amavis quarantine

Hi all  ;)

I have been using postfix-amavis one year and I am pretty
happy with them.
I have this setup on a 50-user file:

$virus_quarantine_to = "virus-quarantine$mydomain";

(I download every week the messages contained in that email
address
with no problem.)

Today an email was quarantined because it had an .exe file,
I checked
the virus-quarantine mailbox trying to find it with no
results, so I
remembered that the message said:

The message has been quarantined as:
  /var/lib/amavis/quarantine

So I ssh the server and went to  /var/lib/amavis/ but the
"quarantine"
directory is just a file and, apparently, it grew to 180Mb
since
install.

Why do I have two different quarantines ? Can I access the
last one? How?

Thanks guys!

------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Andres wrote:

> Hi all  ;)

> I have been using postfix-amavis one year and I am
pretty happy with them.
> I have this setup on a 50-user file:

> $virus_quarantine_to = "virus-quarantine$mydomain";

> (I download every week the messages contained in that
email address
> with no problem.)

> Today an email was quarantined because it had an .exe
file, I checked
> the virus-quarantine mailbox trying to find it with no
results, so I
> remembered that the message said:

> The message has been quarantined as:
>   /var/lib/amavis/quarantine

> So I ssh the server and went to  /var/lib/amavis/ but
the "quarantine"
> directory is just a file and, apparently, it grew to
180Mb since
> install.

> Why do I have two different quarantines ? Can I access
the last one? How?

> Thanks guys!

This was a bug in some early versions of amavisd-new on
Debian.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350917

I suggest changing:
$QUARANTINEDIR = "$MYHOME/quarantine";
to
$QUARANTINEDIR = "$MYHOME/virusmails";

(this may place some quarantined items in the virusmails
directory).

and possibly setting:
$banned_quarantine_to = "virus-quarantine$mydomain";
(or other appropriate mailbox)

Do you have a POP3 server running on this machine? If not,
you could
possibly install qpopper, add a user called 'quarantine':
adduser quarantine
then:
cp /var/lib/amavis/quarantine /var/mail

Then retrieve the mail via pop3.

Then you could possibly remove qpopper if this is only a
relay
server and there is no local mail storage.

If this is the case and you wish to remove qpopper, make
sure it's the
only thing that will be removed by 'simulating' removing it
first:
apt-get -s remove qpopper

Gary V



------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

On 7/16/07, Gary V <listsjohnmecham.com> wrote:
>
> This was a bug in some early versions of amavisd-new on
Debian.
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=350917
>
> I suggest changing:
> $QUARANTINEDIR = "$MYHOME/quarantine";
> to
> $QUARANTINEDIR = "$MYHOME/virusmails";
>
> (this may place some quarantined items in the
virusmails directory).
>
> and possibly setting:
> $banned_quarantine_to = "virus-quarantine$mydomain";
> (or other appropriate mailbox)

Ok I'll change that and try.

> Do you have a POP3 server running on this machine? If
not, you could
> possibly install qpopper, add a user called
'quarantine':
> adduser quarantine
> then:
> cp /var/lib/amavis/quarantine /var/mail
>
> Then retrieve the mail via pop3.

My mail solution is SMTP/POP3 based (no imap) so pop3 is
common,
actually is what I use to download virus emails from
"$virus_quarantine_to"

There is no way of recover that email quarantined to
$MYHOME/quarantine right?

>
> Gary V
>

Thanks for your answer Gary !

------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

At 09:46 AM 7/17/2007, Andres wrote:

>There is no way of recover that email quarantined to
$MYHOME/quarantine right?

Likely that file is an mbox mail file, so the
"formail" command 
should be able to split it out to individual messages.   See
the 
formail man page for the right syntax.

-- 
Noel Jones 


------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Andres wrote:

>> Do you have a POP3 server running on this machine?
If not, you could
>> possibly install qpopper, add a user called
'quarantine':
>> adduser quarantine
>> then:
>> cp /var/lib/amavis/quarantine /var/mail
>>
>> Then retrieve the mail via pop3.

> My mail solution is SMTP/POP3 based (no imap) so pop3
is common,
> actually is what I use to download virus emails from
> "$virus_quarantine_to"

> There is no way of recover that email quarantined to
$MYHOME/quarantine right?

Yes, I think you can. Are you using mbox or maildir mail
storage?

If necessary you should be able to edit the file and do a
copy and
paste of a needed message. I personally would use WinSCP for
a task
like that. Copy the message to the clipboard, paste it to
notepad and
save it as an .EML file.

Gary V



------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Noel wrote:

> At 09:46 AM 7/17/2007, Andres wrote:

>>There is no way of recover that email quarantined to
$MYHOME/quarantine right?

> Likely that file is an mbox mail file, so the
"formail" command 
> should be able to split it out to individual messages. 
 See the 
> formail man page for the right syntax.

I did a Google on 'mbox to maildir' and quickly found a
script that works:

http://perfectmail
dir.home-dn.net/

For my test, I did:

cd
wget http://perfectmaildir.home-dn.net/perfect_ma
ildir/perfect_maildir.pl
chmod +x perfect_maildir.pl
maildirmake temp
./perfect_maildir.pl temp < /var/mail/garyv

Gary V



------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

On 7/17/07, Gary V <listsjohnmecham.com> wrote:
> Yes, I think you can. Are you using mbox or maildir
mail storage?
>
> If necessary you should be able to edit the file and do
a copy and
> paste of a needed message. I personally would use
WinSCP for a task
> like that. Copy the message to the clipboard, paste it
to notepad and
> save it as an .EML file.
>
> Gary V

Gary, Postfix is using Maildir format, so I think amavis
does too
(right?) I will try your solution, with careful because the
file is a
little big.

Thanks Noel and Gary. This is the kind of help someone
expects to
receive on a mailing list (maybe the guys at postfix list
want to
learn from you)

------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Andres wrote:

> Gary, Postfix is using Maildir format, so I think
amavis does too
> (right?)

No, the file: /var/lib/amavis/quarantine is in mbox format.
Amavisd-new created this file, not Postfix.

http://www.ijs.si/software/amavisd/amavisd-ne
w-docs.html#quarantine

Will show that if $QUARANTINEDIR points to a file (which
will be
created if it does not exist) and not a directory, when
using the
default local: quarantine method, quarantined mail will be
appended
to the file in mbox format. Since your mail is stored in
maildir
format, one option is to convert the file to maildir
format.

This only applies if also using some of the default
$*_quarantine_to
settings (and not an email address).

When $QUARANTINEDIR points to a directory (and the default
local:
quarantine method is used, and you are quarantining to one
of the
default locations, like 'banned-quarantine') then each
message is
placed in a separate file.

> I will try your solution, with careful because the file
is a
> little big.

> Thanks Noel and Gary. This is the kind of help someone
expects to
> receive on a mailing list (maybe the guys at postfix
list want to
> learn from you)

Gary V



------------------------------------------------------------
-------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and
take
control of your XML. No limits. Just data. Click to get it
now.
http://sourcefor
ge.net/powerbar/db2/
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/