Scalix & Amavisd-New HOWTO - Wiki updated

[chris78]

Ok this ist from ../mail.err:

Code: Select all

Jun  7 19:36:52 server amavis[3982]: No $dspam,             not using it
Jun  7 19:39:52 server amavis-milter[5475]: k57Hc61M004123: (mlfi_eom) failed to send() Sender: Broken pipe
Jun  7 19:39:52 server amavis-milter[5475]: k57Hc61M004123: (mlfi_eom) communication failure
Jun  7 19:39:54 server amavis[4149]: No $dspam,             not using it
Jun  7 19:48:12 server amavis[4152]: Child task exceeded 480 seconds, abort
Jun  7 19:48:12 server amavis[4152]: Requesting process rundown after fatal error
Jun  7 19:48:12 server amavis-milter[5475]: k57He9rE004155: (mlfi_eom) failed to send() Sender: Broken pipe
Jun  7 19:48:12 server amavis-milter[5475]: k57He9rE004155: (mlfi_eom) communication failure
Jun  7 19:55:30 server amavis-milter[5475]: k57HtS0v004265: (mlfi_eom) failed to connect(): Connection refused
Jun  7 19:55:30 server amavis-milter[5475]: k57HtS0v004265: (mlfi_eom) communication failure


mail.warn:

Code: Select all

Jun  7 16:08:11 server amavis[3225]: Requesting process rundown after fatal error
Jun  7 19:36:52 server amavis[3982]: No $dspam,             not using it
Jun  7 19:39:54 server amavis[4149]: No $dspam,             not using it
Jun  7 19:48:12 server amavis[4152]: Requesting process rundown after fatal error


mail.info:

Code: Select all

Jun  7 19:54:56 server sendmail[4257]: starting daemon (8.13.4): SMTP+queueing@00:30:00
Jun  7 19:54:56 server sendmail-client[4262]: starting daemon (8.13.4): persistent-queueing@00:01:00
Jun  7 19:55:30 server sendmail[4265]: k57HtS0v004265: from=<chris@server.ath.cx>, size=348, class=0, nrcpts=1, msgid=<200606071939.43746.chris@server.ath.cx>, proto=ESMTP, daemon=MTA, relay=[192.168.178.88]
Jun  7 19:55:30 server sendmail[4265]: k57HtS0v004265: Milter: data, reject=451 4.3.2 Please try again later
Jun  7 19:55:30 server sendmail[4265]: k57HtS0v004265: to=<chrisxxxx@t-online.de>, delay=00:00:00, pri=30348, stat=Please try again later

[/quote]

[btisdall]

It looks as if there's no communication between amavisd-milter & amavisd-new - this would cause sendmail to reject the mail.

Can you post the output of:

Code: Select all

ps aux | grep amavisd

Code: Select all

ls -l /var/amavis

(you may need to substitute /var/amavis with whatever the value of $MYHOME is in amavisd.conf)

Code: Select all

head -n60 /etc/amavisd.conf

[chris78]

Code: Select all

server:/etc # ps aux | grep amavisd
vscan     5954  0.2  8.9  44384 40188 ?        Ss   08:51   0:00 amavisd (master)
vscan     5957  0.0  8.9  45120 40272 ?        S    08:51   0:00 amavisd (virgin child)
vscan     5958  0.0  8.9  45120 40280 ?        S    08:51   0:00 amavisd (virgin child)
root      5995  0.0  0.1   1856   604 pts/3    R+   08:56   0:00 grep amavisd



server:/etc # ls -l /var/spool/amavis/
total 4
drwx------   9 vscan root  400 Jun  8 08:51 .
drwxr-xr-x  13 root  root  344 Jun  6 19:59 ..
drwx------   2 vscan vscan 144 Jun  8 08:51 .spamassassin
drwxr-x---   3 vscan vscan 104 Jun  6 20:18 amavis-milter-k56IHwib023083
drwxr-x---   3 vscan vscan 104 Jun  6 20:18 amavis-milter-k56IIYpM023086
drwxr-x---   3 vscan vscan 104 Jun  6 23:10 amavis-milter-k56LAPRH007202
-rw-r-----   1 vscan vscan   0 Jun  8 08:51 amavisd.lock
-rw-r-----   1 vscan vscan   5 Jun  8 08:51 amavisd.pid
srwxr-x---   1 vscan vscan   0 Jun  8 08:51 amavisd.sock
drwx------   2 vscan root  224 Jun  8 08:51 db
drwx------   2 vscan root   48 Sep 13  2005 tmp
drwx------   2 vscan root   88 Sep 13  2005 virusmails

# a minimalistic configuration file for amavisd-new with all necessary settings
#
#   see amavisd.conf-default for a list of all variables with their defaults;
#   see amavisd.conf-sample for a traditional-style commented file;
#   for more details see documentation in INSTALL, README_FILES/*
#   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
$protocol = "AM.PDP"; # Use AM.PDP protocol.

# COMMONLY ADJUSTED SETTINGS:

# @bypass_virus_checks_maps = (1);  # uncomment to DISABLE anti-virus code
# @bypass_spam_checks_maps  = (1);  # uncomment to DISABLE anti-spam code

$max_servers = 2;            # number of pre-forked children (2..15 is common)
$daemon_user = 'vscan';
$daemon_group = 'vscan';

$mydomain = 'ath.cx';   # a convenient default for other settings

$MYHOME = '/var/spool/amavis';
$TEMPBASE = "$MYHOME/tmp";   # working directory, needs to be created manually
$ENV{TMPDIR} = $TEMPBASE;    # environment variable TMPDIR
$QUARANTINEDIR = '/var/spool/amavis/virusmails';
# $quarantine_subdir_levels = 1;  # add level of subdirs to disperse quarantine

# $daemon_chroot_dir = $MYHOME;   # chroot directory or undef

# $db_home   = "$MYHOME/db";
# $helpers_home = "$MYHOME/var";  # prefer $MYHOME clean and owned by root?
# $pid_file  = "$MYHOME/var/amavisd.pid";
# $lock_file = "$MYHOME/var/amavisd.lock";
#NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually

@local_domains_maps = ( [".$mydomain"] );
# @mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
#                   10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 );

$log_level = 0;              # verbosity 0..5
$log_recip_templ = undef;    # disable by-recipient level-0 log entries
$DO_SYSLOG = 1;              # log via syslogd (preferred)
$SYSLOG_LEVEL = 'mail.debug';

$enable_db = 1;              # enable use of BerkeleyDB/libdb (SNMP and nanny)
$enable_global_cache = 1;    # enable use of libdb-based cache if $enable_db=1

#$inet_socket_port = 10024;   # listen on this local TCP port(s) (see $protocol)
$unix_socketname = "$MYHOME/amavisd.sock";  # when using sendmail milter

$sa_tag_level_deflt  = undef;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 3.4;
#$sa_kill_level_deflt = 6.31; # triggers spam evasive actions
#$sa_dsn_cutoff_level = 9;    # spam level beyond which a DSN is not sent
## $sa_quarantine_cutoff_level = 20; # spam level beyond which quarantine is off
$sa_spam_subject_tag = '[SPAM] ';
#$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
#$sa_local_tests_only = 0;    # only tests which do not require internet access?
#$sa_auto_whitelist = 1;      # turn on AWL in SA 2.63 or older (irrelevant
                             # for SA 3.0, cf option is 'use_auto_whitelist')


[btisdall]

Ok, the first thing is that amavisd-milter isn't running, either because you're not starting it or it's dying.

Check the init. script's been enabled & you have the proper values in /etc/sysconfig/amavisd-milter.

I note that on your amavisd-new installation $MYHOME is /var/spool/amavis so the value of AMAVISD_HOME in /etc/sysconfig/amavisd-milter must match that.

[chris78]

I could not find the file /etc/sysconfig/amavisd-milter.
only /etc/sysconfig/amavis

in in the file is enable amavisd-milter
USE_AMAVIS="yes"

## Type: yesno
## Default: "no"
#
# Use sendmail and it's milter interface (that will start an additional
# process called amavis-milter
#
AMAVIS_SENDMAIL_MILTER="yes"

and if i make a rcamavis restart
Shutting down virus-scanner (amavisd-new): done
Shutting down amavis-milter: done
Starting virus-scanner (amavisd-new): done
Starting amavis-milter: done


I sit possible tsh I have an error in sendmail.cf..?
Xmilter-amavis, S=local:/var/run/amavis/amavis-milter.sock, T=S:10m;R:10m;E:10m

[btisdall]

Chris,

before we debug any further, it sounds as if you're using using the old milter which isn't much good.

Have you compiled & installed amavisd-milter as per the howto?

What does

Code: Select all

rpm -qa | grep amavis

Give?

As is made clear I haven't tested this setup on SuSE (though I'm working towards that) so you're something of a guinea-pig I'm afraid.

[chris78]

I have installed amavisd-new-2.3.3-5...
I have installed amavisd-militer like the description in Howto

Code: Select all

Making install in compat
make[1]: Entering directory `/usr/local/src/amavisd-milter-1.1.2/compat'
make[2]: Entering directory `/usr/local/src/amavisd-milter-1.1.2/compat'
make[2]: Nothing to be done for `install-exec-am'.
make[2]: Nothing to be done for `install-data-am'.
make[2]: Leaving directory `/usr/local/src/amavisd-milter-1.1.2/compat'
make[1]: Leaving directory `/usr/local/src/amavisd-milter-1.1.2/compat'
Making install in amavisd-milter
make[1]: Entering directory `/usr/local/src/amavisd-milter-1.1.2/amavisd-milter'
make[2]: Entering directory `/usr/local/src/amavisd-milter-1.1.2/amavisd-milter'
test -z "/usr/local/sbin" || mkdir -p -- "/usr/local/sbin"
  /usr/bin/install -c 'amavisd-milter' '/usr/local/sbin/amavisd-milter'
test -z "/usr/local/man/man8" || mkdir -p -- "/usr/local/man/man8"
 /usr/bin/install -c -m 644 './amavisd-milter.8' '/usr/local/man/man8/amavisd-milter.8'
make[2]: Leaving directory `/usr/local/src/amavisd-milter-1.1.2/amavisd-milter'
make[1]: Leaving directory `/usr/local/src/amavisd-milter-1.1.2/amavisd-milter'
make[1]: Entering directory `/usr/local/src/amavisd-milter-1.1.2'
make[2]: Entering directory `/usr/local/src/amavisd-milter-1.1.2'
make[2]: Nothing to be done for `install-exec-am'.
make[2]: Nothing to be done for `install-data-am'.
make[2]: Leaving directory `/usr/local/src/amavisd-milter-1.1.2'
make[1]: Leaving directory `/usr/local/src/amavisd-milter-1.1.2'


but it doesn`t copy a the file in /etc/sysconfig/amavisd-militer

[btisdall]

I have installed amavisd-new-2.3.3-5...
I have installed amavisd-militer like the description in Howto [...]
but it doesn`t copy a the file in /etc/sysconfig/amavisd-militer

It won't, all this particular 'make install' does is copy the binary to a suitable place. You need to install the amavisd-milter init. & sysconfig scripts provided in the howto section 6 (just the first two scripts). Make sure you set the value of AMAVISD_HOME correctly in the sysconfig script.

I would also advise the following setting in your /etc/sysconfig/amavis:

Code: Select all

AMAVIS_SENDMAIL_MILTER="no"

Becuase that line tries to start the old version of the milter, which you don't want (& don't have installed, I suspect).

Finally, adjust the line in your sendmail.cf to read:

Xmilter-amavis, S=local:/var/spool/amavisd-milter.sock, T=S:10m;R:10m;E:10m

Start everything up & you should be there, or at least close...

[chris78]

ok I have download the script.
now i have folow error

Code: Select all

/etc/init.d/amavisd-milter start
/etc/init.d/amavisd-milter: line 9: /etc/rc.d/init.d/functions: No such file or directory
/etc/sysconfig/amavisd-milter: line 13: sendmail.cf: command not found
Starting Amavisd Milter Interface (amavisd-milter): /etc/init.d/amavisd-milter: line 36: daemon: command not found


I could not find this file /etc/rc.d/init.d/functions ..

Were is this file by SuSe..?

[chris78]

OK I have found a path, I don`t know thats th right but the errormessage is away...
from /lib/lsb/init-functions to source /etc/rc.d/init.d/functions

But this message is remained
Starting Amavisd Milter Interface (amavisd-milter): /etc/init.d/amavisd-milter: line 38: daemon: command not found

[btisdall]

Ok, I've finally got SuSE 10.0-OSS up & running here, there are few things you'll need to tweak to get amavisd-new going - I'll add this stuff to the wiki as soon as I can:

Regenerating sendmail.cf from sendmail.mc worked fine for me, except the file is actually /etc/mail/linux.mc and sendmail.cf is in /etc, meaning the build command is:

Code: Select all

sh -c "m4 /etc/mail/linux.mc > /etc/sendmail.cf"

Next, add the following lines to /etc/sysconfig/amavisd-milter:

Code: Select all

### User that amavisd-milter will run as.
AMAVISD_MILTER_USER="vscan"

And then use this as your init. script:

Code: Select all

#! /bin/sh
# Copyright (c) 1995-2004 SUSE Linux AG, Nuernberg, Germany.
# All rights reserved.
#
# Author: Kurt Garloff
# Please send feedback to http://www.suse.de/feedback/
#
# /etc/init.d/amavisd-milter
#   and its symbolic link
# /(usr/)sbin/rcamavisd-milter
#
### BEGIN INIT INFO
# Provides:          amavisd-milter
# Required-Start:    $syslog $remote_fs
# Should-Start: $time ypbind sendmail
# Required-Stop:     $syslog $remote_fs
# Should-Stop: $time ypbind sendmail
# Default-Start:     3 5
# Default-Stop:      0 1 2 6
# Short-Description: amavisd-milter interface
# Description:       Start amavisd-milter to allow scanning of mail by amavisd-new

# Check for existence of needed config file and read it
AMAVISD_MILTER_CONFIG=/etc/sysconfig/amavisd-milter
test -r $AMAVISD_MILTER_CONFIG || { echo "$AMAVISD_MILTER_CONFIG not existing";
   if [ "$1" = "stop" ]; then exit 0;
   else exit 6; fi; }

# Read config   
. $AMAVISD_MILTER_CONFIG

#Check we have the binary (set in config)
AMAVISD_MILTER_BIN=$MILTER
test -x $AMAVISD_MILTER_BIN || { echo "$AMAVISD_MILTER_BIN not installed";
   if [ "$1" = "stop" ]; then exit 0;
   else exit 5; fi; }

# Shell functions sourced from /etc/rc.status:
#      rc_check         check and set local and overall rc status
#      rc_status        check and set local and overall rc status
#      rc_status -v     be verbose in local rc status and clear it afterwards
#      rc_status -v -r  ditto and clear both the local and overall rc status
#      rc_status -s     display "skipped" and exit with status 3
#      rc_status -u     display "unused" and exit with status 3
#      rc_failed        set local and overall rc status to failed
#      rc_failed <num>  set local and overall rc status to <num>
#      rc_reset         clear both the local and overall rc status
#      rc_exit          exit appropriate to overall rc status
#      rc_active        checks whether a service is activated by symlinks
. /etc/rc.status

# Reset status of this service
rc_reset

# Return values acc. to LSB for all commands but status:
# 0     - success
# 1       - generic or unspecified error
# 2       - invalid or excess argument(s)
# 3       - unimplemented feature (e.g. "reload")
# 4       - user had insufficient privileges
# 5       - program is not installed
# 6       - program is not configured
# 7       - program is not running
# 8--199  - reserved (8--99 LSB, 100--149 distrib, 150--199 appl)
#
# Note that starting an already running service, stopping
# or restarting a not-running service as well as the restart
# with force-reload (in case signaling is not supported) are
# considered a success.

case "$1" in
    start)
   echo -n "Starting amavisd-milter "
   ## Start daemon with startproc(8). If this fails
   ## the return value is set appropriately by startproc.
   /sbin/startproc -u $AMAVISD_MILTER_USER $AMAVISD_MILTER_BIN $MILTER_FLAGS

   # Remember status and be verbose
   rc_status -v
   ;;
    stop)
   echo -n "Shutting down amavisd-milter "
   ## Stop daemon with killproc(8) and if this fails
   ## killproc sets the return value according to LSB.

   /sbin/killproc -TERM $AMAVISD_MILTER_BIN

   # Remember status and be verbose
   rc_status -v
   ;;
    try-restart|condrestart)
   ## Do a restart only if the service was active before.
   ## Note: try-restart is now part of LSB (as of 1.9).
   ## RH has a similar command named condrestart.
   if test "$1" = "condrestart"; then
      echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
   fi
   $0 status
   if test $? = 0; then
      $0 restart
   else
      rc_reset   # Not running is not a failure.
   fi
   # Remember status and be quiet
   rc_status
   ;;
    restart)
   ## Stop the service and regardless of whether it was
   ## running or not, start it again.
   $0 stop
   $0 start

   # Remember status and be quiet
   rc_status
   ;;
    force-reload)
   ## Signal the daemon to reload its config. Most daemons
   ## do this on signal 1 (SIGHUP).
   ## If it does not support it, restart the service if it
   ## is running.

   echo -n "Reload service amavisd-milter "
   ## if it supports it:
   /sbin/killproc -HUP $AMAVISD_MILTER_BIN
   #touch /var/run/amavisd-milter.pid
   rc_status -v

   ## Otherwise:
   #$0 try-restart
   #rc_status
   ;;
    reload)
   ## Like force-reload, but if daemon does not support
   ## signaling, do nothing (!)

   # If it supports signaling:
   echo -n "Reload service amavisd-milter "
   /sbin/killproc -HUP $AMAVISD_MILTER_BIN
   #touch /var/run/amavisd-milter.pid
   rc_status -v
   
   ## Otherwise if it does not support reload:
   #rc_failed 3
   #rc_status -v
   ;;
    status)
   echo -n "Checking for service amavisd-milter "
   ## Check status with checkproc(8), if process is running
   ## checkproc will return with exit status 0.

   # Return value is slightly different for the status command:
   # 0 - service up and running
   # 1 - service dead, but /var/run/  pid  file exists
   # 2 - service dead, but /var/lock/ lock file exists
   # 3 - service not running (unused)
   # 4 - service status unknown  :-(
   # 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.)
   
   # NOTE: checkproc returns LSB compliant status values.
   /sbin/checkproc $AMAVISD_MILTER_BIN
   # NOTE: rc_status knows that we called this init script with
   # "status" option and adapts its messages accordingly.
   rc_status -v
   ;;
    probe)
   ## Optional: Probe for the necessity of a reload, print out the
   ## argument to this init script which is required for a reload.
   ## Note: probe is not (yet) part of LSB (as of 1.9)

   test /etc/amavisd-milter/amavisd-milter.conf -nt /var/run/amavisd-milter.pid && echo reload
   ;;
    *)
   echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
   exit 1
   ;;
esac
rc_exit

This should work, but expect some tweaks/cleanups as I play with SuSE some more.

[jdell]

BTisdall,

Thanks so much for this! This article is a godsend. I really like amavisd-new and have used it with postfix before, but I'm new to sendmail ;-) I have got things setup and basically working (CentOS 4), but not completely happy with it yet.

Also, FYI, I found a typo in the path to smtpd.cfg in the wiki that I fixed

The problem is, I want the intended recipient to receive a notification email when a virus is blocked (this works with postfix/amavisd-new)

Relevant amavisd.conf settings:
$warnvirusrecip = 1;
$notify_virus_recips_templ= read_text("$MYHOME/notify_virus_recip_template.txt");
$final_virus_destiny = D_DISCARD;

First off, the ${sender} being set in amavisd.conf by $mailfrom_notify_recip is throwing a warning. Is this normal?

Second, does the $warnvirusrecip work with amavisd-new/Milter?

Third, when an email is discarded, does it still say 'accepted for delivery' like below? (I didn't receive any email despite what the log says. When I send a non-virus infected email it arrives fine.

Thanks for any help!

Regards,
John

Here is relevant part of log:
Jun 8 16:45:07 scalix sendmail[4866]: k58Nj7tu004866: Authentication-Warning: scalix.marilynyork.net: amavis set sender to virus_alert@marilynyork.net using -f
Jun 8 16:45:07 scalix sendmail[4866]: k58Nj7tu004866: from=virus_alert@marilynyork.net, size=1450, class=0, nrcpts=1, msgid=<VR04847@scalix.marilynyork.net>, relay=amavis@localhost
Jun 8 16:45:07 scalix sendmail[4866]: k58Nj7tu004866: to=jdell@marilynyork.net, delay=00:00:00, mailer=esmtp, pri=31450, dsn=4.4.3, stat=queued
Jun 8 16:45:07 scalix amavis[4847]: (04847) Blocked INFECTED (Eicar-Test-Signature), AM.PDP-SOCK LOCAL [127.0.0.1] <jdell@marilynyork.net> -> <jdell@marilynyork.net>, Queue-ID: k58Nj7IW004859, Message-ID: <9412817.1149810307086.JavaMail.root@scalix.marilynyork.net>, mail_id: cL43XW5Dbxci, Hits: -, 228 ms
Jun 8 16:45:07 scalix sendmail[4859]: k58Nj7IW004859: Milter: data, discard
Jun 8 16:45:07 scalix sendmail[4859]: k58Nj7IW004859: discarded
Jun 8 16:45:07 scalix sendmail[4858]: k58Nj76X004858: to=<jdell@marilynyork.net>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=35864, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (k58Nj7IW004859 Message accepted for delivery)

[jdell]

BTisdall,

Second, does the $warnvirusrecip work with amavisd-new/Milter?

Ok, well, I just received about 10 emails about virus warnings. Having re-read the how-to, I see that I missed the part about QUEUE=1m.

If only I knew what RTFM meant... :-)

Thanks again for the how-to :-)

Regards,
John

[chris78]

The apparently never ending storry Amavis vs. scalix is going to End.. Thank you for your great help. Everithing runs great!!!
:D

[btisdall]

Great! Really happy it worked for you, just one more bit of work for you to keep your installation as secure as possible:

After further testing it turns out that adding the mail user to the vscan group and changing the ownership/perms on /var/spool/amavis wasn't necessary (it was late...).

I've removed those steps from the post, you should really undo them by doing:

Code: Select all

usermod -R vscan mail
chmod 0700 /var/spool/amavis
chown vscan:root /var/spool/amavis

Then restart amavisd-milter, amavis & sendmail and re-test.