Scalix Forums

I am having trouble figuring out why mails that are delivered are not passed through a milter but sent mails are passed through a milter.

I initially thought is was a problem with Spamassassin, but the same issue occurs with Mailwasher.

I am running 11.1 on SuSe 10.2
I started receiving many spam mails and wanted to filter them out.

I have spent the last 2 days trying to determine the issue and still can't figure it out.

In /var/log/mail I see the following issue...


The first section shows a mail being sent from one of my domain users.
Second second shows that the mail is being passed to the milter and then processed.
Third section shows that an external mail delivered is merely passed to the domain user's mailbox without being affected by the milter.

Apparently the milter is working because outgoing mail is being scanned, yet the inbound mail is skipped?

I seem to be skirting around the answer, and maybe I just don't know the proper questions to ask.
It looks like a problem with the sendmail, but I just can't figure out what part.

/etc/mail/linux.mc shows the following

/etc/mail/local-host-names

/etc/mail/mailertable

/etc/mail/relay-domains
*nothing*

/etc/mail/access

/var/opt/scalix/*inst*/s/sys/smtpd.cfg

I'm still looking and saw that my access and mailertable files weren't being used.
So I added the following to linux.mc

Rebuilt /etc/sendmail.cf, restarted sendmail, performed an omsendin, restarted scalix services, but results in the same thing.

I also tried the following


None of these were picked up by the milter.
However, when sending from the SWA to external@external.com the milter picked it up and scanned it.


Again, I think it must be some kind of configuration for Sendmail to be able to pick up on a different relay.
The difference I see for the successful scan are:

Hi Primordius,

SWA sends email via authenticated SMTP to the host configured in /var/opt/scalix/*/webmail/swa.properties

That should be the same inbound smtp daemon that internet email uses.

Can you confirm the setting in swa.properties? It's the value for swa.email.smtpServer=yourserver.company.com

Does the command "sendmail -v root test < /dev/null" contain any interesting information?

What happens if you send an email via telnet? Use the following sequence to send a test email:

telnet `hostname --fqdn` 25
ehlo localhost
mail from:your_addr@company.com
rcpt to: test_account@company.com
data
subject test
test
.


Does that get virus-checked according to the log?

Chris

Chris,

Thanks for your reply.
My file swa.properties shows swa.email.smtpServer=mail2.greers.org which is the internal dns name for this server.

When mail is sent through SWA, or through the Outlook Connector, it triggers the mail filter.


When executing sendmail -v root test < /dev/null I receive the following:


Using telnet:


I'm still not getting anything triggered unless I send outbound from Scalix.
Very confused.

I also noticed that Scalix to Scalix mail does not trigger a filter... only the emails that get sent through my SmartHost get triggered.
Scalix to Scalix uses relay = root@localhost
Salix to Smarthost uses relay = localhost [127.0.0.1] and daemon=Daemon0

I am having a similar problem to this one in this post. Inbound mail is not being scanned by mail filters but outbound mail is.
My settings are very similar to the ones displayed in this post.
The other thing is that incoming mail does not display in the maillog of sendmail.
I am using Scalix 11.4.3 on CentOS 5.2 with spamassassin and ClamAV.
Did this problem ever get solved?
Can some direct me where to look to get the mail filter to work for incoming mail?

SMTPFILTER=TRUE (Warning: this is listed as DEPRECATED, so bear that in mind - it may go away sometime)

Thanks, that did it.

But if in the future this will be removed, can it be noted how to correct it?

SMTPFILTER is being replaced with SMTPMILTER which will allow sendmail milters to run in the SMTP relay, so sendmail won't be needed any more for incoming mail filtering. There's documentation in the smtpd.cfg file.

I tried using

SMTPMILTER=ON

as directed in the smtpd.cfg file but it still wasn't scanning the spam and there was no logging anywhere.

Did you also define the INPUT_MAIL_FILTER? in the smtpd.cfg? Remember to take note of features acknowledged not to work yet (macros, for example).

SMTPMILTER=ON
INPUT_MAIL_FILTER=('spamassassin', 'S=local:/path/to/spamass.sock, F=, T=C:15m;S:4m;R:4m;E:10m')
INPUT_MAIL_FILTER=('clmilter','S=local:/path/to/clmilter.socket, F=, T=C:15m;S:4m;R:4m;E:10m')

is this not correct?

if this was working correctly, where is the log file that smtpd uses?
I do have another scanner but it uses S=INET:port@host to connect and I think scalix is not supporting it yet. Thanks for your help.

Having the exact same problem as described above, has there been a resolution yet for this?

Forgot to add the relevant files using MailScanner (latest) as my milter


----====Begin smtpd.cfg====----
###############################################################################
# SMTP Relay Configuration
# ########################
#
# For details please see Scalix Overview - Security
#
###############################################################################

###############################################################################
# Relay Configuration
# ###################
#
# EXTENSIONS These extensions will be advertised by the EHLO reply
# DOMAIN_NAME Local host FQDN
# LOCAL_NAMES Local aliases of DOMAIN_NAME
# MAX_HOP_COUNT If the number of Received: header lines in a message sent to
# the relay exceed this number then the message will be
# rejected by the relay. The default value is zero and any
# non-positive value is interpreted as infinity. The default
# value means that no loop detection is done by the relay,
# any loop detection will only be done by sendmail.
# GREETING This is the text after the 220 on the connection
# greeting line some tokens can be used:
# %F - FQDN, %P - protocol, %N program name,
# %V - version, %D date
# LISTEN Comma separated host:port to listen to eg.
# LISTEN=mail.example.com:25,10.100.100.1:smtp
# MAX_MESSAGE_SIZE
# The maximum message size allowed in bytes. Oversized message
# will be rejected with a 552 error. Use 0 for anysize.
# SMTPMILTER Main switch to enable/disable milter support in the Relay using
# TRUE/FALSE. Once enabled, use INPUT_MAIL_FILTER to define
# the actual milter to be used for filtering.
# Note: avoid TRUE if no milter is active to improve performance.
# INPUT_MAIL_FILTER
# Filter message using the specified milter before accepting it.
# Syntax=('<name>', 'S=<socket>, F=<fail>, T=<timeout>') where:
# <name> is milter name
# <socket> is sock name (local or unix socket only)
# <fail> is action if fail to connect milter, default is to
# skip this milter, specify T or R to tempfail message
# <timeout> is 'C:<t>;S:<t>;R:<t>;E:<t> where <t> is timeout
# for Connect, Send, Receive and End-of-message.
# e.g. =('abc', S='local:/tmp/abc, F=T, T=C:5m;S:9s;R:9s;E:5m')
# Note: upto 8 milters can be called in sequence with the
# resultant message content from one milter fed into the next,
# some milter features and protocols may not be supported,
# e.g. quarantine, add extended rcpt and set symbol list.
# MILTER_IGNORE_IP_SENDER
# Sender IP address to ignore when searching for real sender info.
# Specify one literal or wildcarded value per option line, e.g.
# '172.16.0.33' or '172.16.0.*'. The real sender is found when
# it's IP address does not match any entry in the ignore list.
# Note: upto 99 such option lines can be specified.
# MILTER_IGNORE_IP_HEADER
# Format to sscanf() all message headers for real sender info.
# Syntax='<header> %s [%s [%s [%s [%s]]]]' where '%s' are the
# format directives to extract the IP address string from the
# last field - see sscanf() C man page for more details.
# Specify one format specification per option line, e.g.
# 'Received: %s %s %s' if the IP address is in the 3rd word.
# Note: upto 99 such option lines can be specified.
# MAX_CLIENTS The maximum number of client connections allowed per Relay
# (sub)process. This may result in timeout if set too high.
# Default is 6, i.e. upto 6 clients per (sub)process.
# MAX_SUBPROCS The maximum number of Relay subprocesses allowed to run in
# addition to the main process to handle client connections
# on demand. This may result in rejection if set too low.
# Default is 15, i.e. upto 15 subprocesses + 1 main process.
#
###############################################################################


EXTENSIONS=AUTH,DSN,8BITMIME

# Uncomment the following lines to enable the Submission and LMTP listeners
#SUBMIT=ON
#LMTP=ON

###############################################################################
# Catch-all recipients
# ####################
#
# Catch-all recipients are for catching email sent to unknown users, instead
# of non-delivering the email. More than one CATCH line can be used.
#
# CATCH PATTERN RECIPIENT
#
# PATTERN can be:
# user* - any unknown address starting with user
# @domain.com - any unknown address in domain.com
# user*@domain.com - any unknown user starting with user in domain.com
# RECIPIENT
# this is the recipient email address to redirect the email to. It can
# be local or remote, but is subject to any relay rules if remote.
#
# Authentication and Anti-Spamming Measures
# #########################################
#
# Each line is of the form:
# EVENT ACTION PATTERN PATTERN...
# When an event happens the SMTP Relay checks for a matching event/pattern
# sequentially in this file. When it finds the first match, it takes the
# action specified.
#
# ######
# EVENTS
# ######
#
# AUTH_SUCCESS An attempt is made to submit a
# successfully authenticated message.
#
# AUTH_MISMATCH An attempt is made to submit a
# successfully authenticated message but
# the originator name does not match
# the authenticated name.
#
# ANONYMOUS An attempt is made to submit a message
# sent without authentication or after
# failed authentication.
#
# SUBMIT An attempt is made to submit a message from
# the host specified in pattern
#
# RELAY An attempt is made to relay a message through the SMTP Relay
#
# ORIGINATOR An attempt is made to submit a message from a user whose
# email address matches pattern
#
# RECIPIENT An attempt is made to submit a message to a user whose
# email address matches pattern
#
# #######
# ACTIONS
# #######
#
# Accept The message is unconditionally accepted and processed
# normally.
#
# Defer The message is deferred with a 400 code
#
# Discard The message is accepted but then discarded
#
# Header The message is accepted, but an extra header is inserted.
#
# Reject The message is rejected with a 500 code
#
# If Log_ added to the start of an action, then the action is also recorded
# in the SMTP Relay log file.
#
# ########
# PATTERNS
# ########
#
# Hostname Patterns
# - an IP address, eg 123.234.132.231
# - an IP subnet and mask, eg 123.234.200.0/255.255.240.0
# - a hostname, eg bert.loc.co.uk
# - the end of a domain, eg .spammer.net
# - the start of a domain, 123.234.
# - the keyword ALL matches all hosts
# - the keyword LOCAL matches all hosts that do not contain a .
#
# Email Patterns - used by ORIGINATOR and RECIPIENT
# - *@*.spam.net
#
# DNSBL Patterns - These can be used by the SUBMIT EVENT to use DNS black
# list systems (See http://en.wikipedia.org/wiki/DNSBL )
# - DNSBL,host,reply eg DNSBL,bl.spamcop.net,ALL
#
###############################################################################
SMTPMILTER=TRUE

# NB Authenticated RELAYs are always allowed
RELAY accept 127.0.0.1
RELAY accept 192.168.11.0/255.255.255.0
RELAY accept .chrisbailey.au.com
RELAY Log_Reject ALL

# extra rules added to prevent open relay usage
RECIPIENT Log_Reject *@*@*
RECIPIENT Log_Reject *%*
RECIPIENT Log_Reject *!*
RECIPIENT Log_Reject *#*@*

# set maximum message size allowed (default unlimited)
#MAX_MESSAGE_SIZE=0

# master switch to enable milter support (default off)
#SMTPMILTER=FALSE


# list of milters to call sequentially (default none)
#INPUT_MAIL_FILTER=('CTmilter', 'S=local:~/temp/CTmilter_socket, F=T, T=C:300s;S:10s;R:10s;E:300s')

# list of addresses to ignore for real sender info (default off)
#MILTER_IGNORE_IP_SENDER=<ip>

# list of formats to sscanf() message headers for real sender info
# format to scan 'Received: from domain (host [ip]) ...'
#MILTER_IGNORE_IP_HEADER=Received: %s %s %s %s
# format to scan 'Received: from domain ([ip]) ...'
#MILTER_IGNORE_IP_HEADER=Received: %s %s %s
# format to scan 'Received: from [ip] ...'
#MILTER_IGNORE_IP_HEADER=Received: %s %s

# The following group sets the configuration for the submission listener
# This listener is only active if SUBMIT=ON is above
# By default it binds to port 587


[SUBMIT]
#LISTEN=localhost:587
# Reject all anonymous connections
ANONYMOUS Log_Reject ALL



# The following group sets the configuration for the lmtp listener
# This listener is only active if LMTP=ON is above
[LMTP]
LISTEN=localhost:24
# Use the following line to listen on a unix domain socket
#LISTEN=~/tmp/lmtp.unix
----====End smtpd.cfg====----