(Sorry for the length of the message
I have a configuration of
Cyrus-Postfix-Procmail-MailScanner-SpamAssassin, the problem is that the
messages with virus are not delivered, but the log saids other things.
################################
# main.cf
biff = no
append_dot_mydomain = no
local_recipient_maps =
mail_name = postfix
mail_owner = postfix
always_bcc = enviados(_at_)domain(_dot_)net
myhostname = mail.domain.net
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_maps = hash:$config_directory/virtual,
regexp:/etc/postfix/virtual-regexp
mydomain = domain.net
mydestination = $myhostname, localhost.$mydomain, $mydomain, localhost
myorigin = $mydomain
relayhost = [mail.domain.org.uy]
mynetworks = 192.168.9.0/24, 127.0.0.0/8
mailbox_size_limit = 0
recipient_delimiter = +
mailbox_transport = procmail
smtpd_tls_auth_only = no
smtpd_sasl_local_domain=correo-debian
smtpd_sender_restrictions = hash:/etc/postfix/access,
hash:/etc/postfix/policy_by_senders
header_checks = regexp:/etc/postfix/regexp.header
body_checks = regexp:/etc/postfix/regexp.body
smtpd_client_restrictions = reject_rbl_client relays.ordb.org
smtpd_restriction_classes = may_use_external_mail, only_internal_mail
may_use_external_mail = permit
only_internal_mail = check_recipient_access
hash:/etc/postfix/allowed_recipients, reject
################################
################################
# master.cf
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - n - - smtpd
-o content_filter=spamassassin:
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - - 300 1 qmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
smtp unix - - n - - smtp
-o content_filter=spamassassin:
relay unix - - - - - smtp
showq unix n - - - - showq
error unix - - - - - error
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
#######
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
cyrus unix - n n - - pipe
flags=R user=cyrus argv=/usr/sbin/cyrdeliver -e -m ${extension} ${user}
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
($recipient)
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -d -t$nexthop -f$sender
$recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
${nexthop} ${user} ${extension}
spamassassin unix - n n - - pipe
user=filter argv=/usr/local/bin/sa-filter.sh -f ${sender} -- ${recipient}
procmail unix - n n - - pipe
flags=R user=cyrus argv=/usr/bin/procmail -t -m USER=${user}
EXTENSION=${extension} /etc/procmailrc
################################
################################
# procmailrc
PATH=/usr/cyrus/bin:/bin:/usr/bin:/usr/local/bin
SHELL=/bin/bash
DELIVERMAIL="/usr/sbin/cyrdeliver"
VERBOSE=yes
BACKUP="$DELIVERMAIL -e -a $USER -m user.recibidos.backup"
SPAMIT="$DELIVERMAIL -e -a $USER -m user.recibidos.spam"
VIRUSIT="$DELIVERMAIL -e -a $USER -m user.recibidos.virus"
DAEMONIT="$DELIVERMAIL -e -a $USER -m user.pgauna.daemon"
INCLUDERC=/home/$USER/.procmailrc
:0hfw
| /usr/bin/formail -I "From "
EXITCODE=
:0 c
| $BACKUP
:0
* ^Subject: \{SPAM\?\}
| $SPAMIT
:0
* ^Subject: \{Virus\?\}
| $VIRUSIT
:0
* ^Subject: \{VIRUS\?\}
| $VIRUSIT
:0
* ^Subject:(_dot_)*root(_at_)correo-debian
| $DAEMONIT
:0
* ^Subject:.*cyrus
| $DAEMONIT
:0 w:cyrus.$USER.lock
| $DELIVERMAIL -a $USER -e -q -m $EXTENSION $USER
:0 w:cyrus.$USER.lock
| $DELIVERMAIL -a $USER -e -q $USER
:0 e
{
EXITCODE=$?
HOST
}
################################
################################
# /var/log/syslog
Aug 10 17:07:49 correo-debian postfix/cleanup[762]: 29F5717B502: hold:
header Received: from adinet.com.uy (200.40.167.163) by
mta2.in.adinet.com.uy (7.0.027)? id 40A25C1201A144E7 for
lapega(_at_)adinet(_dot_)com(_dot_)uy; Tue, 10 Aug 2004 16:59:09 -0300 from local;
from=<cyrus(_at_)domain(_dot_)net> to=<recibidos_null(_at_)domain(_dot_)net>
Aug 10 17:07:49 correo-debian postfix/pipe[798]: 4AD3817B4C4:
to=<recibidos(_at_)localhost>, relay=procmail, delay=6, status=sent
(mail.domain.net)
Aug 10 17:07:49 correo-debian postfix/qmgr[427]: 4AD3817B4C4: removed
Aug 10 17:07:49 correo-debian postfix/smtpd[760]: connect from
unknown[192.168.9.6]
Aug 10 17:07:50 correo-debian postfix/smtpd[760]: 0F49617B4C4:
client=unknown[192.168.9.6]
Aug 10 17:07:50 correo-debian postfix/cleanup[762]: 0F49617B4C4: hold:
header Received: from [192.168.9.6] (unknown [192.168.9.6])??by
mail.domain.net (postfix) with ESMTP id 0F49617B4C4??for
<recibidos(_at_)domain(_dot_)net>; Tue, 10 Aug 2004 17:07:49 -0300 (UYT) from
unknown[192.168.9.6]; from=<pgauna(_at_)domain(_dot_)net> to=<recibidos(_at_)domain(_dot_)net>
proto=ESMTP helo=<[192.168.9.6]>
Aug 10 17:07:50 correo-debian postfix/cleanup[762]: 0F49617B4C4:
message-id=<41192B35(_dot_)4030400(_at_)domain(_dot_)net>
Aug 10 17:07:50 correo-debian postfix/smtpd[760]: disconnect from
unknown[192.168.9.6]
Aug 10 17:08:01 correo-debian /USR/SBIN/CRON[841]: (mail) CMD ( if [ -x
/usr/sbin/exim -a -f /etc/exim/exim.conf ]; then /usr/sbin/exim -q ; fi)
Aug 10 17:08:17 correo-debian MailScanner[326]: New Batch: Scanning 3
messages, 12317 bytes
Aug 10 17:08:20 correo-debian MailScanner[326]: Virus and Content
Scanning: Starting
Aug 10 17:08:22 correo-debian MailScanner[326]:
/var/spool/MailScanner/incoming/326/./0F49617B4C4/eicar_com.zip:
Eicar-Test-Signature FOUND
Aug 10 17:08:22 correo-debian MailScanner[326]:
/var/spool/MailScanner/incoming/326/./0F49617B4C4/eicar.com:
Eicar-Test-Signature FOUND
Aug 10 17:08:22 correo-debian MailScanner[326]: Virus Scanning: ClamAV
found 2 infections
Aug 10 17:08:22 correo-debian MailScanner[326]: Infected message
0F49617B4C4 came from 192.168.9.6
Aug 10 17:08:22 correo-debian MailScanner[326]: Virus Scanning: Found 2
viruses
Aug 10 17:08:22 correo-debian MailScanner[326]: Filename Checks:
Windows/DOS Executable (0F49617B4C4 eicar.com)
Aug 10 17:08:22 correo-debian MailScanner[326]: Other Checks: Found 1
problems
Aug 10 17:08:22 correo-debian MailScanner[326]: Requeue: E9BEA17B501 to
D7BFC17B503
Aug 10 17:08:22 correo-debian MailScanner[326]: Requeue: 29F5717B502 to
737B317B501
Aug 10 17:08:22 correo-debian postfix/qmgr[427]: 737B317B501:
from=<cyrus(_at_)domain(_dot_)net>, size=6984, nrcpt=2 (queue active)
Aug 10 17:08:22 correo-debian postfix/qmgr[427]: D7BFC17B503:
from=<cyrus(_at_)domain(_dot_)net>, size=3356, nrcpt=2 (queue active)
Aug 10 17:08:22 correo-debian MailScanner[326]: Uninfected: Delivered 2
messages
Aug 10 17:08:22 correo-debian postfix/pipe[798]: D7BFC17B503:
to=<enviados(_at_)domain(_dot_)net>, relay=procmail, delay=34, status=sent
(mail.domain.net)
Aug 10 17:08:22 correo-debian postfix/pipe[856]: 737B317B501:
to=<enviados(_at_)domain(_dot_)net>, relay=procmail, delay=33, status=sent
(mail.domain.net)
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: accepted connection
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: lmtp connection
preauth'd as postman
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: accepted connection
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: lmtp connection
preauth'd as postman
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: accepted connection
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: lmtp connection
preauth'd as postman
Aug 10 17:08:22 correo-debian cyrus/master[867]: about to exec
/usr/lib/cyrus/bin/lmtpd
Aug 10 17:08:22 correo-debian cyrus/lmtpunix[867]: executed
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: accepted connection
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: lmtp connection
preauth'd as postman
Aug 10 17:08:22 correo-debian postfix/pipe[797]: D7BFC17B503:
to=<recibidos_null(_at_)domain(_dot_)net>, relay=procmail, delay=34, status=sent
(mail.domain.net)
Aug 10 17:08:22 correo-debian postfix/qmgr[427]: D7BFC17B503: removed
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: accepted connection
Aug 10 17:08:22 correo-debian cyrus/lmtpd[804]: lmtp connection
preauth'd as postman
Aug 10 17:08:23 correo-debian MailScanner[326]: Requeue: 0F49617B4C4 to
D197217B502
Aug 10 17:08:23 correo-debian postfix/qmgr[427]: D197217B502:
from=<pgauna(_at_)domain(_dot_)net>, size=2087, nrcpt=2 (queue active)
Aug 10 17:08:23 correo-debian MailScanner[326]: Silent: Delivered 1
messages containing silent viruses
Aug 10 17:08:23 correo-debian cyrus/lmtpd[867]: accepted connection
Aug 10 17:08:23 correo-debian cyrus/lmtpd[867]: lmtp connection
preauth'd as postman
Aug 10 17:08:23 correo-debian cyrus/lmtpd[867]: duplicate_check:
<40A25C1201A144E7(_at_)mta2(_dot_)in(_dot_)adinet(_dot_)com(_dot_)uy> (added by
postmaster(_at_)adinet(_dot_)com(_dot_)uy) user.recibidos_null 0
Aug 10 17:08:23 correo-debian cyrus/lmtpd[867]: mystore: starting txn
2147483668
Aug 10 17:08:23 correo-debian cyrus/lmtpd[867]: mystore: committing txn
2147483668
Aug 10 17:08:23 correo-debian cyrus/lmtpd[867]: duplicate_mark:
<40A25C1201A144E7(_at_)mta2(_dot_)in(_dot_)adinet(_dot_)com(_dot_)uy> (added by
postmaster(_at_)adinet(_dot_)com(_dot_)uy) user.recibidos_null 1092168503
Aug 10 17:08:23 correo-debian postfix/pipe[829]: 737B317B501:
to=<recibidos_null(_at_)domain(_dot_)net>, relay=procmail, delay=34, status=sent
(mail.domain.net)
Aug 10 17:08:23 correo-debian postfix/qmgr[427]: 737B317B501: removed
Aug 10 17:08:23 correo-debian postfix/pickup[426]: 763F717B4C4: uid=103
from=<postmaster> orig_id=42CB42E2950
Aug 10 17:08:23 correo-debian postfix/cleanup[762]: 763F717B4C4: hold:
header Received: by mail.domain.net (postfix, from userid 103)??id
763F717B4C4; Tue, 10 Aug 2004 17:08:23 -0300 (UYT) from local;
from=<postmaster(_at_)domain(_dot_)net>
Aug 10 17:08:23 correo-debian postfix/cleanup[762]: 763F717B4C4:
message-id=<20040810200823(_dot_)763F717B4C4(_at_)mail(_dot_)domain(_dot_)net>
Aug 10 17:08:23 correo-debian MailScanner[326]: Notices: Warned about 1
messages
Aug 10 17:08:23 correo-debian MailScanner[326]: New Batch: Scanning 1
messages, 1191 bytes
Aug 10 17:08:25 correo-debian MailScanner[326]: Virus and Content
Scanning: Starting
Aug 10 17:08:28 correo-debian postfix/pipe[774]: D197217B502:
to=<enviados(_at_)domain(_dot_)net>, relay=spamassassin, delay=39, status=sent
(mail.domain.net)
Aug 10 17:08:28 correo-debian postfix/pipe[774]: D197217B502:
to=<recibidos(_at_)domain(_dot_)net>, relay=spamassassin, delay=39, status=sent
(mail.domain.net)
Aug 10 17:08:28 correo-debian postfix/qmgr[427]: D197217B502: removed
Aug 10 17:08:28 correo-debian postfix/pickup[426]: BDF6717B501: uid=1006
from=<pgauna(_at_)domain(_dot_)net>
Aug 10 17:08:28 correo-debian postfix/cleanup[762]: BDF6717B501: hold:
header Received: by mail.domain.net (postfix, from userid 1006)??id
BDF6717B501; Tue, 10 Aug 2004 17:08:28 -0300 (UYT) from local;
from=<pgauna(_at_)domain(_dot_)net> to=<enviados(_at_)domain(_dot_)net>
Aug 10 17:08:28 correo-debian postfix/cleanup[762]: BDF6717B501: hold:
header Received: from [192.168.9.6] (unknown [192.168.9.6])??by
mail.domain.net (postfix) with ESMTP id 0F49617B4C4??for
<recibidos(_at_)domain(_dot_)net>; Tue, 10 Aug 2004 17:07:49 -0300 (UYT) from
local; from=<pgauna(_at_)domain(_dot_)net> to=<enviados(_at_)domain(_dot_)net>
Aug 10 17:08:28 correo-debian postfix/cleanup[762]: BDF6717B501:
message-id=<41192B35(_dot_)4030400(_at_)domain(_dot_)net>
Aug 10 17:08:29 correo-debian MailScanner[326]: Requeue: 763F717B4C4 to
65A5817B502
Aug 10 17:08:29 correo-debian postfix/qmgr[427]: 65A5817B502:
from=<postmaster(_at_)domain(_dot_)net>, size=1081, nrcpt=2 (queue active)
Aug 10 17:08:29 correo-debian MailScanner[326]: Uninfected: Delivered 1
messages
Aug 10 17:08:29 correo-debian MailScanner[326]: New Batch: Scanning 1
messages, 2589 bytes
Aug 10 17:08:29 correo-debian postfix/pipe[798]: 65A5817B502:
to=<enviados(_at_)domain(_dot_)net>, relay=procmail, delay=6, status=sent
(mail.domain.net)
Aug 10 17:08:29 correo-debian cyrus/lmtpd[804]: accepted connection
Aug 10 17:08:29 correo-debian cyrus/lmtpd[804]: lmtp connection
preauth'd as postman
Aug 10 17:08:29 correo-debian cyrus/lmtpd[867]: accepted connection
Aug 10 17:08:29 correo-debian cyrus/lmtpd[867]: lmtp connection
preauth'd as postman
Aug 10 17:08:29 correo-debian cyrus/lmtpd[804]: accepted connection
Aug 10 17:08:29 correo-debian cyrus/lmtpd[804]: lmtp connection
preauth'd as postman
Aug 10 17:08:29 correo-debian postfix/pipe[829]: 65A5817B502:
to=<postmaster(_at_)domain(_dot_)net>, orig_to=<postmaster>, relay=procmail,
delay=6, status=bounced (data format error. Command output: procmail:
[884] Tue Aug 10 17:08:29 2004 procmail: Assigning
"BACKUP=/usr/sbin/cyrdeliver -e -a postmaster -m user.recibidos.backup"
procmail: Assigning "SPAMIT=/usr/sbin/cyrdeliver -e -a postmaster -m
user.recibidos.spam" procmail: Assigning "VIRUSIT=/usr/sbin/cyrdeliver
-e -a postmaster -m user.recibidos.virus" procmail: Assigning
"DAEMONIT=/usr/sbin/cyrdeliver -e -a postmaster -m user.pgauna.daemon"
procmail: Assigning "INCLUDERC=/home/postmaster/.procmailrc" procmail:
Couldn't read "/home/postmaster/.procmailrc" procmail: Executing
"/usr/bin/formail,-I,From " procmail: Assigning "EXITCODE=" procmail:
Assigning "LASTFOLDER=/usr/sbin/cyrdeliver -e -a postmaster -m
user.recibidos.backup" procmail: Executing
"/usr/sbin/cyrdeliver,-e,-a,postmaster,-m,user.recibidos.backup"
procmail: No match on "^Subject: \{SPAM\?\}" procmail: No match
Aug 10 17:08:29 correo-debian postfix/cleanup[762]: 919BB17B4C4:
message-id=<20040810200829(_dot_)919BB17B4C4(_at_)mail(_dot_)domain(_dot_)net>
Aug 10 17:08:29 correo-debian postfix/qmgr[427]: 65A5817B502: removed
Aug 10 17:08:29 correo-debian postfix/qmgr[427]: 919BB17B4C4: from=<>,
size=6755, nrcpt=1 (queue active)
Aug 10 17:08:29 correo-debian cyrus/lmtpd[867]: accepted connection
Aug 10 17:08:29 correo-debian cyrus/lmtpd[867]: lmtp connection
preauth'd as postman
Aug 10 17:08:29 correo-debian cyrus/lmtpd[804]: accepted connection
Aug 10 17:08:29 correo-debian cyrus/lmtpd[804]: lmtp connection
preauth'd as postman
Aug 10 17:08:29 correo-debian cyrus/lmtpd[867]: accepted connection
Aug 10 17:08:29 correo-debian cyrus/lmtpd[867]: lmtp connection
preauth'd as postman
Aug 10 17:08:29 correo-debian postfix/pipe[856]: 919BB17B4C4:
to=<postmaster(_at_)domain(_dot_)net>, relay=procmail, delay=0, status=bounced
(data format error. Command output: procmail: [891] Tue Aug 10 17:08:29
2004 procmail: Assigning "BACKUP=/usr/sbin/cyrdeliver -e -a postmaster
-m user.recibidos.backup" procmail: Assigning
"SPAMIT=/usr/sbin/cyrdeliver -e -a postmaster -m user.recibidos.spam"
procmail: Assigning "VIRUSIT=/usr/sbin/cyrdeliver -e -a postmaster -m
user.recibidos.virus" procmail: Assigning "DAEMONIT=/usr/sbin/cyrdeliver
-e -a postmaster -m user.pgauna.daemon" procmail: Assigning
"INCLUDERC=/home/postmaster/.procmailrc" procmail: Couldn't read
"/home/postmaster/.procmailrc" procmail: Executing
"/usr/bin/formail,-I,From " procmail: Assigning "EXITCODE=" procmail:
Executing
"/usr/sbin/cyrdeliver,-e,-a,postmaster,-m,user.recibidos.backup"
procmail: Error while writing to "/usr/sbin/cyrdeliver" procmail:
Assigning "LASTFOLDER=/usr/sbin/cyrdeliver -e -a postmaster -m
user.recibidos.backup" procmail: No match on "^Subje
Aug 10 17:08:29 correo-debian postfix/qmgr[427]: 919BB17B4C4: removed
Aug 10 17:08:30 correo-debian MailScanner[326]: Virus and Content
Scanning: Starting
Aug 10 17:08:32 correo-debian MailScanner[326]: Requeue: BDF6717B501 to
99CD517B4C4
Aug 10 17:08:32 correo-debian postfix/qmgr[427]: 99CD517B4C4:
from=<pgauna(_at_)domain(_dot_)net>, size=2406, nrcpt=2 (queue active)
Aug 10 17:08:32 correo-debian MailScanner[326]: Uninfected: Delivered 1
messages
Aug 10 17:08:32 correo-debian postfix/pipe[797]: 99CD517B4C4:
to=<enviados(_at_)domain(_dot_)net>, relay=procmail, delay=4, status=sent
(mail.domain.net)
Aug 10 17:08:32 correo-debian spamd[193]: connection from localhost
[127.0.0.1] at port 1068
Aug 10 17:08:32 correo-debian spamd[907]: info: setuid to cyrus succeeded
Aug 10 17:08:32 correo-debian spamd[907]: processing message
<41192B35(_dot_)4030400(_at_)domain(_dot_)net> for cyrus:104.
Aug 10 17:08:32 correo-debian spamd[907]: clean message (0.0/3.0) for
cyrus:104 in 0.7 seconds, 2378 bytes.
Aug 10 17:08:33 correo-debian postfix/pickup[426]: 086E117B501: uid=104
from=<cyrus>
Aug 10 17:08:33 correo-debian postfix/cleanup[762]: 086E117B501: hold:
header Received: by mail.domain.net (postfix, from userid 104)??id
086E117B501; Tue, 10 Aug 2004 17:08:33 -0300 (UYT) from local;
from=<cyrus(_at_)domain(_dot_)net> to=<recibidos_null(_at_)domain(_dot_)net>
Aug 10 17:08:33 correo-debian postfix/cleanup[762]: 086E117B501: hold:
header Received: by mail.domain.net (postfix, from userid 1006)??id
BDF6717B501; Tue, 10 Aug 2004 17:08:28 -0300 (UYT) from local;
from=<cyrus(_at_)domain(_dot_)net> to=<recibidos_null(_at_)domain(_dot_)net>
Aug 10 17:08:33 correo-debian postfix/cleanup[762]: 086E117B501: hold:
header Received: from [192.168.9.6] (unknown [192.168.9.6])??by
mail.domain.net (postfix) with ESMTP id 0F49617B4C4??for
<recibidos(_at_)domain(_dot_)net>; Tue, 10 Aug 2004 17:07:49 -0300 (UYT) from
local; from=<cyrus(_at_)domain(_dot_)net> to=<recibidos_null(_at_)domain(_dot_)net>
Aug 10 17:08:33 correo-debian postfix/cleanup[762]: 086E117B501:
message-id=<41192B35(_dot_)4030400(_at_)domain(_dot_)net>
Aug 10 17:08:33 correo-debian postfix/pipe[856]: 99CD517B4C4:
to=<recibidos(_at_)domain(_dot_)net>, relay=procmail, delay=5, status=sent
(mail.domain.net)
Aug 10 17:08:33 correo-debian postfix/qmgr[427]: 99CD517B4C4: removed
################################
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail