qmail-scanner安裝後髮帶附件的郵件失敗

qmail-scanner安裝後髮帶附件的郵件失敗

1.qmail-1.05,  spamassassin,  clamav-0.90rc,  qmail-scanner-2.01

2.不啟用qmail-scanner之前一切正常.
  啟用後,用各種客戶端發沒附件的郵件正常,發有 附件的郵件時就發不出,並提示:....hte mail server responded qq temporary problem(#4.3.0)......
  同時我發現clamd也同時退出了.
----------------------------------
在網上找了一個,大約都是說qmail-smtpd的run中的softlimit 設小了,我都設為80M了,只發一個幾個位元組文件的附件也出問題.

以下是相關內容:請大家幫助參考一下:
3. mailog:
  Nov 15 14:32:08 linuxas X-Qmail-Scanner-2.01: clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2
Nov 15 14:32:23 linuxas X-Qmail-Scanner-2.01: clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2   

4.qmail-queue.log
Wed, 15 Nov 2006 14:32:22 CST:14496: +++ starting debugging for process 14496 by uid=510
Wed, 15 Nov 2006 14:32:22 CST:14496: setting UID to EUID so subprocesses can access files generated by this script
Wed, 15 Nov 2006 14:32:22 CST:14496: program name is qmail-scanner-queue.pl, version 2.01
Wed, 15 Nov 2006 14:32:22 CST:14496: w_c: mkdir /var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496
Wed, 15 Nov 2006 14:32:22 CST:14496: w_c: start dumping incoming msg into /var/spool/qscan/working/tmp/linuxas.cn.abc.com116357234254014496
Wed, 15 Nov 2006 14:32:22 CST:14496: c_a_g: found MIME attachment
Wed, 15 Nov 2006 14:32:22 CST:14496: w_c: primary Content-Type of multipart/mixed found
Wed, 15 Nov 2006 14:32:23 CST:14496: w_c: found a top-level boundary definition of \-\-\-\-\-\-\-\-\-\-\-\-030106090509070403030403
Wed, 15 Nov 2006 14:32:23 CST:14496: w_c: attachment  1: Content-Type of text/plain found
Wed, 15 Nov 2006 14:32:23 CST:14496: found C-T attachment filename "bayesian.txt"
Wed, 15 Nov 2006 14:32:23 CST:14496: w_c: attachment  2: Content-Type of text/plain found
Wed, 15 Nov 2006 14:32:23 CST:14496: w_c: rename new msg from /var/spool/qscan/working/tmp/linuxas.cn.abc.com116357234254014496 to /var/spool/qscan/working/new/linuxas.cn.abc.com116357234254014496
Wed, 15 Nov 2006 14:32:23 CST:14496: w_c: total time between DATA command and "." was 0.021284 secs
Wed, 15 Nov 2006 14:32:23 CST:14496: w_c: (this is basically the time it took the client to send the message over the network
Wed, 15 Nov 2006 14:32:23 CST:14496: w_c: resetting timer so as to measure actual Qmail-Scanner processing time
Wed, 15 Nov 2006 14:32:23 CST:14496: incoming SMTP connection from via SMTP from 192.168.0.45
Wed, 15 Nov 2006 14:32:23 CST:14496: d_m: starting /usr/local/bin/reformime  -x/var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496/ </var/spool/qscan/working/new/linuxas.cn.abc.com116357234254014496
Wed, 15 Nov 2006 14:32:23 CST:14496: d_m: finished /usr/local/bin/reformime  -x/var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496/
Wed, 15 Nov 2006 14:32:23 CST:14496: d_m: Checking all attachments to see if they're MS-TNEF
Wed, 15 Nov 2006 14:32:23 CST:14496: d_m: is /var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496/1163572343.14498-0.linuxas.cn.abc.com is a TNEF file?: 256
Wed, 15 Nov 2006 14:32:23 CST:14496: d_m: is /var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496/Bayesian.txt is a TNEF file?: 256
Wed, 15 Nov 2006 14:32:23 CST:14496: d_m: Check for zip files...
Wed, 15 Nov 2006 14:32:23 CST:14496: d_m: unpacking message took 0.026361 seconds
Wed, 15 Nov 2006 14:32:23 CST:14496: unsetting QMAILQUEUE env var
Wed, 15 Nov 2006 14:32:23 CST:14496: g_e_h: return-path is "admin@cn.abc.com", recips is "test@cn.abc.com"
Wed, 15 Nov 2006 14:32:23 CST:14496: from=admin <admin@cn.abc.com>,subj=test, x-qmail-scanner-message-id=<455AB475.90901@cn.abc.com> via SMTP from 192.168.0.45
Wed, 15 Nov 2006 14:32:23 CST:14496: ini_sc: start scanning
Wed, 15 Nov 2006 14:32:23 CST:14496: ini_sc: recursively scan the directory /var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496/
Wed, 15 Nov 2006 14:32:23 CST:14496: scanloop(virus): starting scan of directory "/var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496"...
Wed, 15 Nov 2006 14:32:23 CST:14496: scanloop: scanner=clamdscan_scanner,plain_text_msg=0
Wed, 15 Nov 2006 14:32:23 CST:14496: clamdscan: starting scan of directory "/var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496"...
Wed, 15 Nov 2006 14:32:23 CST:14496: run /usr/local/bin/clamdscan --no-summary  /var/spool/qscan/tmp/linuxas.cn.abc.com116357234254014496 2>&1
Wed, 15 Nov 2006 14:32:23 CST:14496: --output of clamdscan was:
connect(): Connection refused
WARNING: Can't connect to clamd.
--
Wed, 15 Nov 2006 14:32:23 CST:14496: error_condition: X-Qmail-Scanner-2.01: clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2

5.clamd.log 沒有這個時間段記錄.
6./var/qmail/supervise/qmail-smtpd/run:
#!/bin/sh

#QMAILDUID=`id -u qmaild`
#NOFILESGID=`id -g qmaild`
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`

MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
LOCAL=`head -1 /var/qmail/control/me`

if [ -z "$QMAILDUID" -o -z "$NOFILESGID" -o -z "$MAXSMTPD" -o -z "$LOCAL" ]; then
    echo QMAILDUID, NOFILESGID, MAXSMTPD, or LOCAL is unset in
    echo /var/qmail/supervise/qmail-smtpd/run
    exit 1
fi

if [ ! -f /var/qmail/control/rcpthosts ]; then
    echo "No /var/qmail/control/rcpthosts!"
    echo "Refusing to start SMTP listener because it'll create an open relay"
    exit 1
fi

exec /usr/local/bin/softlimit -m 80000000 \
    /usr/local/bin/tcpserver -v -R -l "$LOCAL" -x /etc/tcp.smtp.cdb -c "$MAXSMTPD" \
-u "$QMAILDUID" -g "$NOFILESGID" 0 smtp \
  /usr/local/bin/rblsmtpd -r cblplus.anti-spam.org.cn \
                          -r relays.ordb.org \
/var/qmail/bin/qmail-smtpd \
/home/vpopmail/bin/vchkpw-smtp /bin/true \
/bin/cmd5checkpw /bin/true 2>&1

7.qmail-scanner-queue.pl許可權為4755.
qmail-scanner-queue.pl中部分內容.其中的數字我都有改小過.也不行

my $VERSION="2.01";

my @scanner_array=("clamdscan_scanner");

my $max_zip_size='8000000';

my $clamscan_binary='/usr/local/bin/clamscan';
my $clamscan_options="-r -m --unzip --unrar --unzoo --lha --disable-summary --max-recursion=10 --max-space=10M";
my $clamdscan_binary='/usr/local/bin/clamdscan';
my $clamdscan_options="--no-summary";
my $spamc_binary='/usr/bin/spamc';
my $spamc_options=' -t 30 -c ';
my $spamc_subject='';
my $spamassassin_binary='/usr/bin/spamassassin';

8./etc/tcp.smtp
127.:allow,RELAYCLIENT="",RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-queue"
192.168.0.:allow,RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl"
10.10.:allow,RBLSMTPD="",QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl"
:allow,QMAILQUEUE="/var/qmail/bin/qmail-scanner-queue.pl"


9.clamd.conf

##
## Example config file for the Clam AV daemon
## Please read the clamd.conf(5) manual before editing this file.
##


# Comment or remove the line below.
#Example

# Uncomment this option to enable logging.
# LogFile must be writable for the user running daemon.
# A full path is required.
# Default: disabled
#LogFile /tmp/clamd.log
LogFile /var/log/clamd.log

# By default the log file is locked for writing - the lock protects against
# running clamd multiple times (if want to run another clamd, please
# copy the configuration file, change the LogFile variable, and run
# the daemon with --config-file option).
# This option disables log file locking.
# Default: no
#LogFileUnlock yes

# Maximal size of the log file.
# Value of 0 disables the limit.
# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes). To specify the size
# in bytes just don't use modifiers.
# Default: 1M
LogFileMaxSize 5M

# Log time with each message.
# Default: no
LogTime yes

# Also log clean files. Useful in debugging but drastically increases the
# log size.
# Default: no
LogClean yes

# Use system logger (can work together with LogFile).
# Default: no
LogSyslog yes

# Specify the type of syslog messages - please refer to 'man syslog'
# for facility names.
# Default: LOG_LOCAL6
LogFacility LOG_MAIL

# Enable verbose logging.
# Default: no
LogVerbose yes

# This option allows you to save a process identifier of the listening
# daemon (main thread).
# Default: disabled
PidFile /var/run/clamd.pid

# Optional path to the global temporary directory.
# Default: system specific (usually /tmp or /var/tmp).
#TemporaryDirectory /var/tmp

# Path to the database directory.
# Default: hardcoded (depends on installation options)
#DatabaseDirectory /var/lib/clamav
DatabaseDirectory /usr/local/share/clamav

# The daemon works in a local OR a network mode. Due to security reasons we
# recommend the local mode.

# Path to a local socket file the daemon will listen on.
# Default: disabled (must be specified by a user)
LocalSocket /tmp/clamd

# Remove stale socket after unclean shutdown.
# Default: no
#FixStaleSocket yes

# TCP port address.
# Default: no
#TCPSocket 3310

# TCP address.
# By default we bind to INADDR_ANY, probably not wise.
# Enable the following to provide some degree of protection
# from the outside world.
# Default: no
#TCPAddr 127.0.0.1

# Maximum length the queue of pending connections may grow to.
# Default: 15
#MaxConnectionQueueLength 30

# Clamd uses FTP-like protocol to receive data from remote clients.
# If you are using clamav-milter to balance load between remote clamd daemons
# on firewall servers you may need to tune the options below.

# Close the connection when the data size limit is exceeded.
# The value should match your MTA's limit for a maximal attachment size.
# Default: 10M
StreamMaxLength 20M

# Limit port range.
# Default: 1024
#StreamMinPort 30000
# Default: 2048
#StreamMaxPort 32000

# Maximal number of threads running at the same time.
# Default: 10
#MaxThreads 20

# Waiting for data from a client socket will timeout after this time (seconds).
# Value of 0 disables the timeout.
# Default: 120
#ReadTimeout 300

# Waiting for a new job will timeout after this time (seconds).
# Default: 30
#IdleTimeout 60

# Maximal depth directories are scanned at.
# Default: 15
#MaxDirectoryRecursion 20

# Follow directory symlinks.
# Default: no
#FollowDirectorySymlinks yes

# Follow regular file symlinks.
# Default: no
#FollowFileSymlinks yes

# Perform internal sanity check (database integrity and freshness).
# Default: 1800 (30 min)
#SelfCheck 600

# Execute a command when virus is found. In the command string %v will
# be replaced by a virus name.
# Default: no
VirusEvent /usr/local/bin/send_sms 123456789 "VIRUS ALERT: %v"

# Run as a selected user (clamd must be started by root).
# Default: don't drop privileges
User clamav

# Initialize supplementary group access (clamd must be started by root).
# Default: no
#AllowSupplementaryGroups no

# Stop daemon when libclamav reports out of memory condition.
#ExitOnOOM yes

# Don't fork into background.
# Default: no
#Foreground yes

# Enable debug messages in libclamav.
# Default: no
#Debug yes

# Do not remove temporary files (for debug purposes).
# Default: no
#LeaveTemporaryFiles yes

# In some cases (eg. complex malware, exploits in graphic files, and others),
# ClamAV uses special algorithms to provide accurate detection. This option
# controls the algorithmic detection.
# Default: yes
#AlgorithmicDetection yes

##
## Executable files
##

# PE stands for Portable Executable - it's an executable file format used
# in all 32-bit versions of Windows operating systems. This option allows
# ClamAV to perform a deeper analysis of executable files and it's also
# required for decompression of popular executable packers such as UPX, FSG,
# and Petite.
# Default: yes
#ScanPE yes

# Executable and Linking Format is a standard format for UN*X executables.
# This option allows you to control the scanning of ELF files.
# Default: yes
ScanELF yes

# With this option clamav will try to detect broken executables (both PE and
# ELF) and mark them as Broken.Executable.
# Default: no
#DetectBrokenExecutables yes


##
## Documents
##

# This option enables scanning of Microsoft Office document macros.
# Default: yes
ScanOLE2 yes

##
## Mail files
##

# Enable internal e-mail scanner.
# Default: yes
ScanMail yes

# If an email contains URLs ClamAV can download and scan them.
# WARNING: This option may open your system to a DoS attack.
#           Never use it on loaded servers.
# Default: no
#MailFollowURLs no

# With this option enabled ClamAV will try to detect phishing attempts (using signatures).
# Default: yes
#DetectPhishing yes

# Use phishing detection for all domains (not just those listed in the .pdb database).
# It is not recommended to turn this option on, it is mean for internal use.
# (available in experimental builds only)
# Default: no
#PhishingStrictURLCheck no

# Scan urls found in mails for phishing attempts.
# (available in experimental builds only)
# Default: yes
#PhishingScanURLs yes

##
## HTML
##

# Perform HTML normalisation and decryption of MS Script Encoder code.
# Default: yes
ScanHTML yes


##
## Archives
##

# ClamAV can scan within archives and compressed files.
# Default: yes
ScanArchive yes

# The options below protect your system against Denial of Service attacks
# using archive bombs.

# Files in archives larger than this limit won't be scanned.
# Value of 0 disables the limit.
# Default: 10M
#ArchiveMaxFileSize 15M

# Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
# file, all files within it will also be scanned. This options specifies how
# deep the process should be continued.
# Value of 0 disables the limit.
# Default: 8
#ArchiveMaxRecursion 10

# Number of files to be scanned within an archive.
# Value of 0 disables the limit.
# Default: 1000
#ArchiveMaxFiles 1500

# If a file in an archive is compressed more than ArchiveMaxCompressionRatio
# times it will be marked as a virus (Oversized.ArchiveType, e.g. Oversized.Zip)
# Value of 0 disables the limit.
# Default: 250
#ArchiveMaxCompressionRatio 300

# Use slower but memory efficient decompression algorithm.
# only affects the bzip2 decompressor.
# Default: no
#ArchiveLimitMemoryUsage yes

# Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
# Default: no
#ArchiveBlockEncrypted no

# Mark archives as viruses (e.g. RAR.ExceededFileSize, Zip.ExceededFilesLimit)
# if ArchiveMaxFiles, ArchiveMaxFileSize, or ArchiveMaxRecursion limit is
# reached.
# Default: no
ArchiveBlockMax yes

# Enable support for Sensory Networks' NodalCore hardware accelerator.
# Default: no
#NodalCoreAcceleration yes


##
## Clamuko settings
## WARNING: This is experimental software. It is very likely it will hang
##            up your system!!!
##

# Enable Clamuko. Dazuko (/dev/dazuko) must be configured and running.
# Default: no
#ClamukoScanOnAccess yes

# Set access mask for Clamuko.
# Default: no
#ClamukoScanOnOpen yes
#ClamukoScanOnClose yes
#ClamukoScanOnExec yes

# Set the include paths (all files in them will be scanned). You can have
# multiple ClamukoIncludePath directives but each directory must be added
# in a seperate line.
# Default: disabled
#ClamukoIncludePath /home
#ClamukoIncludePath /students

# Set the exclude paths. All subdirectories are also excluded.
# Default: disabled
#ClamukoExcludePath /home/bofh

# Don't scan files larger than ClamukoMaxFileSize
# Value of 0 disables the limit.
# Default: 5M
ClamukoMaxFileSize 10M

Tags: