efa-project.org

Bump it up to 2 days. 1 day you won't get anything because the reports go out at around 3am. 1 day is interpreted from midnight - 3am...I had mine set at 1 day and was scratching my head for a few until I realized this.

Cron job is in /etc/cron.daily

Oooh, that would be cool...let me think about how to accomplish this...

When an email is flagged as MCP, it is set to store-mcp in this example but not deliver the mail.

Is this what is happening? Or is all mail not being delivered?

Yep, I know what you are describing. Barracuda works this way. Currently this is not possible but might be in a future update. We would need to somehow instruct MailWatch to create user accounts based on incoming destinations and verify that they exist. Right now, though, you can bind MailWatch to y...

That's an interesting idea. The problem is that you don't want to assume that every email sent to a honeypot is spam, because some of it may not be. So I am not sure how this would work.

Spam assassin has an auto learn feature already built-in, though.

For recipients, you may be able to disable all notifications by removing the report definitions. Note that I have not tried this. Back up your config before emptying these entries. Rejection Report = %report-dir%/rejection.report.txt # Set where to find the message text sent to users when one of the...

Actually, it may be better to specify an RBL in postfix and stop the email from entering the system...

Here's the default in /etc/postfix/main.cf for zen.spamhaus.org...

Code: Select all

smtpd_client_restrictions = permit_sasl_authenticated, reject_rbl_client zen.spamhaus.org

in the to field, you need the word "default" to make a global whitelist entry.

Hmm....this may be related to a postfix update that occurred.

Try this and report the results please

Code: Select all

mkdir /var/spool/postfix/.razor
chown postfix:postfix /var/spool/postfix/.razor

I have determined that the local user does not interfere with delivery.

On my system, another user was assigned the postmaster role, so I was not receiving alerts.

Feel free to share your configuration steps and I will try to reproduce.

That seems accurate, although I have not tested it.

You can also modify the report sent. Look in /etc/MailScanner/reports/en for the reports.

Gmail and the like perform reverse lookups on your MX record. Make sure you have a public PTR record for your MX.

It is important to monitor the performance of your system under high load.

Also, a good rule of thumb is to have no more than 1-2 MailScanner children per processor. Too many MailScanner threads spawning will overload the system and things will start crashing.

Yep.

In /etc/MailScanner/MailScanner.conf

Code: Select all

Highlight Phishing Fraud = no

This will be added to EFA-Configure in an upcoming release.

This is fixed in the 3.0.0.3 update. Update to receive the latest fixes.

I am tracking another issue where it appears that if a local user on EFA is present with the same name as on the mail server, the reports are never delivered. Does this coincide with your issue?

Do you have administrator on your local EFA as a local user?

I am noticing a similar problem where I have a postmaster on my EFA, but I also have a postmaster on my mail server.

I am troubleshooting this. My theory is that EFA is not queuing it out because of the presence of the local account.

Yes, you will need to reconfigure MailScanner as follows:

In /etc/MailScanner/MailScanner.conf change the following from store to delete.

Code: Select all

High Scoring Spam Actions = delete

Code: Select all

sudo service MailScanner restart

ssh into your EFA as your user you set up initially (not root) and run Spam Settings Option 9 then Option 2

(/usr/local/sbin/EFA-Configure should run automatically upon login, if not, run this script with sudo)

Code: Select all

sudo /usr/local/sbin/EFA-Configure

Depending on the configuration, EFA sends out daily quarantine reports. Is that what you are wanting?

Yep

Look in:

/etc/MailScanner/reports/en

You'll find the signature definitions here, and they can be modified.

Wow. What does the permissions on perl look like?

/usr/bin/perl I think.

I don't know very much about Baruwa, Darky's the expert on that one. He's been very busy. I'm sure he'll chime in with some thoughts.

efa-project.org

Search found 3650 matches

Re: Change Frequency of Quarantine Reports to End Users

Re: Email Daily Reports

Re: Using MCP to block offensive content

Re: How to integrate E.F.A with Active Directory

Re: Daily Quarantine Report

Re: honeypot

Re: EFA is spamming me

Re: RBL's

Re: Whitelist isn't working

Re: message marked as spam gives a razor error

Re: Quarantine Reports not appearing in Exchange Mailbox

Re: Quarantine reports not being delivered

Re: Warning email for removed attachments

Re: EFA not receiver hotmail and gmail

Re: Archived mail with status of Other

Re: Phishing Fraud Warning

Re: permissions on postfix folders

Re: Quarantine Reports not appearing in Exchange Mailbox

Re: Quarantine reports not being delivered

Re: Restrict Archive Messages to Spam

Re: EFA is spamming me

Re: Reports via mail

Re: modify This message has been scanned by E.F.A. Project a

Re: installing vmware tools gives permission denied

Re: EFA 2 and 3