February 2011 - Users

Re: [Exim4U] are outgoing mails scan by Clam and SA (Gordon Dickens)
by Kebba Foon 01 Mar '11

01 Mar '11

Hi Gordon, i was able to set scanning for outgoing mails our my exim4u config: here are the settings i added: on the router section at the very top i added this: spamcheck_router: # When to scan a message : # - it isn't already flagged as spam # - it isn't already scanned condition = "${if and { {!def:h_X-Spam-Flag:} {!eq {$received_protocol}{spam-scanned}}} {1}{0}}" driver = accept transport = spamcheck and then on the transport section i have this there: spamcheck: debug_print = "T: spamassassin_pipe for $local_part@$domain" driver = pipe command = /usr/sbin/exim4 -oMr spam-scanned -bS use_bsmtp transport_filter = /usr/bin/spamc home_directory = "/tmp" current_directory = "/tmp" user = Debian-exim group = Debian-exim return_fail_output message_prefix = message_suffix = This indeed scan messages and tag them, but even if it tags the messages as spam it will still send them out. is their any setting i can add on the remote_stmp transport section that it discard emails tag as spam? Thanks Kebba On Wed, 2011-02-09 at 12:00 -0500, users-request(a)exim4u.org wrote: > Re: are outgoing mails scan by Clam and SA (Gordon Dickens)

2 1

surblspamcheck
by Terry 01 Mar '11

01 Mar '11

Do I need to activate this check any where ? I can see it is configured but when I send an email with a black listed url to test it seems to gets through. No errors show in the logs. in exim.conf # exim4u: Setup Perl Startup for SURBL/URIBL Scan Checks perl_startup = do '/etc/exim/exim.pl/exim_surbl.pl' perl_at_start = true message_body_visible = 5000 message_body_newlines = true and ls -al /etc/exim/exim.pl/exim_surbl.pl -rw-r--r-- 1 root wheel 26230 Feb 15 23:35 /etc/exim/exim.pl/exim_surbl.pl It has the Enable embedded Perl interpreter enabled and I don't think it would start up with out it. Not too sure of exim cmd line options to test it further Thanks

2 2

spamassassin tag score
by Kebba Foon 27 Feb '11

27 Feb '11

Dear List, can someone explain this two files for me on the exim4u web interface: Spamassassin tag score: Spamassassin discard score: Am not exactly sure how they affect my spam checks on my server. my question is how is this value calculated and highly or lower values which has the potential to stop more spam? Thanks Kebba On Sat, 2011-02-19 at 12:00 -0500, users-request(a)exim4u.org wrote: > Send users mailing list submissions to > users(a)exim4u.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://exim4u.org/mailman/listinfo/users > or, via email, send a message with subject or body 'help' to > users-request(a)exim4u.org > > You can reach the person managing the list at > users-owner(a)exim4u.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of users digest..." > > > Today's Topics: > > 1. Re: malware acl condition: clamd: ClamAV returned > /var/spool/exim4/scan/XXXX.eml: Can't create temporary directory > ERROR (Odhiambo Washington) > 2. Re: exim as a backup MX (Gordon Dickens) > 3. Re: malware acl condition: clamd: ClamAV returned > /var/spool/exim4/scan/XXXX.eml: Can't create temporary directory > ERROR (Gordon Dickens) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 18 Feb 2011 20:24:35 +0300 > From: Odhiambo Washington <odhiambo(a)gmail.com> > Subject: Re: [Exim4U] malware acl condition: clamd: ClamAV returned > /var/spool/exim4/scan/XXXX.eml: Can't create temporary directory ERROR > To: Exim4U General Discussion <users(a)exim4u.org> > Message-ID: > <AANLkTimrdtT8o308sH6nbatEb6Y=iLGvfoQh11tHytHw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On Fri, Feb 18, 2011 at 6:52 PM, Udo Hortian <udo_hortian(a)web.de> wrote: > > > Hello Gordon, > > > > On Fri, Feb 18, 2011 at 10:07:31AM -0500, Gordon Dickens wrote: > > > That is quite strange especially since it only occurs sometimes. I can't > > > say for sure but I suspect that this is most probably a ClamAV problem. > > > Check to see if the clamd logs have any related entries that might yield > > > a clue. > > I checked the clamav.log and when the error occurs I find lines like: > > > > Tue Feb 15 22:20:42 2011 -> /var/spool/exim4/scan/XXXX/XXXX.eml: Can't > > create temporary directory ERROR > > > > Just like in exim's paniclog. > > > > > I realize this is obvious but make sure that the Debian-exim > > > user and clamav user both have read/write permission to the > > > /var/spool/exim4/scan directory. > > In fact the permissions to this directory are as follows: > > > > ls -l /var/spool/exim4/ | grep scan > > drwxr-x--- 2 Debian-exim Debian-exim 4096 Feb 18 12:54 scan > > > > Before I checked this, but somehow was not noting the missing w for the > > group. > > > > So the Debian-exim group has NO write-permission. On another system > > running exim4u (which I use as the primary MX) the permissions are > > identical and I do not have any errors of this kind there. > > > > Probably here lies the problem. But since I do not have any problems on > > the other system, I would like to understand first, why I really need > > write access here. How does virus scanning actually works? Which process > > really needs access to this directory? > > > > Then I would like to understand why there are no problems on my other > > system. > > > > > Things to check::: > > > I run clamd as mailnull (the same user Exim runs as). > Afterall, they both process the same mail. > > (20:20:25 <~>) 0 $ grep User /usr/local/etc/clamd.conf > User mailnull > (20:20:35 <~>) 0 $ exim -bP | grep exim_user > exim_user = mailnull > (20:20:49 <~>) 0 $ > > (20:20:49 <~>) 0 $ ls -al /var/spool/exim/ > total 24 > drwxr-x--- 7 mailnull mailnull 512 Oct 26 2009 . > drwxr-xr-x 15 root wheel 512 Dec 27 15:17 .. > drwxr-x--- 2 mailnull mailnull 512 Feb 18 18:18 db > drwxr-x--- 13 mailnull mailnull 7680 Feb 18 20:13 input > drwxr-x--- 2 mailnull mailnull 512 Oct 26 2009 log > drwxr-x--- 17 mailnull mailnull 4096 Feb 18 20:13 msglog > drwxr-x--- 3 mailnull mailnull 512 Feb 18 20:13 scan > (20:21:16 <~>) 0 $ > > In clamd.conf: > > TemporaryDirectory /var/tmp > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254733744121/+254722743223 > _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ > Damn!! >

2 1

malware acl condition: clamd: ClamAV returned /var/spool/exim4/scan/XXXX.eml: Can't create temporary directory ERROR
by Udo Hortian 19 Feb '11

19 Feb '11

Hello, I am successfully using exim4u for some time. Thanks Gordon for your work! Now I installed exim4u 1.2.5 on another server with only relay-domains configured so far. From time to time I see the following error in /var/log/exim4/paniclog: 2011-02-15 22:20:42 XXXX malware acl condition: clamd: ClamAV returned /var/spool/exim4/scan/XXXX/XXXX.eml: Can't create temporary directory ERROR exim4u is running on Debian squeeze. I think I make all the necessary adoptions concerning paths and usernames/groups. I also added the clamav user to the Debian-exim group. clamd runs as clamav user: $ps axu | grep clamd clamav 15173 0.3 19.4 125480 102016 ? Ssl Feb13 21:54 /usr/sbin/clamd Interestingly it does not happen with all relayed mails, but only with a few. Do you have any hints where the problem might be? Best regards, Udo

3 4

exim as a backup MX
by Kebba Foon 18 Feb '11

18 Feb '11

Hi list, I have two exim4u installation but the mail boxes are only one server, this is done for backup purposes but I advertise both mx on the internet now the secondary server is accepting mails for my domains but can deliver them to any mailboxes as they don't exist on the second box. So I question is can I turn the second exim4u server to a backup MX? So that it can accept mails for my domains and queue/forward them to the primary(main) mail server. If so can you please send me the sample config file? Thanks Kebba

3 3

Re: [Exim4U] users Digest, Vol 13, Issue 1
by Kebba Foon 09 Feb '11

09 Feb '11

Thanks Gordon, i think then doing ratelimit will be more idea, i will experience with that first. On Tue, 2011-02-08 at 12:00 -0500, users-request(a)exim4u.org wrote: > Send users mailing list submissions to > users(a)exim4u.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://exim4u.org/mailman/listinfo/users > or, via email, send a message with subject or body 'help' to > users-request(a)exim4u.org > > You can reach the person managing the list at > users-owner(a)exim4u.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of users digest..." > > > Today's Topics: > > 1. are outgoing mails scan by Clam and SA (kebba.foon(a)qcell.gm) > 2. Re: are outgoing mails scan by Clam and SA (Gordon Dickens) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 07 Feb 2011 17:58:40 +0000 > From: kebba.foon(a)qcell.gm > Subject: [Exim4U] are outgoing mails scan by Clam and SA > To: users(a)exim4u.org > Message-ID: <20110207175840.15821z6yitesc728(a)qmail.gm> > Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; > format="flowed" > > Dear List, > > our network administrator are having issues with smtp traffice (we are > an ISP) most of our customer's IP are sending spam, this is giving a > bad reputation on our IP's on the rbl's. they are suggesting that all > smtp traffic from our customers be forwarded to our mail server and > the the server will check for malform mails, scan the mails and then > further forward them to their destination. my question is: > > 1. those exim4u scan outgoing mails > 2. is it a good idea to go about this setup? > 3. is there any other best solutions. > > Thanks > Kebba > > > > > ------------------------------ > > Message: 2 > Date: Tue, 08 Feb 2011 10:00:15 -0500 > From: Gordon Dickens <gecko(a)exim4u.org> > Subject: Re: [Exim4U] are outgoing mails scan by Clam and SA > To: Exim4U General Discussion <users(a)exim4u.org> > Message-ID: <4D515A7F.5070708(a)exim4u.org> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi Kebba, > > The stock Exim4U config is not setup to scan outgoing mail for spam. > However, you could modify Exim4U's exim configuration file > (/etc/exim/exim.conf) to scan outgoing mail by modifying the ACLs to > remove the appropriate accept statements prior to the various spam > checks. For example, to have all authenticated mail go through all of > the same spam checks as incoming mail, try commenting out the following > statement from the beginning of all of the ACLs: > > accept authenticated = * > > Obviously, you would need to thoroughly test any modifications such as this. > > It sounds like you are interested in setting up Exim4U as a relay host > and then to have it do spam checks. This can also be done but you would > need to modify the ACLs in the exim configuration file to accept mail > from the relaying server but to then do the spam checks. > > As an aside, Exim4U does have the ability to ratelimit outgoing mail > from internal accounts' to prevent abuse. This is done in the file: > > /etc/exim/exim4u_local_rl.conf.inc. > > The ratelimiting done by this file using the stock Exim4U configuration > is very conservative so as to not disrupt any legitimate senders, > however, this file is fairly well self documented and you can modify the > ratelimiting parameters in this file to be more aggressive to match your > needs. > > FYI, > > Gordon > > > > On 02/07/2011 12:58 PM, kebba.foon(a)qcell.gm wrote: > > Dear List, > > > > our network administrator are having issues with smtp traffice (we are > > an ISP) most of our customer's IP are sending spam, this is giving a > > bad reputation on our IP's on the rbl's. they are suggesting that all > > smtp traffic from our customers be forwarded to our mail server and > > the the server will check for malform mails, scan the mails and then > > further forward them to their destination. my question is: > > > > 1. those exim4u scan outgoing mails > > 2. is it a good idea to go about this setup? > > 3. is there any other best solutions. > > > > Thanks > > Kebba > > > > > > _______________________________________________ > > users mailing list > > users(a)exim4u.org > > https://exim4u.org/mailman/listinfo/users > > > > > ------------------------------ > > _______________________________________________ > users mailing list > users(a)exim4u.org > https://exim4u.org/mailman/listinfo/users > > > End of users Digest, Vol 13, Issue 1 > ************************************

1 0

are outgoing mails scan by Clam and SA
by kebba.foon＠qcell.gm 08 Feb '11

08 Feb '11

Dear List, our network administrator are having issues with smtp traffice (we are an ISP) most of our customer's IP are sending spam, this is giving a bad reputation on our IP's on the rbl's. they are suggesting that all smtp traffic from our customers be forwarded to our mail server and the the server will check for malform mails, scan the mails and then further forward them to their destination. my question is: 1. those exim4u scan outgoing mails 2. is it a good idea to go about this setup? 3. is there any other best solutions. Thanks Kebba

2 1