amavis faliure with postfix (Debian Lenny)

casoe84dk · 12-25-2010, 09:49 AM

I have a small faliure in my config after i have installed a postfix mx server on my local lan to provide me sysmails from my local network.
I have masked my domain and my relay mailserver, so it can't be used to wrong things

I run Debian 5 Lenny all packets upgraded with aptitude.

Quote:

Dec 25 16:18:19 backupmx postfix/smtpd[20929]: connect from backup-mx.example.com[10.0.3.1]
Dec 25 16:18:19 backupmx postfix/smtpd[20929]: B64F81A8172: client=backup-mx.example.com[10.0.3.1]
Dec 25 16:18:19 backupmx postfix/cleanup[20931]: B64F81A8172: message-id=<20101225152157.5B0752FD9E@backup-mx.local.example.com>
Dec 25 16:18:19 backupmx postfix/qmgr[19897]: B64F81A8172: from=<tanja@gateway.local.example.com>, size=680, nrcpt=1 (queue active)
Dec 25 16:18:19 backupmx postfix/smtpd[20929]: disconnect from backup-mx.example.com[10.0.3.1]
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) ESMTP::10024 /var/lib/amavis/tmp/amavis-20101225T155122-08936: <tanja@gateway.local.example.com> -> <sysadmin@example.com> SIZE=680 Received: from mx.local.example.com ([127.0.0.1]) by localhost (backupmx.example.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <sysadmin@example.com>; Sat, 25 Dec 2010 16:18:19 +0100 (CET)
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) smtp connection cache, dt: 1602.6, state: 1
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) smtp connection cache, dt: 1602.6 -> disabling
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) Checking: QHm8qR2Q-E9Q [10.0.3.1] <tanja@gateway.local.example.com> -> <sysadmin@example.com>
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) p001 1 Content-Type: text/plain, size: 101 B, name:
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) check_header: 2, Non-encoded 8-bit data (char C3 hex): From: tanja@gateway.local.example.com (Tanja S\\303\\270rensen)
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) (!!)run_av (ClamAV-clamd) FAILED - unexpected , output="/var/lib/amavis/tmp/amavis-20101225T155122-08936/parts: lstat() failed: Permission denied. ERROR\n"
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) (!!)ClamAV-clamd av-scanner FAILED: CODE(0x9a08c18) unexpected , output="/var/lib/amavis/tmp/amavis-20101225T155122-08936/parts: lstat() failed: Permission denied. ERROR\n" at (eval 88) line 527.
Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) (!!)WARN: all primary virus scanners failed, considering backups
Dec 25 16:18:31 backupmx amavis[8936]: (08936-02) local delivery: <tanja@gateway.local.example.com> -> <bad-header-quarantine>, mbx=/var/lib/amavis/virusmails/Q/badh-QHm8qR2Q-E9Q
Dec 25 16:18:31 backupmx amavis[8936]: (08936-02) smtp resp to NOOP (idle 1614.6 s): 421 4.4.2 mx.local.example.com Error: timeout exceeded
Dec 25 16:18:31 backupmx postfix/smtpd[20937]: connect from backupmx.example.com[127.0.0.1]
Dec 25 16:18:31 backupmx postfix/smtpd[20937]: AC12B1A81B9: client=backupmx.example.com[127.0.0.1]
Dec 25 16:18:31 backupmx postfix/cleanup[20931]: AC12B1A81B9: message-id=<20101225152157.5B0752FD9E@backup-mx.local.example.com>
Dec 25 16:18:31 backupmx postfix/smtpd[20937]: disconnect from backupmx.example.com[127.0.0.1]
Dec 25 16:18:31 backupmx amavis[8936]: (08936-02) FWD via SMTP: <tanja@gateway.local.example.com> -> <sysadmin@example.com>, 250 2.0.0 Ok, id=08936-02, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as AC12B1A81B9
Dec 25 16:18:31 backupmx postfix/qmgr[19897]: AC12B1A81B9: from=<tanja@gateway.local.example.com>, size=1330, nrcpt=1 (queue active)
Dec 25 16:18:31 backupmx amavis[8936]: (08936-02) Passed BAD-HEADER, LOCAL [10.0.3.1] [10.0.3.1] <tanja@gateway.local.example.com> -> <sysadmin@example.com>, quarantine: Q/badh-QHm8qR2Q-E9Q, Message-ID: <20101225152157.5B0752FD9E@backup-mx.local.example.com>, mail_id: QHm8qR2Q-E9Q, Hits: -1.44, size: 680, queued_as: AC12B1A81B9, 11972 ms
Dec 25 16:18:31 backupmx postfix/smtp[20932]: B64F81A8172: to=<sysadmin@example.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=13, delays=0.57/0.01/0.01/12, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=08936-02, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as AC12B1A81B9)
Dec 25 16:18:31 backupmx postfix/qmgr[19897]: B64F81A8172: removed
Dec 25 16:18:31 backupmx amavis[8936]: (08936-02) TIMING [total 11982 ms] - SMTP greeting: 3 (0%)0, SMTP EHLO: 2 (0%)0, SMTP pre-MAIL: 1 (0%)0, SMTP pre-DATA-flush: 4 (0%)0, SMTP DATA: 36 (0%)0, check_init: 2 (0%)0, digest_hdr: 1 (0%)0, digest_body: 0 (0%)0, gen_mail_id: 1 (0%)0, mime_decode: 10 (0%)1, get-file-type1: 18 (0%)1, parts_decode: 0 (0%)1, check_header: 3 (0%)1, AV-scan-1: 5 (0%)1, AV-scan-2: 1 (0%)1, AV-scan-3: 9372 (78%)79, spam-wb-list: 2 (0%)79, SA parse: 3 (0%)79, SA check: 2411 (20%)99, update_cache: 8 (0%)99, decide_mail_destiny: 1 (0%)99, open-mbx: 5 (0%)99, write-header: 1 (0%)99, save-to-local-mailbox: 0 (0%)99, fwd-connect: 28 (0%)99, fwd-mail-pip: 19 (0%)100, fwd-rcpt-pip: 0 (0%)100, fwd-data-chkpnt: 0 (0%)100, write-header: 1 (0%)100, fwd-data-contents: 0 (0%)100, fwd-end-chkpnt: 22 (0%)100, prepare-dsn: 1 (0%)100, main_log_entry: 15 (0%)100, update_snmp: 3 (0%)100, SMTP pre-response: 1 (0%)100, SMTP response: 3 (0%)100, unlink-1-files: 0 (0%)100, rundown: 1 (0%)100
Dec 25 16:18:32 backupmx postfix/smtp[20940]: AC12B1A81B9: to=<sysadmin@example.com>, relay=mail.example.com[xx.xx.xx.xx]:26, delay=0.41, delays=0.03/0.03/0.13/0.22, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as CBDED28411B)
Dec 25 16:18:32 backupmx postfix/qmgr[19897]: AC12B1A81B9: removed

Noway2 · 12-25-2010, 08:25 PM

Just to be sure, I assume you are talking about:

Quote:

Dec 25 16:18:19 backupmx amavis[8936]: (08936-02) (!!)ClamAV-clamd av-scanner FAILED: CODE(0x9a08c18) unexpected , output="/var/lib/amavis/tmp/amavis-20101225T155122-08936/parts: lstat() failed: Permission denied. ERROR\n" at (eval 88) line 527.

Are you running either AppArmour or SELinux? Both of these add additional RW restrictions on directories such as /var/lib. If so, you mayu need to go into the configuration and tell it to allow this application access. Also, what are the permission settings for these directories, with regards to the clamav user?

casoe84dk · 12-25-2010, 08:33 PM

Not what I know of to be honest.
I have installed the mailserver after this tutorial down to and include Advanced mail server http://flurdy.com/docs/postfix/, because It only shall be used to the local network

Noway2 · 12-26-2010, 08:23 PM

You might want to take a look at these two threads: here and here.

I did some checking and it looks like Debian does not use App Armour by default. I ran into this a couple of times with Ubuntu server and had to add the application to the profile. Anyway, according to the links here are some things to check:

1 - the permissions on the file
2 - the ownership of the file, which should be amavis:amavis
3 - Putting Clam-AV in the amavis group
4 - Initializing the supplementary groups in /etc/amavis/conf.d/15-av_scanners