Spam Vigilante - Mail Filter Virtual Appliance

[VMTN_Admin]

http://www.vmware.com/vmtn/appliances/directory/255

A mail proxy based on FreeBSD with spam (SpamAssassin) and virus (ClamAV) scanning. Can be used with any existing mail system.

[pperkins]

is it possible to use SV with both SMTP & fetchmail options simultaneously, or would I need to look at running 2 instances

thx

paul

[telackey]

is it possible to use SV with both SMTP & fetchmail options simultaneously, or would I need to look at running 2 instances

Paul,

I haven't tried it, but it should. For setup, just select SMTP and put that info in, and then afterwards manually edit /usr/local/etc/fetchmail.cf for your accounts. Then add or change the following line in /etc/rc.conf from:

fetchmail_enable="NO"

to:

fetchmail_enable="YES"

Reboot and you'll be running.

[pperkins]

thanks.

i'll give it a go

paul

[Coolio13]

Hello

When I Import this vmware image, then I get in the VI Client the message SERVERNAME (invalid) and I can not Edit the settings.

What can I do, to use the tool?

Thanks for any advise?

Kind Regards

Dani

[pperkins]

savemail panic in sendmail

I have tried googling havent found the answer can anyone else give any pointers,

I have SV installed to 3 sites one has started giving savemail panic in sendmail errors

Nov 16 11:24:35 spamfilter sendmail[3705]: lAGBO1ns003705: Losing ./qflAGBO1ns003705: savemail panic

Nov 16 11:24:35 spamfilter sendmail[3705]: lAGBO1ns003705: SYSERR(vscan): savemail: cannot save rejected email anywhere

Nov 16 11:32:35 spamfilter sendmail[3728]: lAGBW1MF003728: Losing ./qflAGBW1MF003728: savemail panic

Nov 16 11:32:35 spamfilter sendmail[3728]: lAGBW1MF003728: SYSERR(vscan): savemail: cannot save rejected email anywhere

Nov 16 11:39:28 spamfilter login: ROOT LOGIN (root) ON ttyv0

Nov 16 11:40:35 spamfilter sendmail[3772]: lAGBe1Xh003772: Losing ./qflAGBe1Xh003772: savemail panic

Nov 16 11:40:35 spamfilter sendmail[3772]: lAGBe1Xh003772: SYSERR(vscan): savemail: cannot save rejected email anywhere

I have checked the aliases file - all looks ok

run date | sendmail -v -Am postmaster >> returns root

run date | sendmail -v -Am vscan >> returns vscan

the vscan mailbox was 500+mb so I ran a touch /reconfigure increased to 2gb but this didnt resolve

sendmail -bv MAILER-DAEMON >> returns root

sendmail -bv postmaster >> returns root

sendmail -bv vscan >> returns vscan

I have cp'd the vscan mailbox to vscan.old and a new one has been created which is increasing in size

along with this two users whose fetchmail was set to keep have re-received all their emails from October again, once after the reconfigure and again after a reboot last night

I have compared the aliases, sendmail.cf and mailer.conf with one of the other sites and cant seen ay differences

thanks

paul

found all 'lost' messages in /var/spool/clientmqueue after a call saying they had a message about filesystem being full.

i am archiving them off and will try to recover them later as no mail is currently being downloaded to the system

paul

6-12-2007

Had to clear out /var/spool/clientmqueue again - /var fs full.

any ideas , anyone

thx in advance

paul

7-12-2007

probable cause found - amavis-stats update is failing, all .rrd files are getting permission denied when updates trying to run. I have checked against another setup and the .rrd file owner has swicthed to www not vscan. I have manually changed all .rrd & amavis* files back to vscan as the owner and will monitor over the next few days. ***** I had re-installed the stats package at the start of this post, and its reset the owner from vscan to www. *****

paul

[karmek]

Hi all,

i am new to this project and looking forward for its functions. Right now i experience some difficulties in setting up the system.

Let me describe my network situation so you clearly know what i try to do:

We have a NAT Router on our internet connection so bevor usage of Spam- Vigilante my system worked like: Sender -> NAT Server on Port 25 -> Internal Mailserver on Port 25.

I yould like to change the Port forward on my Router to the Spam- Vigilante and he shall transmit mails to the internal mailserver.

Lets imagine the Spamvigilante is spam-filter.mail the mailserver is mail-server.mail and my external domain is myexternaldomain.de

My Spam- Vigilante configuration looks like:

Fully qualified hostname: spam-filter.mail

DHCP: yes

configured as SMTP (not fetchmail)

external mail domain: myexternaldomain.de

internal mail domain: spam-filter.mail (i tried myexternaldomain.de as well)

Server for final delivery: mail-server.mail

Domains the sver should service: myexternaldomain.d, spam-filter.mail

allowed clients: subnet

Spam Configuration all at default

Web interface: no

exchange: no

When i change my Portforward at my firewall to the Spam Vigilante, it recieves mail but doesn't deliver it to the final server. I've tried to Telnet my NAT Server on Port 25 and the Spam-Vigilante answers correctly.

/var/log/maillog shows the incoming connections but not more than that.

/var/mail/root has many messages from double-bounce@spam-filter.mail and all connections end like

451 Error: queue file write error

Session aborted. reason: lost connection

Can you help me with the correct setup?

Thanks

Karmek

[pperkins]

Karmek

Are you able to resolve mail-server name from the SpamVigilante appliance console and telnet to it on port 25?

You could also substitute the destinatin server IP address instead of its name.

paul

[karmek]

pperkins

Thanks for your answer. Yes i am able to resolve it. I've got a Windows DNS Server running which serves those domains. nslookup for mail-server.mail and spam-filter.mail works fine.

I have the same results when i enter ip adresses directly

[telackey]

pperkins

Thanks for your answer. Yes i am able to resolve it. I've got a Windows DNS Server running which serves those domains. nslookup for mail-server.mail and spam-filter.mail works fine.

I have the same results when i enter ip adresses directly

I would have replied sooner, but I have been accosted by the recent mid-west ice storm.

Just to make sure I understand the situation, your NAT router currently forwards mail to your (internal) company mail server. You would like to change that so that the router forwards the mail to SV, and SV forwards it to your company mail server. However, when you do this, SV rejects the mail with the error '451 Error: queue file write error.' Is that correct?

That error is usually an indication of a problem in a pre-queue filter: in the case of SV, that would be amavisd-new. Can you try restarting the amavisd-new process (/usr/local/etc/rc.d/amavisd restart)? After restarting, can you post the output of:

ps aux | grep amavis

Regards.

[robmitch]

Hi There,

I'm trying to work out the easiest way to blacklist an individual recipient in SV - one of my mail accounts has been mailbombed, and the sheer volume of spams and spam replies is killing the SV appliance. Is there a way I can set up a blacklist so that this particular email address gets dropped and not processed.

Thanks,

R.

[Coolio13]

Sehr geehrte Damen und Herren

Besten Dank für Ihr E-Mail, welche ich gerne nach meiner Abwesenheit, ab dem 07. Januar 2008 bearbeiten werde. In dringenden Fällen wenden Sie sich bitte an Jürg Wüest, wueest@rotronic.ch, +41 44 838 13 06 oder in Altiris Angelegenheiten an den Support support@rotronic.ch oder 0848 800 750.

Mit freundlichen Grüssen

i.V. Daniel Bühler

Sektorleiter System Management

ROTRONIC AG

Grindelstrasse 6

CH-8303 Bassersdorf

Email buehler@rotronic.ch

Tel +41 44 838 12 41

Fax +41 44 836 99 95

Besuchen Sie uns auch im Internet: http://www.rotronic.com / http://www.roline.com

[karmek]

Hi telackey and thanks for your help.

Sorry for my slow answer. Your intention was right, i obviously experienced some problems with my amavisd.

In fact i was the one who caused this problem while i reduced the vmwares memory to 96MB. My Host is rather slow and has had only 386MB system memory so i didn't want to waste to much of it... After i restored the original value of 128MB everything worked fine

I have another Problem, it seems that the Spam Vigilante rejects mails lager then 10MB. Where can i configure this to a higher value?

Thanks for your help

karmek

[telackey]

7-12-2007

probable cause found - amavis-stats update is failing, all .rrd files are getting permission denied when updates trying to run. I have checked against another setup and the .rrd file owner has swicthed to www not vscan. I have manually changed all .rrd & amavis* files back to vscan as the owner and will monitor over the next few days. ***** I had re-installed the stats package at the start of this post, and its reset the owner from vscan to www. *****

paul

Paul,

Sorry I didn't get back more quickly. Several business trips and then the holidays... Anyway, did you get it worked out? Was that the issue? It is a bit odd to have any sendmail errors as sendmail is disabled on SV. The first thing that springs to mind though, and it sounds like you alread checked it, is to see if /var is full (df -h). If it is, you can track down where with:

cd /var

du -d 1 | sort -n

Same system would go for amavis-stats under /usr/local/www if it was full. As you mentioned, all the .rrd files under '/usr/local/www/amavis-stats' should be owned by vscan:vscan and show up with 644 permissions.

[telackey]

I have another Problem, it seems that the Spam Vigilante rejects mails lager then 10MB. Where can i configure this to a higher value?

Thanks for your help

karmek

Karmek,

I haven't done this in awhile, so you may be in for some trial and error, but in /usr/local/etc/postfix/main.cf try adding:

message_size_limit =

Example for 20MB:

message_size_limit = 20971520

Make sure the destination server has an equal or larger size configured on it, else it will bounce when SV tries to relay it to your "real" mail server.

[telackey]

Spam Vigilante Mirror:

A really nice gentleman named Steve Arnold has put up a mirror of SV. This is a great help for anyone struggling with VMWare's torrent system.

So, three rounds of applause and here is the link: http://www.stevis.com/SpamVigilante/

Thanks, Steve!

[erbnet]

There are never any seeders for this torrent download. Is there a direct link?

[karmek]

Hi,

thanks for your help telackey. I'll try to increase the mailsize with this command. If it works, i'll let you know

I found another Problem i can not solve for myself. The Spam Vigilante crashes from time to time. I am not sure what service causes this, because i can't find any helpful information in my logs.

I analysed my Harddisk and found out that my virtual machine ist about 5GB large. I thought it might be because of the error logs, something might be writing lots of trash into them and thus filling my harddisk with this trash but my log directory is only about 70MB. So i had a look at some other directorys and found /var/spool/clientmqueue with 3.7GB and lots of files inside.

Can you explain me the use of this directory? Would it be a problem if i delete the content? It looks to me like a undelivered mailquery but as far as i can remember, all mails have been delivered. How can this be?

Thanks

Karmek

[telackey]

Can you explain me the use of this directory? Would it be a problem if i delete the content? It looks to me like a undelivered mailquery but as far as i can remember, all mails have been delivered. How can this be?

Karmek

That is certainly more than a little strange. clientmqueue is not Postfix's queue directory, but to be sure, you can run:

postqueue -p

And see the state of your current queue.

If I had to guess, there must be some sort of notification queueing up, which is trying to be sent to "root" or the like from the command-line, and it is using the sendmail binary to do it. That is pretty much a guess, but it is the best one I have. Can you look at the contents of some of the files and see what you have? It would be good to find out what it is, and why it is going there, before taking any other action.

Incidentally, if you do remove the contents, the space won't be reclaimed for the host unless you take some extra steps within VMWare. You can check the VMWare help on that to see what you need to do.

Regards,

Thomas

[karmek]

Hi,

i've tried postqueue -p. It says there are no mails in my queue. In my directory /var/spool/clientmqueue i have about 900 Files named like dfmXXXXXXXXXXXX and qfmXXXXXXXXXXXX

with content like:

amavis-stats: error: Attempted to update /usr/local/www/amavis-stats/3.rrd at 1201170000 count 19

amavis-stats: error: updateRRD: opening '/usr/local/www/amavis-stats/2.rrd' Permission Denied

Those strange qfm files contain some kind of mails for my local vscan account.

So it seems that a failed installation from amavis-stats causes this problem. But for now i have no clue why. I followed the instructions wrote in the documentation. Any idea how to fix this?

Thanks

Karmek

[telackey]

Hi,

i've tried postqueue -p. It says there are no mails in my queue. In my directory /var/spool/clientmqueue i have about 900 Files named like dfmXXXXXXXXXXXX and qfmXXXXXXXXXXXX

amavis-stats: error: Attempted to update /usr/local/www/amavis-stats/3.rrd at 1201170000 count 19

amavis-stats: error: updateRRD: opening '/usr/local/www/amavis-stats/2.rrd' Permission Denied

Those strange qfm files contain some kind of mails for my local vscan account.

So it seems that a failed installation from amavis-stats causes this problem. But for now i have no clue why. I followed the instructions wrote in the documentation. Any idea how to fix this?

Thanks

Karmek

You could probably comment out the last line in /etc/crontab to stop it for the meantime.

However, I wanted to know, did you paste that exactly?

This part:

amavis-stats: error: updateRRD: opening '/usr/local/amavis-stats/2.rrd' Permission Denied

/usr/local/amavis-stats shouldn't exist, so not a big wonder if it couldn't find it, though it does make me ask why it was looking for it there.