From jrudd at KZIN.UCSC.EDU Sun Dec 1 15:24:21 2002 From: jrudd at KZIN.UCSC.EDU (John Rudd) Date: Thu Jan 12 21:16:34 2006 Subject: RBL checks and Spamcop Message-ID: <200212011524.gB1FOLj05548@kzin.ucsc.edu> > From: Paul Welsh > > > From: "Matt Kettler" > > By default SA has no score assigned to spamcop due to the fact that it is > > not free, it's donation-ware. > > > > You'll have to uncomment the score to enable checking of spamcop, but make > > sure you donate to them. > > Thanks for pointing this out. This level of donation seems fine. > > Is anyone here using SpamCop's blocking list? If so, is it reasonable to > assume that I could quarantine all mail that gets into SpamCop's list, > rather than accepting MailScanner's default of prefixing the Subject with > {SPAM?}? If so, it would be helpful to my users and worth donating. > My personal experience with SpamCop is that they're unreliable, inaccurate, and difficult to get responses from regarding fixing their errors. We had one of our users report spam to them, and they blocked _our_ mail server because they mis-parsed the Received headers. That wasn't our first problem with them, and I generally recommend that people not use SpamCop for any services that they care about. I would compare the quality of their service to trying to use a house of cards as your rack mounting solution. If you don't mind your servers physically crashing to the floor on a regular basis, then, hey, it's a fine solution! So, if it's a mail server that is involved in your company's revenue, or if it's the campus mail server, or something like that ... I wouldn't use SpamCop. If it's just your personal machine ... well, then, if you don't mind the structural reliability of a house of cards, go right ahead. John Rudd From hciss at HCIWS.COM Sun Dec 1 20:55:44 2002 From: hciss at HCIWS.COM (Matt) Date: Thu Jan 12 21:16:34 2006 Subject: RBL checks and Spamcop References: <1038341391.1455.52.camel@wilowisp.dynetics.com> <5.2.0.9.2.20021126191356.02c7fe88@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021126183427.01f37ec0@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021126191356.02c7fe88@imap.ecs.soton.ac.uk> <5.1.1.6.0.20021126161942.015d9450@192.168.50.2> <5.1.1.6.0.20021126180031.016938f8@192.168.50.2> <002a01c295f2$cedc6610$6a0110ac@sbsplc.com> Message-ID: <061201c2997c$07e3a8b0$6501a8c0@matthew> > Is anyone here using SpamCop's blocking list? If so, is it reasonable to > assume that I could quarantine all mail that gets into SpamCop's list, > rather than accepting MailScanner's default of prefixing the Subject with > {SPAM?}? If so, it would be helpful to my users and worth donating. I think it is much better to bounce then just quarantine the messages. If it does get a false positive at least the sender will know that something went wrong and the message failed to go through. Tagging is a good option for power users but your typical user just gets annoyed and never figures it out. We block in sendmail.cf with Spamcop and Ordb with decent results. Matt From paul at ESPMAIL.CO.UK Sun Dec 1 21:45:36 2002 From: paul at ESPMAIL.CO.UK (Paul Welsh) Date: Thu Jan 12 21:16:34 2006 Subject: Osirusoft References: <1038341391.1455.52.camel@wilowisp.dynetics.com> <5.2.0.9.2.20021126191356.02c7fe88@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021126183427.01f37ec0@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021126191356.02c7fe88@imap.ecs.soton.ac.uk> <5.1.1.6.0.20021126161942.015d9450@192.168.50.2> <5.1.1.6.0.20021126180031.016938f8@192.168.50.2> <002a01c295f2$cedc6610$6a0110ac@sbsplc.com> <061201c2997c$07e3a8b0$6501a8c0@matthew> Message-ID: <001b01c29982$fe87b520$d3ca30d5@espmail> I notice a lot of spam is being flagged by SpamAssassin as being listed by osirusoft.com. Does anyone have an opinion on the reliability of this service to reliably flag spam while leaving alone mailings from reputable companies? From paul at ESPMAIL.CO.UK Sun Dec 1 21:41:10 2002 From: paul at ESPMAIL.CO.UK (Paul Welsh) Date: Thu Jan 12 21:16:34 2006 Subject: RBL checks and Spamcop References: <1038341391.1455.52.camel@wilowisp.dynetics.com> <5.2.0.9.2.20021126191356.02c7fe88@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021126183427.01f37ec0@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021126191356.02c7fe88@imap.ecs.soton.ac.uk> <5.1.1.6.0.20021126161942.015d9450@192.168.50.2> <5.1.1.6.0.20021126180031.016938f8@192.168.50.2> <002a01c295f2$cedc6610$6a0110ac@sbsplc.com> <061201c2997c$07e3a8b0$6501a8c0@matthew> Message-ID: <001a01c29982$fdb6a980$d3ca30d5@espmail> ----- Original Message ----- From: "Matt" To: Sent: 01 December 2002 20:55 Subject: Re: RBL checks and Spamcop > I think it is much better to bounce then just quarantine the messages. If > it does get a false positive at least the sender will know that something > went wrong and the message failed to go through. Tagging is a good option > for power users but your typical user just gets annoyed and never figures it > out. We block in sendmail.cf with Spamcop and Ordb with decent results. > Glad someone has something positive to say about SpamCop! Using ordb and spamcop is also what I intend doing. I can quarantine (and delete later) with ease because my MailScanner box relays incoming messages to an NT box running MailSweeper which does the virus scanning. This gives me an easy graphical interface to quarantine and then delete or release messages marked as spam. Note that we had already invested in MailSweeper before discovering MailScanner, so it seemed churlish not to make use of it. I agree completely about typical users never figuring out how to setup rules to delete spam tagged messages, hence the idea of trying to find a service such as SpamCop that can stop most spam from ever reaching them. The problem with SpamAssassin is that it does tend to mark mailings from reputable companies that they wish to receive as spam. This kind of mailing clearly isn't spam since the user has signed up for it. Presumably, such mailings won't find their way into SpamCop's list. From mike at CAMAROSS.NET Mon Dec 2 00:18:36 2002 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:16:34 2006 Subject: Osirusoft In-Reply-To: <001b01c29982$fe87b520$d3ca30d5@espmail> Message-ID: <003e01c29998$5c3fd0c0$6501a8c0@mikedesk> Here's my take on it... I use SpamCop, Osirusoft, and relays.ordb.org and block over 1000 connections a day. If I have a problem with a reputable email coming in, I can selectively add that server to my /etc/mail/access and let it come through. It is the responsibility of the mail admin on the other end to fix their security problems rather than me open my system up to a potential attack from their server(s). It is also their resposibility to have themselves removed from the databases they are listed in. I like the fact that SpamCop is a dynamic list and offending servers are removed within a few days after a dish of spam has outlived the queue. At least that's my understanding of it. Most of my users are understanding of the measures I take and feel it's worthwhile to have a legit email blocked once in a blue moon than be overwhelmed with Viagra ads and teen goat sex. I rarely have to add servers to my access file these days. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Paul Welsh Sent: Sunday, December 01, 2002 3:46 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Osirusoft I notice a lot of spam is being flagged by SpamAssassin as being listed by osirusoft.com. Does anyone have an opinion on the reliability of this service to reliably flag spam while leaving alone mailings from reputable companies? From j.cormie at ABERTAY.AC.UK Mon Dec 2 09:53:07 2002 From: j.cormie at ABERTAY.AC.UK (Jason Cormie) Date: Thu Jan 12 21:16:34 2006 Subject: Mcafee update script Message-ID: <6F7DF531DBB3D41197B600508B55D4020404AB6B@mail3.tay.ac.uk> Just something I find handy, on line 68 if you add --version to give open(MCAFEETEST, "$mcafee -d $mcafeeroot --version | "); Then the cron job sends you a notice of the version of the last Anti Virus installed, comes in handy when you have virus paranoid bosses. :-) Jason From tony.johansson at SVENSKAKYRKAN.SE Mon Dec 2 10:05:25 2002 From: tony.johansson at SVENSKAKYRKAN.SE (Tony Johansson) Date: Thu Jan 12 21:16:34 2006 Subject: Quarantine Web Interface Message-ID: <3C4F5084EF16D4119CE700508B6B8B10058D0861@nt.svenskakyrkan.se> Hello, Currently I'm only tagging mail with {SPAM?}, unless it scores very high with spamassassin. I want to quarantine the lot instead (as {SPAM?} causes some confusion to the end users...) but it seems quite cumbersome to manage emails put in quarantine. How hard would it be to code a web interface to view the mails in quarantine and present a "drop" or "relase" option for the viewer? regards, Tony From gavin at NETERGY.COM Mon Dec 2 10:14:57 2002 From: gavin at NETERGY.COM (Gavin Nelms Crocker) Date: Thu Jan 12 21:16:34 2006 Subject: Quarantine Web Interface Message-ID: <200212021014.gB2AEvB06886@is7.netergy.com> I'm not sure how hard this would be but i would be interested in sponsoring the development of this..! One solution i am using at the moment to get round this is to forward the mail to a spam account that can be viewed via webmail this is fine if only a few people Gavin > the end users...) but it seems quite cumbersome to manage emails put in > quarantine. > > How hard would it be to code a web interface to view the mails in quarantine > and present a "drop" or "relase" option for the viewer? > > > regards, Tony > > From mailscanner at ecs.soton.ac.uk Mon Dec 2 10:39:45 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:34 2006 Subject: Mcafee update script In-Reply-To: <6F7DF531DBB3D41197B600508B55D4020404AB6B@mail3.tay.ac.uk> Message-ID: <5.2.0.9.2.20021202103934.02bb81c8@imap.ecs.soton.ac.uk> Good idea. Added. At 09:53 02/12/2002, you wrote: >Just something I find handy, >on line 68 if you add --version to give >open(MCAFEETEST, "$mcafee -d $mcafeeroot --version | "); > >Then the cron job sends you a notice of the version of the last Anti Virus >installed, >comes in handy when you have virus paranoid bosses. :-) > >Jason -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From huw at PIODEN.NET Mon Dec 2 11:35:37 2002 From: huw at PIODEN.NET (Huw Wyn Jones) Date: Thu Jan 12 21:16:34 2006 Subject: Outgoing mail problems Message-ID: <006801c299f6$f01c8280$0205a8c0@pioden> Hi, I've just set-up MailScanner 4.05-3 from RPM on a RH8 box running Sendmail and F-prot (Dual P3 1GHz., 768Mb RAM). Load is really light - no more than a few hundred e-mails a day at the mo. Incoming mail seems to be perfect - 100% success. Problem is that some outgoing e-mails get sent OK through the system - others seem to disappear into a queue and not get sent at all. Can anybody suggest what might be wrong ? The only mail which will be sent through the system is generated by apps on the server i.e. BBS's, mailing lists, webmail etc. as SMTP sending has been locked down as a security measure. Considering the configuration we could probably get away with not scanning outgoing mail at all - is there a way to bypass MailScanner for outgoing only ? I'm a noob to the world of mail serving so pls excuse any really dumb questions. Regards Huw From Richard.Lush at HP.COM Mon Dec 2 12:04:17 2002 From: Richard.Lush at HP.COM (Lush, Richard) Date: Thu Jan 12 21:16:34 2006 Subject: Outgoing mail problems Message-ID: Are you seeing any errors in your log files? Look for something like relay blocked, should be in /var/log/messages (I think). You may (probably will) have to play with the sendmail configuration. (I have the same problem where mail being sent local from some applications is being blocked but haven't got round to fixing it yet, I used a different SMTP server as a quick fix as I am not a sendmail admin. (I know, I really should fix it and learn sendmail!) If anyone know what the fix is.... I thought it was the domain settings or the access file but changes to these didn't make any difference. Richard (I run RH8 as well) -----Original Message----- From: Huw Wyn Jones [mailto:huw@PIODEN.NET] Sent: 02 December 2002 11:36 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Outgoing mail problems Hi, I've just set-up MailScanner 4.05-3 from RPM on a RH8 box running Sendmail and F-prot (Dual P3 1GHz., 768Mb RAM). Load is really light - no more than a few hundred e-mails a day at the mo. Incoming mail seems to be perfect - 100% success. Problem is that some outgoing e-mails get sent OK through the system - others seem to disappear into a queue and not get sent at all. Can anybody suggest what might be wrong ? The only mail which will be sent through the system is generated by apps on the server i.e. BBS's, mailing lists, webmail etc. as SMTP sending has been locked down as a security measure. Considering the configuration we could probably get away with not scanning outgoing mail at all - is there a way to bypass MailScanner for outgoing only ? I'm a noob to the world of mail serving so pls excuse any really dumb questions. Regards Huw From mbowman at UDCOM.COM Mon Dec 2 13:36:17 2002 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:16:34 2006 Subject: Spam Actions not working correctly? Message-ID: Greetings, I have a problem with Spam Actions in the sense that it doesn't appear to work all the time mbowman@udcom.com delete *@vbcomm.net delete default deliver I still get {SPAM?) and {VIRUS?} tagged e-mail. I also get the mail for hostmaster@vbcomm.net. However, my maillog this morning states that spam.actions is working... Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: from =, size=1404, class=0, nrcpts=1, msgid =<200212021331.IAA20387@raq01.vbcomm.net>, proto=ESMTP, daemon=MTA, relay=climax.vbcomm.net [208.178.120.12] Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: to =, delay=00:00:00, mailer=smtp, pri=31404, stat=queued Dec 2 08:29:50 smithers mailscanner[5752]: Message gB2DTgU06893 from 208.178.120.12 (raq01.vbcomm.net) is spam according to SpamAssassin (score=5.3, required 5.2, AWL, HTTP_USERNAME_USED, MAILTO_TO_SPAM_ADDR, NO_REAL_NAME, SPAM_PHRASE_00_01, WEIRD_PORT, X_AUTH_WARNING) Dec 2 08:29:50 smithers mailscanner[5752]: Deleted spam message gB2DTgU06893 from queue I don't filter @vbcomm.net (one of our domains through mailscanner?) as yet. hostmaster@vbcomm.net is an alias that goes to mbowman@udcom.com and another e-mail addressee. @udcom.com is filtered through mailscanner. This is on a RH 7.2 box with mailscanner 3.26-2 and sendmail 8.11.6 Regards, Matthew K Bowman, Systems Administrator From Heinz.Knutzen at DZSH.DE Mon Dec 2 13:36:36 2002 From: Heinz.Knutzen at DZSH.DE (Knutzen, Heinz (DZ-SH)) Date: Thu Jan 12 21:16:34 2006 Subject: AW: SuSE users? Message-ID: <6C645222B0A8BC4FBFACD7606D4306A8429D09@dzrz-ex-1.dzsh.landsh.de> I would test it with SuSE 8.0 On request I could upgrade my test machine to 8.1 Viele Gr??e -- Heinz Knutzen Datenzentrale Schleswig-Holstein Altenholzer Str. 10-14, 24161 Altenholz, Germany http://www.dzsh.de/ mailto:heinz.knutzen@dzsh.de Tel: +49.431.3295.581 Fax: +49.431.3295.410 > -----Urspr?ngliche Nachricht----- > Von: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Gesendet am: Samstag, 30. November 2002 16:22 > An: MAILSCANNER@JISCMAIL.AC.UK > Betreff: SuSE users? > > Would anyone like to help test the SuSE package of MailScanner please? > -- > Julian Field Teaching Systems Manager > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ > > -- > Diese Mail wurde durch die Datenzentrale Schleswig-Holstein > maschinell auf Viren und gef?hrliche Inhalte untersucht. > > From mike at CAMAROSS.NET Mon Dec 2 13:49:45 2002 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:16:34 2006 Subject: Spam Actions not working correctly? In-Reply-To: Message-ID: <005701c29a09$ace90250$6501a8c0@mikedesk> Looks like you are missing the From/To column: To: mbowman@udcom.com delete To: *@vbcomm.net delete Have your rules EVER worked? And do you have the path to this ruleset defined properly in MailScanner.conf? Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Matthew Bowman Sent: Monday, December 02, 2002 7:36 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Spam Actions not working correctly? Greetings, I have a problem with Spam Actions in the sense that it doesn't appear to work all the time mbowman@udcom.com delete *@vbcomm.net delete default deliver I still get {SPAM?) and {VIRUS?} tagged e-mail. I also get the mail for hostmaster@vbcomm.net. However, my maillog this morning states that spam.actions is working... Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: from =, size=1404, class=0, nrcpts=1, msgid =<200212021331.IAA20387@raq01.vbcomm.net>, proto=ESMTP, daemon=MTA, relay=climax.vbcomm.net [208.178.120.12] Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: to =, delay=00:00:00, mailer=smtp, pri=31404, stat=queued Dec 2 08:29:50 smithers mailscanner[5752]: Message gB2DTgU06893 from 208.178.120.12 (raq01.vbcomm.net) is spam according to SpamAssassin (score=5.3, required 5.2, AWL, HTTP_USERNAME_USED, MAILTO_TO_SPAM_ADDR, NO_REAL_NAME, SPAM_PHRASE_00_01, WEIRD_PORT, X_AUTH_WARNING) Dec 2 08:29:50 smithers mailscanner[5752]: Deleted spam message gB2DTgU06893 from queue I don't filter @vbcomm.net (one of our domains through mailscanner?) as yet. hostmaster@vbcomm.net is an alias that goes to mbowman@udcom.com and another e-mail addressee. @udcom.com is filtered through mailscanner. This is on a RH 7.2 box with mailscanner 3.26-2 and sendmail 8.11.6 Regards, Matthew K Bowman, Systems Administrator From mbowman at UDCOM.COM Mon Dec 2 14:03:23 2002 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:16:34 2006 Subject: Spam Actions not working correctly? Message-ID: Er, the extract I included from the maillog showed that the rule worked? AFAIK you don't need the From/To in the spam.actions.conf file # This file contains instructions for what to do with messages that are # detected as spam. # Each line can contain: #
# where is either 'deliver', 'store' or 'delete' # and
is either a full email address (e.g. user@sub.domain.com) # or a domain name (e.g. sub.domain.com) # or a wildcard domain (e.g. *.domain.com) # or the keyword 'default'. Ruleset: Spam Action = /usr/local/MailScanner/etc/spam.actions.conf #Spam Action = deliver Matthew Mike Kercher cc: Sent by: Subject: Re: Spam Actions not working correctly? MailScanner mailing list 12/02/2002 08:49 AM Please respond to MailScanner mailing list Looks like you are missing the From/To column: To: mbowman@udcom.com delete To: *@vbcomm.net delete Have your rules EVER worked? And do you have the path to this ruleset defined properly in MailScanner.conf? Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Matthew Bowman Sent: Monday, December 02, 2002 7:36 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Spam Actions not working correctly? Greetings, I have a problem with Spam Actions in the sense that it doesn't appear to work all the time mbowman@udcom.com delete *@vbcomm.net delete default deliver I still get {SPAM?) and {VIRUS?} tagged e-mail. I also get the mail for hostmaster@vbcomm.net. However, my maillog this morning states that spam.actions is working... Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: from =, size=1404, class=0, nrcpts=1, msgid =<200212021331.IAA20387@raq01.vbcomm.net>, proto=ESMTP, daemon=MTA, relay=climax.vbcomm.net [208.178.120.12] Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: to =, delay=00:00:00, mailer=smtp, pri=31404, stat=queued Dec 2 08:29:50 smithers mailscanner[5752]: Message gB2DTgU06893 from 208.178.120.12 (raq01.vbcomm.net) is spam according to SpamAssassin (score=5.3, required 5.2, AWL, HTTP_USERNAME_USED, MAILTO_TO_SPAM_ADDR, NO_REAL_NAME, SPAM_PHRASE_00_01, WEIRD_PORT, X_AUTH_WARNING) Dec 2 08:29:50 smithers mailscanner[5752]: Deleted spam message gB2DTgU06893 from queue I don't filter @vbcomm.net (one of our domains through mailscanner?) as yet. hostmaster@vbcomm.net is an alias that goes to mbowman@udcom.com and another e-mail addressee. @udcom.com is filtered through mailscanner. This is on a RH 7.2 box with mailscanner 3.26-2 and sendmail 8.11.6 Regards, Matthew K Bowman, Systems Administrator From richard.siddall at ELIRION.NET Mon Dec 2 14:29:33 2002 From: richard.siddall at ELIRION.NET (Richard Siddall) Date: Thu Jan 12 21:16:34 2006 Subject: Quarantine Web Interface References: <200212021014.gB2AEvB06886@is7.netergy.com> Message-ID: <3DEB6E4D.4174B967@elirion.net> Gavin Nelms Crocker wrote: > > I'm not sure how hard this would be but i would be interested in > sponsoring the development of this..! > > One solution i am using at the moment to get round this is to forward > the mail to a spam account that can be viewed via webmail this is fine > if only a few people > > Gavin > You have to be very careful when adding user interfaces to systems like Mailscanner. People tend to regard the user interface as an integral part of the system, when in fact it's an optional add-on. Mailscanner has been working fine for some time with no user interface. Plus, how should the UI behave? A UI that plugs into a Cobalt RaQ 4's administrative server would look different to one that plugs into a RaQ 550's control panel, which would look different to one that plugs into Openwebmail, which would again be different to one that plugs into Neomail, SquirrelMail, etc. Or you could have a standalone UI that behaves differently to all the other UI's you have to train your users on. Not only does the appearance differ, the means for users to authenticate themselves differs. A webmail plug-in could use the webmail system's authentication, whereas the RaQs use HTTP authentication, etc. I'm not saying a user interface to simplify retrieving messages from quarantine is not a good idea. I'm saying that a single user interface is not going to suit everyone. What you need to do is abstract the user interface from the back-end code to manipulate the quarantine directories. One way of doing this would be to write a Perl module (ISP::MailScanner::Quarantine?) that handles things like: - Getting a list of quarantined messages for a user - Providing (internationalized) help text - Routing quarantined messages back into the sendmail/exim/etc. system for delivery. If the Perl module is correctly designed, it should be trivial to build a CGI/ModPerl/Mason/Apache::ASP/FastCGI user interface on top of it that preserves your system's native look and feel. Of course, if your system's UI is PHP based, you'd need to provide an equivalent layer of abstraction in PHP. Regards, Richard Siddall From Chris.Campbell at FAC.COM Mon Dec 2 14:35:20 2002 From: Chris.Campbell at FAC.COM (Chris Campbell) Date: Thu Jan 12 21:16:34 2006 Subject: freindgreeting Message-ID: What is the synopsis on this? do we use this regexp? (^|[-\?+=/_])(laugh|greeting|friend)?(card|e-card|mail)s?([-\?+=/_]|$) ..................................... Christopher S. Campbell UNIX Admin First Albany Corp 518.447.8544 chris.campbell@fac.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20021202/f575b7ce/attachment.html From mailscanner at ecs.soton.ac.uk Mon Dec 2 15:29:20 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:34 2006 Subject: autoupdate f-prot bis In-Reply-To: <4.1.20021202125853.0094fb30@192.168.2.4> Message-ID: <5.2.0.9.2.20021202152814.03803e20@imap.ecs.soton.ac.uk> I have just downloaded a fresh copy of the Small Business Edition and it makes no mention of any of these URL's. Where did you get them from? I have just run my latest f-prot-autoupdate script and it works fine. At 12:07 02/12/2002, you wrote: >Hello Julian, it's me again. >There are some issues in the script: >1 - f-prot download URL have changed. >You should use in Fetch sub >http://www.f-prot.com/cgi-bin/get_randomly?fp-def >for fp-defs.zip file and >http://www.f-prot.com/cgi-bin/get_randomly?macrdef2 >for macrdef2.zip >2 - FallbackServer is also no more working. >you can suppress it (I didn't find any alternative URL). > >I have tested this modifications : they are working. > >PS : the warn instruction in BailOut sub gives a strange >Perl like message to the user : I first thought that there >was a script error before searching anything else !! > >Best regards. Mailscanner is a very good tool. > > >Christophe Ruhlmann >mailto:christophe.ruhlmann@wanadoo.fr -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From mailscanner at ecs.soton.ac.uk Mon Dec 2 15:31:09 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:34 2006 Subject: AW: SuSE users? In-Reply-To: <6C645222B0A8BC4FBFACD7606D4306A8429D09@dzrz-ex-1.dzsh.land sh.de> Message-ID: <5.2.0.9.2.20021202153048.03cb8360@imap.ecs.soton.ac.uk> Many thanks for the offer. Someone else has already tested it on 8.0 and 8.1 for me. At 13:36 02/12/2002, you wrote: >I would test it with SuSE 8.0 >On request I could upgrade my test machine to 8.1 > >Viele Gr??e > >-- Heinz Knutzen > >Datenzentrale Schleswig-Holstein >Altenholzer Str. 10-14, 24161 Altenholz, Germany >http://www.dzsh.de/ >mailto:heinz.knutzen@dzsh.de >Tel: +49.431.3295.581 Fax: +49.431.3295.410 > > > > -----Urspr?ngliche Nachricht----- > > Von: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > > Gesendet am: Samstag, 30. November 2002 16:22 > > An: MAILSCANNER@JISCMAIL.AC.UK > > Betreff: SuSE users? > > > > Would anyone like to help test the SuSE package of MailScanner please? > > -- > > Julian Field Teaching Systems Manager > > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > > Tel. 023 8059 2817 University of Southampton > > Southampton SO17 1BJ > > > > -- > > Diese Mail wurde durch die Datenzentrale Schleswig-Holstein > > maschinell auf Viren und gef?hrliche Inhalte untersucht. > > > > -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From dwinkler at ALGORITHMICS.COM Mon Dec 2 15:49:00 2002 From: dwinkler at ALGORITHMICS.COM (Derek Winkler) Date: Thu Jan 12 21:16:34 2006 Subject: Restart and config changes Message-ID: <06EE2C86D3DAD5119A6C0060943F3C970402C01B@tormail1.algorithmics.com> Do config changes take effect when Mail Scanner restarts itself periodically? Thanks, Derek Winkler Security Administrator Algorithmics Inc., Toronto Tel: (416) 217-4107 Fax: (416) 971-6263 www.algorithmics.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20021202/3ea45b88/attachment.html From sean at NISD.NET Mon Dec 2 15:51:15 2002 From: sean at NISD.NET (Sean Embry) Date: Thu Jan 12 21:16:34 2006 Subject: Quarantine Web Interface Message-ID: I've changed the {SPAM?} tag to be {May be spam}. This stops quite a bit of confusion. >>> tony.johansson@SVENSKAKYRKAN.SE 12/02/02 04:05AM >>> Hello, Currently I'm only tagging mail with {SPAM?}, unless it scores very high with spamassassin. I want to quarantine the lot instead (as {SPAM?} causes some confusion to the end users...) but it seems quite cumbersome to manage emails put in quarantine. How hard would it be to code a web interface to view the mails in quarantine and present a "drop" or "relase" option for the viewer? regards, Tony From ric at COZZANI.NET Mon Dec 2 15:42:04 2002 From: ric at COZZANI.NET (Riccardo Cozzani) Date: Thu Jan 12 21:16:35 2006 Subject: Quarantine Web Interface In-Reply-To: <3C4F5084EF16D4119CE700508B6B8B10058D0861@nt.svenskakyrkan.se> References: <3C4F5084EF16D4119CE700508B6B8B10058D0861@nt.svenskakyrkan.se> Message-ID: <1038843724.3deb7f4c15814@www.zia.ms.it> Hello all, > How hard would it be to code a web interface to view the mails in > quarantine and present a "drop" or "relase" option for the viewer? We've hacked just a little bit into the code of mailscanner to do what we consider sufficient for our users. If you like our solution, and if you understand something in my bad english, we could give more details. Out Mailscanner now works like this: - when it creates the warning message, it writes the list of the recipients into a separate file associeated with the id of the message; - the warning message contains a link constructed with the name of a php page on our webserver, the date ($datenumber), the message id ($id) and the recipient ($to); - the recipient click on the link; - the script writes the query into a mysql table and tells the user that the orignal message is sent to him; - a cronjob on the antivirus server run a query on the mysql server and if there are new requests, does some checks and then send to the recipient the original message with the subject changed. However it is not possible that a message is sent to someone different to the original recipients. bye Riccardo From mailscanner at ecs.soton.ac.uk Mon Dec 2 16:03:03 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Restart and config changes In-Reply-To: <06EE2C86D3DAD5119A6C0060943F3C970402C01B@tormail1.algorith mics.com> Message-ID: <5.2.0.9.2.20021202160257.07445408@imap.ecs.soton.ac.uk> At 15:49 02/12/2002, you wrote: >Do config changes take effect when Mail Scanner restarts itself periodically? Yes. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From mailscanner at ecs.soton.ac.uk Mon Dec 2 16:04:16 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Spam Actions not working correctly? In-Reply-To: Message-ID: <5.2.0.9.2.20021202160354.01ffa3a0@imap.ecs.soton.ac.uk> Can we clarify which version you are having the problem with? 3 or 4? At 14:03 02/12/2002, you wrote: >Er, the extract I included from the maillog showed that the rule worked? >AFAIK you don't need the From/To in the spam.actions.conf file > ># This file contains instructions for what to do with messages that are ># detected as spam. ># Each line can contain: >#
># where is either 'deliver', 'store' or 'delete' ># and
is either a full email address (e.g. user@sub.domain.com) ># or a domain name (e.g. sub.domain.com) ># or a wildcard domain (e.g. *.domain.com) ># or the keyword 'default'. > >Ruleset: > >Spam Action = /usr/local/MailScanner/etc/spam.actions.conf >#Spam Action = deliver > >Matthew > > > > > Mike Kercher > MAILSCANNER@JISCMAIL.AC.UK > > cc: > Sent by: Subject: Re: Spam > Actions not working correctly? > MailScanner > mailing list > AIL.AC.UK> > > > 12/02/2002 08:49 > AM > Please respond to > MailScanner > mailing list > > > > > > >Looks like you are missing the From/To column: > >To: mbowman@udcom.com delete >To: *@vbcomm.net delete > >Have your rules EVER worked? And do you have the path to this ruleset >defined properly in MailScanner.conf? > >Mike > > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Matthew Bowman >Sent: Monday, December 02, 2002 7:36 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Spam Actions not working correctly? > > >Greetings, > >I have a problem with Spam Actions in the sense that it doesn't appear >to work all the time > > >mbowman@udcom.com delete >*@vbcomm.net delete >default deliver > >I still get {SPAM?) and {VIRUS?} tagged e-mail. I also get the mail for >hostmaster@vbcomm.net. > > >However, my maillog this morning states that spam.actions is working... > >Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: from >=, size=1404, class=0, nrcpts=1, msgid >=<200212021331.IAA20387@raq01.vbcomm.net>, proto=ESMTP, daemon=MTA, >relay=climax.vbcomm.net [208.178.120.12] Dec 2 08:29:42 smithers >sendmail[6893]: gB2DTgU06893: to =, delay=00:00:00, >mailer=smtp, pri=31404, stat=queued Dec 2 08:29:50 smithers >mailscanner[5752]: Message gB2DTgU06893 from 208.178.120.12 >(raq01.vbcomm.net) is spam according to SpamAssassin (score=5.3, >required 5.2, AWL, HTTP_USERNAME_USED, MAILTO_TO_SPAM_ADDR, >NO_REAL_NAME, SPAM_PHRASE_00_01, WEIRD_PORT, X_AUTH_WARNING) Dec 2 >08:29:50 smithers mailscanner[5752]: Deleted spam message gB2DTgU06893 >from queue > >I don't filter @vbcomm.net (one of our domains through mailscanner?) as >yet. hostmaster@vbcomm.net is an alias that goes to mbowman@udcom.com >and another e-mail addressee. @udcom.com is filtered through >mailscanner. > >This is on a RH 7.2 box with mailscanner 3.26-2 and sendmail 8.11.6 > >Regards, > >Matthew K Bowman, >Systems Administrator -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From Denis.Beauchemin at USHERBROOKE.CA Mon Dec 2 16:19:03 2002 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:16:35 2006 Subject: Spam detection Message-ID: <1038845943.2731.150.camel@dbeauchemin.si.usherbrooke.ca> Hello, Messages that are spam according to an RBL or a blacklist rule sometimes show a low X-MailScanner-SpamScore. Could the X-MailScanner-SpamScore be modified to always score a given score if the message is to be tagged as spam? How about a "RBL and Blacklist Score = 10" in MailScanner.conf that would make those messages appear to have a score of 10? This would greatly simplify our Cyrus/Sieve spam filtering rules. Thanks again for all the efforts you put in for us. Denis -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From mailscanner at ecs.soton.ac.uk Mon Dec 2 16:22:53 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Spam detection In-Reply-To: <1038845943.2731.150.camel@dbeauchemin.si.usherbrooke.ca> Message-ID: <5.2.0.9.2.20021202162214.075a9ba0@imap.ecs.soton.ac.uk> At 16:19 02/12/2002, you wrote: >Hello, > >Messages that are spam according to an RBL or a blacklist rule sometimes >show a low X-MailScanner-SpamScore. > >Could the X-MailScanner-SpamScore be modified to always score a given >score if the message is to be tagged as spam? > >How about a "RBL and Blacklist Score = 10" in MailScanner.conf that >would make those messages appear to have a score of 10? In which case, why not just make SpamAssassin do the RBL checking? But it's a fair point, I will see what I can do. >This would greatly simplify our Cyrus/Sieve spam filtering rules. > >Thanks again for all the efforts you put in for us. No worries. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From mailscanner at ecs.soton.ac.uk Mon Dec 2 16:21:56 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Spam Actions not working correctly? In-Reply-To: Message-ID: <5.2.0.9.2.20021202162119.0767cc90@imap.ecs.soton.ac.uk> At 13:36 02/12/2002, you wrote: >Greetings, > >I have a problem with Spam Actions in the sense that it doesn't appear to >work all the time > > >mbowman@udcom.com delete >*@vbcomm.net delete Make that line just vbcomm.net delete and try it again. I am assuming you are using Version 3. >default deliver > >I still get {SPAM?) and {VIRUS?} tagged e-mail. I also get the mail for >hostmaster@vbcomm.net. > > >However, my maillog this morning states that spam.actions is working... > >Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: from >=, size=1404, class=0, nrcpts=1, msgid >=<200212021331.IAA20387@raq01.vbcomm.net>, proto=ESMTP, daemon=MTA, >relay=climax.vbcomm.net [208.178.120.12] >Dec 2 08:29:42 smithers sendmail[6893]: gB2DTgU06893: to >=, delay=00:00:00, mailer=smtp, pri=31404, stat=queued >Dec 2 08:29:50 smithers mailscanner[5752]: Message gB2DTgU06893 from >208.178.120.12 (raq01.vbcomm.net) >is spam according to SpamAssassin (score=5.3, required 5.2, AWL, >HTTP_USERNAME_USED, MAILTO_TO_SPAM_ADDR, NO_REAL_NAME, SPAM_PHRASE_00_01, >WEIRD_PORT, X_AUTH_WARNING) >Dec 2 08:29:50 smithers mailscanner[5752]: Deleted spam message >gB2DTgU06893 from queue > >I don't filter @vbcomm.net (one of our domains through mailscanner?) as >yet. hostmaster@vbcomm.net is an alias that goes to mbowman@udcom.com and >another e-mail addressee. @udcom.com is filtered through mailscanner. > >This is on a RH 7.2 box with mailscanner 3.26-2 and sendmail 8.11.6 > >Regards, > >Matthew K Bowman, >Systems Administrator -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From mailscanner at ecs.soton.ac.uk Mon Dec 2 16:24:47 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Spam detection In-Reply-To: <1038845943.2731.150.camel@dbeauchemin.si.usherbrooke.ca> Message-ID: <5.2.0.9.2.20021202162412.076aee58@imap.ecs.soton.ac.uk> At 16:19 02/12/2002, you wrote: >Hello, > >Messages that are spam according to an RBL or a blacklist rule sometimes >show a low X-MailScanner-SpamScore. > >Could the X-MailScanner-SpamScore be modified to always score a given >score if the message is to be tagged as spam? > >How about a "RBL and Blacklist Score = 10" in MailScanner.conf that >would make those messages appear to have a score of 10? 10 points regardless of the number of RBL's it appears in? Or 10 points per RBL? -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From Denis.Beauchemin at USHERBROOKE.CA Mon Dec 2 19:18:13 2002 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:16:35 2006 Subject: Spam detection In-Reply-To: <5.2.0.9.2.20021202162412.076aee58@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021202162412.076aee58@imap.ecs.soton.ac.uk> Message-ID: <1038856693.2731.164.camel@dbeauchemin.si.usherbrooke.ca> Julian, Either way it would be OK for us. Thanks again. Denis Le lun 02/12/2002 ? 11:24, Julian Field a ?crit : > At 16:19 02/12/2002, you wrote: > >Hello, > > > >Messages that are spam according to an RBL or a blacklist rule sometimes > >show a low X-MailScanner-SpamScore. > > > >Could the X-MailScanner-SpamScore be modified to always score a given > >score if the message is to be tagged as spam? > > > >How about a "RBL and Blacklist Score = 10" in MailScanner.conf that > >would make those messages appear to have a score of 10? > > 10 points regardless of the number of RBL's it appears in? > Or 10 points per RBL? > -- > Julian Field Teaching Systems Manager > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From mailscanner at ecs.soton.ac.uk Mon Dec 2 19:25:17 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Spam detection In-Reply-To: <1038856693.2731.164.camel@dbeauchemin.si.usherbrooke.ca> References: <5.2.0.9.2.20021202162412.076aee58@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021202162412.076aee58@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021202192315.01ffbe58@imap.ecs.soton.ac.uk> At 19:18 02/12/2002, you wrote: >Julian, > >Either way it would be OK for us. This won't make it into the next release (I'm aiming to release 4.10 tomorrow --- Tuesday) but should make it into the release after that. I'll add a separate score for being in the blacklist as well. >Le lun 02/12/2002 ? 11:24, Julian Field a ?crit : > > At 16:19 02/12/2002, you wrote: > > >Hello, > > > > > >Messages that are spam according to an RBL or a blacklist rule sometimes > > >show a low X-MailScanner-SpamScore. > > > > > >Could the X-MailScanner-SpamScore be modified to always score a given > > >score if the message is to be tagged as spam? > > > > > >How about a "RBL and Blacklist Score = 10" in MailScanner.conf that > > >would make those messages appear to have a score of 10? > > > > 10 points regardless of the number of RBL's it appears in? > > Or 10 points per RBL? > > -- > > Julian Field Teaching Systems Manager > > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > > Tel. 023 8059 2817 University of Southampton > > Southampton SO17 1BJ >-- >Denis Beauchemin, analyste >Universit? de Sherbrooke, S.T.I. >T: 819.821.8000x2252 F: 819.821.8045 -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From derek at csolve.net Mon Dec 2 22:51:44 2002 From: derek at csolve.net (Derek Buttineau) Date: Thu Jan 12 21:16:35 2006 Subject: Virus: Replace message to recipient Message-ID: <000a01c29a55$637d9f30$8850a4cf@CPQ12353234267> Quick question if possible. We're currently using MailScanner to scan for spam on mail inbound to our network.. I'm trying to convince my higher ups to replace our AMaViS product for virus scanning with a MailScanner solution as well. One of the initial key hurdles I need to broach to pacify the powers that be is to keep the system initally the same as AMaViS in terms of notification and message queuing. What I'm wondering.. and though I've played with the config somewhat, I may have missed it. Is it possible to replace the message destined to the recipient with a new message, say perhaps just attach the VirusWarning.txt message as the body of the message and also replace the Subject line? If I can initially replicate the behaviour of AMaViS then I can most likely win them over :) Anyway if you could let me know if this is/would be easily achievable or not, I can proceed from there. Thanks, Derek -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20021202/43d71e18/attachment.html From mailscanner at ecs.soton.ac.uk Mon Dec 2 23:08:01 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Virus: Replace message to recipient In-Reply-To: <000a01c29a55$637d9f30$8850a4cf@CPQ12353234267> Message-ID: <5.2.0.9.2.20021202230106.02f7f378@imap.ecs.soton.ac.uk> At 22:51 02/12/2002, you wrote: >Is it possible to replace the message destined to the recipient with a new >message, say perhaps just attach the VirusWarning.txt message as the body >of the message and also replace the Subject line? If I can initially >replicate the behaviour of AMaViS then I can most likely win them over :) You can make the VirusWarning.txt inline instead of an attachment. Warning Is Attachment = no You can edit the text in the VirusWarning.txt message. Stored Bad Filename Message Report = Stored Virus Message Report = You can edit the warning message that is inserted at the top of the message. Inline HTML Warning = Inline Text Warning = You can change the subject line tag. Virus Modify Subject = yes Virus Subject Text = {Virus?} This should make it pretty close to what you have now. MailScanner will (by default) try hard to deliver as much of the message as it safely can. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From nerijus at USERS.SOURCEFORGE.NET Tue Dec 3 02:41:14 2002 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:16:35 2006 Subject: clean_quarantine In-Reply-To: References: Message-ID: <200212030248.gB32mafg015139@mx.ktv.lt> On Thu, 21 Nov 2002 10:42:48 -0500 Matthew Bowman wrote: > This is also effective > > find /var/spool/MailScanner/quarantine -mtime +8 -exec rm -fr {} \; Could it be included in upcoming rpm as /etc/cron.daily/mailscanner ? Just that line with #!/bin/sh above. Regards, Nerijus From mailscanner at ecs.soton.ac.uk Tue Dec 3 08:20:46 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: clean_quarantine In-Reply-To: <200212030248.gB32mafg015139@mx.ktv.lt> References: Message-ID: <5.2.0.9.2.20021203082011.0324dc88@imap.ecs.soton.ac.uk> At 02:41 03/12/2002, you wrote: >On Thu, 21 Nov 2002 10:42:48 -0500 Matthew Bowman wrote: > > > This is also effective > > > > find /var/spool/MailScanner/quarantine -mtime +8 -exec rm -fr {} \; > >Could it be included in upcoming rpm as /etc/cron.daily/mailscanner ? > >Just that line with #!/bin/sh above. I would prefer not to include anything as standard which regularly deletes files. A bit too dangerous for my liking... :) -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From mailscanner at ecs.soton.ac.uk Tue Dec 3 09:49:08 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released Message-ID: <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> Morning all, I have just released version 4.10-1. Most important in this new version are the addition of Exim support, and the addition of a package designed for SuSE Linux 8.0 and 8.1. There are also many other changes and additions as requested by all sorts of people. You can download it all as usual from www.mailscanner.info The full ChangeLog is this: New in Version 4.10 =================== - Exim supported as well as sendmail. - I can now accept credit card donations. - Numerous minor changes to ease transition from V3 to V4. - Logging improvements to differentiate between initial scanning, disinfection and re-scanning passes over each batch. - Logging improvements to spam detection when not using SpamAssassin. - HTML messages containing IFrame tags can be converted to plain text and then delivered normally. - Fixed df2mbox script for new spam dir layout and included it in the distributions. - Another improvement to the F-Prot output parser. - "Silent Viruses" list is no longer case insensitive. - NOTE: Important fix for latest versions of Kaspersky. - Fixed bug where properly disinfectable attachments could bypass filename checks. - Re-wrote pipe code in RBL and SpamAssassin checking, as it occasionally fails badly for unknown reasons for 1 user. - Reduced default maximum number of unscanned messages per batch, as these users were actually running out of file handles. - Improved comments for "Virus Scanning" option in mailscanner.conf file. - Moved all static output strings into languages.conf for translation. MailScanner should now be properly multi-lingual (several at the same time!). - Added Danish translation (not quite complete, a few still in English). - Added Italian translation. - Fixed "Spam Bounce to" logging problem. - SpamScore header doesn't appear when message is whitelisted. - SpamCheck header always starts with "spam" or "not spam". - Run-time selection of Exim vs Sendmail. - Spam headers now obey "Multiple Headers" configuration option. - Improved RedHat init.d script to allow local customisation of mqueue.in dir. - Slight path correction in sophos-autoupdate. - Reverted to having 1 PID file instead of a PID dir. Killing the parent will kill the children. Please use "kill" and not "kill -9" as it will do a better job. - Linux init.d script improved so that stop, restart, reload and status should work better. - Linux distribution now contains QuickInstall.txt instructions. - Slightly improved wording of spam logging. - Several warnings fixed. - Configuration compiler now locks all config files as they are read, so that if you use "Restart Every" to restart frequently with config files updated by other scripts, you can simply copy the file-locking code from one of the autoupdate scripts and the same protection will be provided against reading config files while they are being updated. - Added Romanian translation of reports. - WinEvar added to default list of silent viruses. - .ceo added to default list of banned filename extensions for attachments. - Notices can now be sent to multiple recipients (space-separated list). - F-Prot autoupdate script changed for different (ftp) fallback server, and improved error logging. - IFrame and Object Codebase tags only allowed if all recipients+sender agree that they should be allowed. - Added Posix setsigmask() calls to work around bug in Perl shipped with Solaris 9 which doesn't reset the blocked-signals mask properly. - Bug fixed to correctly handle messages with no headers at all. - McAfee autoupdate script now prints McAfee version number when it tries to run McAfee to test the updated pattern files. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From brandon.pearson at BBSRC.AC.UK Tue Dec 3 09:29:04 2002 From: brandon.pearson at BBSRC.AC.UK (brandon pearson (BITS)) Date: Thu Jan 12 21:16:35 2006 Subject: Mailscanner V4 for Exim Message-ID: <41773CEF2B8FD411920200508BDCDC12278801@bits-exch1.bits.bbsrc.ac.uk> Any news on Mailscanner V4 for Exim? Thanks, Brandon From mailscanner at ecs.soton.ac.uk Tue Dec 3 10:03:05 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Mailscanner V4 for Exim In-Reply-To: <41773CEF2B8FD411920200508BDCDC12278801@bits-exch1.bits.bbs rc.ac.uk> Message-ID: <5.2.0.9.2.20021203100244.0343a208@imap.ecs.soton.ac.uk> At 09:29 03/12/2002, you wrote: >Any news on Mailscanner V4 for Exim? Me thinks I just answered that one ;-) -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mike at ZANKER.ORG Tue Dec 3 10:45:56 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released In-Reply-To: <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> Message-ID: <254759203.1038912356@mallard.open.ac.uk> On 03 December 2002 09:49 +0000 Julian Field wrote: > I have just released version 4.10-1. Great, thanks. Can we get away with just installing the main mailscanner RPM or have some of the support packages changed too? Thanks, Mike. From mailscanner at ecs.soton.ac.uk Tue Dec 3 11:14:17 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released In-Reply-To: <254759203.1038912356@mallard.open.ac.uk> References: <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021203111357.06442370@imap.ecs.soton.ac.uk> At 10:45 03/12/2002, you wrote: >On 03 December 2002 09:49 +0000 Julian Field > wrote: > >>I have just released version 4.10-1. > >Great, thanks. Can we get away with just installing the main >mailscanner RPM or have some of the support packages changed too? Just the main mailscanner RPM. I haven't changed any of the support packages. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From S.R.Patterson at SOTON.AC.UK Tue Dec 3 11:39:43 2002 From: S.R.Patterson at SOTON.AC.UK (Patterson S.R.) Date: Thu Jan 12 21:16:35 2006 Subject: My clean.quarantine script Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, Find attached the clean.quarantine script I run daily. It uses perl and has the advantage over the one on www.mailscaner.info that it deletes any directory older than the specified time, rather than any directory as old as the specified time - so if it doesn't run for a day or two for some reason, it doesn't really matter. Steve - -- Steven Patterson MSci OCP. Tel: +44 (0)2380 595810 Primary Information Services Support and Development Information Systems Services, University of Southampton, UK. Public PGP Key: http://www.bottleneck.org/pubkey.php -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 (Build 294) Beta iQA/AwUBPeyX/q2fOiTs5+WvEQI2fgCeNkSRw0x4DKncPawEk5uW2zq0GPwAn1U6 rbToOmlRe1L5UdVsVoBbn8BF =6AwI -----END PGP SIGNATURE----- -------------- next part -------------- A non-text attachment was scrubbed... Name: clean.quarantine Type: application/octet-stream Size: 728 bytes Desc: clean.quarantine Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20021203/a6adbe12/clean.obj From info at blacknight-solutions.com Tue Dec 3 11:53:06 2002 From: info at blacknight-solutions.com (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released In-Reply-To: <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> Message-ID: <17525.213.136.131.214.1038916386.squirrel@www.blacknightsolutions.com> Thanks for all your hard work!! I think I'll wait a few days before installing this as it doesn't get along too well with our CP (or vice versa) From luis at PEROMARTA.ORG Tue Dec 3 12:16:33 2002 From: luis at PEROMARTA.ORG (Luis Peromarta) Date: Thu Jan 12 21:16:35 2006 Subject: Languages.conf in spanish In-Reply-To: <5.2.0.9.2.20021203111357.06442370@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203111357.06442370@imap.ecs.soton.ac.uk> Message-ID: <20021203121633.GA32747@perolinux.peromarta.org> Hi Julian, please find attache languages.conf file in Spanish. You may include it in next release, On Tue, Dec 03, 2002 at 11:14:17AM +0000, Julian Field wrote: > At 10:45 03/12/2002, you wrote: > >On 03 December 2002 09:49 +0000 Julian Field > > wrote: > > > >>I have just released version 4.10-1. > > > >Great, thanks. Can we get away with just installing the main > >mailscanner RPM or have some of the support packages changed too? > > Just the main mailscanner RPM. I haven't changed any of the support > packages. > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support -- Saludos Cordiales, Beannacht D? Leat, Best Regards, M.F.G, Cordialement ----------------------------------------------------------------------- Luis Peromarta Rome wasn't built in a day powered by myISP (we didn't have the contract) http://peromarta.org http://peebles-engineering.com -- ?ste mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que est? limpio. -------------- next part -------------- A non-text attachment was scrubbed... Name: languages.conf.gz Type: application/x-gzip Size: 1076 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20021203/56d84a63/languages.conf.gz From mailscanner at ecs.soton.ac.uk Tue Dec 3 12:17:18 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released In-Reply-To: <5.2.0.9.2.20021203111357.06442370@imap.ecs.soton.ac.uk> References: <254759203.1038912356@mallard.open.ac.uk> <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021203121602.06573098@imap.ecs.soton.ac.uk> If you are getting syntax errors on starting up MailScanner (Config.pm line 950), then you forgot to compare your MailScanner.conf file with the one from the latest version. You are probably lacking the "Language Strings" configuration value which is essential. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From doko at CS.TU-BERLIN.DE Tue Dec 3 11:33:29 2002 From: doko at CS.TU-BERLIN.DE (Matthias Klose) Date: Thu Jan 12 21:16:35 2006 Subject: V4 & Exim In-Reply-To: <20021103113448.GE30611@hoiho.nz.lemon-computing.com> References: <20021103113448.GE30611@hoiho.nz.lemon-computing.com> Message-ID: <15852.38537.5564.121535@gargle.gargle.HOWL> Nick Phillips writes: > OK, just to give you some idea of where I'm at... > > ...I've just successfully passed my first few messages through v4 with Exim. > > There are a bunch of bugs that I know about, and are sure to be loads that > I don't. Next step is to fix the obvious ones & start testing with "dirty" > messages. > > Then a neat way to select mta-specific code at runtime needs to be dealt with > (I've got a few ideas here... should be fun). ok, what's the status now that exim support is in ;-) Matthias From mailscanner at ecs.soton.ac.uk Tue Dec 3 12:27:02 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Languages.conf in spanish In-Reply-To: <20021203121633.GA32747@perolinux.peromarta.org> References: <5.2.0.9.2.20021203111357.06442370@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203093215.037fdb40@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203111357.06442370@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021203122653.065ceec0@imap.ecs.soton.ac.uk> Many thanks. It will be in the next release. At 12:16 03/12/2002, you wrote: >Hi Julian, please find attache languages.conf file in Spanish. > >You may include it in next release, > >On Tue, Dec 03, 2002 at 11:14:17AM +0000, Julian Field wrote: > > At 10:45 03/12/2002, you wrote: > > >On 03 December 2002 09:49 +0000 Julian Field > > > wrote: > > > > > >>I have just released version 4.10-1. > > > > > >Great, thanks. Can we get away with just installing the main > > >mailscanner RPM or have some of the support packages changed too? > > > > Just the main mailscanner RPM. I haven't changed any of the support > > packages. > > -- > > Julian Field > > www.MailScanner.info > > MailScanner thanks transtec Computers for their support > >-- >Saludos Cordiales, Beannacht D? Leat, Best Regards, M.F.G, Cordialement >----------------------------------------------------------------------- >Luis Peromarta Rome wasn't built in a day >powered by myISP (we didn't have the contract) >http://peromarta.org http://peebles-engineering.com > > >-- >?ste mensaje ha sido analizado por MailScanner >en busca de virus y otros contenidos peligrosos, >y se considera que est? limpio. > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Jan-Peter.Koopmann at SECEIDOS.DE Tue Dec 3 14:42:09 2002 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released Message-ID: <4E7026FF8A422749B1553FE508E00680053E4D@message.intern.akctech.de> Hi Julian, I just upgraded to 4.10-1. Starting MailScanner I get the following console output for every new instance: Number of lines: 20 Relative Line Numbers (in percent): 12.697333199579 29.519721770149 40.8800726258374 63.8060390653807 74.5889492315516 93.5640391425596 Absolute Line Numbers: 2 5 8 12 14 18 Relative Offsets for section 1: 48.2012991046913 99.3694709983668 Relative Offsets for section 2: 6.93676010661921 83.6820767989025 Length of the first section: 264 bytes Length of the second section: 198 bytes Chunk start/end positions in Section 1: 127 262 (length: 135) Chunk start/end positions in Section 2: 13 165 (length: 152) Absolute chunk offsets: Line 6 charachter 61 to line 8 character 64 Absolute chunk offsets: Line 12 charachter 13 to line 14 character 33 Section 1: loadsI need to make this message body somewhat long so TextCat preloadsI need to make this message body somewhat long so TextCat preloa Section 2: e this message body somewhat long so TextCat preloadsI need to make this message body somewhat long so TextCat preloadsI need to make this message body Total length of stuff that will be hashed: 287 Computed e-hash is 32a699489a8a872fe2c90e3026ee5e1f87286acc What am I doing wrong? I updated mailscanner.conf with the language setting and copied bin and etc/reports over the old installation. Regards, JP > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: Tuesday, December 03, 2002 10:49 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: ANNOUNCE: Version 4.10-1 released > > > Morning all, > > I have just released version 4.10-1. > > Most important in this new version are the addition of Exim > support, and the addition of a package designed for SuSE > Linux 8.0 and 8.1. > > There are also many other changes and additions as requested > by all sorts of people. > > You can download it all as usual from > www.mailscanner.info > > The full ChangeLog is this: > > New in Version 4.10 > =================== > - Exim supported as well as sendmail. > - I can now accept credit card donations. > - Numerous minor changes to ease transition from V3 to V4. > - Logging improvements to differentiate between initial > scanning, disinfection and re-scanning passes over each batch. > - Logging improvements to spam detection when not using SpamAssassin. > - HTML messages containing IFrame tags can be converted to > plain text and then delivered normally. > - Fixed df2mbox script for new spam dir layout and included > it in the distributions. > - Another improvement to the F-Prot output parser. > - "Silent Viruses" list is no longer case insensitive. > - NOTE: Important fix for latest versions of Kaspersky. > - Fixed bug where properly disinfectable attachments could > bypass filename checks. > - Re-wrote pipe code in RBL and SpamAssassin checking, as it > occasionally fails badly for unknown reasons for 1 user. > - Reduced default maximum number of unscanned messages per > batch, as these users were actually running out of file handles. > - Improved comments for "Virus Scanning" option in > mailscanner.conf file. > - Moved all static output strings into languages.conf for > translation. MailScanner should now be properly multi-lingual > (several at the same time!). > - Added Danish translation (not quite complete, a few still > in English). > - Added Italian translation. > - Fixed "Spam Bounce to" logging problem. > - SpamScore header doesn't appear when message is whitelisted. > - SpamCheck header always starts with "spam" or "not spam". > - Run-time selection of Exim vs Sendmail. > - Spam headers now obey "Multiple Headers" configuration option. > - Improved RedHat init.d script to allow local customisation > of mqueue.in dir. > - Slight path correction in sophos-autoupdate. > - Reverted to having 1 PID file instead of a PID dir. Killing > the parent will kill the children. Please use "kill" and not > "kill -9" as it will do a better job. > - Linux init.d script improved so that stop, restart, reload > and status should work better. > - Linux distribution now contains QuickInstall.txt instructions. > - Slightly improved wording of spam logging. > - Several warnings fixed. > - Configuration compiler now locks all config files as they > are read, so that if you use "Restart Every" to restart > frequently with config files updated by other scripts, you > can simply copy the file-locking code from one of the > autoupdate scripts and the same protection will be provided > against reading config files while they are being updated. > - Added Romanian translation of reports. > - WinEvar added to default list of silent viruses. > - .ceo added to default list of banned filename extensions > for attachments. > - Notices can now be sent to multiple recipients > (space-separated list). > - F-Prot autoupdate script changed for different (ftp) > fallback server, and improved error logging. > - IFrame and Object Codebase tags only allowed if all > recipients+sender agree that they should be allowed. > - Added Posix setsigmask() calls to work around bug in Perl > shipped with Solaris 9 which doesn't reset the > blocked-signals mask properly. > - Bug fixed to correctly handle messages with no headers at all. > - McAfee autoupdate script now prints McAfee version number > when it tries to run McAfee to test the updated pattern files. > -- > Julian Field Teaching Systems Manager > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ > From mailscanner at ecs.soton.ac.uk Tue Dec 3 14:51:16 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released In-Reply-To: <4E7026FF8A422749B1553FE508E00680053E4D@message.intern.akct ech.de> Message-ID: <5.2.0.9.2.20021203144824.065e2418@imap.ecs.soton.ac.uk> Are you using Exim or sendmail? I can't find any lines containing the text printed below in the MailScanner source code. Have you got any debug settings switched on or anything like that? I don't think this code can possibly actually come from MailScanner, it must be coming from something it calls. Nick --- got any ideas where this is coming from? At 14:42 03/12/2002, you wrote: >Hi Julian, > >I just upgraded to 4.10-1. Starting MailScanner I get the following >console output for every new instance: > >Number of lines: 20 >Relative Line Numbers (in percent): 12.697333199579 29.519721770149 >40.8800726258374 63.8060390653807 74.5889492315516 93.5640391425596 >Absolute Line Numbers: 2 5 8 12 14 18 >Relative Offsets for section 1: 48.2012991046913 99.3694709983668 >Relative Offsets for section 2: 6.93676010661921 83.6820767989025 >Length of the first section: 264 bytes >Length of the second section: 198 bytes >Chunk start/end positions in Section 1: 127 262 (length: 135) >Chunk start/end positions in Section 2: 13 165 (length: 152) >Absolute chunk offsets: Line 6 charachter 61 to line 8 character 64 >Absolute chunk offsets: Line 12 charachter 13 to line 14 character 33 >Section 1: loadsI need to make this message body somewhat long so >TextCat preloadsI need to make this message body somewhat long so >TextCat preloa >Section 2: e this message body somewhat long so TextCat preloadsI need >to make this message body somewhat long so TextCat preloadsI need to >make this message body >Total length of stuff that will be hashed: 287 >Computed e-hash is 32a699489a8a872fe2c90e3026ee5e1f87286acc > >What am I doing wrong? I updated mailscanner.conf with the language >setting and copied bin and etc/reports over the old installation. > >Regards, > JP > > > -----Original Message----- > > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > > Sent: Tuesday, December 03, 2002 10:49 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: ANNOUNCE: Version 4.10-1 released > > > > > > Morning all, > > > > I have just released version 4.10-1. > > > > Most important in this new version are the addition of Exim > > support, and the addition of a package designed for SuSE > > Linux 8.0 and 8.1. > > > > There are also many other changes and additions as requested > > by all sorts of people. > > > > You can download it all as usual from > > www.mailscanner.info > > > > The full ChangeLog is this: > > > > New in Version 4.10 > > =================== > > - Exim supported as well as sendmail. > > - I can now accept credit card donations. > > - Numerous minor changes to ease transition from V3 to V4. > > - Logging improvements to differentiate between initial > > scanning, disinfection and re-scanning passes over each batch. > > - Logging improvements to spam detection when not using SpamAssassin. > > - HTML messages containing IFrame tags can be converted to > > plain text and then delivered normally. > > - Fixed df2mbox script for new spam dir layout and included > > it in the distributions. > > - Another improvement to the F-Prot output parser. > > - "Silent Viruses" list is no longer case insensitive. > > - NOTE: Important fix for latest versions of Kaspersky. > > - Fixed bug where properly disinfectable attachments could > > bypass filename checks. > > - Re-wrote pipe code in RBL and SpamAssassin checking, as it > > occasionally fails badly for unknown reasons for 1 user. > > - Reduced default maximum number of unscanned messages per > > batch, as these users were actually running out of file handles. > > - Improved comments for "Virus Scanning" option in > > mailscanner.conf file. > > - Moved all static output strings into languages.conf for > > translation. MailScanner should now be properly multi-lingual > > (several at the same time!). > > - Added Danish translation (not quite complete, a few still > > in English). > > - Added Italian translation. > > - Fixed "Spam Bounce to" logging problem. > > - SpamScore header doesn't appear when message is whitelisted. > > - SpamCheck header always starts with "spam" or "not spam". > > - Run-time selection of Exim vs Sendmail. > > - Spam headers now obey "Multiple Headers" configuration option. > > - Improved RedHat init.d script to allow local customisation > > of mqueue.in dir. > > - Slight path correction in sophos-autoupdate. > > - Reverted to having 1 PID file instead of a PID dir. Killing > > the parent will kill the children. Please use "kill" and not > > "kill -9" as it will do a better job. > > - Linux init.d script improved so that stop, restart, reload > > and status should work better. > > - Linux distribution now contains QuickInstall.txt instructions. > > - Slightly improved wording of spam logging. > > - Several warnings fixed. > > - Configuration compiler now locks all config files as they > > are read, so that if you use "Restart Every" to restart > > frequently with config files updated by other scripts, you > > can simply copy the file-locking code from one of the > > autoupdate scripts and the same protection will be provided > > against reading config files while they are being updated. > > - Added Romanian translation of reports. > > - WinEvar added to default list of silent viruses. > > - .ceo added to default list of banned filename extensions > > for attachments. > > - Notices can now be sent to multiple recipients > > (space-separated list). > > - F-Prot autoupdate script changed for different (ftp) > > fallback server, and improved error logging. > > - IFrame and Object Codebase tags only allowed if all > > recipients+sender agree that they should be allowed. > > - Added Posix setsigmask() calls to work around bug in Perl > > shipped with Solaris 9 which doesn't reset the > > blocked-signals mask properly. > > - Bug fixed to correctly handle messages with no headers at all. > > - McAfee autoupdate script now prints McAfee version number > > when it tries to run McAfee to test the updated pattern files. > > -- > > Julian Field Teaching Systems Manager > > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > > Tel. 023 8059 2817 University of Southampton > > Southampton SO17 1BJ > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Jan-Peter.Koopmann at SECEIDOS.DE Tue Dec 3 14:57:03 2002 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released Message-ID: <4E7026FF8A422749B1553FE508E00680053E4F@message.intern.akctech.de> Hi, I am using sendmail and I am pretty sure this either comes from razor or from DCC. I am about to find out now and tell you ASAP. Strange though: 1. Why have I not noticed this before? 2. Why does this happen the moment I turn on MailScanner? There should be nothing left in the mailqueue. Regards, JP > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: Tuesday, December 03, 2002 3:51 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: ANNOUNCE: Version 4.10-1 released > > > Are you using Exim or sendmail? > I can't find any lines containing the text printed below in > the MailScanner source code. > > Have you got any debug settings switched on or anything like > that? I don't think this code can possibly actually come from > MailScanner, it must be coming from something it calls. > > Nick --- got any ideas where this is coming from? > > At 14:42 03/12/2002, you wrote: > >Hi Julian, > > > >I just upgraded to 4.10-1. Starting MailScanner I get the following > >console output for every new instance: > > > >Number of lines: 20 > >Relative Line Numbers (in percent): 12.697333199579 29.519721770149 > >40.8800726258374 63.8060390653807 74.5889492315516 93.5640391425596 > >Absolute Line Numbers: 2 5 8 12 14 18 Relative Offsets for > section 1: > >48.2012991046913 99.3694709983668 Relative Offsets for section 2: > >6.93676010661921 83.6820767989025 Length of the first section: 264 > >bytes Length of the second section: 198 bytes > >Chunk start/end positions in Section 1: 127 262 (length: 135) > >Chunk start/end positions in Section 2: 13 165 (length: 152) > >Absolute chunk offsets: Line 6 charachter 61 to line 8 character 64 > >Absolute chunk offsets: Line 12 charachter 13 to line 14 character 33 > >Section 1: loadsI need to make this message body somewhat long so > >TextCat preloadsI need to make this message body somewhat long so > >TextCat preloa > >Section 2: e this message body somewhat long so TextCat > preloadsI need > >to make this message body somewhat long so TextCat preloadsI need to > >make this message body > >Total length of stuff that will be hashed: 287 > >Computed e-hash is 32a699489a8a872fe2c90e3026ee5e1f87286acc > > > >What am I doing wrong? I updated mailscanner.conf with the language > >setting and copied bin and etc/reports over the old installation. > > > >Regards, > > JP > > > > > -----Original Message----- > > > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > > > Sent: Tuesday, December 03, 2002 10:49 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: ANNOUNCE: Version 4.10-1 released > > > > > > > > > Morning all, > > > > > > I have just released version 4.10-1. > > > > > > Most important in this new version are the addition of > Exim support, > > > and the addition of a package designed for SuSE Linux 8.0 and 8.1. > > > > > > There are also many other changes and additions as > requested by all > > > sorts of people. > > > > > > You can download it all as usual from > > > www.mailscanner.info > > > > > > The full ChangeLog is this: > > > > > > New in Version 4.10 > > > =================== > > > - Exim supported as well as sendmail. > > > - I can now accept credit card donations. > > > - Numerous minor changes to ease transition from V3 to V4. > > > - Logging improvements to differentiate between initial scanning, > > > disinfection and re-scanning passes over each batch. > > > - Logging improvements to spam detection when not using > > > SpamAssassin. > > > - HTML messages containing IFrame tags can be converted to > > > plain text and then delivered normally. > > > - Fixed df2mbox script for new spam dir layout and included > > > it in the distributions. > > > - Another improvement to the F-Prot output parser. > > > - "Silent Viruses" list is no longer case insensitive. > > > - NOTE: Important fix for latest versions of Kaspersky. > > > - Fixed bug where properly disinfectable attachments could > > > bypass filename checks. > > > - Re-wrote pipe code in RBL and SpamAssassin checking, as it > > > occasionally fails badly for unknown reasons for 1 user. > > > - Reduced default maximum number of unscanned messages per > > > batch, as these users were actually running out of file handles. > > > - Improved comments for "Virus Scanning" option in > > > mailscanner.conf file. > > > - Moved all static output strings into languages.conf for > > > translation. MailScanner should now be properly multi-lingual > > > (several at the same time!). > > > - Added Danish translation (not quite complete, a few still > > > in English). > > > - Added Italian translation. > > > - Fixed "Spam Bounce to" logging problem. > > > - SpamScore header doesn't appear when message is whitelisted. > > > - SpamCheck header always starts with "spam" or "not spam". > > > - Run-time selection of Exim vs Sendmail. > > > - Spam headers now obey "Multiple Headers" configuration option. > > > - Improved RedHat init.d script to allow local customisation > > > of mqueue.in dir. > > > - Slight path correction in sophos-autoupdate. > > > - Reverted to having 1 PID file instead of a PID dir. Killing > > > the parent will kill the children. Please use "kill" and not > > > "kill -9" as it will do a better job. > > > - Linux init.d script improved so that stop, restart, reload > > > and status should work better. > > > - Linux distribution now contains QuickInstall.txt instructions. > > > - Slightly improved wording of spam logging. > > > - Several warnings fixed. > > > - Configuration compiler now locks all config files as they > > > are read, so that if you use "Restart Every" to restart > > > frequently with config files updated by other scripts, you > > > can simply copy the file-locking code from one of the > > > autoupdate scripts and the same protection will be provided > > > against reading config files while they are being updated. > > > - Added Romanian translation of reports. > > > - WinEvar added to default list of silent viruses. > > > - .ceo added to default list of banned filename extensions > > > for attachments. > > > - Notices can now be sent to multiple recipients > > > (space-separated list). > > > - F-Prot autoupdate script changed for different (ftp) > > > fallback server, and improved error logging. > > > - IFrame and Object Codebase tags only allowed if all > > > recipients+sender agree that they should be allowed. > > > - Added Posix setsigmask() calls to work around bug in > Perl shipped > > > with Solaris 9 which doesn't reset the blocked-signals mask > > > properly. > > > - Bug fixed to correctly handle messages with no headers at all. > > > - McAfee autoupdate script now prints McAfee version > number when it > > > tries to run McAfee to test the updated pattern files. > > > -- > > > Julian Field Teaching Systems Manager > > > jkf@ecs.soton.ac.uk Dept. of Electronics & > Computer Science > > > Tel. 023 8059 2817 University of Southampton > > > Southampton SO17 1BJ > > > > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > From Jan-Peter.Koopmann at SECEIDOS.DE Tue Dec 3 15:10:58 2002 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released Message-ID: <4E7026FF8A422749B1553FE508E00680053E50@message.intern.akctech.de> Looks like pyzor to me. I could not find this in the sources of pyzor but once I comment out pyzor/DCC in spam.assassin.prefs.conf I do not get this anymore. Still strange... > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: Tuesday, December 03, 2002 3:51 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: ANNOUNCE: Version 4.10-1 released > > > Are you using Exim or sendmail? > I can't find any lines containing the text printed below in > the MailScanner source code. > > Have you got any debug settings switched on or anything like > that? I don't think this code can possibly actually come from > MailScanner, it must be coming from something it calls. > > Nick --- got any ideas where this is coming from? > > At 14:42 03/12/2002, you wrote: > >Hi Julian, > > > >I just upgraded to 4.10-1. Starting MailScanner I get the following > >console output for every new instance: > > > >Number of lines: 20 > >Relative Line Numbers (in percent): 12.697333199579 29.519721770149 > >40.8800726258374 63.8060390653807 74.5889492315516 93.5640391425596 > >Absolute Line Numbers: 2 5 8 12 14 18 Relative Offsets for > section 1: > >48.2012991046913 99.3694709983668 Relative Offsets for section 2: > >6.93676010661921 83.6820767989025 Length of the first section: 264 > >bytes Length of the second section: 198 bytes > >Chunk start/end positions in Section 1: 127 262 (length: 135) > >Chunk start/end positions in Section 2: 13 165 (length: 152) > >Absolute chunk offsets: Line 6 charachter 61 to line 8 character 64 > >Absolute chunk offsets: Line 12 charachter 13 to line 14 character 33 > >Section 1: loadsI need to make this message body somewhat long so > >TextCat preloadsI need to make this message body somewhat long so > >TextCat preloa > >Section 2: e this message body somewhat long so TextCat > preloadsI need > >to make this message body somewhat long so TextCat preloadsI need to > >make this message body > >Total length of stuff that will be hashed: 287 > >Computed e-hash is 32a699489a8a872fe2c90e3026ee5e1f87286acc > > > >What am I doing wrong? I updated mailscanner.conf with the language > >setting and copied bin and etc/reports over the old installation. > > > >Regards, > > JP > > > > > -----Original Message----- > > > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > > > Sent: Tuesday, December 03, 2002 10:49 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: ANNOUNCE: Version 4.10-1 released > > > > > > > > > Morning all, > > > > > > I have just released version 4.10-1. > > > > > > Most important in this new version are the addition of > Exim support, > > > and the addition of a package designed for SuSE Linux 8.0 and 8.1. > > > > > > There are also many other changes and additions as > requested by all > > > sorts of people. > > > > > > You can download it all as usual from > > > www.mailscanner.info > > > > > > The full ChangeLog is this: > > > > > > New in Version 4.10 > > > =================== > > > - Exim supported as well as sendmail. > > > - I can now accept credit card donations. > > > - Numerous minor changes to ease transition from V3 to V4. > > > - Logging improvements to differentiate between initial scanning, > > > disinfection and re-scanning passes over each batch. > > > - Logging improvements to spam detection when not using > > > SpamAssassin. > > > - HTML messages containing IFrame tags can be converted to > > > plain text and then delivered normally. > > > - Fixed df2mbox script for new spam dir layout and included > > > it in the distributions. > > > - Another improvement to the F-Prot output parser. > > > - "Silent Viruses" list is no longer case insensitive. > > > - NOTE: Important fix for latest versions of Kaspersky. > > > - Fixed bug where properly disinfectable attachments could > > > bypass filename checks. > > > - Re-wrote pipe code in RBL and SpamAssassin checking, as it > > > occasionally fails badly for unknown reasons for 1 user. > > > - Reduced default maximum number of unscanned messages per > > > batch, as these users were actually running out of file handles. > > > - Improved comments for "Virus Scanning" option in > > > mailscanner.conf file. > > > - Moved all static output strings into languages.conf for > > > translation. MailScanner should now be properly multi-lingual > > > (several at the same time!). > > > - Added Danish translation (not quite complete, a few still > > > in English). > > > - Added Italian translation. > > > - Fixed "Spam Bounce to" logging problem. > > > - SpamScore header doesn't appear when message is whitelisted. > > > - SpamCheck header always starts with "spam" or "not spam". > > > - Run-time selection of Exim vs Sendmail. > > > - Spam headers now obey "Multiple Headers" configuration option. > > > - Improved RedHat init.d script to allow local customisation > > > of mqueue.in dir. > > > - Slight path correction in sophos-autoupdate. > > > - Reverted to having 1 PID file instead of a PID dir. Killing > > > the parent will kill the children. Please use "kill" and not > > > "kill -9" as it will do a better job. > > > - Linux init.d script improved so that stop, restart, reload > > > and status should work better. > > > - Linux distribution now contains QuickInstall.txt instructions. > > > - Slightly improved wording of spam logging. > > > - Several warnings fixed. > > > - Configuration compiler now locks all config files as they > > > are read, so that if you use "Restart Every" to restart > > > frequently with config files updated by other scripts, you > > > can simply copy the file-locking code from one of the > > > autoupdate scripts and the same protection will be provided > > > against reading config files while they are being updated. > > > - Added Romanian translation of reports. > > > - WinEvar added to default list of silent viruses. > > > - .ceo added to default list of banned filename extensions > > > for attachments. > > > - Notices can now be sent to multiple recipients > > > (space-separated list). > > > - F-Prot autoupdate script changed for different (ftp) > > > fallback server, and improved error logging. > > > - IFrame and Object Codebase tags only allowed if all > > > recipients+sender agree that they should be allowed. > > > - Added Posix setsigmask() calls to work around bug in > Perl shipped > > > with Solaris 9 which doesn't reset the blocked-signals mask > > > properly. > > > - Bug fixed to correctly handle messages with no headers at all. > > > - McAfee autoupdate script now prints McAfee version > number when it > > > tries to run McAfee to test the updated pattern files. > > > -- > > > Julian Field Teaching Systems Manager > > > jkf@ecs.soton.ac.uk Dept. of Electronics & > Computer Science > > > Tel. 023 8059 2817 University of Southampton > > > Southampton SO17 1BJ > > > > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > From Jan-Peter.Koopmann at SECEIDOS.DE Tue Dec 3 15:48:41 2002 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:16:35 2006 Subject: ANNOUNCE: Version 4.10-1 released Message-ID: <4E7026FF8A422749B1553FE508E00680053E51@message.intern.akctech.de> Me again... I take it back. It is not pyzor, it is razor. After having a look at http://www.geocrawler.com/archives/3/2539/2002/3/0/8232704/ and testing things again I am sure. Everything seems to work fine by the way so I will discard the problem as being cosmetic only. Thanks, JP > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: Tuesday, December 03, 2002 3:51 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: ANNOUNCE: Version 4.10-1 released > > > Are you using Exim or sendmail? > I can't find any lines containing the text printed below in > the MailScanner source code. > > Have you got any debug settings switched on or anything like > that? I don't think this code can possibly actually come from > MailScanner, it must be coming from something it calls. > > Nick --- got any ideas where this is coming from? > > At 14:42 03/12/2002, you wrote: > >Hi Julian, > > > >I just upgraded to 4.10-1. Starting MailScanner I get the following > >console output for every new instance: > > > >Number of lines: 20 > >Relative Line Numbers (in percent): 12.697333199579 29.519721770149 > >40.8800726258374 63.8060390653807 74.5889492315516 93.5640391425596 > >Absolute Line Numbers: 2 5 8 12 14 18 Relative Offsets for > section 1: > >48.2012991046913 99.3694709983668 Relative Offsets for section 2: > >6.93676010661921 83.6820767989025 Length of the first section: 264 > >bytes Length of the second section: 198 bytes > >Chunk start/end positions in Section 1: 127 262 (length: 135) > >Chunk start/end positions in Section 2: 13 165 (length: 152) > >Absolute chunk offsets: Line 6 charachter 61 to line 8 character 64 > >Absolute chunk offsets: Line 12 charachter 13 to line 14 character 33 > >Section 1: loadsI need to make this message body somewhat long so > >TextCat preloadsI need to make this message body somewhat long so > >TextCat preloa > >Section 2: e this message body somewhat long so TextCat > preloadsI need > >to make this message body somewhat long so TextCat preloadsI need to > >make this message body > >Total length of stuff that will be hashed: 287 > >Computed e-hash is 32a699489a8a872fe2c90e3026ee5e1f87286acc > > > >What am I doing wrong? I updated mailscanner.conf with the language > >setting and copied bin and etc/reports over the old installation. > > > >Regards, > > JP > > > > > -----Original Message----- > > > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > > > Sent: Tuesday, December 03, 2002 10:49 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: ANNOUNCE: Version 4.10-1 released > > > > > > > > > Morning all, > > > > > > I have just released version 4.10-1. > > > > > > Most important in this new version are the addition of > Exim support, > > > and the addition of a package designed for SuSE Linux 8.0 and 8.1. > > > > > > There are also many other changes and additions as > requested by all > > > sorts of people. > > > > > > You can download it all as usual from > > > www.mailscanner.info > > > > > > The full ChangeLog is this: > > > > > > New in Version 4.10 > > > =================== > > > - Exim supported as well as sendmail. > > > - I can now accept credit card donations. > > > - Numerous minor changes to ease transition from V3 to V4. > > > - Logging improvements to differentiate between initial scanning, > > > disinfection and re-scanning passes over each batch. > > > - Logging improvements to spam detection when not using > > > SpamAssassin. > > > - HTML messages containing IFrame tags can be converted to > > > plain text and then delivered normally. > > > - Fixed df2mbox script for new spam dir layout and included > > > it in the distributions. > > > - Another improvement to the F-Prot output parser. > > > - "Silent Viruses" list is no longer case insensitive. > > > - NOTE: Important fix for latest versions of Kaspersky. > > > - Fixed bug where properly disinfectable attachments could > > > bypass filename checks. > > > - Re-wrote pipe code in RBL and SpamAssassin checking, as it > > > occasionally fails badly for unknown reasons for 1 user. > > > - Reduced default maximum number of unscanned messages per > > > batch, as these users were actually running out of file handles. > > > - Improved comments for "Virus Scanning" option in > > > mailscanner.conf file. > > > - Moved all static output strings into languages.conf for > > > translation. MailScanner should now be properly multi-lingual > > > (several at the same time!). > > > - Added Danish translation (not quite complete, a few still > > > in English). > > > - Added Italian translation. > > > - Fixed "Spam Bounce to" logging problem. > > > - SpamScore header doesn't appear when message is whitelisted. > > > - SpamCheck header always starts with "spam" or "not spam". > > > - Run-time selection of Exim vs Sendmail. > > > - Spam headers now obey "Multiple Headers" configuration option. > > > - Improved RedHat init.d script to allow local customisation > > > of mqueue.in dir. > > > - Slight path correction in sophos-autoupdate. > > > - Reverted to having 1 PID file instead of a PID dir. Killing > > > the parent will kill the children. Please use "kill" and not > > > "kill -9" as it will do a better job. > > > - Linux init.d script improved so that stop, restart, reload > > > and status should work better. > > > - Linux distribution now contains QuickInstall.txt instructions. > > > - Slightly improved wording of spam logging. > > > - Several warnings fixed. > > > - Configuration compiler now locks all config files as they > > > are read, so that if you use "Restart Every" to restart > > > frequently with config files updated by other scripts, you > > > can simply copy the file-locking code from one of the > > > autoupdate scripts and the same protection will be provided > > > against reading config files while they are being updated. > > > - Added Romanian translation of reports. > > > - WinEvar added to default list of silent viruses. > > > - .ceo added to default list of banned filename extensions > > > for attachments. > > > - Notices can now be sent to multiple recipients > > > (space-separated list). > > > - F-Prot autoupdate script changed for different (ftp) > > > fallback server, and improved error logging. > > > - IFrame and Object Codebase tags only allowed if all > > > recipients+sender agree that they should be allowed. > > > - Added Posix setsigmask() calls to work around bug in > Perl shipped > > > with Solaris 9 which doesn't reset the blocked-signals mask > > > properly. > > > - Bug fixed to correctly handle messages with no headers at all. > > > - McAfee autoupdate script now prints McAfee version > number when it > > > tries to run McAfee to test the updated pattern files. > > > -- > > > Julian Field Teaching Systems Manager > > > jkf@ecs.soton.ac.uk Dept. of Electronics & > Computer Science > > > Tel. 023 8059 2817 University of Southampton > > > Southampton SO17 1BJ > > > > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > From paul_houselander at BRISTOL-LEA.ORG.UK Tue Dec 3 15:53:19 2002 From: paul_houselander at BRISTOL-LEA.ORG.UK (Paul Houselander) Date: Thu Jan 12 21:16:35 2006 Subject: Local Domains Message-ID: <00c301c29ae4$19c11360$7b10140a@education.bcc.lan> Im trying to recreate the old "Deliver From Local Domains" Can I just confirm this is correct I have Deliver Cleaned Messages = /opt/ms_rulesets/deliver.clean.rules and in deliver.clean.rules I have To: *@abc.co.uk yes To: *@xyz.com yes To: default no Will this deliver cleaned messages to abc.co.uk and xyz.co.uk (domains I look after) but not deliver for a cleaned mail to any other domain? Do I need to set explicit From: *@abc.co.uk no From: *@xyz.co.uk no From: default yes as well? Paul -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mailscanner at ecs.soton.ac.uk Tue Dec 3 16:16:08 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Local Domains In-Reply-To: <00c301c29ae4$19c11360$7b10140a@education.bcc.lan> Message-ID: <5.2.0.9.2.20021203161435.064d8240@imap.ecs.soton.ac.uk> At 15:53 03/12/2002, you wrote: >Im trying to recreate the old "Deliver From Local Domains" > >Can I just confirm this is correct > >I have > >Deliver Cleaned Messages = /opt/ms_rulesets/deliver.clean.rules > >and in deliver.clean.rules I have > >To: *@abc.co.uk yes >To: *@xyz.com yes >To: default no Set the default for both directions, so I would advise FromOrTo: default no instead of your "To: default no" line. >Will this deliver cleaned messages to abc.co.uk and xyz.co.uk (domains I >look after) but not deliver for a cleaned mail to any other domain? Correct (with my change). -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From splee at PLEXIO.COM Tue Dec 3 18:37:35 2002 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 Message-ID: <1038940655.30026.100.camel@ralph.plexio.private> Hi, I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 system running Exim 3.36. The Perl modules install fine but the install.sh scripts stops near the end and complains about a sendmail dependency. Am I suppose to adjust something in the install.sh script or the mailscanner rpm? My version of Exim originates from source and not an rpm. Thanks, Stephen From mailscanner at ecs.soton.ac.uk Tue Dec 3 18:45:36 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <1038940655.30026.100.camel@ralph.plexio.private> Message-ID: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> At 18:37 03/12/2002, you wrote: >I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 >system running Exim 3.36. The Perl modules install fine but the >install.sh scripts stops near the end and complains about a sendmail >dependency. Am I suppose to adjust something in the install.sh script or >the mailscanner rpm? My version of Exim originates from source and not >an rpm. Good point. I should remove the dependency. Try this: rpm -Uvh --nodeps mailscanner*rpm which will just tell it to ignore the dependencies. Don't forget to read the Exim-specific installation instructions on the website (or in the docs that are installed by the rpm). -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From splee at PLEXIO.COM Tue Dec 3 18:54:48 2002 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> Message-ID: <1038941688.30026.105.camel@ralph.plexio.private> On Tue, 2002-12-03 at 10:45, Julian Field wrote: > At 18:37 03/12/2002, you wrote: > >I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 > >system running Exim 3.36. The Perl modules install fine but the > >install.sh scripts stops near the end and complains about a sendmail > >dependency. Am I suppose to adjust something in the install.sh script or > >the mailscanner rpm? My version of Exim originates from source and not > >an rpm. > > Good point. I should remove the dependency. Try this: > rpm -Uvh --nodeps mailscanner*rpm > which will just tell it to ignore the dependencies. > Just did that and no complaints now. However, it appears that the initscript, MailScanner, is specific for sendmail. Is there one for Exim? I had previously hacked one from MS 3.25 to work with Exim. Stephen From mailscanner at ecs.soton.ac.uk Tue Dec 3 18:59:18 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <1038941688.30026.105.camel@ralph.plexio.private> References: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> At 18:54 03/12/2002, you wrote: >On Tue, 2002-12-03 at 10:45, Julian Field wrote: > > At 18:37 03/12/2002, you wrote: > > >I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 > > >system running Exim 3.36. The Perl modules install fine but the > > >install.sh scripts stops near the end and complains about a sendmail > > >dependency. Am I suppose to adjust something in the install.sh script or > > >the mailscanner rpm? My version of Exim originates from source and not > > >an rpm. > > > > Good point. I should remove the dependency. Try this: > > rpm -Uvh --nodeps mailscanner*rpm > > which will just tell it to ignore the dependencies. > > >Just did that and no complaints now. However, it appears that the >initscript, MailScanner, is specific for sendmail. Is there one for >Exim? I had previously hacked one from MS 3.25 to work with Exim. No, sorry, haven't done that bit yet. Your 3.25 one will probably still work with 4.10. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From brian at PORTSMOUTH-COLLEGE.AC.UK Tue Dec 3 19:01:20 2002 From: brian at PORTSMOUTH-COLLEGE.AC.UK (Brian Chivers - ICT Support Officer Portsmouth College) Date: Thu Jan 12 21:16:35 2006 Subject: Updating Sophos References: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <1038941688.30026.105.camel@ralph.plexio.private> Message-ID: <003101c29afe$5daec260$65c8a8c0@portsmouthcollege.ac.uk> Simple question, hopefully !!! Every month I receive an update from Sophos is it a simple matter of just running the install script again that comes with Mailscanner to over write the old version ?? Thanks Brian -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From robibaro at ROBIBARO.COM Tue Dec 3 18:52:47 2002 From: robibaro at ROBIBARO.COM (Eric Robibaro) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> Message-ID: <306122550.1038923567@[10.0.18.4]> just a quick question, I'm not sure if this is possible, but I do know it's how some mail "addons" do it in the debian world... Wouldn't it be possible to seperate the "mta-specific" code in a module, in a seperate rpm, and leave the bulk of mailscanner intact, with no dependancies to a specific mailscanner (I think that may help integration of mailscanner into new mtas: I'm much interested in a courier-addon, but I have limited(that is small, not non existant) time to work on all the issues, if the code was seperate(with an api? does one need an api at this level?), at least I'd know the extent of my task --On December 3, 2002 6:45 PM +0000 Julian Field wrote: > At 18:37 03/12/2002, you wrote: >> I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 >> system running Exim 3.36. The Perl modules install fine but the >> install.sh scripts stops near the end and complains about a sendmail >> dependency. Am I suppose to adjust something in the install.sh script or >> the mailscanner rpm? My version of Exim originates from source and not >> an rpm. > > Good point. I should remove the dependency. Try this: > rpm -Uvh --nodeps mailscanner*rpm > which will just tell it to ignore the dependencies. > > Don't forget to read the Exim-specific installation instructions on the > website (or in the docs that are installed by the rpm). > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Dec 3 19:05:58 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <306122550.1038923567@[10.0.18.4]> References: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021203190332.02bc1880@imap.ecs.soton.ac.uk> We pretty much have that already. There are Exim.pm / EximDiskStore.pm and Sendmail.pm / SMDiskStore.pm. Implementing a new pair for another MTA is a pretty big job and I wouldn't advise it unless you are very happy writing Perl. We plan on implementing support for Postfix next, but there will need to be some cleanups to do on the current interface before that can happen tidily. At 18:52 03/12/2002, you wrote: >Wouldn't it be possible to seperate the "mta-specific" code in a module, in >a seperate rpm, and leave the bulk of mailscanner intact, with no >dependancies to a specific mailscanner (I think that may help integration >of mailscanner into new mtas: I'm much interested in a courier-addon, but I >have limited(that is small, not non existant) time to work on all the >issues, if the code was seperate(with an api? does one need an api at this >level?), at least I'd know the extent of my task > >--On December 3, 2002 6:45 PM +0000 Julian Field > wrote: > >>At 18:37 03/12/2002, you wrote: >>>I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 >>>system running Exim 3.36. The Perl modules install fine but the >>>install.sh scripts stops near the end and complains about a sendmail >>>dependency. Am I suppose to adjust something in the install.sh script or >>>the mailscanner rpm? My version of Exim originates from source and not >>>an rpm. >> >>Good point. I should remove the dependency. Try this: >> rpm -Uvh --nodeps mailscanner*rpm >>which will just tell it to ignore the dependencies. >> >>Don't forget to read the Exim-specific installation instructions on the >>website (or in the docs that are installed by the rpm). >>-- >>Julian Field >>www.MailScanner.info >>MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Dec 3 19:07:34 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Updating Sophos In-Reply-To: <003101c29afe$5daec260$65c8a8c0@portsmouthcollege.ac.uk> References: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <1038941688.30026.105.camel@ralph.plexio.private> Message-ID: <5.2.0.9.2.20021203190613.02bfde30@imap.ecs.soton.ac.uk> At 19:01 03/12/2002, you wrote: >Every month I receive an update from Sophos is it a simple matter of just >running the install script again that comes with Mailscanner to over write >the old version ?? You only need to upgrade every 2 or 3 months, as Sophos keep producing zips of IDE files for the current version and its 2 predecessors. And yes, just run the Sophos.install script again, that's it. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mike at ZANKER.ORG Tue Dec 3 19:51:29 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:16:35 2006 Subject: Local Domains In-Reply-To: <5.2.0.9.2.20021203161435.064d8240@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203161435.064d8240@imap.ecs.soton.ac.uk> Message-ID: <185045701.1038945089@jemima.zanker.org> On 03 December 2002 16:16 +0000 Julian Field wrote: > Set the default for both directions, so I would advise > FromOrTo: default no > instead of your "To: default no" line. I've noticed that the new spam.whitelist.rules has FromTo: default no rather than FromOrTo: default no which the old one had. Is this a syntax change or just another way of saying the same thing? Mike. From jaearick at COLBY.EDU Tue Dec 3 20:00:36 2002 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:16:35 2006 Subject: v4, perl 5.8? Message-ID: Julian, Does MailScanner 4.x work with perl 5.8.0? Can this be noted someplace on the installation webpages? ----------------------------------- Jeff A. Earickson, Ph.D Senior UNIX Sysadmin and Email Guru Information Technology Services Colby College, 4214 Mayflower Hill, Waterville ME, 04901-8842 phone: 207-872-3659 (fax = 3076) ----------------------------------- From mailscanner at ecs.soton.ac.uk Tue Dec 3 20:02:06 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Local Domains In-Reply-To: <185045701.1038945089@jemima.zanker.org> References: <5.2.0.9.2.20021203161435.064d8240@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203161435.064d8240@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021203200119.02c19330@imap.ecs.soton.ac.uk> At 19:51 03/12/2002, you wrote: >On 03 December 2002 16:16 +0000 Julian Field > wrote: > >>Set the default for both directions, so I would advise >> FromOrTo: default no >>instead of your "To: default no" line. > >I've noticed that the new spam.whitelist.rules has > >FromTo: default no > >rather than > >FromOrTo: default no > >which the old one had. Is this a syntax change or just another way of >saying the same thing? They are both equally valid. I should have been more consistent in my examples and docs so this sort of confusion wouldn't occur. Sorry about that. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Dec 3 20:05:31 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: v4, perl 5.8? In-Reply-To: Message-ID: <5.2.0.9.2.20021203200337.01f842d8@imap.ecs.soton.ac.uk> At 20:00 03/12/2002, you wrote: > Does MailScanner 4.x work with perl 5.8.0? Yes. > Can this be >noted someplace on the installation webpages? Good idea. I've added it to install/perl.shtml. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From dot at DOTAT.AT Tue Dec 3 21:23:55 2002 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:16:35 2006 Subject: Criteria for choosing a TNEF decoder Message-ID: <200212032134.gB3LY1v13229@ori.rl.ac.uk> What are the relative plusses and minuses of the C vs. the Perl TNEF decoders? The docs don't provide any clues. Tony. -- f.a.n.finch http://dotat.at/ DOVER WIGHT: VARIABLE 4, BECOMING SOUTHWEST 5 TO 7, VEERING NORTHWEST LATER. RAIN OR SHOWERS. MODERATE OR GOOD. From mailscanner at ecs.soton.ac.uk Tue Dec 3 21:53:48 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Criteria for choosing a TNEF decoder In-Reply-To: <200212032134.gB3LY1v13229@ori.rl.ac.uk> Message-ID: <5.2.0.9.2.20021203215142.02bcf7b0@imap.ecs.soton.ac.uk> At 21:23 03/12/2002, you wrote: >What are the relative plusses and minuses of the C vs. the Perl TNEF >decoders? The docs don't provide any clues. The C one is faster, but other than that it is difficult to say. I have never managed to acquire a decent test set of tnef files. I would go for the C one to start with, and try the perl one if you have problems. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From nerijus at USERS.SOURCEFORGE.NET Tue Dec 3 21:56:32 2002 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:16:35 2006 Subject: Criteria for choosing a TNEF decoder In-Reply-To: <200212032134.gB3LY1v13229@ori.rl.ac.uk> References: <200212032134.gB3LY1v13229@ori.rl.ac.uk> Message-ID: <200212032232.gB3MW2fg013945@mx.ktv.lt> On Tue, 3 Dec 2002 21:23:55 +0000 Tony Finch wrote: > What are the relative plusses and minuses of the C vs. the Perl TNEF > decoders? The docs don't provide any clues. C one didn't compile on AIX 4.2 for me... ;-) Regards, Nerijus From robibaro at ROBIBARO.COM Tue Dec 3 23:44:33 2002 From: robibaro at ROBIBARO.COM (Eric Robibaro) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <5.2.0.9.2.20021203190332.02bc1880@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203190332.02bc1880@imap.ecs.soton.ac.uk> Message-ID: <323628433.1038941073@[10.0.18.4]> Errr you have those modules... but they're not in seperate rpms are they? *hides head in shame at being unclear again* I meant for the rpms to be "mta agnostic" not the program itself(although having seperate perl modules makes the rpms mta agnostic a lot closer to the nice side of possible mind you). From what you said, I'll just take it for granted you are aware of the idea and that you've taken it into consideration :) And I am always happy at writing perl... it's digging into the courier internals that might make me unhappy... :) Specially between client requests... --On December 3, 2002 7:05 PM +0000 Julian Field wrote: > We pretty much have that already. There are Exim.pm / EximDiskStore.pm and > Sendmail.pm / SMDiskStore.pm. Implementing a new pair for another MTA is a > pretty big job and I wouldn't advise it unless you are very happy writing > Perl. We plan on implementing support for Postfix next, but there will > need to be some cleanups to do on the current interface before that can > happen tidily. > > At 18:52 03/12/2002, you wrote: >> Wouldn't it be possible to seperate the "mta-specific" code in a module, >> in a seperate rpm, and leave the bulk of mailscanner intact, with no >> dependancies to a specific mailscanner (I think that may help integration >> of mailscanner into new mtas: I'm much interested in a courier-addon, >> but I have limited(that is small, not non existant) time to work on all >> the issues, if the code was seperate(with an api? does one need an api >> at this level?), at least I'd know the extent of my task >> >> --On December 3, 2002 6:45 PM +0000 Julian Field >> wrote: >> >>> At 18:37 03/12/2002, you wrote: >>>> I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 >>>> system running Exim 3.36. The Perl modules install fine but the >>>> install.sh scripts stops near the end and complains about a sendmail >>>> dependency. Am I suppose to adjust something in the install.sh script >>>> or the mailscanner rpm? My version of Exim originates from source and >>>> not an rpm. >>> >>> Good point. I should remove the dependency. Try this: >>> rpm -Uvh --nodeps mailscanner*rpm >>> which will just tell it to ignore the dependencies. >>> >>> Don't forget to read the Exim-specific installation instructions on the >>> website (or in the docs that are installed by the rpm). >>> -- >>> Julian Field >>> www.MailScanner.info >>> MailScanner thanks transtec Computers for their support > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support From splee at PLEXIO.COM Wed Dec 4 00:15:06 2002 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> Message-ID: <1038960906.30026.125.camel@ralph.plexio.private> On Tue, 2002-12-03 at 10:59, Julian Field wrote: > At 18:54 03/12/2002, you wrote: > >On Tue, 2002-12-03 at 10:45, Julian Field wrote: > > > At 18:37 03/12/2002, you wrote: > > > >I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 > > > >system running Exim 3.36. The Perl modules install fine but the > > > >install.sh scripts stops near the end and complains about a sendmail > > > >dependency. Am I suppose to adjust something in the install.sh script or > > > >the mailscanner rpm? My version of Exim originates from source and not > > > >an rpm. > > > > > > Good point. I should remove the dependency. Try this: > > > rpm -Uvh --nodeps mailscanner*rpm > > > which will just tell it to ignore the dependencies. > > > > >Just did that and no complaints now. However, it appears that the > >initscript, MailScanner, is specific for sendmail. Is there one for > >Exim? I had previously hacked one from MS 3.25 to work with Exim. > > No, sorry, haven't done that bit yet. Your 3.25 one will probably still > work with 4.10. The problem I'm having now is that when I start check_MailScanner I get: Starting virus scanner... Cannot open config file /etc/MailScanner/MailScanner.conf, Permission denied at /usr/lib/MailScanner/MailScanner/Config.pm line 294. MailScanner is run as exim.exim and the permissions for the 2 files are: -rw-r--r-- 1 root root 33577 Dec 3 13:44 MailScanner.conf and -rw-r--r-- 1 root root 49216 Dec 3 01:41 /usr/lib/MailScanner/MailScanner/Config.pm In MS V3xx, this was sufficient permission for MailScanner.conf. Where else should I look? Thanks, Stephen From P.G.M.Peters at civ.utwente.nl Wed Dec 4 08:02:48 2002 From: P.G.M.Peters at civ.utwente.nl (Peter Peters) Date: Thu Jan 12 21:16:35 2006 Subject: problems with starting mailscanner Message-ID: <99druuokotgdtt63pfv22a8qp3fuconmik@4ax.com> On my new system I keep having problems with starting MS (4.05-3) on a Redhat Advanced Server. The first time I start (or restart) MS it dies on me with messages like "can't write header /var/spool/MailScanner/incoming// I've got another problem. SA (2.31) this time. I keep getting messages like: "SpamAssassin timed out and was killed, consecutive failure 252 of 20" I believe it should stop at "20 of 20". When I check the PID's of the MS processes showing this message it seems that only one of the childs starts (and runs) SA correctly. When I configure MS to use SA within a short period of time my incoming queue grows beyond anything MS can handle. I had to manually move the files from queue.in to queue (ofcourse after stopping MS). I have another problem with SA (unrelated to MS). When I start spamassassin and input some text I don't get any response. -- Peter Peters senior netwerkbeheerder, Centrum voor Informatievoorziening, Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: +31 53 489 2301, fax:+31 53 489 2383, http://www.utwente.nl/civ From jonas at ODENSE.KOLLEGIENET.DK Wed Dec 4 09:17:34 2002 From: jonas at ODENSE.KOLLEGIENET.DK (Jonas Bardino) Date: Thu Jan 12 21:16:35 2006 Subject: V4 & Exim References: Message-ID: <3DEDC82E.9010200@odense.kollegienet.dk> Nick Phillips wrote: > On Wednesday, December 4, 2002, at 12:33 am, Matthias Klose wrote: >> ok, what's the status now that exim support is in ;-) > > > The status is that I'm waiting to hear how it goes for people... the > next two things on my list are to make all the make stuff more > portable, and to package it for Debian. > > > Cheers, > > > Nick Great work, Julian and Nick! Still running V3 with Exim on a Debian box. Hopefully it won't be long before I can find the time to install and test V4 from source. I'm still looking forward to the new Debian package, though. Cheers, Jonas From mailscanner at ecs.soton.ac.uk Wed Dec 4 10:29:48 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: problems with starting mailscanner In-Reply-To: <99druuokotgdtt63pfv22a8qp3fuconmik@4ax.com> Message-ID: <5.2.0.9.2.20021204102837.020266d8@imap.ecs.soton.ac.uk> Does it depend on what directory you are in when you start it, or anything strange like this? I've never used RHAS, but I can't understand why it would work some times and not others. At 08:02 04/12/2002, you wrote: >On my new system I keep having problems with starting MS (4.05-3) on a >Redhat Advanced Server. > >The first time I start (or restart) MS it dies on me with messages like >"can't write header /var/spool/MailScanner/incoming//queueID" > >When I restart MS after that it runs OK and it starts a number of childs >without any problem. When I restart MS after a while the problem >returns. > >-- >Peter Peters >senior netwerkbeheerder, Centrum voor Informatievoorziening, >Universiteit Twente, Postbus 217, 7500 AE Enschede >telefoon: +31 53 489 2301, fax:+31 53 489 2383, http://www.utwente.nl/civ -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Dec 4 10:27:33 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <1038960906.30026.125.camel@ralph.plexio.private> References: <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021204102403.02018050@imap.ecs.soton.ac.uk> At 00:15 04/12/2002, you wrote: >On Tue, 2002-12-03 at 10:59, Julian Field wrote: > > At 18:54 03/12/2002, you wrote: > > >On Tue, 2002-12-03 at 10:45, Julian Field wrote: > > > > At 18:37 03/12/2002, you wrote: > > > > >I just tried to install the Redhat version of MS 4.10-1 on a Redhat7.3 > > > > >system running Exim 3.36. The Perl modules install fine but the > > > > >install.sh scripts stops near the end and complains about a sendmail > > > > >dependency. Am I suppose to adjust something in the install.sh > script or > > > > >the mailscanner rpm? My version of Exim originates from source and not > > > > >an rpm. > > > > > > > > Good point. I should remove the dependency. Try this: > > > > rpm -Uvh --nodeps mailscanner*rpm > > > > which will just tell it to ignore the dependencies. > > > > > > >Just did that and no complaints now. However, it appears that the > > >initscript, MailScanner, is specific for sendmail. Is there one for > > >Exim? I had previously hacked one from MS 3.25 to work with Exim. > > > > No, sorry, haven't done that bit yet. Your 3.25 one will probably still > > work with 4.10. > >The problem I'm having now is that when I start check_MailScanner I get: > >Starting virus scanner... >Cannot open config file /etc/MailScanner/MailScanner.conf, Permission >denied at /usr/lib/MailScanner/MailScanner/Config.pm line 294. > >MailScanner is run as exim.exim and the permissions for the 2 files are: > >-rw-r--r-- 1 root root 33577 Dec 3 13:44 MailScanner.conf > >and > >-rw-r--r-- 1 root root 49216 Dec 3 01:41 >/usr/lib/MailScanner/MailScanner/Config.pm > >In MS V3xx, this was sufficient permission for MailScanner.conf. Where >else should I look? You will need to make the config files owned by (or at least writable by) exim.exim. MailScanner needs to place an exclusive lock on each of the config files, so that you can have another script (possibly linked to a web-based configuration system) can update the config files while MailScanner is running, safe in the knowledge that you can't be half-way through writing a config file at the same time as MailScanner is reading it. In order to get an exclusive lock on a file, the file must be opened for writing. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Janssen at RZ.UNI-FRANKFURT.DE Wed Dec 4 10:57:03 2002 From: Janssen at RZ.UNI-FRANKFURT.DE (Michael Janssen) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: <1038960906.30026.125.camel@ralph.plexio.private> Message-ID: Hello, I've got the same (on debian with tar-distrib and exim). chown the conf-file to MailScanner user and group has helped. regards Michael On Tue, 3 Dec 2002, Stephen Lee wrote: > The problem I'm having now is that when I start check_MailScanner I get: > > Starting virus scanner... > Cannot open config file /etc/MailScanner/MailScanner.conf, Permission > denied at /usr/lib/MailScanner/MailScanner/Config.pm line 294. > > MailScanner is run as exim.exim and the permissions for the 2 files are: > > -rw-r--r-- 1 root root 33577 Dec 3 13:44 MailScanner.conf > > and > > -rw-r--r-- 1 root root 49216 Dec 3 01:41 > /usr/lib/MailScanner/MailScanner/Config.pm > > In MS V3xx, this was sufficient permission for MailScanner.conf. Where > else should I look? > > Thanks, > Stephen > From mailscanner at ecs.soton.ac.uk Wed Dec 4 11:36:32 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: References: <1038960906.30026.125.camel@ralph.plexio.private> Message-ID: <5.2.0.9.2.20021204113540.0204c208@imap.ecs.soton.ac.uk> I guess it would be better if I used a temporary lockfile for this, rather than locking each config file in turn. I forgot about the Exim requirements when I wrote that bit. At 10:57 04/12/2002, you wrote: >Hello, > >I've got the same (on debian with tar-distrib and exim). chown the >conf-file to MailScanner user and group has helped. > >regards >Michael > >On Tue, 3 Dec 2002, Stephen Lee wrote: > > > The problem I'm having now is that when I start check_MailScanner I get: > > > > Starting virus scanner... > > Cannot open config file /etc/MailScanner/MailScanner.conf, Permission > > denied at /usr/lib/MailScanner/MailScanner/Config.pm line 294. > > > > MailScanner is run as exim.exim and the permissions for the 2 files are: > > > > -rw-r--r-- 1 root root 33577 Dec 3 13:44 MailScanner.conf > > > > and > > > > -rw-r--r-- 1 root root 49216 Dec 3 01:41 > > /usr/lib/MailScanner/MailScanner/Config.pm > > > > In MS V3xx, this was sufficient permission for MailScanner.conf. Where > > else should I look? > > > > Thanks, > > Stephen > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From paul_houselander at BRISTOL-LEA.ORG.UK Wed Dec 4 11:43:17 2002 From: paul_houselander at BRISTOL-LEA.ORG.UK (Paul Houselander) Date: Thu Jan 12 21:16:35 2006 Subject: default to rulesets Message-ID: <005601c29b8a$56ec15e0$7b10140a@education.bcc.lan> Does mailscanner read a rulset file from top to bottom or will it stop at the first match? in which case does a default entry need to appear at the bottom of the file e.g. From: test@abc.co.uk yes From: default no From: *@xyz.co.uk yes Will the xyz.co.uk apply? Thanks Paul -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mailscanner at ecs.soton.ac.uk Wed Dec 4 11:50:32 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:35 2006 Subject: default to rulesets In-Reply-To: <005601c29b8a$56ec15e0$7b10140a@education.bcc.lan> Message-ID: <5.2.0.9.2.20021204114808.01fb0e60@imap.ecs.soton.ac.uk> At 11:43 04/12/2002, you wrote: >Does mailscanner read a rulset file from top to bottom or will it stop at >the first match? It depends on the variable affected by the ruleset. Most are "use first match" rulesets. A few that need to be are "concatenate all matches" (such as where to archive mail, spam actions list, where to send postmaster notices, things like that). > in which case does a default entry need to appear at the >bottom of the file e.g. > >From: test@abc.co.uk yes >From: default no >From: *@xyz.co.uk yes > >Will the xyz.co.uk apply? The "default" value is always read by the ruleset compiler, so it doesn't matter where it appears. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From gerry at dorfam.ca Tue Dec 3 21:06:34 2002 From: gerry at dorfam.ca (Gerry Doris) Date: Thu Jan 12 21:16:35 2006 Subject: New O'Reilly Bat Book Message-ID: <62974.129.80.22.133.1038949594.squirrel@tiger.dorfam.ca> I thought I'd mention to the group since most here are likely interested...O'Reilly are about to ship an updated Sendmail book (commonly called the Bat book). It is supposed to begin shipping later this month. Gerry From dot at DOTAT.AT Wed Dec 4 14:39:47 2002 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:16:35 2006 Subject: Exim support in 4.10-1 In-Reply-To: References: <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <1038960906.30026.125.camel@ralph.plexio.private> Message-ID: Julian Field wrote: > >You will need to make the config files owned by (or at least writable by) >exim.exim. That seems very foolish from a security point of view. >MailScanner needs to place an exclusive lock on each of the config files, >so that you can have another script (possibly linked to a web-based >configuration system) can update the config files while MailScanner is >running, safe in the knowledge that you can't be half-way through writing a >config file at the same time as MailScanner is reading it. It sounds like MailScanner has a rather broken approach to handling its configuration file. What sysadmins expect is that a daemon will slurp the file when it starts and when it is HUPped rather than reading piecemeal. Since perl file locks are advisory they won't prevent the admin from shooting themselves in the foot by incorrectly assuming that MailScanner does that too. Even if you don't change MailScanner to slurp its configuration, please remove the locking code and instead require admins to use mv to update the configuration file atomically. Tony. -- f.a.n.finch http://dotat.at/ WHITBY TO THE WASH: SOUTH 4 OR 5 VEERING WEST TO NORTHWEST 4, LATER NORTHWEST TO NORTH 5 OR 6, PERHAPS 6 OR 7 FOR A TIME. RAIN FOR A TIME THEN MAINLY FAIR LATER. GOOD OCCASIONALLY MODERATE. SLIGHT TO MODERATE. From Stephen.Dawes at GOV.CALGARY.AB.CA Wed Dec 4 14:53:47 2002 From: Stephen.Dawes at GOV.CALGARY.AB.CA (Dawes, Stephen) Date: Thu Jan 12 21:16:35 2006 Subject: Problem getting MailScanner 4.10 - New Release started: Message-ID: I am having a problem getting the latest release of MailScanner up and running. My system is running RedHat 8.0, and included in it is sendmail-8.12.5. Here is what I get when I try to start MailScanner. [root@Panther root]# cd / [root@Panther /]# service MailScanner start Starting MailScanner daemons: incoming sendmail: [ OK ] outgoing sendmail: [ OK ] MailScanner: Can't locate MIME/Parser.pm in @INC (@INC contains: /usr/lib/MailScanner /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . /usr/lib/MailScanner) at /usr/lib/MailScanner/MailScanner/Message.pm line 39. BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/Message.pm line 39. Compilation failed in require at /usr/sbin/MailScanner line 46. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 46. [ OK ] [root@Panther /]# What am I doing wrong here? Steve Dawes PH: (403) 268-5527. Mailto: sdawes@calgary.ca NOTICE:: This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation. From Jan-Peter.Koopmann at SECEIDOS.DE Wed Dec 4 15:25:41 2002 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:16:35 2006 Subject: Problem getting MailScanner 4.10 - New Release started: Message-ID: <4E7026FF8A422749B1553FE508E0068007EBC5@message.intern.akctech.de> Hi, I had the same problem. Easiest solution: Change the init-skript and/or check_mailscanner script and change the directory to the mailscanner/bin before starting MailScanner. Regards, JP > -----Original Message----- > From: Dawes, Stephen [mailto:Stephen.Dawes@GOV.CALGARY.AB.CA] > Sent: Wednesday, December 04, 2002 3:54 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Problem getting MailScanner 4.10 - New Release started: > > > I am having a problem getting the latest release of > MailScanner up and running. > > My system is running RedHat 8.0, and included in it is > sendmail-8.12.5. > > Here is what I get when I try to start MailScanner. > > [root@Panther root]# cd / > [root@Panther /]# service MailScanner start > Starting MailScanner daemons: > incoming sendmail: [ OK ] > outgoing sendmail: [ OK ] > MailScanner: Can't locate MIME/Parser.pm in > @INC (@INC contains: /usr/lib/MailScanner > /usr/lib/perl5/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/5.8.0 > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . > /usr/lib/MailScanner) at > /usr/lib/MailScanner/MailScanner/Message.pm line 39. > BEGIN failed--compilation aborted at > /usr/lib/MailScanner/MailScanner/Message.pm line 39. > Compilation failed in require at /usr/sbin/MailScanner line > 46. BEGIN failed--compilation aborted at > /usr/sbin/MailScanner line 46. [ OK ] [root@Panther /]# > > What am I doing wrong here? > > Steve Dawes > PH: (403) 268-5527. > Mailto: sdawes@calgary.ca > > > > NOTICE:: > This communication is intended ONLY for the use of the person > or entity named above and may contain information that is > confidential or legally privileged. If you are not the > intended recipient named above or a person responsible for > delivering messages or communications to the intended > recipient, YOU ARE HEREBY NOTIFIED that any use, > distribution, or copying of this communication or any of the > information contained in it is strictly prohibited. If you > have received this communication in error, please notify us > immediately by telephone and then destroy or delete this > communication, or return it to us by mail if requested by us. > The City of Calgary thanks you for your attention and cooperation. > From sylvain.phaneuf at IMSU.OXFORD.AC.UK Wed Dec 4 15:20:15 2002 From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf) Date: Thu Jan 12 21:16:35 2006 Subject: $filename in reports Message-ID: I am new to MailScanner and I wonder if it is possible to had the variable $filename (e.g. blocked attachment) into the message sent to the sender. I have tried to add it in the sender.filename.report.txt but I get /opt/MailScanner/etc/reports/en/sender.filename.report.txt instead of the filename. I would like to get something like: " One or more of the attachments have not been delivered (dangerous.bat) " but I get " One or more of the attachments have not been delivered (/opt/MailScanner/etc/reports/en/sender.filename.report.txt ) " Thanks in advance, Sylvain =========================================================== Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 Information Management Services Unit (Clinical School) Oxford University | email : sylvain.phaneuf@imsu.ox.ac.uk Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 Oxford OX3 9DU England =========================================================== From sysadmin at DMS.UMONTREAL.CA Wed Dec 4 15:34:02 2002 From: sysadmin at DMS.UMONTREAL.CA (Administrateur Systeme) Date: Thu Jan 12 21:16:35 2006 Subject: Daily batched versions of the list Message-ID: <3DEE206A.3080107@DMS.UMontreal.CA> Would it be possible to just receive the list in a daily batch? -- -------------------------------------------------------------------- Christopher Albert Responsable des services informatiques Departement de mathematiques et de statistique Universite de Montreal bureau 6188, Pavillon Andre-Aisenstadt Tel: (514) 343-2281 Fax: (514) 343-5700 -------------------------------------------------------------------- From mailscanner at ecs.soton.ac.uk Wed Dec 4 15:30:36 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:36 2006 Subject: Problem getting MailScanner 4.10 - New Release started: In-Reply-To: Message-ID: <5.2.0.9.2.20021204153014.0a60b850@imap.ecs.soton.ac.uk> Assuming you ran the "install.sh" script, it appears to have not installed the perl-MIME-tools correctly. At 14:53 04/12/2002, you wrote: >I am having a problem getting the latest release of MailScanner up and >running. > >My system is running RedHat 8.0, and included in it is sendmail-8.12.5. > >Here is what I get when I try to start MailScanner. > >[root@Panther root]# cd / >[root@Panther /]# service MailScanner start >Starting MailScanner daemons: > incoming sendmail: [ OK ] > outgoing sendmail: [ OK ] > MailScanner: Can't locate MIME/Parser.pm in @INC (@INC > contains: /usr/lib/MailScanner > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . > /usr/lib/MailScanner) at /usr/lib/MailScanner/MailScanner/Message.pm line 39. >BEGIN failed--compilation aborted at >/usr/lib/MailScanner/MailScanner/Message.pm line 39. >Compilation failed in require at /usr/sbin/MailScanner line 46. >BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 46. >[ OK ] >[root@Panther /]# > >What am I doing wrong here? > >Steve Dawes >PH: (403) 268-5527. >Mailto: sdawes@calgary.ca > > > >NOTICE:: >This communication is intended ONLY for the use of the person or entity >named above and may contain information that is confidential or legally >privileged. If you are not the intended recipient named above or a person >responsible for delivering messages or communications to the intended >recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying >of this communication or any of the information contained in it is >strictly prohibited. If you have received this communication in error, >please notify us immediately by telephone and then destroy or delete this >communication, or return it to us by mail if requested by us. The City of >Calgary thanks you for your attention and cooperation. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Dec 4 15:29:32 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:36 2006 Subject: Exim support in 4.10-1 In-Reply-To: References: <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <1038960906.30026.125.camel@ralph.plexio.private> Message-ID: <5.2.0.9.2.20021204152334.0a67feb0@imap.ecs.soton.ac.uk> At 14:39 04/12/2002, you wrote: > >MailScanner needs to place an exclusive lock on each of the config files, > >so that you can have another script (possibly linked to a web-based > >configuration system) can update the config files while MailScanner is > >running, safe in the knowledge that you can't be half-way through writing a > >config file at the same time as MailScanner is reading it. > >It sounds like MailScanner has a rather broken approach to handling its >configuration file. Sorry, but it doesn't do what you describe. > What sysadmins expect is that a daemon will slurp the >file when it starts and when it is HUPped rather than reading piecemeal. It does slurps the files in at 1 go when it starts. However, because each of the child processes is programmed to die after a few hours, MailScanner may actually read a configuration file at any time, not just when you HUP it. >Since perl file locks are advisory they won't prevent the admin from >shooting themselves in the foot by incorrectly assuming that MailScanner >does that too. > >Even if you don't change MailScanner to slurp its configuration, I don't need to. > please >remove the locking code and instead require admins to use mv to update >the configuration file atomically. I was trying to save sysadmins (who didn't know as much as you do) from some problems they might hit, as they can just copy the locking code out of any of the autoupdate scripts and it will give them a safety net. However, if you prefer to have enough rope to hang yourself, that's fine by me. I will change it for the next version if other people don't want the file locking either. In the mean time, if you really don't want it doing any file locking of its configuration files, simply comment out all the "flock" calls in Config.pm. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From thomas_duvally at BROWN.EDU Wed Dec 4 16:01:44 2002 From: thomas_duvally at BROWN.EDU (Thomas DuVally) Date: Thu Jan 12 21:16:36 2006 Subject: Hacked in virus scanner, now it won't clean Message-ID: <1039017704.21833.25.camel@croithine> I may not understand some of the options in v4, so bare with me: I've looked into the archives and found no real help on this one, so here's my problem. I've added support for Symantec Carrier Scanner, which is working great in 3.22-14 in production (200K messages per day) I've gotten 4.10-1 patched and it DOES scan, but the infected messages still get delivered. Here is what the log shows: mailscanner[5744]: New Batch: Scanning 1 messages, 121180 bytes mailscanner[5744]: Spam Checks: Starting mailscanner[5744]: Virus and Content Scanning: Starting mailscanner[5744]: Infected: /MailScanner/venus/spool/incoming/5744/gB4Fel205792/install.exe mailscanner[5744]: Info: W32.Klez.H@mm mailscanner[5744]: Virus Scanning: symcmd found 1 infections mailscanner[5744]: Virus Scanning: Found 1 viruses mailscanner[5744]: Uninfected: Delivered 1 messages It looks like mailscanner did recognize that the virus scanner (called symcmd here) found a virus, but the last line seems to show it regards it uninfected and sends it along as such. The received messages has the infected file attached and mailscanner has tagged the messages as "Found to be clean". If this is a simple conf file issue, I'll feel stupid, but thankful. -- Thomas J. DuVally Lead Systems Prog. CIS, Brown Univ. From Stephen.Dawes at GOV.CALGARY.AB.CA Wed Dec 4 16:01:53 2002 From: Stephen.Dawes at GOV.CALGARY.AB.CA (Dawes, Stephen) Date: Thu Jan 12 21:16:36 2006 Subject: Problem getting MailScanner 4.10 - New Release started: Message-ID: Yes, I ran the install.sh script. In fact, the first time I did, it was suggested that I run Update-MakeMaker.sh, to which I did. After it successfully completed, I ran the install.sh script for a second time, and did the 4 instructions that are listed on the screen at the completion of the script. I then made the necessary changes to MailScanner.conf, and then did the service MailScanner Start, to which you see the output below. Steve Dawes PH: (403) 268-5527. Mailto: sdawes@calgary.ca NOTICE:: This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation. > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: 2002 December 04 8:31 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Problem getting MailScanner 4.10 - New Release started: > > > Assuming you ran the "install.sh" script, it appears to have > not installed > the perl-MIME-tools correctly. > > At 14:53 04/12/2002, you wrote: > >I am having a problem getting the latest release of > MailScanner up and > >running. > > > >My system is running RedHat 8.0, and included in it is > sendmail-8.12.5. > > > >Here is what I get when I try to start MailScanner. > > > >[root@Panther root]# cd / > >[root@Panther /]# service MailScanner start > >Starting MailScanner daemons: > > incoming sendmail: [ OK ] > > outgoing sendmail: [ OK ] > > MailScanner: Can't locate MIME/Parser.pm in > @INC (@INC > > contains: /usr/lib/MailScanner > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . > > /usr/lib/MailScanner) at > /usr/lib/MailScanner/MailScanner/Message.pm line 39. > >BEGIN failed--compilation aborted at > >/usr/lib/MailScanner/MailScanner/Message.pm line 39. > >Compilation failed in require at /usr/sbin/MailScanner line 46. > >BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 46. > >[ OK ] > >[root@Panther /]# > > > >What am I doing wrong here? > > > >Steve Dawes > >PH: (403) 268-5527. > >Mailto: sdawes@calgary.ca > > > > > > > >NOTICE:: > >This communication is intended ONLY for the use of the > person or entity > >named above and may contain information that is confidential > or legally > >privileged. If you are not the intended recipient named > above or a person > >responsible for delivering messages or communications to the intended > >recipient, YOU ARE HEREBY NOTIFIED that any use, > distribution, or copying > >of this communication or any of the information contained in it is > >strictly prohibited. If you have received this communication > in error, > >please notify us immediately by telephone and then destroy > or delete this > >communication, or return it to us by mail if requested by > us. The City of > >Calgary thanks you for your attention and cooperation. > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > From splee at PLEXIO.COM Wed Dec 4 16:05:34 2002 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:16:36 2006 Subject: Exim support in 4.10-1 In-Reply-To: <5.2.0.9.2.20021204152334.0a67feb0@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <1038960906.30026.125.camel@ralph.plexio.private> <5.2.0.9.2.20021204152334.0a67feb0@imap.ecs.soton.ac.uk> Message-ID: <1039017934.30551.187.camel@ralph.plexio.private> On Wed, 2002-12-04 at 07:29, Julian Field wrote: > I will change it for the next version if other people don't want the file > locking either. In the mean time, if you really don't want it doing any > file locking of its configuration files, simply comment out all the "flock" > calls in Config.pm. After changing all files in /etc/MailScanner to exim.exim MS starts and works fine now. It's interesting that syslog output shows the following: Dec 4 08:42:11 QCTO MailScanner[7500]: MailScanner Dec 4 08:42:11 QCTO MailScanner[7500]: MailScanner E-Mail Virus Scanner version 4.10-1 starting... Dec 4 08:42:11 QCTO MailScanner[7500]: Using locktype = posix Dec 4 08:42:11 QCTO MailScanner[7500]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Dec 4 08:42:21 QCTO MailScanner[7501]: MailScanner Dec 4 08:42:21 QCTO MailScanner[7501]: MailScanner E-Mail Virus Scanner version 4.10-1 starting... Dec 4 08:42:21 QCTO MailScanner[7501]: Using locktype = posix Dec 4 08:42:21 QCTO MailScanner[7501]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Dec 4 08:42:31 QCTO MailScanner[7502]: MailScanner Dec 4 08:42:31 QCTO MailScanner[7502]: MailScanner E-Mail Virus Scanner version 4.10-1 starting... Dec 4 08:42:31 QCTO MailScanner[7502]: Using locktype = posix Dec 4 08:42:31 QCTO MailScanner[7502]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Dec 4 08:42:41 QCTO MailScanner[7503]: MailScanner Dec 4 08:42:41 QCTO MailScanner[7503]: MailScanner E-Mail Virus Scanner version 4.10-1 starting... Dec 4 08:42:41 QCTO MailScanner[7503]: Using locktype = posix Dec 4 08:42:41 QCTO MailScanner[7503]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Do each of the struct_flock above correspond to a config file in /etc/Mailscanner? Thanks for all your help (and MS of course)! Stephen From nerijus at USERS.SOURCEFORGE.NET Wed Dec 4 16:17:58 2002 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:16:36 2006 Subject: Exim support in 4.10-1 In-Reply-To: <1039017934.30551.187.camel@ralph.plexio.private> References: <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk><5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk><5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk><5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk><1038960906.30026.125.camel@ralph.plexio.private><5.2.0.9.2.20021204152334.0a67feb0@imap.ecs.soton.ac.uk> <1039017934.30551.187.camel@ralph.plexio.private> Message-ID: <200212041618.gB4GI3fg008542@mx.ktv.lt> On Wed, 4 Dec 2002 08:05:34 -0800 Stephen Lee wrote: > Dec 4 08:42:31 QCTO MailScanner[7502]: MailScanner > Dec 4 08:42:31 QCTO MailScanner[7502]: MailScanner E-Mail Virus Scanner > version 4.10-1 starting... > Dec 4 08:42:31 QCTO MailScanner[7502]: Using locktype = posix > Dec 4 08:42:31 QCTO MailScanner[7502]: Creating hardcoded struct_flock > subroutine for linux (Linux-type) > Dec 4 08:42:41 QCTO MailScanner[7503]: MailScanner > Dec 4 08:42:41 QCTO MailScanner[7503]: MailScanner E-Mail Virus Scanner > version 4.10-1 starting... > Dec 4 08:42:41 QCTO MailScanner[7503]: Using locktype = posix > Dec 4 08:42:41 QCTO MailScanner[7503]: Creating hardcoded struct_flock > subroutine for linux (Linux-type) > > Do each of the struct_flock above correspond to a config file in > /etc/Mailscanner? That's just different MS processes (children) - 7502, 7503... Regards, Nerijus From mailscanner at ecs.soton.ac.uk Wed Dec 4 16:17:57 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:36 2006 Subject: Hacked in virus scanner, now it won't clean In-Reply-To: <1039017704.21833.25.camel@croithine> Message-ID: <5.2.0.9.2.20021204161728.03db9e90@imap.ecs.soton.ac.uk> My guess would be that's it not extracting the infected filename out of the virus scanner report properly. At 16:01 04/12/2002, you wrote: >I may not understand some of the options in v4, so bare with me: > >I've looked into the archives and found no real help on this one, so >here's my problem. > >I've added support for Symantec Carrier Scanner, which is working great >in 3.22-14 in production (200K messages per day) > >I've gotten 4.10-1 patched and it DOES scan, but the infected messages >still get delivered. Here is what the log shows: > > >mailscanner[5744]: New Batch: Scanning 1 messages, 121180 bytes >mailscanner[5744]: Spam Checks: Starting >mailscanner[5744]: Virus and Content Scanning: Starting >mailscanner[5744]: Infected: >/MailScanner/venus/spool/incoming/5744/gB4Fel205792/install.exe >mailscanner[5744]: Info: W32.Klez.H@mm >mailscanner[5744]: Virus Scanning: symcmd found 1 infections >mailscanner[5744]: Virus Scanning: Found 1 viruses >mailscanner[5744]: Uninfected: Delivered 1 messages > >It looks like mailscanner did recognize that the virus scanner (called >symcmd here) found a virus, but the last line seems to show it regards >it uninfected and sends it along as such. > >The received messages has the infected file attached and mailscanner has >tagged the messages as "Found to be clean". > >If this is a simple conf file issue, I'll feel stupid, but thankful. > > >-- >Thomas J. DuVally >Lead Systems Prog. >CIS, Brown Univ. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Dec 4 16:20:13 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:36 2006 Subject: Exim support in 4.10-1 In-Reply-To: <1039017934.30551.187.camel@ralph.plexio.private> References: <5.2.0.9.2.20021204152334.0a67feb0@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203184312.02bf9a08@imap.ecs.soton.ac.uk> <5.2.0.9.2.20021203185824.02c0bf50@imap.ecs.soton.ac.uk> <1038960906.30026.125.camel@ralph.plexio.private> <5.2.0.9.2.20021204152334.0a67feb0@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20021204161919.0a673c40@imap.ecs.soton.ac.uk> At 16:05 04/12/2002, you wrote: >On Wed, 2002-12-04 at 07:29, Julian Field wrote: > > I will change it for the next version if other people don't want the file > > locking either. In the mean time, if you really don't want it doing any > > file locking of its configuration files, simply comment out all the "flock" > > calls in Config.pm. > >After changing all files in /etc/MailScanner to exim.exim MS starts and >works fine now. It's interesting that syslog output shows the following: > >Dec 4 08:42:11 QCTO MailScanner[7500]: MailScanner >Dec 4 08:42:11 QCTO MailScanner[7500]: MailScanner E-Mail Virus Scanner >version 4.10-1 starting... >Dec 4 08:42:11 QCTO MailScanner[7500]: Using locktype = posix >Dec 4 08:42:11 QCTO MailScanner[7500]: Creating hardcoded struct_flock >subroutine for linux (Linux-type) > >Do each of the struct_flock above correspond to a config file in >/etc/Mailscanner? They each correspond to 1 child process starting up and initialising itself. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Dec 4 16:16:56 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:36 2006 Subject: $filename in reports In-Reply-To: Message-ID: <5.2.0.9.2.20021204161611.0a675008@imap.ecs.soton.ac.uk> Here is a patch to Message.pm which should do what you want. It will be included in the next release. At 15:20 04/12/2002, you wrote: >I am new to MailScanner and I wonder if it is possible to had the variable >$filename (e.g. blocked attachment) into the message sent to the sender. > >I have tried to add it in the sender.filename.report.txt but I get >/opt/MailScanner/etc/reports/en/sender.filename.report.txt instead of the >filename. > >I would like to get something like: " One or more of the attachments have >not been delivered (dangerous.bat) " > >but I get > >" One or more of the attachments have not been delivered >(/opt/MailScanner/etc/reports/en/sender.filename.report.txt ) " > >Thanks in advance, > > >Sylvain > >=========================================================== >Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 >Information Management Services Unit (Clinical School) >Oxford University | email : >sylvain.phaneuf@imsu.ox.ac.uk >Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 >Oxford OX3 9DU England >=========================================================== -------------- next part -------------- A non-text attachment was scrubbed... Name: Message.pm.patch Type: application/octet-stream Size: 2278 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20021204/88f95abd/Message.pm.obj -------------- next part -------------- -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Dec 4 16:19:02 2002 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:16:36 2006 Subject: Problem getting MailScanner 4.10 - New Release started: In-Reply-To: Message-ID: <5.2.0.9.2.20021204161827.038b0908@imap.ecs.soton.ac.uk> Do locate Parser.pm and see where it finds it. If it doesn't report anything, then find /usr -name '*Parser.pm*' -print should find it. At 16:01 04/12/2002, you wrote: >Yes, I ran the install.sh script. >In fact, the first time I did, it was suggested that I run >Update-MakeMaker.sh, to which I did. >After it successfully completed, I ran the install.sh script for a >second time, and did the 4 instructions that are listed on the screen at >the completion of the script. >I then made the necessary changes to MailScanner.conf, and then did the >service MailScanner Start, to which you see the output below. > > >Steve Dawes >PH: (403) 268-5527. >Mailto: sdawes@calgary.ca > > > > >NOTICE:: >This communication is intended ONLY for the use of the person or entity >named above and may contain information that is confidential or legally >privileged. If you are not the intended recipient named above or a person >responsible for delivering messages or communications to the intended >recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying >of this communication or any of the information contained in it is >strictly prohibited. If you have received this communication in error, >please notify us immediately by telephone and then destroy or delete this >communication, or return it to us by mail if requested by us. The City of >Calgary thanks you for your attention and cooperation. > > > -----Original Message----- > > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > > Sent: 2002 December 04 8:31 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Problem getting MailScanner 4.10 - New Release started: > > > > > > Assuming you ran the "install.sh" script, it appears to have > > not installed > > the perl-MIME-tools correctly. > > > > At 14:53 04/12/2002, you wrote: > > >I am having a problem getting the latest release of > > MailScanner up and > > >running. > > > > > >My system is running RedHat 8.0, and included in it is > > sendmail-8.12.5. > > > > > >Here is what I get when I try to start MailScanner. > > > > > >[root@Panther root]# cd / > > >[root@Panther /]# service MailScanner start > > >Starting MailScanner daemons: > > > incoming sendmail: [ OK ] > > > outgoing sendmail: [ OK ] > > > MailScanner: Can't locate MIME/Parser.pm in > > @INC (@INC > > > contains: /usr/lib/MailScanner > > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 > > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi > > > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl > > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi > > > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . > > > /usr/lib/MailScanner) at > > /usr/lib/MailScanner/MailScanner/Message.pm line 39. > > >BEGIN failed--compilation aborted at > > >/usr/lib/MailScanner/MailScanner/Message.pm line 39. > > >Compilation failed in require at /usr/sbin/MailScanner line 46. > > >BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 46. > > >[ OK ] > > >[root@Panther /]# > > > > > >What am I doing wrong here? > > > > > >Steve Dawes > > >PH: (403) 268-5527. > > >Mailto: sdawes@calgary.ca > > > > > > > > > > > >NOTICE:: > > >This communication is intended ONLY for the use of the > > person or entity > > >named above and may contain information that is confidential > > or legally > > >privileged. If you are not the intended recipient named > > above or a person > > >responsible for delivering messages or communications to the intended > > >recipient, YOU ARE HEREBY NOTIFIED that any use, > > distribution, or copying > > >of this communication or any of the information contained in it is > > >strictly prohibited. If you have received this communication > > in error, > > >please notify us immediately by telephone and then destroy > > or delete this > > >communication, or return it to us by mail if requested by > > us. The City of > > >Calgary thanks you for your attention and cooperation. > > > > -- > > Julian Field > > www.MailScanner.info > > MailScanner thanks transtec Computers for their support > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mk at quadstone.com Wed Dec 4 16:34:37 2002 From: mk at quadstone.com (Michael Keightley) Date: Thu Jan 12 21:16:36 2006 Subject: "Convert Dangerous HTML To Text" option Message-ID: <20021204163437.GA10203@quadstone.com> How would I go about allowing certain messages containing