[Qmail-scanner-general]getservbyname failed

2003-09-22 Thread taltos-qs
I am running qmail-scanner 1.03 with clamav 20030829 and spamassassin 2.60 on Solaris 8. I have been getting several errors in /var/log/qmail/smtpd/current, to the effect of: getservbyname failed at /dev/fd/3 line 469. Every time this failed, qmail-scanner would see it as a failure, leave th

[Qmail-scanner-general]SUID Perl Issue

2003-09-22 Thread Brandon Mercer
Ok, so everybody on this list is going to be faced with the suid perl issue when they upgrade to perl 5.8.0. What is qmail-scanner going to do to fix this because obviously right now it's not going to work without some fixes. Is this something that's going to be addressed with the next RC? Ho

[Qmail-scanner-general]Re: Qmail-scanner-general digest, Vol 1 #883 - 14 msgs

2003-09-22 Thread Qmail-Scanner List
snip... > You edited the perl script by hand didn't you... > > > > If you had done it by the ./configure script, you would have figured out > > what you have done wrong :-) Just because the documentation says to Well .. with Gentoo it was emerged .. what i need to know now is how to list multipl

Re: [Qmail-scanner-general]patch: vpopmail local domain detection (for recipient notify)

2003-09-22 Thread John Johnson
I like this. I hope it get's added to qmail-scanner -John - Original Message - From: "Davide Giunchi" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: "Juergen Kendzorra" <[EMAIL PROTECTED]> Sent: Monday, September 22, 2003 1:20 PM Subject: [Qmail-scanner-general]patch: vpopmail local do

Re: [Qmail-scanner-general]Qmail, vpopmail, courier-imapd, qmail-pop3d and squirrelmail, qmail-scanner, procmail and spamassassin

2003-09-22 Thread Mark
Sorry about that. The .qmail file goes into the user dir. In my case: moya:/opt/vpopmail/domains/xyxyxyx.com/mark# ls -als total 16 4 drwx--3 vpopmail vchkpw 4096 Jul 8 14:46 . 4 drwx--8 vpopmail vchkpw 4096 Jul 29 20:47 .. 4 -rw---1 vpopmail vchkpw

Re: [Qmail-scanner-general]Clamav + qmailscanner + blocking ms worm?

2003-09-22 Thread Josh Trutwin
On Mon, 22 Sep 2003 18:18:21 -0400 "Dan Didier" <[EMAIL PROTECTED]> wrote: > Do you update your AV dat files? I have a cron job that runs freshclam every night. I'm runing 1.1.16 until the .20 goes out of rc. Soon I hope? Spamassassin is almost out of rc too, I've been waiting to do them bot

Re: [Qmail-scanner-general]Qmail, vpopmail, courier-imapd, qmail-pop3d and squirrelmail, qmail-scanner, procmail and spamassassin

2003-09-22 Thread Mark
I use maildrop to put messages into the right places. I suppose you could call procmail the same way. The following will put any message marked as spam into a Spam folder creatin git if needed. Hope this helps. Mark In the user vpopmail dir put the following into a .qmail file. |/var/qmail/

RE: [Qmail-scanner-general]Clamav + qmailscanner + blocking ms worm?

2003-09-22 Thread Dan Didier
Do you update your AV dat files? Here is a copy of my latest virus warning: notice that clamav found the virus. Dan The original message is kept in: sandbox:/var/spool/qmailscan/quarantine where the System Anti-Virus Administrator can further diagnose it. The Email scanner reported the

Re: [Qmail-scanner-general]Clamav + qmailscanner + blocking ms worm?

2003-09-22 Thread Mark
ClamAV is catching just fine here with qmail-scanner 1.20rc3. Are you updating your virus signitures? Mark Quoting Josh Trutwin <[EMAIL PROTECTED]>: > On 22 Sep 2003 13:53:15 -0400 > Matt <[EMAIL PROTECTED]> wrote: > > > Has anyone here figured out a way to prevent the newest worm from getting

[Qmail-scanner-general]Qmail, vpopmail, courier-imapd, qmail-pop3d and squirrelmail, qmail-scanner, procmail and spamassassin

2003-09-22 Thread Qmail-Scanner List
Hello list .. I tried the gentoo list with this problem, but no luck .. I have finally taken the shot at trying to get this working .. What is working? Qmail, vpopmail, courier-imapd, qmail-pop3d and squirrelmail, qmail-scanner, clamav(minor problems) this all works ... what I am trying to in

Re: [Qmail-scanner-general]Clamav + qmailscanner + blocking ms worm?

2003-09-22 Thread Josh Trutwin
On 22 Sep 2003 13:53:15 -0400 Matt <[EMAIL PROTECTED]> wrote: > Has anyone here figured out a way to prevent the newest worm from getting out on the > net? (That e-mail thing with the MS update) ClamAV doesn't seem to be catching it, so I added .exe to my list of quaranteened attachments. Josh

[Qmail-scanner-general]patch: vpopmail local domain detection (for recipient notify)

2003-09-22 Thread Davide Giunchi
I've done a little change to qs-1.20rc3 to make it works better with an hosting server if you use vpopmail: I want to notify the recip, so i must use the --local options, but i've 170.000 domains, so i cannot type all there, so i've modifyed qs to load the perl module vpopmail at the beginning,

Re: [Qmail-scanner-general]test_installation works real life fails

2003-09-22 Thread Brandon Mercer
On Monday 22 September 2003 14:39, Richard Geoffrion wrote: > Original Message > From: Brandon Mercer > To: [EMAIL PROTECTED] > Sent: Monday, September 22, 2003 11:52 AM > Subject: [Qmail-scanner-general]test_installation works real life fails > > > Hello, > > I'm starting all over again.

Re: [Qmail-scanner-general]Silent viruses

2003-09-22 Thread Rick Romero
On Mon, 2003-09-22 at 13:08, Dave Sill wrote: > I'm using ClamAV, which reports KLEZ, et al, as Exploit.IFrame.Gen. So > I edited qmail-scanner-queue.pl and set: > > my > @silent_viruses_array=('iframe','klez','bugbear','hybris','yaha','braid','nimda','tanatos','sobig','winevar'); > > But Qmail-

Re: [Qmail-scanner-general]test_installation works real life fails

2003-09-22 Thread Richard Geoffrion
Original Message From: Brandon MercerTo: [EMAIL PROTECTED]Sent: Monday, September 22, 2003 11:52 AMSubject: [Qmail-scanner-general]test_installation works real life fails> Hello,> I'm starting all over again.  The machine setup is a slackware 9.0> box with a > fresh install of perl

Re: [Qmail-scanner-general]Clamav + qmailscanner + blocking ms worm?

2003-09-22 Thread John Johnson
http://securityresponse.symantec.com/avcenter/venc/data/pf/[EMAIL PROTECTED] Some info on it. -John - Original Message - From: "Matt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, September 22, 2003 10:53 AM Subject: [Qmail-scanner-general]Clamav + qmailscanner + blocking ms

[Qmail-scanner-general]Silent viruses

2003-09-22 Thread Dave Sill
I'm using ClamAV, which reports KLEZ, et al, as Exploit.IFrame.Gen. So I edited qmail-scanner-queue.pl and set: my @silent_viruses_array=('iframe','klez','bugbear','hybris','yaha','braid','nimda','tanatos','sobig','winevar'); But Qmail-Scanner is still sending reports to senders of Exploit.IFram

[Qmail-scanner-general]Clamav + qmailscanner + blocking ms worm?

2003-09-22 Thread Matt
Has anyone here figured out a way to prevent the newest worm from getting out on the net? (That e-mail thing with the MS update) ~ Matt --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf __

[Qmail-scanner-general]test_installation works real life fails

2003-09-22 Thread Brandon Mercer
Hello, I'm starting all over again. The machine setup is a slackware 9.0 box with a fresh install of perl from source using the default options. I'm evoking the qmail-scanner-queue.pl script through the C wrapper provided. My /etc/tcp.smtp: 192.168.0.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUE

[Qmail-scanner-general]virus notifications

2003-09-22 Thread Jesse Guardiani
Howdy list, Is there any way I can get qmail-scanner to only send me virus notifications via email if the headers of the quarantined virus contain a certain regular expression? For instance, I'd LOVE to be notified anytime my headers contain ".*ppp.*customer.wingnet.net.*". But I don't see much

[Qmail-scanner-general]perlscanner after antivirus?

2003-09-22 Thread Jesse Guardiani
Howdy list, I'm currently running qmail-scanner-1.20rc1 on my production mail server. I saw this thread back in August: http://news.gmane.org/onethread.php?group=gmane.mail.qmail.scanner&root=%3C20030824230334.GB25047%40trimble.co.nz%3E And I'm wondering if this change has already been made to q

RE: [Qmail-scanner-general]Multiple AV with qmail-scanner

2003-09-22 Thread Dan Didier
It is about half and half. Dan > -Original Message- > From: Jason Staudenmayer [mailto:[EMAIL PROTECTED] > Sent: Monday, September 22, 2003 9:59 AM > To: Dan Didier; [EMAIL PROTECTED] > Subject: RE: [Qmail-scanner-general]Multiple AV with qmail-scanner > > How's your clamav working? Doe

Re: [Qmail-scanner-general]invoking scanner

2003-09-22 Thread Oliver Lehmann
Brandon Mercer wrote: > ok, I ran the test_installation script and I checked the following logs: That won't display errors generated by an smtp-recieve as it doesn't use the smtp way ;) > X-Qmail-Scanner-1.16 email cannot open > /var/spool/qmailscan/qmail-scanner-queue-version.txt - did you > in

RE: [Qmail-scanner-general]Multiple AV with qmail-scanner

2003-09-22 Thread Jason Staudenmayer
How's your clamav working? Does it pick off the virii or does the perl-scan get the extension? Mine seems to only pick off a very few html based virii like the iframe but everything else get perl-scanned for the extension. -Original Message- From: Dan Didier [mailto:[EMAIL PROTECTED] Sent

Re: [Qmail-scanner-general]invoking scanner

2003-09-22 Thread Brandon Mercer
On Monday 22 September 2003 09:36, Oliver Lehmann wrote: > Brandon Mercer wrote: > > On Monday 22 September 2003 08:55, Oliver Lehmann wrote: > the test_installation.sh send the mails directly to qmail-inject. w/o > making an smtp connecting through the tcpserver thingie. So, is your > smtp-curren

[Qmail-scanner-general]Multiple AV with qmail-scanner

2003-09-22 Thread Dan Didier
Is it possible to use multiple AV scanners with qmail-scanner without causing problems? I am already using ClamAV and I would also like to use Inoculan. Thanks, Dan --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http:

Re: [Qmail-scanner-general]invoking scanner

2003-09-22 Thread Oliver Lehmann
Brandon Mercer wrote: > On Monday 22 September 2003 08:55, Oliver Lehmann wrote: > > > > Check your tcpserver smtpd-logfile for "Out of memory" messages. Do > > you adjusted your softlimit call? > yes, I've adjusted that I've made some progress since this post... > the test_installation.sh

Re: [Qmail-scanner-general]invoking scanner

2003-09-22 Thread Brandon Mercer
On Monday 22 September 2003 08:55, Oliver Lehmann wrote: > Hi, > > Brandon Mercer wrote: > > and local hosts there is nothing in the > > /var/spool/qmailscan/qmail-queue.log file. So my initial thought is > > that it's not being evoked... I really need help on this. Things worked > > GREAT before

Re: [Qmail-scanner-general]invoking scanner

2003-09-22 Thread Oliver Lehmann
Hi, Brandon Mercer wrote: > and local hosts there is nothing in the > /var/spool/qmailscan/qmail-queue.log file. So my initial thought is > that it's not being evoked... I really need help on this. Things worked > GREAT before. Any ideas? Thanks in advance, > Brandon Check your tcpserver sm

[Qmail-scanner-general]invoking scanner

2003-09-22 Thread Brandon Mercer
Hello, I've been using qmail-scanner for about a year now and I have run into some problems running it on my current setup. I'm running slackware linux 9.0 with a custom kernel. I have SpamAssassin and Sophos antivirus on my servers that qmail-scanner-1.20rc3 detected both of. When I install