[Mailwatch-users] Releasing Quarantine Files as Original Message

Discussion:

Alan Dobkin

2005-10-01 20:15:03 UTC

I have been using MailWatch with MailScanner for the past several
months. I installed it just before version 1.0 was released, and I
haven't upgraded from version 0.5.1 yet.

Prior to installing MailWatch, I had MailScanner configured to
quarantine whole messages as queue files, so it was very easy to release
them fully intact back to their original destination. However, I had to
turn this setting off in order to use the MailWatch features. Now, when
I release a file, they appear altered, coming from the postmaster
instead of the original sender, and not in their original format. Is
there any way to keep the original mail files intact with MailWatch, or
using some external command? Will upgrading to version 1.0.2 correct
this problem?

To explain a bit further, sometimes MailScanner encounters a problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this happens
when /tmp fills up. I want to be able to release these messages back to
their original destinations as though they were never quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the postmaster
with a header telling the user that their message was released from the
quarantine is confusing and inappropriate for this situation.

Any advice would be appreciated....

Thanks,
Alan

Dennis Willson

2005-10-02 20:51:38 UTC

Permalink

I have added some functionality to MailWatch and am sending out a copy
of the code for anyone that is interested. I would have just put it on
the Wiki, but I couldn't find an easy way to upload files, and this
isn't just a few patch lines.

SQLSpamSettings is a CustomFunction for MailScanner that gets its Low
Spam Score and High Spam scores along with a flag that determines
whether to scan for Spam at all from a MySQL database instead of the
MailScanner.conf file. This allows much easier modifications per user
than using text files. These modules are intended to be used with
MailWatch and its database. Included are SQL scripts to modify the
MailWatch database structure to support these modules and replacement
PHP modules to allow the settings to be changed via the MailWatch WEB
interface. One other feature that was added was the ability for a user
to change their own password. The intention is to allow end users to set
these values themselves. There can be system defaults so that users that
don't want to make changes can just leave them alone, A domain
administrator can create a set of default values for their users that
want to just let someone else make these adjustments. Or the user
themselves can set these values to what they're comfortable with.

There's a README file (SQLSpamSettings.README) that has the installation
instructions,.

Dennis

Steve Freegard

2005-10-10 15:22:57 UTC

Permalink

Hi Dennis,

Post by Dennis Willson
I have added some functionality to MailWatch and am sending out a copy
of the code for anyone that is interested. I would have just put it on
the Wiki, but I couldn't find an easy way to upload files, and this
isn't just a few patch lines.
SQLSpamSettings is a CustomFunction for MailScanner that gets its Low
Spam Score and High Spam scores along with a flag that determines
whether to scan for Spam at all from a MySQL database instead of the
MailScanner.conf file. This allows much easier modifications per user
than using text files. These modules are intended to be used with
MailWatch and its database. Included are SQL scripts to modify the
MailWatch database structure to support these modules and replacement
PHP modules to allow the settings to be changed via the MailWatch WEB
interface. One other feature that was added was the ability for a user
to change their own password. The intention is to allow end users to set
these values themselves. There can be system defaults so that users that
don't want to make changes can just leave them alone, A domain
administrator can create a set of default values for their users that
want to just let someone else make these adjustments. Or the user
themselves can set these values to what they're comfortable with.
There's a README file (SQLSpamSettings.README) that has the installation
instructions,.

Thanks for this - it is most appreciated.

I've added all of this functionality into MailWatch CVS - so it will be
included in the next version.

Cheers,
Steve.

--
Steve Freegard
Fort Systems

Steve Freegard

2005-10-11 08:19:13 UTC

Permalink

Hi Dennis,

Steve,
I've been looking at the code that shows what's in the quarantine. It's only showing what's in the local directories (at least on
my system) and not what's on any remote machine. Is there any reason you don't just list what's marked in the database as being in
quarantine which would show everything for all systems instead? Then use the same mechanism to view details as you do for any file
for that user. I have have not looked deep yet, but there appears to be xml-rpc code for the server to view the remote quarantine
files, but I have not looked at the "client side" portion yet to see why it's not showing the remote files.

I don't use the database for a couple of reasons:

1) The database only has a boolean flag to say if there is something
quarantined or not - it doesn't know what actual *files* are
quarantined. I use the quarantine flag for housekeeping and to speed up
the display of the quarantine lists.

2) Doing it by using the filesystem if local or by XML-RPC (using the
same function remotely) either works or it doesn't and displays exactly
what is in the quarantine directory for that message. If for some
reason it doesn't work the quarantine footer isn't displayed.

3) The quarantine flag was a recent addition to the code.

Since when you set to "distributed only" it removes the quarantine menus, I assume it's not suppose to show the remote files, but
I'm not sure why.
BTW, I haven't been able to get "distributed only" to work correctly, as it always complains about the lack of a DEFINE statement
regarding my Virus Scanner. I have followed the instructions and manually added one, but with no luck. I will have to look closer at
the code to find out what is happening. If you have any incite for something I may be missing, let me know.

DISTRIBUTED_SETUP is an old bit of contributed code that was supposed to
set if you were running MailWatch on a front-end web server that has no
local installation of MailScanner (e.g. it can't read MailScanner.conf
or any rulesets). This precedes the XML-RPC code so it would disable
any functionality that didn't work without MailScanner present (e.g.
quarantine and mailscanner/spamassassin functions) and because it
assumes that MailScanner.conf isn't present it can't work out what
regexp to use for identifying viruses so requires that it is manually
set in conf.php.

I would say that this is largely redundant now - I plan on making
everything work by XML-RPC soon so I'll go through and rip out and
DISTRIBUTED_SETUP tests. In the meantime - if you want a front-end web
server, rsync the /etc/MailScanner directory between the machines, log
everything from the gateways to a central database and let XML-RPC do
the rest.

To actually get XML-RPC to work correctly - you must have MailWatch
installed on each of the gateways and port 80 must be reachable by the
front-end web server. To test, log-in to each gateway and check that
they can see their own local quarantines by using the message listing
report filtered by host, then go to the front-end and you should be able
to view/release/delete message on the remote machines.

If it isn't working - to troubleshoot, find a message processed by a
remote gateway and look at the message detail page and check the
'Received by:' header and make sure that the hostname is resolvable by
the front-end web server and that MailWatch is reachable by
http://<hostname>/mailscanner/ (e.g. you haven't moved or renamed it).

If it still isn't working - set DEBUG to true in conf.php and see what
you get.

Cheers,
Steve.

Dennis Willson

2005-10-11 15:03:20 UTC

Permalink

What I actually have right now... Is two mail hubs both running
MailScanner and MailWatch. I can log into either web interface. I use
only one of them to the users. However the quarantine only shows the
files located on the local hub not the other, remote hub. How does it
know if it suppose to use the local filesystem or the XML-RPC or in my
case both?

Post by Steve Freegard
Hi Dennis,

1) The database only has a boolean flag to say if there is something
quarantined or not - it doesn't know what actual *files* are
quarantined. I use the quarantine flag for housekeeping and to speed up
the display of the quarantine lists.
2) Doing it by using the filesystem if local or by XML-RPC (using the
same function remotely) either works or it doesn't and displays exactly
what is in the quarantine directory for that message. If for some
reason it doesn't work the quarantine footer isn't displayed.
3) The quarantine flag was a recent addition to the code.

DISTRIBUTED_SETUP is an old bit of contributed code that was supposed to
set if you were running MailWatch on a front-end web server that has no
local installation of MailScanner (e.g. it can't read MailScanner.conf
or any rulesets). This precedes the XML-RPC code so it would disable
any functionality that didn't work without MailScanner present (e.g.
quarantine and mailscanner/spamassassin functions) and because it
assumes that MailScanner.conf isn't present it can't work out what
regexp to use for identifying viruses so requires that it is manually
set in conf.php.
I would say that this is largely redundant now - I plan on making
everything work by XML-RPC soon so I'll go through and rip out and
DISTRIBUTED_SETUP tests. In the meantime - if you want a front-end web
server, rsync the /etc/MailScanner directory between the machines, log
everything from the gateways to a central database and let XML-RPC do
the rest.
To actually get XML-RPC to work correctly - you must have MailWatch
installed on each of the gateways and port 80 must be reachable by the
front-end web server. To test, log-in to each gateway and check that
they can see their own local quarantines by using the message listing
report filtered by host, then go to the front-end and you should be able
to view/release/delete message on the remote machines.
If it isn't working - to troubleshoot, find a message processed by a
remote gateway and look at the message detail page and check the
'Received by:' header and make sure that the hostname is resolvable by
the front-end web server and that MailWatch is reachable by
http://<hostname>/mailscanner/ (e.g. you haven't moved or renamed it).
If it still isn't working - set DEBUG to true in conf.php and see what
you get.
Cheers,
Steve.
-------------------------------------------------------
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

Steve Freegard

2005-10-11 15:13:04 UTC

Permalink

Hi Dennis,

Post by Dennis Willson
What I actually have right now... Is two mail hubs both running
MailScanner and MailWatch. I can log into either web interface. I use
only one of them to the users. However the quarantine only shows the
files located on the local hub not the other, remote hub. How does it
know if it suppose to use the local filesystem or the XML-RPC or in my
case both?

It uses the 'hostname' field in the database to work out which gateway
actually received the mail (and where is it therefore quarantined).
There is a check called is_local() in functions.php that works out if
XML-RPC is needed or not.

Regards,
Steve.

Dhawal Doshy

2005-10-11 15:16:18 UTC

Permalink

Post by Steve Freegard
Hi Dennis,

Interesting.. would it mean that if 'is_local()' was disabled OR XML-RPC
is forced, a global (multiple server-wide) quarantine could be viewed?

It would be a neat feature if it works that way.

- dhawal

Steve Freegard

2005-10-11 16:32:14 UTC

Permalink

Hi Dhawal,

Post by Dhawal Doshy

Post by Steve Freegard
Hi Dennis,

Interesting.. would it mean that if 'is_local()' was disabled OR XML-RPC
is forced, a global (multiple server-wide) quarantine could be viewed?

I think you misunderstand - the is_local() function gives a global
multiple server-wide quarantine view but uses the filesystem if the host
is local (for speed). You can force XML-RPC for everything by setting
define(RPC_ONLY, true) in conf.php - but it only really used for testing
as it is marginally slower.

Kind regards,
Steve.

Devon Harding

2005-10-03 13:09:15 UTC

Permalink

Post by Alan Dobkin
I have been using MailWatch with MailScanner for the past several
months. I installed it just before version 1.0 was released, and I
haven't upgraded from version 0.5.1 yet.
Prior to installing MailWatch, I had MailScanner configured to
quarantine whole messages as queue files, so it was very easy to release
them fully intact back to their original destination. However, I had to
turn this setting off in order to use the MailWatch features. Now, when
I release a file, they appear altered, coming from the postmaster
instead of the original sender, and not in their original format. Is
there any way to keep the original mail files intact with MailWatch, or
using some external command? Will upgrading to version 1.0.2 correct
this problem?
To explain a bit further, sometimes MailScanner encounters a problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this happens
when /tmp fills up. I want to be able to release these messages back to
their original destinations as though they were never quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the postmaster
with a header telling the user that their message was released from the
quarantine is confusing and inappropriate for this situation.
Any advice would be appreciated....
Thanks,
Alan
-------------------------------------------------------
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

Steve Freegard

2005-10-03 18:12:26 UTC

Permalink

Hi Devon,

MailWatch can release messages as Original items without attachments -
just set:

define(QUARANTINE_USE_SENDMAIL, true);

in conf.php. I know it says 'sendmail' but it works on Postfix/Exim as
they emulate the sendmail interface (and provide a 'sendmail' binary).

Kind regards,
Steve.

I've been wondering the same thing. The V2 of Quarantine Report does
the same thing. Messages released, comes from the postmaster in the
form of an attachment. Now when using FSL's QuarantineReport, the
messages are released showing the original senders. I wanted to just
have one tool to do everything.
-Devon
I have been using MailWatch with MailScanner for the past several
months. I installed it just before version 1.0 was released, and I
haven't upgraded from version 0.5.1 yet.
Prior to installing MailWatch, I had MailScanner configured to
quarantine whole messages as queue files, so it was very easy to release
them fully intact back to their original
destination. However, I had to
turn this setting off in order to use the MailWatch
features. Now, when
I release a file, they appear altered, coming from the
postmaster
instead of the original sender, and not in their original format. Is
there any way to keep the original mail files intact with MailWatch, or
using some external command? Will upgrading to version 1.0.2 correct
this problem?
To explain a bit further, sometimes MailScanner encounters a problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this happens
when /tmp fills up. I want to be able to release these messages back to
their original destinations as though they were never
quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the postmaster
with a header telling the user that their message was released from the
quarantine is confusing and inappropriate for this situation.
Any advice would be appreciated....
Thanks,
Alan
-------------------------------------------------------
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

Devon Harding

2005-10-03 20:12:28 UTC

Permalink

Hmm...I've added the line to conf.php, but messages still comes from the
postmaster. Is there anything else that I need to do?

-Devon

Post by Steve Freegard
Hi Devon,
MailWatch can release messages as Original items without attachments -
define(QUARANTINE_USE_SENDMAIL, true);
in conf.php. I know it says 'sendmail' but it works on Postfix/Exim as
they emulate the sendmail interface (and provide a 'sendmail' binary).
Kind regards,
Steve.

Post by Devon Harding
I've been wondering the same thing. The V2 of Quarantine Report does
the same thing. Messages released, comes from the postmaster in the
form of an attachment. Now when using FSL's QuarantineReport, the
messages are released showing the original senders. I wanted to just
have one tool to do everything.
-Devon
I have been using MailWatch with MailScanner for the past
several
months. I installed it just before version 1.0 was released,
and I
haven't upgraded from version 0.5.1 yet.
Prior to installing MailWatch, I had MailScanner configured
to
quarantine whole messages as queue files, so it was very easy to release
them fully intact back to their original
destination. However, I had to
turn this setting off in order to use the MailWatch
features. Now, when
I release a file, they appear altered, coming from the
postmaster
instead of the original sender, and not in their original
format. Is
there any way to keep the original mail files intact with
MailWatch, or
using some external command? Will upgrading to version 1.0.2
correct
this problem?
To explain a bit further, sometimes MailScanner encounters a
problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this
happens
when /tmp fills up. I want to be able to release these
messages back to
their original destinations as though they were never
quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the
postmaster
with a header telling the user that their message was released from the
quarantine is confusing and inappropriate for this situation.
Any advice would be appreciated....
Thanks,
Alan
-------------------------------------------------------
Power Architecture Resource Center: Free content, downloads,
discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

Devon Harding

2005-10-03 20:14:20 UTC

Permalink

Should this info be removed or commented?

define(QUARANTINE_MAIL_HOST, '127.0.0.1 <http://127.0.0.1>');
define(QUARANTINE_FROM_ADDR, 'postmaster');
define(QUARANTINE_SUBJECT, 'Message released from quarantine');
define(QUARANTINE_MSG_BODY, 'Please find the original message that was
quarantined attached to this mail.

Regards,
Postmaster');

Post by Devon Harding
Hmm...I've added the line to conf.php, but messages still comes from the
postmaster. Is there anything else that I need to do?
-Devon

Post by Devon Harding
I've been wondering the same thing. The V2 of Quarantine Report does
the same thing. Messages released, comes from the postmaster in the
form of an attachment. Now when using FSL's QuarantineReport, the
messages are released showing the original senders. I wanted to just
have one tool to do everything.
-Devon
I have been using MailWatch with MailScanner for the past
several
months. I installed it just before version 1.0 was released, and I
haven't upgraded from version 0.5.1 yet.
Prior to installing MailWatch, I had MailScanner configured to
quarantine whole messages as queue files, so it was very easy to release
them fully intact back to their original
destination. However, I had to
turn this setting off in order to use the MailWatch
features. Now, when
I release a file, they appear altered, coming from the
postmaster
instead of the original sender, and not in their original
format. Is
there any way to keep the original mail files intact with
MailWatch, or
using some external command? Will upgrading to version 1.0.2 correct
this problem?
To explain a bit further, sometimes MailScanner encounters a problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this happens
when /tmp fills up. I want to be able to release these
messages back to
their original destinations as though they were never
quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the
postmaster
with a header telling the user that their message was released from the
quarantine is confusing and inappropriate for this situation.
Any advice would be appreciated....
Thanks,
Alan
-------------------------------------------------------
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

Chris Tirpak

2005-10-03 20:56:22 UTC

Permalink

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
check that you only have that line inthere once - I think it is
originally in the file as supplied from sf.net - if you have it 2x it
will use the second value 
 
Devon Harding said the following on 10/3/2005 2:12 PM:
<blockquote
cite="***@mail.gmail.com"
type="cite">Hmm...I've added the line to conf.php, but messages still
comes from
the postmaster.  Is there anything else that I need to do? 
 
-Devon 
 
<div>On 10/3/05, Steve Freegard <<a
href="mailto:***@f2s.com">***@f2s.com</a>> wrote:
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi
Devon, 
 
MailWatch can release messages as Original items without attachments - 
just set: 
 
define(QUARANTINE_USE_SENDMAIL, true); 
 
in conf.php.  I know it says 'sendmail' but it works on Postfix/Exim as
 
they emulate the sendmail interface (and provide a 'sendmail' binary). 
 
Kind regards, 
Steve. 
 
On Mon, 2005-10-03 at 09:09 -0400, Devon Harding wrote: 
> I've been wondering the same thing.  The V2 of Quarantine Report
does
 
> the same thing.  Messages released, comes from the postmaster in
the 
> form of an attachment.  Now when using FSL's QuarantineReport, the 
> messages are released showing the original senders.  I wanted to
just
 
> have one tool to do everything. 
> 
> -Devon 
> 
> On 10/1/05, Alan Dobkin <<a href="mailto:***@omnicomp.org">***@omnicomp.org</a>>
wrote: 
>         I have been using MailWatch with MailScanner for the past
 
>         several 
>         months.  I installed it just before version 1.0 was
released, 
>         and I 
>         haven't upgraded from version 0.5.1 yet. 
> 
>         Prior to installing MailWatch, I had MailScanner
configured
 
>         to 
>         quarantine whole messages as queue files, so it was very
easy 
>         to release 
>         them fully intact back to their original 
>         destination.  However, I had to
 
>         turn this setting off in order to use the MailWatch 
>         features.  Now, when 
>         I release a file, they appear altered, coming from the 
>         postmaster 
>         instead of the original sender, and not in their original
 
>         format.  Is 
>         there any way to keep the original mail files intact with 
>         MailWatch, or 
>         using some external command?  Will upgrading to version
1.0.2 
>         correct
 
>         this problem? 
> 
>         To explain a bit further, sometimes MailScanner encounters
a 
>         problem and 
>         quarantines a bunch of legitimate mail with the error
report 
>         "MailScanner: Could not analyze message".  For example,
this 
>         happens 
>         when /tmp fills up.  I want to be able to release these 
>         messages back to 
>         their original destinations as though they were never
 
>         quarantined in the 
>         first place (as they shouldn't have been).  So, the current 
>         functionality with these messages coming altered from the 
>         postmaster 
>         with a header telling the user that their message was
released
 
>         from the 
>         quarantine is confusing and inappropriate for this
situation. 
> 
>         Any advice would be appreciated.... 
> 
>         Thanks, 
>         Alan 
>
 
> 
>         ------------------------------------------------------- 
>         This SF.Net email is sponsored by: 
>         Power Architecture Resource Center: Free content,
downloads, 
>         discussions,
 
>         and more. <a
href="http://solutions.newsforge.com/ibmarch.tmpl">http://solutions.newsforge.com/ibmarch.tmpl</a> 
>         _______________________________________________ 
>         Mailwatch-users mailing list
 
>         <a href="mailto:Mailwatch-***@lists.sourceforge.net">Mailwatch-***@lists.sourceforge.net</a> 
>         <a
href="https://lists.sourceforge.net/lists/listinfo/mailwatch-users">https://lists.sourceforge.net/lists/listinfo/mailwatch-users
</a> 
> 
 
</blockquote>
</div>
 
</blockquote>
</body>
</html>

Devon Harding

2005-10-03 21:08:08 UTC

Permalink

I have it in there once in the Quarantine Settings...

// Quarantine settings

// The quarantine flag is only available on MailScanner >=4.43
// it will dramtically improved the speed of quarantine operations
// but requires that you use the quarantine_manager.php in place of
// the clean.quarantine script provided with MailScanner.
define(QUARANTINE_USE_SENDMAIL, true);
define(QUARANTINE_USE_FLAG, true);
define(QUARANTINE_DAYS_TO_KEEP, 30);
define(QUARANTINE_MAIL_HOST, '127.0.0.1 <http://127.0.0.1>');
define(QUARANTINE_FROM_ADDR, 'postmaster');
define(QUARANTINE_SUBJECT, 'Message released from quarantine');
define(QUARANTINE_MSG_BODY, 'Please find the original message that was
quarantined attached to this mail.

Regards,
Postmaster');
define(QUARANTINE_REPORT_HOSTURL,
'http://'.chop(`hostname`).':8000/mailscanner/');
define(QUARANTINE_REPORT_DAYS, 7);

check that you only have that line inthere once - I think it is originally
in the file as supplied from sf.net <http://sf.net> - if you have it 2x it
will use the second value
Hmm...I've added the line to conf.php, but messages still comes from the
postmaster. Is there anything else that I need to do?
-Devon

Post by Devon Harding
I've been wondering the same thing. The V2 of Quarantine Report does
the same thing. Messages released, comes from the postmaster in the
form of an attachment. Now when using FSL's QuarantineReport, the
messages are released showing the original senders. I wanted to just
have one tool to do everything.
-Devon
I have been using MailWatch with MailScanner for the past
several
months. I installed it just before version 1.0 was released, and I
haven't upgraded from version 0.5.1 yet.
Prior to installing MailWatch, I had MailScanner configured to
quarantine whole messages as queue files, so it was very easy to release
them fully intact back to their original
destination. However, I had to
turn this setting off in order to use the MailWatch
features. Now, when
I release a file, they appear altered, coming from the
postmaster
instead of the original sender, and not in their original
format. Is
there any way to keep the original mail files intact with
MailWatch, or
using some external command? Will upgrading to version 1.0.2 correct
this problem?
To explain a bit further, sometimes MailScanner encounters a problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this happens
when /tmp fills up. I want to be able to release these
messages back to
their original destinations as though they were never
quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the
postmaster
with a header telling the user that their message was released from the
quarantine is confusing and inappropriate for this situation.
Any advice would be appreciated....
Thanks,
Alan
-------------------------------------------------------
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

------------------------------------------------------- This SF.Net email
is sponsored by: Power Architecture Resource Center: Free content,
downloads, discussions, and more.
http://solutions.newsforge.com/ibmarch.tmpl_______________________________________________ Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

Devon Harding

2005-10-04 11:09:40 UTC

Permalink

Ok, I got it working now. It seems that I was using version 1.01 instead of
1.02.

Post by Devon Harding
I have it in there once in the Quarantine Settings...
// Quarantine settings
// The quarantine flag is only available on MailScanner >=4.43
// it will dramtically improved the speed of quarantine operations
// but requires that you use the quarantine_manager.php in place of
// the clean.quarantine script provided with MailScanner.
define(QUARANTINE_USE_SENDMAIL, true);
define(QUARANTINE_USE_FLAG, true);
define(QUARANTINE_DAYS_TO_KEEP, 30);
define(QUARANTINE_MAIL_HOST, '127.0.0.1 <http://127.0.0.1>');
define(QUARANTINE_FROM_ADDR, 'postmaster');
define(QUARANTINE_SUBJECT, 'Message released from quarantine');
define(QUARANTINE_MSG_BODY, 'Please find the original message that was
quarantined attached to this mail.
Regards,
Postmaster');
define(QUARANTINE_REPORT_HOSTURL,
'http://'.chop(`hostname`).':8000/mailscanner/');
define(QUARANTINE_REPORT_DAYS, 7);

Post by Chris Tirpak
check that you only have that line inthere once - I think it is
originally in the file as supplied from sf.net <http://sf.net> - if you
have it 2x it will use the second value
Hmm...I've added the line to conf.php, but messages still comes from the
postmaster. Is there anything else that I need to do?
-Devon

Post by Devon Harding
I've been wondering the same thing. The V2 of Quarantine Report does
the same thing. Messages released, comes from the postmaster in the
form of an attachment. Now when using FSL's QuarantineReport, the
messages are released showing the original senders. I wanted to just
have one tool to do everything.
-Devon
I have been using MailWatch with MailScanner for the past several
months. I installed it just before version 1.0 was released, and I
haven't upgraded from version 0.5.1 yet.
Prior to installing MailWatch, I had MailScanner configured to
quarantine whole messages as queue files, so it was very easy to release
them fully intact back to their original
destination. However, I had to
turn this setting off in order to use the MailWatch
features. Now, when
I release a file, they appear altered, coming from the
postmaster
instead of the original sender, and not in their original format. Is
there any way to keep the original mail files intact with MailWatch, or
using some external command? Will upgrading to version 1.0.2 correct
this problem?
To explain a bit further, sometimes MailScanner encounters a problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this happens
when /tmp fills up. I want to be able to release these
messages back to
their original destinations as though they were never
quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the postmaster
with a header telling the user that their message was released from the
quarantine is confusing and inappropriate for this situation.
Any advice would be appreciated....
Thanks,
Alan
-------------------------------------------------------
Power Architecture Resource Center: Free content, downloads, discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

------------------------------------------------------- This SF.Netemail is sponsored by: Power Architecture Resource Center: Free content,
downloads, discussions, and more.
http://solutions.newsforge.com/ibmarch.tmpl_______________________________________________ Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

Dennis Willson

2005-10-04 18:58:40 UTC

Permalink

Is anyone out there using MailWatch in "distributed mode"? I'm using it in what I call "semi distributed mode". Meaning I have two
mail hubs with the MailWatch being accessed from one of them. There are issues with both this and true distributed mode. I have the
issue that it still shows the quarantine information as if it was should all of it, but it's really only showing whats on the local
server, not the remote. Same with the MailScanner and sendmail status and queues (however I fixed the queue problem and now queues
are a total of the two).

I think that if MailWatch is in "distributed mode" it should use XML-RPC to gather all the same information it has locally. What do
yall think? Is this something worth tackling? If there's no interest or a total lack of "distributed mode" users I won't bother
looking at adding this support. I want to go to a full "distributed mode" myself in the future (The database is already on a
separate server) so I need to decide if this is something I want to take the time to work on, if there's a number of others that
would like it, that would sway the scale and I would just do it now.

Dennis

Dhawal Doshy

2005-10-06 11:06:54 UTC

Permalink

Post by Dennis Willson
Is anyone out there using MailWatch in "distributed mode"? I'm using it
in what I call "semi distributed mode". Meaning I have two mail hubs
with the MailWatch being accessed from one of them. There are issues
with both this and true distributed mode. I have the issue that it still
shows the quarantine information as if it was should all of it, but it's
really only showing whats on the local server, not the remote. Same with
the MailScanner and sendmail status and queues (however I fixed the
queue problem and now queues are a total of the two).

We do have multiple servers though mailwatch is not running in a
"distributed mode".. we have N+1 front-end MX servers talking to a
backend DB server for mailwatch + bayes + syslog and a few other things..

To not run in "distributed mode", i've installed on the DB server, MS +
SA + everything else in a dormant mode (installed + updated but not used)

"Quarantine View" was disabled using a couple of lines in functions.php.
We do not use the mailq feature (done using nagios). A few other
modifications are required to ensure that the customers get a restricted
view.

Post by Dennis Willson
I think that if MailWatch is in "distributed mode" it should use XML-RPC
to gather all the same information it has locally. What do yall think?
Is this something worth tackling? If there's no interest or a total lack
of "distributed mode" users I won't bother looking at adding this
support. I want to go to a full "distributed mode" myself in the future
(The database is already on a separate server) so I need to decide if
this is something I want to take the time to work on, if there's a
number of others that would like it, that would sway the scale and I
would just do it now.

I would be interested for sure (makes my life easy), since i'd prefer
using the stock mailwatch version rather than modifying everytime there
is a new release.

- dhawal

Chris Tirpak

2005-10-04 23:06:57 UTC

Permalink

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
This works for me as well.  It also cures a bug - release as an
attachment I always get the released messaged dated as sent in 1999
which is of course incorrect and puts it at the wrong end of a users
mailbox.  That is something we might want to fix regardless. 
 
-c 
 
 
Steve Freegard said the following on 10/3/2005 12:12 PM:
<blockquote cite="***@localhost.localdomain"
type="cite">
<pre wrap="">Hi Devon,

MailWatch can release messages as Original items without attachments -
just set:

define(QUARANTINE_USE_SENDMAIL, true);

in conf.php. I know it says 'sendmail' but it works on Postfix/Exim as
they emulate the sendmail interface (and provide a 'sendmail' binary).

Kind regards,
Steve.

On Mon, 2005-10-03 at 09:09 -0400, Devon Harding wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I've been wondering the same thing. The V2 of Quarantine Report does
the same thing. Messages released, comes from the postmaster in the
form of an attachment. Now when using FSL's QuarantineReport, the
messages are released showing the original senders. I wanted to just
have one tool to do everything.

-Devon

On 10/1/05, Alan Dobkin <a class="moz-txt-link-rfc2396E" href="mailto:***@omnicomp.org"><***@omnicomp.org></a> wrote:
I have been using MailWatch with MailScanner for the past
several
months. I installed it just before version 1.0 was released,
and I
haven't upgraded from version 0.5.1 yet.

Prior to installing MailWatch, I had MailScanner configured
to
quarantine whole messages as queue files, so it was very easy
to release
them fully intact back to their original
destination. However, I had to
turn this setting off in order to use the MailWatch
features. Now, when
I release a file, they appear altered, coming from the
postmaster
instead of the original sender, and not in their original
format. Is
there any way to keep the original mail files intact with
MailWatch, or
using some external command? Will upgrading to version 1.0.2
correct
this problem?

To explain a bit further, sometimes MailScanner encounters a
problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this
happens
when /tmp fills up. I want to be able to release these
messages back to
their original destinations as though they were never
quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the
postmaster
with a header telling the user that their message was released
from the
quarantine is confusing and inappropriate for this situation.

Any advice would be appreciated....

Thanks,
Alan

-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads,
discussions,
and more. <a class="moz-txt-link-freetext" href="http://solutions.newsforge.com/ibmarch.tmpl">http://solutions.newsforge.com/ibmarch.tmpl</a>
_______________________________________________
Mailwatch-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Mailwatch-***@lists.sourceforge.net">Mailwatch-***@lists.sourceforge.net</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/mailwatch-users">https://lists.sourceforge.net/lists/listinfo/mailwatch-users</a>

</pre>
</blockquote>
<pre wrap="">

-------------------------------------------------------
This SF.Net email is sponsored by:
Power Architecture Resource Center: Free content, downloads, discussions,
and more. <a class="moz-txt-link-freetext" href="http://solutions.newsforge.com/ibmarch.tmpl">http://solutions.newsforge.com/ibmarch.tmpl</a>
_______________________________________________
Mailwatch-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Mailwatch-***@lists.sourceforge.net">Mailwatch-***@lists.sourceforge.net</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/mailwatch-users">https://lists.sourceforge.net/lists/listinfo/mailwatch-users</a>

</pre>
</blockquote>
</body>
</html>

Dave Hickey

2005-10-11 08:52:36 UTC

Permalink

This works for me as well. It also cures a bug - release as an
attachment I always get the released messaged dated as sent in 1999
which is of course incorrect and puts it at the wrong end of a users
mailbox. That is something we might want to fix regardless.

Edit functions.php and change (line ~2070)

$hdrs = array('From' => QUARANTINE_FROM_ADDR, 'Subject' => QUARANTINE_SUBJECT);

to

$hdrs = array('From' => QUARANTINE_FROM_ADDR, 'Subject' => QUARANTINE_SUBJECT,
'Date' => date("r"));

This will set the date header to the time the mail was released from
quarantine.

Dave

--
Dave Hickey ***@esat.net
Senior Unix Systems Engineer Esat BT IP NOC
www.esat.net www.esatbt.com

Steve Freegard

2005-10-11 13:08:00 UTC

Permalink

Hi Dave,

Post by Dave Hickey

Edit functions.php and change (line ~2070)
$hdrs = array('From' => QUARANTINE_FROM_ADDR, 'Subject' => QUARANTINE_SUBJECT);
to
$hdrs = array('From' => QUARANTINE_FROM_ADDR, 'Subject' => QUARANTINE_SUBJECT,
'Date' => date("r"));
This will set the date header to the time the mail was released from
quarantine.

Thanks Dave - this is now in CVS and will be in the next release.

Cheers,
Steve.

EndelWar

2005-10-06 10:48:35 UTC

Permalink

Post by Steve Freegard
define(QUARANTINE_USE_SENDMAIL, true);
in conf.php. I know it says 'sendmail' but it works on Postfix/Exim as
they emulate the sendmail interface (and provide a 'sendmail' binary).

I get this error when I press submit:

error code 1 returned from Sendmail: sendmail: sendmail cannot be called
directly from a shell with the current user id

I think it is an apache config issue, but I don't know how to handle it.

Don Rick

2005-10-03 20:17:11 UTC

Permalink

Worked fine for me.

________________________________

From: mailwatch-users-***@lists.sourceforge.net
[mailto:mailwatch-users-***@lists.sourceforge.net] On Behalf Of Devon
Harding
Sent: Monday, October 03, 2005 3:12 PM
To: Steve Freegard
Cc: MailWatch-Users
Subject: [Mailwatch-users] Re: Releasing Quarantine Files as Original
Message

Hmm...I've added the line to conf.php, but messages still comes from the
postmaster. Is there anything else that I need to do?

-Devon

On 10/3/05, Steve Freegard <***@f2s.com> wrote:

Hi Devon,

MailWatch can release messages as Original items without attachments -
just set:

define(QUARANTINE_USE_SENDMAIL, true);

in conf.php. I know it says 'sendmail' but it works on Postfix/Exim as
they emulate the sendmail interface (and provide a 'sendmail' binary).

Kind regards,
Steve.

I've been wondering the same thing. The V2 of Quarantine Report does
the same thing. Messages released, comes from the postmaster in the
form of an attachment. Now when using FSL's QuarantineReport, the
messages are released showing the original senders. I wanted to just
have one tool to do everything.
-Devon
I have been using MailWatch with MailScanner for the past
several
months. I installed it just before version 1.0 was released,
and I
haven't upgraded from version 0.5.1 yet.
Prior to installing MailWatch, I had MailScanner configured
to
quarantine whole messages as queue files, so it was very easy
to release
them fully intact back to their original
destination. However, I had to
turn this setting off in order to use the MailWatch
features. Now, when
I release a file, they appear altered, coming from the
postmaster
instead of the original sender, and not in their original
format. Is
there any way to keep the original mail files intact with
MailWatch, or
using some external command? Will upgrading to version 1.0.2
correct
this problem?
To explain a bit further, sometimes MailScanner encounters a
problem and
quarantines a bunch of legitimate mail with the error report
"MailScanner: Could not analyze message". For example, this
happens
when /tmp fills up. I want to be able to release these
messages back to
their original destinations as though they were never
quarantined in the
first place (as they shouldn't have been). So, the current
functionality with these messages coming altered from the
postmaster
with a header telling the user that their message was released
from the
quarantine is confusing and inappropriate for this situation.
Any advice would be appreciated....
Thanks,
Alan
-------------------------------------------------------
Power Architecture Resource Center: Free content, downloads,
discussions,
and more. http://solutions.newsforge.com/ibmarch.tmpl
_______________________________________________
Mailwatch-users mailing list
https://lists.sourceforge.net/lists/listinfo/mailwatch-users

This is a transmission from Wisconsin Capital Management LLC and contains information that is confidential. If you are not the intended addressee or authorized to receive for the addressee, then any disclosure, copying, distribution, or use of the contents of this message is prohibited. If you have received this transmission in error, please destroy it and notify the sender immediately at the transmitting e-mail address. If you are the intended recipient, please be advised that this e-mail transmission is not encrypted or otherwise protected from potential misappropriation or misuse. Wisconsin Capital Management LLC expressly disclaims any and all liability for harm resulting from the misappropriation, interception or misuse of the information contained in this transmission.