I reverted back to
# rpm -q clamav
clamav-0.99.2-1.el6.sme.i386
As I tested in real enviroment and my users started to complain not receiving emails from some customers/suppliers, I decided to roll back.
I checked the logs qpsmtpd, qmail, spamd.
I.e. I found this:
2018-02-02 08:49:10.192461500 10481 Accepted connection 0/40 from 217.9.102.11 / mail.sixt.de
2018-02-02 08:49:10.193214500 10481 Connection from mail.sixt.de [217.9.102.11]
2018-02-02 08:49:12.134825500 10481 dispatching EHLO mail-in1.sixt.de
2018-02-02 08:49:12.138264500 10481 250-saturn.ivbonline.de Hi mail.sixt.de [217.9.102.11]
2018-02-02 08:49:12.490391500 10481 dispatching EHLO mail-in1.sixt.de
2018-02-02 08:49:12.493210500 10481 250-saturn.ivbonline.de Hi mail.sixt.de [217.9.102.11]
2018-02-02 08:49:12.539402500 10481 dispatching MAIL FROM:<neuwagenservice@sixt.de> SIZE=52195
2018-02-02 08:49:12.874712500 10481 (mail) resolvable_fromhost: pass, sixt.de has MX at sixt-de.mail.protection.outlook.com
2018-02-02 08:49:14.582405500 10481 (mail) sender_permitted_from: pass, sixt.de: 217.9.102.11 is authorized to use 'neuwagenservice@sixt.de' in 'mfrom' identity (mechanism 'ip4:217.9.102.11' matched)
2018-02-02 08:49:14.598189500 10481 (deny) logging::logterse: ` 217.9.102.11 mail.sixt.de mail-in1.sixt.de naughty 901 (dnsbl) IP 217.9.102.11 is UCEPROTECT-Level 1 listed. See
http://www.uceprotect.net/rblcheck.php?ipr=217.9.102.11 msg denied before queued
2018-02-02 08:49:14.599640500 10481 deny mail from <neuwagenservice@sixt.de> ((dnsbl) IP 217.9.102.11 is UCEPROTECT-Level 1 listed. See
http://www.uceprotect.net/rblcheck.php?ipr=217.9.102.11)
The reason therefore might be the ubllist settings. In the white-list of the server-manager I added *sixt.de. I assume that emails from *sixt.de will pass now.
# config show qpsmtpd
qpsmtpd=service
BadCountries=AC,AD,AE,AF,AG,AI,AL,AM,AN,AO,AQ,AP,AR,AS,AU,AW,AX,AZ,BA,BB,BD,BE,BF,BG,BH,BI,BJ,BL,BM,BN,BO,BQ,BR,BS,BT,BV,BW,BY,BZ,CA,CC,CD,CF,CG,CI,CK,CL,CM,CN,CO,CR,CU,CV,CW,CX,CY,CZ,DJ,DM,DO,DZ,EC,EDU,EE,EG,EH,ER,ES,ET,FI,FJ,FK,FM,FO,GA,GB,GD,GE,GF,GG,GH,GI,GL,GM,GN,GP,GQ,GR,GS,GT,GU,GW,GY,HK,HM,HN,HR,HT,HU,ID,IE,IL,IM,IN,IO,IQ,IR,IS,IT,JE,JM,JO,JP,KE,KG,KH,KI,KM,KN,KP,KR,KW,KY,KZ,LA,LB,LC,LI,LK,LR,LS,LT,LU,LV,LY,MA,MC,MD,ME,MF,MG,MH,MIL,MK,ML,MM,MN,MO,MP,MQ,MR,MS,MT,MU,MV,MW,MX,MY,MZ,NA,NAME,NC,NE,NF,NG,NI,NO,NP,NR,NU,NZ,OM,PA,PE,PF,PG,PH,PK,PM,PN,PR,PS,PT,PW,PY,QA,RE,RO,RS,RU,RW,SA,SB,SC,SD,SE,SG,SH,SI,SJ,SK,SL,SM,SN,SO,SR,SS,ST,SU,SV,SX,SY,SZ,TC,TD,TF,TG,TH,TJ,TK,TL,TM,TN,TO,TP,TR,TT,TV,TW,TZ,UA,UG,UK,UM,UY,UZ,VA,VC,VE,VG,VI,VN,VU,WF,WS,XXX,YE,YT,ZA,ZM,ZW
Bcc=enabled
BccMode=bcc
BccUser=maillog
DKIMSigning=enabled
DMARCReject=disabled
DMARCReporting=disabled
DNSBL=enabled
GeoIP=enabled
Karma=disabled
LogLevel=6
MaxScannerSize=15000000
RBLList=bl.spamcop.net,dnsbl-1.uceprotect.net,dnsbl-2.uceprotect.net,psbl.surriel.com,zen.spamhaus.org
RHSBL=enabled
RelayRequiresAuth=enabled
SBLList=multi.surbl.org,black.uribl.com,rhsbl.sorbs.net
SPFRejectPolicy=0
TlsBeforeAuth=1
UBLList=multi.surbl.org:8-16-64-128,black.uribl.com,rhsbl.sorbs.net
URIBL=enabled
access=public
qplogsumm=disabled
status=enabled
But unfortunately in the logs other emails did not show up. One of our suppliers sent the error back, which was:
Betreff: Mail delivery failed: returning message to sender
Datum: Fri, 02 Feb 2018 10:00:59 +0100
Von: Mail Delivery System <Mailer-Daemon@dedi1422.your-server.de>
An: xyz@foo.de
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
abc@foobar.de
host mail.foobar.de [87.140.117.154]
SMTP error from remote mail server after RCPT TO:<abc@foobar.de>:
550 Relaying denied (#5.7.1)
------ This is a copy of the message, including all the headers. ------
------ The body of the message is 152723 characters long; only the first
------ 24576 or so are included here.
Return-path: <xyz@foo.de>
Received: from [87.140.87.168] (helo=[192.168.0.125])
by dedi1422.your-server.de with esmtpsa (TLSv1.2:DHE-RSA-AES256-SHA:256)
(Exim 4.85_2)
(envelope-from <xyz@foo.de>)
id 1ehXDL-0004tz-D4
for abc@foobar.de; Fri, 02 Feb 2018 10:00:56 +0100
To: abc@foobar.de
Subject: Auftragsbestaetigung Nr.12345
From: x y <xyz@foo.de>
Message-ID: <ef534d9e-64c5-87d7-d632-4947e9e1419e@foo.de>
Date: Fri, 2 Feb 2018 10:00:54 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101
Thunderbird/52.6.0
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="------------980972077F439AB852439D23"
Content-Language: de-DE
X-Antivirus: Avast (VPS 180202-2, 02.02.2018), Outbound message
X-Antivirus-Status: Clean
X-Authenticated-Sender: xyz@foo.de
X-Virus-Scanned: Clear (ClamAV 0.99.3/24277/Fri Feb 2 02:23:13 2018)
This is a multi-part message in MIME format.
--------------980972077F439AB852439D23
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
In the past I didn't have the error *550 Relaying denied (#5.7.1)* All emails from the foo.de sender have been received. Maybe the install of the ClamAV 0.99.3 requires also 0.99.3 clamd and clamav-db? I didn't check if the rpms had been installed as dependencies. Maybe clamav changed in some behaviour? I don't know...
Therefore I reverted back to clamav-0.99.2-1. During the next week I will keep an eye on this.
regards,
stefan
12 Replies
6018 Views