Results 1 to 10 of 11

Thread: Mail being virus scanned twice?

Hybrid View

  1. #1
    Join Date
    Dec 2007
    Location
    Stockton, CA
    Posts
    164
    Rep Power
    7

    Default Mail being virus scanned twice?

    I'm running Zimbra 8.0.2, and it looks like internal messages are being virus scanned twice.

    This sample is of me sending myself a test message. Notice the double virus scanning?

    Code:
    Return-Path: ahoppe@mpcsd.org
    Received: from cottontail.mpcsd.org (LHLO cottontail.mpcsd.org) (10.1.1.37)
     by cottontail.mpcsd.org with LMTP; Wed, 9 Jan 2013 15:02:28 -0800 (PST)
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by cottontail.mpcsd.org (Postfix) with ESMTP id 6A5D513003FA
    	for <ahoppe@mpcsd.org>; Wed,  9 Jan 2013 15:02:28 -0800 (PST)
    X-Virus-Scanned: amavisd-new at mpcsd.org
    Received: from cottontail.mpcsd.org ([127.0.0.1])
    	by localhost (cottontail.mpcsd.org [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id Q-E7reEF_hCp for <ahoppe@mpcsd.org>;
    	Wed,  9 Jan 2013 15:02:23 -0800 (PST)
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by cottontail.mpcsd.org (Postfix) with ESMTP id 98760130043E
    	for <ahoppe@mpcsd.org>; Wed,  9 Jan 2013 15:02:22 -0800 (PST)
    X-Virus-Scanned: amavisd-new at mpcsd.org
    Received: from cottontail.mpcsd.org ([127.0.0.1])
    	by localhost (cottontail.mpcsd.org [127.0.0.1]) (amavisd-new, port 10026)
    	with ESMTP id yzxYc2tlBePN for <ahoppe@mpcsd.org>;
    	Wed,  9 Jan 2013 15:02:21 -0800 (PST)
    Received: from cottontail.mpcsd.org (cottontail.mpcsd.org [10.1.1.37])
    	by cottontail.mpcsd.org (Postfix) with ESMTP id 9789E1300433
    	for <ahoppe@mpcsd.org>; Wed,  9 Jan 2013 15:02:21 -0800 (PST)
    Date: Wed, 9 Jan 2013 15:02:21 -0800 (PST)
    From: Anthony Hoppe <ahoppe@mpcsd.org>
    To: Anthony Hoppe <ahoppe@mpcsd.org>
    Message-ID: <202652381.159722.1357772541292.JavaMail.root@mpcsd.org>
    Subject: Test
    MIME-Version: 1.0
    Content-Type: text/plain; charset=utf-8
    Content-Transfer-Encoding: 7bit
    X-Originating-IP: [10.10.45.40]
    X-Mailer: Zimbra 8.0.2_GA_5569 (ZimbraWebClient - GC23 (Mac)/8.0.2_GA_5569)
    Thread-Topic: Test
    Thread-Index: sSVLV0LfkoHhnUpZbrPo+EcgTtIwnw==
    Here is a message from an internal user to me (user is masked for privacy) before we upgraded to 8.0.2 (we were previously running 6.0.14). Only

    Code:
    Return-Path: [maskeduser]@mpcsd.org
    Received: from cottontail.mpcsd.org (LHLO cottontail.mpcsd.org) (10.1.1.37)
     by cottontail.mpcsd.org with LMTP; Fri, 14 Dec 2012 16:04:29 -0800 (PST)
    Received: from localhost (localhost [127.0.0.1])
    	by cottontail.mpcsd.org (Postfix) with ESMTP id CC4E3DD0006;
    	Fri, 14 Dec 2012 16:04:29 -0800 (PST)
    X-Virus-Scanned: amavisd-new at cottontail.mpcsd.org
    Received: from cottontail.mpcsd.org ([127.0.0.1])
    	by localhost (cottontail.mpcsd.org [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id nMsPGHQVT9Bq; Fri, 14 Dec 2012 16:04:22 -0800 (PST)
    Received: from cottontail.mpcsd.org (cottontail.mpcsd.org [10.1.1.37])
    	by cottontail.mpcsd.org (Postfix) with ESMTP id ED65413D0001;
    	Fri, 14 Dec 2012 16:04:22 -0800 (PST)
    Date: Fri, 14 Dec 2012 16:04:22 -0800 (PST)
    From: [maskeduser] <[maskeduser]@mpcsd.org>
    To: Anthony Hoppe <ahoppe@mpcsd.org>
    Message-ID: <26790457.3341.1355529862933.JavaMail.root@cottontail>
    In-Reply-To: <12270407.2983.1355526724187.JavaMail.root@cottontail>
    Subject: Fwd: Report Card Update
    MIME-Version: 1.0
    Content-Type: text/plain; charset=utf-8
    Content-Transfer-Encoding: quoted-printable
    X-Originating-IP: [10.20.45.11]
    X-Mailer: Zimbra 6.0.14_GA_2931 (ZimbraWebClient - FF3.0 (Mac)/6.0.14_GA_2928)
    Am I crazy? If not, how to I configure 8.0.2's virus scanning to behave like 6.0.14?

  2. #2
    Join Date
    May 2007
    Location
    Zimbra
    Posts
    1,285
    Rep Power
    10

    Default

    You can configure amavis to bypass SA by editing the related key in localconfig. Set it to true instead of false.
    Quanah Gibson-Mount
    Server Architect
    Zimbra, Inc
    --------------------
    Zimbra :: the leader in open source messaging and collaboration

  3. #3
    Join Date
    Dec 2007
    Location
    Stockton, CA
    Posts
    164
    Rep Power
    7

    Default

    If you are referring to

    Code:
    amavis_originating_bypass_sa = true
    It's already set that way.

    Code:
    zimbra@cottontail:~$ zmlocalconfig | grep bypass_sa
    amavis_originating_bypass_sa = true
    Are there any other config tweaks I can do?

  4. #4
    Join Date
    May 2007
    Location
    Zimbra
    Posts
    1,285
    Rep Power
    10

    Default

    Wierd... did you restart the MTA after making that change on the MTA? Shouldn't be required, but maybe it didn't take.
    Quanah Gibson-Mount
    Server Architect
    Zimbra, Inc
    --------------------
    Zimbra :: the leader in open source messaging and collaboration

  5. #5
    Join Date
    Dec 2007
    Location
    Stockton, CA
    Posts
    164
    Rep Power
    7

    Default

    Yep. Since that option has been set, I've done a zmmtactl restart, zmcontrol restart, and even power cycled the server (not for this issue, though).

  6. #6
    Join Date
    Aug 2012
    Posts
    11
    Rep Power
    3

    Default

    Hi,
    If I understand well, when amavis_originating_bypass_sa = true, only spam checking is disabled in amavid.conf, but mails are still check (twice) for virus:

    $policy_bank{'ORIGINATING'} = { # mail supposedly originating from our users
    ...
    bypass_spam_checks_maps => [1], # don't spam-check internal mail (added by amavis_originating_bypass_sa = true)
    ...
    };

    If I add bypass_virus_checks_maps => [1], virus check seems to still occurs for internal user (??) but now only one time (I get one X-Virus-Scanned header).

    Is it the expected behavior? How to prevent mail to be checked twice AND still enable spam and virus checks for internal users?
    Mathieu

Similar Threads

  1. How to disable X-Mailer and X-Virus-Scanned
    By barth in forum Administrators
    Replies: 18
    Last Post: 10-23-2011, 10:33 PM
  2. Can't receive scanned file.
    By Jakall in forum Administrators
    Replies: 7
    Last Post: 03-24-2010, 02:15 AM
  3. Can't receive scanned file.
    By Jakall in forum Error Reports
    Replies: 2
    Last Post: 03-23-2010, 02:36 AM
  4. Replies: 2
    Last Post: 04-03-2009, 12:20 AM
  5. Is outgoing mail virus scanned by default?
    By iain in forum Administrators
    Replies: 1
    Last Post: 02-03-2009, 11:35 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •