MantisBT - Issues

0000062: Wrong URL in 'copfilter_status.cgi'

Tue, 18 Jun 2013 20:31:02 +0200

ProxSMTP-Link in 'copfilter_status.cgi' gives an '404 Not Found'.
'http://memberwebs.com/nielsen/software/proxsmtp' [^] is no longer valid, should be 'http://thewalter.net/stef/software/proxsmtp/'. [^]

0000061: Missing subroutine in '~/copfilter/etc2/copfilter_status'

Thu, 23 May 2013 13:52:53 +0200

Starting

'/var/log/copfilter/default/opt/c_icap/etc/init.de/copfilter_c-icap status'

from console results in:

c-icap./copfilter_c-icap: line 163: echo_running: command not found

0000060: Spamassassin: udpate failed from malware.com,german rulese, mime validation rulesets

Mon, 20 May 2013 20:29:27 +0200

Hi,

I installed on Copfilter V1 (0.85.3beta5) the update for new rules for Spamassassin.

Installation and Download were OK.

The display of the rules is :
Règles courantes:
2013-04-21 23:30 Règles SpamAssassin
2013-04-21 07:05 Règles MalwarePatrol
2013-04-21 07:05 Règles d'évaluation du format MIME

There is an error with download for the new rules for spamassassin, with automatic update.

I received a mail for rules update (from yesterday 23:30.

The end of the mail is:
......
-rw-r--r-- 1 root root 2484 2013-04-21 23:30 73_sandbox_manual_scores.cf
-rw-r--r-- 1 root root 2770 2013-04-21 23:30 regression_tests.cf

udpate failed from malware.com!
udpate failed from german rulesets!
udpate failed from mime validation rulesets!

Notice that german rules are not installed on my machine (installation in french)

Log in message log:

...
23:30:15 copV1 copfilter updates spamassassin: -rw-r--r-- 1 root root 6247 2013-04-21 23:30 60_whitelist_dkim.cf
Apr 21 23:30:15 copV1 copfilter updates spamassassin: -rw-r--r-- 1 root root 3635 2013-04-21 23:30 60_whitelist_spf.cf
Apr 21 23:30:15 copV1 copfilter updates spamassassin: -rw-r--r-- 1 root root 1965 2013-04-21 23:30 60_whitelist_subject.cf
Apr 21 23:30:15 copV1 copfilter updates spamassassin: -rw-r--r-- 1 root root 221390 2013-04-21 23:30 72_active.cf
Apr 21 23:30:15 copV1 copfilter updates spamassassin: -rw-r--r-- 1 root root 6610 2013-04-21 23:30 72_scores.cf
Apr 21 23:30:15 copV1 copfilter updates spamassassin: -rw-r--r-- 1 root root 2484 2013-04-21 23:30 73_sandbox_manual_scores.cf
Apr 21 23:30:15 copV1 copfilter updates spamassassin: -rw-r--r-- 1 root root 2770 2013-04-21 23:30 regression_tests.cf
Apr 21 23:30:15 copV1 copfilter updates spamassassin:
Apr 21 23:30:15 copV1 last message repeated 2 times

Apr 21 23:30:15 copV1 copfilter updates spamassassin: udpate failed from malware.com!
Apr 21 23:30:15 copV1 copfilter updates spamassassin: udpate failed from german rulesets!
Apr 21 23:30:15 copV1 copfilter updates spamassassin: udpate failed from mime validation rulesets!

Apr 21 23:30:15 copV1 copfilter updates spamassassin: Reading message body from STDIN because the '-m' option was not used.
Apr 21 23:30:15 copV1 copfilter updates spamassassin: If you are manually typing in a message:
Apr 21 23:30:15 copV1 copfilter updates spamassassin: - First line must be received within 60 seconds.
Apr 21 23:30:15 copV1 copfilter updates spamassassin: - End manual input with a CTRL-D on its own line.
Apr 21 23:30:15 copV1 copfilter updates spamassassin:
Apr 21 23:30:15 copV1 copfilter updates spamassassin: Apr 21 23:30:15 copv1 sendEmail[8237]: Message input complete.
Apr 21 23:30:16 copV1 copfilter updates spamassassin: Apr 21 23:30:16 copv1 sendEmail[8237]: Email was sent successfully!
Apr 21 23:30:16 copV1 copfilter updates spamassassin: done
Apr 21 23:30:16 copV1 fcron[7545]: Job /usr/local/bin/copfilter_cron >> /var/log/copfilter/default/opt/tools/var/log/copfilter_cron.log 2>&1 completed
Apr 21 23:30:51 copV1 spamd[8130]: dcc: [8283] terminated: exit 241

regards.

0000022: Sprachauswahl der Fehlerseiten

Tue, 14 May 2013 02:14:29 +0200

# Path to template files.
#
# Default:
# TEMPLATEPATH /usr/local/etc/havp/templates/en
TEMPLATEPATH /var/log/copfilter/default/opt/havp/etc/templates/de

hier würde ich mir wünschen, dass die Sprache der COP-Installation geladen wird. (unter anderem auch darum, weil ich die Fehlermeldungs-Seiten im URL-Filter Design verwende und diese im DE-Verzeichniss liegen)

0000058: Denied access to squid cache log

Wed, 24 Apr 2013 12:11:15 +0200

Hi,

I tested to access to squid cache log with the log GUI (last version).
version 0.84beta5 (@ Matthias: there is not possible to choose this version to report))

it is not possible to access to this log (error 403).

Httpd error log:

Tue Apr 16 19:22:25 2013] [error] [client 192.168.4.30] (13)Permission denied: file permissions deny server access: /home/httpd/html/copfilterlog/squid_cache.log
[Tue Apr 16 19:25:32 2013] [error] [client 192.168.4.30] (13)Permission denied: file permissions deny server access: /home/httpd/html/copfilterlog/squid_cache.log

right for var/log/squid/cache.log : 640 squid:squid rw-r-----

It is necessary to change the rights to 644 squid:squid rw-r--r--
Now it is working fine.
You can mark as solved.

(i didn't check for copfilter V2)

0000059: Wrong URL in BUGS

Wed, 17 Apr 2013 22:13:07 +0200

Under directory "doc_all_lang" all files named "BUGS" in [language]-dirs contain wrong URL:

- current bugs are listed here: http://copfilter.org/bugzilla [^]

should read:

- current bugs are listed here: http://copfilter.org/bugtracker [^]

0000053: defective submission of time value to find command in cron.daily

Sat, 13 Apr 2013 16:02:18 +0200

The current cron.daily contents the commands

==== SNIP =============================
find /var/log/copfilter/default/opt/p3scan/quarantine -mtime ${POP3_VIRUS_QUARANTINE_REMOVAL_DAYS} -type f -exec rm -f {} \; >/dev/null 2>&1
find /var/log/copfilter/default/opt/proxsmtp/quarantine/ -mtime ${SMTP_VIRUS_QUARANTINE_REMOVAL_DAYS} -type f -exec rm -f {} \; >/dev/null 2>&1

find /var/log/copfilter/default/opt/p3scan/tmp -mtime ${POP3_VIRUS_QUARANTINE_REMOVAL_DAYS} -type f -exec rm -f {} \; >/dev/null 2>&1
find /var/log/copfilter/default/opt/p3scan/tmp/children -mtime ${POP3_VIRUS_QUARANTINE_REMOVAL_DAYS} -type f -exec rm -f {} \; >/dev/null 2>&1
find /var/log/copfilter/default/opt/proxsmtp/tmp -mtime ${SMTP_VIRUS_QUARANTINE_REMOVAL_DAYS} -type f -exec rm -f {} \; >/dev/null 2>&1
==== SNAP ==============================

As on the GUI only integer values are allowed this may raise problems if the ipcop was down for some days.
The option -mtime ${POP3_VIRUS_QUARANTINE_REMOVAL_DAYS} f.i. may result to
-mtime 8 , which only deletes files which are exactly 8 days old (but not older!)

0000052: grep and sed command can't handle german umlauts in mailscanner.sh

Wed, 10 Apr 2013 19:08:37 +0200

mailscanner.sh rewrites subject of spam, blacklist and virus mails.
If there are german umlauts within, the result is a string of undefined characters with no sense at all.
These strings can't be processed to non umlaut characters because the original umlauts get lost when running grep or sed to extract the subject lines.
Currently no fix known.

0000054: Virus test and send test e-mail + dangerous attachement don't work

Wed, 10 Apr 2013 19:08:19 +0200

On Copfilter V1 (0.85.3beta5) and Copfilter V2 (2.091beta3), sending a virus test and dangerous attachment don't work.
/var/log/copfilter/default/tests/virus/send_virus_mail.sh doesn't work.

But sending a spam test is working (Copfilter V1 and Copfilter V2)

0000026: Mails from Clam AV

Wed, 10 Apr 2013 19:05:46 +0200

I become more Mails from the ClamAV from my different Cops than from my Businesspartners. I think it was usefull to have a joice that ClamAV send only a Mail when the Update older then X-days, or a critical error exist.

0000019: Whitelist von HAVP ueber GUI aendern?

Wed, 10 Apr 2013 19:04:55 +0200

Wunsch fuer die Zukunft:

Koennte man die White-/Blacklist von HAVP ueber die GUI zugaenglich machen und dort Eintragungen vorzunehmen, wie bei der Whitelist für die Emails?

0000029: Logs - way of listing

Wed, 10 Apr 2013 19:01:45 +0200

In the GUI of the IPCOP i can switch the way of logging. Last input on the top or at last. It would nice when the setting from the IPCOP could also be used for the logs from Copfilter.

0000041: no slash in password allowed if using smtp_auth

Wed, 10 Apr 2013 19:00:52 +0200

Habe auf 4.10.1 aus dem Thread: http://copfilter.endlich-mail.de/viewtopic.php?t=2079&highlight=monit&sid= [^] geupdated, da ich endlich mal die Monit-Emails kriegen wollte. Das Ergebnis: Monit ließ sich nach den ganzen notwendigen Änderungen in den dort angegebenen Dateien nicht mehr starten.

Ursache
ein Slash / im Passwort zur Emailadresse.
und zwar trägt die Zeile:
code: sed -e "/# COPFILTER START - mail server/,/# COPFILTER STOP - mail server/s/ .*/ set mailserver ${SMTP_HOST_MONIT} username \"${SMTP_AUTH_USER}\" password \"${SMTP_AUTH_PASS}\" /" >/tmp/monitrc.tmp

und zwar speziell der Eintrag \"${SMTP_AUTH_PASS}\" einen Slash zuviel in die Zeile hinein (aus dem Passwort), was dazu führt, dass die monitrc nicht mehr richtig geschrieben wird (größe 0) -> Monit startet nicht.

Abhilfe im moment: kein Kennwort mit einem Backslash einsetzen

0000036: Configuration error for checking HAVP process in Monit

Wed, 10 Apr 2013 19:00:16 +0200

This error belongs to all copfilter versions. The process pidfile for havp is false in monitrc.

check process havp with pidfile /var/log/copfilter/default/opt/havp/var/run/havp.pid

should be:
check process havp with pidfile /var/log/copfilter/default/opt/havp/var/run/havp_daemon.pid

If havp crashed, the havp.pid file keeps and the havp_daemon.pid file is deleted

0000037: another Antivir-tool

Wed, 10 Apr 2013 18:58:49 +0200

I found in the web a link for another free Antivirprog.

http://it-em.net/cms/front_content.php?client=1&lang=1&idcat=30 [^]
In this Link i read something about "Dämon" so it is perhabs possible to scan http traffic an not only mailtraffic?

0000031: zuviele und zu alte Einträge in der freshclam.log

Wed, 10 Apr 2013 18:58:22 +0200

Diese Log besitzt uralte Einträge ist ziemlich groß. Wird das überhaupt noch benötigt? Hab die mal editiert und überflüssige Einträge gelöscht.

0000030: Updatecheck von AVG obwohl AVG nicht installiert ist

Wed, 10 Apr 2013 18:56:22 +0200

In der copfilter_cron.log finde ich zuhauf diese Einträge:

/var/log/copfilter/default/opt/tools/bin/check-updates_avg.sh: line 25: /var/log/copfilter/default/opt/avg/default/bin/avgscan: No such file or directory
/var/log/copfilter/default/opt/tools/bin/check-updates_avg.sh: line 27: /var/log/copfilter/default/opt/avg/default/bin/avgupdate: No such file or directory
/var/log/copfilter/default/opt/tools/bin/check-updates_avg.sh: line 29: /var/log/copfilter/default/opt/avg/default/bin/avgscan: No such file or directory

Anscheinend wird versucht, AVG zu aktualisieren, obwohl AVG garnicht installiert ist.

Ist mehr eine Unschöhnheit und wahrscheins Trivial, aber immerhin wird regelmäßig ein Job ausgeführt, der eigentlich nicht sein muß.

0000014: 'MBL.NDB': Typos in cron.daily / copfilter_functions / copfilter_antivirus.cgi

Wed, 10 Apr 2013 18:55:44 +0200

As described in http://copfilter.endlich-mail.de/viewtopic.php?p=11306#11306 [^]

"Typo in the mbl.ndb mod:"

File: cron.daily, Lines 54ff:

***SNIP***
$BASEDIR/opt/tools/bin/wget -O - http://www.malware.com.br/cgi/submit?action=list_clamav [^] > /tmp/mbl.db
if [ `ls -s /tmp/mbl.db | cut -d " " -f1` = 0 ]; then
rm -f /tmp/mbl.db
else
mv -f /tmp/mbl.db $BASEDIR/opt/clamav/virdb/mbl.db
rm -f /tmp/mbl.db
fi
***SNAP***

Should read:
$BASEDIR/opt/tools/bin/wget -O - http://www.malware.com.br/cgi/submit?action=list_clamav_ext [^] > /tmp/mbl.ndb
if [ `ls -s /tmp/mbl.ndb | cut -d " " -f1` = 0 ]; then
rm -f /tmp/mbl.ndb
else
mv -f /tmp/mbl.ndb $BASEDIR/opt/clamav/virdb/mbl.ndb
# rm -f /tmp/mbl.ndb
fi

***SNIP***

By the way, the *second* "rm -f /tmp/mbl.db"-line seems to be one too much!?

I put a comment there - could anyone confirm?

Furthermore, changes in 'copfilter_antivirus.cgi', Line 987ff:

***SNIP***
#Version der Malware-Datenbank
if ( -e "/var/log/copfilter/default/opt/clamav/virdb/mbl.ndb" ){
$output = `ls -la /var/log/copfilter/default/opt/clamav/virdb/ |grep mbl.ndb |cut -c 36-65`;
$output = &Header::cleanhtml($output,"y");
print "
$output\n";
}
***SNAP***

and three changes in 'copfilter_functions', 'mbl.db' needs to be changed to 'mbl.ndb'.

0000016: Localization needs rework in general

Wed, 10 Apr 2013 18:54:51 +0200

Many language files seem to be outdated or even contain errors.
It seems to be advisable to get in contact with the maintainers.

1. Check out, who is still willing to maintain a certain language.
2. Do the needed accommodations soon.
3. Temporarily put the unmaintained languages out of use.

It is better to have a correct, complete and working English version of the files, than bad translations, which may produce errors at worst.

0000018: Note 2. is incorrect

Wed, 10 Apr 2013 18:54:26 +0200

Wrong filename given.

Wrong:
2. The Setting DatabaseMirror in clamd.conf should be configured with your country code (See IANA for the full list)

Right:
2. The Setting DatabaseMirror in /var/log/copfilter/default/opt/clamav/etc/freshclam.conf should be configured with your country code (See IANA for the full list)

0000017: Note 1. is outdated/incorrect

Wed, 10 Apr 2013 18:54:10 +0200

The setting ArchiveMaxFileSize does not longer exist!

Wrong:
Note:
1. ClamAV does not scan files for viruses, if file size is over 10MByte (this setting can be configured in /var/log/copfilter/default/opt/clamav/etc/clamd.conf (Setting: ArchiveMaxFileSize)

Right:
1. ClamAV does not scan files for viruses if the file size is over 100MByte. This setting can be configured in /var/log/copfilter/default/opt/clamav/etc/clamd.conf for the ClamAV daemon (Setting: MaxScanSize) and /var/log/copfilter/default/opt/havp/etc/havp.config for the ClamAV library (Setting: CLAMMAXSCANSIZE).

0000015: Unneeded spaces prevent services from starting

Wed, 10 Apr 2013 18:52:50 +0200

es.sh: Line 6 + 7 contain two unneeded spaces, which prevent the services from being started.

Wrong:
CPerr_not_exist= "copfilter no está instalado o el archivo global_settings ...
CP_warning= "CUIDADO:\n\

Right:
CPerr_not_exist="copfilter no está instalado o el archivo global_settings ...
CP_warning="CUIDADO:\n\

0000008: Some smaller details still need to be fixed

Wed, 10 Apr 2013 18:52:15 +0200

Format, language ...

0000042: freshclam configuration - countrycode

Wed, 10 Apr 2013 18:50:53 +0200

The country code should be set in freshclam.conf.
-----
# Uncomment the following line and replace XY with your country
# code. See http://www.iana.org/cctld/cctld-whois.htm [^] for the full list.
#DatabaseMirror db.XY.clamav.net
-----

The country code must be set in order to do updates more often than hourly (max. 4 updates per hour - see http://www.clamav.net/support/faq/ [^]).

The gui setting does not match the update frequency (this has been changed in copfilter_antivirus.cgi) - if it is set to one hour, the update will be called twice an hour.
This should be changed, so that the setting matches the real update frequency. And it should be changed so that it will be possible to configure up to 4 updates per hour.

0000047: Spam-Mails in der Quarantäne - Kein Löschen über WebGUI möglich

Wed, 10 Apr 2013 18:47:35 +0200

N'bend :-)

Dieses Phänomen ist mir zwar schon vor längerer Zeit aufgefallen (direkt nach einer Install, nach Abruf von Mails), aber grade aktuell wollte ich meine Quarantäne mal aufräumen und da fiel es mir wieder ein: Ein Löschen der Mails funktioniert nicht. Weder durch Einzellöschung noch durch den Button "Lösche alle Emails aus der Quarantäne". Auch durch Setzen anderer erweiterter Rechte für p3scan nicht. Erst das manuelle Löschen via WinSCP im Verzeichnis "/opt/p3scan/quarantine" ging, danach wurde mir auch "Null" Spammails angezeigt.
Das Phänomen bezieht sich nicht nur auf Spammails, auch Virenmails kann/konnte ich nicht löschen (war mir mal bei einer früheren Install aufgefallen).
Warum ich das jetzt erst melde? Habs immer wieder vergessen. *g*