Upgrade MailScanner in Debian Lenny

Recentemente ho dovuto eseguire alcuni aggiornamenti di sicurezza sul mio server con Debian Lenny.

MailScanner è stato rimosso dalle repository di Lenny per motivi di sicurezza (bugs.debian.org), ed ora è possibile reperirlo dalle repository di lenny-backports o squeeze (LINK).

Armato di pazienza e incrociando le dita, ho installato con un’abile pinning la versione 4.79.11-2.1 da repository lenny-backports.

Ma alcuni intoppi mi hanno fatto sudare per un attimo.

Seguendo l’articolo vedremo di sciogliere i nodi che porteranno nuovamente MailScanner a funzionare.

Dopo l’aggiornamento che è filato liscio senza problemi, mi sono trovato di fronte alla richiesta di aptitude di modificare alcuni file di configurazione a cui ho risposto negativamente per mantenere le mie configurazioni.

Al riavvio del servizio però un primo errore compare, anche se pare non interrompere il funzionamento o comprometterne le capacità.

#/etc/init.d/mailscanner start
 Could not create SpamAssassin temporary directory , No such file or directory at /usr/share/MailScanner

Da una ricerca sul web approdo a questo blog che tratta il mio stesso problema : LINK

Provo la soluzione postata adeguandola alle mie condizioni e necessità :

# upgrade_MailScanner_conf /etc/MailScanner/MailScanner.conf /etc/MailScanner/MailScanner.conf.dpkg-dist >/tmp/MailScanner.conf.new

Important Note
————–
Your settings for the Sophos SAVI virus scanner are probably
broken. They should look like this (unless your Sophos is
installed somewhere else)
Sophos IDE Dir = /opt/sophos-av/lib/sav
Sophos Lib Dir = /opt/sophos-av/lib
Monitors for Sophos Updates = /opt/sophos-av/lib/sav/*.ide

Important Note
————–
Your setting for ‘Monitors for ClamAV Updates’ is broken.
It should look like this (unless your ClamAV is installed
somewhere else)
Monitors for ClamAV Updates = /usr/local/share/clamav/*.cld /usr/local/share/clamav/*.cvd

Important Note
————–
Your setting for ‘Maximum Archive Depth’ is very low.
When expanding archives, Microsoft Office documents are
handled the same way as zip and rar archives.
A setting as low as your current value (2) is likely to
cause a lot of messages blocked with a report that the
“Message contained archive nested too deeply”.
This will needlessly irritate a lot of your users as
their files will be blocked.
Please manually set it to at least 3 or 4, after moving into
place the new MailScanner.conf file I am writing for you.

Added new: Maximum Processing Attempts = 6
Added new: Processing Attempts Database = /var/spool/MailScanner/incoming/Processing.db
Added new: Unpack Microsoft Documents = yes
Added new: Zip Attachments = no
Added new: Attachments Zip Filename = MessageAttachments.zip
Added new: Attachments Min Total Size To Zip = 100k
Added new: Attachment Extensions Not To Zip = .zip .rar .gz .tgz .jpg .jpeg .mpg .mpe .mpeg .mp3 .rpm .htm .html .eml
Added new: Add Text Of Doc = no
Added new: Antiword = /usr/bin/antiword -f
Added new: Antiword Timeout = 50
Added new: Unzip Maximum Files Per Archive = 0
Added new: Unzip Maximum File Size = 50k
Added new: Unzip Filenames = *.txt *.ini *.log *.csv
Added new: Unzip MimeType = text/plain
Added new: Spam-Virus Header = X-%org-name%-MailScanner-SpamVirus-Report:
Added new: Virus Names Which Are Spam = Sane*UNOFFICIAL HTML/* *Phish*
Added new: Check Filenames In Password-Protected Archives = yes
Added new: Clamd Port = 3310
Added new: Clamd Socket = /var/run/clamav/clamd.ctl
Added new: Clamd Lock File = /var/run/clamav/clamd.pid
Added new: Clamd Use Threads = no
Added new: ClamAV Full Message Scan = yes
Added new: Fpscand Port = 10200
Added new: Phishing Bad Sites File = %etc-dir%/phishing.bad.sites.conf
Added new: Known Web Bug Servers = msgtag.com
Added new: Web Bug Replacement = http://www.mailscanner.tv/1x1spacer.gif
Added new: Archives Are = zip rar ole
Added new: Allow File MIME Types =
Added new: Deny File MIME Types =
Added new: Archives: Allow Filenames =
Added new: Archives: Deny Filenames =
Added new: Archives: Filename Rules = %etc-dir%/archives.filename.rules.conf
Added new: Archives: Allow Filetypes =
Added new: Archives: Allow File MIME Types =
Added new: Archives: Deny Filetypes =
Added new: Archives: Deny File MIME Types =
Added new: Archives: Filetype Rules = %etc-dir%/archives.filetype.rules.conf
Added new: Signature Image Filename = %report-dir%/sig.jpg
Added new: Signature Image <img> Filename = signature.jpg
Added new: ID Header = X-%org-name%-MailScanner-ID:
Added new: IP Protocol Version Header = # X-%org-name%-MailScanner-IP-Protocol:
Added new: Place New Headers At Top Of Message = no
Added new: Attach Image To Signature = no
Added new: Attach Image To HTML Message Only = yes
Added new: Allow Multiple HTML Signatures = no
Added new: Dont Sign HTML If Headers Exist = # In-Reply-To: References:
Added new: Notify Senders Of Blocked Size Attachments = no
Added new: Missing Mail Archive Is = directory
Added new: Max Spam Check Size = 200k
Added new: Use Watermarking = no
Added new: Add Watermark = yes
Added new: Check Watermarks With No Sender = yes
Added new: Treat Invalid Watermarks With No Sender as Spam = nothing
Added new: Check Watermarks To Skip Spam Checks = yes
Added new: Watermark Secret = %org-name%-Secret
Added new: Watermark Lifetime = 604800
Added new: Watermark Header = X-%org-name%-MailScanner-Watermark:
Added new: Include Binary Attachments In SpamAssassin = no
Added new: SpamAssassin Rule Actions =
Added new: Log Delivery And Non-Delivery = no
Added new: Log Permitted File MIME Types = no
Added new: Log SpamAssassin Rule Actions = yes
Added new: SpamAssassin Temporary Dir = /var/spool/MailScanner/incoming/SpamAssassin-Temp
Added new: Read IP Address From Received Header = no
Added new: Lockfile Dir = /var/lock/subsys/MailScanner
Added new: Syslog Socket Type =
Added new: Automatic Syntax Check = yes
Added new: include /etc/MailScanner/conf.d/*

Summary
——-
Read 285 settings from old /etc/MailScanner/MailScanner.conf
Used 283 settings from old /etc/MailScanner/MailScanner.conf
Used 69 default settings from new /etc/MailScanner/MailScanner.conf.dpkg-dist

Notes
—–
I would advise you to check on any parameters which are different between
the default new conf file and the conf file you just created, so that you
find any parameters whose default values have changed.
If you ran this with a command like this
upgrade_MailScanner_conf MailScanner.conf MailScanner.conf.rpmnew > MailScanner.new
then you should do
diff -w MailScanner.conf.rpmnew MailScanner.new
and check for any differences in values you have not changed yourself.

Once you have checked that MailScanner.new contains what
you want, you can then save your old one and move the new
one into place, using commands like these:
mv -f MailScanner.conf MailScanner.old
mv -f MailScanner.new  MailScanner.conf

Dopo aver fatto una copia del mio attuale file di configurazione eseguo la sostituzione del vecchio con il nuovo appena creato e il problema prima citato scompare, ma non son rose.

Ora all’avvio del servizio i problemi sono 2 :

# /etc/init.d/mailscanner start
Starting mail spam/virus scanner: MailScanner
Configuration: Failed to find any configuration files like /etc/MailScanner/conf.d/*, skipping them. at /usr/share/MailScanner//MailScanner/Config.pm line 2020

Your setting “Mail Header” contains illegal characters.
This is most likely caused by your “%org-name%” setting
which must not contain any spaces, “.” or “_” characters
as these are known to cause problems with many mail systems.

Per risolvere il primo problema citato, basta commentare l’ultima riga del file Mailscanner.conf.

Questa nuova riga è stata aggiunta in questa recente versione e visto che non ho configurazioni particolari ( la dir /etc/MailScanner/conf.d/ risulta vuota) commentandola l’errore cessa di esistere.

Per i secondo problema ho dovuto modificare il valore %org-name% nel file MailScanner.conf, infatti riportava il “.” che in questa nuova versione non viene consentito ma che prima veniva accettato.

Dopo aver applicato queste modifiche, basta riavviare MailScanner e tutto dovrebbe tornare a funzionare correttamente senza errori.

More Secure = More Happy