efa-project.org

What OS and version is your physical and virtual servers running?

No. Don't edit that file. That file could get overwritten on an update. The proper answer is to override the values in local.cf. I also found the ImageCerberus scoring too highly for the messages I received, so I reduced them to a 10th of what they were. Here is what I added to /etc/mail/spamassassi...

Yes, that is correct. There is a script that is supposed to record this information in the database. However, it is not customized for EFAs postfix log files, and thus does not capture the information correctly. I was working on getting it working, but I got sidetracked with work. See here: https://...

Bug. See viewtopic.php?f=13&t=1619 for a fix

Hmmm, I've never touched the footers, so I don't know about those. The customized files seem safe in /etc/mail/spamassassin/, or at least mine have been so far. I think the files in /etc/MailScanner/reports/en/ may get overwritten, so make sure you keep a copy elsewhere. As I previously mentioned, t...

So, your box is having trouble connecting to the internet, or it is having trouble with name resolution.

Open a terminal window to the efa box and send me the results of the following two commands:
1/ ping 8.8.8.8
2/ ping www.google.com

That should be the SQLGrey perl daemon. [user@efa postfix]$ netstat -plutn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:2501 0.0.0.0:* LISTEN 2238/perl [user@efa postfix]$ ps -ef |grep 2238 sqlgrey 2238 1 0 Apr1...

The web based interface is "mailscanner", now part of the mailwatch project. Everything there is in /var/www/html/mailscanner. Anything changed there will be overwritten in the next update. (I modified a report and lost the changes twice. doh! I'm getting good at making the changes though)...

Thanks darky83. I never noticed that before (shows you how much time I spend in the menu).

I guess I must have had it turned off in 3.0.0.7 and somehow it got turned back on in 3.0.0.9.

Thanks for the pointer! Mystery solved!

When I last checked the version of my EFA appliance, it was 3.0.0.9 When I looked this morning, it was 3.0.1.1 which is strange as I don't recall updating it. Is there now an autoupdate feature that I am unaware of? Or somehow it happened because I sleepwalked for the first time ever? Just curious.

As DaN says, it's just supposed to show the # character.

would you be willing and able to have them send messages to two addresses I specify so I could diagnose it further?

is it just this one message, or does it happen with every message sent?

I recently came across Devuan, a Debian fork with systemd excised.

I'm cautiously and optimistically, keeping an eye on it to see where it goes.

Since I was fixing the stats, I figured I might as well update the mail report as well. Attached are two replacement files, functions.php and rep_total_mail_by_date.php. I've renamed them to *-new.php so you can download and compare them before actually using them. These files go in /var/www/html/ma...

note to self:
you came across this before and found another script that could properly pull the information:
viewtopic.php?f=5&t=1015&p=3146&hilit=m ... tics#p3146

2/ See here for the necessary configuration change.

1/ How do you know the customer is really sending safe emails? Do the affected emails from the customer contain word documents?

Fixed in the mailwatch project.

Now that I am happily blocking messages with crappy attachments in zip files, I noticed the statistics were not showing the blocked messages and that the messages didn't add up. Screen Shot 2016-05-05 at 10.45.png In fact, the total is short by the number of blocked messages. That's mighty suspiciou...

a year later, my mailscanner config files have survived two upgrades intact.

*bump* I just came across this thread while looking for a solution for denying all zip archived .js files. So yes, changing the default would be good. Also, is there a way to make explicitly sure that we just trash any zip encoded js files? [edit: It seems that starts to happen once the setting is c...

Perhaps you could provide a bit more information?

How do you think you are integrating with Active Directory?

I'll call that a win!

areid, can you post the log messages showing the "throttling". That might refresh my memory and help me locate the problem. I've found the following posts that may be relevant: [solved] can I avoid the greylist by incoming network ip? https://forum.efa-project.org/viewtopic.php?f=5&t=9...

I did? I've forgotten. Let me have a look.