SpamSnake Issues

[Kamian]

Hi, I haven't made my way through the whole setup yet as I am trying to ensure its working step by step. I believe I have Postfix setup correctly, at the moment it is collecting mail, but its not being relayed through, but was before I started on Mailscanner.

With MailScanner, I have gone through the entire setup for this but I am getting the following error when I try to start MailScanner.

root@mcp-spam1:/var/spool/MailScanner# /etc/init.d/mailscanner start
Could not read directory /var/spool/MailScanner/incoming at /usr/share/MailScanner//MailScanner/Config.pm line 2488
Error in configuration file line 166, directory /var/spool/MailScanner/incoming for incomingworkdir does not exist (or is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 2812
Could not read directory /var/spool/MailScanner/quarantine at /usr/share/MailScanner//MailScanner/Config.pm line 2488
Error in configuration file line 170, directory /var/spool/MailScanner/quarantine for quarantinedir does not exist (or is not readable) at /usr/share/MailScanner//MailScanner/Config.pm line 2812
root@mcp-spam1:/var/spool/MailScanner#

The directory listings with permissions etc are as belows;

root@mcp-spam1:/var/spool/MailScanner# ls -aFl
total 24
drwxr-x--- 6 mail mail 4096 2008-06-09 16:26 ./
drwxr-xr-x 6 root root 4096 2008-06-09 16:14 ../
drwxr-x--- 2 postfix postfix 4096 2008-04-05 10:00 archive/
drwxr-x--- 2 postfix postfix 4096 2008-04-05 10:00 incoming/
drwxr-x--- 2 postfix postfix 4096 2008-04-05 10:00 quarantine/
drwxr-x--- 2 postfix postfix 4096 2008-06-09 16:26 spamassassin/
root@mcp-spam1:/var/spool/MailScanner#

In my /etc/MailScanner/MailScanner.conf file it is set to run both user and group as postfix

In my /var/log/syslog this keeps repeating over and over.

Jun 9 22:53:58 mcp-spam1 MailScanner: Process did not exit cleanly, returned 1 with signal 0
Jun 9 22:53:58 mcp-spam1 MailScanner[6155]: MailScanner E-Mail Virus Scanner version 4.68.8 starting...
Jun 9 22:53:59 mcp-spam1 MailScanner[6155]: Could not read directory /var/spool/MailScanner/incoming
Jun 9 22:53:59 mcp-spam1 MailScanner[6155]: Error in configuration file line 166, directory /var/spool/MailScanner/incoming for incomingworkdir does not exist (or is not readable)
Jun 9 22:53:59 mcp-spam1 MailScanner[6155]: Could not read directory /var/spool/MailScanner/quarantine
Jun 9 22:53:59 mcp-spam1 MailScanner[6155]: Error in configuration file line 170, directory /var/spool/MailScanner/quarantine for quarantinedir does not exist (or is not readable)
Jun 9 22:54:00 mcp-spam1 MailScanner[6155]: Read 817 hostnames from the phishing whitelist
Jun 9 22:54:00 mcp-spam1 MailScanner[6155]: Read 5141 hostnames from the phishing blacklist
Jun 9 22:54:00 mcp-spam1 MailScanner[6155]: SpamAssassin temporary working directory is /tmp
Jun 9 22:54:01 mcp-spam1 MailScanner[6155]: Using SpamAssassin results cache
Jun 9 22:54:01 mcp-spam1 MailScanner[6155]: Could not create SpamAssassin cache database /var/spool/MailScanner/incoming/SpamAssassin.cache.db
Jun 9 22:54:01 mcp-spam1 MailScanner[6155]: Enabling SpamAssassin auto-whitelist functionality...
Jun 9 22:54:11 mcp-spam1 MailScanner[6155]: ClamAV scanner using unrar command /usr/bin/unrar
Jun 9 22:54:11 mcp-spam1 MailScanner[6155]: Incoming Work Dir does not exist
Jun 9 22:54:11 mcp-spam1 MailScanner: Process did not exit cleanly, returned 1 with signal 0

/var/log/mail.log constantly repeats the following

Jun 9 22:55:16 mcp-spam1 MailScanner[6175]: Could not create SpamAssassin cache database /var/spool/MailScanner/incoming/SpamAssassin.cache.db
Jun 9 22:55:17 mcp-spam1 MailScanner[6175]: Enabling SpamAssassin auto-whitelist functionality...
Jun 9 22:55:23 mcp-spam1 MailScanner[6175]: ClamAV scanner using unrar command /usr/bin/unrar
Jun 9 22:55:23 mcp-spam1 MailScanner[6175]: Incoming Work Dir does not exist
Jun 9 22:55:24 mcp-spam1 MailScanner[6177]: MailScanner E-Mail Virus Scanner version 4.68.8 starting...
Jun 9 22:55:24 mcp-spam1 MailScanner[6177]: Could not read directory /var/spool/MailScanner/incoming
Jun 9 22:55:24 mcp-spam1 MailScanner[6177]: Error in configuration file line 166, directory /var/spool/MailScanner/incoming for incomingworkdir does not exist (or is not readable)
Jun 9 22:55:24 mcp-spam1 MailScanner[6177]: Could not read directory /var/spool/MailScanner/quarantine
Jun 9 22:55:25 mcp-spam1 MailScanner[6177]: Error in configuration file line 170, directory /var/spool/MailScanner/quarantine for quarantinedir does not exist (or is not readable)
Jun 9 22:55:25 mcp-spam1 MailScanner[6177]: Read 817 hostnames from the phishing whitelist
Jun 9 22:55:25 mcp-spam1 MailScanner[6177]: Read 5141 hostnames from the phishing blacklist
Jun 9 22:55:25 mcp-spam1 MailScanner[6177]: SpamAssassin temporary working directory is /tmp
Jun 9 22:55:26 mcp-spam1 MailScanner[6177]: Using SpamAssassin results cache
Jun 9 22:55:26 mcp-spam1 MailScanner[6177]: Could not create SpamAssassin cache database /var/spool/MailScanner/incoming/SpamAssassin.cache.db
Jun 9 22:55:26 mcp-spam1 MailScanner[6177]: Enabling SpamAssassin auto-whitelist functionality...

I have so far done the following in trying to solve this issue;
1. Disabled app-armour as suggested at start of tutorial (well I did this but will mention it)
2. Rebooted several times.
3. Tried different users and different permissions.
4. Added the suggested additions to /etc/rc.local however the directories were not being removed beforehand anyway, but have added as well as the chown +r ...
5. Compared to a known working spam solution against their /etc/MailScanner/MailScanner.conf file and they have the same setup and config options, but a working system (Ubuntu 6.06 LTS)
6. Checked file settings via Webmin


What I am mainly confused about is; the config file is saying for MailScanner to run as postfix, and the file/group perms are set to postfix, yet it cannot see that it exists still. Mailscanner is running on my box, but it exits as you can see from the above log files.

I am unsure what to do next to troubleshoot or progress. I'm sure its something extremely small and simply that I am missing, so any suggestion will be welcome!

[falko]

The problem is that the directory /var/spool/MailScanner is owned by the user and group mail and that noone else can read that directory. So even if the directories within /var/spool/MailScanner are owned by postfix, that user cannot access them because the parent directory isn't accessible for the user postfix.

[Kamian]

awesome! Thanks I changed it over and now it works with no error. Will report back when finished to confirm this (though i'm semi confident it is)

[Kamian]

Jun 11 14:58:05 mcp-spam1 MailScanner: Cannot write pid file /var/run/MailScanner/MailScanner.pid, No such file or directory
Jun 11 14:58:05 mcp-spam1 MailScanner: MailScanner setting GID to postfix (117)
Jun 11 14:58:05 mcp-spam1 MailScanner: MailScanner setting UID to postfix (109)
Jun 11 14:58:06 mcp-spam1 MailScanner: Cannot write pid file /var/run/MailScanner/MailScanner.pid, No such file or directory
Jun 11 14:58:07 mcp-spam1 MailScanner[4862]: MailScanner E-Mail Virus Scanner version 4.68.8 starting...
Jun 11 14:58:07 mcp-spam1 postfix/master[4933]: daemon started -- version 2.5.1, configuration /etc/postfix
Jun 11 14:58:07 mcp-spam1 MailScanner[4862]: Could not read directory /var/lock/subsys/MailScanner
Jun 11 14:58:07 mcp-spam1 /usr/sbin/cron[4994]: (CRON) INFO (pidfile fd = 3)
Jun 11 14:58:07 mcp-spam1 /usr/sbin/cron[4995]: (CRON) STARTUP (fork ok)
Jun 11 14:58:07 mcp-spam1 MailScanner[4862]: Error in configuration file line 2559, directory /var/lock/subsys/MailScanner for lockfiledir does not exist (or is not readable)
Jun 11 14:58:07 mcp-spam1 /usr/sbin/cron[4995]: (CRON) INFO (Running @reboot jobs)
Jun 11 14:58:07 mcp-spam1 MailScanner[4862]: Syntax error in line 1777, value "" for spamblacklist is not one of allowed values "yes","no"
Jun 11 14:58:08 mcp-spam1 MailScanner[4862]: Syntax error in line 1770, value "" for spamwhitelist is not one of allowed values "yes","no"
Jun 11 14:58:08 mcp-spam1 MailScanner[4862]: Read 817 hostnames from the phishing whitelist
Jun 11 14:58:08 mcp-spam1 MailScanner[4862]: Read 5141 hostnames from the phishing blacklist
Jun 11 14:58:09 mcp-spam1 MailScanner[4862]: Config: calling custom init function MailWatchLogging
Jun 11 14:58:09 mcp-spam1 postfix/master[4933]: terminating on signal 15
Jun 11 14:58:09 mcp-spam1 MailScanner[4862]: Started SQL Logging child
Jun 11 14:58:09 mcp-spam1 postfix/master[5122]: daemon started -- version 2.5.1, configuration /etc/postfix
Jun 11 14:58:13 mcp-spam1 MailScanner: MailScanner setting GID to postfix (117)
Jun 11 14:58:13 mcp-spam1 MailScanner: MailScanner setting UID to postfix (109)
Jun 11 14:58:14 mcp-spam1 MailScanner[5153]: MailScanner E-Mail Virus Scanner version 4.68.8 starting...
Jun 11 14:58:15 mcp-spam1 MailScanner[5153]: Syntax error in line 1777, value "" for spamblacklist is not one of allowed values "yes","no"
Jun 11 14:58:15 mcp-spam1 MailScanner[5153]: Syntax error in line 1770, value "" for spamwhitelist is not one of allowed values "yes","no"
Jun 11 14:58:15 mcp-spam1 MailScanner[5153]: Read 817 hostnames from the phishing whitelist
Jun 11 14:58:16 mcp-spam1 MailScanner[5153]: Read 5141 hostnames from the phishing blacklist
Jun 11 14:58:16 mcp-spam1 MailScanner[5153]: Config: calling custom init function MailWatchLogging
Jun 11 14:58:16 mcp-spam1 MailScanner[5153]: Started SQL Logging child
Jun 11 14:58:16 mcp-spam1 MailScanner[5153]: SpamAssassin temporary working directory is /var/spool/MailScanner/incoming/SpamAssassin-Temp
Jun 11 14:58:17 mcp-spam1 MailScanner[5153]: Using SpamAssassin results cache
Jun 11 14:58:18 mcp-spam1 MailScanner[5153]: Connected to SpamAssassin cache database
Jun 11 14:58:18 mcp-spam1 MailScanner[5153]: Enabling SpamAssassin auto-whitelist functionality...
Jun 11 14:58:25 mcp-spam1 MailScanner[5153]: ClamAV scanner using unrar command /usr/bin/unrar
Jun 11 14:58:25 mcp-spam1 MailScanner[5153]: Using locktype = flock

It seems to be mostly working other than these couple issues.

/var/run/MailScanner appears to have the correct perms as set in the tutorial.

root@mcp-spam1:/var/run# ll
total 44
drwxr-xr-x 14 root root 520 2008-06-11 14:58 ./
drwxr-xr-x 15 root root 4096 2008-06-09 12:32 ../
srw-rw-rw- 1 root root 0 2008-06-11 14:57 acpid.socket=
drwxr-xr-x 2 root root 40 2008-06-11 14:58 apache2/
-rw-r--r-- 1 root root 5 2008-06-11 14:58 apache2.pid
-rw-r--r-- 1 root root 5 2008-06-11 14:58 atd.pid
drwxr-xr-x 3 root root 60 2008-06-11 14:57 bind/
drwxr-xr-x 2 clamav clamav 100 2008-06-11 14:58 clamav/
-rw-r--r-- 1 root root 5 2008-06-11 14:58 crond.pid
---------- 1 root root 0 2008-06-11 14:58 crond.reboot
drwxr-xr-x 2 dcc dcc 40 2008-06-11 14:58 dcc/
-rw-r--r-- 1 root root 5 2008-06-11 14:57 dhclient.eth0.pid
drwxr-xr-x 2 klog klog 100 2008-06-11 14:57 klogd/
drwxr-xr-x 2 postfix www-data 60 2008-06-11 14:58 MailScanner/
-rw-r--r-- 1 root root 421 2008-06-11 14:57 motd
drwxr-xr-x 2 mysql root 80 2008-06-11 14:57 mysqld/
drwxr-xr-x 2 root root 60 2008-06-11 14:57 network/
-rw-r--r-- 1 root root 4 2008-06-11 14:57 ntpd.pid
drwxrwxr-x 2 root utmp 40 2008-06-11 14:57 screen/
-rw-r--r-- 1 root root 2 2008-06-11 14:57 sendsigs.omit
drwxr-xr-x 2 root root 40 2008-06-11 14:57 sendsigs.omit.d/
drwxr-xr-x 2 root root 40 2008-06-11 14:57 sshd/
-rw-r--r-- 1 root root 5 2008-06-11 14:57 sshd.pid
drwx------ 3 root george 60 2008-06-11 14:58 sudo/
-rw-r--r-- 1 root root 5 2008-06-11 14:57 syslogd.pid
-rw-rw-r-- 1 root utmp 3456 2008-06-11 14:58 utmp
root@mcp-spam1:/var/run#

MailScanner.pid is owned by postfix : postfix so would it be safe to assume that it can write to it? Could it be the file perm 0600?

root@mcp-spam1:/var/run/MailScanner# ll
total 4
drwxr-xr-x 2 postfix www-data 60 2008-06-11 14:58 ./
drwxr-xr-x 14 root root 520 2008-06-11 14:58 ../
-rw------- 1 postfix postfix 5 2008-06-11 14:58 MailScanner.pid
root@mcp-spam1:/var/run/MailScanner#

Any hints on finding the issue for the spamlists?

[Kamian]

In regards to the spamlists issues I have checked the following;

/etc/MailScanner/CustomFunctions/ and the correct script is there as requested by the tutorial, and edited as suggested.

/etc/MailScanner/MailScanner.conf has the path to the CustomFunctions set appropriately, and also the SQLBlackWhiteList.pm in that directory. The error states it needs to be yes or no for the answer but it is referring to the function in that file...

MailScanner.conf refers to another custom script for Mailwatch and doesn't error over that, so I am unsure what it is that I could have done to break it. I have gone through and rechecked spelling and ensured no extra whitespace after the filename, simply a blank line and the next section on the config file.

[falko]

What happens when you run

chmod 777 /var/run/MailScanner

?

What's the output of

ls -la /var/lock/subsys/MailScanner

?

[Rocky]

Kamian,

Sorry for the late response, been quite busy lately.

Make sure you have the following set in /etc/MailScanner/MailScanner.conf:

• Run As Group = www-data
• Quarantine User = root
• Quarantine Group = www-data
• Quarantine Permissions = 0660
• Quarantine Whole Message = yes
• Always Looked Up Last = &MailWatchLogging
• Quarantine Whole Message As Queue Files = no
• Detailed Spam Report = yes
• Include Scores In SpamAssassin Report = yes
• Is Definitely Not Spam = &SQLWhitelist
• Is Definitely Spam = &SQLBlacklist

Repeat these steps:

chown -R postfix:www-data /var/spool/MailScanner
chown -R postfix:www-data /var/lib/MailScanner
chown -R postfix:www-data /var/run/MailScanner
chown -R postfix:www-data /var/lock/subsys/MailScanner
chown -R postfix:www-data /var/spool/postfix/hold
chmod -R ug+rwx /var/spool/postfix/hold
chmod -R ug+rwx /var/spool/MailScanner

Finally restart MailScanner, log into your MailWatch interface and test it.
/etc/init.d/mailscanner restart

Let me know if that worked.

Rocky

[Kamian]

Thanks Falko, made no difference though. It was definately a group problem where I missed something in the mailscanner config file. i really appreciate the response though.

Rocky, I didn't set the group to www-data, i had it as postfix, so I changed that.

It seems to be running now after the rc.local mods change the perms, and all the problems with perms are solved.

the only problem i have now is in regards to;

Quarantine Whole Message As Queue Files = no <--- This is not in my MailScanner.conf file at all.


# Is Definitely Not Spam = &SQLWhitelist
# Is Definitely Spam = &SQLBlacklist

Jun 11 21:56:03 mcp-spam1 MailScanner[5157]: Syntax error in line 1777, value "" for spamblacklist is not one of allowed values "yes","no"
Jun 11 21:56:03 mcp-spam1 MailScanner[5157]: Syntax error in line 1770, value "" for spamwhitelist is not one of allowed values "yes","no"

Admittedly, I haven't had any mail flow through the server, could this be why? the DB hasn't been created yet?

[Rocky]

Hey,

Do you have the following lines exactly like so?

 
# Is Definitely Not Spam = &SQLWhitelist
# Is Definitely Spam = &SQLBlacklist

If so, remove the comments and restart mailscanner.

Regarding the following line, just add it.

 
Quarantine Whole Message As Queue Files = no

Also, what version of mailscanner are you using?

Rocky

[Kamian]

From my /etc/MailScanner/MailScanner.conf file

Is Definitely Not Spam = $SQLWhitelist
Is Definitely Spam = $SQLBlacklist

And now I see the problem. $ and not a &.

Thankyou for your patience

Ok, I added that line and its not liking it.

Jun 11 23:06:35 mcp-spam1 MailScanner: MailScanner setting GID to www-data (33)
Jun 11 23:06:35 mcp-spam1 MailScanner: MailScanner setting UID to postfix (109)
Jun 11 23:06:36 mcp-spam1 MailScanner[5744]: MailScanner E-Mail Virus Scanner version 4.68.8 starting...
Jun 11 23:06:36 mcp-spam1 MailScanner[5744]: Syntax error(s) in configuration file:
Jun 11 23:06:37 mcp-spam1 MailScanner[5744]: Unrecognised keyword "quarantinewholemessageasqueuefiles" at line 273
Jun 11 23:06:37 mcp-spam1 MailScanner[5744]: Warning: syntax errors in /etc/MailScanner/MailScanner.conf.
Jun 11 23:06:37 mcp-spam1 MailScanner[5744]: Read 817 hostnames from the phishing whitelist
Jun 11 23:06:38 mcp-spam1 MailScanner[5744]: Read 5141 hostnames from the phishing blacklist
Jun 11 23:06:38 mcp-spam1 MailScanner[5744]: Config: calling custom init function SQLBlacklist
Jun 11 23:06:38 mcp-spam1 MailScanner[5744]: Starting up SQL Blacklist
Jun 11 23:06:38 mcp-spam1 MailScanner[5744]: Read 0 blacklist entries
Jun 11 23:06:39 mcp-spam1 MailScanner[5744]: Config: calling custom init function MailWatchLogging
Jun 11 23:06:39 mcp-spam1 MailScanner[5744]: Started SQL Logging child
Jun 11 23:06:39 mcp-spam1 MailScanner[5744]: Config: calling custom init function SQLWhitelist
Jun 11 23:06:39 mcp-spam1 MailScanner[5744]: Starting up SQL Whitelist
Jun 11 23:06:40 mcp-spam1 MailScanner[5744]: Read 0 whitelist entries
Jun 11 23:06:40 mcp-spam1 MailScanner[5744]: SpamAssassin temporary working directory is /var/spool/MailScanner/incoming/SpamAssassin-Temp
Jun 11 23:06:40 mcp-spam1 MailScanner[5744]: Using SpamAssassin results cache
Jun 11 23:06:41 mcp-spam1 MailScanner[5744]: Connected to SpamAssassin cache database
Jun 11 23:06:41 mcp-spam1 MailScanner[5744]: Expired 2 records from the SpamAssassin cache
Jun 11 23:06:41 mcp-spam1 MailScanner[5744]: Enabling SpamAssassin auto-whitelist functionality...
Jun 11 23:06:53 mcp-spam1 MailScanner[5744]: ClamAV scanner using unrar command /usr/bin/unrar
Jun 11 23:06:53 mcp-spam1 MailScanner[5744]: Using locktype = flock
root@mcp-spam1:~#

I simply cut and paste that line into the conf file under the other Quarantine section.


# Quarantine Setting added for SpamSnake / MailWatcher
Quarantine Whole Message As Queue Files = no

#

I'm running mailscanner_4.68.8-1_all.deb from memory I just cut and paste the link in the tutorial, but I could be wrong, I can't say 100%.