# What's wrong with that stupid qmail-scanner, again >(

## tecknojunky

```
@400000004217959507fac72c X-Qmail-Scanner-1.25st:[baby110884186769424493] /var/spool/qmailscan/tmp/baby110884186769424493 exists - try again later...

@40000000421795950898c47c /bin/rm: cannot remove `/var/spool/qmailscan/tmp/baby110884186769424493/': Permission denied
```

----------

## slashdot

After I emerged 1.25 qmail-scanner I had to chown the following files...

cd /var/spool/qmailscan

orig: drwxr-xr-x  6 qscand qscand   416 Feb 27 23:31 .

chown qmaild:qscand .

after: drwxr-xr-x  6 qmaild qscand      416 Feb 27 23:33 .

orig: drwxr-x---  2 qscand qscand     72 Feb 27 23:31 tmp

chown -R qmaild:qscand tmp

after: drwxr-x---  2 qmaild qscand     72 Feb 27 23:31 tmp

orig: drwxr-x---  5 qscand qscand    120 Feb 27 23:31 working

chown -R qmaild:qscand working

after: drwxr-x---  5 qmaild qscand    120 Feb 27 23:31 working

result:

-rw-r--r--  1 qscand qscand      0 Feb 27 23:31 quarantine.log

-rw-r--r--  1 qscand qscand   7414 Feb 27 23:31 quarantine-attachments.txt

drwxr-x---  5 qscand qscand    120 Feb 27 23:31 quarantine

drwxr-x---  5 qscand qscand    120 Feb 27 23:31 archive

lrwxrwxrwx  1 root   root       14 Feb 27 23:31 viruses.log -> quarantine.log

drwxr-x---  5 qmaild qscand    120 Feb 27 23:31 working

-rw-------  1 qscand root      334 Feb 27 23:31 qmail-queue.log

-rw-------  1 qmaild nofiles    40 Feb 27 23:33 qmail-scanner-queue-version.txt

-rw-r-----  1 qmaild nofiles 49152 Feb 27 23:33 quarantine-attachments.db

-rw-------  1 qmaild nofiles   501 Feb 27 23:40 mailstats.csv

drwxr-x---  2 qmaild qscand     72 Feb 27 23:40 tmp

QMail works fine now. Hope this helps!!

----------

## tecknojunky

The problem I have is that something will chown back qmail-scanner-queue-version.txt to root:root rendering the mail server useless.  I get to know about it when:

1- I send a mail and evolution spits a DATA error.

2- I notice that I received no mails since a couple of hours.

3- An angry user tells me "mail server down again?" looking me with eyes that seems to say "you incompetent".

All this trouble started when I emerged some version of Perl that changed something about suid, or whatever.  All I know is that my postmaster life has been miserable since.

----------

## slashdot

Check to make sure there's nothing running under cron that will do this. Other reports I've read suggest removing /etc/cron.daily/qmail-scanner to prevent automatic 

prems correction with the 'qmail-scanner-queue.pl -z' script but i've not had to do this.

Hope this helps.

----------

## tecknojunky

 *slashdot wrote:*   

> Check to make sure there's nothing running under cron that will do this. Other reports I've read suggest removing /etc/cron.daily/qmail-scanner to prevent automatic 
> 
> prems correction with the 'qmail-scanner-queue.pl -z' script but i've not had to do this.
> 
> Hope this helps.

 Well, I have /etc/cron.weekly/qmail-scanner-clean.cron and that's exactly the file I rely on to re-enable qmail, because I have modified it like this

```
#!/bin/sh

setuidgid qscand /var/qmail/bin/qmail-scanner-queue -z

chmod 666 /var/spool/qmailscan/qmail-scanner-queue-version.txt
```

So, when I notice that mails does not work anymore, i run that script and it's fixed.  Now, just to be sure, I have done this:

```
# ls -l /var/spool/qmailscan/qmail-scanner-queue-version.txt

-rw-rw-rw-  1 qscand qscand 40 fév 28 05:58 /var/spool/qmailscan/qmail-scanner-queue-version.txt

# setuidgid qscand /var/qmail/bin/qmail-scanner-queue -z

# ls -l /var/spool/qmailscan/qmail-scanner-queue-version.txt

-rw-------  1 qscand qscand 40 fév 28 09:38 /var/spool/qmailscan/qmail-scanner-queue-version.txt
```

Sending a test mail still went thrue.  So this mean the chmod line in the cron script is superfluous and can be removed.

So, I'm left with this question for which I have no answer... what chowns back qmail-scanner-queue-version.txt to root:root?  :Confused:  Is their a way I can be told what is touching that file and be notified as soon as it happens?

----------

## slashdot

If you use the 2.4 kernel then perhaps you could use this utility....http://www.sysinternals.com/linux/utilities/filemon.shtml

however, I not aware of anything else that has the same functionality without you having to write something yourself...may be some else can suggest something though.

Anyone?

----------

## tecknojunky

I appreciate your help Slashdot.

For now, I've been keeping a close eye on /var/spool/qmailscan/qmail-scanner-queue-version.txt and, surprise, surprise (look at the time):

```
# ls -l /var/spool/qmailscan/qmail-scanner-queue-version.txt

-rw-------  1 qmaild nofiles 40 mar  1 03:00 /var/spool/qmailscan/qmail-scanner-queue-version.txt
```

Hum <_<

```
# ls /etc/cron.daily/

qmail-genrsacert.sh*  qmail-scanner*  rulesdujour  slocate*  virus-update.cron*

```

qmail-scanner*  :Shocked:   :Shocked:   :Shocked: 

If we look inside

```
#!/bin/bash

#setuidgid qmaild /var/qmail/bin/qmail-scanner-queue.pl -z
```

So, it seem I've been tracking the wrong file all along  :Embarassed:  (yes, I'm really ambarrassed).  Further, there is no qmaild group on my system, so I'm really wondering where that came from, but it's probably me putting it there from reading a post in these forum and either the post was bad or I readed it wrong.

Let's fix it...

```
# cat /etc/cron.daily/qmail-scanner #!/bin/bash

setuidgid qscand /var/qmail/bin/qmail-scanner-queue -z
```

Run it and voilà:

```
 # ls -l /var/spool/qmailscan/qmail-scanner-queue-version.txt

-rw-------  1 qscand qscand 40 mar  1 03:40 /var/spool/qmailscan/qmail-scanner-queue-version.txt
```

I hope I nailed it this time  :Rolling Eyes: 

----------

## slashdot

fingers crossed!

----------

## zap_killer

I had the same problem with 'Permission denied' in logs.

Now, that point is fixed (thank you guys), but (always a 'but') now, I cannot run anymore qmail-scanner-queue :

```
# setuidgid qmaild /var/qmail/bin/qmail-scanner-queue -z

X-Qmail-Scanner-1.25st:[] cannot create /var/spool/qmailscan/tmp - Permission denied
```

----------

## tecknojunky

Hum...  I rememebr having problems with that too.  Checking back on it, I have this:

```
# ls /var/spool/qmailscan -ld

drwxrwxrwx  6 qmaild qscand 448 mar  9 03:00 /var/spool/qmailscan/

# ls /var/spool/qmailscan/tmp -ld

drwxrwxrwx  2 qscand qscand 48 mar  9 12:34 /var/spool/qmailscan/tmp/
```

...which is probably incecure.

But you know what?  I don't give a poop.  I've been struggling so much with it, that since it now work, I'm really too scared to touch anything now.  Like they say, if it ain't broken, don't fix it, stupid.

----------

## mattsteven

Before you start chowning/chmoding, if you were using the tcp.smtp configuration before simply look at this file:

/var/qmail/bin/qmail-scanner-queue.pl

After messing around for a long time the only thing it turned out that I had to do was

```
chmod u+s /var/qmail/bin/qmail-scanner-queue.pl /usr/bin/suidperl
```

And everything worked again.  Portage apparently removed the suid bit on these two things during a recent upgrade.

----------

## lcj

A different approach:

1. edit the 

```
/usr/portage/mail-filter/qmail-scanner/qmail-scanner-1.25-r1.ebuild
```

 and change the qscand to qmaild (also you can change group to i.e. nofiles)

2. remove from Manifest in the folder hashes other than MD5, and replace the size and MD5 sum by new file size and md5sum with 

```
md5sum qmail-scanner-1.25-r1.ebuild
```

3. emerge scanner again, reload qmail[/code]

not clean but works for me (in terms of qmail-scanner)

----------

## jsouthard

Hey Guys,

   I have spent the last 4 days trying to figure out this problem. I found references to this problem from 2004 so I figured there was a better solution by now than chown or chmod or hacking ebuilds. So I don't know if this helps anyone else but it helped me. Now let me preface this by saying yesterday I reemerged perl with the suidperl use flag because I thought that might be my problem but I had the same issues this morning. So that may or may not be part of the problem but I will reemerge later to find out.

   My main problem was I was reading the instructions that fly during emerge that say run 

      setuidgid qmaild /var/qmail/bin/qmail-scanner-queue.pl -g

and then the log files that say 

      X-Qmail-Scanner-1.25st:[] cannot open /var/spool/qmailscan/qmail-scanner-queue-version.txt - did you initialise the system by running "qmail-scanner-queue.pl -z"? - No such file or directory.

I finally opened my eyes and realized that all the install HOWTOs talk about the new wrapper var/qmail/bin/qmail-scanner-queue which fixed some security issues. So I dropped the ".pl" from the above two instructions and it worked!! Then I checked  /etc/tcprules.d/tcp.qmail-smtp and the line to enable qmail-scanner was pointing to the perl script as well and not the wrapper. I dropped the .pl and mail is working thru qmail-scanner.

I hope this helps. It has frustrated the heck out of me for way to long.

Jacob

----------

## nianderson

Im having issues with this as well. 

```

iris qmailscan # tail /var/log/qmail/qmail-smtpd/current

@400000004563b4c52fbb1bcc X-Qmail-Scanner-1.25st:[iris116416223571827773] cannot open /var/spool/qmailscan/qmail-scanner-queue-version.txt - did you initialise the system by running "qmail-scanner-queue.pl -z"? - Permission denied

@400000004563b4c52fdd97ec /bin/rm: cannot remove `/var/spool/qmailscan/tmp/iris116416223571827773/': Permission denied

@400000004563b4c52fdd9fbc /bin/rm: cannot remove `/var/spool/qmailscan/working/new/iris116416223571827773': Permission denied

@400000004563b4e7151fe7d4 X-Qmail-Scanner-1.25st:[iris116416226971827780] /var/spool/qmailscan/tmp/iris116416226971827780 exists - try again later...

@400000004563b4e71532b454 /bin/rm: cannot remove `/var/spool/qmailscan/tmp/iris116416226971827780/': Permission denied

@400000004563b4e715336804 /bin/rm: cannot remove `/var/spool/qmailscan/working/new/iris116416226971827780': Permission denied

```

i was able to send mail finally but only after i 777 qmail-scanner-queue-version.txt, tmp, and working directories

This isn't secure and id like to have proper permissions set.

----------

## iTimm

Problem located: Perl is merged without perlsuid

Please, do not modify any rights (like posts before), only do following steps:

 *Quote:*   

>  echo "dev-lang/perl perlsuid" >> /etc/portage/package.use
> 
> emerge perl
> 
> 

 

After a while...

 *Quote:*   

>  qmail-scanner-queue.pl -z

 

Works fine now on..., volia!

Greets

iTimm

----------

