.html ... and I quote: mailscanner system, works with Postfix and other MTAs. WARNING: This software uses unsupported methods to manipulate Postfix queue files directly. This will result in corruption or loss of mail. The mailscanner authors have sofar refused to discuss a proper ...


5

Amavis is in the default installation of Mac OS X. It can be used with SMTP server like Postfix (also installed with mac os x). But even if it comes with all Mac OS X installation, it is here to be used by Mac OS X server. But of course, by configuring manually postfix and amavis on mac os x client you could use them. There is a web page on Apple website ...


5

If your using amavisd-new, you can simply run the amavisd-release command, passing it the quarantine ID of the mail in question. It will take care of removing the email from the quarantine and injecting the email into Postfix, bypassing any content filtering. You can find out the details at ...


5

to disable milter processing after amavis, add to your master.cf in the after-amavis section 127.0.0.1:10025 inet n - - - - smtpd [....] -o smtpd_milters= if you want to run the milter after amavis, set the smtpd_milters= configuration option in main.cf to an empty string and add the inet:localhost:8891 configuration to ...


5

Have you checked this parameter: @local_domains_acl It is defined on /etc/amavis/conf.d/05-domain_id. According to the Amavisd-new documentaion on http://www.ijs.si/software/amavisd/: No spam-related headers inserted? Here are some reasons: @local_domains_acl is not correctly set. These headers are only inserted for recipients matching ...


4

Have a look at the file, maybe the content is something else, amavis is using 'file' to look in the content what content-type it is.


4

Since you want to disable virus checking entirely, the easiest way to do so is find the @bypass_virus_checks_maps line in the Amavis configuration files (amavis.conf or conf.d/50-user) and change it to this; bypass_virus_checks_maps => [1];


4

The logs above is expected behavior from postfix and amavis. For after queue content filter like amavis, the filter needs reinject email to postfix. For more info please refers to official documentation. Here some explanation of postfix and amavis action. Jul 19 07:59:06 mail postfix/smtpd[15492]: connect from unknown[37.215.63.185] Client from ...


4

Additionally to the explanations from masegaloeh, I want to point out, why the spammer got through in your case. Look at the following line in the logs: Jul 19 07:59:07 mail postfix/smtpd[15492]: NOQUEUE: reject_warning: RCPT from unknown[37.215.63.185]: 504 5.5.2 <37.215.63.185>: Helo command rejected: need fully-qualified hostname; from=<> ...


4

If you are sure, that all mails to amavis are going to your users and you don't want to lookup your database, then disable your SQL parameters and set @local_domains_maps = ( ["."] ); With that setting every mail amavis receives is considered to have a local user as destination.


4

It calls it up via perl, no deamon required.


4

You need to provide more detailed logging output to solve that: Stop amavisd and restart it in debug mode (amavisd debug, on Debian/Ubuntu it's probably amavisd-new debug, but since you mention you configured amavisd with amavisd.conf and not /etc/amavis/conf.d/50-user, I guess you are not on Debian/Ubuntu). While you do that, you will probably want to ...


4

Oh boy. So, I figured it out. Turns out it was a Nagios script that checks whether amavis is running, and more importantly for this particular issue, checks that the AV engine is working... by sending it the EICAR virus. http://exchange.nagios.org/directory/Plugins/Anti-2DVirus/Amavis/check_amavis/details is the script in question if anyone is interested. ...


4

Solved on Amavis Users Group... Thanks Mark Martinec Requires two changes: In /etc/amavis/conf.d/50-user add this: ################## ---- CUSTOM SIGNATURES AS DISCLAIMERS ------- ############################### # uses altermime to insert a different signatue per users # signatures are located in teh /etc/postfix/signatures/ directory # also needs a small ...


3

I would suggest a smtpd_recipient_restriction similar to the following: smtpd_recipient_restricdtions = # Whitelisting or blacklisting: check_recipient_access proxy:mysql:/etc/postfix/mysql-virtual_recipient.cf, # Everyone should play after rules: reject_non_fqdn_recipient, reject_non_fqdn_sender, reject_unknown_recipient_domain, ...


3

In clamd.conf AllowSupplementaryGroups is default false try this: AllowSupplementaryGroups true


3

There are several options to accomplish this, and they all largely depend on the delivery agent you are using to do the final delivery to a user's virtual mailbox. If you are using the stock Postfix virtual(8) delivery agent, you can't accomplish this. If you are using either the Cyrus LDA or the Dovecot LDA, you habe two more options: You can either use ...


3

You should put this options on your /etc/amavis/conf.d/50-user file: $sa_tag_level_deflt = -999; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 6.2; # add 'spam detected' headers at that level $sa_kill_level_deflt = 6.9; # triggers spam evasive actions (e.g. blocks mail) $sa_spam_subject_tag = '**Spam**'; Configure the SPAM ...


3

Thia maillog line Jan 19 13:45:13 mydomain postfix/smtpd[2361]: fatal: unexpected command-line argument: ### was clear indicator that something wrong on master.cf syntax. You already confirmed this in your answer. In this part, I will try to explain why mail go through when you requeue them. When you issue command postsuper - r to requeue message, ...


3

In amavisd.conf there is a line up at the top of the file $log_templ= you will want to add %b to that, it will include the MD5 hash of the email in the log. You will probably want to read the README.customize a bit more, because you will be redefining how amavisd logs. This is one I've found, it's not impossible to understand, you'd just need to add the %b ...


2

Amavisd uses parameter $inet_socket_bind to specify which binding IP address. The possible value is undef or an IP Address. So, it isn't possible to specify some IP address but not all. The default value is 127.0.0.1, that means amavis only listen on localhost. If you expose amavisd by bind it to public IP address, don't forget to set ACL so you don't allow ...


2

Disclaimer: this is half answer because I can use socket when postfix -> amavis but I can't use it when amavis -> postfix. See the explanation in end of this answer. To use socket, you should use LMTP instead of SMTP to deliver email from postfix to amavis. As NickW said above, you need to put the amavis socket inside the Postfix queue directory. In this ...


2

This is the solution for a communication of amavis to postfix over unix socket. It is the second half of masegaloeh's answer. First, you have to modify the /var/spool/postfix/amavis directory: chmod 770 /var/spool/postfix/amavis chown amavis:postfix /var/spool/postfix/amavis The idea behind that: Postfix will create a unix socket smtpd service in this ...


2

Looks like your case was similar to this example case on Amavisd documentation If for some reason SASL users connect to port 25, as an alternate method you could have all clients in Postfix' $mynetworks and SASL auth senders bypass checks and let everything else fall through to a catchall that sets the content_filter. #main.cf content_filter = ...


2

If you use Spam Assassin with Amavisd, then amavisd don't use parameter required_score to determine spam score limit. Instead of this, amavis has three level of score here $sa_tag_level_deflt = 1; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 6.2; # add 'spam detected' headers at that level $sa_kill_level_deflt = 6.9; # ...


2

Use spamassassin binary in debug mode. Taken from this SpamAssassin Wiki: Using Pyzor echo "test" | spamassassin -D pyzor 2>&1 | less or spamassassin -t -D 2>&1 < /tmp/myspam| less First command was send string "test" to spamassassin. The second one, send full source of email in /tmp/myspam to spamasssassin. This test should return ...



Only top voted, non community-wiki answers of a minimum length are eligible