On Fri, 2006-01-20 at 21:49 +0800, Ishukor wrote: > Hi, > > Our network was infected with worm.vb-8, we detected a few pc that > being infected with this worm in my mail scanner log we detected the > messages was not scanned for viruses because it regarded as a local > users. below is the sample of the log. > > "SA: don't scan as RELAYCLIENT implies this was sent by a local user" > > Because of this the virus has infected a lot of PC. How can we avoid > this problem? currently we identified a few PC and deny their IP, my > tcp.smtp setting > > 127.:allow,RELAYCLIENT="" > 192.168.1.67:deny,RELAYCLIENT="" > > By the way i am using toaster ver 0.83 but with qmail-scanner 1.25st > not simscan. > > Thanks In Advanve
from: http://qmail-scanner.sourceforge.net/FAQ.php 18: Why are some mails not scanned by SpamAssassin?. Qmail-Scanner will only pass the message to SpamAssassin if it originates from an external SMTP client. This is defined by whether or not the standard Qmail RELAYCLIENT environment variable is set. i.e. if the mail originates locally, it isn't scanned by SA. This is done for performance reasons and to cut down on false positives (i.e. your local users will never complain that their email is being classified as spam :-) If you explicitly want to scan some/all local SMTP clients email too, then set QS_SPAMASSASSIN="on" within the tcpserver rules file. aka: 192.168.:allow,RELAYCLIENT="",QS_SPAMASSASSIN="on" bye -- Miolinux <[EMAIL PROTECTED]>
