Anyone know of a way to setup per-user (per email address)
message size restrictions or attachment blocking in qmail-scanner? One of the
problems we have encountered is in setting a system-wide variable to block
attachments/enforce message size restrictions when a handful of users depend on
We have a client that wants to be able to Quarantine specified
attachments, but then wants to be able to view them, and either deliver
to intended recipient, or delete.
Just wondering if anyone has implemented something similar?
Regards,
MB
--
Load on one of our qmail,vpopmail,qmail+scanner,clamd server is
averaging ~7 - Is it possible to run clamd on remote server?
Regards,
MB
---
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple i
Hey All,
Have a qmailserver with qmail-scanner currently being spammed by
several thousand emails a day on a 512/128 ADSL link. The link is
being saturated, which was fixed by lowering concurrencyincoming to
something ridiculously low.
My problem now is the load is something phenomenal, and I wou
that the attachment was blocked.
Michael Martinez
Unix
System Administrator
ISTM/CSREES/USDA
Room 4161
Washington, DC 2004
Phone:
(202) 720-6223
Email:
[EMAIL PROTECTED]
amav to be
owned by qscand also...
Alternatively I guess you could install qmail-scanner as user clamav and
then you wouldn't have all that mucking around
Hope this helps...
Michael Ralston
Stral.net
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf O
e...
Maybe I should downgrade clamav to see if it fixes the problems
Michael
-Original Message-
From: Dean Mumby [mailto:[EMAIL PROTECTED]
Sent: Thursday, 15 July 2004 5:22 PM
To: [EMAIL PROTECTED]
Cc: 'Terry Letsche'; [EMAIL PROTECTED]
Subject: Re: [Qmail-scanner-general]Permission
mdscan was:
/var/spool/qmailscan/tmp/ns1.stral.net10898558444802915: Can't access the
file ERROR
--
Thu, 15 Jul 2004 11:44:06 EST:2915: error_condition: X-Qmail-Scanner-1.22:
clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms
problem - exit status 2
Michael Ralston
Stral.
I presume there aren't any problems deleting *
from /var/spool/qmailscan/quarantine/new
drive starting to fill up, cant seen any reason why
i shouldn't be able to, unless there is a DB that i'd need to synch to after
deleting the files
thanks
michael
Title: Message
firstly thanks for the help :)
When you say put spam and worm in, do u mean into
the silent list?
Is there somewhere that has a current list of the
worm names, or is it just something that i have to manually build up over
time?
again thnx, greatly appreciated
Michael
hange did stop the virus warning
though, half-way there :) . can i just remove psender too, so it wont send the
bounce so then it cant bounce then i'd stop getting the error, could i just have
somehting like my $NOTIFY_ADDRS='';
thanks all
Michael
ing is the correct way to go about
it
thanks all, really appreciate any suggestions
michael
empty loop/timeout. Try changing
admin to a local user setup to dump the alerts to. Then set a cronjob to empty
the account once a day.
-Original Message-From: michael-list
[mailto:[EMAIL PROTECTED] Sent: Sunday, June 27, 2004 2:04
PMTo: [EMAIL PROTECTED]Subject
ils and no
scanner brought the system down?
any ideas ?
thanks all
michael
- Original Message -
From: Jason
Staudenmayer
To: [EMAIL PROTECTED]
Sent: Monday, June 28, 2004 1:55 AM
Subject: RE: [Qmail-scanner-general]reconfiguring
qmail-scanner
just
wait for a kicked ema
Title: Message
cheers mate :)
how can i test the config once i've changed the
qmail-scanner-queue.pl
thnx again
michael
- Original Message -
From:
Jason
Staudenmayer
To: [EMAIL PROTECTED]
Sent: Monday, June 28, 2004 12:38
AM
Subject: RE:
[Qmail-sc
ns will be greatly appreciated
:)
thanks all
michael
iated,
michael
---
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportu
That would handle per domain... But not per account filtering...
I've found qmvc but it doesn't seem to support spamassassin, only clamav (or
commercial virus scanners)
Michael
-Original Message-
From: McKeever Chris [mailto:[EMAIL PROTECTED]
Sent: Wednesday, 2 June 2004
I am using qmail-scanner quite successfully on my server, but I'd like to
only check email on certain accounts or domains, not system wide. Is
qmail-scanner able to do this or is there any other software that would be
better suited?
Mi
I was just wondering if it was possible to run qmail-scanner with the
persistant perl binaries (#!/usr/bin/speedy instead of #!/usr/bin/perl)
Would this have any effect on performance?
Michael Ralston
Stral.net
---
This SF.Net email is
,
Michael Martinez
[EMAIL PROTECTED]
N¬HS^µéX¬²š'²ŠÞu¼Ž§%{] ë\z»b~'¢{az-µë-¶§ëÞÚ!ŠÛazf«‘ëN§%{]
M© js«iÉ^×H •«,žŒÜ –X"½ìØ^{¦†Ûiÿö Ê&ý§b
>
> >
> > Mar 17 12:03:51 server2 X-Qmail-Scanner-1.20rc1:
> > [server2.example.com107954543145531004] Requeuing: Maximum time
> > exceeded.
>
> I have seen this - It was due (In my case) to a large zip
> file containg a compressed tif (~120M)
>
> I needed to reduce the maximum message size c
>
> Mar 17 12:03:51 server2 X-Qmail-Scanner-1.20rc1:
> [server2.example.com107954543145531004] Requeuing: Maximum
> time exceeded.
I have seen this - It was due (In my case) to a large zip file containg
a compressed tif (~120M)
I needed to reduce the maximum message size clamav would scan:
--m
>
> >Sould I be looking at qmail-scanner, clamav or qss to either
> modify the
> >time/date format, or make allowances for this change?
> >
> >
> >
> Matt Simerson has altered the date-interpretation in QSS to
> work with the old AND the new dateformat at the same time.
>
> http://www.tnpi.b
>
>
> I am using qmail-scanner 1.21, clamav 0.67 with qss 2.0.2 and
> it is working fine. Are you using an older version of qss?
Update to 2.02 - But still no stats.
I don't appear to be getting any php errors, and my configured log file
def. has entries:
$config["logFile"] = "/var/spool/qmai
> I am using qmail-scanner 1.21, clamav 0.67 with qss 2.0.2 and
> it is working fine. Are you using an older version of qss?
QSS 2.0.1 - Will upgrade now.
Ta,
MB
>
> Jim
>
>
>
---
This SF.Net email is sponsored by: IBM Linux Tutorials
Seems since upgrading from qmail-scanner 1.16->1.20 (And clamav
.60->67-1) the time/date format has changed(Consequently breaking qss):
19/02/2004 12:47:10 [EMAIL PROTECTED]
[EMAIL PROTECTED]hello PIF files not allowed per
Company security p
olicy clamscan: 0.60.
Thu, 19 Feb 2004 12:5
Works great on 1.16 btw. Thanks -- this has been a nightmare
-Original Message-
From: Jason Staudenmayer [mailto:[EMAIL PROTECTED]
Sent: Wednesday, March 03, 2004 2:07 PM
To: [EMAIL PROTECTED]
Subject: RE: [Qmail-scanner-general]Bagle-h and password protected ZIP fil
es
Still no luck
> (from 'man clamscan')
>--max-space=#n
>Extract first #n kilobytes from each archive. You
> may give the
>number in megabytes in format xM or xm, where x is a number.
Thanks!
BTW - The default of 100 kilobytes seems a little high?
Regards,
MB
-
Today I noticed our gateway mailserver running particularly slow -
Investigating further revealed it had a load of 100+!
The culprit was clamscan: One of our clients had sent 500+ e-mails with
a 5Mb zip attachment, with each zip containing a compressed tif image
that was 50Mb+.
Is there anyway to
: Michael Menefee [mailto:[EMAIL PROTECTED]
Sent: Wednesday, February 11, 2004 7:50 PM
To: '[EMAIL PROTECTED]'; [EMAIL PROTECTED]
Subject: RE: [Qmail-scanner-general]Mydoom/Worm.SCO
latest stable is 0.65, I thought. I will research the issue, but what does
clamav have to do with the bou
ailto:[EMAIL PROTECTED]
Sent: Wednesday, February 11, 2004 6:25 PM
To: [EMAIL PROTECTED]
Subject: Re: [Qmail-scanner-general]Mydoom/Worm.SCO
On Wed, 2004-02-11 at 16:03, Michael Menefee wrote:
>
> I can see that qmail-scanner and clamav are quarantining the
> mydoom/Worm.SCO.A, however
I have the following configuration:
redhat 7.3/qmail/qmail-scanner-1.16/clamav 0.65. This box is setup as an
SMTP gateway that then forwards all clean messages to my internal Exchange
Server
I can see that qmail-scanner and clamav are quarantining the
mydoom/Worm.SCO.A, however the A/V on my exch
I have looked into isoqlog and used it for a while, but I quarantine about
100,000 messages per day and isoqlog can't keep up even if I run it every
minute (which I dont ;-)
-Original Message-
From: Mandy [mailto:[EMAIL PROTECTED]
Sent: Sunday, February 01, 2004 2:04 PM
To: Mi
:[EMAIL PROTECTED]
Sent: Sunday, February 01, 2004 12:27 PM
To: [EMAIL PROTECTED]
Subject: Re: [Qmail-scanner-general]Reporting on all messages processed
for virus logs i use the quarantie.log file and parse it ones a day and
write the output the a mysql-tables,
Michael Menefee wrote:
>This
This may be the wrong group for this question, but may be useful, so I'll
post it. I am using a hacked up version of qmail-scanner (v 1.16) which logs
information to a MySQL database, rather than just the log file. This works
great cause I can run all sorts of queries and give my customers tons of
Read the archives, and see it is possible to enable --archive, but this
seems a little excessive when I only need to have a copy of one users
outgoing mail.
Regards,
MB
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference o
This may be a dumb question, but I haven't seen any discussion on this
before
is there a way (or has anyone written anything) that qmail-scanner can log
to a MySQL database, for excample, rather than to quarantine.log? The
problem is that reporting by parsing a log file when my particular ser
Good
morning all. I’ve just started using SA and clamscan to scan
mailboxes on a per-user config basis. My QSS is scanning incoming and
outgoing messages. I’d like it to NOT scan outgoing messages for
SA, but clamav is fine. I cant seem to get it to. I was convinced
it had someth
I am running the patched qmail-scanner-1.16 which quarantines SPAM messages.
I want to use the "silent" option to NOT receive notifications about SPAM
that is caught. Is this possible, and if so--what is the proper switch
Thanks
--
Michael Menefee, CISSP
Senior Security Cons
: [Qmail-scanner-general]Quarantine Question
Hi.
How did your configure SA to delete the messages ?
The only way i know is to mark them ..
Really cool will be a way to move them in a seperate Mailfolder.
regards Mandy
Michael Menefee wrote:
>All:
>Wondering if there's a way to m
hanks
--
Michael Menefee, CISSP
Senior Security Consultant
U.S. Networks, Inc.
(919) 256-1694
[EMAIL PROTECTED]
---
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl
Is there a way to add the specified receiver to this part of qmail-scanner:
my $NOTIFY_ADDRS='sender,admin';
I want the receiver to realize that we are protecting them.
Thank you.
Michael
---
This SF.Net email sponsored by
king. When
I send a message there is not qmail-scanner header in it, it just comes
through as normal.
Any thoughts or help would be greatly appreciated.
Thank you.
Michael
---
This SF.Net email sponsored by: Parasoft
Error proof Web apps, aut
errors refered to by
perl above...
[/qmail-scanner install error]
My System: FreeBSD 4.7, Perl 5.8
Any help would be appriciated :)
Thanks in advance
Michael Andreasen
---
This SF.net email is sponsored by:
The Definitive I
errors refered to by
perl above...
[/qmail-scanner install error]
My System: FreeBSD 4.7, Perl 5.8
Any help would be appriciated :)
Thanks in advance
Michael Andreasen
---
This SF.net email is sponsored by:
The Definitive I
> >> which of course deleted all messages in the archives
> maildir that
> >> were older than 36 hours.
Which is the reason why a competent sysadmin will do a "tar -czvf
/home/backups/var.spool.qmailscan..tgz /var/spool/qmailscan" prior to
upgrading software, changing software, reinstalling so
here
could help. The patch appears below. It's a unified diff. You can either
"cut and paste" from below, or email me for a gzip file that contains the
patch.
Please keep in mind this patch is for qmail-scanner-1.16.
I'd really appreciate some help getting this to work.
Mic
no listing.
I thought maybe there was a limit on the number of files I could have in a
folder (Linux, ext2 filesystem), so I initiated a cron job that tars up the
emails and moves them to a backup, every few days. But ... This did not fix
the issue.
Anybody got any ideas what's goin
Do you see any problems adding support for spambayes? Would you like me to
help you do it?
Michael Martinez
CSREES/ISTM/USDA
> -Original Message-
> From: Jason Haar [mailto:[EMAIL PROTECTED]
> Sent: Thursday, March 06, 2003 12:48 PM
> To: [EMAIL PROTECTED]
> Subj
Does qmail-scanner have spambayes support?
Michael Martinez
CSREES/ISTM/USDA
---
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger
for complex code. Debugging C/C++ programs can leave you feeling lost and
Hi There
I have a
qmail+qmail-scanner+spamassassin
I start spamd with
# spamd -F
0
I have created user_prefs at /home/vpopmail/domains/domain.com/postmaster/.spamassassin/user_prefs
But whenever a mail passes through i got this error
msg:
read_scoreonly_config: cannot open
"/var
mail
with no body, no "from" or "to" populated ( in Outlook). A portion of the
body text (like, the first line only) shows up in the internet headers.
What's the problem here? I thought the sequence as described above was t
In reference to using rblsmtpd and the other spam prevention tools listed
below, I was wondering whether these programs give one the option of
specifying a system or configuration file, rather than a computer server, as
the means by which the list of known spam relays is obtained.
Michael
, could someone provide a brief
explanation of how one of these other methods differs, and why something like spamassassin would be better?
Thanks,
Michael Martinez
gt; /var/qmail/bin/qmail-scanner-queue.pl line 1016.
I had this same problem a while back
The fix is to alter the permissions on the vscan file
Refer to
http://sourceforge.net/mailarchive/message.php?msg_id=1901493
and
http://sourceforge.net/mailarchive/me
Hello,
I posted this problem a few days ago.
if I start qmail (vers. 1.03) qmail-scanner reports the following in the log
file:
18/12/2002 10:54:23:824: w_c: start dumping incoming msg into
/var/spool/qmailscan/working/tmp/qmail1040205263424824 [1040205263.84594]
18/12/2002 10:54:23:824: w_c:
oks fine to me, mirroring (almost) exactly what is
running on our live q-s systems:
init-+
...
|-tcpserver-+-7*[qmail-smtpd---perl5.00503]
| |-qmail-smtpd
| |-qmail-smtpd---perl5.00503---sh---spamc
...
Are you reading this in a non-monospaced font?
--
Joel Michae
Am Mittwoch, 11. Dezember 2002 14:10 schrieb Doug Monroe:
> Michael Grahlert wrote:
> > Hi,
> >
> > I installed qmail 1.03, works fine. But qmail-scanner reports the message
> > X-Qmail-Scanner 1.12 cannot dub fd 0 invalid argument.
>
> sounds like you are usin
Grüßen aus Hockenheim
Michael Grahlert
*
Schöllkopf Netzwerktechnik e. K.
Service Center
Kollmerstr 3
D-68766 Hockenheim
e. If
there's any way I can help with q-s v2, please tell me (and the rest of
the mailing list!)
--
Joel Michael| Phone: +61 7 3367 3555
Systems Administrator | Fax: +61 7 3367 3544
WorldHosting.org Pty. Ltd. | Mobile: +61 408 336 728
htt
Is it safe to say that the rest of q-a.txt (v1.15) is okay?
Michael Martinez
System Administrator
Information Systems and Technology Management
CSREES - United States Department of Agriculture
(202) 720-6223
> -Original Message-
> From: Jason Haar [mailto:Jason.Haar@;trimble
hbedv
with qmail-scanner.
Looking forward to upgrading,
Michael Martinez
System Administrator
---
This sf.net email is sponsored by: Influence the future
of Java(TM) technology. Join the Java Community
Process(SM) (JCP(SM)) program now.
h
Or stick the entire friendgreeting.com net range in tcp.stmp if you use
tcpserver (use www.hexillion.com/utilities to look up the netrange).
Or look through the internet headers for e-card email (if you have have
received it already), and block the ip it came from
Michael Martinez
oulsy I've "eyeballed" a drop in the number being quarantined
through qmail-scanner.
Michael Martinez
> -Original Message-
> From: Darley Ware [mailto:[EMAIL PROTECTED]]
> Sent: Friday, October 11, 2002 12:39 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Qmail-sc
I concur, I've seen this too.
Michael Martinez
> -Original Message-
> From: Volker Schaefer [mailto:vs@;neopoly.de]
> Sent: Friday, October 11, 2002 5:53 AM
> To: [EMAIL PROTECTED]
> Subject: [Qmail-scanner-general]HBEDV antivir version 6.16
>
>
> Hello
. Perhaps
incorporate a makefile option to where a choice is given to disable/enable
the feature?
Michael Martinez
> -Original Message-
> From: Jason Haar [mailto:[EMAIL PROTECTED]]
> Sent: Monday, September 30, 2002 1:06 AM
> To: [EMAIL PROTECTED]
> Subject: Re: [Qmail-scanne
Is it possible to inject the contents of /var/spool/qmailscan/archives/new
back into the qmail queue, and if so, how would this be done?
Michael Martinez
System Administrator
---
This SF.NET email is sponsored by: AMD - Your access to the
ginal problem - the local-relay stuff.
I'll probably test it next week and post my results to the list at that
time.
Michael Martinez
System Administrator
Information Systems and Technology Management
CSREES - United States Department of Agriculture
(202) 720-6223
-
it on the list What does the contents of your
qmail-scanner-queue-version.txt file look like?"
but I haven't had time yet to look into this.
Michael Martinez
System Administrator (Contractor)
Information Systems and Technology Management
CSREES - United States Department of A
entry in the smtproutes. It does not
occur with locally delivered mail, or with mail that is forwarded to the
other entries in "smtproutes" which contain forwarding rules for those
domains listed in my "/var/qmail/control/rcpthosts" and "locals."
i hope I've been
5.5) I
get an error because of this CR. If I delete the CR manually from the mail
file on the server I can retrieve the mails without any problems.
I searched the internet for any solutions but found nothing helpful. Any
ideas? Thanks in advance.
Michael
[snip]
MIME-Version: 1.0
Content-type:
delete the hundreds of
copies of Klez, Magistr, and all the other email-generating viruses that
get put there every day. I figured it may be useful to others that run
qmail-scanner on reasonably high-volume servers :-)
Anyway, thanks for the great software, keep up the excellent wo
I think you are right. After reading a bit more about Razor details, it
seems that it is using "echo" port (7/TCP) as a sort of a "ping" for server
discovery process.
-Michael
>
>
> I use Q-S and SA and neither use port 7. But I do not use Razor. Perhaps
>
noid
when unexpected connections pop up.
There are also connections to other ports on those IP's - like 2702. Anyone
knows complete list?
Thanks
-Michael Lasevich
___
Don't miss the 2002 Sprint PCS Application Developer&#x
gt; tar: Error exit delayed from previous errors
>
> Is the file uploaded corrupted?
>
Make sure that your browser didn't automagically decompress the file for
you. Try tar without the z option.
--
Joel Michael| Phone: +61 7 3367 3555
Systems Administr
and replace it with just the stats on what the attachment was
(filename, size, etc.) This way my script can copy the messages into my
real mailbox and I can view them without worrying about viruses.
Just an idea. What do you think?
-Michael
- Original Message -
From: "Jason Haar&quo
figure people here have dealt with this before
and may have some good ideas?
Thank in advance.
-Michael
Awesome. Thank you.
I've created the dirs before, but not as
maildirs
running:
maildirmake working
maildirmake quarantine
fixed it :-)
Thank you.
-Michael
- Original Message -
From:
CertaintyTech - Ed Henderson
To: Michael Lasevich ; [EMAIL PROT
ar/spool/qmailscan/working/tmp/mailman.private.com10203717924084185 - No such
file or
directory------
-Michael Lasevich
true for the Magistr virus, but what about the viruses like
BadTrans and Klez (I think) that mangle ADDRESS-A, but keep ADDRESS-C
correct?
If this problem is "fixed", then it's broken for different viruses.
Damned if you do, damned if you don't :-)
--
Joel Michael
81 matches
Mail list logo
