efa-project.org

Hi there, Is there a possibility to search in the messages? Somtimes we have a false positive and we need to look it up in mailWatch, but that really takes a lot of time to click through a lot of pages. Is there a find or, even better, a filtered view? Filter on receiving user or domain, etc... Than...

sorry about my lame reply! If you need some help, sure I can help. My problem tough was unrelated after all. I used a heavy body check from postfix whish caused the sluggyness. Things are up to speed now. However, if you need some help in testing things, just drop me a line, I ll see what I can do. ...

sorry, already found it!

Hi All,
Can I somehow find messages from or to a certain user in MailWatch or the raw quaratine on disk? Or is this a matter from going through the maillog, find the messageID and take it from there?
Grtz,\
Ronald

This was 100% on my end, I added an exhaustive body_check in postfix and that screwed it up. It works fine now. Only 2GB max usage and max 20% CPU load (on 4 CPUs). So this is good.

Hola,

Can you please upgrade postfix to 3.1.3? I think I have hit an ldap lookup problem in 3.0.4. My system is very sluggish, I think due to the current postfix version deployed in EFA.
Or can you explain how to upgrade to 3.1.3? The efa repo only has 3.0.4 ...

Thanks!
Ronald

if anyone can do a sanity check on these snippets of my main.cf: # tarpit control smtpd_error_sleep_time = 10 smtpd_soft_error_limit = 2 smtpd_hard_error_limit = 2 smtpd_junk_command_limit = 2 smtpd_recipient_overshoot_limit = 100 # smtpd restrictions smtpd_data_restrictions = reject_unauth_pipelini...

Hi All, I experience a huge memory and cpu load on my EFA box. It is the cleanup process of postfix that is responsible for this. I also notice the MailScanner process taking sometime a full core (99% cpu). I have no clue why, it is a rather greenfield deployment. Can someone please help me out? I c...

Hola, I have some scanners and some Outlook users that do want to use SASL to be able to send mail. However, seems tcp/465 and 587 along with the specific stuff to make it work in EFA are not configured. for details see http://www.postfix.org/TLS_README.html I enabled this is master.cf and main.cf, ...

I m interested, vt slso intercepted my 0 days, that were slipping through in efa as it is now. Wonder about reliability and costs though..

Hola, Can you also use LDAP for SASL auth? So auth plain sasl is querying AD instead of the local users of the system? I got sasl working now with dovecot and that works fine with local users. No GUI needed, as long as the configs survive an upgrade. I used webmin and all my config was screwed up. G...

Hola, Maybe a nice feature would be to allow sasl authenticated users, but against Windows AD (LDAP) accounts. Then accounts are managed at a central location, which you can also delegate, which reliefs me from maintenance burdens... So the appliance stays stateless. Just some config files which you...

Hola, Just a question how things are organised here, I do have a lot of customization work in main.cf, MailScanner.conf, etc. Also got my ExtremeShok unofficial sigs running. I never used the GUIs to configure something, I like a shell =) What is an upgrade doing? Is it messing up basic config files...

ack, it's very simple.

Will have a look @ sophos. My sigs: [root@sys-efa01 ~]# clamscan --debug 2>&1 /dev/null | grep "loaded" LibClamAV debug: /var/lib/clamav/sigwhitelist.ign2 loaded LibClamAV debug: /var/lib/clamav/securiteinfo.ign2 loaded LibClamAV debug: daily.info loaded LibClamAV debug: daily.cfg load...

Thanks for the analysis offer, but how can I send it? It might be caught along the way. What's the plan?
Grtz!

Hi all, Lately we are bombed with .doc attachments containing ransomware malware. I tested it out on efa3014 with unofficial sigs (free versions) included, but they got through anyway. Checking on virustotal.com, all big commercial guys detected the virus. F-Secure, Fortinet, Ikarus, McAfee, Qihoo-3...

Allrighty, found out myself, just follow the instuctions on https://github.com/extremeshok/clamav-unofficial-sigs
Just the scripts were in 3.0.1.4 but not configured, since the auth keys need to be individually.
It seems to work.
Cheerz!

Hola, Maybe I should post this question here. I do extremely welcome the Unofficial SIGS of ExtremeShok (v3.0.1.4), but how can I tell if the SIGS are used by ClamAV? There is a log file location for it (/var/log/clamav-unofficial), but that's empty and I do not see anything related in maillog or cl...

Hi, As you are all maybe aware, but thought it might be worth mentioning, postfix as of version 2.10 supports the proxy protocol, so the original source IP is sent from the load balancer to postfix. This will make sure spamassassin works with the original source IP instead of the local balancers nod...

Hey any1, My first question, hence my 1st post. I do extremely welcome the Unofficial SIGS part of ExtremeShok, but how can I tell if the SIGS are added to ClamAV? There is a log file location for it, but that's empty and I do not see anything related in maillog or clamd.log (or freshclam log). I ha...

Hi guys and maybe girls, I am owner / engineer of a dutch based full service ASP and of course, mail is a challenge. I was busy puzzling all these pieces together myself when I stumbled upon this project. Looks like it is exactly doing what I was looking for and even more. So that's gr8. So hope to ...