- Users - KICTANet

Config script
by Thomas Carrie 07 Mar '11

07 Mar '11

Hello, I have written a script where you input the location of the config files involved in Exim4u config then it reports what has to be done to complete your setup. The script needs more work to support postgres and dovecot (because my setup uses mysql and courier). However the script gives simple good instruction and is small (easy to modify). Here it is : Regards -- Thomas Carrié

2 1

Re: [Exim4U] are outgoing mails scan by Clam and SA (Gordon Dickens)
by Kebba Foon 01 Mar '11

01 Mar '11

Hi Gordon, i was able to set scanning for outgoing mails our my exim4u config: here are the settings i added: on the router section at the very top i added this: spamcheck_router: # When to scan a message : # - it isn't already flagged as spam # - it isn't already scanned condition = "${if and { {!def:h_X-Spam-Flag:} {!eq {$received_protocol}{spam-scanned}}} {1}{0}}" driver = accept transport = spamcheck and then on the transport section i have this there: spamcheck: debug_print = "T: spamassassin_pipe for $local_part@$domain" driver = pipe command = /usr/sbin/exim4 -oMr spam-scanned -bS use_bsmtp transport_filter = /usr/bin/spamc home_directory = "/tmp" current_directory = "/tmp" user = Debian-exim group = Debian-exim return_fail_output message_prefix = message_suffix = This indeed scan messages and tag them, but even if it tags the messages as spam it will still send them out. is their any setting i can add on the remote_stmp transport section that it discard emails tag as spam? Thanks Kebba On Wed, 2011-02-09 at 12:00 -0500, users-request(a)exim4u.org wrote: > Re: are outgoing mails scan by Clam and SA (Gordon Dickens)

2 1

surblspamcheck
by Terry 01 Mar '11

01 Mar '11

Do I need to activate this check any where ? I can see it is configured but when I send an email with a black listed url to test it seems to gets through. No errors show in the logs. in exim.conf # exim4u: Setup Perl Startup for SURBL/URIBL Scan Checks perl_startup = do '/etc/exim/exim.pl/exim_surbl.pl' perl_at_start = true message_body_visible = 5000 message_body_newlines = true and ls -al /etc/exim/exim.pl/exim_surbl.pl -rw-r--r-- 1 root wheel 26230 Feb 15 23:35 /etc/exim/exim.pl/exim_surbl.pl It has the Enable embedded Perl interpreter enabled and I don't think it would start up with out it. Not too sure of exim cmd line options to test it further Thanks

2 2

spamassassin tag score
by Kebba Foon 27 Feb '11

27 Feb '11

Dear List, can someone explain this two files for me on the exim4u web interface: Spamassassin tag score: Spamassassin discard score: Am not exactly sure how they affect my spam checks on my server. my question is how is this value calculated and highly or lower values which has the potential to stop more spam? Thanks Kebba On Sat, 2011-02-19 at 12:00 -0500, users-request(a)exim4u.org wrote: > Send users mailing list submissions to > users(a)exim4u.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://exim4u.org/mailman/listinfo/users > or, via email, send a message with subject or body 'help' to > users-request(a)exim4u.org > > You can reach the person managing the list at > users-owner(a)exim4u.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of users digest..." > > > Today's Topics: > > 1. Re: malware acl condition: clamd: ClamAV returned > /var/spool/exim4/scan/XXXX.eml: Can't create temporary directory > ERROR (Odhiambo Washington) > 2. Re: exim as a backup MX (Gordon Dickens) > 3. Re: malware acl condition: clamd: ClamAV returned > /var/spool/exim4/scan/XXXX.eml: Can't create temporary directory > ERROR (Gordon Dickens) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 18 Feb 2011 20:24:35 +0300 > From: Odhiambo Washington <odhiambo(a)gmail.com> > Subject: Re: [Exim4U] malware acl condition: clamd: ClamAV returned > /var/spool/exim4/scan/XXXX.eml: Can't create temporary directory ERROR > To: Exim4U General Discussion <users(a)exim4u.org> > Message-ID: > <AANLkTimrdtT8o308sH6nbatEb6Y=iLGvfoQh11tHytHw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On Fri, Feb 18, 2011 at 6:52 PM, Udo Hortian <udo_hortian(a)web.de> wrote: > > > Hello Gordon, > > > > On Fri, Feb 18, 2011 at 10:07:31AM -0500, Gordon Dickens wrote: > > > That is quite strange especially since it only occurs sometimes. I can't > > > say for sure but I suspect that this is most probably a ClamAV problem. > > > Check to see if the clamd logs have any related entries that might yield > > > a clue. > > I checked the clamav.log and when the error occurs I find lines like: > > > > Tue Feb 15 22:20:42 2011 -> /var/spool/exim4/scan/XXXX/XXXX.eml: Can't > > create temporary directory ERROR > > > > Just like in exim's paniclog. > > > > > I realize this is obvious but make sure that the Debian-exim > > > user and clamav user both have read/write permission to the > > > /var/spool/exim4/scan directory. > > In fact the permissions to this directory are as follows: > > > > ls -l /var/spool/exim4/ | grep scan > > drwxr-x--- 2 Debian-exim Debian-exim 4096 Feb 18 12:54 scan > > > > Before I checked this, but somehow was not noting the missing w for the > > group. > > > > So the Debian-exim group has NO write-permission. On another system > > running exim4u (which I use as the primary MX) the permissions are > > identical and I do not have any errors of this kind there. > > > > Probably here lies the problem. But since I do not have any problems on > > the other system, I would like to understand first, why I really need > > write access here. How does virus scanning actually works? Which process > > really needs access to this directory? > > > > Then I would like to understand why there are no problems on my other > > system. > > > > > Things to check::: > > > I run clamd as mailnull (the same user Exim runs as). > Afterall, they both process the same mail. > > (20:20:25 <~>) 0 $ grep User /usr/local/etc/clamd.conf > User mailnull > (20:20:35 <~>) 0 $ exim -bP | grep exim_user > exim_user = mailnull > (20:20:49 <~>) 0 $ > > (20:20:49 <~>) 0 $ ls -al /var/spool/exim/ > total 24 > drwxr-x--- 7 mailnull mailnull 512 Oct 26 2009 . > drwxr-xr-x 15 root wheel 512 Dec 27 15:17 .. > drwxr-x--- 2 mailnull mailnull 512 Feb 18 18:18 db > drwxr-x--- 13 mailnull mailnull 7680 Feb 18 20:13 input > drwxr-x--- 2 mailnull mailnull 512 Oct 26 2009 log > drwxr-x--- 17 mailnull mailnull 4096 Feb 18 20:13 msglog > drwxr-x--- 3 mailnull mailnull 512 Feb 18 20:13 scan > (20:21:16 <~>) 0 $ > > In clamd.conf: > > TemporaryDirectory /var/tmp > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254733744121/+254722743223 > _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ > Damn!! >

2 1

malware acl condition: clamd: ClamAV returned /var/spool/exim4/scan/XXXX.eml: Can't create temporary directory ERROR
by Udo Hortian 19 Feb '11

19 Feb '11

Hello, I am successfully using exim4u for some time. Thanks Gordon for your work! Now I installed exim4u 1.2.5 on another server with only relay-domains configured so far. From time to time I see the following error in /var/log/exim4/paniclog: 2011-02-15 22:20:42 XXXX malware acl condition: clamd: ClamAV returned /var/spool/exim4/scan/XXXX/XXXX.eml: Can't create temporary directory ERROR exim4u is running on Debian squeeze. I think I make all the necessary adoptions concerning paths and usernames/groups. I also added the clamav user to the Debian-exim group. clamd runs as clamav user: $ps axu | grep clamd clamav 15173 0.3 19.4 125480 102016 ? Ssl Feb13 21:54 /usr/sbin/clamd Interestingly it does not happen with all relayed mails, but only with a few. Do you have any hints where the problem might be? Best regards, Udo

3 4

exim as a backup MX
by Kebba Foon 18 Feb '11

18 Feb '11

Hi list, I have two exim4u installation but the mail boxes are only one server, this is done for backup purposes but I advertise both mx on the internet now the secondary server is accepting mails for my domains but can deliver them to any mailboxes as they don't exist on the second box. So I question is can I turn the second exim4u server to a backup MX? So that it can accept mails for my domains and queue/forward them to the primary(main) mail server. If so can you please send me the sample config file? Thanks Kebba

3 3

Re: [Exim4U] users Digest, Vol 13, Issue 1
by Kebba Foon 09 Feb '11

09 Feb '11

Thanks Gordon, i think then doing ratelimit will be more idea, i will experience with that first. On Tue, 2011-02-08 at 12:00 -0500, users-request(a)exim4u.org wrote: > Send users mailing list submissions to > users(a)exim4u.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://exim4u.org/mailman/listinfo/users > or, via email, send a message with subject or body 'help' to > users-request(a)exim4u.org > > You can reach the person managing the list at > users-owner(a)exim4u.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of users digest..." > > > Today's Topics: > > 1. are outgoing mails scan by Clam and SA (kebba.foon(a)qcell.gm) > 2. Re: are outgoing mails scan by Clam and SA (Gordon Dickens) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 07 Feb 2011 17:58:40 +0000 > From: kebba.foon(a)qcell.gm > Subject: [Exim4U] are outgoing mails scan by Clam and SA > To: users(a)exim4u.org > Message-ID: <20110207175840.15821z6yitesc728(a)qmail.gm> > Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; > format="flowed" > > Dear List, > > our network administrator are having issues with smtp traffice (we are > an ISP) most of our customer's IP are sending spam, this is giving a > bad reputation on our IP's on the rbl's. they are suggesting that all > smtp traffic from our customers be forwarded to our mail server and > the the server will check for malform mails, scan the mails and then > further forward them to their destination. my question is: > > 1. those exim4u scan outgoing mails > 2. is it a good idea to go about this setup? > 3. is there any other best solutions. > > Thanks > Kebba > > > > > ------------------------------ > > Message: 2 > Date: Tue, 08 Feb 2011 10:00:15 -0500 > From: Gordon Dickens <gecko(a)exim4u.org> > Subject: Re: [Exim4U] are outgoing mails scan by Clam and SA > To: Exim4U General Discussion <users(a)exim4u.org> > Message-ID: <4D515A7F.5070708(a)exim4u.org> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi Kebba, > > The stock Exim4U config is not setup to scan outgoing mail for spam. > However, you could modify Exim4U's exim configuration file > (/etc/exim/exim.conf) to scan outgoing mail by modifying the ACLs to > remove the appropriate accept statements prior to the various spam > checks. For example, to have all authenticated mail go through all of > the same spam checks as incoming mail, try commenting out the following > statement from the beginning of all of the ACLs: > > accept authenticated = * > > Obviously, you would need to thoroughly test any modifications such as this. > > It sounds like you are interested in setting up Exim4U as a relay host > and then to have it do spam checks. This can also be done but you would > need to modify the ACLs in the exim configuration file to accept mail > from the relaying server but to then do the spam checks. > > As an aside, Exim4U does have the ability to ratelimit outgoing mail > from internal accounts' to prevent abuse. This is done in the file: > > /etc/exim/exim4u_local_rl.conf.inc. > > The ratelimiting done by this file using the stock Exim4U configuration > is very conservative so as to not disrupt any legitimate senders, > however, this file is fairly well self documented and you can modify the > ratelimiting parameters in this file to be more aggressive to match your > needs. > > FYI, > > Gordon > > > > On 02/07/2011 12:58 PM, kebba.foon(a)qcell.gm wrote: > > Dear List, > > > > our network administrator are having issues with smtp traffice (we are > > an ISP) most of our customer's IP are sending spam, this is giving a > > bad reputation on our IP's on the rbl's. they are suggesting that all > > smtp traffic from our customers be forwarded to our mail server and > > the the server will check for malform mails, scan the mails and then > > further forward them to their destination. my question is: > > > > 1. those exim4u scan outgoing mails > > 2. is it a good idea to go about this setup? > > 3. is there any other best solutions. > > > > Thanks > > Kebba > > > > > > _______________________________________________ > > users mailing list > > users(a)exim4u.org > > https://exim4u.org/mailman/listinfo/users > > > > > ------------------------------ > > _______________________________________________ > users mailing list > users(a)exim4u.org > https://exim4u.org/mailman/listinfo/users > > > End of users Digest, Vol 13, Issue 1 > ************************************

1 0

are outgoing mails scan by Clam and SA
by kebba.foon＠qcell.gm 08 Feb '11

08 Feb '11

Dear List, our network administrator are having issues with smtp traffice (we are an ISP) most of our customer's IP are sending spam, this is giving a bad reputation on our IP's on the rbl's. they are suggesting that all smtp traffic from our customers be forwarded to our mail server and the the server will check for malform mails, scan the mails and then further forward them to their destination. my question is: 1. those exim4u scan outgoing mails 2. is it a good idea to go about this setup? 3. is there any other best solutions. Thanks Kebba

2 1

Exim4U Version 1.2.5 Released
by Gordon Dickens 27 Jan '11

27 Jan '11

Hello Everybody, Exim4U version 1.2.5 was released today. Highlights of this release are as follows: Exim Configuration's URIBL/SURBL/DBL Blocklists (exim_surbl) Upgraded Upgraded exim_surbl from version 2.0 to version 2.2. This new version of exim_surbl adds the Spamhaus DBL list for enhanced spam prevention and supports the new SURBL implementation guidelines. Revised Exim Configuration's Vacation Autoreply Transport The new vacation autoreply transport configuration limits autoreplys for each sender to one autoreply per user specified time period (default = 1 day) in order to avoid email ping pong infinite loops with mailing lists, etc. Other Bug fix to adminuserchange.php related to the vacation autoreply text for admin users. Expanded the vacation autoreply message field in the MySQL database to 4096 characters. The smtp_accept_queue_per_connection configuration option was added to exim4u_local.conf.inc. Credits The vacation autoreply modifications were contributed by Jörg Roßdeutscher who also recommended the additions to the DEBIAN documentation file. The upgrade to exim_surbl 2.2 and the smtp_accept_queue_per_connection configuration option was suggested by Odhiambo Washington. Thanks Jörg and Odhiambo! Exim4U version 1.2.5 may be downloaded from here: http://exim4u.org/html/download.html A detailed summary of the changes and enhancements in version 1.2.5 may be reviewed here: http://exim4u.org/svn/exim4u_src/tags/1.2.5/VERSION Instructions for upgrading Exim4U version 1.2.4 to 1.2.5 are included in the changelog here: http://exim4u.org/svn/exim4u_src/tags/1.2.5/CHANGELOG FYI, Gordon Dickens

1 0

different address for spam
by Shamim Shahriar 16 Jan '11

16 Jan '11

First of all let me thank the team for such an excellent package. I had been using vexim for a while. But I must admit, I am liking exim4u even better. Now, a little problem. I have a mail router which accepts emails for three domains a.example.com b.example.com c.example.com and routes them to three individual servers (the admin people prefers to have their own server than finance, and so on :P) the three internal servers are maintained by three different people, who generally does not agree on anything, but now have agreed on one issue -- they all want a seperate spam address where all spams will be forwarded so they can check and decide what to do with them. in other words, spams coming to a.example.com needs to be routed to spam(a)a.example.com spams coming to b.example.com needs to be routed to spam(a)b.example.com spams coming to c.example.com needs to be routed to spam(a)c.example.com can this be done via ACL or does it have to be in the router? I am not at all good in understanding the entire exim configuration (started only three months ago and that too with vexim). Is there any sample code available that I can customize with my little knowledge and put to work? any help/pointer is highly appreciated Thanks to all again Shamim

2 3