Syntax errors

Report bugs and workarounds
Post Reply
zane93
Posts: 44
Joined: 08 Mar 2016 22:08

Syntax errors

Post by zane93 »

Running 3.0.2.6
I've been getting absolutely murdered with spam lately so I started looking through config setting in efa and noticed the following errors when mailscanner was restarted but I do not see any syntax errors so a second set of eyes would be helpful.
Restarting MailScanner ...
Syntax error in first field in line 24 of ruleset /etc/MailScanner/rules/max.message.size.rules at /usr/share/MailScanner/perl/MailScanner/Config.pm line 2707
Possible syntax error on line 48 of /etc/MailScanner/archives.filename.rules.conf at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1672
Remember to separate fields with tab characters! at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1674
Possible syntax error on line 21 of /etc/MailScanner/archives.filetype.rules.conf at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1672
Remember to separate fields with tab characters! at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1674
Possible syntax error on line 22 of /etc/MailScanner/archives.filetype.rules.conf at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1672
Remember to separate fields with tab characters! at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1674
Possible syntax error on line 23 of /etc/MailScanner/archives.filetype.rules.conf at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1672
Remember to separate fields with tab characters! at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1674
Possible syntax error on line 24 of /etc/MailScanner/archives.filetype.rules.conf at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1672
Remember to separate fields with tab characters! at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1674
Possible syntax error on line 25 of /etc/MailScanner/archives.filetype.rules.conf at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1672
Remember to separate fields with tab characters! at /usr/share/MailScanner/perl/MailScanner/Config.pm line 1674
max.message.size.rules

Code: Select all

Maximum Message Size = 0
FromOrTo: default           0
lines 14-60 of archives.filename.fules.conf
Line 21 starts here deny \.ani$

Code: Select all

deny	\.fdf$			Dangerous Adobe Acrobat data-file						Opening this file can cause auto-loading of any file from the internet

# JKF 04/01/2005 More Microsoft security vulnerabilities
deny	\.ico$			Windows icon file security vulnerability					Possible buffer overflow in Windows
deny	\.ani$			Windows animated cursor file security vulnerability				Possible buffer overflow in Windows
deny	\.cur$			Windows cursor file security vulnerability					Possible buffer overflow in Windows
#deny	\.hlp$			Windows help file security vulnerability					Possible buffer overflow in Windows

# These 4 are well known viruses.
deny	pretty\s+park\.exe$	"Pretty Park" virus								"Pretty Park" virus
deny	happy99\.exe$		"Happy" virus									"Happy" virus
deny	\.ceo$		WinEvar virus attachment							Often used by the WinEvar virus
deny	webpage\.rar$	I-Worm.Yanker virus attachment							Often used by the I-Worm.Yanker virus

# JKF 08/07/2005 Several virus scanners may miss this one
deny	\.cab$			Possible malicious Microsoft cabinet file					Cabinet files may hide viruses

# These are in the archives which are Microsoft Office 2007 files (e.g. docx)
allow	\.xml\d*\.rel$		-	-
allow	\.x\d+\.rel$		-	-
allow	\.rtf$			-	-

# These are known to be mostly harmless.
allow	\.jpg$			-	-
allow	\.gif$			-	-
# .url is arguably dangerous, but I can't just ban it...
allow	\.url$			-	-
allow	\.vcf$			-	-
allow	\.txt$			-	-
allow	\.zip$			-	-
allow	\.t?gz$			-	-
allow   \.7z$			-	-
allow	\.bz2$			-	-
allow	\.Z$			-	-
allow	\.rpm$			-	-
# PGP and GPG
allow	\.gpg$			-	-
allow	\.pgp$			-	-
allow	\.sig$			-	-
allow	\.asc$			-	-
# Macintosh archives
allow	\.hqx$			-	-
allow	\.sit.bin$		-	-
allow	\.sea$			-	-
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Syntax errors

Post by pdwalker »

Remember to separate fields with tab characters!
There is your error. You are using spaces in the file instead of tab characters.

Unfortunately, they can be hard to tell apart.

If you use the vi editor for editing your files, you can type in ":set list" to see which characters are spaces and which are tabs.

Other editors, I don't know.
zane93
Posts: 44
Joined: 08 Mar 2016 22:08

Re: Syntax errors

Post by zane93 »

Thanks for the VI tip but still having an issue with

EDIT: I think I was reading this setting incorrectly and 'Maximum Message Size = 0' does not belong in this file. Is it simply refering to the "0" as unlimited at the end of the rule "FromOrTo: default 0" correct?

max.message.size.rules
Maximum Message Size = 0
Is this no longer a valid setting? It does not matter how or where I format or place the setting I receive the error
Syntax error in first field in line 24 of ruleset /etc/MailScanner/rules/max.message.size.rules at /usr/share/MailScanner/perl/MailScanner/Config.pm line 2707
/usr/share/MailScanner/perl/MailScanner/Config.pm line 2707

Code: Select all

   2697   # Syntax check and shorten fromto
   2698   $fromto = '';
   2699   if ($direction =~ /and/i) {
   2700     $fromto = 'b'; # b = both from AND to at the same time
   2701   } else {
   2702     $fromto .= 'f' if $direction =~ /from/i;
   2703     $fromto .= 't' if $direction =~ /to/i;
   2704     $fromto =  'v' if $direction =~ /virus/i;
   2705   }
   2706   if ($fromto eq '') {
   2707     MailScanner::Log::WarnLog('Syntax error in first field in line ' .
   2708       '%d of ruleset %s', $linecounter, $filename);
   2709     $errors = 1;
   2710     next;
   2711   }
   2712
henk
Posts: 517
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: Syntax errors

Post by henk »

Just remove the Maximum Message Size = 0 line

This is the default content of the file:

Code: Select all

      1 # This is an example ruleset to show how rules can have resulting values$
      2 # other than yes and no. This ruleset demonstrates having a numerical result.$
      3 # The From: and To: rules show how simple domains can be used to select$
      4 # different values for the result of the ruleset.$
      5 # Note that the fields of each rule line can be separated by any whitespace,$
      6 # any combination of tabs and spaces.$
      7 #$
      8 # The 2 lines involving domain3.com show that for email to user@domain3.com$
      9 # has a limit of 5Mbytes per message, while email to any other user$
     10 # @domain3.com has a limit of 500Kbytes per message.$
     11 #$
     12 $
     13 #To:       *@domain1.com     10M$
     14 #To:       *@domain2.com     20M$
     15 #From:     user@domain3.com   5M$
     16 #From:     *@domain3.com     500K$
     17 $
     18 #$
     19 # The following line specifies the default result used when none of the$
     20 # other rules match. In this example,$
     21 # Maximum Message Size = 0$
     22 # means that there is no limit to the size of the message.$
     23 #$
     24 $
     25 FromOrTo: default           0$
     26 $
“We are stuck with technology when what we really want is just stuff that works.” -Douglas Adams
Post Reply