HOWTO: Upgrade layer1 MailScanner

[icanectc]

Thanks guys! You all rock!

 

[equens]

Hello, I want to install Mailscanner + ClamAV in a new server. What do you think is best, install layer1 MailScanner 1.5 and update it or install only new versions?

1º I think that it is the moment to do a new layer for MailScanner and ClamAV, or to do a new version of howto install both step by step, but I dont have all the knowledges.

2º The cpanelplus howto is good but does not include the instalation of ClamAV.

3º Cpanelhosts offers a howto with clamavmodule???

Related links:
http://forum.cpanelhosts.com/index.php?act=ST&f=2&t=299

http://www.cpanelplus.com/home/content/view/3/

 

[Dreamer]

I think there was an how to on how to upgrade the installation only. Then you can install it and feel fresh enough. Something more, I believe someone have made an updated package. Search around

 

[equens]

I can´t see any updated package here, perhaps do you know where is it? If no one has made a new howto, I will post it here in few days, because I don't have your experience, I will read all instrucctions to make a new step by step to install ClamAV and Mailscanner with last versions :-(

 

[chirpy]

The first post in this thread is continually updated by me to upgrade from the layer1 install (and any subsequent upgrade) to the latest release, maintaing your settings.

Updating ClamAV is simple:

Pop over to their website and download the latest version:
http://prdownloads.sourceforge.net/clamav
Latest is clamav-0.70.tar.gz

Then on the server:
tar -xzf clamav-0.70.tar.gz
cd clamav-0.70
./configure
make
make install

That's it.

 

[equens]

Thanks chirpy!! and sorry, I thought that the first post was obsolete... [edited updated for latest release of MailScanner 3 May 2004] thanks again

 

[dory36]

I'm running the current release (4.31.1), and am now getting defunct jobs -- although everything seems to be working fine otherwise.

Any suggestions?

23714 ? SN 0:01 /usr/bin/perl -I/usr/mailscanner/lib /usr/mailscanner/bin/MailSc
anner /usr/mailscanner/etc/MailScanner.conf
23731 ? SN 0:01 /usr/bin/perl -I/usr/mailscanner/lib /usr/mailscanner/bin/MailSc
anner /usr/mailscanner/etc/MailScanner.conf
24095 ? SN 0:01 /usr/bin/perl -I/usr/mailscanner/lib /usr/mailscanner/bin/MailSc
anner /usr/mailscanner/etc/MailScanner.conf
24113 ? SN 0:02 /usr/bin/perl -I/usr/mailscanner/lib /usr/mailscanner/bin/MailSc
anner /usr/mailscanner/etc/MailScanner.conf
20123 ? ZN 0:00 [MailScanner <defunct>]
20555 ? ZN 0:00 [MailScanner <defunct>]
20581 ? ZN 0:00 [MailScanner <defunct>]
21265 ? ZN 0:00 [MailScanner <defunct>]
21289 ? ZN 0:00 [MailScanner <defunct>]

 

[chirpy]

I should have mentioned...they're perfectly normal and you can safely ignore them.

From: http://www.sng.ecs.soton.ac.uk/mailscanner/#news

16/3/2004 Released unstable version 4.29.1-1. Fix for passing archives through properly when allowing all password-protected archives. Minor speed-ups. Expect to see "defunct" processes appear with this version, it is quite normal.

 

[equens]

Help with Mailscanner

Hello, I have installed layer1 MailScanner and upgraded with chirpy instructions and all runnig well, there are only two problems:

I cant do "service MailScanner restart" MailScanner: unrecognized service.

And I can´t stop Mailscanner Warning Attachment. I set the Warning Is Attachment to no in my MailScanner.conf but all emails allways have in-line warning and Warning Attachment.

# When a virus or attachment is replaced by a plain-text warning, should the warning be in an attachment? If "no" then it will be placed in-line.

Warning Is Attachment = no

What must I do to stop the Attachment? Thanks

 

[icanectc]

Much easier to start and stop MailScanner using init.d


/etc/init.d/MailScanner stop
/etc/init.d/MailScanner start
/etc/init.d/MailScanner restart

voila!

I will have to check my conf file when I get home.. But there should be an option to now allow for attachments alltogether.. Ill check and post.

 

[chirpy]

The layer1 installation does not install the init script, so you cannot use either "service mailscanner" or /etc/init.d/mailscanner.

Here's a script that I use:

#!/bin/sh
killall MailScanner
sleep 8
/usr/mailscanner/bin/check_mailscanner

I would guess that the warning attachment change is not working because you haven't stopped and restarted MailScanner.

 

[equens]

/etc/init.d/MailScanner restart
-bash: /etc/init.d/MailScanner: No such file or directory :-((

Someone has this problem?

1º I configure MailScanner.conf
# pico /usr/mailscanner/etc/MailScanner.conf

2º Parametres
Notify Senders Of Viruses = no
Notify Senders Of Blocked Filenames Or Filetypes = no
Notify Senders Of Other Blocked Content = no
Never Notify Senders Of Precedence = list bulk
Warning Is Attachment = no
Attachment Warning Filename = VirusWarning.txt

3º Restart Mailscanner
killall MailScanner
wait a minute
/usr/mailscanner/bin/check_mailscanner

4º Eicar test
I send Eicar test and I receive email with in-line warning and warning attachment... and I receive two alerts, one in sender email, and other one in destination email.

Thanks!

 

[damainman]

what would cause this error:


[email protected][/usr/mailscanner.new/etc]# perl -pi -e "s/\/opt\/MailScanner/\/usr\/mailscanner/g" /usr/mailscanner.new/lib/*
Can't do inplace edit: /usr/mailscanner.new/lib/MailScanner is not a regular file, <> line 2537.

[email protected][/usr/mailscanner.new/etc]# perl -pi -e "s/\/opt\/MailScanner/\/usr\/mailscanner/g" /usr/mailscanner.new/lib/MailScanner/*
Can't do inplace edit: /usr/mailscanner.new/lib/MailScanner/CustomFunctions is not a regular file, <> line 5083.

 

[chirpy]

Don't worry about those two errors - they happen because the substitute is on all the files within the directory which includes a couple of sub-directories and you can't do that on a subdir file It does no harm and you can safely ignore them.

 

[chirpy]

I send Eicar test and I receive email with in-line warning and warning attachment... and I receive two alerts, one in sender email, and other one in destination email.

How did you send the eicar test - was it in a normal text email, or was it in an html email or was the eicar string in an attached text file?

Do you have SpamAssassin disabled in WHM > Tweak Settings, or do you have it enabled?

 

[anand]

Instead of the mailscanner and living with its high cpu usage you might wanna try this

http://forums.cpanel.net/showthread.php?s=&threadid=24541

 

[chirpy]

high cpu usage

I'm managing MailScanner on many servers and have never had a problem with high CPU usage despite high mail loads. It's generally a matter of configuring it correctly and making sure you use ClamAV appropriately.

I've had it running on 2 RaQ4's (350Mhz CPU's with 128MB RAM) with no problems.

But, as you say, if your server is somewhat overloaded to start with, you may well experience issues and there are , of course, other solutions. I do think, however, that you'll find it hard to beat MailScanner for its feature set and simple configurability and scalability.

 

[anand]

Originally posted by chirpy
I'm managing MailScanner on many servers and have never had a problem with high CPU usage despite high mail loads. It's generally a matter of configuring it correctly and making sure you use ClamAV appropriately.

I've had it running on 2 RaQ4's (350Mhz CPU's with 128MB RAM) with no problems.

But, as you say, if your server is somewhat overloaded to start with, you may well experience issues and there are , of course, other solutions. I do think, however, that you'll find it hard to beat MailScanner for its feature set and simple configurability and scalability.

With a PIV 2.4Ghz, 1GB Ram and 20-30k mails a day mailscanner kills the box. You are probably one of those lucky ones who is not facing this problem. Whereever i have seen i have seen mailscanner heavy on the cpu. Anyways its good to know atleast for someone it works properly.

As for cnofiguration and scalibility, the fact that virus mails and malware attachment mails don't enter the mailq and clog it, seems to be itself a huge solution.

Anyways its just a matter of opinion and usage. Some would prefer mailscanner (as it is a excellent piece of stuff), some will prefer the new exiscan method (where they have less cpu and memory to devote to this work).

 

[equens]

Hi Chirpy,

How did you send the eicar test - was it in a normal text email, or was it in an html email or was the eicar string in an attached text file?
-----------
Attached in .zip file

Do you have SpamAssassin disabled in WHM > Tweak Settings, or do you have it enabled?
----------
Yes, I have SpamAssassin enabled but not activated in MailScanner.conf

 

[chirpy]

I asked because that way cPanel have integrated SA with exim all emails are actually delivered twice, so MailScanner runs against each mail twice too. That could be an explaination. To avoid that, you have to disable SA in WHM and only use it through MailScanner. If that's not an option, then it is something you may have to live with (or defect to exiscan )