[Clamav-users] Clamav on Linux Gateway to Exchange - Clamav locking up sendmail
Hi All, I have had a problem occur twice on a Linux (Cobalt RaQ3) gateway for a MS Exchange Server (Our internal Mail server) and wondered if anyone has experienced something similar. Firstly the details: Clamav-0.70-rc1 with clamav-milter from that package. Sendmail 8.12.10 Spamassassin 2.55 with spamass-milter 0.1.3a Everything goes along fine for a few days and then stuff like this all of a sudden appears in the logs. Mar 24 16:09:24 pinot clamav-milter[8564]: No data received from clamd in 60 seconds Mar 24 16:09:48 pinot clamav-milter[8568]: No data received from clamd in 60 seconds Mar 24 16:10:24 pinot clamav-milter[8564]: No data received from clamd in 60 seconds Mar 24 16:10:24 pinot clamav-milter[8564]: Expected port information from clamd, got '' Mar 24 16:10:24 pinot sendmail[8561]: i2O58NRs008561: Milter: from=<[EMAIL PROTECTED]>, reject=451 4.7.1 Please try again later Mar 24 16:10:48 pinot sendmail[8565]: i2O58mRs008565: from=<[EMAIL PROTECTED]>, size=6252, class =0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=diaz.tusc.com.au [10.1.10.29] Mar 24 16:10:56 pinot clamav-milter[8640]: No data received from clamd in 60 seconds Mar 24 16:11:01 pinot clamav-milter[8650]: No data received from clamd in 60 seconds Mar 24 16:11:18 pinot clamav-milter[8821]: No data received from clamd in 60 seconds Mar 24 16:11:34 pinot clamav-milter[9527]: No data received from clamd in 60 seconds Mar 24 16:11:38 pinot clamav-milter[8616]: No data received from clamd in 60 seconds Mar 24 16:11:38 pinot clamav-milter[8616]: Expected port information from clamd, got '' Mar 24 16:11:38 pinot sendmail[8612]: i2O59YRs008612: Milter: from=<[EMAIL PROTECTED]>, reject=4 51 4.7.1 Please try again later All mail is rejected, incoming and outgoing from the Exchange server. Restarting clamd gets things going again as far as incoming is concerned. The Exchange SMTP Connector (don't ask me, you no Microsoft) has to be forced to reconnect and send the queued messages. Then things work fine again. This has only happened twice, but it is of concern. We used to have a problem with the Exchange Connector holding the Sendmail port open so nothing else could connect. Had to restart sendmail. Trying to figure out if a patch or something else fixed it. This appears to be a similar problem, only now it has frees up the sendmail port to accept more connections and spawn new sendmails, but the milter interface appears to tie up clamd. Any suggestions would be appreciated, except for the one to ditch Exchange. Not my choice, but I have to live with it. Regards TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 --- This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial presented by Daniel Robbins, President and CEO of GenToo technologies. Learn everything from fundamentals to system administration.http://ads.osdn.com/?ad_id70&alloc_id638&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] Correct clamav-milter options to --postmaster-only
-Original Message- From: Nigel Horne [mailto:[EMAIL PROTECTED] Sent: Tuesday, 2 March 2004 6:46 PM To: [EMAIL PROTECTED] Subject: Re: [Clamav-users] Correct clamav-milter options to --postmaster-only >>On Tuesday 02 Mar 2004 12:58 am, Stevens, John wrote: >> >Please post an example of the bounce message, then I can see where it's >> > coming from. >> From: MAILER-DAEMON >> To: [EMAIL PROTECTED] >> CC: [EMAIL PROTECTED] >> Subject: Virus intercepted >> A message you sent to [EMAIL PROTECTED] contained a virus and has not >> been delivered. stream: Worm.Bagle.E FOUND >John, >Unfortunately you've deleted the original message with all your options and >I've deleted your original posting so I can't remember what they were. Anyway, >this message is created by the -b (--bounce) option, so turn that off. >> John Stevens - MIS Manager, Senior Project Engineer >-- >Nigel Horne. Arranger, Composer, Typesetter. >NJH Music, Barnsley, UK. ICQ#20252325 >[EMAIL PROTECTED] http://www.bandsman.co.uk Hi Nigel, Options I am passing are -lob -postmaster-only [EMAIL PROTECTED] /path/to/socket. I do want the postmaster notifications as outlined in the man pages with the offending message ID. I do not want the bounce going back to "sender". I am aware I can stop the bounce by turning off the bounce option, but according to my reading of the man page, it must be on for the postmaster to get notifications. Hence I have left it on, but I am only CC'd in a bounce message, and that does not contain the message ID of the offending message. Thanks TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 --- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id56&alloc_id438&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] Correct clamav-milter options to --postmaster-only
>Please post an example of the bounce message, then I can see where it's coming from. >-Nigel Hi Nigel, From: MAILER-DAEMON To: [EMAIL PROTECTED] CC: [EMAIL PROTECTED] Subject: Virus intercepted A message you sent to [EMAIL PROTECTED] contained a virus and has not been delivered. stream: Worm.Bagle.E FOUND No Message ID included as detailed in the man page, and always CC. TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 --- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id56&alloc_id438&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
[Clamav-users] Correct clamav-milter options to --postmaster-only
Hi All, I have clamd and clamav-milter (0.67-1) on my two mail gateways, and am really happy with the performance and detection rates. Job well done to the devs. The only problem I have at the moment is getting alerted to a virus detection by clamav-milter WITHOUT bouncing the message back. I use clamav-milter with the -lobP options set and [EMAIL PROTECTED] But it still sends a bounce message out. From my understanding of the man page -b (--bounce) and -P (--postmaster-only) must both be set for a bounce message to be received by the postmaster mail address. Any pointers? What am I doing wrong? Regards TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 --- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id56&alloc_id438&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] make errors for clamav-milter
>clamav-milter.c:548: parse error before `tcpSocket' >clamav-milter.c:548: warning: data definition has no type or storage >class make: >*** [clamav-milter.o] Error 1 I have had this one before. Make sure that you have a copy of or a symbolic link to the sendmail libmilter headers. I did an ln -s /sendmailsrcdir/include/libmilter /usr/include/libmilter and that solved the problem for me. Hope this helps. BTW, clamav is working well for me. Thanks to the devs and those helpful people on the list. --- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id56&alloc_id438&op=click ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] Re: clamav-milter compilation problems again
Thanks again Carl. That did it. TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 -Original Message- From: redragon [mailto:[EMAIL PROTECTED] Sent: Tuesday, 10 February 2004 12:13 PM To: [EMAIL PROTECTED] Subject: Re: [Clamav-users] Re: clamav-milter compilation problems again Thats an easy one John, go into clamav-0.65/docs/man then cp clamav-milter.8 ../ then go back and configure, make and make install. Carl [EMAIL PROTECTED] - Original Message - From: "Stevens, John" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, February 09, 2004 5:07 PM Subject: RE: [Clamav-users] Re: clamav-milter compilation problems again > Hi Carl, > Thanks for the tip, it worked a treat for compilation of clamav-milter. Problem is I now have another error creating the man page for it, and as a consequence it can't install. > > make[1]: Entering directory `/home/local/src/clamav-0.65/clamav-milter' > make[1]: *** No rule to make target `../docs/clamav-milter.8', needed by `all-am'. Stop. > make[1]: Leaving directory `/home/local/src/clamav-0.65/clamav-milter' > make: *** [all-recursive] Error 1 > > If anyone has any ideas on how to correct this, much appreciated. Again, apologies for the disclaimer. > --- > > This message (and any associated files) is intended only for the > use of the individual or entity to which it is addressed and may > contain information that is confidential, subject to copyright or > constitutes a trade secret. If you are not the intended recipient > you are hereby notified that any dissemination, copying or > distribution of this message, or files associated with this message, > is strictly prohibited. If you have received this message in error, > please notify us immediately by replying to the message and deleting > it from your computer. Messages sent to and from us may be monitored. > > Internet communications cannot be guaranteed to be secure or error-free > as information could be intercepted, corrupted, lost, destroyed, arrive > late or incomplete, or contain viruses. Therefore, we do not accept > responsibility for any errors or omissions that are present in this > message, or any attachment, that have arisen as a result of e-mail > transmission. If verification is required, please request a hard-copy > version. Any views or opinions presented are solely those of the author > and do not necessarily represent those of the company. > > TUSC Computer Systems, ABN 44 005 815 752 > ÿÓ.ä.ü×zf¢-+,¦?좷o!-*lx*'ÛM8>·¦? êÞ?ßz·§qê':-§NS%°7¯zZ)TéíjwHz× "b¢tzzØ^n·svØh|G%S>-iËb3/4+rüW>(r)æ"ËùSp'j¢>ð? þm§ÿÿà ÿyÉb¦Ço¢è(r)è±Ùÿÿÿð¥jf¯þë-(r)ÉsSX§,X¬´)ZT"ÿºÇ" ³ùb²Ûÿ²<"qçè(r) ÿëa¶ÚlÿÿåSËlþÊ.ÇY¢¸-þwþX¬¶ÏåSËbú?rV¦jÿî±êì > --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
RE: [Clamav-users] Re: clamav-milter compilation problems again
Hi Carl, Thanks for the tip, it worked a treat for compilation of clamav-milter. Problem is I now have another error creating the man page for it, and as a consequence it can't install. make[1]: Entering directory `/home/local/src/clamav-0.65/clamav-milter' make[1]: *** No rule to make target `../docs/clamav-milter.8', needed by `all-am'. Stop. make[1]: Leaving directory `/home/local/src/clamav-0.65/clamav-milter' make: *** [all-recursive] Error 1 If anyone has any ideas on how to correct this, much appreciated. Again, apologies for the disclaimer. --- This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company. TUSC Computer Systems, ABN 44 005 815 752 áy!Mzצj)b²ÊhÊ+yÖòÉb¦Ç¢}´Óëzhà¨÷«zw¢s©ztè¢[z÷¥¢Ö§tíz Ú¶*'Iç æëy§mÄrX©±æ¶+â·!^n»¯-ùp'j¢ !¶Úÿ0yÉb¦Ç¢z+ú,vp¥jf¯ºÇ«²f¢)à+- V¦jû¬z»%Ël²«qç讧zØm¶?þX¬¶Ë(º·~àzwþX¬¶ÏåËbú?rV¦jû¬z»
RE: [Clamav-users] clamav-milter compilation problems again
Ah lawyers.. You wouldn't believe how often that one is pointed out. On Wed, 2004-02-04 at 23:29, Stevens, John wrote: > and sorry for this stupid disclaimer. > We also have a stupid disclaimer, but one question about yours - can you have "omissions that are present"? --- This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company. TUSC Computer Systems, ABN 44 005 815 752 N×zf¢+,¦ì¢·o!*lx*'ÛM8>·¦êÞ ßz·§qê':§N%°7¯zZ)éíjwH× «b¢tzØ^n·vØh|G%iËb¾+ræ빪òߧv¡z)m§ÿðÃ*lyÊ'¢¸?¢Çg V¦jû¬z»&j)b b²Ð¥jf¯ºÇ«²X¬¶Ë(º·~àzwÛi³ÿåËl²«qç讧zßåËlþX¬¶)ߣ÷%jf¯ºÇ«
RE: [Clamav-users] clamav-milter compilation problems again
Hi Nigel, Yes the disclaimer is crap. I have been arguing against it to the MD for a year to no avail. We have even sometimes put really weird stuff in it just to find out if people read it, and it has never given a response. I'd tell the MD, but he would get pissed off at me and sick the lawyer on me for an ear bashing. I usually apologise for I, but was in a rush on the day. Anyhoo, I cannot find a reference to in_port_t in any of the many in.h files on my system. Remember, it is a Cobalt (Sun) RAQ3 box, pretty close to redhat linux. So if there is a package or glibc update that I should have, please point it out. I can then try and find it and install it. From memory this has been a problem with one other piece of software I tried to compile once. Thanks, keep up the great work, and sorry for this stupid disclaimer. TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 -Original Message- From: Nigel Horne [mailto:[EMAIL PROTECTED] Sent: Wednesday, 4 February 2004 4:01 AM To: [EMAIL PROTECTED] Subject: Re: [Clamav-users] clamav-milter compilation problems again On Tuesday 03 Feb 2004 3:32 am, Stevens, John wrote: > clamav-milter.c:572: `in_port_t' undeclared (first use in this function) > clamav-milter.c:572: (Each undeclared identifier is reported only once > clamav-milter.c:572: for each function it appears in.) Your system is missing /usr/include/netinet/in.h, or that file is missing the definition of in_port_t. > Messages sent to and from us may be monitored. Hmm. If they only "may" be monitored, what's the pointing in sending you a message? What if no-one's monitoring this message. > If verification is required, please request a hard-copy > version. Please send me a hard-copy version. > Any views or opinions presented are solely those of the author > and do not necessarily represent those of the company. Well d'uh. -Nigel -- Nigel Horne. Arranger, Composer, Typesetter. NJH Music, Barnsley, UK. ICQ#20252325 [EMAIL PROTECTED] http://www.bandsman.co.uk --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn ___ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users --- This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company. TUSC Computer Systems, ABN 44 005 815 752 N×zf¢+,¦ì¢·o!*lx*'ÛM8>·¦êÞ ßz·§qê':§N%°7¯zZ)éíjwH× «b¢tzØ^n·vØh|G%iËb¾+ræ빪òߧv¡z)m§ÿðÃ*lyÊ'¢¸?¢Çg V¦jû¬z»&j)b b²Ð¥jf¯ºÇ«²X¬¶Ë(º·~àzwÛi³ÿåËl²«qç讧zßåËlþX¬¶)ߣ÷%jf¯ºÇ«
[Clamav-users] clamav-milter compilation problems again
Hi All, Sorry, but it seems my last mail was munged, at least the one I got in my digest was unreadable. I am trying to build clamav on a cobalt RAQ3 with sendmail 8.12.10. Everything works fine except for the clamav-milter compilation. If I don't -enable-milter compilation is fine and clamd etc all run OK. If I -enable-milter, I get the following errors: clamav-milter.c:322: parse error before `tcpSocket' clamav-milter.c:322: warning: data definition has no type or storage class clamav-milter.c: In function `main': clamav-milter.c:572: `in_port_t' undeclared (first use in this function) clamav-milter.c:572: (Each undeclared identifier is reported only once clamav-milter.c:572: for each function it appears in.) clamav-milter.c:572: parse error before `cpt' make[1]: *** [clamav-milter.o] Error 1 make[1]: Leaving directory `/home/local/src/clamav-0.65/clamav-milter' make: *** [all-recursive] Error 1 I have two other milters that compile and work fine. Any ideas or pointers would be appreciated. TIA --- This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company. TUSC Computer Systems, ABN 44 005 815 752 áy!Mzצj)b²ÊhÊ+yÖòÉb¦Ç¢}´Óëzhà¨÷«zw¢s©ztè¢[z÷¥¢Ö§tíz Ú¶*'Iç æëy§mÄrX©±æ¶+â·!^n»¯-ùp'j¢ !¶Úÿ0yÉb¦Ç¢z+ú,vp¥jf¯ºÇ«²f¢)à+- V¦jû¬z»%Ël²«qç讧zØm¶?þX¬¶Ë(º·~àzwþX¬¶ÏåËbú?rV¦jû¬z»
[Clamav-users] Problems compiling clamav-milter on cobalt RAQ3
Hello all, I am trying to get clamav compiled on a cobalt RAQ3. Everything works except the compile of clamav-milter. It throws up the following errors: clamav-milter.c:322: parse error before `tcpSocket' clamav-milter.c:322: warning: data definition has no type or storage class clamav-milter.c: In function `main': clamav-milter.c:572: `in_port_t' undeclared (first use in this function) clamav-milter.c:572: (Each undeclared identifier is reported only once clamav-milter.c:572: for each function it appears in.) clamav-milter.c:572: parse error before `cpt' make[1]: *** [clamav-milter.o] Error 1 I have installed sendmail 8.12.10 and have two other milters working fine. Any help or pointers appreciated. TIA TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 --- This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company. TUSC Computer Systems, ABN 44 005 815 752 ä 5ë^¨¥Ë)¢{(ç[ÈG% öÓNé¢z·¢wÞéÜzÎ¥éÓ¢l ëÞfz{ZÒ'µè+jب'¶æ¶Éb¦ÇrØ¯Ü yºîj¼·æ)À¨^`Ûiÿü0Áç%rè®è±Ù©¾ë®ÉX§X¬´)Z«î±êì+-²Ê.Ç¢¸ëa¶Úlÿùb²Û,¢êÜyú+éÞ·ùb²Û?+-wèýÉZ«î±êì