efa-project.org

This looks like a problem with postfix not being able to handle the = inside the <email address>. I do not see any options to allow you to override the reject_unknown_sender_domain postfix option inside postfix. The only alternative would be to turn off this function, but that would result in lots m...

Silly question - what version of efa/Mailscanner are you running? I get the following: Command line: real 0m6.159s user 0m4.212s sys 0m0.872s Web Interface MailScanner Lint Message Time Trying to setlogsock(unix) 0 Reading configuration file /etc/MailScanner/MailScanner.conf 0.13883 Reading configur...

I hate systemd because it makes managing the systems a pain when you least need the pain.

Voted Devuan.

Ubuntu/Debian are *grumble* fine.

henk wrote: ↑

04 Jan 2021 21:07

in MailScanner.conf

If you do have another MTA between "the net" and your MS box, then you
really do need set this to 2.

huh. I didn't know that one, and I needed it. Thanks!

I am sure there are many tutorials online for doing this.

Do you need one for winscp and putty?

(offtopic reply, but this is for Nicola: viewtopic.php?f=14&t=2466&p=16669&sid=3 ... 839#p16669)

Normally, I just search the spamassassin on my installation in the /var/lib/spamassassin/3*/ directory for the ruleset names. That will lead to the definition.

In this case, I do not have these rules in my installations.

It works for me. I can see the results of the RBL checks when I use the -D option.

Nov 18 17:40:15.773 [24344] dbg: async: calling callback on key dns:A:130.190.168.104.bl.mailspike.net
Nov 18 17:40:15.773 [24344] dbg: dns: hit <dns:130.190.168.104.bl.mailspike.net> 127.0.0.10

In my case, since I wasn't aware of the mailscanner bug, I changed how my exchange server forwarded messages - basically from changing it from a user level forward to a system transport level forward. I have absolutely no idea why it worked, only that it did, and I guess I am still using the buggy v...

What is the setting of your /etc/MailScanner/Mailscanner.conf "Spam Actions" option?

Without more information, it's very hard to debug this.

Is there anything in the mysql log files? how about the System log files? Is the database still running? what does "mysqladmin processlist" show?

Consider using the Centos 8 instead of Centos 7 as your host os. That means you'll have more time before you need to upgrade the OS again.

I believe efa running on Centos 8 is working now.

Good luck with your migration. Sounds like you know what you are doing.

What version of eFa are you running?

without having access to your box at the time it was compromised, it's very hard to guess.

Keep your local user accounts to a minimum.

Use strong passwords

Implement "fail2ban" to protect your login accounts.

goldengate wrote: ↑

02 Nov 2020 23:44

Salutations from a long time MailScanner user (I have Julian's book!) contemplating transitioning to EFA.

Do it!

"just turn on automatic updates"

huh. I just dealt with this problem 2 days ago. I have an exchange user who forwards mail automatically to gmail. The user@gmail address would be converted to user@exchange and sent back - which would then forward a copy to user@gmail - which would then send it back... I changed how the message was ...

I'm just looking over the mail headers, and from what I can see, somebody from 23.129.64.18 was able to use your server (SMTP.Cryptz.com / 24.229.7.147) and authenticate as user cryptz. So, did your machine have a user called "cryptz" on your system? Was the password compromised? That'd be my guess....

Here are my v3 to v4 upgrade notes that may be of some use.

viewtopic.php?f=5&t=4325

I don't recall doing anything special for dmark, other than updating the configuration file.

shawniverson, is this a change that should be pushed up to the sqlgrey folks?

If I were to guess...

when you change the db_host from localhost to an ipaddress or hostname, the mysql database wouldn't allow access from a non local request.

To fix that, you'll have to give access to the sqlgrey database from that user/host combination.

When you say "broke" can you be a bit more specific?

Can you tell us all the steps you did between when it "worked" and when it "broke"?

If we know what you did, then we may be able to figure out where it went wrong.

Welcome aboard.

Thanks for the reply.

It sounds like a false positive. Somehow, the PDF you've generated is matching another spam signature under the Sanesecurity's spam signatures. Either that, or your pdf is actually the spam people have reported to Sanesecurity. If it's the former, then I suggest you regenerate your PDF, or resave it...