Re: Amavisd listening on multiple UDP ports

2024-09-19 Thread Damian
 COMMAND PID  USER  FD  TYPE   DEVICE   SIZE/OFF    NODE NAME  perl  79714 vscan 10u IPv4 0xf80164e96b40  0 UDP $amavis.ip:59511->$nameserver.ip:53  perl  79714 vscan 12u IPv4 0xf802071cb880  0 UDP *:47998->*:* Very interesting. In my tests, the secon

Re: Catchall mailbox *@domain.com and $sql_select_policy

2024-09-12 Thread Damian
We have encountered an issue while setting up a catchall mailbox for *@ domain.com, and I would greatly appreciate your assistance. [...] I think the query ends up replacing parameter %k by an address like specific-addre...@domain.com. Since this address is not explicitly defined in the table, no

Re: Configuring supported extensions

2024-09-02 Thread Damian
For example, say .rar isn't supported natively. I've seen tutorials suggest installing related packages, but don't see how Amavis picks up on that. From the amavsid.conf, I see a "@decoders" which seems like a map (extension, command, arguments). This appears to map to /lib/Amavis/Unpackers.pm.

Re: sender maps and whitelisting

2024-05-14 Thread Damian
However, I don't want spam checks for the bcc-user email to be bypassed. I also don't want the spam that would be quarantined for the regular sender to be delivered for the bcc-user either. In other words, I want the bcc-user to be treated exactly the same as mail for the intended recipient. Is t

Re: Unable to integrate amass-new and openDKIM

2024-05-01 Thread Damian
Help! I’m trying to use openDKIM with amavis-new. I have amavis up and running with spamassassin and clamAV. That part works great, but not so much with openDKIM. In what way do you suspect Amavis being involved in the problem? When you use OpenDKIM, the interaction happens between Postfix

Re: sender maps and whitelisting

2024-04-23 Thread Damian
Yes, that's correct - I've always used postfix always_bcc and didn't realize there was one for amavis as well. If you want to keep it that way, you could declare bcc-user a spam_lover: @spam_lovers_maps = ([

Re: sender maps and whitelisting

2024-04-23 Thread Damian
Here's a pastebin from an email similar to the above where one of the recips is whitelisted while the other is quarantined (using report_json). https://pastebin.com/8i6qwjvM The paste shows "rcpt_to": [ "bcc-u...@gambit.example.com", "hartm...@tenney.com" ], which is surprising, as I would exp

Re: sender maps and whitelisting

2024-04-23 Thread Damian
I was using the hash-type arrays. Would something like this work for the hash array to represent any sender at this domain? '.email.avi-8.com' => -100.0, Yes, but I was under the impression that you wanted to match VERP-style sender addresses, spec

Re: sender maps and whitelisting

2024-04-22 Thread Damian
I've just started using sender_maps instead of the welcomelist in spamassassin directly and have a few questions. Here is my current sender_map: Is this `@score_sender_maps`? '.gtenney.com' => [{ '.*@send.undone.com' => -100.0, '.*@mg-d0.substack.

Amavis::Custom survey

2024-04-03 Thread Damian
Hello amavis users, I would like to ask those of you who have an own Amavis::Custom implementation, how your code interacts with Amavis internals and what your code's assumptions are. There is currently no convention how much or little can be changed in Amavis::Custom context without breaking

Re: Use another table for user lookup

2024-04-03 Thread Damian
I have in my MariaDB database used table users for other needs. Is there any opiniion to use another table such as emails which has structure CREATE TABLE `emails` ( `id` int(5) NOT NULL auto_increment, `email` varchar(255) NOT NULL, `password` mediumtext NOT NULL, `user_id` int(5) NO

Re: Amavis doesn't get the right spam score values from policy table in MySQL

2024-03-28 Thread Damian
Is this temporary fix safe to use I have not seen feedback on Gitlab or amavis-users that it lead to problems. until a new version of perl-DBD-MySQL is released for RHEL9 (and AlmaLinux9 and others)? Unless some changed their mind, there won't be a fix in perl-DBD-MySQL. Instead you can try

Re: Amavis doesn't get the right spam score values from policy table in MySQL

2024-03-28 Thread Damian
Hi everybody, I kindly ask for assistance. Amavis doesn't get the right spam score values from policy table in MySQL. When columns (spam_tag2_level, spam_tag3_level, spam_kill_level) are unmodified and are NULL, the default values are from Amavis config file. But when we modify the row, the ret

amavis releases 2.12.3 and 2.13.1

2024-03-14 Thread Damian
Hello amavis users, today we have new releases in the 2.12 and 2.13 stable branches. They address a security issue, identified as CVE-2024-28054. See [1] or [2]. [1] https://gitlab.com/amavis/amavis/-/raw/v2.12.3/RELEASE_NOTES [2] https://gitlab.com/amavis/amavis/-/raw/v2.13.1/RELEASE_NOTES

Re: Cron Job errors after installing Debian 11

2024-02-12 Thread Damian
I'm guessing it has something to do with the interaction of Spamassassin and Amavis? Unsure if anything is 'broken' but everything else seems to be working as expected. Cron test -e /usr/sbin/amavisd-new-cronjob && /usr/sbin/amavisd-new-cronjob sa-sync Number found where operator expected a

Re: Adjusting spam reject message

2024-02-09 Thread Damian
when amavis rejects a message above spam kill level the reject message looks like that: 554 5.7.0 Reject, id=27417-12 - spam (in reply to end of DATA command) How is it possible to change the simple "spam" to something more sophisticated ;-) like "rejected for policy reasons" or "local pol

Re: Per user spamassassin bayes_path

2024-01-10 Thread Damian
A harder way would also be highly appreciated 🙂 I'd go some lengths for avoiding a postgres/mariadb instance. I suppose just whitelisting the "bayes_path" property in the user-settings would impose a trove of new problems? I don't know what you mean by whitelisting the property. The reason fo

Re: Per user spamassassin bayes_path

2024-01-10 Thread Damian
Is there absolutely no way to read bayes tokens from user's home dirs using the default berkdb files (even if it's slow)? How would you manage file access to user's home dirs? Amavis (and therefore Spamassassin) does not scan with root privileges. Did anyone manage to do this? I don't see a si

Re: could not read from amavisd socket /var/amavis/amavisd.sock: No error: 0

2023-12-27 Thread Damian
Any idea where else to dig into? Sorry, not my area of expertise. If your build-machine builds with `-march=x86-64` it should be fine, I guess.

Re: could not read from amavisd socket /var/amavis/amavisd.sock: No error: 0

2023-12-26 Thread Damian
Dec 26 17:03:28 batman spamd[86118]: spamd: handled cleanup of child pid [5276] due to SIGCHLD: DIED, signal 4 (0004) spamd has been killed with signal 4 (illegal instruction). Do you have built perl for the wrong architecture? Mail::DKIM for example is used by both Amavis and SpamAssassin, an

Re: could not read from amavisd socket /var/amavis/amavisd.sock: No error: 0

2023-12-26 Thread Damian
amavisd-milter then does log this line: could not read from amavisd socket /var/amavis/amavisd.sock: No error: 0 The amavisd-milter code is: logqidmsg(mlfi, LOG_ERR, "could not read from amavisd socket %s: %s", amavisd_socket, strerror(errno)); logqidmsg(mlfi, LOG_DEBUG, "amavisd resp

Re: How to bypass a recipient domain?

2023-11-27 Thread Damian
i want to bypass amavis for a specific *recipient* domain (not sender!). I am not sure how to do that, because all i find is whitelisting a sender. Or should i do it better in amavisd.conf: @bypass_spam_checks_maps  = ( ['@example1.com', '@example2.com'], ); Do you want to bypass amavis comple

Re: Amavis and OpenDMARC

2023-11-15 Thread Damian
If there is anything hostile to mailing lists in DMARC specification, it's this. ... The mailing list has nothing to do with that. Seems contradictory to me. If you fo=1 on your domain: You will get bombed ... Those are the same `you`s, are they not? `you` get what `you` wished for. If

Re: Amavis and OpenDMARC

2023-11-15 Thread Damian
This in my understanding generates failure reports for any forwarded mail including any mail to lists that do not completely rewrite From: (including this one mailing list) - even if DKIM is preserved and valid, such mail won't generate aligned SPF   pass unless you have better explanation of

Re: Amavis and OpenDMARC

2023-11-13 Thread Damian
Looking at it, fo=0 should generate dmarc report for each individual mail forwarded, either through mailing list or via other ways. If there is anything hostile to mailing lists in DMARC specification, it's this. Why would someone pick a mailing list address as their ruf?

Re: Amavis and OpenDMARC

2023-11-12 Thread Damian
if policy uses fo=0  then yes, both SPF and DKIM must exist, and both must pass. if policy uses fo=1  then no, as a minimum /either/ SPF or DKIM must exist, and pass, so DMARC will work with only SPF or only DKIM, it will also work with both, which has the advantage that only one of these must p

Re: Amavis and OpenDMARC

2023-11-11 Thread Damian
So Amavis is setup as an smtpd_milter as well? No, Amavis is setup as a content_filter (content_filter = amavis:[127.0.0.1]:10021) You can't do that. OpenDMARC needs to see Authentication-Results for DKIM.

Re: Amavis and OpenDMARC

2023-11-11 Thread Damian
Also, since they allude to "some passing", I guess they did remember to set  enable_dkim_verification=1 ? "Some passing OpenDMARC" might mean that they pass SPF-based only.

Re: Amavis and OpenDMARC

2023-11-10 Thread Damian
OpenDMARC is setup as a smtpd_milter in Postfix. So Amavis is setup as an smtpd_milter as well? Can someone maybe shed some light on why this would be happening or is there a different way to handle DMARC? Do you see DKIM-related Authentication-Results headers in incoming mails?

Re: How to block forged senders (planning tactics)

2023-11-10 Thread Damian
... then I would like to quarantine this mail as spam. ... There are two standard ways to categorize mail as spam: - via a spam_scanner as part of @spam_scanners (usually SpamAssassin) - via an av_scanner as part of @av_scanners and @virus_name_to_spam_score_maps. Other non-standard ways i

Re: Clarification about qurantine vs. D_DISCARD

2023-10-07 Thread Damian
I am reading amavis documentation and would like some clarification about the way amavis is handeling the a message score by SpamAssassin. With a configuration like: $sa_tag_level_deflt = 2.0; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 5.0; # add 'spam detected'

Re: Amavis on Alma Linux 8 with Quarantined issue.

2023-09-25 Thread Damian
ALTER TABLE policy MODIFY spam_tag_level varchar(10) NULL; ALTER TABLE policy MODIFY spam_tag2_level varchar(10) NULL; ALTER TABLE policy MODIFY spam_kill_level varchar(10) NULL; ALTER TABLE policy MODIFY spam_dsn_cutoff_level varchar(10) NULL; ALTER TABLE policy MODIFY spam_quarantine_cutoff_leve

Re: Amavis on Alma Linux 8 with Quarantined issue.

2023-09-25 Thread Damian
Could you please come up with your ideas? Not sure, but it sounds like another case of [1]. The quickest workaround would be to use `DBI::MariaDB` instead of `DBI::mysql` in @lookup_sql_dsn. However it seems that perl-DBD-MariaDB is not shipped with AlmaLinux 8. You could try [2] instead. [

Re: Feature request about sa_debug

2023-06-27 Thread Damian
That's not how it works. I can assure you my logs have "SA dbg:” lines only for messages which recipient address matches the @debug_recipient_maps. It triggers a DEBUG_ONESHOT event in Amavisd-new, and when the message is fully processed in spamassassin, Amavisd-new turns of DEBUG_ONESHOT:

Re: Feature request about sa_debug

2023-06-27 Thread Damian
you can tune Amavisd-new to activate conditional debug inside SA depending on recipients address (that’s what I’m doing) "$sa_debug = 1" is a global setting. Your logs should be full of "SA dbg:" lines even for emails which do not match your @debug_recipient_maps.

Re: Feature request about sa_debug

2023-06-26 Thread Damian
It would be really nice to have a setting like sa_debug_sampling (or sa_debug_ratio, sa_debug_sample, etc.) taking an integer value (eg. 100) that would trigger debug logging for 1 email message every sa_debug_sampling messages (eg. 1 message every 100 messages). The sampling can be fuzzy, for

Re: Virus checking options

2023-04-26 Thread Damian
Fedora 38 ships Amavis 2.13.0 which switched to clamdscan in Amavis upstream. We have a winner...   Did the package manager explain/release_note why they made that move? The config file change [1] comes with an explanation. The Fedora setup does not fit the explanation completely, because it r

Re: Virus checking options

2023-04-25 Thread Damian
clamscan is slow slow and uses much of RAM, I have disabled it by unsetting @av_scanners_backup in my local config file. +1 clamdscan is the client for clamd and is fast, that would be why he is using it. at least in debian, amavis contacts clamd directly, not by using clamdscan:  ['Cl

Re: Virus checking options

2023-04-25 Thread Damian
Is there a fuller explanation of the virus checking options. Amavis documentation is scattered and incomplete. There is some information in multiple readme files and the release notes. I want Clamsdcan to check attachments, but warn me, not either bock or delete the attachments. You can put

Re: Amavisd ClamDscan

2023-04-25 Thread Damian
###http://www.clamav.net/ - using remote clamd scanner as a backup ['ClamAV-clamdscan', 'clamdscan', # "--stdout --no-summary --config-file=/etc/clamd-client.conf {}", "--stdout --no-summary --config-file=/etc/clamd.d/clamd.conf {}", <-- changed file name [0], qr/:.*\sFOUND$/m, qr/^

Re: Defining default value for sa_username_maps

2023-04-25 Thread Damian
Amavis still tries use nonexisting user, spamassassin seems simply ignore bayes tests in that case. Are you sure? Maybe the new users are just below bayes_min_ham_num and bayes_min_spam_num.

Re: custom reject message in smtp-dialog

2023-02-25 Thread Damian
$smtp_reason_by_ccat{&CC_SPAM} = 'id=%n - spam'; $smtp_reason_by_ccat{&CC_SPAM} = '[~[:TESTS]|SPF_FAIL|id=%n - SPF Failure ; Please contact your administrator|spam]'; $smtp_reason_by_ccat{&CC_SPAM} = '[~[:TESTS]|MYTEST|Triggered MYTEST-Spamassassin Rule|spam]'; I tried the following but it does

Re: custom reject message in smtp-dialog

2023-02-25 Thread Damian
usually when amavisd-new rejects mail as pre-queue filter, the smtp-dialog-message is like "554 5.7.0 Reject, id=13158-01 - spam" I would like to customize the message, if the Spamain-Rule SPF_FAIL triggers, e.g. "554 5.7.0 Reject, id=13158-01 - SPF Failure ; Please contact your administra

Re: always_bcc - can you have two recipients?

2023-02-11 Thread Damian
I was thinking of “fixing” this by setting always_bcc to a local alias such as archive@localhost and then expanding this in Postfix to the two recipient address Sounds reasonable. but I suspect that will automatically route the email via amavisd again. I am sure there is a way in Postfix to

Re: always_bcc - can you have two recipients?

2023-02-09 Thread Damian
I would like to always_bcc to two different recipients, is this possible? Surprisingly, amavis does not seem to support it.

Re: Error with altermime

2023-01-10 Thread Damian
For some reason it's trying to alter a file that doesn't exists /var/spool/amavisd/tmp/amavis-20230110T095247-31601-RpGveeFM/email-repl.txt, but /var/spool/amavisd/tmp/amavis-20230110T095247-31601-RpGveeFM/email.txt does exists Are you sure that email-repl.txt did not exist? Amavis wants to c

Re: Remove clickable hyperlinks in the email body

2022-12-22 Thread Damian
Would it be possible to change URLs from 'http' to 'hXXp' for example like most spam reporting agencies do to prevent help desk people from clicking on malicious URLs being reported? Out-of-the-box there is no such feature.

Re: mysql userpref

2022-12-01 Thread Damian
I added such an entry in the amavis configuration, maybe you know why it doesn't work? $sql_clause{'sel_wblist'} = 'SELECT "W" as wb'; Apparently the wblist code expects a user id. Try this sel_policy: SELECT username AS id, value AS spam_kill_level FROM userpref WHERE preference = "required_

Re: mysql userpref

2022-11-28 Thread Damian
I read it and unfortunately I still don't know how to set it up. @lookup_sql_dsn i have set for vmail database. Please write how to make amavis read "required_score" from database "spamassassin" from table "userpref" and if it finds a user let it use individual spam threshold "value". Something

Re: mysql userpref

2022-11-27 Thread Damian
Unrelated to SQL, amavis does not care about SpamAssassin's required_score. If you want spam-thresholds in SQL, have a look at [1]. Doesn't read required_scores value (3), only uses global value from amavisd.conf setting: $sa_tag2_level_deflt = 1.9; W dniu 25.11.2022 o 16:05, Da

Re: mysql userpref

2022-11-25 Thread Damian
Your user has three preferences defined, namely ok_locales, ok_languages and required_scores. What exactly would you like SpamAssassin to do that doesn't work? In attachment. W dniu 24.11.2022 o 22:04, Damian pisze: I do not see why individual settings for users from the "userpr

Re: mysql userpref

2022-11-24 Thread Damian
I do not see why individual settings for users from the "userpref" table are not downloaded. What do you get for SELECT preference, value FROM userpref WHERE username = 'mar...@wekstunters.pl' OR username = '$GLOBAL' ORDER BY username ASC

Re: Amavis process pinning CPU at 100% returning after 5 to 30 minutes

2022-08-30 Thread Damian
Running it on the complete email.txt (which is not how amavis invokes SpamAssassin): Aug 30 13:10:30.866 [73086] dbg: timing: total 7235 ms - init: 3338 (46.1%), parse: 28 (0.4%), extract_message_metadata: 266 (3.7%), get_uri_detail_list: 56 (0.8%), tests_pri_-1000: 106 (1.5%), compile_gen:

Re: Blocked BAD-HEADER-0 {RejectedInbound,Quarantined

2022-08-29 Thread Damian
How do I determine what exactly is wrong with the header that the remote server is sending? What is your log_level and do you see "check_header: " log lines? $log_level = 1; I don't see check_header in the logs. What should I set it to? $log_level = 2; If I can't get the remote site to fix

Re: Amavis process pinning CPU at 100% returning after 5 to 30 minutes

2022-08-29 Thread Damian
I was wondering if anyone is seeing similar behaviour or has any recommendations to debug this further. Depending on your mail throughput, you could increase $log_level up to 5 and see what is being logged right before the lockup. Additionally a mail which resides 30-40 minutes in processing

Re: Blocked BAD-HEADER-0 {RejectedInbound,Quarantined

2022-08-26 Thread Damian
I've got a few remote senders whose messages my server is rejecting and putting this in syslog: Blocked BAD-HEADER-0 {RejectedInbound,Quarantined} This is strange, I cannot find a code path which sets CC_BADH without setting the minor > 0. How do I determine what exactly is wrong with the hea

Re: locally submitted mail - policy banks

2022-06-11 Thread Damian
AFAIK this one should exist by default Upstream amavis defines MYNETS in its amavisd.conf, Debian doesn't.

Re: locally submitted mail - policy banks

2022-06-10 Thread Damian
when submitting mail locally, I get no policy bank assigned. I assumed that localhost is by default in @mynetworks (amavisd-new line 931) and the mail should get into MYNETS bank (amavisd-new line 1748) ...it obviously does not: Dumb question: Do you even have a MYNETS policy bank?

Re: Specify non-default path to spamassassin rules?

2022-05-15 Thread Damian
Hi all - can I ask again if someone has any ideas on how to specify an alternative config path for SpamAssassin files with amavis? How about [1]? [1] https://gitlab.com/amavis/amavis/-/blob/master/RELEASE_NOTES#L5439-5444

Re: Error reading from socket using IKARUS scan.server

2022-05-14 Thread Damian
May  9 16:58:42 mail amavis[1542]: (01542-01) (!)IKARUS scan.server: Error reading from socket: Connection reset by peer at /usr/sbin/amavisd-new line 8246., retrying (2) When within a stream does that happen? Have you looked at a tcpdump?

Re: More Hacking amavisd $msginfo

2022-05-03 Thread Damian
I'm trying to find or develop a way to quarantine mail from specific senders for specific domains. Is there a well-defined way to do this? It appears the amavisd.conf doesn't provide the ability to specify different policies based on domains. Since you already use Amavis::Custom, you can amend t

Re: Better antivirus (AV) protection?

2022-04-05 Thread Damian
Yet, I would NOT be surprised by ClamAV not detecting it, but I would hope some third-party db (through ExtremeSHOCK) to catch it. Does your setup permit executables?

Re: Better antivirus (AV) protection?

2022-04-05 Thread Damian
Important question: If I provide unrar to the OS, would I need to change anything to the amavis configuration? Ideally, no. Look for "Found decoder for" lines on Amavis restart. Also, would that be enough for archive scanning needs or I should try to find 7zz too I don't know the success rates

Re: Better antivirus (AV) protection?

2022-04-05 Thread Damian
How about using 'unar' - a command line version of 'The Unarchiver' (https://theunarchiver.com/) which supports a lot of formats (including 7z, RAR, ...) and is available on several Linux distros? Currently unsupported [1] by Amavis. [1] https://gitlab.com/amavis/amavis/-/issues/84

Re: Better antivirus (AV) protection?

2022-04-05 Thread Damian
You could give 7zip [1] a try. According to [2], 7zz integration does not need code changes. You'd have to deploy 7zz manually, though, as I don't see it in EPEL either. RPM names are p7zip and p7zip-plugins on EPEL for Centos 8. p7zip and p7zip-plugins do not provide 7zz, but 7z and 7za. Pe

Re: Better antivirus (AV) protection?

2022-04-05 Thread Damian
Question 1:  Is there something wrong in the configuration that does not allow 7z scanning or probably an additional software library is needed? Your system lacks rar and unrar, and EPEL does not provide it any more. Question 1A: If a decoder fails, could amavis be explicitly configured to tr

Re: Better antivirus (AV) protection?

2022-04-05 Thread Damian
Yet, we are recently receiving a lot of mails with virus-infected attachments (usually in 7z files) which are scanned by amavis/clamav but are NOT getting detected. How do you know that they are infected? Is your setup not detecting those viruses because neither Amavis nor ClamAV look inside

Re: spam_scanners on policy_banks

2022-04-04 Thread Damian
Though I can fill a bug on gitlab if you like. Yes, please.

Re: spam_scanners on policy_banks

2022-04-04 Thread Damian
I would expect messages with policy POL1 to be scanned only through SpamdClient; but what really happens is that both Spamassassin and SpamdClient are called, and their scores added (looks like global setting is applied). Looks like a bug to me.

Re: F-Secure av_scanner

2022-03-30 Thread Damian
could anybody help me out to configure F-secure as virus scanner? See [1]. [1] https://gitlab.com/amavis/amavis/-/blob/master/conf/amavisd.conf#L554-558

Re: Amavis::Util: can't obtain a tainted string at /usr/sbin/amavisd line 2935.

2022-03-29 Thread Damian
The Distribution is: Centos 7.8 I don't see 2.12.2 in CentOS or EPEL. Anyway, this seems to be [1]. [1] https://gitlab.com/amavis/amavis/-/issues/85

Re: Amavis::Util: can't obtain a tainted string at /usr/sbin/amavisd line 2935.

2022-03-29 Thread Damian
I get the following warning message in amavis-v2.12.2. I could not find a solution in google. What can I do to resolve the warning message. Which distribution?

Re: Whitelisting File Extension Types?

2022-03-24 Thread Damian
I am not sure why it is finding an "asc" file as only a PDF was attached. The banned files mechanism checks mime parts, not only attachments. Furthermore, even if I added ".asc" to the list above, it is still flagging the email as having banned content. A text-file attachment internally tran

Re: problems with whitelisting

2022-03-24 Thread Damian
bypass_spam_checks_maps => ['@whitelist_sender_maps'], # don't spam-check this mail bypass_banned_checks_maps => ['@whitelist_sender_maps'], # don't banned-check this mail bypass_header_checks_maps => ['@whitelist_sender_maps'], # don't header-check this mail Those are not per sender bu

Re: Defanging with Altermine - Any Way to Add Text for Stripped Attachments

2022-03-23 Thread Damian
I see no way to notify the user which attachments have been stripped. How might this be achieved through amavis (whether through altermime or another means)? It might work with Amavis + Anomy::Sanitizer [1] and its "msg_file_drop" mechanism. [1] http://mailtools.anomy.net/sanitizer.html

Re: Keyword based custom subject warning

2022-03-07 Thread Damian
https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.html#subjprefix Good call. But if Amavis is calling SA (which is normal) this feature in SA can still be used can't it? SA-in-Amavis cannot rewrite a header on its own.

Re: Keyword based custom subject warning

2022-03-07 Thread Damian
apparently, our users are receiving emails containing links and /or references to various publications, some of which are considered 'predatory'. Emails usually contain ISSN (International Standard Serial Number) and the idea is to scan the body of an email for the ISSN and if it matches one on

Re: Delays in mail deliveries

2022-03-03 Thread Damian
does not match $max_servers. You mean I should change the processes number below (2) to match amavis $max_servers configured value (currently 10)? This would be one possible way, yes. A good number depends on cpu and memory usage and availability. SpamAssassin can be greedy, and clamscan (not

Re: Delays in mail deliveries

2022-03-02 Thread Damian
smtp-amavis unix -  -   n   -   2   lmtp maxproc does not match $max_servers.     -o smtp_data_done_timeout=1200     -o smtp_send_xforward_command=yes These are the wrong options for an lmtp service. This is why you see: client IP address unknown, fetched from Receive

Re: Delays in mail deliveries

2022-03-02 Thread Damian
However, it still takes time (up to 10 minutes) for final delivery, because there is a mail processing queue in which the mail has to enter, be examined (even minimally) and be returned. Amavis is taking time because clamd scan is time consuming and it is processing mails which are ahead (in qu

Re: Delays in mail deliveries

2022-03-01 Thread Damian
A suggestion was to whitelist the sender address (at the example below: no-re...@sharepointonline.com), but we fear that this (or other similar) commonly used sender address may be deceptively used in third-party phishing/malicious mail which will then get through unprocessed/unfiltered. You ar

Re: Excluding blocking macro/xlsx/docx files to specific recipients?

2022-02-25 Thread Damian
Is it possible to allow certain file types from certain addresses to certain recipients without knowing the sending IP to add them to a policy bank? File types are considered in the context of banned checks, which can be configured by various banned_* confvars. Generally some confvars are glob

Re: sa_mail_body_size_limit and attachments

2022-02-24 Thread Damian
malware should be detected by clamav or other AV. I did not understand Alex' question regarding "stop scanning" to apply to spam-scanning only. Maybe they should specify.

Re: amavisd clean shutdown and restart

2022-02-23 Thread Damian
Feb 24 00:00:05 [server] /usr/local/sbin/amavisd[97857]: (97857-03) rmdir_recursively: /var/amavis/tmp/amavis-20220223T235319-97857-Mo9niBLX/parts, excl= # cat /var/log/amavisd.log | head -n 5 Feb 24 00:00:00 [server] newsyslog[63582]: logfile turned over Feb 24 00:00:59 [server] /usr/local/sbi

Re: sa_mail_body_size_limit and attachments

2022-02-23 Thread Damian
Yeah, amavis was written at a time when 100k was a large attachment. Have people mostly moved on from amavis? What are the other options? I've been using it almost from the beginning (2001?), but trying to do more with it now, and it's not holding up. Do I understand correctly, that you want a

Re: amavisd clean shutdown and restart

2022-02-23 Thread Damian
Feb 24 00:00:05 [server] /usr/local/sbin/amavisd[97857]: (97857-03) rmdir_recursively: /var/amavis/tmp/amavis-20220223T235319-97857-Mo9niBLX/parts, excl= ... Nothing until monit(1) starts amavisd a minute later What is (the last of) ... there?

Re: sa_mail_body_size_limit and attachments

2022-02-23 Thread Damian
Is there a variable to skip processing messages that contain attachments larger than a specific size? There isn't.

Re: Trying to add a new AV engine

2022-02-20 Thread Damian
['Dr. Web Security Space ', 'drweb-ctl', 'checkmail {}', qr/^Reject/m,, qr/^(?:infected with:\s+(.+)/m ], Have a look at [1]. - Both your patterns anchor at beginning of line. - A clean mail would not match "Reject" anywhere, but you defined it for the "clean" pattern. [1] https://gitlab.c

Re: Per-domain processing?

2022-01-31 Thread Damian
I have @local_domains_maps set to all domains for which it should process mail, but I'd like to be able to control virus/spam scanning, blocklist/allowlist, and other features on a per-domain basis. Is this possible? I'm aware of $policy_bank but isn't that based on IP address? Can I set @client_

Re: autodetect authenticated mail

2022-01-12 Thread Damian
can amavisd detect if mail was authenticated via SMTP? Not directly. or do I need to to explicitly set originating = 1 ? Yes.

Re: Undesired ban of text mail

2021-12-14 Thread Damian
What's your (and other people's) advice? You can place lines 8-13 from Savvas Karagiannidis' link in /etc/magic. I realized that this won't help. The new definition in /etc/magic will not match (which is the purpose of the upstream change), so file will continue and use the definition from th

Re: Undesired ban of text mail

2021-12-14 Thread Damian
What's your (and other people's) advice? You can place lines 8-13 from Savvas Karagiannidis' link in /etc/magic.

Re: Undesired ban of text mail

2021-12-12 Thread Damian
p.path BANNED:1 us...@noa.gr: "P=p001,L=1,M=text/plain,T=exe", matching_key="(?^:^\\.(exe|lha|cab|dll|gz|tgz|lzh)$)" But the mail is simple text. Why is it getting dropped? Use a $log_level of at least 4 to see the type_long that resulted in an exe type_short, e.g.: (3882952-01) lookup [map

Re: disable bad header checks ?

2021-10-29 Thread Damian
how do I disable bad header checks ? the few emails in badh inbasket all genuine, so I think I don't really need it ? Do you want to disable the checks or the quarantine?

Re: tracing bottlenecks ?

2021-10-29 Thread Damian
I've noticed some of my emails spend up to 5 minutes in amavis checks, dumb question, how to figure out where is the bottleneck ? Look for TIMING log lines.

Re: Amavis can't find perl modules so it does not work anymore

2021-10-19 Thread Damian
I'm running amavis 20160426 on Ubuntu 20.04 and suddenly it stopped working. It looks like it is failing to find/read some perl modules. Is there anybody who knows how to fix it? Thanks a lot in advanced! :) $ ls /usr/local/lib/x86_64-linux-gnu/perl/5.30.0/ Alien auto Bit Compress

Re: Question about '50-user' setting

2021-10-15 Thread Damian
I've yet to find an example (ideally visual) of what 7bitmime and 8bitmime look like side-by-side. : 436f 6e74 656e 742d 5472 616e 7366 6572 Content-Transfer 0010: 2d45 6e63 6f64 696e 673a 2038 6269 740d -Encoding: 8bit. 0020: 0a0d 0ac3 a4c3 b6c3 bc0d 0a ...

Re: lowercase "subject:" with sa_spam_subject_tag

2021-10-15 Thread Damian
we use amavisd-milter when receiving from the world, perhaps it can cause the issue? Ah yes, now I see it.

Re: Question about '50-user' setting

2021-10-14 Thread Damian
What does “force MTA conversion to 7-bit (e.g. before DKIM signing)” mean? You are probably referring to smtpd_discard_ehlo_keywords => ['8BITMIME'] If an MTA has 8BITMIME [1] mail to deliver to a next hop (e.g. an amavis instance), and this next hop does not announce being capable of handl

Re: lowercase "subject:" with sa_spam_subject_tag

2021-09-17 Thread Damian
noticed that Subject: is mapped to subject:  (lowercase) when I define $sa_spam_subject_tag I am not able to reproduce this. Do you have a minimal example config?

  1   2   >