[Mimedefang] clamav problems

[Al Sparks]

--- Rob MacGregor <rob.macgregor at gmail.com> wrote:
> Ok,
> 
> 1) Does this happen with something other than sobig?
> 

I didn't test anything besides sobig.  But I found the problem (see below).

> 2) Does this happen if you run the command as root?
Yes.

Ok, here's what was going on.  Basically, MIMEDefang was bouncing the
bounce message when it got a positive from clamd.  So postmaster
wasn't getting out since it included an attachment of the original
message (and I think I will endeavor to strip those attachments
from postmaster).

Now I thought I had planned for that eventuality by placing the
appropriate code in filter_relay() to not filter any email originating
from localhost.

It turns out that in my test environment I had not been running
mimedefang with the "-r" option.  Without it, filter_relay() is
ignored in mimedefang-filter.

Ironically, my implementation would have worked in my production
environment since mimedefang is running with the "-r" option in
that environment.

One other thing, I had doing my tests with
     sendmail postmaster < ENTIRE_MESSAGE
and then checking logs.

Another helpful tool is "-v" options in sendmail.  I found
     sendmail –v postmaster < ENTIRE_MESSAGE
to be helpful.  On the local machine it actually showed the postmaster
bounce as well as the original bounce.  Before then, I only suspected
postmaster trying to bounce was the problem.  The STOUT from the above
command made it very clear.

Thanks for your help.
  === Al