From rishi at THEARGONCOMPANY.COM Fri Mar 1 03:34:40 2002 From: rishi at THEARGONCOMPANY.COM (Rishi Gangoly) Date: Thu Jan 12 21:14:30 2006 Subject: MailScanner References: <002a01c1c079$83740880$bc66a8c0@vpiberlin.com> Message-ID: <001701c1c0d2$05028180$0a00a8c0@gangfam.com> Dear Leecher, Change the last line in /usr/local/MailScanner/etc/mailscanner.conf from Minimum Code Status = supported to Minimum Code Status = beta That should fix it. Julian, Just a thought, you could probably move the Minimum Code Status section just below the Sweep option. What say? Regards -------------------------------------------------------------------------------- Rishi Gangoly The Argon Company 4th Floor, G Block, Dhanraj Mahal Chhatrapati Shivaji marg, Mumbai - 400039 Phone: 2361300 ; 2361311 Website: www.TheArgonCompany.com -------------------------------------------------------------------------------- ----- Original Message ----- From: Leecher To: rishi@theargoncompany.com Sent: Thursday, February 28, 2002 10:31 PM Subject: MailScanner Hello, Sorry for bother you, but I'm hopin you can help me out with a problem. I have installed the subject on my RedHat 7.2 computer, and I'm trying to use f-prot as the virus scanner. You posted a message that you have used f-prot with MailScanner, working. I'm not having as much luck... Mainly the MailScanner works fine. Scans and so on. However whenever I make the f-prot entries, and start MailScanner and a mail comes in, there is an error message and is rather unhelpful. Starting MailScanner: # FATAL: *Please go and READ* http://www.sng.ecs.soton.ac.uk/mailscanner/install/codestatus.shtml at /usr/local/MailScanner/bin/logger.pl line 60. The link contains nothing I see that can help. Can you help me out in getting MailScanner working? Thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020301/b19286fe/attachment.html From LISTSERV at JISCMAIL.AC.UK Fri Mar 1 08:47:26 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: marcobano@YAHOO.COM requested to join Message-ID: <200203010847.IAA12593@magpie.ecs.soton.ac.uk> Fri, 1 Mar 2002 08:47:26 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Marco Bano The following membership options have been requested: NOHTML MIME DIGEST. You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER marcobano@YAHOO.COM Marco Bano PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER marcobano@YAHOO.COM Marco Bano SET MAILSCANNER NOHTML MIME DIGEST FOR marcobano@YAHOO.COM // EOJ From brose at MED.WAYNE.EDU Fri Mar 1 15:55:42 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:30 2006 Subject: RBL checking Message-ID: But my thought was that if a message was tagged because of a RBL result of true, that it could skip sending it thru SA. That way it completely avoids doing the SA rbl check thru net::dns. Also it allows us to rely on your RBL check which appears faster than SA's. It doesn't matter that a sender host may not be in an RBL db, SA will still check. I frequently see messages on the SA list that states that net::dns is a performance problem with SA. So avoiding it would be good. -----Original Message----- From: Julian Field [mailto:jkf@ECS.SOTON.AC.UK] Sent: Thursday, February 28, 2002 12:01 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: RBL checking At 16:43 28/02/2002, you wrote: >I think the question was: > >What happens if the RBL check in mailscanner fails? Does MailScanner >still call SpamAssassin? or is the message "tagged and sent on?" It still does both checks. Some of my users only auto-filter mail that has been tagged as spam by the RBL lists as they prefer to ignore the results of SpamAssassin. This means I have to do all the checks. Also, it won't make much difference to the speed, as a very small %-age of mail in any batch of messages is caught by the RBL checks, so virtually all the mail would still have to go through SpamAssassin anyway. >I assume that once a message is tagged as SPAM, no further checks are >performed. So by setting the RBL flag on or off in SpamAssassin >shouldnt make a difference if MailScanner has already labeled the >message as SPAM. No. See above. >Julian Field said: > > At 16:35 28/02/2002, you wrote: > >>Julian, if Mailscanner does an RBL check does it still pass the > >>message off to SpamAssassin in which case it's checked again along > >>with content? Or is it just tagged and send on? Our queues got > >>really large last night and I've had to disable SA checking until > >>they clear out. I was wondering if RBL checking was happening in > >>both mailscanner and sa on the same message. > > > > I have my SpamAssassin user_prefs file say > > skip_rbl_checks 1 > > which fixes it. > > > >>Also what is mailcanner using for the reverse dns lookups if it > >>doesn't use net:dns module like SA does? Just wondering if the SA > >>guys could use the same process and ditch net::dns. > > > > I just use gethostbyname(). Seems fast in some tests I've been doing > > this afternoon. I was thinking about starting to use Net::DNS (as it > > can do DNS lookups in background), but the time taken to do it with > > gethostbyname() just wasn't worth trying to optimise. The real delay > > was all the processing the SpamAssassin does, not the DNS lookups. > > -- > > Julian Field Teaching Systems Manager > > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > > Tel. 023 8059 2817 University of Southampton > > Southampton SO17 1BJ -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From LISTSERV at JISCMAIL.AC.UK Fri Mar 1 20:22:10 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: jeff@ORI.RL.AC.UK requested to join Message-ID: <200203012022.UAA16165@magpie.ecs.soton.ac.uk> Fri, 1 Mar 2002 20:22:10 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Jeff Volckaert You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER jeff@ORI.RL.AC.UK Jeff Volckaert PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER jeff@ORI.RL.AC.UK Jeff Volckaert // EOJ From LISTSERV at JISCMAIL.AC.UK Sat Mar 2 13:11:39 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: mystic_sense@CENTURY.LCZ.CO.ZW requested to join Message-ID: <200203021311.NAA26789@magpie.ecs.soton.ac.uk> Sat, 2 Mar 2002 13:11:39 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Mystic Sense You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mystic_sense@CENTURY.LCZ.CO.ZW Mystic Sense PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mystic_sense@CENTURY.LCZ.CO.ZW Mystic Sense // EOJ From brose at MED.WAYNE.EDU Sun Mar 3 08:21:24 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:30 2006 Subject: SpamAssassin 2.1 issue Message-ID: Julian, I think we were wrong on the 2.1 compatiblity. Mailscanner wants MyMailAudit.pm which isn't in the 2.1 distro since they switched to NoMailAudit.pm. The reason mailscanner continued to work after we upgraded to 2.1 is because the 1.5 MyMailAudit.pm still lingered. So long as people have it, then they are ok but I don't see 1.5 available anymore. -=B From jkf at ecs.soton.ac.uk Sun Mar 3 09:48:44 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: SpamAssassin 2.1 issue In-Reply-To: Message-ID: <5.1.0.14.2.20020303094701.0288eeb0@hawk.ecs.soton.ac.uk> At 08:21 03/03/2002, you wrote: >Julian, I think we were wrong on the 2.1 compatiblity. Mailscanner >wants MyMailAudit.pm which isn't in the 2.1 distro since they switched >to NoMailAudit.pm. The reason mailscanner continued to work after we >upgraded to 2.1 is because the 1.5 MyMailAudit.pm still lingered. So >long as people have it, then they are ok but I don't see 1.5 available >anymore. There are a couple of changes that have to happen to the MailScanner source to support SpamAssassin 2.1, which unfortunately removes backward compatibility with 2.01 and earlier. I have made the relevant changes to the source and should be publishing a new version of MailScanner (to fit with SA 2.1 among other changes) next week, once my beta-testers have confirmed there aren't any glaring problems. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From LISTSERV at JISCMAIL.AC.UK Mon Mar 4 10:13:40 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: lltan@WEARNES.COM.SG requested to join Message-ID: <200203041013.KAA05903@magpie.ecs.soton.ac.uk> Mon, 4 Mar 2002 10:13:40 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Tan Lian Leong You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER lltan@WEARNES.COM.SG Tan Lian Leong PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER lltan@WEARNES.COM.SG Tan Lian Leong // EOJ From dennis at YTN.CO.NZ Mon Mar 4 19:59:04 2002 From: dennis at YTN.CO.NZ (Dennis Monks) Date: Thu Jan 12 21:14:30 2006 Subject: exim and spanassasin Message-ID: <3C83D208.6080601@ytn.co.nz> We have being noticing an error in the exim's header spool file for a while after mailscanner had detected Spam correctly. The error went something like this: 2002-03-05 08:12:24 16hbMz-00069t-00 Format error in spool file 16hbMz-00069t-00-H: size=1396 We have tracked this down to the subject line length being incorrect. The length placed in by mailscanner is one char short. Looking at the mta-specific.pl function PrependHeader it adds up the length, but forgets to allow for the '\n'. I have added the following to our code and it is working fine: $len = $oldlen - length($oldkey); + #D.Monks added another 1 for the newline char. Exim report error otherwise. + $headerlen = sprintf("%03d", $oldlen + length($newvalue) + length($sep) +1 ); the version of mailscanner being used is 3.11-1 Our users are now happly getting their spam. I hope this Dennis Monks I have nothing witty to say From LISTSERV at JISCMAIL.AC.UK Tue Mar 5 10:22:55 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: mailscanner@HOUSEOFCAEN.COM requested to join Message-ID: <200203051022.KAA18884@magpie.ecs.soton.ac.uk> Tue, 5 Mar 2002 10:22:55 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Francois Caen You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mailscanner@HOUSEOFCAEN.COM Francois Caen PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mailscanner@HOUSEOFCAEN.COM Francois Caen // EOJ From jkf at ecs.soton.ac.uk Tue Mar 5 14:45:37 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: ANNOUNCE: Version 3.12-3 released Message-ID: <5.1.0.14.2.20020305141728.02cb2818@imap.ecs.soton.ac.uk> I have just released Version 3.12-3 of MailScanner. Changes for this version are: - Domains To Scan now supports wildcards, e.g. *.julianfield.net, - Spam White List now supports wildcards, e.g. *.julianfield.net, - Greatly improved F-Prot parser (this should be the last major change to the parser), - Support for SpamAssassin 2.1 and upwards, - Stopped McAfee wrapper producing "kernel: cdrom open failed" errors, - New feature: "Mail Archive" to save all incoming mail to a directory, - Support for Inoculan 4.x virus scanner. - Fixed the bug in changing the subject line when spam-tagging with Exim (hopefully!) SpamAssassin users -- Please note you will need to have at least version 2.1 of SpamAssassin installed (current version is 2.11). MailScanner will complain and refuse to run if you have an earlier version of SpamAssassin installed. Downloadable, as usual, from http://www.mailscanner.info/ Jules. P.S. I am on holiday in the Alps next week (9th-16th March), so there will be a break in support from me. Sorry, but I don't feel like carrying my heavy old laptop on holiday. Now if someone wants to buy me a nice light new one, I would take that... ;-) -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From jkf at ecs.soton.ac.uk Tue Mar 5 15:25:04 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: exim and spanassasin In-Reply-To: <3C83D208.6080601@ytn.co.nz> Message-ID: <5.1.0.14.2.20020305152410.02c9bbc0@imap.ecs.soton.ac.uk> Many thanks for that. You're the second person to spot the bug today. It is fixed in 3.12-3 which I have just released. (I previously knew it was wrong, but hadn't figured out why. Thanks for the explanation!) At 19:59 04/03/2002, you wrote: > We have being noticing an error in the exim's header spool file for >a while after mailscanner had detected Spam correctly. The error went >something like this: > > 2002-03-05 08:12:24 16hbMz-00069t-00 Format error in spool file >16hbMz-00069t-00-H: size=1396 > >We have tracked this down to the subject line length being incorrect. >The length placed in by mailscanner is one char short. > >Looking at the mta-specific.pl function PrependHeader it adds up the >length, but forgets to allow for the '\n'. > >I have added the following to our code and it is working fine: > > $len = $oldlen - length($oldkey); > >+ #D.Monks added another 1 for the newline char. Exim report error >otherwise. >+ $headerlen = sprintf("%03d", $oldlen + length($newvalue) + >length($sep) +1 ); > >the version of mailscanner being used is 3.11-1 > >Our users are now happly getting their spam. > >I hope this >Dennis Monks > >I have nothing witty to say -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From S.R.Patterson at SOTON.AC.UK Tue Mar 5 15:21:34 2002 From: S.R.Patterson at SOTON.AC.UK (Patterson, S R) Date: Thu Jan 12 21:14:30 2006 Subject: ANNOUNCE: Version 3.12-3 released Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Tell you what, you can borrow my nice light Dell laptop for a week and I'll go to the alps... ;) - -- Steven Patterson, MSci ----------------------------------------------+ | Electronic Information Systems Support and Development | | Computing Services, University of Southampton, UK. | +-------------------------------------------- Tel: +44 (0) 2380 595810 ...... ...... .. Give me ambiguity or give me something else. .. ...... ...... > -----Original Message----- > From: Julian Field [mailto:jkf@ECS.SOTON.AC.UK] > Sent: 05 March 2002 14:46 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: ANNOUNCE: Version 3.12-3 released > > > I have just released Version 3.12-3 of MailScanner. > > Changes for this version are: > - Domains To Scan now supports wildcards, e.g. *.julianfield.net, > - Spam White List now supports wildcards, e.g. *.julianfield.net, > - Greatly improved F-Prot parser (this should be the last > major change to the parser), > - Support for SpamAssassin 2.1 and upwards, > - Stopped McAfee wrapper producing "kernel: cdrom open > failed" errors, > - New feature: "Mail Archive" to save all incoming mail to > a directory, > - Support for Inoculan 4.x virus scanner. > - Fixed the bug in changing the subject line when > spam-tagging with Exim > (hopefully!) > > SpamAssassin users -- Please note you will need to have at > least version 2.1 of SpamAssassin installed (current version > is 2.11). MailScanner will complain and refuse to run if you > have an earlier version of SpamAssassin installed. > > Downloadable, as usual, from > http://www.mailscanner.info/ > > Jules. > > P.S. I am on holiday in the Alps next week (9th-16th March), > so there will be a break in support from me. Sorry, but I > don't feel like carrying my heavy old laptop on holiday. Now > if someone wants to buy me a nice light new one, I would take > that... ;-) > -- > Julian Field Teaching Systems Manager > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ > -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPIThsK2fOiTs5+WvEQKIdQCgv8y07t4F5iyaXIunAoRSOZbWW04An3h7 nPH0tVE8lcVDJCFbz8MdiMaa =vw1H -----END PGP SIGNATURE----- From evertjan at VANRAMSELAAR.NL Tue Mar 5 15:44:51 2002 From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar) Date: Thu Jan 12 21:14:30 2006 Subject: ANNOUNCE: Version 3.12-3 released In-Reply-To: <5.1.0.14.2.20020305141728.02cb2818@imap.ecs.soton.ac.uk> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Julian Field > Sent: Tuesday, March 05, 2002 3:46 PM > - New feature: "Mail Archive" to save all incoming mail to a > directory, I have set Archive Mail = yes Archive Mail Dir = /var/spool/mailscanner/Archive but none of the incoming messages are being saved there, not even infected ones. Btw, does this save _all_ incoming mail, or just the infected ones? - -- Evert Jan van Ramselaar Van Ramselaar Info Tech -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPITn87UM1CUSAtqVEQKpcACbBspsquukbZAmYmiy9ScOdJFrY10AoI1f KvF0SYhCmrhk8SK2zmvgVER5 =NdYn -----END PGP SIGNATURE----- ___ This message has been scanned for viruses and other dangerous content by Van Ramselaar Info Tech and is believed to be clean. See http://www.vr-it.com/emailpolicy.php From jkf at ecs.soton.ac.uk Tue Mar 5 16:14:41 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: ANNOUNCE: Version 3.12-3 released In-Reply-To: References: <5.1.0.14.2.20020305141728.02cb2818@imap.ecs.soton.ac.uk> Message-ID: <5.1.0.14.2.20020305161324.08ae13a0@imap.ecs.soton.ac.uk> At 15:44 05/03/2002, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > > -----Original Message----- > > From: Julian Field > > Sent: Tuesday, March 05, 2002 3:46 PM > > > - New feature: "Mail Archive" to save all incoming mail to a > > directory, > >I have set > Archive Mail = yes > Archive Mail Dir = /var/spool/mailscanner/Archive >but none of the incoming messages are being saved there, not even >infected ones. Do you have a /bin/cp? A lack of that file would explain it not working. >Btw, does this save _all_ incoming mail, or just the infected ones? It should save _all_ incoming mail. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From evertjan at VANRAMSELAAR.NL Tue Mar 5 16:34:19 2002 From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar) Date: Thu Jan 12 21:14:30 2006 Subject: ANNOUNCE: Version 3.12-3 released In-Reply-To: <5.1.0.14.2.20020305161324.08ae13a0@imap.ecs.soton.ac.uk> Message-ID: <008001c1c463$994f6c10$65020a0a@galaxy> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Julian Field > Sent: Tuesday, March 05, 2002 5:15 PM > > > - New feature: "Mail Archive" to save all incoming mail to a > > > directory, > Do you have a /bin/cp? Yes. And the target dir does also exist. However, setting the option to Yes does not copy it there. > It should save _all_ incoming mail. Ok. I am gonna set it to No anyway then. Any chance of having an option to only save infected items, including all headers and stuff? All that is saved now, is just the infected file in the quarantine dir. - -- Evert Jan van Ramselaar Van Ramselaar Info Tech -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPITzi7UM1CUSAtqVEQKRogCeKHu4K0wctt0Uyk2xLr1aGXCdYOwAn2m2 LpBb2e1LaTO9CDoPysWsCr0a =jlZs -----END PGP SIGNATURE----- ___ This message has been scanned for viruses and other dangerous content by Van Ramselaar Info Tech and is believed to be clean. See http://www.vr-it.com/emailpolicy.php From mime at GMX.DE Tue Mar 5 16:25:44 2002 From: mime at GMX.DE (Michael Meyer) Date: Thu Jan 12 21:14:30 2006 Subject: ANNOUNCE: Version 3.12-3 released References: <5.1.0.14.2.20020305141728.02cb2818@imap.ecs.soton.ac.uk> <5.1.0.14.2.20020305161324.08ae13a0@imap.ecs.soton.ac.uk> Message-ID: <004a01c1c462$6638c480$0701a8c0@micha> ----- Original Message ----- From: "Julian Field" To: Sent: Tuesday, March 05, 2002 5:14 PM Subject: Re: ANNOUNCE: Version 3.12-3 released > > > > > - New feature: "Mail Archive" to save all incoming mail to a > > > directory, > > > >I have set > > Archive Mail = yes > > Archive Mail Dir = /var/spool/mailscanner/Archive > >but none of the incoming messages are being saved there, not even > >infected ones. i have the same problem under Suse 7.1. > Do you have a /bin/cp? > A lack of that file would explain it not working. i have a /bin/cp (4.0.35) > >Btw, does this save _all_ incoming mail, or just the infected ones? > > It should save _all_ incoming mail. > > -- > Julian Field Teaching Systems Manager > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ micha From jkf at ecs.soton.ac.uk Tue Mar 5 16:40:50 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: ANNOUNCE: Version 3.12-4 released. Was Re: ANNOUNCE: Version 3.12-3 released In-Reply-To: References: <5.1.0.14.2.20020305141728.02cb2818@imap.ecs.soton.ac.uk> Message-ID: <5.1.0.14.2.20020305163937.02a49508@imap.ecs.soton.ac.uk> Sorry, stupid bug on my part. I have just released 3.12-4 which fixes this. (I went and changed my mind about what to call the yes/no option at the last minute and didn't test the new value properly). At 15:44 05/03/2002, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > > -----Original Message----- > > From: Julian Field > > Sent: Tuesday, March 05, 2002 3:46 PM > > > - New feature: "Mail Archive" to save all incoming mail to a > > directory, > >I have set > Archive Mail = yes > Archive Mail Dir = /var/spool/mailscanner/Archive >but none of the incoming messages are being saved there, not even >infected ones. > >Btw, does this save _all_ incoming mail, or just the infected ones? > >- -- > Evert Jan van Ramselaar > Van Ramselaar Info Tech > > >-----BEGIN PGP SIGNATURE----- >Version: PGP 7.0.4 > >iQA/AwUBPITn87UM1CUSAtqVEQKpcACbBspsquukbZAmYmiy9ScOdJFrY10AoI1f >KvF0SYhCmrhk8SK2zmvgVER5 >=NdYn >-----END PGP SIGNATURE----- > > >___ >This message has been scanned for viruses and other dangerous >content by Van Ramselaar Info Tech and is believed to be clean. >See http://www.vr-it.com/emailpolicy.php -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From fizz at BOMB.NET Tue Mar 5 19:31:04 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:30 2006 Subject: need to know.. Message-ID: <001b01c1c47c$4d5b4360$48cf75cc@fizz> What perl modules are required for MailScanner? I cant seem to find this info anywhere on the site.. thanks ////// ( o o ) +--.oooO--(_)--Oooo.-----------------+ | [Kelly Hamlin] | kellyh@cyberstreet.com | http://www.bomb.net | .oooO | ( ) Oooo. +--- \ (----( )----------------------------+ \_) ) / (_/ From brose at MED.WAYNE.EDU Tue Mar 5 20:00:34 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:30 2006 Subject: need to know.. Message-ID: You're not looking hard enough. It's under Installation Guides ->Installing Tar distribution. Step 3 -----Original Message----- From: Kelly Hamlin [mailto:fizz@BOMB.NET] Sent: Tuesday, March 05, 2002 2:31 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: need to know.. What perl modules are required for MailScanner? I cant seem to find this info anywhere on the site.. thanks ////// ( o o ) +--.oooO--(_)--Oooo.-----------------+ | [Kelly Hamlin] | kellyh@cyberstreet.com | http://www.bomb.net | .oooO | ( ) Oooo. +--- \ (----( )----------------------------+ \_) ) / (_/ From fizz at BOMB.NET Tue Mar 5 20:12:32 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:30 2006 Subject: need to know.. References: Message-ID: <000701c1c482$1533e680$48cf75cc@fizz> =( im sorry, ive had a very stressfull day, 3 people short on staff, and im getting bombarded with tech support while trying to get the backup mail gateway setup.. thanks . ----- Original Message ----- From: "Rose, Bobby" To: Sent: Tuesday, March 05, 2002 3:00 PM Subject: Re: need to know.. You're not looking hard enough. It's under Installation Guides ->Installing Tar distribution. Step 3 -----Original Message----- From: Kelly Hamlin [mailto:fizz@BOMB.NET] Sent: Tuesday, March 05, 2002 2:31 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: need to know.. What perl modules are required for MailScanner? I cant seem to find this info anywhere on the site.. thanks ////// ( o o ) +--.oooO--(_)--Oooo.-----------------+ | [Kelly Hamlin] | kellyh@cyberstreet.com | http://www.bomb.net | .oooO | ( ) Oooo. +--- \ (----( )----------------------------+ \_) ) / (_/ From darian at BEPINC.COM Tue Mar 5 19:51:20 2002 From: darian at BEPINC.COM (Darian Rafie) Date: Thu Jan 12 21:14:30 2006 Subject: Mail-Archive feature Version 3.12-4 In-Reply-To: <5.1.0.14.2.20020305163937.02a49508@imap.ecs.soton.ac.uk> Message-ID: <006101c1c47f$228385a0$11c9dbd1@WONDER> Is it possible to save the headers as well, right now it appears they are stripped out. D. From evertjan at VANRAMSELAAR.NL Tue Mar 5 20:34:51 2002 From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar) Date: Thu Jan 12 21:14:30 2006 Subject: Mail-Archive feature Version 3.12-4 In-Reply-To: <006101c1c47f$228385a0$11c9dbd1@WONDER> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Darian Rafie > Sent: Tuesday, March 05, 2002 8:51 PM > Is it possible to save the headers as well, right now it appears > they are stripped out. I would really much like to just save the infected messages, also including headers. Now it's just a choice of save _all_ or just save infected files, not complete messages with infected files. - -- Evert Jan van Ramselaar Van Ramselaar Info Tech -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPIUr67UM1CUSAtqVEQKAQACfRvo4dXGhAemQgRxewsjEKRtzG9gAnjbf KvA2iOCTa4tvEt6ohsm8J8F8 =4RHa -----END PGP SIGNATURE----- ___ This message has been scanned for viruses and other dangerous content by Van Ramselaar Info Tech and is believed to be clean. See http://www.vr-it.com/emailpolicy.php From nwp at LEMON-COMPUTING.COM Tue Mar 5 23:50:49 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:30 2006 Subject: Large queues In-Reply-To: <0e7b01c1ba37$570caa60$813112d0@clas.net>; from ispmgr@CLAS.NET on Wed, Feb 20, 2002 at 11:52:18AM -0600 References: <3C73D1FA.4080908@mis.net> <0e7b01c1ba37$570caa60$813112d0@clas.net> Message-ID: <20020305235049.E19706@redshift.lemon-computing.com> On Wed, Feb 20, 2002 at 11:52:18AM -0600, Youn Gonzales wrote: > we are now running (2) dual XEON 733 boxes with 1G RAM and under a heavy load they are barely keeping up. we would also be happy to help beta test the code and work through these issues. we also have Deliver In Background set to yes and Delivery Mode set to queue. This is one of the things occupying my mailscanner "to-do" list... the packaging/install is the other main one. If all goes according to plan I'll be working on it over the next few weeks (no "real work" to do for a little while). So I may be back to ask you guys for help/testing in a while. I need to get back into the swing of things first (and get my head around everything that's changed in the last month or so). Cheers, Nick From doko at CS.TU-BERLIN.DE Tue Mar 5 23:58:19 2002 From: doko at CS.TU-BERLIN.DE (Matthias Klose) Date: Thu Jan 12 21:14:30 2006 Subject: Large queues In-Reply-To: <20020305235049.E19706@redshift.lemon-computing.com> References: <3C73D1FA.4080908@mis.net> <0e7b01c1ba37$570caa60$813112d0@clas.net> <20020305235049.E19706@redshift.lemon-computing.com> Message-ID: <15493.23451.500497.714079@gargle.gargle.HOWL> hehe, nice to see you again :-) Nick Phillips writes: > On Wed, Feb 20, 2002 at 11:52:18AM -0600, Youn Gonzales wrote: > > we are now running (2) dual XEON 733 boxes with 1G RAM and under a heavy load they are barely keeping up. we would also be happy to help beta test the code and work through these issues. we also have Deliver In Background set to yes and Delivery Mode set to queue. > > > This is one of the things occupying my mailscanner "to-do" list... the > packaging/install is the other main one. > > If all goes according to plan I'll be working on it over the next few > weeks (no "real work" to do for a little while). > > So I may be back to ask you guys for help/testing in a while. I need to > get back into the swing of things first (and get my head around everything > that's changed in the last month or so). > > > Cheers, > > > Nick From nwp at LEMON-COMPUTING.COM Wed Mar 6 00:46:34 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:30 2006 Subject: NFS Drive for mqueue & mqueue.in In-Reply-To: <3C7A0909.7AC36F79@di.unito.it>; from rabellino@DI.UNITO.IT on Mon, Feb 25, 2002 at 10:51:05AM +0100 References: <20C245C5F9A41949A359CCDBF4B3ADED2A7951@foundation.foundation.sdsu.edu> <3C7A0909.7AC36F79@di.unito.it> Message-ID: <20020306004634.H19706@redshift.lemon-computing.com> On Mon, Feb 25, 2002 at 10:51:05AM +0100, Rabellino Sergio wrote: > Steve Evans wrote: > > > > Has anybody ever used a NFS share for the mqueue and mqueue.in > > directory? Haven't tried it, but.... Depends on your OS and NFS. The following is from memory, so don't trust it. Under Linux: Sendmail's locking will not work over NFS. Exim's locking will work over NFS, so long as you're using the right NFS. Mailscanner's locking *should* (if we've got it right) be the same as the MTA in use. So under Linux with Exim and the right NFS server and client (the latest ones, basically, and set up in such a way as to do locking), you *might* be OK. The exim_lock program can be helpful for testing such things. Hope this helps. Nick From LISTSERV at JISCMAIL.AC.UK Tue Mar 5 23:16:37 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: sean@TCOB1.NET requested to join Message-ID: <200203052316.XAA27498@magpie.ecs.soton.ac.uk> Tue, 5 Mar 2002 23:16:37 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Sean Rima The following membership options have been requested: SUBJECTHDR. You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER sean@TCOB1.NET Sean Rima PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER sean@TCOB1.NET Sean Rima SET MAILSCANNER SUBJECTHDR FOR sean@TCOB1.NET // EOJ From LISTSERV at JISCMAIL.AC.UK Tue Mar 5 23:26:23 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: mike@UNIXSECURITY.ORG requested to join Message-ID: <200203052326.XAA28160@magpie.ecs.soton.ac.uk> Tue, 5 Mar 2002 23:26:23 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Mike Wallis You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mike@UNIXSECURITY.ORG Mike Wallis PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mike@UNIXSECURITY.ORG Mike Wallis // EOJ From jkf at ecs.soton.ac.uk Wed Mar 6 09:43:40 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: Mail-Archive feature Version 3.12-4 In-Reply-To: <006101c1c47f$228385a0$11c9dbd1@WONDER> References: <5.1.0.14.2.20020305163937.02a49508@imap.ecs.soton.ac.uk> Message-ID: <5.1.0.14.2.20020306094312.0456cdb0@hawk.ecs.soton.ac.uk> At 19:51 05/03/2002, you wrote: >Is it possible to save the headers as well, right now it appears they >are stripped out. They are there, but in a different file. If you are using sendmail, you will have a "qf" and a "df" file for each message, just the way they appear in a real sendmail queue. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 6 13:13:10 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: cerda@AGROPOLIS.FR requested to join Message-ID: <200203061313.NAA22288@magpie.ecs.soton.ac.uk> Wed, 6 Mar 2002 13:13:10 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Jean Cerda You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER cerda@AGROPOLIS.FR Jean Cerda PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER cerda@AGROPOLIS.FR Jean Cerda // EOJ From mike at UNIXSECURITY.ORG Wed Mar 6 15:12:35 2002 From: mike at UNIXSECURITY.ORG (Mike Wallis) Date: Thu Jan 12 21:14:30 2006 Subject: Sophos IDE autoupdate Message-ID: <3C8631E3.4030403@unixsecurity.org> Apparently this month Sophos has started to release two versions of their scanner, the regular and a new 'enhanced' version. They both use the same IDE files, but the enhanced version has a slightly different dat file name. It appears that this minor change causes the regexp in the autoupdate script to choke. Unfortunately, my perl-fu is weak, so I thought I'd pass this along to those who can actually fix it. standard dat file: vdl-3.55.dat enhanced dat file: vdl-3.55n.dat Creating a symlink of vdl-3.55.dat -> vdl-3.55n.dat serves as a workaround, but seems a bit kludgy. -- Mike Wallis mw@unixsecurity.org From jkf at ecs.soton.ac.uk Wed Mar 6 16:00:43 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: Sophos IDE autoupdate In-Reply-To: <3C8631E3.4030403@unixsecurity.org> Message-ID: <5.1.0.14.2.20020306155123.028e3750@hawk.ecs.soton.ac.uk> At 15:12 06/03/2002, you wrote: >Apparently this month Sophos has started to release two versions of >their scanner, the regular and a new 'enhanced' version. They both use >the same IDE files, but the enhanced version has a slightly different >dat file name. It appears that this minor change causes the regexp in >the autoupdate script to choke. Unfortunately, my perl-fu is weak, so I >thought I'd pass this along to those who can actually fix it. > >standard dat file: vdl-3.55.dat >enhanced dat file: vdl-3.55n.dat >Creating a symlink of vdl-3.55.dat -> vdl-3.55n.dat serves as a >workaround, but seems a bit kludgy. Edit the Sophos autoupdate, and change line 26 from next unless $vdlname =~ /^vdl-(\d+)\.(\d+)\.dat$/; to next unless $vdlname =~ /^vdl-(\d+)\.(\d+)n?\.dat$/; That version of the code will work on the normal and NSV variants of Sophos. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From david.fry at ifrsys.com Wed Mar 6 19:29:02 2002 From: david.fry at ifrsys.com (David Fry) Date: Thu Jan 12 21:14:30 2006 Subject: Sophos autoupdate cron woe. Message-ID: <000201c1c545$2bbaeb10$b491c80a@mis.ifrsys.com> Greetings, I have Sophos running under Mailscanner version 3.04 successfully on both RedHat 7.1 & 6.2 platforms. The setups are basically identical with autoupdate being run from CROND. On the RedHat 7.1 box it works like a champ. On the RedHat 6.2 box, it works like a champ ONLY if I run the script from the command line -- Once I schedule it in cron, I get the following error message: " Lynx failed with error return 1 , Bad file descriptor at /opt/mailscanner/bin/autoupdate line 75. " I have to suspect it is some sort of environment variable or path issue on the 6.2 box since it works fine if I invoke it from the command prompt. Is there some flag I should be adding to the cron entry so that lynx doesn't croak on me? Anyone out there able to clue me in?? Thanks in advance for your help. David Fry IFR Systems From mike at UNIXSECURITY.ORG Wed Mar 6 20:43:42 2002 From: mike at UNIXSECURITY.ORG (Mike Wallis) Date: Thu Jan 12 21:14:30 2006 Subject: Sophos IDE autoupdate References: <5.1.0.14.2.20020306155123.028e3750@hawk.ecs.soton.ac.uk> Message-ID: <3C867F7E.4030105@unixsecurity.org> Julian Field wrote: > At 15:12 06/03/2002, you wrote: > >> standard dat file: vdl-3.55.dat >> enhanced dat file: vdl-3.55n.dat >> Creating a symlink of vdl-3.55.dat -> vdl-3.55n.dat serves as a >> workaround, but seems a bit kludgy. > > > Edit the Sophos autoupdate, and change line 26 from > next unless $vdlname =~ /^vdl-(\d+)\.(\d+)\.dat$/; > to > next unless $vdlname =~ /^vdl-(\d+)\.(\d+)n?\.dat$/; > > That version of the code will work on the normal and NSV variants of > Sophos. That fixes the autoupdate issue with determining the version number, but doesn't quite get all of it. I updated the script and removed the symlink I'd created to test it out. Inside the daily ide directory, vdl.dat is still symlinked back to ../lib/vdl-3.55.dat. It looks like the optional 'n' character isn't being preserved in $MinorVer. -- Mike Wallis mw@unixsecurity.org From david.fry at ifrsys.com Wed Mar 6 22:38:10 2002 From: david.fry at ifrsys.com (David Fry) Date: Thu Jan 12 21:14:30 2006 Subject: Microsloth security update worm not being caught! Message-ID: <001d01c1c55f$97f02fb0$b491c80a@mis.ifrsys.com> Has anyone else noticed an issue with the W32.Gibe@mm worm NOT being caught by Sophos and Mailscanner?? I just saw it pass through my mail gateway twice in the last few minutes with nary an alert. My sophos ide's were updated as soon as the W32.Gibe definitions came out & yet it got through the scanner. I am rather shocked this happened. The Sophos/Mailscanner combo has been superb up to this point ... we are in an evaluation process & I am looking for an explanation as to why it got through. Can anyone provide a clue for me?? Thank you in advance for your help! Sincerely, David Fry IFR Systems From LISTSERV at JISCMAIL.AC.UK Wed Mar 6 19:51:07 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: alfredo@ACYC.COM requested to join Message-ID: <200203061951.TAA26389@magpie.ecs.soton.ac.uk> Wed, 6 Mar 2002 19:51:07 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from "Alfredo J. Cole" You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER alfredo@ACYC.COM Alfredo J. Cole PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER alfredo@ACYC.COM Alfredo J. Cole // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 6 21:50:23 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: Denis.Beauchemin@USHERBROOKE.CA requested to join Message-ID: <200203062150.VAA19198@magpie.ecs.soton.ac.uk> Wed, 6 Mar 2002 21:50:23 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Denis Beauchemin The following membership options have been requested: CONCEAL. You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER Denis.Beauchemin@USHERBROOKE.CA Denis Beauchemin PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER Denis.Beauchemin@USHERBROOKE.CA Denis Beauchemin SET MAILSCANNER CONCEAL FOR Denis.Beauchemin@USHERBROOKE.CA // EOJ From jkf at ecs.soton.ac.uk Thu Mar 7 09:21:15 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: Sophos IDE autoupdate In-Reply-To: <3C867F7E.4030105@unixsecurity.org> References: <5.1.0.14.2.20020306155123.028e3750@hawk.ecs.soton.ac.uk> Message-ID: <5.1.0.14.2.20020307091947.02cb70d8@imap.ecs.soton.ac.uk> At 20:43 06/03/2002, you wrote: >Julian Field wrote: > >>At 15:12 06/03/2002, you wrote: >> >>>standard dat file: vdl-3.55.dat >>>enhanced dat file: vdl-3.55n.dat >>>Creating a symlink of vdl-3.55.dat -> vdl-3.55n.dat serves as a >>>workaround, but seems a bit kludgy. >> >> >>Edit the Sophos autoupdate, and change line 26 from >> next unless $vdlname =~ /^vdl-(\d+)\.(\d+)\.dat$/; >>to >> next unless $vdlname =~ /^vdl-(\d+)\.(\d+)n?\.dat$/; >> >>That version of the code will work on the normal and NSV variants of >>Sophos. > > >That fixes the autoupdate issue with determining the version number, but >doesn't quite get all of it. I updated the script and removed the >symlink I'd created to test it out. Inside the daily ide directory, >vdl.dat is still symlinked back to ../lib/vdl-3.55.dat. It looks like >the optional 'n' character isn't being preserved in $MinorVer. Sorry. Try this instead next unless $vdlname =~ /^vdl-(\d+)\.(\d+n?)\.dat$/; -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From m.sapsed at BANGOR.AC.UK Thu Mar 7 09:52:15 2002 From: m.sapsed at BANGOR.AC.UK (Martin Sapsed) Date: Thu Jan 12 21:14:30 2006 Subject: Microsloth security update worm not being caught! References: <001d01c1c55f$97f02fb0$b491c80a@mis.ifrsys.com> Message-ID: <3C87384F.6040505@bangor.ac.uk> David Fry wrote: > Has anyone else noticed an issue with the W32.Gibe@mm worm NOT being caught > by Sophos and Mailscanner?? > > I just saw it pass through my mail gateway twice in the last few minutes > with nary an alert. My sophos ide's were updated as soon as the W32.Gibe > definitions came out & yet it got through the scanner. I am rather shocked > this happened. The Sophos/Mailscanner combo has been superb up to this > point ... we are in an evaluation process & I am looking for an explanation > as to why it got through. A colleague forwarded a copy of Gibe to me and it was intercepted by MailScanner/Sophos. I don't have any information on an original copy of Gibe though. Cheers, Martin -- Martin Sapsed To have no errors Information Services Would be life without meaning University of Wales, Bangor, LL57 2UX No struggle, no joy. Fax: +44 (0)1248 383826 From jkf at ecs.soton.ac.uk Thu Mar 7 10:01:32 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:30 2006 Subject: Microsloth security update worm not being caught! In-Reply-To: <3C87384F.6040505@bangor.ac.uk> References: <001d01c1c55f$97f02fb0$b491c80a@mis.ifrsys.com> Message-ID: <5.1.0.14.2.20020307095934.02a7f4c0@imap.ecs.soton.ac.uk> At 09:52 07/03/2002, you wrote: >David Fry wrote: >>Has anyone else noticed an issue with the W32.Gibe@mm worm NOT being caught >>by Sophos and Mailscanner?? I use Sophos myself and MailScanner is catching it: >To: postmaster@ecs.soton.ac.uk >Subject: Warning: E-mail viruses detected > >The following e-mail messages were found to have viruses in them: > >Sender: <****@****.com> >Recipient: <*****@ecs.soton.ac.uk>, <***@ecs.soton.ac.uk> >Subject: Internet Security Update >MessageID: AAA17266 >Report: >>> Virus 'W32/Gibe-A' found in file ./AAA17266/q216309.exe >-- >MailScanner >Email Virus Scanner (Hidden the names for obvious privacy reasons). >>I just saw it pass through my mail gateway twice in the last few minutes >>with nary an alert. My sophos ide's were updated as soon as the W32.Gibe >>definitions came out & yet it got through the scanner. I am rather shocked >>this happened. The Sophos/Mailscanner combo has been superb up to this >>point ... we are in an evaluation process & I am looking for an explanation >>as to why it got through. > >A colleague forwarded a copy of Gibe to me and it was intercepted by >MailScanner/Sophos. I don't have any information on an original copy of >Gibe though. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 7 10:25:34 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:30 2006 Subject: MAILSCANNER: jorge.bras@IESTRADAS.PT requested to join Message-ID: <200203071025.KAA09087@magpie.ecs.soton.ac.uk> Thu, 7 Mar 2002 10:25:34 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Jorge Bras You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER jorge.bras@IESTRADAS.PT Jorge Bras PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER jorge.bras@IESTRADAS.PT Jorge Bras // EOJ From dobos_s at IBCNET.HU Thu Mar 7 10:34:23 2002 From: dobos_s at IBCNET.HU (Sandor Dobos) Date: Thu Jan 12 21:14:31 2006 Subject: virus passed through mailscanner driven mcafee! Message-ID: (mailscanner version 3.04-1) Hi! Maybe You know about this, but I think there is an error in parsing mcafee output. The sympthom was that I got a message from a webshield running on win that there is an Exploit-MIME.gen infected email. But that PC got the email from a linux mail-relay, running mailscanner with mcafee 4188! And the email reaching the webshield has a X-Mailscanner: found to be clean header! I sent the infected mail as an attachment back through the relay, but this time I get the viruswarning. How could this happen? I run uvscan on the sendmails queue file, it said there is that virus, but after the "Found...." line there was an other telling "Please send a copy to..." I run uvscan on the mailscanners incoming directory, where were the unpacked attachments, and there was nothing found! So what to do? Dobos Sandor IBCnet Hungary Ltd. Julian Field cc: Sent by: Subject: Re: [OT] Sendmail - Was Re: Re: Filtering MailScanner mailing list 2002.02.26 11:34 Please respond to MailScanner mailing list At 10:27 26/02/2002, you wrote: >Is it possible to include these checks in a .mc file instead of the .cf file >? Yes, that's where I put the code below. Just put in a line saying LOCAL_RULESETS and then follow it with the example I have given. >I hate having to add these things after using m4 on my .mc file ! I never touch the cf file, only the mc. >----- Original Message ----- >From: "Julian Field" >Sent: Tuesday, February 26, 2002 8:45 AM >Subject: Re: Filtering > > > > And subject lines can be easily filtered in sendmail too. > > For example: > > > > HSubject: $>Check_Subject > > > > D{MelissaPat}Important Message From > > D{MelissaMsg}This message may contain the Melissa virus. > > D{PrettyPat}C:\\CoolProgs\\Pretty Park.exe > > D{PrettyMsg}This message may contain the Pretty Park virus. > > > > SCheck_Subject > > R${MelissaPat} $* $#error $@ 5.7.1 $: ${MelissaMsg} > > RRe: ${MelissaPat} $* $#error $@ 5.7.1 $: ${MelissaMsg} > > R${PrettyPat} $* $#error $@ 5.7.1 $: ${PrettyMsg} > > > > At 19:55 25/02/2002, you wrote: > > >sender addresses can be filtered using sendmail's access.db feature.. > > > > > >Youn Gonzales > > >System Administrator > > >Comptia A+, Network+, INET+, > > >Cisco CCNA/CCDA Certified Technician > > >Microsoft Certified Professional > > > > > > > > >----- Original Message ----- > > >From: "Henry C. Chorlian" > > >To: > > >Sent: Monday, February 25, 2002 2:00 PM > > >Subject: Filtering > > > > > > > > > > Is there a way to filter out sender addresses or certain > > > > anoying subject headers? > > > > > > > > Any suggestions greatly appreciated. > > > > > > > > Thanks, > > > > > > > > Henry > > > > > > > > ------------------------------------------ > > > > Henry C. Chorlian > > > > Director of Information Systems > > > > Center for Blood Research > > > > 800 Huntington Avenue > > > > Boston, MA 02115-6303 > > > > > > > > Harvard Medical School Affiliate > > > > chorlian@cbr.med.harvard.edu > > > > Voice: (617) 278-3425 > > > > Fax: (617) 278-3493 > > > > -- > > Julian Field Teaching Systems Manager > > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > > Tel. 023 8059 2817 University of Southampton > > Southampton SO17 1BJ > > -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 7 11:34:04 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: thomas.zajic@NEO.AT requested to join Message-ID: <200203071134.LAA22420@magpie.ecs.soton.ac.uk> Thu, 7 Mar 2002 11:34:04 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Thomas Zajic You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER thomas.zajic@NEO.AT Thomas Zajic PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER thomas.zajic@NEO.AT Thomas Zajic // EOJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 7 13:00:56 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: jeff@ORI.RL.AC.UK requested to join Message-ID: <200203071300.NAA09409@magpie.ecs.soton.ac.uk> Thu, 7 Mar 2002 13:00:56 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Jeff Volckaert You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER jeff@ORI.RL.AC.UK Jeff Volckaert PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER jeff@ORI.RL.AC.UK Jeff Volckaert // EOJ From jkf at ecs.soton.ac.uk Thu Mar 7 14:40:26 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:31 2006 Subject: ANNOUNCE: Bug report and fix: Version 3.12-5 Message-ID: <5.1.0.14.2.20020307142744.02bd2930@imap.ecs.soton.ac.uk> Impact ====== This bug only affects users of the McAfee virus scanner. I would advise all McAfee users to correct this problem, either by applying the change in this message, or by upgrading to version 3.12-5. This bug is unlikely to cause a problem at all, *but* there is a very remote chance of mail being scanned without a valid set of virus definitions being present, if the scan happens at exactly the right moment while the daily auto-updating script is running. Bug Report ========== The McAfee virus scanner updating script (/usr/local/mcafee/autoupdate) and the main MailScanner code disagree on the name of the lock file. Fix === Edit the updating script (/usr/local/mcafee/autoupdate or wherever you have it installed) and change line 19 from my($LockFile) = "/tmp/McafeeBusy.lock"; to my($LockFile) = "/tmp/McAfeeBusy.lock"; This is also fixed in version 3.12-5. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From alfredo at ACYC.COM Thu Mar 7 15:17:54 2002 From: alfredo at ACYC.COM (Alfredo Cole) Date: Thu Jan 12 21:14:31 2006 Subject: autoupdate erases my uvscan directory Message-ID: <200203071522.g27FMJx23421@central.acyc.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 After installing McAfee antivirus for Linux, I noticed that signature files are located in the /usr/local/uvscan directory, and that the installation does not create a separate /dat subdirectory. So I modified autoupdate script and made datdir point to that directory. But when it executes, it deletes the entire uvscan directory. Is there a fix for this? Also, I have RAV antivirus. Will support for RAV be added anytime soon? Thank you. - -- Alfredo J. Cole http://www.acyc.com (Accounting Systems) http://www.clshonduras.com (Linux Hardware) PGP Key available from certserver.pgp.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.5 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8h4Sju5DxuPWE298RAsYdAJ9ErYaaEbO1IsJIempM06FapW3tugCfWx7n ELfDb5uZoOWSeazRwjgCQa0= =BKgI -----END PGP SIGNATURE----- From mike at UNIXSECURITY.ORG Thu Mar 7 15:47:17 2002 From: mike at UNIXSECURITY.ORG (Mike Wallis) Date: Thu Jan 12 21:14:31 2006 Subject: Sophos IDE autoupdate References: <5.1.0.14.2.20020306155123.028e3750@hawk.ecs.soton.ac.uk> <5.1.0.14.2.20020307091947.02cb70d8@imap.ecs.soton.ac.uk> Message-ID: <3C878B85.1020307@unixsecurity.org> Julian Field wrote: > Sorry. Try this instead > next unless $vdlname =~ /^vdl-(\d+)\.(\d+n?)\.dat$/; Whoops, looks like I overlooked the possibility of the extra character in $MinorVer breaking the download of the IDE file. It seems like there needs to be a new variable, one for the filename, and one for the version to be downloaded. So, I'll just go back to using my workaround until such time as the script gets updated. So I guess you can just treat this as a feature request for a future version. -- Mike Wallis mw@unixsecurity.org From sean at TCOB1.NET Thu Mar 7 16:01:59 2002 From: sean at TCOB1.NET (Sean Rima) Date: Thu Jan 12 21:14:31 2006 Subject: Loads of clean mail in the quarantine dir Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For some strange reason, I have found a lot of email in the quarantine dir. All have a Found Clean header. Is this common or have I done something wrong. Sean - -- ,,, (o o) - -=-=-=-=-=-=-=-=-=-=-=-oOOo-(_)-oOOo-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Offering feeds for Fidonet, Adventurenet, and many other nets See http://www.tcob1.net for more details ICQ: 679813 Linux User: 231986 TCOB1 BBS: 095 43852 Yahoo: tcob_1 Jabber: tcobone@jabber.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Use GPG for Secure Mail iEYEARECAAYFAjyHjvcACgkQeR/L2ZZp3E8FYwCgjnpf0U4xfp+ArBAUvvXlR8qq EakAn35/GIRKzfbUPaIFMTeR6Uh+ACky =87Za -----END PGP SIGNATURE----- From brose at MED.WAYNE.EDU Thu Mar 7 16:14:43 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:31 2006 Subject: Microsloth security update worm not being caught! Message-ID: But are you guys restricting exe's? I saw the same thing but Mailscanner stopped it only because it was an exe and that's in my restricted attachment list. -----Original Message----- From: Julian Field [mailto:jkf@ECS.SOTON.AC.UK] Sent: Thursday, March 07, 2002 5:02 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Microsloth security update worm not being caught! At 09:52 07/03/2002, you wrote: >David Fry wrote: >>Has anyone else noticed an issue with the W32.Gibe@mm worm NOT being >>caught by Sophos and Mailscanner?? I use Sophos myself and MailScanner is catching it: >To: postmaster@ecs.soton.ac.uk >Subject: Warning: E-mail viruses detected > >The following e-mail messages were found to have viruses in them: > >Sender: <****@****.com> >Recipient: <*****@ecs.soton.ac.uk>, <***@ecs.soton.ac.uk> >Subject: Internet Security Update >MessageID: AAA17266 >Report: >>> Virus 'W32/Gibe-A' found in file ./AAA17266/q216309.exe >-- >MailScanner >Email Virus Scanner (Hidden the names for obvious privacy reasons). >>I just saw it pass through my mail gateway twice in the last few >>minutes with nary an alert. My sophos ide's were updated as soon as >>the W32.Gibe definitions came out & yet it got through the scanner. I >>am rather shocked this happened. The Sophos/Mailscanner combo has >>been superb up to this point ... we are in an evaluation process & I >>am looking for an explanation as to why it got through. > >A colleague forwarded a copy of Gibe to me and it was intercepted by >MailScanner/Sophos. I don't have any information on an original copy of >Gibe though. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From David.Sullivan at BARNET.AC.UK Thu Mar 7 16:33:23 2002 From: David.Sullivan at BARNET.AC.UK (David Sullivan) Date: Thu Jan 12 21:14:31 2006 Subject: Microsloth security update worm not being caught! In-Reply-To: Message-ID: <3C879653.16836.AE8574A@localhost> On 7 Mar 2002 at 11:14, Rose, Bobby wrote: > But are you guys restricting exe's? I saw the same thing but > Mailscanner stopped it only because it was an exe and that's in my > restricted attachment list. > If that were the case you wouldn't get the ">>> Virus" bit as shown below since this is an indication from the virus scanner that it has found the virus shown. Unacceptable attachments should generate an message indicating that the file extension is on a list of unacceptable attachments. > >Report: >>> Virus 'W32/Gibe-A' found in file ./AAA17266/q216309.exe > >-- > >MailScanner > >Email Virus Scanner -- David Sullivan IT Services, Barnet College, London David.Sullivan@barnet.ac.uk 020 8275 5036 ============================================================== This communication may contain privileged or confidential information which is for the exclusive use of the intended recipient. If you are not the intended recipient, please note that you may not distribute or use this communication or the information it contains. If this e-mail has reached you in error, please delete it and any attachment. Internet communications are not secure and Barnet College does not accept legal responsibility for the content of this message. Any views or opinions expressed are those of the author and not necessarily those of Barnet College. Please note that Barnet College reserves the right to monitor the source/destinations of all incoming or outgoing e-mail communications. ============================================================== From thomas.zajic at NEO.AT Thu Mar 7 16:31:29 2002 From: thomas.zajic at NEO.AT (Thomas Zajic) Date: Thu Jan 12 21:14:31 2006 Subject: autoupdate erases my uvscan directory In-Reply-To: <200203071522.g27FMJx23421@central.acyc.com>; from alfredo@ACYC.COM on Thu, Mar 07, 2002 at 09:17:54AM -0600 References: <200203071522.g27FMJx23421@central.acyc.com> Message-ID: <20020307173129.E422@thomas.neo.at> On Thu, Mar 07, 2002 at 09:17:54AM -0600, Alfredo Cole wrote: > After installing McAfee antivirus for Linux, I noticed that signature > files are located in the /usr/local/uvscan directory, and that the > installation does not create a separate /dat subdirectory. So I > modified autoupdate script and made datdir point to that directory. > But when it executes, it deletes the entire uvscan directory. Is > there a fix for this? [...] Modify your /usr/local/uvscan directory structure as follows: 1. Create a directory in YYYYMMDD format, using yesterday's (or an earlier) date. # cd /usr/local/uvscan # mkdir 20020101 2. Move all your *.dat files _except_ license.dat and messages.dat (these two aren't contained in the .dat update tarballs) into the newly created directory. # mv clean.dat internet.dat names.dat scan.dat 20020101 Alternatively, simply untar the .dat update tarball in the newly created directory. # cd 20020101 # tar xf /path/to/dat-4188.tar 3. Create a symlink called 'dat' pointing to the newly created directory. # ln -sf 20020101 dat 4. Optional: create symlinks to the moved *.dat files pointing to their original location. This step isn't necessary, but it is convenient in case some scripts rely on the *.dat files to be in their original location. # ln -sf dat/*.dat . 5. Your /usr/local/uvscan directory structure should now look similar to this (depending on which options you chose in step 2. & 4.). [root@gateway2]:~# ls -lR /usr/local/uvscan/ /usr/local/uvscan/: total 4772 drwxr-xr-x 2 root root 20020101 lrwxrwxrwx 1 root root clean.dat -> dat/clean.dat lrwxrwxrwx 1 root root dat -> /usr/local/uvscan/20020101 lrwxrwxrwx 1 root root internet.dat -> dat/internet.dat lrwxrwxrwx 1 root root liblnxfv.so -> liblnxfv.so.4 -rwxr-xr-x 1 root root liblnxfv.so.4 -rw-r--r-- 1 root root license.dat -r--r--r-- 1 root root license.txt -rw-r--r-- 1 root root messages.dat lrwxrwxrwx 1 root root names.dat -> dat/names.dat -r--r--r-- 1 root root readme.txt -r--r--r-- 1 root root reseller.txt lrwxrwxrwx 1 root root scan.dat -> dat/scan.dat -r-xr-xr-x 1 root root uninstall-uvscan -r--r--r-- 1 root root unxadmin.pdf -r-xr-xr-x 1 root root uvscan -r--r--r-- 1 root root uvscan.1 /usr/local/uvscan/20020101: total 4592 -rw-r--r-- 1 root root clean.dat -rw-r--r-- 1 root root dat-4188.tar -rw-r--r-- 1 root root file_id.diz -rw-r--r-- 1 root root internet.dat -rw-r--r-- 1 root root mcscript.ini -rw-r--r-- 1 root root names.dat -rw-r--r-- 1 root root packing.lst -rw-r--r-- 1 root root pkgdesc.ini -rw-r--r-- 1 root root readme.txt -rw-r--r-- 1 root root reseller.txt -rw-r--r-- 1 root root scan.dat -rwxr-xr-x 1 root root validate.exe 6. Now run 'autoupdate'. Should work fine, and leave you with a new directory with today's date, containing a freshly unpacked .dat update tarball, and a symlink called 'dat' pointing to it. The old '20020101' directory should have been removed. HTH, Thomas -- ----------------------------- Thomas Zajic System Administrator neo Software Produktions GmbH A T2 Company email: thomas.zajic@neo.at web: http://www.neo.at -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 232 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020307/48a85a9c/attachment.bin From jkf at ecs.soton.ac.uk Thu Mar 7 16:52:04 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:31 2006 Subject: autoupdate erases my uvscan directory In-Reply-To: <200203071522.g27FMJx23421@central.acyc.com> Message-ID: <5.1.0.14.2.20020307165023.05866210@imap.ecs.soton.ac.uk> At 15:17 07/03/2002, you wrote: >After installing McAfee antivirus for Linux, I noticed that signature >files are located in the /usr/local/uvscan directory, and that the >installation does not create a separate /dat subdirectory. Fixed. Thanks for reporting that. >So I >modified autoupdate script and made datdir point to that directory. >But when it executes, it deletes the entire uvscan directory. Is >there a fix for this? Keep all the dat files in a separate directory (e.g. the /usr/local/mcafee/dat directory). >Also, I have RAV antivirus. Will support for RAV be added anytime >soon? If you can give us the documentation and some sample output, I can probably implement it for you. However, you are welcome to try to do it yourself. Take a look at sweep.pl and copy what is already there for the current range of supported scanners. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From home at SIMONB.ORG.UK Thu Mar 7 17:54:17 2002 From: home at SIMONB.ORG.UK (Simon Blandford) Date: Thu Jan 12 21:14:31 2006 Subject: Installation on RAQ4 Message-ID: Hi, I found some issues installing Mailscanner on a Cobalt RAQ4. I installed from the rpm file. 1) In config.pl there are references to /opt/ even though both Mailscanner and Sophos are installed under /usr/local/. 2) The queue munching instance of Sendmail did not do anything with the contents of /var/spool/mqueue until I explicitely told it where the queue was in the /etc/rc.d/init.d/mailscanner script. $SENDMAIL -q15m had to be changed to $SENDMAIL -q15m -OQueueDirectory=/var/spool/mqueue 2) A new script was installed in /etc/rc.d/init.d called "mailscanner". The Cobalt will restart the Sendmail process whenever any mail settings are changed. I found the best solution was to save the old "sendmail" script to a backup and make a hybrid of the "sendmail" and "mailscanner" script so as far as the Cobalt is concerned it is business as usual. Regards, Simon B. From sean at TCOB1.NET Thu Mar 7 17:35:04 2002 From: sean at TCOB1.NET (Sean Rima) Date: Thu Jan 12 21:14:31 2006 Subject: Loads of clean mail in the quarantine dir In-Reply-To: (Sean Rima's message of "Thu, 7 Mar 2002 16:01:59 +0000") References: Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thu, 7 Mar 2002, Sean Rima said: > For some strange reason, I have found a lot of email in the quarantine > dir. All have a Found Clean header. Is this common or have I done > something wrong. > Ignore this, op error, had for some reason set the archive option and was sticking them into the quarantine dir. Sean - -- ,,, (o o) - -=-=-=-=-=-=-=-=-=-=-=-oOOo-(_)-oOOo-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Offering feeds for Fidonet, Adventurenet, and many other nets See http://www.tcob1.net for more details ICQ: 679813 Linux User: 231986 TCOB1 BBS: 095 43852 Yahoo: tcob_1 Jabber: tcobone@jabber.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Use GPG for Secure Mail iEYEARECAAYFAjyHpMgACgkQeR/L2ZZp3E8WuQCgmiisgITrTpORoIZ+wD64aZP7 O34An2q7uJuGKmZQPmpYUgwGB87PFyIO =vJmV -----END PGP SIGNATURE----- From jkf at ecs.soton.ac.uk Thu Mar 7 18:09:27 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:31 2006 Subject: Installation on RAQ4 In-Reply-To: Message-ID: <5.1.0.14.2.20020307180732.0278da38@hawk.ecs.soton.ac.uk> At 17:54 07/03/2002, you wrote: >I found some issues installing Mailscanner on a Cobalt RAQ4. I installed >from the rpm file. > >1) In config.pl there are references to /opt/ even though both Mailscanner >and Sophos are installed under /usr/local/. That doesn't matter, as all the paths are over-ridden by the contents of mailscanner.conf anyway. >2) The queue munching instance of Sendmail did not do anything with the >contents of /var/spool/mqueue until I explicitely told it where the queue >was in the /etc/rc.d/init.d/mailscanner script. > $SENDMAIL -q15m >had to be changed to > $SENDMAIL -q15m -OQueueDirectory=/var/spool/mqueue > >2) A new script was installed in /etc/rc.d/init.d called "mailscanner". The >Cobalt will restart the Sendmail process whenever any mail settings are >changed. I found the best solution was to save the old "sendmail" script to >a backup and make a hybrid of the "sendmail" and "mailscanner" script so as >far as the Cobalt is concerned it is business as usual. There is a FAQ all about doing this on the UK2NET RAQ-hosting website. I'm sure one of the UK2NET guys can provide you with the exact URL if Google can't find it. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From jkf at ecs.soton.ac.uk Thu Mar 7 18:10:57 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:31 2006 Subject: Installation on RAQ4 In-Reply-To: Message-ID: <5.1.0.14.2.20020307181045.028c7668@hawk.ecs.soton.ac.uk> At 17:54 07/03/2002, you wrote: >I found some issues installing Mailscanner on a Cobalt RAQ4. I installed >from the rpm file. Read this: http://www.uk2raq.com/raqfaq/raqfaqshow.php?faq=96 -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From eyau at SDSU.EDU Thu Mar 7 18:35:26 2002 From: eyau at SDSU.EDU (Emily Yau) Date: Thu Jan 12 21:14:31 2006 Subject: McAfee autoupdate - Do I need to stop mailscanner first? Message-ID: Hi, Quick question... Is it okay to run the autoupdate script for McAfee (included with the MailScanner 3.11.1 tarball) while Mailscanner is running? Or should Mailscanner be stopped first? Thanks! From LISTSERV at JISCMAIL.AC.UK Thu Mar 7 18:14:29 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: sfarrell@ICCONSULTING.COM.AU left the JISCmail list Message-ID: <200203071814.SAA08754@magpie.ecs.soton.ac.uk> Thu, 7 Mar 2002 18:14:29 sfarrell@ICCONSULTING.COM.AU has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From jkf at ecs.soton.ac.uk Thu Mar 7 19:29:18 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:31 2006 Subject: McAfee autoupdate - Do I need to stop mailscanner first? In-Reply-To: Message-ID: <5.1.0.14.2.20020307192747.02859258@hawk.ecs.soton.ac.uk> At 18:35 07/03/2002, you wrote: >Is it okay to run the autoupdate script for McAfee (included with the >MailScanner 3.11.1 tarball) while Mailscanner is running? Or should >Mailscanner be stopped first? Download the latest version as there is a lockfile fix specifically to address a slight problem with this. But the answer is "it is quite safe to run autoupdate while MailScanner is running", as there is a lockfile shared between the 2 processes to ensure that only one is accessing the DAT files at a time. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 7 20:49:17 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: kylist@SHCORP.COM requested to join Message-ID: <200203072049.UAA08387@magpie.ecs.soton.ac.uk> Thu, 7 Mar 2002 20:49:17 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Kurt Yoder You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER kylist@SHCORP.COM Kurt Yoder PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER kylist@SHCORP.COM Kurt Yoder // EOJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 7 23:21:06 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: sbleau@QDOBA.COM requested to join Message-ID: <200203072321.XAA06955@magpie.ecs.soton.ac.uk> Thu, 7 Mar 2002 23:21:06 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Scott Bleau You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER sbleau@QDOBA.COM Scott Bleau PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER sbleau@QDOBA.COM Scott Bleau // EOJ From home at SIMONB.ORG.UK Fri Mar 8 09:04:43 2002 From: home at SIMONB.ORG.UK (Simon Blandford) Date: Thu Jan 12 21:14:31 2006 Subject: Installation on RAQ4 Message-ID: Thanks for the tip, Julian. Much appreciated. Have a great holiday! SimonB. From home at SIMONB.ORG.UK Fri Mar 8 09:05:02 2002 From: home at SIMONB.ORG.UK (Simon Blandford) Date: Thu Jan 12 21:14:31 2006 Subject: Installation on RAQ4 Message-ID: Thanks for the tip, Julian. Much appreciated. Have a great holiday! SimonB. On Thu, 7 Mar 2002 18:10:57 +0000, Julian Field wrote: >At 17:54 07/03/2002, you wrote: >>I found some issues installing Mailscanner on a Cobalt RAQ4. I installed >>from the rpm file. > >Read this: >http://www.uk2raq.com/raqfaq/raqfaqshow.php?faq=96 >-- >Julian Field Teaching Systems Manager >jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science >Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ From Denis.Beauchemin at USHERBROOKE.CA Fri Mar 8 14:15:56 2002 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:14:31 2006 Subject: Newbie questions Message-ID: <1015596977.23959.29.camel@dbeauchemin.si.usherb.ca> Hi, I am seriously considering installing MailScanner as a replacement for Anomy here at Universit? de Sherbrooke. But I have a few questions: ;-) 1- would a French version be available somewhere? If not, are all the files that would need translating in the /usr/local/MailScanner/etc directory? 2- could it be used on a mail gateway that accepts emails for many domains, scans them and then dispatchs them to other mail hosts? (the doc seems to say so) 3- the documentation says that "It is easy to install into an existing e-mail gateway, requiring very little knowledge of sendmail and no change to an existing sendmail configuration."; it also says "All the required changes can be easily done by editing the commands used to start sendmail." but I can't find more on the subject... is this magical? Thanks! -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From jkf at ecs.soton.ac.uk Fri Mar 8 14:38:09 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:31 2006 Subject: Newbie questions In-Reply-To: <1015596977.23959.29.camel@dbeauchemin.si.usherb.ca> Message-ID: <5.1.0.14.2.20020308143528.05a8e558@imap.ecs.soton.ac.uk> At 14:15 08/03/2002, you wrote: >1- would a French version be available somewhere? If not, are all the >files that would need translating in the /usr/local/MailScanner/etc >directory? Apart from the message to the local Postmaster (which is very brief anyway and not seen by normal users), all the translations needed are in the /usr/local/MailScanner/etc directory. >2- could it be used on a mail gateway that accepts emails for many >domains, scans them and then dispatchs them to other mail hosts? (the >doc seems to say so) Yes, it will drop into your existing sendmail configuration. >3- the documentation says that "It is easy to install into an existing >e-mail gateway, requiring very little knowledge of sendmail and no >change to an existing sendmail configuration."; it also says "All the >required changes can be easily done by editing the commands used to >start sendmail." but I can't find more on the subject... is this >magical? Read the installation guides on the web site. If you are installing on a Linux system, then the RPM will insert the init.d startup script for you. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From brose at MED.WAYNE.EDU Fri Mar 8 14:45:57 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:31 2006 Subject: Newbie questions Message-ID: 1) Yes. All the text files are the ones that mailscanner uses to replace message bodies of infected messages, etc. 2) Yes 3) What you are doing is changing sendmail so that it has an incoming queue and an outgoing queue. Default sendmail has a single queue to process all incoming and outgoing. Mailscanner runs in between. It picks up the incoming mail, scans it and moves it to the outgoing. Example: /usr/lib/sendmail -bd -ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in /usr/lib/sendmail -q5m /opt/mailscanner/bin/check_mailscanner -----Original Message----- From: Denis Beauchemin [mailto:Denis.Beauchemin@USHERBROOKE.CA] Sent: Friday, March 08, 2002 9:16 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Newbie questions Hi, I am seriously considering installing MailScanner as a replacement for Anomy here at Universit? de Sherbrooke. But I have a few questions: ;-) 1- would a French version be available somewhere? If not, are all the files that would need translating in the /usr/local/MailScanner/etc directory? 2- could it be used on a mail gateway that accepts emails for many domains, scans them and then dispatchs them to other mail hosts? (the doc seems to say so) 3- the documentation says that "It is easy to install into an existing e-mail gateway, requiring very little knowledge of sendmail and no change to an existing sendmail configuration."; it also says "All the required changes can be easily done by editing the commands used to start sendmail." but I can't find more on the subject... is this magical? Thanks! -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From kylist at SHCORP.COM Fri Mar 8 20:17:07 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:31 2006 Subject: mailscanner setup on debian? Message-ID: <39150.10.10.1.95.1015618627.squirrel@webmail.shcorp.com> Hello list I am trying to set up mailscanner on Debian using the .deb package. The instructions on the mailscanner site don't seem to apply to the Debian setup of mailscanner. At the mailscanner site, I see "Currently, your copy of sendmail will be started by a script such as /etc/init.d/mail or /etc/rc.d/init.d/sendmail. Somewhere in this script will be the command to start sendmail itself. This should look like this: sendmail -bd -q15m You should change this to the following two lines: sendmail -bd -ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in sendmail -q15m" However, in my Debian install (yes, I am using sendmail, not exim), I can't find any references to "sendmail -bd -q15m". Anyone have any ideas what I'm supposed to do? -- Kurt Yoder Sport & Health network administrator From LISTSERV at JISCMAIL.AC.UK Fri Mar 8 21:02:03 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: pp@UNI-FFM.DE requested to join Message-ID: <200203082102.VAA10753@magpie.ecs.soton.ac.uk> Fri, 8 Mar 2002 21:02:03 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Arnold Jaeger You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER pp@UNI-FFM.DE Arnold Jaeger PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER pp@UNI-FFM.DE Arnold Jaeger // EOJ From fizz at BOMB.NET Fri Mar 8 21:57:34 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:31 2006 Subject: Newbie questions References: <1015596977.23959.29.camel@dbeauchemin.si.usherb.ca> Message-ID: <000f01c1c6ec$4161e240$48cf75cc@fizz> probably the easiest thing to do would be to look at the install files for your platform. It does work on email gateways, infact thats what its primary purose was (i beleive) anywayz, thats what i use it for. As far as another language, the only thing you should have to change would be a few settings in the mailscanner.conf file for when a message is sent out that was cleaned or whatever. As far as 3, were just changing the command line for starting sendmail. The rest is up to mailscanner and whatever virus package you decide to use. Hope this helps, Kelly ----- Original Message ----- From: "Denis Beauchemin" To: Sent: Friday, March 08, 2002 9:15 AM Subject: Newbie questions Hi, I am seriously considering installing MailScanner as a replacement for Anomy here at Universit? de Sherbrooke. But I have a few questions: ;-) 1- would a French version be available somewhere? If not, are all the files that would need translating in the /usr/local/MailScanner/etc directory? 2- could it be used on a mail gateway that accepts emails for many domains, scans them and then dispatchs them to other mail hosts? (the doc seems to say so) 3- the documentation says that "It is easy to install into an existing e-mail gateway, requiring very little knowledge of sendmail and no change to an existing sendmail configuration."; it also says "All the required changes can be easily done by editing the commands used to start sendmail." but I can't find more on the subject... is this magical? Thanks! -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From fizz at BOMB.NET Fri Mar 8 23:21:41 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:31 2006 Subject: Strange Problem.. Message-ID: <003d01c1c6f8$0140af50$ac722241@fizz> I updated my mailscanner to the latest version as of today, i was running one a bit older, before domain scanning. Anywayz, after i updated, it cant keep up with the queue now, i edited mailscanner and changed the sleep time from 30 to 5, and im using Batch, and deliver in background. Any thing you can think of that might help? Thanks.. Kely -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020308/3e451dc3/attachment.html From eyau at SDSU.EDU Sat Mar 9 01:02:24 2002 From: eyau at SDSU.EDU (Emily Yau) Date: Thu Jan 12 21:14:31 2006 Subject: McAfee autoupdate - Do I need to stop mailscanner first? Message-ID: Thanks! I went back to try to figure out how things worked, and found the lock file you were referring to. In doing more research, I have another question :) sweep.pl refers to a lock called McAfeeBusy.lock, and I see this file in /tmp But, autoupdate refers to a lock called (/tmp) McafeeBusy.lock (A is not capitalized). Should this be the same? Thanks! Emily ...running on Solaris From LISTSERV at JISCMAIL.AC.UK Fri Mar 8 22:13:53 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: jerry@PRIMAL.UCDAVIS.EDU left the JISCmail list Message-ID: <200203082213.WAA24092@magpie.ecs.soton.ac.uk> Fri, 8 Mar 2002 22:13:53 Jerry Nishimoto has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Fri Mar 8 22:24:25 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: listas@RIEDER.NET.PY requested to join Message-ID: <200203082224.WAA26127@magpie.ecs.soton.ac.uk> Fri, 8 Mar 2002 22:24:25 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Pablo Capo You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER listas@RIEDER.NET.PY Pablo Capo PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER listas@RIEDER.NET.PY Pablo Capo // EOJ From jkf at ecs.soton.ac.uk Sat Mar 9 10:47:48 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:31 2006 Subject: McAfee autoupdate - Do I need to stop mailscanner first? In-Reply-To: Message-ID: <5.1.0.14.2.20020309104709.04d81050@hawk.ecs.soton.ac.uk> At 01:02 09/03/2002, you wrote: >sweep.pl refers to a lock called McAfeeBusy.lock, and I see this file in >/tmp >But, autoupdate refers to a lock called (/tmp) McafeeBusy.lock (A is not >capitalized). Should this be the same? Yes it should. This mistake has already been fixed and is okay in the current version. Well spotted though! -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From tal at MUSICGENOME.COM Sun Mar 10 09:09:04 2002 From: tal at MUSICGENOME.COM (Tal Kelrich) Date: Thu Jan 12 21:14:31 2006 Subject: [Fwd: On the ultimate futility of server-based mail scanning] Message-ID: <1015751344.6384.16.camel@localhost.localdomain> Just thought this might be of interest -- Tal Kelrich PGP Fingerprint: 3EDF FCC5 60BB 4729 AB2F CAE6 FEC1 9AAC 12B9 AA69 PGP key-id: 12B9AA69 -------------- next part -------------- An embedded message was scrubbed... From: "David F. Skoll" Subject: On the ultimate futility of server-based mail scanning Date: Mon, 4 Mar 2002 17:07:29 -0500 (EST) Size: 2988 Url: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020310/b11345a2/attachment.mht From doko at CS.TU-BERLIN.DE Sun Mar 10 22:10:51 2002 From: doko at CS.TU-BERLIN.DE (Matthias Klose) Date: Thu Jan 12 21:14:31 2006 Subject: mailscanner setup on debian? In-Reply-To: <39150.10.10.1.95.1015618627.squirrel@webmail.shcorp.com> References: <39150.10.10.1.95.1015618627.squirrel@webmail.shcorp.com> Message-ID: <15499.55787.368903.327546@gargle.gargle.HOWL> Kurt Yoder writes: > Hello list > > I am trying to set up mailscanner on Debian using the .deb package. The > instructions on the mailscanner site don't seem to apply to the Debian setup > of mailscanner. At the mailscanner site, I see > > "Currently, your copy of sendmail will be started by a script such as > /etc/init.d/mail or /etc/rc.d/init.d/sendmail. Somewhere in this script will > be the command to start sendmail itself. This should look like this: > > sendmail -bd -q15m > > You should change this to the following two lines: > > sendmail -bd -ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in > sendmail -q15m" > > However, in my Debian install (yes, I am using sendmail, not exim), I can't > find any references to "sendmail -bd -q15m". Anyone have any ideas what I'm > supposed to do? at least exim can be configured to be started as a daemon or from inetd. I never used sendmail ... I'll happily include a description, how to setup mailscanner with sendmail in the package ... Matthias From David.Sullivan at BARNET.AC.UK Mon Mar 11 10:55:19 2002 From: David.Sullivan at BARNET.AC.UK (David Sullivan) Date: Thu Jan 12 21:14:31 2006 Subject: Viruses - Missed by mailscanner, caught by Sophos NSV Message-ID: <3C8C8D15.32455.1E4C3DB7@localhost> We've recently upgraded to the Sophos NSV (non standard version) on Netware and as an added feature it seems to be scanning and picking up viruses in mime attachments as Mercury delivers them since this version now can parse mime messages. Since we run mailscanner at our mail hub we certainly *shouldn't* see any infected messages from outside. The following message seems to be a spanner in the works however: (names changed to protect the innocent) ... http://www.barnet.ac.uk/~sully/missed.txt This message has passed through the server running mailscanner (delta) and has even been marked "Found to be clean" by mailscanner itself when at the very least it should have been rejected since we are blocking all "exe" type attachments. I can't see anything obviously wrong with the message itself other than the fact there seems to be an odd character in the message subject line "of FormInsert Heading Here Type", perhaps this is upsetting the mime parser perhaps? We're running version MailScanner-3.11-1 and version 5.411of the MIME::Tools perl module. I've a sneaking suspicion that upgrading to the NSV version of sophos for Linux would have caught this but it's a little concerning that new "hot off the press" viruses that don't have an ide file yet but are propgated as an exe file in e-mail might be missed. Any thoughts? -- David Sullivan IT Services, Barnet College, London David.Sullivan@barnet.ac.uk 020 8275 5036 ============================================================== This communication may contain privileged or confidential information which is for the exclusive use of the intended recipient. If you are not the intended recipient, please note that you may not distribute or use this communication or the information it contains. If this e-mail has reached you in error, please delete it and any attachment. Internet communications are not secure and Barnet College does not accept legal responsibility for the content of this message. Any views or opinions expressed are those of the author and not necessarily those of Barnet College. Please note that Barnet College reserves the right to monitor the source/destinations of all incoming or outgoing e-mail communications. ============================================================== From LISTSERV at JISCMAIL.AC.UK Sat Mar 9 19:52:05 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: robert@WEBTENT.COM requested to join Message-ID: <200203091952.TAA26665@magpie.ecs.soton.ac.uk> Sat, 9 Mar 2002 19:52:05 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Robert Fitzpatrick You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER robert@WEBTENT.COM Robert Fitzpatrick PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER robert@WEBTENT.COM Robert Fitzpatrick // EOJ From kylist at SHCORP.COM Mon Mar 11 15:33:46 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:31 2006 Subject: mailscanner setup on debian? In-Reply-To: <15499.55787.368903.327546@gargle.gargle.HOWL> References: <15499.55787.368903.327546@gargle.gargle.HOWL> Message-ID: <43479.10.10.1.95.1015860826.squirrel@webmail.shcorp.com> Matthias Klose said: > Kurt Yoder writes: >> Hello list >> >> I am trying to set up mailscanner on Debian using the .deb package. >> The instructions on the mailscanner site don't seem to apply to the >> Debian setup of mailscanner. At the mailscanner site, I see >> >> "Currently, your copy of sendmail will be started by a script such as >> /etc/init.d/mail or /etc/rc.d/init.d/sendmail. Somewhere in this >> script will be the command to start sendmail itself. This should look >> like this: >> >> sendmail -bd -q15m >> >> You should change this to the following two lines: >> >> sendmail -bd -ODeliveryMode=queueonly >> -OQueueDirectory=/var/spool/mqueue.in >> sendmail -q15m" >> >> However, in my Debian install (yes, I am using sendmail, not exim), I >> can't find any references to "sendmail -bd -q15m". Anyone have any >> ideas what I'm supposed to do? > > at least exim can be configured to be started as a daemon or from > inetd. I never used sendmail ... I'll happily include a description, > how to setup mailscanner with sendmail in the package ... > > Matthias OK; can you send me your docs whenever you get them? Thanks -- Kurt Yoder Sport & Health network administrator From HancockS at MORGANCO.COM Mon Mar 11 15:44:28 2002 From: HancockS at MORGANCO.COM (Hancock, Scott) Date: Thu Jan 12 21:14:31 2006 Subject: mailscanner setup on debian? Message-ID: Please send me the Docs as well. I hope to install on debian in the next 2 weeks. Thank you Scott Hancock hancocks@morganco.com Morgan Co. > > at least exim can be configured to be started as a daemon or from > > inetd. I never used sendmail ... I'll happily include a description, > > how to setup mailscanner with sendmail in the package ... > > > > Matthias > > OK; can you send me your docs whenever you get them? > > Thanks > > -- > Kurt Yoder > Sport & Health network administrator > From R.A.Gardener at SHU.AC.UK Tue Mar 12 08:58:46 2002 From: R.A.Gardener at SHU.AC.UK (Ray Gardener) Date: Thu Jan 12 21:14:31 2006 Subject: Viruses - Missed by mailscanner, caught by Sophos NSV References: <3C8C8D15.32455.1E4C3DB7@localhost> Message-ID: <000c01c1c9a4$21964400$5a14348f@videoproducer> ----- Original Message ----- From: "David Sullivan" To: Sent: Monday, March 11, 2002 10:55 AM Subject: Viruses - Missed by mailscanner, caught by Sophos NSV > We've recently upgraded to the Sophos NSV (non standard version) on Netware and > as an added feature it seems to be scanning and picking up viruses in mime > attachments as Mercury delivers them since this version now can parse mime > messages. Since we run mailscanner at our mail hub we certainly *shouldn't* see > any infected messages from outside. > > The following message seems to be a spanner in the works however: (names > changed to protect the innocent) ... > http://www.barnet.ac.uk/~sully/missed.txt David, which virus did Sophos NSV report and what version of Sophos are you running on the hubs? I had a quick look at the text of the message in Pine on Unix. Pine (usually fairly good with mime) seems unable to recognise the section containing the executable as a valid mime part. Did your MUA show this as a mime attachment? To me this looks similar to the stuff produced by sircam which tries to generate mine attachments but not always in a compliant way. Regards, Ray Gardener > From David.Sullivan at BARNET.AC.UK Tue Mar 12 10:49:38 2002 From: David.Sullivan at BARNET.AC.UK (David Sullivan) Date: Thu Jan 12 21:14:31 2006 Subject: Viruses - Missed by mailscanner, caught by Sophos NSV In-Reply-To: <000c01c1c9a4$21964400$5a14348f@videoproducer> Message-ID: <3C8DDD5A.24225.236DCD9C@localhost> On 12 Mar 2002 at 8:58, Ray Gardener wrote: > > We've recently upgraded to the Sophos NSV (non standard version) on > Netware and > > as an added feature it seems to be scanning and picking up viruses in mime > > attachments as Mercury delivers them since this version now can parse mime > > messages. Since we run mailscanner at our mail hub we certainly > *shouldn't* see > > any infected messages from outside. > > > > The following message seems to be a spanner in the works however: (names > > changed to protect the innocent) ... > > http://www.barnet.ac.uk/~sully/missed.txt > > David, > > which virus did Sophos NSV report and what version of Sophos are you running > on the hubs? Real-time: >>> Virus 'W32/Magistr-A' found in file STAFF:/*****/PMAIL/Y08850/SULFNBK.EXE Reported by 3.55NSV on Netware, we're still running 3.54 on Linux on the mailhub, I will be upgrading soon once I've fixed up MailScanner to be happy with the nsv version as covered previously > > I had a quick look at the text of the message in Pine on Unix. Pine (usually > fairly good with mime) seems unable to recognise the section containing the > executable as a valid mime part. Did your MUA show this as a mime > attachment? Pegasus Mail 3.12 and 4 show this message to be a valid MIME message with the attachment as mime part, as soon as I save the attachment the sophos picks up the virus straight away. > To me this looks similar to the stuff produced by sircam which tries to > generate mine attachments but not always in a compliant way. The problem being, compliant or not a number of MUAs have been written to parse all kinds of rubbish that has been thrown at them generated by other less compliant MUAs If sweep can do it's own parsing and potentially pick up things that MailScanner's mime parser doesn't it might be the case of going down the same road as TNEF and use sweep in preference to parsing MIME ourselves. -- David Sullivan IT Services, Barnet College, London David.Sullivan@barnet.ac.uk 020 8275 5036 ============================================================== This communication may contain privileged or confidential information which is for the exclusive use of the intended recipient. If you are not the intended recipient, please note that you may not distribute or use this communication or the information it contains. If this e-mail has reached you in error, please delete it and any attachment. Internet communications are not secure and Barnet College does not accept legal responsibility for the content of this message. Any views or opinions expressed are those of the author and not necessarily those of Barnet College. Please note that Barnet College reserves the right to monitor the source/destinations of all incoming or outgoing e-mail communications. ============================================================== From R.A.Gardener at SHU.AC.UK Tue Mar 12 16:22:18 2002 From: R.A.Gardener at SHU.AC.UK (Ray Gardener) Date: Thu Jan 12 21:14:31 2006 Subject: Viruses - Missed by mailscanner, caught by Sophos NSV In-Reply-To: <3C8DDD5A.24225.236DCD9C@localhost> Message-ID: On Tue, 12 Mar 2002, David Sullivan wrote: > > > The following message seems to be a spanner in the works however: (names > > > changed to protect the innocent) ... > > > http://www.barnet.ac.uk/~sully/missed.txt > > > > David, > > > > which virus did Sophos NSV report and what version of Sophos are you running > > on the hubs? > > Real-time: >>> Virus 'W32/Magistr-A' found in file > STAFF:/*****/PMAIL/Y08850/SULFNBK.EXE > Reported by 3.55NSV on Netware, we're still running 3.54 on Linux on the > mailhub, I will be upgrading soon once I've fixed up MailScanner to be happy > with the nsv version as covered previously After more investigation I can see that our second layer virus scanning at the Exchange level is also picking up instances of viruses that should be screened out by mailscanner. Most of the instances involve the virus Magistr-A David, you are right in believing the new enhanced version 3.55NSV detects and disinfects this ;-). However there is still a problem for those people who aren't using sophos :-( > If sweep can do it's own parsing and potentially pick up things that > MailScanner's mime parser doesn't it might be the case of going down the same > road as TNEF and use sweep in preference to parsing MIME ourselves. I agree partly, however I would prefer to leave in the mailscanner parsing as I think mailscanner needs it to filter for prohibited filenames and filetypes and it can work in addition to Sophos 3.55NSV parsing. > > -- > David Sullivan IT Services, Barnet College, London > David.Sullivan@barnet.ac.uk > 020 8275 5036 > > ============================================================== > This communication may contain privileged or confidential information which > is for the exclusive use of the intended recipient. If you are not the > intended recipient, please note that you may not distribute or use this > communication or the information it contains. If this e-mail has reached you > in error, please delete it and any attachment. > > Internet communications are not secure and Barnet College does not accept > legal responsibility for the content of this message. Any views or opinions > expressed are those of the author and not necessarily those of Barnet College. > > Please note that Barnet College reserves the right to monitor the > source/destinations of all incoming or outgoing e-mail communications. > ============================================================== > From fizz at BOMB.NET Thu Mar 14 00:38:12 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:31 2006 Subject: Questions Re: Spamassassin and Mailscanner Message-ID: <000a01c1caf0$85ff7e00$ac722241@fizz> Mailscanner seems to help with spam quite a bit, but with spamassassin it works great. Im running 2.1 of spamassassin and latest mailscanner, my question to you is, Which config file do we use for spamassassin? i see one in /root/.spamassassin/user_prefs and also in /etc/mail/spamassassin/local.cf I have a bunch of custom settings in local.cf, but i include my threshhold in both local.cf and user_prefs because im not sure which file is read. I guess what im looking for is a little more information on how spamassassin is actually called from mailscanner. Any help would be great, cause i still have the occaisional idiot saying ALL his mail is marked as spam. Then he tries telling me that nextel, and this other crap ISNT spam lol wish there was a way to just make the scanner NOT do anything for mail for certain people :P i could care less if he got a virus. Kelly -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020313/54fbabe9/attachment.html From brose at MED.WAYNE.EDU Thu Mar 14 02:41:47 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:31 2006 Subject: Unparseable Rich Text Format Message-ID: Does anyone know the conditions that must occur for this to happen? I know that rich text formatting generates the tnef and winmail.dat but I'm not certain what causes tnef extractor not to be able to unencode the message. I seem to see it a lot more with the Outlook for the Mac and I'm curious as to what may generate it more with them. -=B From darian at BEPINC.COM Thu Mar 14 15:43:35 2002 From: darian at BEPINC.COM (Darian Rafie) Date: Thu Jan 12 21:14:31 2006 Subject: Questions Re: Spamassassin and Mailscanner In-Reply-To: <000a01c1caf0$85ff7e00$ac722241@fizz> Message-ID: <002b01c1cb6f$041ccfd0$11c9dbd1@WONDER> You should probably refer this question to the SA-Talk list : Spamassassin-talk mailing list Spamassassin-talk@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/spamassassin-talk The user_prefs located in the /root directory will apply only to root. local.cf applies site wide to all your users. You can configure spamassassin to allow all spam through for certain accounts. Check the documentation or inquire at the SA-Talk list. take care, d. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Kelly Hamlin Sent: Wednesday, March 13, 2002 6:38 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Questions Re: Spamassassin and Mailscanner Mailscanner seems to help with spam quite a bit, but with spamassassin it works great. Im running 2.1 of spamassassin and latest mailscanner, my question to you is, Which config file do we use for spamassassin? i see one in /root/.spamassassin/user_prefs and also in /etc/mail/spamassassin/local.cf I have a bunch of custom settings in local.cf, but i include my threshhold in both local.cf and user_prefs because im not sure which file is read. I guess what im looking for is a little more information on how spamassassin is actually called from mailscanner. Any help would be great, cause i still have the occaisional idiot saying ALL his mail is marked as spam. Then he tries telling me that nextel, and this other crap ISNT spam lol wish there was a way to just make the scanner NOT do anything for mail for certain people :P i could care less if he got a virus. Kelly -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020314/903c71a9/attachment.html From kylist at SHCORP.COM Thu Mar 14 19:30:34 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:31 2006 Subject: (answered) Re: mailscanner setup on debian? In-Reply-To: <15499.55787.368903.327546@gargle.gargle.HOWL> References: <15499.55787.368903.327546@gargle.gargle.HOWL> Message-ID: <51180.10.10.1.95.1016134234.squirrel@webmail.shcorp.com> About a week ago I posted a message asking how to do the Sendmail setup under Debian as detailed in the mailscanner setup instructions: "Currently, your copy of sendmail will be started by a script such as /etc/init.d/mail or /etc/rc.d/init.d/sendmail. Somewhere in this script will be the command to start sendmail itself. This should look like this: sendmail -bd -q15m You should change this to the following two lines: sendmail -bd -ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in sendmail -q15m" OK, this is how I did it with *Sendmail* on Debian: edit /etc/mail/sendmail.conf find the line DAEMON_PARMS=""; and change it to DAEMON_PARMS="-ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in"; (note there is *no*line*break* in the previous line; my composer has inserted it) run /etc/init.d/sendmail stop run /etc/init.d/sendmail start (note: don't do /etc/init.d/sendmail restart, it doesn't reload the configuration correctly) Then of course follow the rest of the setup instructions on the mailscanner site... HTH for all you Debian folks -- Kurt Yoder Sport & Health network administrator From kylist at SHCORP.COM Thu Mar 14 19:33:27 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:31 2006 Subject: (answered) Re: mailscanner setup on debian? In-Reply-To: <51180.10.10.1.95.1016134234.squirrel@webmail.shcorp.com> References: <51180.10.10.1.95.1016134234.squirrel@webmail.shcorp.com> Message-ID: <51186.10.10.1.95.1016134407.squirrel@webmail.shcorp.com> I forgot to add a step below Kurt Yoder said: > About a week ago I posted a message asking how to do the Sendmail setup > under Debian as detailed in the mailscanner setup instructions: > > "Currently, your copy of sendmail will be started by a script such as > /etc/init.d/mail or /etc/rc.d/init.d/sendmail. Somewhere in this script > will be the command to start sendmail itself. This should look like > this: > > sendmail -bd -q15m > > You should change this to the following two lines: > > sendmail -bd -ODeliveryMode=queueonly > -OQueueDirectory=/var/spool/mqueue.in > sendmail -q15m" > > OK, this is how I did it with *Sendmail* on Debian: > > edit /etc/mail/sendmail.conf > > find the line > > DAEMON_PARMS=""; > > and change it to > > DAEMON_PARMS="-ODeliveryMode=queueonly > -OQueueDirectory=/var/spool/mqueue.in"; > (note there is *no*line*break* in the previous line; my composer has > inserted it) Add this step: run /usr/sbin/sendmailconfig > run /etc/init.d/sendmail stop > run /etc/init.d/sendmail start > > (note: don't do /etc/init.d/sendmail restart, it doesn't reload the > configuration correctly) > > Then of course follow the rest of the setup instructions on the > mailscanner site... > > HTH for all you Debian folks -- Kurt Yoder Sport & Health network administrator From LISTSERV at JISCMAIL.AC.UK Mon Mar 11 17:42:54 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: matthew.richard@COCC.COM requested to join Message-ID: <200203111742.RAA05609@magpie.ecs.soton.ac.uk> Mon, 11 Mar 2002 17:42:54 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Matthew Richard You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER matthew.richard@COCC.COM Matthew Richard PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER matthew.richard@COCC.COM Matthew Richard // EOJ From LISTSERV at JISCMAIL.AC.UK Tue Mar 12 14:01:40 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: rajiv@W-O-I.COM requested to join Message-ID: <200203121401.OAA25724@magpie.ecs.soton.ac.uk> Tue, 12 Mar 2002 14:01:40 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Rajiv Shah You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER rajiv@W-O-I.COM Rajiv Shah PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER rajiv@W-O-I.COM Rajiv Shah // EOJ From LISTSERV at JISCMAIL.AC.UK Tue Mar 12 16:19:14 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:31 2006 Subject: MAILSCANNER: k.jackson@UNL.AC.UK requested to join Message-ID: <200203121619.QAA22891@magpie.ecs.soton.ac.uk> Tue, 12 Mar 2002 16:19:14 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Ken Jackson The following membership options have been requested: NOMIME DIGEST NOACK NOREPRO. You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER k.jackson@UNL.AC.UK Ken Jackson PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER k.jackson@UNL.AC.UK Ken Jackson SET MAILSCANNER NOMIME DIGEST NOACK NOREPRO FOR k.jackson@UNL.AC.UK // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 13 01:16:17 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: kmburris@TOWNSEND.COM requested to join Message-ID: <200203130116.BAA08943@magpie.ecs.soton.ac.uk> Wed, 13 Mar 2002 01:16:17 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Keith Burris You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER kmburris@TOWNSEND.COM Keith Burris PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER kmburris@TOWNSEND.COM Keith Burris // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 13 01:16:37 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: burriskm@LANETWORKS.COM requested to join Message-ID: <200203130116.BAA08946@magpie.ecs.soton.ac.uk> Wed, 13 Mar 2002 01:16:37 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Keith Burris You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER burriskm@LANETWORKS.COM Keith Burris PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER burriskm@LANETWORKS.COM Keith Burris // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 13 04:28:36 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: sparsons@COLUMBUS.RR.COM requested to join Message-ID: <200203130428.EAA15810@magpie.ecs.soton.ac.uk> Wed, 13 Mar 2002 04:28:36 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Steven Parsons You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER sparsons@COLUMBUS.RR.COM Steven Parsons PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER sparsons@COLUMBUS.RR.COM Steven Parsons // EOJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 14 15:05:58 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: Philip.Craven@LGU.AC.UK requested to join Message-ID: <200203141505.PAA01148@magpie.ecs.soton.ac.uk> Thu, 14 Mar 2002 15:05:58 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Philip Craven You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER Philip.Craven@LGU.AC.UK Philip Craven PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER Philip.Craven@LGU.AC.UK Philip Craven // EOJ From LISTSERV at JISCMAIL.AC.UK Fri Mar 15 13:16:15 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: percom@PRIDIE-BREWSTER.COM requested to join Message-ID: <200203151316.NAA18542@magpie.ecs.soton.ac.uk> Fri, 15 Mar 2002 13:16:15 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from John Appleby You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER percom@PRIDIE-BREWSTER.COM John Appleby PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER percom@PRIDIE-BREWSTER.COM John Appleby // EOJ From LISTSERV at JISCMAIL.AC.UK Fri Mar 15 14:49:16 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: paul_houselander@BRISTOL-CITY.GOV.UK requested to join Message-ID: <200203151449.OAA06328@magpie.ecs.soton.ac.uk> Fri, 15 Mar 2002 14:49:16 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Paul Houselander You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER paul_houselander@BRISTOL-CITY.GOV.UK Paul Houselander PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER paul_houselander@BRISTOL-CITY.GOV.UK Paul Houselander // EOJ From LISTSERV at JISCMAIL.AC.UK Fri Mar 15 18:35:07 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: Shech@UFGCA.COM requested to join Message-ID: <200203151835.SAA19680@magpie.ecs.soton.ac.uk> Fri, 15 Mar 2002 18:35:07 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Chuck Sheehan You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER Shech@UFGCA.COM Chuck Sheehan PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER Shech@UFGCA.COM Chuck Sheehan // EOJ From LISTSERV at JISCMAIL.AC.UK Mon Mar 18 02:14:40 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: mail@SIMONHUBBARD.COM requested to join Message-ID: <200203180214.CAA05761@magpie.ecs.soton.ac.uk> Mon, 18 Mar 2002 02:14:40 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Simon Hubbard You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mail@SIMONHUBBARD.COM Simon Hubbard PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mail@SIMONHUBBARD.COM Simon Hubbard // EOJ From LISTSERV at JISCMAIL.AC.UK Mon Mar 18 11:29:20 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: g.tranelli@INARCASSA.IT requested to join Message-ID: <200203181129.LAA19686@magpie.ecs.soton.ac.uk> Mon, 18 Mar 2002 11:29:20 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Gianluca Tranelli You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER g.tranelli@INARCASSA.IT Gianluca Tranelli PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER g.tranelli@INARCASSA.IT Gianluca Tranelli // EOJ From LISTSERV at JISCMAIL.AC.UK Mon Mar 18 16:54:44 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: slee@JONCTIONINTER.NET requested to join Message-ID: <200203181654.QAA23278@magpie.ecs.soton.ac.uk> Mon, 18 Mar 2002 16:54:44 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Stephane Lee You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER slee@JONCTIONINTER.NET Stephane Lee PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER slee@JONCTIONINTER.NET Stephane Lee // EOJ From fizz at BOMB.NET Wed Mar 20 00:44:38 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:32 2006 Subject: Any clue on this one? Message-ID: <000701c1cfa8$6a7e6c10$48cf75cc@fizz> Mailscanner 3.12-5 Today at around 3pm or so my email gateway running mailscanner went on the fritz. Mailscanner would take mail into its incoming dir and then do nothing. I would continuously do ps -x to see what its doing, then eventually it would go defunct. So i tried reinstalling.. no fix.. i tried changing settings... no good.. i did everything except redo the whole box. (Keep in mind on my MX 20 record it was running fine, and then as i started to write a HELP email to the list, it started working again. Its very strange, but any clue would be great, i just grew about 17 grey hairs working on this. heh thanks ////// ( o o ) +--.oooO--(_)--Oooo.-----------------+ | [Kelly Hamlin] | kellyh@cyberstreet.com | http://www.bomb.net | .oooO | ( ) Oooo. +--- \ (----( )----------------------------+ \_) ) / (_/ From nwp at LEMON-COMPUTING.COM Wed Mar 20 01:47:33 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:32 2006 Subject: [nwp: Re: Any clue on this one?] Message-ID: <20020320014733.GC14440@hoiho.nz.lemon-computing.com> On Tue, Mar 19, 2002 at 07:44:38PM -0500, Kelly Hamlin wrote: > nothing. I would continuously do ps -x to see what its doing, then ps tells you the status of a process (often "S", can be "R", "D"...) Any idea what this was most of the time? "top" is usually slightly more useful than "ps". And if you really want to know what a process is doing, then you need to trace what it's actually doing. On linux, you use "strace" or "ltrace". On Solaris, you want to look at "truss". These tools will tell you what system/library calls a program is making, which will tell you what's holding it up. Other than DNS holdups and long timeouts waiting for the virus scanner to finish, I don't know of anything that's likely to cause mailscanner that kind of problem. It does sound like it may have been one "awkward" message causing the problem though -- that would explain why it suddenly fixed itself. Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com You never know how many friends you have until you rent a house on the beach. From s.kelly at ayrcoll.ac.uk Wed Mar 20 11:00:16 2002 From: s.kelly at ayrcoll.ac.uk (Shane Kelly) Date: Thu Jan 12 21:14:32 2006 Subject: Any explanations gratefully recieved. Message-ID: <02032011001605.00658@ned> I got a call from a user who reported a virus in an email - this is such an unusual occurrence these days that I went personally to get the details. The following are the headers from the email, and the log entry pertaining to it. Any thoughts ? ************************** Headers ****************************** Received: from mailscanner.ayrcoll.ac.uk ([192.168.10.16]) by homer.ayrcoll.ac.uk with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21) id FKA69GK0; Tue, 19 Mar 2002 13:41:55 -0000 Received: from mercury.hol.gr (mercury.hol.gr [194.30.192.30]) by mailscanner.ayrcoll.ac.uk (8.11.6/8.11.6) with SMTP id g2JDk3j13255 for ; Tue, 19 Mar 2002 13:46:04 GMT Received: (qmail 7229 invoked from network); 19 Mar 2002 13:42:44 -0000 Received: from vdp053.ath02.cas.hol.gr (HELO vmail.hol.gr) (195.97.117.54) by mercury.hol.gr with SMTP; 19 Mar 2002 13:42:44 -0000 Date: Tue, 19 Mar 2002 13:46:04 GMT Message-Id: <200203191346.g2JDk3j13255@mailscanner.ayrcoll.ac.uk> FROM: Ksanthakos SUBJECT: #_?r?, ]m04UoY2??7, size=128271, class=0, nrcpts=1, msgid=<200203191346.g2JDk3j13255@mailscanner.ayrcoll.ac.uk>, bodytype=8BITMIME, proto=SMTP, daemon=MTA, relay=mercury.hol.gr [194.30.192.30] ********************/Log Entry*************************************** mailscanner is a mail gateway with mailscanner/sophos installation, the virus reported was magistra. Any help gratefully received. -- Shane Kelly Network Controller Ayr College 01292 265184 s.kelly@ayrcoll.ac.uk From David.Sullivan at BARNET.AC.UK Wed Mar 20 10:13:52 2002 From: David.Sullivan at BARNET.AC.UK (David Sullivan) Date: Thu Jan 12 21:14:32 2006 Subject: Any explanations gratefully recieved. In-Reply-To: <02032011001605.00658@ned> Message-ID: <3C9860E6.28010.8ADB46C@localhost> On 20 Mar 2002 at 11:00, Shane Kelly wrote: > I got a call from a user who reported a virus in an email - this is such an > unusual occurrence these days that I went personally to get the details. > > The following are the headers from the email, and the log entry pertaining to > it. Any thoughts ? > SUBJECT: #_?r?, > ]m04UoY2??7 > mailscanner is a mail gateway with mailscanner/sophos installation, the virus > reported was magistra. > See a previous thread on this: http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A1=ind0203&L=mailscanner#24 The headers of your message show that exactly the same virus and reasons that it was missed are involved. Regards -- David Sullivan IT Services, Barnet College, London David.Sullivan@barnet.ac.uk 020 8275 5036 This communication may contain privileged or confidential information which is for the exclusive use of the intended recipient. If you are not the intended recipient, please note that you may not distribute or use this communication or the information it contains. If this e-mail has reached you in error, please delete it and any attachment. Internet communications are not secure and Barnet College does not accept legal responsibility for the content of this message. Any views or opinions expressed are those of the author and not necessarily those of Barnet College. Please note that Barnet College reserves the right to monitor the source/destinations of all incoming or outgoing e-mail communications. From LISTSERV at JISCMAIL.AC.UK Tue Mar 19 17:18:33 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: mike@ZANKER.ORG requested to join Message-ID: <200203191718.RAA10899@magpie.ecs.soton.ac.uk> Tue, 19 Mar 2002 17:18:33 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Mike Zanker The following membership options have been requested: CONCEAL. You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mike@ZANKER.ORG Mike Zanker PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mike@ZANKER.ORG Mike Zanker SET MAILSCANNER CONCEAL FOR mike@ZANKER.ORG // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 20 12:22:50 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: ibrahim@TRIDOR.COM left the JISCmail list Message-ID: <200203201222.MAA22912@magpie.ecs.soton.ac.uk> Wed, 20 Mar 2002 12:22:50 Ibrahim Darwis has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Wed Mar 20 12:25:32 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: lufomat@COPPERNET.ZM requested to join Message-ID: <200203201225.MAA23500@magpie.ecs.soton.ac.uk> Wed, 20 Mar 2002 12:25:32 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Ted Lufoma You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER lufomat@COPPERNET.ZM Ted Lufoma PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER lufomat@COPPERNET.ZM Ted Lufoma // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 20 13:26:19 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: lbergman@ABI.TCONLINE.NET requested to join Message-ID: <200203201326.NAA06320@magpie.ecs.soton.ac.uk> Wed, 20 Mar 2002 13:26:19 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Lewis Bergman You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER lbergman@ABI.TCONLINE.NET Lewis Bergman PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER lbergman@ABI.TCONLINE.NET Lewis Bergman // EOJ From gerry at dorfam.ca Wed Mar 20 15:59:01 2002 From: gerry at dorfam.ca (Gerry Doris) Date: Thu Jan 12 21:14:32 2006 Subject: Test - Please Ignore Message-ID: <9153.129.80.22.134.1016639941.squirrel@tiger.dorfam.ca> I'm sorry for the test message but I've been having some problems. I built a new server and messed up my DNS server config (damn those "."). I was bouncing emails for about a day before I noticed something was wrong. I just want to be sure I'm still subscribed! Gerry From LISTSERV at JISCMAIL.AC.UK Wed Mar 20 16:03:53 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: jon@XNEXT.COM requested to join Message-ID: <200203201603.QAA09294@magpie.ecs.soton.ac.uk> Wed, 20 Mar 2002 16:03:53 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from "Jon (Xnext, Inc)" You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER jon@XNEXT.COM Jon (Xnext, Inc) PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER jon@XNEXT.COM Jon (Xnext, Inc) // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 20 16:15:20 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: live@GENERATION.NET requested to join Message-ID: <200203201615.QAA11585@magpie.ecs.soton.ac.uk> Wed, 20 Mar 2002 16:15:20 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Mike Nguyen You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER live@GENERATION.NET Mike Nguyen PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER live@GENERATION.NET Mike Nguyen // EOJ From fizz at BOMB.NET Wed Mar 20 19:32:07 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:32 2006 Subject: [nwp: Re: Any clue on this one?] References: <20020320014733.GC14440@hoiho.nz.lemon-computing.com> Message-ID: <000b01c1d045$ec36cde0$48cf75cc@fizz> 32591 root 0 0 9820 9820 1728 S 0.0 15.6 0:00 mailscanner 32595 root 3 0 0 0 0 Z 0.0 0.0 0:00 mailscanner i notice that sh occaisionally goes defunct also. i also notice when i turn spamassassin OFF it works. What i dont understand is why. I havent changed anything in the last couple weeks, so any help would be great. Thanks kelly ----- Original Message ----- From: "Nick Phillips" To: Sent: Tuesday, March 19, 2002 8:47 PM Subject: [nwp: Re: Any clue on this one?] > On Tue, Mar 19, 2002 at 07:44:38PM -0500, Kelly Hamlin wrote: > > > nothing. I would continuously do ps -x to see what its doing, then > > > ps tells you the status of a process (often "S", can be "R", "D"...) > Any idea what this was most of the time? > > "top" is usually slightly more useful than "ps". > > And if you really want to know what a process is doing, then you need to > trace what it's actually doing. On linux, you use "strace" or "ltrace". > > On Solaris, you want to look at "truss". > > These tools will tell you what system/library calls a program is making, > which will tell you what's holding it up. > > > Other than DNS holdups and long timeouts waiting for the virus scanner to > finish, I don't know of anything that's likely to cause mailscanner that > kind of problem. > > It does sound like it may have been one "awkward" message causing the problem > though -- that would explain why it suddenly fixed itself. > > > Cheers, > > > Nick > > -- > Nick Phillips -- nwp@lemon-computing.com > You never know how many friends you have until you rent a house on the beach. > From lbergman at abi.tconline.net Wed Mar 20 20:03:27 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:32 2006 Subject: Can you send spam to oblivion? Message-ID: <200203202003.g2KK3Rh22171@lewis.abi.tconline.net> I know using spamassassin and a procmail recipe you can send a confirmed spam hit to where you want (like /var/spool/spamassassin/spam/) When using MailScanner to filter spam is it possible to do the same thing? I don't really care about adding a subject line that says "**SPAM?**". I am trying to do this on a site-wide basis and any help would be appreciated. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From sparsons at COLUMBUS.RR.COM Wed Mar 20 20:28:04 2002 From: sparsons at COLUMBUS.RR.COM (Steven Parsons) Date: Thu Jan 12 21:14:32 2006 Subject: Usage Question Message-ID: <02a501c1d04d$bd13b890$63031841@rr.com> Ive just recently subscribed to this list to please forgive me if this has been asked - I was not able to find any faq's with this information. Im now running mailscanner - sopos (trial which I really like) and spam assassin. Setup is catching about 95% of my spam im very impressed (just my own account right now). Say you wanted to implement this in a site on a large scale - what kind of HW are some of you using - Say to filter for example under a million messages daily. Also in my above scenario would I only have to worry about licensing sopho's to be legal ? I appreciate any information or pointers anyone can give. Im looking to deploy this on a big scale as so far it looks like the most cost effective & efficient . Thanks Steven B. Parsons -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020320/fceb26b6/attachment.html From fizz at BOMB.NET Wed Mar 20 20:41:55 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:32 2006 Subject: Usage Question References: <02a501c1d04d$bd13b890$63031841@rr.com> Message-ID: <000b01c1d04f$ac445e00$48cf75cc@fizz> sophos liscence is ridiculous, but the trial never expires (*cough*) As far as hardware, i do about 30-45 thousand messages a day and my email gateway is a 233 with 128 megs of ram. Works great :) ----- Original Message ----- From: Steven Parsons To: MAILSCANNER@JISCMAIL.AC.UK Sent: Wednesday, March 20, 2002 3:28 PM Subject: Usage Question Ive just recently subscribed to this list to please forgive me if this has been asked - I was not able to find any faq's with this information. Im now running mailscanner - sopos (trial which I really like) and spam assassin. Setup is catching about 95% of my spam im very impressed (just my own account right now). Say you wanted to implement this in a site on a large scale - what kind of HW are some of you using - Say to filter for example under a million messages daily. Also in my above scenario would I only have to worry about licensing sopho's to be legal ? I appreciate any information or pointers anyone can give. Im looking to deploy this on a big scale as so far it looks like the most cost effective & efficient . Thanks Steven B. Parsons -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020320/8a7c4f90/attachment.html From brose at MED.WAYNE.EDU Wed Mar 20 20:46:15 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:32 2006 Subject: Can you send spam to oblivion? Message-ID: Go thru the list. I posted some diffs a couple weeks ago that may help. Did everyone here that Orbz shutdown? That blows! http://slashdot.org/article.pl?sid=02/03/20/1528246&mode=thread&tid=111 -----Original Message----- From: Lewis Bergman [mailto:lbergman@abi.tconline.net] Sent: Wednesday, March 20, 2002 3:03 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Can you send spam to oblivion? I know using spamassassin and a procmail recipe you can send a confirmed spam hit to where you want (like /var/spool/spamassassin/spam/) When using MailScanner to filter spam is it possible to do the same thing? I don't really care about adding a subject line that says "**SPAM?**". I am trying to do this on a site-wide basis and any help would be appreciated. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From jon at XNEXT.COM Wed Mar 20 20:46:33 2002 From: jon at XNEXT.COM (Jonothon Ortiz) Date: Thu Jan 12 21:14:32 2006 Subject: Usage Question In-Reply-To: <000b01c1d04f$ac445e00$48cf75cc@fizz> Message-ID: Quick Q for those who have had it work on the RaQ 4: I've followed the steps listed in the ukraq site but when i run start on mailscanner I get the following error: /etc/rc.d/init.d/mailscanner start Starting MailScanner: Directory /var/spool/mqueue/q(x) does not exist! at /usr/local/MailScanner/bin/logger.pl line 60. Now I know that directory exsists; and when I look in there I do find folders q1, q2, q3, q4, etc. etc.. so I'm assuming the (x) is a variable automatically replaced (or am I wrong?). Any ideas? :) Jonothon Ortiz Vice President Xnext, Inc. Ph: 863.298.9698 or 888.84.XNEXT http://www.Xnext.com mailto:jon@xnext.com ================================================================= This message is intended only for the use of the addressee and is PRIVILEGED and CONFIDENTIAL. This includes any attachment(s). ================================================================= SIGN UP FOR OUR NEWSLETTER TODAY AT WWW.XNEXT.COM ! ================================================================= -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Kelly Hamlin Sent: Wednesday, March 20, 2002 3:42 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Usage Question sophos liscence is ridiculous, but the trial never expires (*cough*) As far as hardware, i do about 30-45 thousand messages a day and my email gateway is a 233 with 128 megs of ram. Works great :) ----- Original Message ----- From: Steven Parsons To: MAILSCANNER@JISCMAIL.AC.UK Sent: Wednesday, March 20, 2002 3:28 PM Subject: Usage Question Ive just recently subscribed to this list to please forgive me if this has been asked - I was not able to find any faq's with this information. Im now running mailscanner - sopos (trial which I really like) and spam assassin. Setup is catching about 95% of my spam im very impressed (just my own account right now). Say you wanted to implement this in a site on a large scale - what kind of HW are some of you using - Say to filter for example under a million messages daily. Also in my above scenario would I only have to worry about licensing sopho's to be legal ? I appreciate any information or pointers anyone can give. Im looking to deploy this on a big scale as so far it looks like the most cost effective & efficient . Thanks Steven B. Parsons -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020320/74e898a6/attachment.html From sparsons at COLUMBUS.RR.COM Wed Mar 20 21:47:53 2002 From: sparsons at COLUMBUS.RR.COM (Steven Parsons) Date: Thu Jan 12 21:14:32 2006 Subject: Usage Question References: <02a501c1d04d$bd13b890$63031841@rr.com> <000b01c1d04f$ac445e00$48cf75cc@fizz> Message-ID: <03b501c1d058$e3b34280$63031841@rr.com> Thanks for the resp Kelly . I did find the mailscanner archives and I am getting some good info outa them. I have a couple Sun 420's loaded now with A1000's processing my email. They do about 2mil average daily both. I still have a bit of research to do before I can implement but it does look like a good solution. Be interested in hearing about any other large sites what kind of HW your using. Thanks Steven B. Parsons ----- Original Message ----- From: Kelly Hamlin To: MAILSCANNER@JISCMAIL.AC.UK Sent: Wednesday, March 20, 2002 3:41 PM Subject: Re: Usage Question sophos liscence is ridiculous, but the trial never expires (*cough*) As far as hardware, i do about 30-45 thousand messages a day and my email gateway is a 233 with 128 megs of ram. Works great :) ----- Original Message ----- From: Steven Parsons To: MAILSCANNER@JISCMAIL.AC.UK Sent: Wednesday, March 20, 2002 3:28 PM Subject: Usage Question Ive just recently subscribed to this list to please forgive me if this has been asked - I was not able to find any faq's with this information. Im now running mailscanner - sopos (trial which I really like) and spam assassin. Setup is catching about 95% of my spam im very impressed (just my own account right now). Say you wanted to implement this in a site on a large scale - what kind of HW are some of you using - Say to filter for example under a million messages daily. Also in my above scenario would I only have to worry about licensing sopho's to be legal ? I appreciate any information or pointers anyone can give. Im looking to deploy this on a big scale as so far it looks like the most cost effective & efficient . Thanks Steven B. Parsons -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020320/c6c4af20/attachment.html From nwp at LEMON-COMPUTING.COM Wed Mar 20 21:49:13 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:32 2006 Subject: [nwp: Re: Any clue on this one?] In-Reply-To: <000b01c1d045$ec36cde0$48cf75cc@fizz> References: <20020320014733.GC14440@hoiho.nz.lemon-computing.com> <000b01c1d045$ec36cde0$48cf75cc@fizz> Message-ID: <20020320214913.GJ15136@hoiho.nz.lemon-computing.com> On Wed, Mar 20, 2002 at 02:32:07PM -0500, Kelly Hamlin wrote: > 32591 root 0 0 9820 9820 1728 S 0.0 15.6 0:00 mailscanner > 32595 root 3 0 0 0 0 Z 0.0 0.0 0:00 mailscanner > > i notice that sh occaisionally goes defunct also. > i also notice when i turn spamassassin OFF it works. What i dont understand > is why. I havent changed anything in the last couple weeks, so any help > would be great. There's probably no problem with the above; it looks like it's just a child process that's finished but not been reaped yet. If it only happens with spamassassin on, it's probably the DNS thing again. I haven't got into using it with spamassassin really yet, so I can't really be much help on that. Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com Don't you feel more like you do now than you did when you came in? From nwp at LEMON-COMPUTING.COM Wed Mar 20 21:58:22 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:32 2006 Subject: Usage Question In-Reply-To: References: <000b01c1d04f$ac445e00$48cf75cc@fizz> Message-ID: <20020320215822.GK15136@hoiho.nz.lemon-computing.com> On Wed, Mar 20, 2002 at 03:46:33PM -0500, Jonothon Ortiz wrote: > Now I know that directory exsists; and when I look in there I do find > folders q1, q2, q3, q4, etc. etc.. so I'm assuming the (x) is a variable > automatically replaced (or am I wrong?). Any ideas? :) I don't think we deal with split spool directories... I don't know the sendmail option that turns this on, but I would try clearing out your queue, changing the relevant option, and trying again. Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com You are not dead yet. But watch for further reports. From sevans at FOUNDATION.SDSU.EDU Wed Mar 20 23:18:14 2002 From: sevans at FOUNDATION.SDSU.EDU (Steve Evans) Date: Thu Jan 12 21:14:32 2006 Subject: Adult Content Filter Message-ID: Anyone seen an adult content filter that will work with mailscanner? I'm not talking about SPAM from porn sites I'm talking about employees receiving spam from their friends outside of the organization. Steve Evans Computing Services SDSU Foundation 619 594-0653 From todd at DECAGON.COM Wed Mar 20 23:38:46 2002 From: todd at DECAGON.COM (Todd Martin) Date: Thu Jan 12 21:14:32 2006 Subject: Adult Content Filter In-Reply-To: References: Message-ID: If you are already using SpamAssassin, you can override and increase the default scores for their adult content rules. This is what I'm doing. If you're not currently using SpamAssassin with MailScanner, I can imagine a way to use it just to catch adult content. (assign manual rule values, subject line rewriting, procmail recipe to archive or drop). ~Todd >Anyone seen an adult content filter that will work with mailscanner? >I'm not talking about SPAM from porn sites I'm talking about employees >receiving spam from their friends outside of the organization. > >Steve Evans >Computing Services >SDSU Foundation >619 594-0653 From mail at SIMONHUBBARD.COM Thu Mar 21 10:10:44 2002 From: mail at SIMONHUBBARD.COM (Simon J Hubbard) Date: Thu Jan 12 21:14:32 2006 Subject: A few questions Message-ID: <009501c1d0c0$ad7cf3b0$c79cb7ca@SINT2000> Sorry these may be lame questions but I have to start somewhere: 1. I have MailScanner configured to use SpamAssassin. How do I know that SpamAssassin is actually working. I know that there is an extra header added for messages that fail the MailScanner RBL test. Is there an extra header added by MailScanner for messages that fail the heuristic spamassassin checks or are they just flagged by adding {SPAM} to the subject line. 2. I'd like to configure MailScanner to forward suspected SPAM messages to a central mailbox or folder. I've browsed the posting on the list but can see nothing on how this might be configured beit using MailScanner or sendmail+rules. Many thanks, Simon J Hubbard. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020321/480fcbbc/attachment.html From LISTSERV at JISCMAIL.AC.UK Wed Mar 20 17:21:00 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: dna@BRDINFO.RO requested to join Message-ID: <200203201721.RAA24624@magpie.ecs.soton.ac.uk> Wed, 20 Mar 2002 17:21:00 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Ionut STANESCU You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER dna@BRDINFO.RO Ionut STANESCU PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER dna@BRDINFO.RO Ionut STANESCU // EOJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 21 08:21:05 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:32 2006 Subject: MAILSCANNER: henrik@LEWANDER.COM requested to join Message-ID: <200203210821.IAA22816@magpie.ecs.soton.ac.uk> Thu, 21 Mar 2002 08:21:05 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Henrik Lewander You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER henrik@LEWANDER.COM Henrik Lewander PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER henrik@LEWANDER.COM Henrik Lewander // EOJ From thomas.zajic at NEO.AT Thu Mar 21 10:43:23 2002 From: thomas.zajic at NEO.AT (Thomas Zajic) Date: Thu Jan 12 21:14:33 2006 Subject: Usage Question In-Reply-To: <000b01c1d04f$ac445e00$48cf75cc@fizz>; from fizz@BOMB.NET on Wed, Mar 20, 2002 at 03:41:55PM -0500 References: <02a501c1d04d$bd13b890$63031841@rr.com> <000b01c1d04f$ac445e00$48cf75cc@fizz> Message-ID: <20020321114323.A18775@thomas.neo.at> On Wed, Mar 20, 2002 at 03:41:55PM -0500, Kelly Hamlin wrote: > sophos liscence is ridiculous, but the trial never expires (*cough*) Funny, just like McAfee's uvscan trial version! (*coughcough*) ;-) Thomas -- ----------------------------- Thomas Zajic System Administrator neo Software Produktions GmbH A T2 Company email: thomas.zajic@neo.at web: http://www.neo.at From evertjan at VANRAMSELAAR.NL Thu Mar 21 11:03:42 2002 From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar) Date: Thu Jan 12 21:14:33 2006 Subject: Sophos (was: Usage Question) In-Reply-To: <000b01c1d04f$ac445e00$48cf75cc@fizz> Message-ID: <009901c1d0c8$100ba600$65020a0a@galaxy> -----Original Message----- From: Kelly Hamlin Sent: Wednesday, March 20, 2002 9:42 PM > sophos liscence is ridiculous, but the trial never expires (*cough*) But how to do monthly updates for Sophos? The automated IDE-updating works fine, but the monthly updates can't be automated? -- Evert Jan van Ramselaar Van Ramselaar Info Tech ___ This message has been scanned for viruses and other dangerous content by Van Ramselaar Info Tech and is believed to be clean. See http://www.vr-it.com/emailpolicy.php From LISTSERV at JISCMAIL.AC.UK Thu Mar 21 10:00:17 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: Stephane.Lentz@ANSF.ALCATEL.FR requested to join Message-ID: <200203211000.KAA13326@magpie.ecs.soton.ac.uk> Thu, 21 Mar 2002 10:00:17 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Stephane Lentz You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER Stephane.Lentz@ANSF.ALCATEL.FR Stephane Lentz PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER Stephane.Lentz@ANSF.ALCATEL.FR Stephane Lentz // EOJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 21 10:31:20 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: tracey.roche@DIT.IE requested to join Message-ID: <200203211031.KAA19836@magpie.ecs.soton.ac.uk> Thu, 21 Mar 2002 10:31:20 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Tracey Roche You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER tracey.roche@DIT.IE Tracey Roche PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER tracey.roche@DIT.IE Tracey Roche // EOJ From paul_houselander at BRISTOL-CITY.GOV.UK Thu Mar 21 11:15:08 2002 From: paul_houselander at BRISTOL-CITY.GOV.UK (Paul Houselander) Date: Thu Jan 12 21:14:33 2006 Subject: Messages not being signed Message-ID: Ive noticed a few messages are not having the signature added? "Sign Clean Messages" is set to yes, and the majority of messages get signed. Cant seem to see a common factor, Mailscanner has definitely scanned the message as the header is added. Seems to have all been html messages but I receive html messages with the signature added as well. The messages are not encrypted either. Can anyone give any reasons why a message may not be signed? Paul Houselander Network & Intranet Support Officer Bristol City Council From nwp at LEMON-COMPUTING.COM Thu Mar 21 11:22:12 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:33 2006 Subject: Sophos (was: Usage Question) In-Reply-To: <009901c1d0c8$100ba600$65020a0a@galaxy> References: <000b01c1d04f$ac445e00$48cf75cc@fizz> <009901c1d0c8$100ba600$65020a0a@galaxy> Message-ID: <20020321112212.GQ15136@hoiho.nz.lemon-computing.com> On Thu, Mar 21, 2002 at 12:03:42PM +0100, Evert Jan van Ramselaar wrote: > -----Original Message----- > From: Kelly Hamlin > Sent: Wednesday, March 20, 2002 9:42 PM > > > sophos liscence is ridiculous, but the trial never expires (*cough*) > > But how to do monthly updates for Sophos? > The automated IDE-updating works fine, but the monthly updates can't be > automated? For a single server, no not really. If you're deploying across a network to more than one machine, then yes, kind of. Problem is that occasionally they (need to) change little things about the install. So if you assumed that the monthly update was like last month's, you might regret it. If however you have time to look over it once, then you can automate subsequent installs. -- Nick Phillips -- nwp@lemon-computing.com You are a fluke of the universe; you have no right to be here. From LISTSERV at JISCMAIL.AC.UK Thu Mar 21 14:59:41 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: nicolin.a@KEYCOMM.IT left the JISCmail list Message-ID: <200203211459.OAA14501@magpie.ecs.soton.ac.uk> Thu, 21 Mar 2002 14:59:41 -Andrea- -Nicolin- has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Thu Mar 21 16:12:20 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: jbagwell@YAHOO.COM requested to join Message-ID: <200203211612.QAA29858@magpie.ecs.soton.ac.uk> Thu, 21 Mar 2002 16:12:20 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Jane Bagwell You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER jbagwell@YAHOO.COM Jane Bagwell PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER jbagwell@YAHOO.COM Jane Bagwell // EOJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 21 16:44:07 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: hans@VALLDEN.COM left the JISCmail list Message-ID: <200203211644.QAA06721@magpie.ecs.soton.ac.uk> Thu, 21 Mar 2002 16:44:07 Hans Vallden has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From kmburris at TOWNSEND.COM Thu Mar 21 21:05:13 2002 From: kmburris at TOWNSEND.COM (Keith Burris) Date: Thu Jan 12 21:14:33 2006 Subject: Failed to lock ...: Invalid argument Message-ID: <20020321130513.A95098@townsend.com> Hi, all -- I am new to MailScanner so forgive me if this is a FAQ or the solution is obvious. I have read the docs and the FAQs fairly closely, so I don't think this issue has been addressed so far. I am attempting to install MailScanner 3-12-5 on a system running FreeBSD 4.5-Release-p2. Perl is version 5.00503 and the required modules have been built and installed via the FreeBSD ports system. Exim is the MTA and Sophos sweep is the AV engine. I believe I have correctly followed the installation instructions. MailScanner starts up, but messages queued by the "incoming" instance of Exim are processed. If I start MailScanner in debug mode, the captioned message appears in maillog. MailScanner is unable to acquire a lock for the message header files. If I fstat the incoming spool directory, no locks are reported except read locks on the parent directory. Can anyone point me in the right direction to solve this problem? Any assistance would be greatly appreciated. From nwp at LEMON-COMPUTING.COM Thu Mar 21 22:59:01 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:33 2006 Subject: Failed to lock ...: Invalid argument In-Reply-To: <20020321130513.A95098@townsend.com> References: <20020321130513.A95098@townsend.com> Message-ID: <20020321225901.GU15136@hoiho.nz.lemon-computing.com> On Thu, Mar 21, 2002 at 01:05:13PM -0800, Keith Burris wrote: > MailScanner starts up, but messages queued by the "incoming" instance of > Exim are processed. If I start MailScanner in debug mode, the captioned Not processed, I presume you mean? > Can anyone point me in the right direction to solve this problem? You probably need to add "/input" to the end of the directory specification you've given mailscanner for exim's incoming queue directory, rather than just the "/var/spool/exim" or whatever you have specified to exim. Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com This life is yours. Some of it was given to you; the rest, you made yourself. From LISTSERV at JISCMAIL.AC.UK Thu Mar 21 20:08:28 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: otsuarez@CASA.CULT.CU requested to join Message-ID: <200203212008.UAA18985@magpie.ecs.soton.ac.uk> Thu, 21 Mar 2002 20:08:28 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Osvaldo Suarez You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER otsuarez@CASA.CULT.CU Osvaldo Suarez PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER otsuarez@CASA.CULT.CU Osvaldo Suarez // EOJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 21 21:10:53 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: lundin@GYRE.RICHMOND.EDU requested to join Message-ID: <200203212110.VAA02146@magpie.ecs.soton.ac.uk> Thu, 21 Mar 2002 21:10:53 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from John Lundin You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER lundin@GYRE.RICHMOND.EDU John Lundin PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER lundin@GYRE.RICHMOND.EDU John Lundin // EOJ From kmburris at TOWNSEND.COM Fri Mar 22 00:50:35 2002 From: kmburris at TOWNSEND.COM (Keith Burris) Date: Thu Jan 12 21:14:33 2006 Subject: Failed to lock ...: Invalid argument Message-ID: <20020321165035.A98171@townsend.com> Hi, Nick -- Yes, I did mean that they are not being processed. Sorry if that caused any confusion. Thanks for being a good interpreter and for responding. The /input part of the directory spec is in mailscanner.conf. A typical (complete) message in maillog is: Mar 21 09:34:46 mail mailscanner[11751]: Failed to lock /var/spool/exim_incoming/input/16nrMo-0002jf-00-H: Invalid argument So MailScanner is actually trying to lock an Exim message header file, but can't. MailScanner is running as user exim and group mail. The permissions for the example file are: 134934 -rw------- 1 exim mail 1019 Mar 20 17:27 16nrMo-0002jf-00-H Any other thoughts? >>> "Nick Phillips" 3/21/02 2:59:01 PM >>> On Thu, Mar 21, 2002 at 01:05:13PM -0800, Keith Burris wrote: > MailScanner starts up, but messages queued by the "incoming" instance of > Exim are processed. If I start MailScanner in debug mode, the captioned Not processed, I presume you mean? > Can anyone point me in the right direction to solve this problem? You probably need to add "/input" to the end of the directory specification you've given mailscanner for exim's incoming queue directory, rather than just the "/var/spool/exim" or whatever you have specified to exim. Cheers, Nick -- Nick Phillips -- ??nwp@lemon-computing.com?? This life is yours. Some of it was given to you; the rest, you made yourself. From nwp at LEMON-COMPUTING.COM Fri Mar 22 01:49:53 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:33 2006 Subject: Failed to lock ...: Invalid argument Message-ID: <20020322014953.GB15136@hoiho.nz.lemon-computing.com> On Thu, Mar 21, 2002 at 04:50:35PM -0800, Keith Burris wrote: > Mar 21 09:34:46 mail mailscanner[11751]: Failed to lock /var/spool/exim_incoming/input/16nrMo-0002jf-00-H: Invalid argument > > So MailScanner is actually trying to lock an Exim message header file, > but can't. MailScanner is running as user exim and group mail. The > permissions for the example file are: > > 134934 -rw------- 1 exim mail 1019 Mar 20 17:27 16nrMo-0002jf-00-H > > Any other thoughts? You are *sure* that the ls output above is from the directory /var/spool/exim_incoming/input?? You've not messed with the locking setting in the mailscanner.conf? Your Exim is compiled with the usual locking setup? Exim version is what? Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com Try to relax and enjoy the crisis. From LISTSERV at JISCMAIL.AC.UK Fri Mar 22 11:18:59 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: ben.tullis@INFOMATRIX.COM requested to join Message-ID: <200203221118.LAA24636@magpie.ecs.soton.ac.uk> Fri, 22 Mar 2002 11:18:59 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Ben Tullis You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER ben.tullis@INFOMATRIX.COM Ben Tullis PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER ben.tullis@INFOMATRIX.COM Ben Tullis // EOJ From ben.tullis at INFOMATRIX.COM Fri Mar 22 11:55:36 2002 From: ben.tullis at INFOMATRIX.COM (Ben Tullis) Date: Thu Jan 12 21:14:33 2006 Subject: Digital signature invalidated Message-ID: I have been using Mailscanner for about six months quite successfully. However, I mam having trouble using it with signed e-mail. Several times a message has been reported to have been changed during transmission, thereby invalidating the digital signature. I have tried switching off 'sign clean messages' and 'scan all messages' to no avail. Not all signed messages are corrupted, but particularly the ones with a MIME payload such as video/mpeg. Please help. I need to implement a company-wide PKI and do not wish to have to abandon mailscanner. The virus scanning engine is sophos Spam asassin is not enabled or installed Spam tagging is disabled MTA is sendmail Server is Debian Linux 2.2 I have not disabled the 'X-Mailscanner: found to be clean' header, but it was my understanding that this should not invalidate the message body signature. Many thanks. Ben Tullis From paul_houselander at BRISTOL-CITY.GOV.UK Fri Mar 22 17:47:01 2002 From: paul_houselander at BRISTOL-CITY.GOV.UK (Paul Houselander) Date: Thu Jan 12 21:14:33 2006 Subject: Server Crash Message-ID: I am running MailScanner on a cobalt box. Has been running happily for over a week, yesterday the machine fell over, and does so everytime I now start up mailscanner, their are messages (75) in mqueue.in, I had signature/spam/custom headers defined in mailscanner.conf so have defaulted back to the original installation, however everytime I start mailscanner, after approx 3-4 mins the machine complains of being out of memory and falls over. Its a remote machine so takes a bit of time to get someone to go and power cycle it. When its back up im going to move the messages in mqueue.in into mqueue and see how sendmail copes with them, in the meantime can anyone offer any potential explanations? seems to have got itself into a loop but Im not sure what action ive taken that has caused it. Extract of maillog below. Paul Mar 21 16:01:02 cobalt100 mailscanner[2368]: MailScanner E-Mail Virus Scanner version 3.12 starting. Mar 21 16:01:02 cobalt100 mailscanner[2368]: Configuring mailscanner for sendmail... Mar 21 16:01:02 cobalt100 mailscanner[2371]: Startup: found 76 messages waiting Mar 21 16:01:03 cobalt100 mailscanner[2371]: Forwarding 1 clean messages, 1070 bytes Mar 21 16:01:03 cobalt100 mailscanner[2371]: Scanning 75 messages, 8624865 bytes Mar 21 16:01:05 cobalt100 sendmail[2447]: g2LFctm00950: to=, delay=00:22:10, xdelay=00:00:00, mailer=local, pri=120508, dsn=2.0.0, stat=Sent Mar 21 16:01:30 cobalt100 sendmail[2473]: g2LG1Tn02473: from=, size=3912, class=0, nrcpts=1, msgid=, proto=ESMTP, daemon=MTA, relay=anchor-post-33.mail.demon.net [194.217.242.91] Mar 21 16:01:31 cobalt100 sendmail[2474]: g2LG1Tn02473: to=, delay=00:00:01, xdelay=00:00:01, mailer=local, pri=32328, dsn=2.0.0, stat=Sent Mar 21 16:01:44 cobalt100 in.qpopper[2496]: (v?) POP login by user "admin" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:44 cobalt100 in.qpopper[2495]: (v?) POP login by user "4front1654" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:53 cobalt100 sendmail[2500]: g2LG1qn02500: from=, size=12187, class=0, nrcpts=1, msgid=<200203211601.g2LG1qn02500@cobalt100.fm.netbenefit.co.uk>, proto=SMTP, daemon=MTA, relay=kryten.sift.co.uk [194.131.210.136] Mar 21 16:01:53 cobalt100 sendmail[2499]: g2LG1qn02499: from=, size=12182, class=0, nrcpts=1, msgid=<200203211601.g2LG1qn02499@cobalt100.fm.netbenefit.co.uk>, proto=SMTP, daemon=MTA, relay=kryten.sift.co.uk [194.131.210.136] Mar 21 16:01:56 cobalt100 sendmail[2502]: g2LG1qn02500: to=, delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:01:56 cobalt100 sendmail[2501]: g2LG1qn02499: to=, delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:45 cobalt100 in.qpopper[2524]: gtev4441 at 194.222.213.195 (194.222.213.195): -ERR [AUTH] PAM authentication failed for user "gtev4441": Module is unknown (28) Mar 21 16:02:45 cobalt100 in.qpopper[2524]: [AUTH] Failed attempted login to gtev4441 from host (194.222.213.195) 194.222.213.195 Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:55 cobalt100 in.qpopper[2527]: 4front1654 at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication failed for user "4front1654": Module is unknown (28) Mar 21 16:02:55 cobalt100 in.qpopper[2527]: [AUTH] Failed attempted login to 4front1654 from host (213.1.134.11) 213.1.134.11 Mar 21 16:02:55 cobalt100 in.qpopper[2529]: admin at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication failed for user "admin": Module is unknown (28) Mar 21 16:02:55 cobalt100 in.qpopper[2529]: [AUTH] Failed attempted login to admin from host (213.1.134.11) 213.1.134.11 Mar 21 16:03:10 cobalt100 sendmail[2548]: g2LG39n02548: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:10 cobalt100 sendmail[2533]: g2LG31n02533: SYSERR(root): SMTP-MAIL: died on signal 11 Mar 21 16:03:23 cobalt100 in.qpopper[2551]: I/O Error from at 62.6.75.159 (62.6.75.159): [-1] 104 (Connection reset by peer); 0 (Success) Mar 21 16:03:23 cobalt100 in.qpopper[2551]: (null) at 62.6.75.159 (62.6.75.159): -ERR POP EOF or I/O Error: 104 (Connection reset by peer); 0 (Success) Mar 21 16:03:26 cobalt100 sendmail[2552]: g2LG3Qn02552: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:27 cobalt100 sendmail[2550]: g2LG3Jn02550: SYSERR(root): SMTP-MAIL: died on signal 11 Mar 21 16:04:34 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:05:17 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot open hash database /etc/mail/aliases.db: Cannot allocate memory Mar 21 16:59:45 cobalt100 sendmail[387]: alias database /etc/mail/aliases rebuilt by root Mar 21 16:59:45 cobalt100 sendmail[387]: /etc/mail/aliases: 26 aliases, longest 33 bytes, 473 bytes total From lbergman at abi.tconline.net Fri Mar 22 17:42:43 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:33 2006 Subject: Server Crash In-Reply-To: References: Message-ID: <200203221742.g2MHghw24531@lewis.abi.tconline.net> > When its back up im going to move the messages in mqueue.in into mqueue and > see how sendmail copes with them, in the meantime can anyone offer any > potential explanations? seems to have got itself into a loop but Im not > sure what action ive taken that has caused it. Extract of maillog below. Are you forking mailscanner? Maybe multiple instances are running (one for each message) and it is eating up what memory you have. Change the config not to background and see if that helps. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From kmburris at TOWNSEND.COM Fri Mar 22 17:51:25 2002 From: kmburris at TOWNSEND.COM (Keith Burris) Date: Thu Jan 12 21:14:33 2006 Subject: Failed to lock ...: Invalid argument Message-ID: <20020322095125.A13788@townsend.com> Yes, I am sure that the ls output is from /var/spool/exim_incoming/input. I have left the Lock Type setting as in the original mailscanner.conf, i.e., it is commented out and is set, presumably, by setting MTA = exim. Exim is version 3.35. Build from the tarball at ftp.csx.cam.ac.uk. LDAP and TLS support compiled in. No changes to the defaults for directory permissions or locking. As I mentioned earlier, if I fstat the /var file system, no locks are shown for the files. > On Thu, Mar 21, 2002 at 04:50:35PM -0800, Keith B Keith Burris wrote: > >> Mar 21 09:34:46 mail mailscanner[11751]: Failed to lock /var/spool/exim_incoming/input/16nrMo-0002jf-00-H: Invalid argument >> >> So MailScanner is actually trying to lock an Exim message header file, >> but can't. MailScanner is running as user exim and group mail. The >> permissions for the example file are: >> >> 134934 -rw------- 1 exim mail 1019 Mar 20 17:27 16nrMo-0002jf-00-H >> >> Any other thoughts? > > You are *sure* that the ls output above is from the directory > /var/spool/exim_incoming/input?? You've not messed with the locking setting > in the mailscanner.conf? Your Exim is compiled with the usual locking setup? > Exim version is what? > > > > Cheers, > > > Nick > > -- > Nick Phillips -- nwp@lemon-computing.com > Try to relax and enjoy the crisis. From brose at MED.WAYNE.EDU Fri Mar 22 19:09:15 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:33 2006 Subject: Server Crash Message-ID: It looks likes it's really between your ssl libcrypt library and PAM. Is you pam db ok? -----Original Message----- From: Paul Houselander [mailto:paul_houselander@BRISTOL-CITY.GOV.UK] Sent: Friday, March 22, 2002 12:47 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Server Crash I am running MailScanner on a cobalt box. Has been running happily for over a week, yesterday the machine fell over, and does so everytime I now start up mailscanner, their are messages (75) in mqueue.in, I had signature/spam/custom headers defined in mailscanner.conf so have defaulted back to the original installation, however everytime I start mailscanner, after approx 3-4 mins the machine complains of being out of memory and falls over. Its a remote machine so takes a bit of time to get someone to go and power cycle it. When its back up im going to move the messages in mqueue.in into mqueue and see how sendmail copes with them, in the meantime can anyone offer any potential explanations? seems to have got itself into a loop but Im not sure what action ive taken that has caused it. Extract of maillog below. Paul Mar 21 16:01:02 cobalt100 mailscanner[2368]: MailScanner E-Mail Virus Scanner version 3.12 starting. Mar 21 16:01:02 cobalt100 mailscanner[2368]: Configuring mailscanner for sendmail... Mar 21 16:01:02 cobalt100 mailscanner[2371]: Startup: found 76 messages waiting Mar 21 16:01:03 cobalt100 mailscanner[2371]: Forwarding 1 clean messages, 1070 bytes Mar 21 16:01:03 cobalt100 mailscanner[2371]: Scanning 75 messages, 8624865 bytes Mar 21 16:01:05 cobalt100 sendmail[2447]: g2LFctm00950: to=, delay=00:22:10, xdelay=00:00:00, mailer=local, pri=120508, dsn=2.0.0, stat=Sent Mar 21 16:01:30 cobalt100 sendmail[2473]: g2LG1Tn02473: from=, size=3912, class=0, nrcpts=1, msgid=, proto=ESMTP, daemon=MTA, relay=anchor-post-33.mail.demon.net [194.217.242.91] Mar 21 16:01:31 cobalt100 sendmail[2474]: g2LG1Tn02473: to=, delay=00:00:01, xdelay=00:00:01, mailer=local, pri=32328, dsn=2.0.0, stat=Sent Mar 21 16:01:44 cobalt100 in.qpopper[2496]: (v?) POP login by user "admin" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:44 cobalt100 in.qpopper[2495]: (v?) POP login by user "4front1654" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:53 cobalt100 sendmail[2500]: g2LG1qn02500: from=, size=12187, class=0, nrcpts=1, msgid=<200203211601.g2LG1qn02500@cobalt100.fm.netbenefit.co.uk>, proto=SMTP, daemon=MTA, relay=kryten.sift.co.uk [194.131.210.136] Mar 21 16:01:53 cobalt100 sendmail[2499]: g2LG1qn02499: from=, size=12182, class=0, nrcpts=1, msgid=<200203211601.g2LG1qn02499@cobalt100.fm.netbenefit.co.uk>, proto=SMTP, daemon=MTA, relay=kryten.sift.co.uk [194.131.210.136] Mar 21 16:01:56 cobalt100 sendmail[2502]: g2LG1qn02500: to=, delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:01:56 cobalt100 sendmail[2501]: g2LG1qn02499: to=, delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:45 cobalt100 in.qpopper[2524]: gtev4441 at 194.222.213.195 (194.222.213.195): -ERR [AUTH] PAM authentication failed for user "gtev4441": Module is unknown (28) Mar 21 16:02:45 cobalt100 in.qpopper[2524]: [AUTH] Failed attempted login to gtev4441 from host (194.222.213.195) 194.222.213.195 Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:55 cobalt100 in.qpopper[2527]: 4front1654 at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication failed for user "4front1654": Module is unknown (28) Mar 21 16:02:55 cobalt100 in.qpopper[2527]: [AUTH] Failed attempted login to 4front1654 from host (213.1.134.11) 213.1.134.11 Mar 21 16:02:55 cobalt100 in.qpopper[2529]: admin at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication failed for user "admin": Module is unknown (28) Mar 21 16:02:55 cobalt100 in.qpopper[2529]: [AUTH] Failed attempted login to admin from host (213.1.134.11) 213.1.134.11 Mar 21 16:03:10 cobalt100 sendmail[2548]: g2LG39n02548: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:10 cobalt100 sendmail[2533]: g2LG31n02533: SYSERR(root): SMTP-MAIL: died on signal 11 Mar 21 16:03:23 cobalt100 in.qpopper[2551]: I/O Error from at 62.6.75.159 (62.6.75.159): [-1] 104 (Connection reset by peer); 0 (Success) Mar 21 16:03:23 cobalt100 in.qpopper[2551]: (null) at 62.6.75.159 (62.6.75.159): -ERR POP EOF or I/O Error: 104 (Connection reset by peer); 0 (Success) Mar 21 16:03:26 cobalt100 sendmail[2552]: g2LG3Qn02552: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:27 cobalt100 sendmail[2550]: g2LG3Jn02550: SYSERR(root): SMTP-MAIL: died on signal 11 Mar 21 16:04:34 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:05:17 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot open hash database /etc/mail/aliases.db: Cannot allocate memory Mar 21 16:59:45 cobalt100 sendmail[387]: alias database /etc/mail/aliases rebuilt by root Mar 21 16:59:45 cobalt100 sendmail[387]: /etc/mail/aliases: 26 aliases, longest 33 bytes, 473 bytes total From Q.G.Campbell at NEWCASTLE.AC.UK Fri Mar 22 19:38:25 2002 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:14:33 2006 Subject: Which are the recommended CPAN module versions? Message-ID: I am about to install the latest version of MailScanner (and SpamAssassin) on a brand new dual-processor box running Redhat 7.2. The latter has Perl 5.6.0 installed by default. What are the current recommended levels for the following CPAN modules needed by MailScanner: IO-stringy (now at 2.108 but Julian used 1.211) MIME-Base64 (now at 2.12 but Julian used 2.11) MailTools (various: 1.1401, 1.16, 1.40 & 1.43; Julian used 1.1401) File-Spec (now at 0.82 but a version already installed with Perl 5.6.0) MIME-tools (various: 5.411 & 5.411a; Julian used patched 5.313) What other versions are people successfully using on RedHat 7.2 systems? Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From Funk.Gabor at HUNETKFT.HU Fri Mar 22 19:50:22 2002 From: Funk.Gabor at HUNETKFT.HU (Funk Gabor) Date: Thu Jan 12 21:14:33 2006 Subject: Which are the recommended CPAN module versions? Message-ID: <026e01c1d1da$cf02d6b0$3364a8c0@xxxx.xxx> >>What other versions are people successfully using on RedHat 7.2 systems? Since this is more perl related than distrib, I hereby share my debian experience. I use a debian testing, I installed Mailscanner more than a months ago, the versions were as follows. Since then they probably got upgraded if there was new version. (Debian testing has perl 5.6) io::stringy [libiostringy] v2.108-1 MIME::Base64 [libmimebase64] v2.12-4 Mail::Tools [libmailtools] v1.42-2 MIME::Tools [libmime-perl] v5.4.11-1 Works fine. G. From lbergman at abi.tconline.net Fri Mar 22 20:22:31 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:33 2006 Subject: Which are the recommended CPAN module versions? In-Reply-To: <026e01c1d1da$cf02d6b0$3364a8c0@xxxx.xxx> References: <026e01c1d1da$cf02d6b0$3364a8c0@xxxx.xxx> Message-ID: <200203222022.g2MKMVZ24871@lewis.abi.tconline.net> > Since this is more perl related than distrib, I hereby share my debian > experience. I use a debian testing, I installed Mailscanner more than a > months ago, the versions were as follows. Since then they probably got > upgraded if there was new version. (Debian testing has perl 5.6) I installed mine a couple of days ago using 7.2 and CPAN with 5.6.1 and it seems to work fine. I just installed whatever versions were up on CPAN at the time. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From nwp at LEMON-COMPUTING.COM Fri Mar 22 22:26:38 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:33 2006 Subject: Digital signature invalidated In-Reply-To: References: Message-ID: <20020322222638.GF15136@hoiho.nz.lemon-computing.com> On Fri, Mar 22, 2002 at 11:55:36AM +0000, Ben Tullis wrote: > Several times a message has been reported to have been changed during > transmission, thereby invalidating the digital signature. Hmmm... haven't really used it with signed mail much if at all. > I have tried switching off 'sign clean messages' and 'scan all messages' to > no avail. Not all signed messages are corrupted, but particularly the ones > with a MIME payload such as video/mpeg. MIME messages are probably being unpacked and rebuilt. I'll have to get set up here, and then I'll look into it. > Please help. I need to implement a company-wide PKI and do not wish to > have to abandon mailscanner. Don't worry; I will need signed messages to pass unscathed too, so... > I have not disabled the 'X-Mailscanner: found to be clean' header, but it > was my understanding that this should not invalidate the message body > signature. What are you using to sign the messages; there are (at least) two different ways that messages get signed, depending on the age and quality of the software you're using. Just for reference, I'll sign this using Mutt. Mutt, so far as I know, does it the modern, "right", way. Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com Excellent day to have a rotten day. -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 240 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020323/0ccda1a9/attachment.bin From kylist at SHCORP.COM Sun Mar 24 05:06:40 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:33 2006 Subject: spamassassin not called on Debian? Message-ID: <2263.10.10.3.100.1016946400.squirrel@webmail.shcorp.com> Hi list Mailscanner doesn't appear to be using spamassassin, even though I've got the mailscanner.cf file set with option "Use SpamAssassin = yes". I sent myself a redirected spam, but it wasn't caught. I'm not even seeing the X-header "X-MailScanner-SpamCheck:". Mails from the internet (ie, they aren't in the whitelist) don't show this X-header either... I'm running Debian (mostly testing) with Mailscanner v 3.12.4 (Debian package mailscanner 3.12.4-1). Other packages version info: SpamAssassin 2.11, Sendmail 8.12.1, Sophos Sweep 3.55. Any ideas what might be going wrong or bad with my setup? Thanks -- Kurt Yoder Sport & Health network administrator From mike at ZANKER.ORG Sun Mar 24 07:43:50 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:33 2006 Subject: spamassassin not called on Debian? In-Reply-To: <2263.10.10.3.100.1016946400.squirrel@webmail.shcorp.com> References: <2263.10.10.3.100.1016946400.squirrel@webmail.shcorp.com> Message-ID: <78578199.1016955830@jemima.zanker.org> On 24 March 2002 00:06 -0500 Kurt Yoder wrote: > Mailscanner doesn't appear to be using spamassassin, even though I've > got the mailscanner.cf file set with option "Use SpamAssassin = yes". > I sent myself a redirected spam, but it wasn't caught. I'm not even > seeing the X-header "X-MailScanner-SpamCheck:". Mails from the > internet (ie, they aren't in the whitelist) don't show this X-header > either... Are you sure that you haven't got your network or e-mail address in the network or e-mail address whitelist? That would prevent spams that you forward to yourself being processed. This caught me out when I was testing. Also, the X-header is only added to e-mails that are found to be spam. Regards, Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From LISTSERV at JISCMAIL.AC.UK Sat Mar 23 16:57:09 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: rusw@BEE.NET requested to join Message-ID: <200203231657.QAA13686@magpie.ecs.soton.ac.uk> Sat, 23 Mar 2002 16:57:09 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Rus Wetherill You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER rusw@BEE.NET Rus Wetherill PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER rusw@BEE.NET Rus Wetherill // EOJ From LISTSERV at JISCMAIL.AC.UK Sat Mar 23 19:58:32 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: rfowkar@YAHOO.COM left the JISCmail list Message-ID: <200203231958.TAA17953@magpie.ecs.soton.ac.uk> Sat, 23 Mar 2002 19:58:32 Rajesh Fowkar has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Sat Mar 23 21:45:31 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: dan@OXNARDSD.ORG requested to join Message-ID: <200203232145.VAA08665@magpie.ecs.soton.ac.uk> Sat, 23 Mar 2002 21:45:31 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Dan Kubilos You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER dan@OXNARDSD.ORG Dan Kubilos PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER dan@OXNARDSD.ORG Dan Kubilos // EOJ From LISTSERV at JISCMAIL.AC.UK Sat Mar 23 20:02:24 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: rajesh-shriram@GMX.NET requested to join Message-ID: <200203232002.UAA18701@magpie.ecs.soton.ac.uk> Sat, 23 Mar 2002 20:02:24 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Rajesh Fowkar You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER rajesh-shriram@GMX.NET Rajesh Fowkar PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER rajesh-shriram@GMX.NET Rajesh Fowkar // EOJ From jkf at ecs.soton.ac.uk Sun Mar 24 13:08:30 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:33 2006 Subject: [Fwd: On the ultimate futility of server-based mail scanning] In-Reply-To: <1015751344.6384.16.camel@localhost.localdomain> Message-ID: <5.1.0.14.2.20020324130655.04901db0@hawk.ecs.soton.ac.uk> At 09:09 10/03/2002, you wrote: >Several postings on Bugtraq recently talked about DoS attacks against >server-based mail-scanners. Compress four gigabytes of zeros and >debilitate mail scanners which uncompress .gz files, for example. > >Several mail scanners try to be clever and examine .zip files, .tar.gz >files, .arc files, etc. to look inside for viruses. > >This is ultimately futile. > >I gave one scenario: > >(cat small_x86_jmp_code; \ > dd if=/dev/zero bs=1k count=400k; \ > cat virus_payload) | gzip > virus.attach.gz > >This DoS's virus-scanners which do not limit scanning-size, and sneaks past >those which do. I don't understand why this is a problem. And anyway, MailScanner detects DoS attacks on the basis of the time taken to process the gz file, not the size of the expanded archive. So it should still get caught. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From jkf at ecs.soton.ac.uk Sun Mar 24 13:12:30 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:33 2006 Subject: Questions Re: Spamassassin and Mailscanner In-Reply-To: <000a01c1caf0$85ff7e00$ac722241@fizz> Message-ID: <5.1.0.14.2.20020324131146.0498eeb8@hawk.ecs.soton.ac.uk> At 00:38 14/03/2002, you wrote: >Mailscanner seems to help with spam quite a bit, but with spamassassin it >works great. Im running 2.1 of spamassassin and latest mailscanner, my >question to you is, Which config file do we use for spamassassin? i see >one in /root/.spamassassin/user_prefs and also in >/etc/mail/spamassassin/local.cf It will use both of those. As MailScanner is run as root (with sendmail), SpamAssassin is also run as root. I put the threshold values in both of those files too :-) -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From jkf at ecs.soton.ac.uk Sun Mar 24 13:20:28 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:33 2006 Subject: Sophos (was: Usage Question) In-Reply-To: <009901c1d0c8$100ba600$65020a0a@galaxy> References: <000b01c1d04f$ac445e00$48cf75cc@fizz> Message-ID: <5.1.0.14.2.20020324131926.027c9530@hawk.ecs.soton.ac.uk> At 11:03 21/03/2002, you wrote: >-----Original Message----- >From: Kelly Hamlin >Sent: Wednesday, March 20, 2002 9:42 PM > > > sophos liscence is ridiculous, but the trial never expires (*cough*) > >But how to do monthly updates for Sophos? >The automated IDE-updating works fine, but the monthly updates can't be >automated? You only need to update every 2-3 months or so. They keep up-to-date IDE files for the current version and its 2 predecessors. I find downloading the .Z file from the website once every 3 months, then calling Sophos.install only takes me a couple of minutes. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From jkf at ecs.soton.ac.uk Sun Mar 24 13:18:47 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:33 2006 Subject: A few questions In-Reply-To: <009501c1d0c0$ad7cf3b0$c79cb7ca@SINT2000> Message-ID: <5.1.0.14.2.20020324131805.04941330@hawk.ecs.soton.ac.uk> At 10:10 21/03/2002, you wrote: >1. I have MailScanner configured to use SpamAssassin. How do I know that >SpamAssassin is actually working. I know that there is an extra header >added for messages that fail the MailScanner RBL test. Is there an extra >header added by MailScanner for messages that fail the heuristic >spamassassin checks or are they just flagged by adding {SPAM} to the >subject line. The MailScanner "spam header" will be added, containing the text "SpamAssassin" if the message failed a spamassassin check. >2. I'd like to configure MailScanner to forward suspected SPAM messages >to a central mailbox or folder. I've browsed the posting on the list but >can see nothing on how this might be configured beit using MailScanner or >sendmail+rules. Not yet.. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From jkf at ecs.soton.ac.uk Sun Mar 24 13:15:44 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:33 2006 Subject: Any explanations gratefully recieved. In-Reply-To: <3C9860E6.28010.8ADB46C@localhost> References: <02032011001605.00658@ned> Message-ID: <5.1.0.14.2.20020324131451.04931130@hawk.ecs.soton.ac.uk> Can someone please send me a message (the qf file out of the message queue would be perfect) that suffers from this problem, so I can try to work out a solution to it. It depends critically on exactly how the break in the subject line is created in the file. At 10:13 20/03/2002, you wrote: >On 20 Mar 2002 at 11:00, Shane Kelly wrote: > > > I got a call from a user who reported a virus in an email - this is such an > > unusual occurrence these days that I went personally to get the details. > > > > The following are the headers from the email, and the log entry > pertaining to > > it. Any thoughts ? > > > > SUBJECT: #_?r , > > ]m04UoY2??7 > > > > mailscanner is a mail gateway with mailscanner/sophos installation, the > virus > > reported was magistra. > > > >See a previous thread on this: > >http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A1=ind0203&L=mailscanner#24 > >The headers of your message show that exactly the same virus and reasons that >it was missed are involved. > >Regards > >-- >David Sullivan IT Services, Barnet College, London > David.Sullivan@barnet.ac.uk > 020 8275 5036 > >This communication may contain privileged or confidential information which >is for the exclusive use of the intended recipient. If you are not the >intended recipient, please note that you may not distribute or use this >communication or the information it contains. If this e-mail has reached you >in error, please delete it and any attachment. > >Internet communications are not secure and Barnet College does not accept >legal responsibility for the content of this message. Any views or opinions >expressed are those of the author and not necessarily those of Barnet College. > >Please note that Barnet College reserves the right to monitor the >source/destinations of all incoming or outgoing e-mail communications. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From jkf at ecs.soton.ac.uk Sun Mar 24 13:24:28 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:33 2006 Subject: Digital signature invalidated In-Reply-To: Message-ID: <5.1.0.14.2.20020324132254.0495a590@hawk.ecs.soton.ac.uk> At 11:55 22/03/2002, you wrote: >I have been using Mailscanner for about six months quite successfully. >However, I mam having trouble using it with signed e-mail. >Several times a message has been reported to have been changed during >transmission, thereby invalidating the digital signature. >I have tried switching off 'sign clean messages' and 'scan all messages' to >no avail. Not all signed messages are corrupted, but particularly the ones >with a MIME payload such as video/mpeg. > >Please help. I need to implement a company-wide PKI and do not wish to >have to abandon mailscanner. > >The virus scanning engine is sophos >Spam asassin is not enabled or installed >Spam tagging is disabled >MTA is sendmail >Server is Debian Linux 2.2 > >I have not disabled the 'X-Mailscanner: found to be clean' header, but it >was my understanding that this should not invalidate the message body >signature. If the message is found to be clean, then the "df" file from the queue, containing the message body, is moved directly to the outgoing queue without ever being touched or even opened. So I'm at a loss to see why the signature would be invalidated. Are you sure you always re-started MailScanner when experimenting with the various configuration switches? -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From kylist at SHCORP.COM Sun Mar 24 16:07:33 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:33 2006 Subject: some messages not getting scanned Message-ID: <2312.10.10.3.100.1016986053.squirrel@webmail.shcorp.com> Hello all I'm noticing that some messages are not being scanned by mailscanner. They simply pass through and get no "X-MailScanner: Found to be clean" message. Here's an example from my logs: Mar 24 10:27:25 pangaea sm-mta[13995]: g2OFRPt2013995: from=, size=2721, class=0, nrcpts=1, msgid=<200203241527.g2OFROKC007439@eurasia.shcorp.com>, bodytype=8BITMIME, proto=ESMTP, daemon=MTA, relay=eurasia.shcorp.com [10.10.2.5] Mar 24 10:27:43 pangaea sm-mta[14002]: g2OFRPt2013995: to=besales1@aragorn.shcorp.com, delay=00:00:18, xdelay=00:00:00, mailer=esmtp, pri=123422, relay=aragorn.shcorp.com. [10.10.1.235], dsn=2.0.0, stat=Sent (g2OFRhf83782 Message accepted for delivery) (#$%^@^@ spammers!) A normal mail pass looks like: Mar 24 10:28:15 pangaea sm-mta[14003]: g2OFSEt2014003: from=, size=663, class=-60, nrcpts=2, msgid=<20020324101624.A12008@justice.loyola.edu>, proto=ESMTP, daemon=MTA, relay=eurasia.shcorp.com [10.10.2.5] Mar 24 10:28:44 pangaea mailscanner[13822]: Scanning 1 messages, 2999 bytes Mar 24 10:28:45 pangaea mailscanner[13822]: Scanned 1 messages, 2999 bytes in 1seconds Mar 24 10:28:45 pangaea sendmail[14009]: g2OFSEt2014003: to=kyoder@aragorn.shcorp.com,mjones@aragorn.shcorp.com, delay=00:00:31, xdelay=00:00:00, mailer=esmtp, pri=260444, relay=aragorn.shcorp.com. [10.10.1.235], dsn=2.0.0, stat=Sent (g2OFSjf83814 Message accepted for delivery) Can anyone explain this behavior? Thanks... -- Kurt Yoder Sport & Health network administrator From dan at OXNARDSD.ORG Sun Mar 24 17:44:03 2002 From: dan at OXNARDSD.ORG (Dan Kubilos) Date: Thu Jan 12 21:14:33 2006 Subject: Filelist Rule and Conf In-Reply-To: <5.1.0.14.2.20020324131146.0498eeb8@hawk.ecs.soton.ac.uk> Message-ID: Just installed MailScanner for our school district's email server - redhat 7.2 sendmail, spamassassin and razor -- WOW! Thank you very much. Questions I have. I expected to be able to test the filename.rules.conf by simply sending myself a double extension filename file. ( I am using the included sample.) But nothing occurs when I send this attachment. Running with debug = 1 I see that mailscanner was called and a message scanned. The message was delivered with test.doc.pif intact. How can I test current or new configuration of filename.rules.conf? I installed the RPM distribution. What is the best way to have mailscanner reload a new config? I *thought* I had restarted the init script after changing Deliver Cleaned attachment to "no" but noticed one was delivered. -- Dan Kubilos __\o_ ^ K-8 Tech Coord http://www.oxnardsd.org From jkf at ecs.soton.ac.uk Sun Mar 24 19:31:28 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:33 2006 Subject: Filelist Rule and Conf In-Reply-To: References: <5.1.0.14.2.20020324131146.0498eeb8@hawk.ecs.soton.ac.uk> Message-ID: <5.1.0.14.2.20020324193041.0291b4b8@hawk.ecs.soton.ac.uk> At 17:44 24/03/2002, you wrote: >I installed the RPM distribution. What is the best way to have mailscanner >reload a new config? I *thought* I had restarted the init script after >changing Deliver Cleaned attachment to "no" but noticed one was delivered. Run /usr/local/MailScanner/bin/check_mailscanner. That will tell you the PID of the current MailScanner process. Kill that PID, then run /usr/local/MailScanner/bin/check_mailscanner again to restart it. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From nwp at LEMON-COMPUTING.COM Sun Mar 24 21:00:17 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:33 2006 Subject: some messages not getting scanned Message-ID: <20020324210017.GQ15136@hoiho.nz.lemon-computing.com> On Sun, Mar 24, 2002 at 11:07:33AM -0500, Kurt Yoder wrote: > Hello all > > I'm noticing that some messages are not being scanned by mailscanner. They > simply pass through and get no "X-MailScanner: Found to be clean" message. > Here's an example from my logs: > > Mar 24 10:27:25 pangaea sm-mta[13995]: g2OFRPt2013995: > from=, size=2721, class=0, nrcpts=1, > msgid=<200203241527.g2OFROKC007439@eurasia.shcorp.com>, bodytype=8BITMIME, > proto=ESMTP, daemon=MTA, relay=eurasia.shcorp.com [10.10.2.5] > Mar 24 10:27:43 pangaea sm-mta[14002]: g2OFRPt2013995: > to=besales1@aragorn.shcorp.com, delay=00:00:18, xdelay=00:00:00, > mailer=esmtp, pri=123422, relay=aragorn.shcorp.com. [10.10.1.235], > dsn=2.0.0, stat=Sent (g2OFRhf83782 Message accepted for delivery) Looks like the secoond sendmail is using the same queue as the first one. So, most likely your sendmail is not configured right. In fact, if it only happens sometimes, I'd say that your "incoming" sendmail is the one that's wrong - it's probably queue-running as well as accepting incoming messages. I can't remember where the option to change that is in Debian, though. You did say you were using Debian, didn't you? Have a look in /etc/defaults/sendmail or somewhere like that; I'll try to find out exactly where. Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com Good news. Ten weeks from Friday will be a pretty good day. From paul-w at BLUEYONDER.CO.UK Sun Mar 24 22:46:13 2002 From: paul-w at BLUEYONDER.CO.UK (Paul Welsh) Date: Thu Jan 12 21:14:33 2006 Subject: Most cost effective virus scanner? Message-ID: <013f01c1d385$cb9168a0$05ca30d5@espmail00053> Well, for those of us using the free beta of F-Prot Linux, things changed on 22 March because the commercial version was launched. Their site says (http://www.f-prot.com/f-prot/products/fplin.html) "License shall be without charge for personal users of F-Prot Linux for Small Business, when used on personal workstations." Now I'm a pretty honest sort of guy and can't claim my server is for personal use, nor is it a workstation. As the f-prot site states: "F-Prot Linux for Small Business cost $300 per server, and includes one year of virus signature updates, version upgrades, and e-mail technical support." So I guess the question is whether F-Prot is the most cost effective package out there for use with mailscanner. I like the flat rate nature of the new f-prot product. I have about 12 mailboxes on my server used by various people. Products like Sophos are licensed on the basis of the number of users that benefit. Even if I bought 12 Sophos Sweep licences, it would cost about ?40 per licence = ?480. The thing is, I should buy a lot more than 12 Sweep licences because the pop3 boxes I have on my server are global pop3 boxes so in terms of the number of users being protected by f-prot, it could be quite high - I'm not even sure myself. So, f-prot for $300 pa looks like a bargain compared to Sophos. Anyone else using anything less expensive still that works reliably? From paul-w at BLUEYONDER.CO.UK Sun Mar 24 22:51:58 2002 From: paul-w at BLUEYONDER.CO.UK (Paul Welsh) Date: Thu Jan 12 21:14:33 2006 Subject: Which version of f-prot? Message-ID: <015401c1d386$897af660$05ca30d5@espmail00053> Another f-prot question. Now that it's no longer free which version do we need for use with Mailscanner? There are two versions: F-Prot Linux for Small Business and F-Prot Linux for Enterprise Business. Could someone take a look at http://www.f-prot.com/f-prot/products/fplin.html and let me know which is the one to get? From nwp at LEMON-COMPUTING.COM Sun Mar 24 23:44:17 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:33 2006 Subject: Which version of f-prot? In-Reply-To: <015401c1d386$897af660$05ca30d5@espmail00053> References: <015401c1d386$897af660$05ca30d5@espmail00053> Message-ID: <20020324234417.GR15136@hoiho.nz.lemon-computing.com> On Sun, Mar 24, 2002 at 10:51:58PM -0000, Paul Welsh wrote: > Another f-prot question. Now that it's no longer free which version do > we need for use with Mailscanner? There are two versions: F-Prot Linux > for Small Business and F-Prot Linux for Enterprise Business. Could > someone take a look at http://www.f-prot.com/f-prot/products/fplin.html > and let me know which is the one to get? Right now we use a command-line scanner. So, as long as they haven't modified the output (which is possible/likely), then the Small Business version looks appropriate. *I haven't tried it yet*. -- Nick Phillips -- nwp@lemon-computing.com Don't Worry, Be Happy. From dan at OXNARDSD.ORG Mon Mar 25 01:43:37 2002 From: dan at OXNARDSD.ORG (Dan Kubilos) Date: Thu Jan 12 21:14:33 2006 Subject: Filename Rules Delivery In-Reply-To: <5.1.0.14.2.20020324131146.0498eeb8@hawk.ecs.soton.ac.uk> Message-ID: New install is working great. Thanks Julian for your response to how to best restart mailscanner. One issue still. I expected to be able to test the filename.rules.conf by simply sending myself a double extension filename file. ( I am using the included sample.) But nothing occurs when I send this attachment. Running with debug = 1 I see that mailscanner was called and a message scanned. The message was delivered with test.doc.pif intact. How can I test current or new configuration of filename.rules.conf? Dan Kubilos Tech Coordinator Oxnard School District From robert at WEBTENT.COM Mon Mar 25 02:40:12 2002 From: robert at WEBTENT.COM (Robert Fitzpatrick) Date: Thu Jan 12 21:14:33 2006 Subject: Problem starting MailScanner Message-ID: <200203250240.g2P2eCe11143@hermes.webtent.net> I have this problem all of a sudden and see a lot of posts in the archives, but nothing checks out so far. I know the Linux version just went pay-for again, but I didn't know about that until after I installed the 3.12 version of f-prot, March 21. After I untarred the new version and updated the symbolic links everything started giving me problems. Mail stuck in the mqueue.in and MailScanner reports the following after Starting MailScanner: Commercial virus checker failed with real error: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! Since the old version of f-prot was still there, I just remove and remade my /usr/local/f-prot symlink to point back there again. Same problem. Right now, I have MailScanner off, no messages are being scanned, and I'm receiving that error after starting. Can someone tell me if this has anything to do with having to license the Linux version of f-prot now or what may be causing my problem? -- Robert From rabellino at DI.UNITO.IT Mon Mar 25 08:57:50 2002 From: rabellino at DI.UNITO.IT (Rabellino Sergio) Date: Thu Jan 12 21:14:33 2006 Subject: Digital signature invalidated References: <5.1.0.14.2.20020324132254.0495a590@hawk.ecs.soton.ac.uk> Message-ID: <3C9EE68E.74A2B040@di.unito.it> Julian Field wrote: > > At 11:55 22/03/2002, you wrote: > >I have been using Mailscanner for about six months quite successfully. > >However, I mam having trouble using it with signed e-mail. > >Several times a message has been reported to have been changed during > >transmission, thereby invalidating the digital signature. > >I have tried switching off 'sign clean messages' and 'scan all messages' to > >no avail. Not all signed messages are corrupted, but particularly the ones > >with a MIME payload such as video/mpeg. > > > >Please help. I need to implement a company-wide PKI and do not wish to > >have to abandon mailscanner. > > > >The virus scanning engine is sophos > >Spam asassin is not enabled or installed > >Spam tagging is disabled > >MTA is sendmail > >Server is Debian Linux 2.2 > > > >I have not disabled the 'X-Mailscanner: found to be clean' header, but it > >was my understanding that this should not invalidate the message body > >signature. > > If the message is found to be clean, then the "df" file from the queue, > containing the message body, is moved directly to the outgoing queue > without ever being touched or even opened. So I'm at a loss to see why the > signature would be invalidated. > > Are you sure you always re-started MailScanner when experimenting with the > various configuration switches? > -- > Julian Field Teaching Systems Manager > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ We have our Corporate PKI running from '96 and mailscanner from 6 months... no problems at all. We're using the latest mailscanner and McAfee viruscan on a solaris 7 Sparc. Maybe your problems are on the client side ... -- Dott. Sergio Rabellino Technical Staff Department of Computer Science University of Torino (Italy) Member of the Internet Society http://www.di.unito.it/~rabser Tel. +39-0116706701 Fax. +39-011751603 From mike at ZANKER.ORG Mon Mar 25 09:36:30 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:33 2006 Subject: Upgrading MailScanner/Sophos Message-ID: <168332118.1017048990@mallard.open.ac.uk> Quick question - am I correct in assuming that upgrading to a new version of MailScanner (RH 7.2) is simply a case of running "rpm -U" on the new rpm? Do I need to back up any changed files in the etc directory or will it back these up? Sophos - just a case of re-running /usr/local/MailScanner/bin/Sophos.install on the new Sophos tar bundle? Thanks in advance, -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From LISTSERV at JISCMAIL.AC.UK Sun Mar 24 22:50:56 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: ally@ITSERVICES.CORDAH.COM requested to join Message-ID: <200203242250.WAA25587@magpie.ecs.soton.ac.uk> Sun, 24 Mar 2002 22:50:56 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Alastair Sell You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER ally@ITSERVICES.CORDAH.COM Alastair Sell PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER ally@ITSERVICES.CORDAH.COM Alastair Sell // EOJ From LISTSERV at JISCMAIL.AC.UK Sun Mar 24 22:58:41 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: sean@TCOB1.NET left the JISCmail list Message-ID: <200203242258.WAA27110@magpie.ecs.soton.ac.uk> Sun, 24 Mar 2002 22:58:41 Sean Rima has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Mon Mar 25 07:35:01 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:33 2006 Subject: MAILSCANNER: chawana@CHEVALIERTHAI.COM left the JISCmail list Message-ID: <200203250734.HAA03899@magpie.ecs.soton.ac.uk> Mon, 25 Mar 2002 07:35:01 Chawana Suntonpitagkul has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Mon Mar 25 07:52:38 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:34 2006 Subject: MAILSCANNER: newsletters@PCSITES.COM requested to join Message-ID: <200203250752.HAA07255@magpie.ecs.soton.ac.uk> Mon, 25 Mar 2002 07:52:38 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Richard Ahlquist You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER newsletters@PCSITES.COM Richard Ahlquist PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER newsletters@PCSITES.COM Richard Ahlquist // EOJ From LISTSERV at JISCMAIL.AC.UK Mon Mar 25 09:41:09 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:34 2006 Subject: MAILSCANNER: jan.selen@INGA.FI requested to join Message-ID: <200203250941.JAA28011@magpie.ecs.soton.ac.uk> Mon, 25 Mar 2002 09:41:09 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Jan Selen You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER jan.selen@INGA.FI Jan Selen PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER jan.selen@INGA.FI Jan Selen // EOJ From jkf at ecs.soton.ac.uk Mon Mar 25 09:51:17 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:34 2006 Subject: Upgrading MailScanner/Sophos In-Reply-To: <168332118.1017048990@mallard.open.ac.uk> Message-ID: <5.1.0.14.2.20020325095043.02d299d8@imap.ecs.soton.ac.uk> At 09:36 25/03/2002, you wrote: >Quick question - am I correct in assuming that upgrading to a new >version of MailScanner (RH 7.2) is simply a case of running "rpm -U" on >the new rpm? Do I need to back up any changed files in the etc >directory or will it back these up? Backup your etc files first, then diff them against the new ones so you pick up the new keywords in the mailscanner.conf file. >Sophos - just a case of re-running >/usr/local/MailScanner/bin/Sophos.install on the new Sophos tar bundle? Yes. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From thomas.zajic at NEO.AT Mon Mar 25 09:57:17 2002 From: thomas.zajic at NEO.AT (Thomas Zajic) Date: Thu Jan 12 21:14:34 2006 Subject: Which are the recommended CPAN module versions? In-Reply-To: ; from Q.G.Campbell@NEWCASTLE.AC.UK on Fri, Mar 22, 2002 at 07:38:25PM -0000 References: Message-ID: <20020325105717.A642@thomas.neo.at> On Fri, Mar 22, 2002 at 07:38:25PM -0000, Quentin Campbell wrote: > What are the current recommended levels for the following CPAN > modules needed by MailScanner: > > IO-stringy (now at 2.108 but Julian used 1.211) > MIME-Base64 (now at 2.12 but Julian used 2.11) > MailTools (various: 1.1401, 1.16, 1.40 & 1.43; Julian used > 1.1401) > File-Spec (now at 0.82 but a version already installed with > Perl 5.6.0) > MIME-tools (various: 5.411 & 5.411a; Julian used patched 5.313) > > What other versions are people successfully using on RedHat 7.2 > systems? Don't know about RedHat, but these versions (self-compiled) work fine on a Slackware 8.0-current system with perl-5.6.1 (MailScanner is configured to use SpamAssassin, SpamAssassin is configured to use Razor): | [root@gateway2]:~# stowes list perl | Listing packages in /usr/local/stow matching [ perl ] (9 matches): | I Perl-Digest-SHA1-2.01 | I Perl-IO-stringy-1.220 | I Perl-MIME-Base64-2.12 | I Perl-MIME-tools-5.411a | I Perl-MailTools-1.43 | I Perl-Net-DNS-0.14 | I Perl-Net-Ping-2.12 | I Perl-Time-HiRes-01.20 HTH, Thomas -- ----------------------------- Thomas Zajic System Administrator neo Software Produktions GmbH A T2 Company email: thomas.zajic@neo.at web: http://www.neo.at From mike at ZANKER.ORG Mon Mar 25 10:03:49 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:34 2006 Subject: Upgrading MailScanner/Sophos In-Reply-To: <5.1.0.14.2.20020325095043.02d299d8@imap.ecs.soton.ac.uk> References: <5.1.0.14.2.20020325095043.02d299d8@imap.ecs.soton.ac.uk> Message-ID: <169971686.1017050629@mallard.open.ac.uk> On 25 March 2002 09:51 +0000 Julian Field wrote: > Backup your etc files first, then diff them against the new ones so > you pick up the new keywords in the mailscanner.conf file. Thanks for such a quick response :) Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From paul_houselander at BRISTOL-CITY.GOV.UK Mon Mar 25 10:56:57 2002 From: paul_houselander at BRISTOL-CITY.GOV.UK (Paul Houselander) Date: Thu Jan 12 21:14:34 2006 Subject: Server Crash Message-ID: I think the SSL/PAM stuff was as a result of the mailscanner problem Ive got it running ok now, the first message in the /var/spool/mqueue.in was a bit strange, seemed that every 3 seconds it attempted to send a mail but got a relaying denied message (this was because pop before smtp was on), not sure why it was trying to do it every 3 seconds? Anyway the resulting message was just over 1mb in size filled with the below errors >250 HELP MAIL FROM: >250 2.1.0 ... Sender ok RCPT TO: >550 5.7.1 ... Relaying denied. Please check your mail first. Seems consistent, as soon as I moved this message manually, mailscanner was fine. Any ideals, I dont think this is likely to happen to often, but once is enough. Paul >>> brose@MED.WAYNE.EDU 03/22/02 19:17 PM >>> It looks likes it's really between your ssl libcrypt library and PAM. Is you pam db ok? -----Original Message----- From: Paul Houselander [mailto:paul_houselander@BRISTOL-CITY.GOV.UK] Sent: Friday, March 22, 2002 12:47 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Server Crash I am running MailScanner on a cobalt box. Has been running happily for over a week, yesterday the machine fell over, and does so everytime I now start up mailscanner, their are messages (75) in mqueue.in, I had signature/spam/custom headers defined in mailscanner.conf so have defaulted back to the original installation, however everytime I start mailscanner, after approx 3-4 mins the machine complains of being out of memory and falls over. Its a remote machine so takes a bit of time to get someone to go and power cycle it. When is back up im going to move the messages in mqueue.in into mqueue and see how sendmail copes with them, in the meantime can anyone offer any potential explanations? seems to have got itself into a loop but Im not sure what action ive taken that has caused it. Extract of maillog below. Paul Mar 21 16:01:02 cobalt100 mailscanner[2368]: MailScanner E-Mail Virus Scanner version 3.12 starting. Mar 21 16:01:02 cobalt100 mailscanner[2368]: Configuring mailscanner for sendmail... Mar 21 16:01:02 cobalt100 mailscanner[2371]: Startup: found 76 messages waiting Mar 21 16:01:03 cobalt100 mailscanner[2371]: Forwarding 1 clean messages, 1070 bytes Mar 21 16:01:03 cobalt100 mailscanner[2371]: Scanning 75 messages, 8624865 bytes Mar 21 16:01:05 cobalt100 sendmail[2447]: g2LFctm00950: to=, delay=00:22:10, xdelay=00:00:00, mailer=local, pri=120508, dsn=2.0.0, stat=Sent Mar 21 16:01:30 cobalt100 sendmail[2473]: g2LG1Tn02473: from=, size=3912, class=0, nrcpts=1, msgid=, proto=ESMTP, daemon=MTA, relay=anchor-post-33.mail.demon.net [194.217.242.91] Mar 21 16:01:31 cobalt100 sendmail[2474]: g2LG1Tn02473: to=, delay=00:00:01, xdelay=00:00:01, mailer=local, pri=32328, dsn=2.0.0, stat=Sent Mar 21 16:01:44 cobalt100 in.qpopper[2496]: (v?) POP login by user "admin" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:44 cobalt100 in.qpopper[2495]: (v?) POP login by user "4front1654" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:53 cobalt100 sendmail[2500]: g2LG1qn02500: from=, size=12187, class=0, nrcpts=1, msgid=<200203211601.g2LG1qn02500@cobalt100.fm.netbenefit.co.uk>, proto=SMTP, daemon=MTA, relay=kryten.sift.co.uk [194.131.210.136] Mar 21 16:01:53 cobalt100 sendmail[2499]: g2LG1qn02499: from=, size=12182, class=0, nrcpts=1, msgid=<200203211601.g2LG1qn02499@cobalt100.fm.netbenefit.co.uk>, proto=SMTP, daemon=MTA, relay=kryten.sift.co.k [194.131.210.136] Mar 21 16:01:56 cobalt100 sendmail[2502]: g2LG1qn02500: to=, delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:01:56 cobalt100 sendmail[2501]: g2LG1qn02499: to=, delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:45 cobalt100 in.qpopper[2524]: gtev4441 at 194.222.213.195 (194.222.213.195): -ERR [AUTH] PAM authentication failed for user "gtev4441": Module is unknown (28) Mar 21 16:02:45 cobalt100 in.qpopper[2524]: [AUTH] Failed attempted login to gtev4441 from host (194.222.213.195) 194.222.213.195 Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:55 cobalt100 in.qpopper[2527]: 4front1654 at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication failed for user "4front1654": Module is unknown (28) Mar 21 16:02:55 cobalt100 in.qpopper[2527]: [AUTH] Failed attempted login to 4front1654 from host (213.1.134.11) 213.1.134.11 Mar 21 16:02:55 cobalt100 in.qpopper[2529]: admin at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication failed for user "admin": Module is unknown (28) Mar 21 16:02:55 cobalt100 in.qpopper[2529]: [AUTH] Failed attempted login to admin from host (213.1.134.11) 213.1.134.11 Mar 21 16:03:10 cobalt100 sendmail[2548]: g2LG39n02548: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:10 cobalt100 sendmail[2533]: g2LG31n02533: SYSERR(root): SMTP-MAIL: died on signal 11 Mar 21 16:03:23 cobalt100 in.qpopper[2551]: I/O Error from at 62.6.75.159 (62.6.75.159): [-1] 104 (Connection reset by peer); 0 (Success) Mar 21 16:03:23 cobalt100 in.qpopper[2551]: (null) at 62.6.75.159 (62.6.75.159): -ERR POP EOF or I/O Error: 104 (Connection reset by peer); 0 (Success) Mar 21 16:03:26 cobalt100 sendmail[2552]: g2LG3Qn02552: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:27 cobalt100 sendmail[2550]: g2LG3Jn02550: SYSERR(root): SMTP-MAIL: died on signal 11 Mar 21 16:04:34 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:05:17 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot open hash database /etc/mail/aliases.db: Cannot allocate memory Mar 21 16:59:45 cobalt100 sendmail[387]: alias database /etc/mail/aliases rebuilt by root Mar 21 16:59:45 cobalt100 sendmail[387]: /etc/mail/aliases: 26 aliases, longest 33 bytes, 473 bytes total From jan.selen at INGA.FI Mon Mar 25 11:00:34 2002 From: jan.selen at INGA.FI (Jan Selen) Date: Thu Jan 12 21:14:34 2006 Subject: smap and mailscanner Message-ID: I'm using smap from the TIS firewall toolkit to relay mail to our real mail server. smap receives the mail, puts it in a spool directory, and then the smapd-daemon invokes sendmail for delivery. What is the best way to get mailscanner to work whith this setup, do I really have to use sendmail instead of smap to listen for email, or is there some other (easier) way to get the mail to mailscanner? Jan From paul_houselander at BRISTOL-CITY.GOV.UK Mon Mar 25 13:48:07 2002 From: paul_houselander at BRISTOL-CITY.GOV.UK (Paul Houselander) Date: Thu Jan 12 21:14:34 2006 Subject: Server Crash Message-ID: Bit more info. Ive taken the message and put on a different box with a fresh copy of mailscanner and can duplicate the problem. I started in debug mode but it did not output any messages, looking at px it spend ages doing a cat "/bin/cat /var/spool/MailScanner/incomming/g2LC0jG18107.header /var/spool/mqueue.in/dfg2LC0jG18107" Eventually this process becomes defunct. Looking in /var/spool/MailScanner/incomming/g2LC0jG18107, hundreds of messages are created with filenames like msg-20434-1000.txt, each file contains the following text The attached message could not be delivered due to the transmission error shown in the transcript below. >220 cobalt100.fm.netbenefit.co.uk ESMTP Sendmail 8.10.2/8.10.2; Thu, 21 Mar 2002 11:39:50 GMT EHLO helpdesq.co.uk >250-cobalt100.fm.netbenefit.co.uk Hello host213-122-57-5.in-addr.btopenworld.com [213.122.57.5], pleased to meet you >250-ENHANCEDSTATUSCODES >250-8BITMIME >250-SIZE 10485760 >250-DSN >250-ONEX >250-ETRN >250-XUSR >250-AUTH PLAIN >250 HELP MAIL FROM: >250 2.1.0 ... Sender ok RCPT TO: >550 5.7.1 ... Relaying denied. Please check your mail first. I guess MailScanner has separated the attachments from the message and is creating the files to scan, so is doing everything it should, however due to the volume of attachments it falls over. Paul >>> paul_houselander@BRISTOL-CITY.GOV.UK 03/25 10:56 am >>> I think the SSL/PAM stuff was as a result of the mailscanner problem Ive got it running ok now, the first message in the /var/spool/mqueue.in was a bit strange, seemed that every 3 seconds it attempted to send a mail but got a relaying denied message (this was because pop before smtp was on), not sure why it was trying to do it every 3 seconds? Anyway the resulting message was just over 1mb in size filled with the below errors >250 HELP MAIL FROM: >250 2.1.0 ... Sender ok RCPT TO: >550 5.7.1 ... Relaying denied. Please check your mail first. Seems consistent, as soon as I moved this message manually, mailscanner was fine. Any ideals, I dont think this is likely to happen to often, but once is enough. Paul >>> brose@MED.WAYNE.EDU 03/22/02 19:17 PM >>> It looks likes it's really between your ssl libcrypt library and PAM. Is you pam db ok? -----Original Message----- From: Paul Houselander [mailto:paul_houselander@BRISTOL-CITY.GOV.UK] Sent: Friday, March 22, 2002 12:47 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Server Crash I am running MailScanner on a cobalt box. Has been running happily for over a week, yesterday the machine fell over, and does so everytime I now start up mailscanner, their are messages (75) in mqueue.in, I had signature/spam/custom headers defined in mailscanner.conf so have defaulted back to the original installation, however everytime I start mailscanner, after approx 3-4 mins the machine complains of being out of memory and falls over. Its a remote machine so takes a bit of time to get someone to go and power cycle it. When is back up im going to move the messages in mqueue.in into mqueue and see how sendmail copes with them, in the meantime can anyone offer any potential explanations? seems to have got itself into a loop but Im not sure what action ive taken that has caused it. Extract of maillog below. Paul Mar 21 16:01:02 cobalt100 mailscanner[2368]: MailScanner E-Mail Virus Scanner version 3.12 starting. Mar 21 16:01:02 cobalt100 mailscanner[2368]: Configuring mailscanner for sendmail... Mar 21 16:01:02 cobalt100 mailscanner[2371]: Startup: found 76 messages waiting Mar 21 16:01:03 cobalt100 mailscanner[2371]: Forwarding 1 clean messages, 1070 bytes Mar 21 16:01:03 cobalt100 mailscanner[2371]: Scanning 75 messages, 8624865 bytes Mar 21 16:01:05 cobalt100 sendmail[2447]: g2LFctm00950: to=, delay=00:22:10, xdelay=00:00:00, mailer=local, pri=120508, dsn=2.0.0, stat=Sent Mar 21 16:01:30 cobalt100 sendmail[2473]: g2LG1Tn02473: from=, size=3912, class=0, nrcpts=1, msgid=, proto=ESMTP, daemon=MTA, relay=anchor-post-33.mail.demon.net [194.217.242.91] Mar 21 16:01:31 cobalt100 sendmail[2474]: g2LG1Tn02473: to=, delay=00:00:01, xdelay=00:00:01, mailer=local, pri=32328, dsn=2.0.0, stat=Sent Mar 21 16:01:44 cobalt100 in.qpopper[2496]: (v?) POP login by user "admin" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:44 cobalt100 in.qpopper[2495]: (v?) POP login by user "4front1654" at (213.1.134.11) 213.1.134.11 Mar 21 16:01:53 cobalt100 sendmail[2500]: g2LG1qn02500: from=, size=12187, class=0, nrcpts=1, msgid=<200203211601.g2LG1qn02500@cobalt100.fm.netbenefit.co.uk>, proto=SMTP, daemon=MTA, relay=kryten.sift.co.uk [194.131.210.136] Mar 21 16:01:53 cobalt100 sendmail[2499]: g2LG1qn02499: from=, size=12182, class=0, nrcpts=1, msgid=<200203211601.g2LG1qn02499@cobalt100.fm.netbenefit.co.uk>, proto=SMTP, daemon=MTA, relay=kryten.sift.co.k [194.131.210.136] Mar 21 16:01:56 cobalt100 sendmail[2502]: g2LG1qn02500: to=, delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:01:56 cobalt100 sendmail[2501]: g2LG1qn02499: to=, delay=00:00:03, xdelay=00:00:01, mailer=local, pri=41564, dsn=2.0.0, stat=Sent Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:35 cobalt100 in.qpopper[2524]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:45 cobalt100 in.qpopper[2524]: gtev4441 at 194.222.213.195 (194.222.213.195): -ERR [AUTH] PAM authentication failed for user "gtev4441": Module is unknown (28) Mar 21 16:02:45 cobalt100 in.qpopper[2524]: [AUTH] Failed attempted login to gtev4441 from host (194.222.213.195) 194.222.213.195 Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100 in.qpopper[2527]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM unable to dlopen(/lib/security/pam_pwdb.so) Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM [dlerror: libcrypt.so.1: cannot map zero-fill pages: Cannot allocate memory] Mar 21 16:02:45 cobalt100 in.qpopper[2529]: PAM adding faulty module: /lib/security/pam_pwdb.so Mar 21 16:02:55 cobalt100 in.qpopper[2527]: 4front1654 at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication failed for user "4front1654": Module is unknown (28) Mar 21 16:02:55 cobalt100 in.qpopper[2527]: [AUTH] Failed attempted login to 4front1654 from host (213.1.134.11) 213.1.134.11 Mar 21 16:02:55 cobalt100 in.qpopper[2529]: admin at 213.1.134.11 (213.1.134.11): -ERR [AUTH] PAM authentication failed for user "admin": Module is unknown (28) Mar 21 16:02:55 cobalt100 in.qpopper[2529]: [AUTH] Failed attempted login to admin from host (213.1.134.11) 213.1.134.11 Mar 21 16:03:10 cobalt100 sendmail[2548]: g2LG39n02548: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:10 cobalt100 sendmail[2533]: g2LG31n02533: SYSERR(root): SMTP-MAIL: died on signal 11 Mar 21 16:03:23 cobalt100 in.qpopper[2551]: I/O Error from at 62.6.75.159 (62.6.75.159): [-1] 104 (Connection reset by peer); 0 (Success) Mar 21 16:03:23 cobalt100 in.qpopper[2551]: (null) at 62.6.75.159 (62.6.75.159): -ERR POP EOF or I/O Error: 104 (Connection reset by peer); 0 (Success) Mar 21 16:03:26 cobalt100 sendmail[2552]: g2LG3Qn02552: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:03:27 cobalt100 sendmail[2550]: g2LG3Jn02550: SYSERR(root): SMTP-MAIL: died on signal 11 Mar 21 16:04:34 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot open hash database /etc/mail/popip.db: Cannot allocate memory Mar 21 16:05:17 cobalt100 sendmail[2583]: g2LG4Un02583: SYSERR(root): Cannot open hash database /etc/mail/aliases.db: Cannot allocate memory Mar 21 16:59:45 cobalt100 sendmail[387]: alias database /etc/mail/aliases rebuilt by root Mar 21 16:59:45 cobalt100 sendmail[387]: /etc/mail/aliases: 26 aliases, longest 33 bytes, 473 bytes total From LISTSERV at JISCMAIL.AC.UK Mon Mar 25 12:47:22 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:34 2006 Subject: MAILSCANNER: bmx666@WEB.DE requested to join Message-ID: <200203251247.MAA03350@magpie.ecs.soton.ac.uk> Mon, 25 Mar 2002 12:47:22 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Jan Brinkmann You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER bmx666@WEB.DE Jan Brinkmann PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER bmx666@WEB.DE Jan Brinkmann // EOJ From LISTSERV at JISCMAIL.AC.UK Mon Mar 25 13:56:50 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:34 2006 Subject: MAILSCANNER: richard.hall@INGENTA.COM requested to join Message-ID: <200203251356.NAA16623@magpie.ecs.soton.ac.uk> Mon, 25 Mar 2002 13:56:50 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Richard Hall You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER richard.hall@INGENTA.COM Richard Hall PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER richard.hall@INGENTA.COM Richard Hall // EOJ From jkf at ecs.soton.ac.uk Mon Mar 25 14:12:05 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:34 2006 Subject: ANNOUNCE: Version 3.13-1 released Message-ID: <5.1.0.14.2.20020325140659.02bae008@imap.ecs.soton.ac.uk> I have just released MailScanner version 3.13-1. This is to fix the problems caused by viruses embedding newline characters in the middle of the subject line, which broke the MIME parsing code. I have also fixed the Sophos "autoupdate" script to properly handle the new Sophos "NSV" version of their virus scanner. Downloadable, as per usual, from http://www.mailscanner.info/ As this fixes a problem which could cause a virus to get into your site, I would strongly recommend all users upgrade to this version. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From jkf at ecs.soton.ac.uk Mon Mar 25 14:22:19 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:34 2006 Subject: Viruses - Missed by mailscanner, caught by Sophos NSV In-Reply-To: References: <3C8DDD5A.24225.236DCD9C@localhost> Message-ID: <5.1.0.14.2.20020325142134.053a81c0@imap.ecs.soton.ac.uk> This is due to the virus embedding newline characters in the middle of the subject :-( Version 3.13-1 (just released) corrects this behaviour by removing newline characters from the middle of header lines. At 16:22 12/03/2002, you wrote: >On Tue, 12 Mar 2002, David Sullivan wrote: > > > > > > The following message seems to be a spanner in the works however: >(names > > > > changed to protect the innocent) ... > > > > http://www.barnet.ac.uk/~sully/missed.txt > > > > > > David, > > > > > > which virus did Sophos NSV report and what version of Sophos are you > running > > > on the hubs? > > > > Real-time: >>> Virus 'W32/Magistr-A' found in file > > STAFF:/*****/PMAIL/Y08850/SULFNBK.EXE > > Reported by 3.55NSV on Netware, we're still running 3.54 on Linux on the > > mailhub, I will be upgrading soon once I've fixed up MailScanner to be > happy > > with the nsv version as covered previously > >After more investigation I can see that our second layer virus scanning at >the Exchange level is also picking up instances of viruses that should be >screened out by mailscanner. Most of the instances involve the virus >Magistr-A > >David, you are right in believing the new enhanced version 3.55NSV detects >and disinfects this ;-). However there is still a problem for those people >who aren't using sophos :-( > > > If sweep can do it's own parsing and potentially pick up things that > > MailScanner's mime parser doesn't it might be the case of going down > the same > > road as TNEF and use sweep in preference to parsing MIME ourselves. > >I agree partly, however I would prefer to leave in the mailscanner >parsing as I think mailscanner needs it to filter for prohibited >filenames and filetypes and it can work in addition to Sophos 3.55NSV parsing. > > > > > -- > > David Sullivan IT Services, Barnet College, London > > David.Sullivan@barnet.ac.uk > > 020 8275 5036 > > > > ============================================================== > > This communication may contain privileged or confidential information which > > is for the exclusive use of the intended recipient. If you are not the > > intended recipient, please note that you may not distribute or use this > > communication or the information it contains. If this e-mail has > reached you > > in error, please delete it and any attachment. > > > > Internet communications are not secure and Barnet College does not accept > > legal responsibility for the content of this message. Any views or > opinions > > expressed are those of the author and not necessarily those of Barnet > College. > > > > Please note that Barnet College reserves the right to monitor the > > source/destinations of all incoming or outgoing e-mail communications. > > ============================================================== > > -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From Q.G.Campbell at NEWCASTLE.AC.UK Mon Mar 25 14:40:07 2002 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:14:34 2006 Subject: ANNOUNCE: Version 3.13-1 released Message-ID: Julian Is there a patch to 3.12-5 which I only installed yesterday. :-( I am not worried about the Sophos stuff. If you have just changed one module for the Subject line fix, can you let me know which module it is? Thanks Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." > -----Original Message----- > From: Julian Field [mailto:jkf@ecs.soton.ac.uk] > Sent: 25 March 2002 14:12 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: ANNOUNCE: Version 3.13-1 released > > > I have just released MailScanner version 3.13-1. > > This is to fix the problems caused by viruses embedding > newline characters in the middle of the subject line, which > broke the MIME parsing code. > > I have also fixed the Sophos "autoupdate" script to properly > handle the new Sophos "NSV" version of their virus scanner. > > Downloadable, as per usual, from > http://www.mailscanner.info/ > > As this fixes a problem which could cause a virus to get into > your site, I would strongly recommend all users upgrade to > this version. > -- > Julian Field Teaching Systems Manager > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ > From LISTSERV at JISCMAIL.AC.UK Mon Mar 25 14:49:32 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:34 2006 Subject: MAILSCANNER: jbagwell@YAHOO.COM left the JISCmail list Message-ID: <200203251449.OAA22779@magpie.ecs.soton.ac.uk> Mon, 25 Mar 2002 14:49:32 jbagwell@YAHOO.COM has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From jkf at ecs.soton.ac.uk Mon Mar 25 14:52:24 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:34 2006 Subject: ANNOUNCE: Version 3.13-1 released In-Reply-To: Message-ID: <5.1.0.14.2.20020325145056.02af6400@imap.ecs.soton.ac.uk> At 14:40 25/03/2002, you wrote: >Julian > >Is there a patch to 3.12-5 which I only installed yesterday. :-( > >I am not worried about the Sophos stuff. If you have just changed one >module for the Subject line fix, can you let me know which module it is? mta-specific.pl In particular, a new chunk of code just before the bottom of each ReadQf() function, and a 1-word change in the last line of each ReadQf(). Diff mta-specific.pl with your old one and you'll see the change. Who's off to NetWorkshop tomorrow? I'll be there... > > -----Original Message----- > > From: Julian Field [mailto:jkf@ecs.soton.ac.uk] > > Sent: 25 March 2002 14:12 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: ANNOUNCE: Version 3.13-1 released > > > > > > I have just released MailScanner version 3.13-1. > > > > This is to fix the problems caused by viruses embedding > > newline characters in the middle of the subject line, which > > broke the MIME parsing code. > > > > I have also fixed the Sophos "autoupdate" script to properly > > handle the new Sophos "NSV" version of their virus scanner. > > > > Downloadable, as per usual, from > > http://www.mailscanner.info/ > > > > As this fixes a problem which could cause a virus to get into > > your site, I would strongly recommend all users upgrade to > > this version. > > -- > > Julian Field Teaching Systems Manager > > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > > Tel. 023 8059 2817 University of Southampton > > Southampton SO17 1BJ > > -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From mike at ZANKER.ORG Mon Mar 25 14:55:46 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:34 2006 Subject: ANNOUNCE: Version 3.13-1 released In-Reply-To: <5.1.0.14.2.20020325140659.02bae008@imap.ecs.soton.ac.uk> References: <5.1.0.14.2.20020325140659.02bae008@imap.ecs.soton.ac.uk> Message-ID: <9019038.1017068145@mallard.open.ac.uk> On 25 March 2002 14:12 +0000 Julian Field wrote: > I have just released MailScanner version 3.13-1. When diffing mailscanner.conf with my installed version I noticed that Debug is set to 1 rather than 0. Is this an oversight or intentional? Thanks, Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From jkf at ecs.soton.ac.uk Mon Mar 25 15:03:30 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:34 2006 Subject: ANNOUNCE: Version 3.13-1 released In-Reply-To: <9019038.1017068145@mallard.open.ac.uk> References: <5.1.0.14.2.20020325140659.02bae008@imap.ecs.soton.ac.uk> <5.1.0.14.2.20020325140659.02bae008@imap.ecs.soton.ac.uk> Message-ID: <5.1.0.14.2.20020325150318.02bd0740@imap.ecs.soton.ac.uk> At 14:55 25/03/2002, you wrote: >On 25 March 2002 14:12 +0000 Julian Field wrote: > >>I have just released MailScanner version 3.13-1. > >When diffing mailscanner.conf with my installed version I noticed that >Debug is set to 1 rather than 0. Is this an oversight or intentional? Bother. Will fix that immediately. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From howard at harper-adams.ac.uk Mon Mar 25 15:14:08 2002 From: howard at harper-adams.ac.uk (Howard Robinson) Date: Thu Jan 12 21:14:34 2006 Subject: Novell 6 & pegasus Pleas for information Message-ID: <200203251511.g2PFBuB25271@blackhole.harper-adams.ac.uk> Dear list members We are looking to upgrade from Netware 5.1 to 6 but can't find any reference to Pegasus being supported on Novell 6. Do you use Netware 6? If you do, do you use Pegasus mail? If you are can you still use mercury? If so does it work okay? If not what do you use instead? Any help appreciated. Regards Howard Robinson (Senior Technical Development Officer) Harper Adams University College Edgmond Newport Shropshire TF10 8NB UK E-mail: hrobinson@harper-adams.ac.uk Tel. : +44(0)1952 820280 Via switchboard : +44(0)1952 815253 Direct line Fax. : +44(0)1952 814783 College Web site http://www.harper-adams.ac.uk From mike at ZANKER.ORG Mon Mar 25 15:18:32 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:34 2006 Subject: ANNOUNCE: Version 3.13-1 released In-Reply-To: <5.1.0.14.2.20020325145056.02af6400@imap.ecs.soton.ac.uk> References: <5.1.0.14.2.20020325145056.02af6400@imap.ecs.soton.ac.uk> Message-ID: <10385213.1017069512@mallard.open.ac.uk> On 25 March 2002 14:52 +0000 Julian Field wrote: > Who's off to NetWorkshop tomorrow? I'll be there... Giving it a miss this year but two of my Network Analysts will be there. It was one of them who brought MailScanner to my attention after seeing your presentation last year. Mike (posting under private e-mail address but headers should give my .ac.uk location away :) From LISTSERV at JISCMAIL.AC.UK Mon Mar 25 14:57:54 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:34 2006 Subject: MAILSCANNER: marnell@LTCQ.COM left the JISCmail list Message-ID: <200203251457.OAA23510@magpie.ecs.soton.ac.uk> Mon, 25 Mar 2002 14:57:54 Mike Marnell has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Mon Mar 25 15:57:16 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:34 2006 Subject: MAILSCANNER: clong@ALPHASYS.FR requested to join Message-ID: <200203251557.PAA29084@magpie.ecs.soton.ac.uk> Mon, 25 Mar 2002 15:57:16 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Christophe Long You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER clong@ALPHASYS.FR Christophe Long PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER clong@ALPHASYS.FR Christophe Long // EOJ From lbergman at abi.tconline.net Mon Mar 25 18:06:30 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:34 2006 Subject: Virus Recommendations Message-ID: <200203251806.g2PI6Ui02887@lewis.abi.tconline.net> To expand on the virus recommendation deal a bit. What are the recommendations? Is f-prot good? I suppose the fact that sophos is the default that is a bit of a recommendation there. Any recommends with short justifications. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From otsuarez at CASA.CULT.CU Mon Mar 25 19:32:32 2002 From: otsuarez at CASA.CULT.CU (Osvaldo T. Suarez) Date: Thu Jan 12 21:14:34 2006 Subject: installing from the rpm Message-ID: <005b01c1d433$cf3da9b0$0119a8c0@casa.cult.cu> Hi: I am installing a new mail server, based on redhat 7.1. I just downloaded the latest mailscanner version (3.13-2) and when i try to installed it, I got this message: _________________________________________ error: failed dependencies: gcc is needed by mailscanner-3.13-2 unzip is needed by mailscanner-3.13-2 _________________________________________ The problem is that since I try to make the minimal installation posible, I left out a lot of things. I don't have problems with installing unzip, but what about gcc? I was trying to avoid having a compiler installed on a production server. Does anybody knows what is the gcc needed for? And so, could I just ignored it? Regards, toja From jkf at ecs.soton.ac.uk Mon Mar 25 20:00:20 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:34 2006 Subject: installing from the rpm In-Reply-To: <005b01c1d433$cf3da9b0$0119a8c0@casa.cult.cu> Message-ID: <5.1.0.14.2.20020325195922.029110d0@hawk.ecs.soton.ac.uk> At 19:32 25/03/2002, you wrote: >error: failed dependencies: >gcc is needed by mailscanner-3.13-2 >unzip is needed by mailscanner-3.13-2 >_________________________________________ >The problem is that since I try to make the minimal installation posible, I >left out a lot of things. I don't have problems with installing unzip, but >what about gcc? I was trying to avoid having a compiler installed on a >production server. Does anybody knows what is the gcc needed for? And so, >could I just ignored it? gcc is needed to install the MIME-tools Perl module, as the Base64 decoder within it is written in C for speed. You can always install it, then install MailScanner, then uninstall the compiler again. -- Julian Field Teaching Systems Manager jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science Tel. 023 8059 2817 University of Southampton Southampton SO17 1BJ From james at PCXPERIENCE.COM Mon Mar 25 20:05:56 2002 From: james at PCXPERIENCE.COM (James A. Pattie) Date: Thu Jan 12 21:14:34 2006 Subject: installing from the rpm References: <5.1.0.14.2.20020325195922.029110d0@hawk.ecs.soton.ac.uk> Message-ID: <3C9F8324.4050107@pcxperience.com> Optionally, we could update the spec file to just require the perl modules as rpms and then build and distribute the perl module rpms from the spec files I provided last month. This way you don't need gcc installed. The added benefits are that you aren't rebuilding the same perl modules every time you upgrade mailscanner and you possibly aren't overriding a newer version of the perl module with what is included in the mailscanner package. Julian Field wrote: > At 19:32 25/03/2002, you wrote: > >> error: failed dependencies: >> gcc is needed by mailscanner-3.13-2 >> unzip is needed by mailscanner-3.13-2 >> _________________________________________ >> The problem is that since I try to make the minimal installation >> posible, I >> left out a lot of things. I don't have problems with installing unzip, >> but >> what about gcc? I was trying to avoid having a compiler installed on a >> production server. Does anybody knows what is the gcc needed for? And so, >> could I just ignored it? > > > gcc is needed to install the MIME-tools Perl module, as the Base64 decoder > within it is written in C for speed. > You can always install it, then install MailScanner, then uninstall the > compiler again. > -- > Julian Field Teaching Systems Manager > jkf@ecs.soton.ac.uk Dept. of Electronics & Computer Science > Tel. 023 8059 2817 University of Southampton > Southampton SO17 1BJ -- James A. Pattie james@pcxperience.com Linux -- SysAdmin / Programmer PC & Web Xperience, Inc. http://www.pcxperience.com/ From kylist at SHCORP.COM Mon Mar 25 20:32:11 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:34 2006 Subject: some messages not getting scanned In-Reply-To: <20020324210017.GQ15136@hoiho.nz.lemon-computing.com> References: <20020324210017.GQ15136@hoiho.nz.lemon-computing.com> Message-ID: <42094.10.10.1.95.1017088331.squirrel@webmail.shcorp.com> Nick Phillips said: > On Sun, Mar 24, 2002 at 11:07:33AM -0500, Kurt Yoder wrote: >> Hello all >> >> I'm noticing that some messages are not being scanned by mailscanner. >> They simply pass through and get no "X-MailScanner: Found to be clean" >> message. Here's an example from my logs: >> >> Mar 24 10:27:25 pangaea sm-mta[13995]: g2OFRPt2013995: >> from=, size=2721, class=0, nrcpts=1, >> msgid=<200203241527.g2OFROKC007439@eurasia.shcorp.com>, >> bodytype=8BITMIME, proto=ESMTP, daemon=MTA, relay=eurasia.shcorp.com >> [10.10.2.5] >> Mar 24 10:27:43 pangaea sm-mta[14002]: g2OFRPt2013995: >> to=besales1@aragorn.shcorp.com, delay=00:00:18, xdelay=00:00:00, >> mailer=esmtp, pri=123422, relay=aragorn.shcorp.com. [10.10.1.235], >> dsn=2.0.0, stat=Sent (g2OFRhf83782 Message accepted for delivery) > > Looks like the secoond sendmail is using the same queue as the first > one. So, most likely your sendmail is not configured right. > > In fact, if it only happens sometimes, I'd say that your "incoming" > sendmail is the one that's wrong - it's probably queue-running as well > as accepting incoming messages. > > I can't remember where the option to change that is in Debian, though. > You did say you were using Debian, didn't you? > > Have a look in /etc/defaults/sendmail or somewhere like that; I'll try > to find out exactly where. > > > > Cheers, > > > Nick > > -- > Nick Phillips -- nwp@lemon-computing.com > Good news. Ten weeks from Friday will be a pretty good day. Yah, Debian... here's my setup: root@pangaea:/etc/mail# cat sendmail.conf | grep -v ^# | grep -v ^$ DAEMON_MODE="Daemon"; DAEMON_PARMS="-ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in";DAEMON_HOSTSTATS="Yes"; DAEMON_MAILSTATS="No"; QUEUE_MODE="${DAEMON_MODE}"; QUEUE_INTERVAL="10"; QUEUE_PARMS=""; MSP_MODE="${QUEUE_MODE}"; MSP_INTERVAL="${QUEUE_INTERVAL}"; MSP_PARMS="${QUEUE_PARMS}"; MSP_MAILSTATS="No"; MISC_PARMS=""; CRON_MAILTO="root"; CRON_PARMS=""; AGE_DATA=""; DAEMON_STATS="${DAEMON_MAILSTATS}"; MSP_STATS="${MSP_MAILSTATS}"; Looks to me like it *should* be using mqueue.in to deliver incoming messages... -- Kurt Yoder Sport & Health network administrator From kylist at SHCORP.COM Mon Mar 25 20:39:34 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:34 2006 Subject: spamassassin not called on Debian? In-Reply-To: <78578199.1016955830@jemima.zanker.org> References: <78578199.1016955830@jemima.zanker.org> Message-ID: <42120.10.10.1.95.1017088774.squirrel@webmail.shcorp.com> Mike Zanker said: > On 24 March 2002 00:06 -0500 Kurt Yoder wrote: > >> Mailscanner doesn't appear to be using spamassassin, even though I've >> got the mailscanner.cf file set with option "Use SpamAssassin = yes". >> I sent myself a redirected spam, but it wasn't caught. I'm not even >> seeing the X-header "X-MailScanner-SpamCheck:". Mails from the >> internet (ie, they aren't in the whitelist) don't show this X-header >> either... > > Are you sure that you haven't got your network or e-mail address in the > network or e-mail address whitelist? That would prevent spams that you > forward to yourself being processed. This caught me out when I was > testing. > > Also, the X-header is only added to e-mails that are found to be spam. Well, I just sent myself the confirmed spam from my yahoo account, but still no spamassassin intervention. I know it would be flagged as spam if spamassassin were looking at it, because I tried scanning it with "spamassassin -t". Any other ideas? Is there a mailscanner debug option that can show me what's happening at the point that spamassassin would normally be called? -- Kurt Yoder Sport & Health network administrator From Q.G.Campbell at NEWCASTLE.AC.UK Tue Mar 26 08:40:51 2002 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog Message-ID: Have recently installed MailScanner 3.12-5 on a new system and notice that I no longer see "mailscanner" messages (eg. Scanning 2 messages, ...) in the sendmail logs. This installation is a Linux (RedHat 7.2) system. The current systems are Solaris 7 running with MailScanner 3.10-3 and "mailscanner" messages do appear in the sendmail logs. Is this a change in MailScanner since 3.10-3? I cannot see why the syslog.conf file on Linux may be losing the "mailscanner" messages as sendmail records are being logged as I require. Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From henrik at LEWANDER.COM Tue Mar 26 09:47:42 2002 From: henrik at LEWANDER.COM (Henrik Lewander) Date: Thu Jan 12 21:14:34 2006 Subject: Spamassassin reports Message-ID: <060e01c1d4ab$4676ee20$d62211c2@gbg.bluelabs.se> Hi! I would like to add spamassassins reports to the header of spam messages but it seems like mailscanner doesn't forward these headers, I just get the X-MailScanner-SpamCheck: SpamAssassin (7 hits) header. The reports I'm talking about is the one you get with "report_header 1" in spamassassin's user_prefs. Is it possible to get those headers? Or maybe I'm doing something wrong, which spamassassin config file is used when called from mailscanner? I run mailscanner with exim, f-prot & spamassassin. Regards, Henrik From paul_houselander at BRISTOL-CITY.GOV.UK Tue Mar 26 12:39:48 2002 From: paul_houselander at BRISTOL-CITY.GOV.UK (Paul Houselander) Date: Thu Jan 12 21:14:34 2006 Subject: Useful Feature? Message-ID: I relay mail for quite a few domains. Would be very useful to be able to configure/turn on/turn off features on a domain by domain basis. e.g. abc.bristol.sch.uk want .exe attachments but no one else does xyz.org.uk have their own local tech support so I want VirusWarning.txt and the body signature to give a message advising to contact local tech support. Does anyone else think this would be useful? Has anyone written any patches to achieve this? my perl knowledge is not at a level where I would feel confident doing this myself. The Scan/Skip Ruleset feature mentioned in the "Plans for the Next Version" would be useful as well. Paul Houselander Network & Intranet Support Officer Bristol City Council From otsuarez at CASA.CULT.CU Tue Mar 26 14:10:55 2002 From: otsuarez at CASA.CULT.CU (Osvaldo T. Suarez) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog References: Message-ID: <001501c1d4d0$0bd29240$0119a8c0@casa.cult.cu> Hi: Did you try adding the "-r" option in /etc/sysconfig/syslog? it would look like this (on a redhat 7.1 server) SYSLOGD_OPTIONS="-m 0 -r" regards toja ----- Original Message ----- From: "Quentin Campbell" To: Sent: Tuesday, March 26, 2002 3:40 AM Subject: MailScanner and syslog Have recently installed MailScanner 3.12-5 on a new system and notice that I no longer see "mailscanner" messages (eg. Scanning 2 messages, ...) in the sendmail logs. This installation is a Linux (RedHat 7.2) system. The current systems are Solaris 7 running with MailScanner 3.10-3 and "mailscanner" messages do appear in the sendmail logs. Is this a change in MailScanner since 3.10-3? I cannot see why the syslog.conf file on Linux may be losing the "mailscanner" messages as sendmail records are being logged as I require. Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From lbergman at abi.tconline.net Tue Mar 26 14:30:07 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:34 2006 Subject: Spamassassin reports In-Reply-To: <060e01c1d4ab$4676ee20$d62211c2@gbg.bluelabs.se> References: <060e01c1d4ab$4676ee20$d62211c2@gbg.bluelabs.se> Message-ID: <200203261430.g2QEU7203896@lewis.abi.tconline.net> On Tuesday 26 March 2002 03:47 am, you wrote: > Hi! > > I would like to add spamassassins reports to the header of spam messages > but it seems like mailscanner doesn't forward these headers, I just get the > X-MailScanner-SpamCheck: SpamAssassin (7 hits) header. The reports I'm > talking about is the one you get with "report_header 1" in spamassassin's > user_prefs. Is it possible to get those headers? Or maybe I'm doing > something wrong, which spamassassin config file is used when called from > mailscanner? I run mailscanner with exim, f-prot & spamassassin. > > Regards, > Henrik The /root/.spamassassin and /etc/mail/spamassassin/ files are both used. Have you checked the config line in mailscanner.conf about detailed reports? -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From lbergman at abi.tconline.net Tue Mar 26 14:44:45 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:34 2006 Subject: FEATURE(dnsbl...... in sendmail Message-ID: <200203261444.g2QEijT03900@lewis.abi.tconline.net> I have had a few blacklist entries in my sendmail.mc which I generate my cf file with. Now that those entries are in MailScanner should I remove those? -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From mike at ZANKER.ORG Tue Mar 26 15:06:17 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:34 2006 Subject: FEATURE(dnsbl...... in sendmail In-Reply-To: <200203261444.g2QEijT03900@lewis.abi.tconline.net> References: <200203261444.g2QEijT03900@lewis.abi.tconline.net> Message-ID: <96055210.1017155177@mallard.open.ac.uk> On 26 March 2002 08:44 -0600 Lewis Bergman wrote: > I have had a few blacklist entries in my sendmail.mc which I generate > my cf file with. Now that those entries are in MailScanner should I > remove those? That depends whether you want to simply tag the mail as spam or reject the remote mail server at the point of delivery. Use MailScanner for the former and sendmail.mc for the latter. Incidentally, I find that spammers are injecting via my secondary MX host more and more which means the sendmail method fails. However, it should still be tagged by MailScanner. Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From henrik at LEWANDER.COM Tue Mar 26 15:08:19 2002 From: henrik at LEWANDER.COM (Henrik Lewander) Date: Thu Jan 12 21:14:34 2006 Subject: Spamassassin reports References: <060e01c1d4ab$4676ee20$d62211c2@gbg.bluelabs.se> <200203261430.g2QEU7203896@lewis.abi.tconline.net> Message-ID: <094601c1d4d8$10e45b30$d62211c2@gbg.bluelabs.se> > > Hi! > > > > I would like to add spamassassins reports to the header of spam messages > > but it seems like mailscanner doesn't forward these headers, I just get the > > X-MailScanner-SpamCheck: SpamAssassin (7 hits) header. The reports I'm > > talking about is the one you get with "report_header 1" in spamassassin's > > user_prefs. Is it possible to get those headers? Or maybe I'm doing > > something wrong, which spamassassin config file is used when called from > > mailscanner? I run mailscanner with exim, f-prot & spamassassin. > > > > Regards, > > Henrik > The /root/.spamassassin and /etc/mail/spamassassin/ files are both used. Have > you checked the config line in mailscanner.conf about detailed reports? What config line are you refering to? I can't find anything about this. .Henrik From lbergman at abi.tconline.net Tue Mar 26 16:18:30 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:34 2006 Subject: Spamassassin reports In-Reply-To: <094601c1d4d8$10e45b30$d62211c2@gbg.bluelabs.se> References: <060e01c1d4ab$4676ee20$d62211c2@gbg.bluelabs.se> <200203261430.g2QEU7203896@lewis.abi.tconline.net> <094601c1d4d8$10e45b30$d62211c2@gbg.bluelabs.se> Message-ID: <200203261618.g2QGIUO03974@lewis.abi.tconline.net> > What config line are you refering to? I can't find anything about this. Sorry, seems I was mixing up my spamassassin config file with my mailscanner one. After I sent that I couldn't find it either. Just enter it in the /etc/mail/spamassassin/*.cf file and it should be picked up. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From jkf at ecs.soton.ac.uk Tue Mar 26 17:13:19 2002 From: jkf at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog In-Reply-To: Message-ID: On Tue, 26 Mar 2002, Quentin Campbell wrote: > Have recently installed MailScanner 3.12-5 on a new system and notice > that I no longer see "mailscanner" messages (eg. Scanning 2 messages, > ...) in the sendmail logs. This installation is a Linux (RedHat 7.2) > system. > > Is this a change in MailScanner since 3.10-3? I cannot see why the > syslog.conf file on Linux may be losing the "mailscanner" messages as > sendmail records are being logged as I require. The most likely cause is the lack of the "-r" flag in the syslogd command-line. Check item 1 in the Installation FAQ for more info. -- Jules jkf@ecs.soton.ac.uk From fizz at BOMB.NET Tue Mar 26 17:43:44 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:34 2006 Subject: Spamassassin reports References: <060e01c1d4ab$4676ee20$d62211c2@gbg.bluelabs.se> <200203261430.g2QEU7203896@lewis.abi.tconline.net> <094601c1d4d8$10e45b30$d62211c2@gbg.bluelabs.se> <200203261618.g2QGIUO03974@lewis.abi.tconline.net> Message-ID: <002601c1d4ed$c6b67af0$48cf75cc@fizz> i have the full local.cf file from the faq at spamassassin.org (the one for if your having problems) as my local.cf, i would be interested in learning this ability to as it has alot more usefull information in the report. Just now i added report_header 1 and use_terse_report 1 to my local.cf, and am gonna see how that works now.. Also, if i make a change to spamassassin config's do i need to restart mailscanner? ----- Original Message ----- From: "Lewis Bergman" To: Sent: Tuesday, March 26, 2002 11:18 AM Subject: Re: Spamassassin reports > > What config line are you refering to? I can't find anything about this. > Sorry, seems I was mixing up my spamassassin config file with my mailscanner > one. After I sent that I couldn't find it either. Just enter it in the > /etc/mail/spamassassin/*.cf file and it should be picked up. > -- > Lewis Bergman > Texas Communications > 4309 Maple St. > Abilene, TX 79602-8044 > 915-695-6962 ext 115 > From henrik at LEWANDER.COM Tue Mar 26 18:31:15 2002 From: henrik at LEWANDER.COM (Henrik Lewander) Date: Thu Jan 12 21:14:34 2006 Subject: Spamassassin reports References: <060e01c1d4ab$4676ee20$d62211c2@gbg.bluelabs.se> <200203261430.g2QEU7203896@lewis.abi.tconline.net> <094601c1d4d8$10e45b30$d62211c2@gbg.bluelabs.se> <200203261618.g2QGIUO03974@lewis.abi.tconline.net> Message-ID: <021301c1d4f4$6d9f26e0$4bf90bc1@hemmet.chalmers.se> From: "Lewis Bergman" > > What config line are you refering to? I can't find anything about this. > Sorry, seems I was mixing up my spamassassin config file with my mailscanner > one. After I sent that I couldn't find it either. Just enter it in the > /etc/mail/spamassassin/*.cf file and it should be picked up. Actually, that's the problem: I already have it there. And I have restarted mailscanner. .Henrik From fizz at BOMB.NET Wed Mar 27 04:31:11 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:34 2006 Subject: Feature Request Message-ID: <000a01c1d548$3b2533e0$14792241@fizz> As you may or may not have noticed, people have been wanting the ability to A. Know what spam is being scored even when it doesnt meat the threshold. and B. Be able to include the terse report that spamassassin uses.. Ex:(damnit, cant find example) Anyway it shows which elements of the message scored what. Which would then allow you to further tweak the scores. I think mailscanned is a wonderful utility and as it gets more users/features will continue to be the best. I would love to see better intergration ability with spamassassin and maybe razor in future releases. And maybe a flat text file whitelist for people you dont want mailscanner to mark ANY mail as spam, and still scan for virus's. Basically a little more flexability. I know some requests are a little iffy, but im interested to see how many people would like this functionality from the wonderful mailscanner by its incredibile author Julian :) -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020326/855ae83a/attachment.html From nwp at LEMON-COMPUTING.COM Wed Mar 27 04:54:53 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:34 2006 Subject: Feature Request In-Reply-To: <000a01c1d548$3b2533e0$14792241@fizz> References: <000a01c1d548$3b2533e0$14792241@fizz> Message-ID: <20020327045452.GB23477@hoiho.nz.lemon-computing.com> On Tue, Mar 26, 2002 at 11:31:11PM -0500, Kelly Hamlin wrote: > but im interested to see how many people would like this functionality > from the wonderful mailscanner by its incredibile author Julian :) If you're not careful he'll be too busy throwing up to get anything done ;) -- Nick Phillips -- nwp@lemon-computing.com The time is right to make new friends. From brose at MED.WAYNE.EDU Wed Mar 27 05:29:37 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:34 2006 Subject: Feature Request Message-ID: It already does the whitelist. When Mailscanner first started using SA, I made some modifications in sendmail.pl within the SAForkAndTest sub, after the line $SAResult = int($spamness->get_hits()) if $SAResult; I added if ($SAScore >=5) { $spamness->rewrite_mail (); my $SARewrite = $spamness->get_full_message_as_text(); local(*DOUT); open(DOUT, ">>/var/spam/queue/spr$mID") or Log::DieLog("Failed to create copy of spam message spr$mID"); print DOUT $SARewrite; close DOUT; } This dumps the message including the SA report into a queue. This allows me to take samples and also to report the messages as spam to razor. Oh yeh I had to added $mID to the subroutine call so the $SAResult = SAForkAndTest($SAspamtest, $spammail); became $SAResult = SAForkAndTest($SAspamtest, $spammail, $mID); and my($Test, $Mail) = @_; became my($Test, $Mail, $mID) = @_; Granted I could probably stop doing this since I think Julian mentioned adding the ability to forward or cc the spam messages to an account. From postmaster at theargoncompany.com Wed Mar 27 06:27:50 2002 From: postmaster at theargoncompany.com (MailScanner) Date: Thu Jan 12 21:14:34 2006 Subject: Disinfected: Virus not getting detecte... Message-ID: <200203270627.LAA23632@theargoncompany.com> A message you recently received from "" with the subject "Virus not getting detected " contained one or more viruses that could be disinfected. The viruses have been removed, and the disinfected files are attached to this message. -- MailScanner Email Virus Scanner -------------- next part -------------- A non-text attachment was scrubbed... Name: template.com Type: application/octet-stream Size: 118784 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020327/ba19462a/template.obj From mike at ZANKER.ORG Wed Mar 27 09:50:11 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:34 2006 Subject: Feature Request In-Reply-To: <000a01c1d548$3b2533e0$14792241@fizz> References: <000a01c1d548$3b2533e0$14792241@fizz> Message-ID: <163493491.1017222611@mallard.open.ac.uk> On 26 March 2002 23:31 -0500 Kelly Hamlin wrote: > I would love to see better intergration ability with spamassassin and > maybe razor in future releases. And maybe a flat text file whitelist > for people you dont want mailscanner to mark ANY mail as spam, and > still scan for virus's. We already have the latter, don't we - spam.whitelist.conf? Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From dna at BRDINFO.RO Wed Mar 27 19:32:41 2002 From: dna at BRDINFO.RO (DNA) Date: Thu Jan 12 21:14:34 2006 Subject: Inoculate integration.. Message-ID: <005f01c1d5c6$28fee980$8504370a@IULIANNN> I have RedHat machine with CA InoculateIT for Linux (sendmail and web servers running ) + mailscanner last version..but I can't integrate this with my antivirus software. I follow all steps from the mailscanner.conf file without success. What should I do in this case ? Thank you. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020327/c7df3afe/attachment.html From Janssen at RZ.UNI-FRANKFURT.DE Wed Mar 27 12:49:09 2002 From: Janssen at RZ.UNI-FRANKFURT.DE (Michael Janssen) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog In-Reply-To: Message-ID: Hello, i was interesting following this thread, cause we've got the same Problem with RedHat 7.1 (no syslog no matter about -r option) now i've learn some perl and syslog-stuff and add one line of code into logger.pl: sub Start { Sys::Syslog::setlogsock('unix'); ### mj 27.Mar: enables syslog Sys::Syslog::openlog(@_, 'pid, nowait', 'mail'); } restarting MailScanner and there are nice syslog-messages! But be carefull, i'm quite not experienced in perl. regards Michael Janssen, University of Frankfurt, Germany On Wed, 27 Mar 2002, Quentin Campbell wrote: > Julian > > That does not appear to fix things and I do not see why it should! The > -r option allows syslogd to receive messages from a network socket. I > thought the MailScanner messages are being received via a Unix socket? > That is, if I am logging sendmail messages without the "-r" option then > I should be logging MailScanner messages as well? > > I added the "-r" option to /etc/sysconfig/syslog and stopped/started > syslogd so that it would reread its config file. I still do not see > MailScanner messages in the file to which mail.* messages are being > logged. > > A perplexed > > Quentin > --- > PHONE: +44 191 222 8209 Computing Service, University of Newcastle > FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. > ------------------------------------------------------------------------ > "Any opinion expressed above is mine. The University can get its own." > > > > > -----Original Message----- > > From: Julian Field [mailto:jkf@ecs.soton.ac.uk] > > Sent: 26 March 2002 17:13 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: MailScanner and syslog > > > > > > On Tue, 26 Mar 2002, Quentin Campbell wrote: > > > Have recently installed MailScanner 3.12-5 on a new system > > and notice > > > that I no longer see "mailscanner" messages (eg. Scanning 2 > > messages, > > > ...) in the sendmail logs. This installation is a Linux > > (RedHat 7.2) > > > system. > > > > > > Is this a change in MailScanner since 3.10-3? I cannot see why the > > > syslog.conf file on Linux may be losing the "mailscanner" > > messages as > > > sendmail records are being logged as I require. > > > > The most likely cause is the lack of the "-r" flag in the > > syslogd command-line. Check item 1 in the Installation FAQ > > for more info. > > -- > > Jules > > jkf@ecs.soton.ac.uk > > > From Funk.Gabor at HUNETKFT.HU Wed Mar 27 13:06:57 2002 From: Funk.Gabor at HUNETKFT.HU (Funk Gabor) Date: Thu Jan 12 21:14:34 2006 Subject: Inoculate integration.. Message-ID: <021a01c1d590$47d71750$3364a8c0@xxxx.xxx> >>I have RedHat machine with CA InoculateIT for Linux (sendmail >>and web servers running ) + mailscanner last version..but I can't >>integrate this with my antivirus software. A bit more detailed description of the EXACT problem would help volunteers to answer your question. From your letter, one can assume that for example: you don't find the installation CD or have some problem alike. Inocmd32 runs only as "root", so it could be your problem, but it is a wild guess. G. (Switch off HTML also advised). From Q.G.Campbell at NEWCASTLE.AC.UK Wed Mar 27 13:35:10 2002 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog Message-ID: Julian et al As a RedHat 7.2 user with no Perl experience at all I am very interested in Michael's contribution below. Any comments? It may be that I am among the first to notice a problem with RedHat since I am also running MailScanner and sendmail on Solaris boxes and so have noticed a difference between those systems in what is logged to the mail logs. Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." > -----Original Message----- > From: Michael Janssen [mailto:Janssen@rz.uni-frankfurt.de] > Sent: 27 March 2002 12:49 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner and syslog > > > Hello, > > i was interesting following this thread, cause we've got the > same Problem with RedHat 7.1 (no syslog no matter about -r option) > > now i've learn some perl and syslog-stuff and add one line of > code into > logger.pl: > > sub Start { > Sys::Syslog::setlogsock('unix'); ### mj 27.Mar: enables syslog > Sys::Syslog::openlog(@_, 'pid, nowait', 'mail'); > } > > restarting MailScanner and there are nice syslog-messages! > But be carefull, i'm quite not experienced in perl. > > regards > Michael Janssen, University of Frankfurt, Germany > > > On Wed, 27 Mar 2002, Quentin Campbell wrote: > > > Julian > > > > That does not appear to fix things and I do not see why it > should! The > > -r option allows syslogd to receive messages from a network > socket. I > > thought the MailScanner messages are being received via a > Unix socket? > > That is, if I am logging sendmail messages without the "-r" option > > then I should be logging MailScanner messages as well? > > > > I added the "-r" option to /etc/sysconfig/syslog and > stopped/started > > syslogd so that it would reread its config file. I still do not see > > MailScanner messages in the file to which mail.* messages are being > > logged. > > > > A perplexed > > > > Quentin > > --- > > PHONE: +44 191 222 8209 Computing Service, University of > Newcastle > > FAX: +44 191 222 8765 Newcastle upon Tyne, United > Kingdom, NE1 7RU. > > > ---------------------------------------------------------------------- > > -- > > "Any opinion expressed above is mine. The University can > get its own." > > > > > > > > > -----Original Message----- > > > From: Julian Field [mailto:jkf@ecs.soton.ac.uk] > > > Sent: 26 March 2002 17:13 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: MailScanner and syslog > > > > > > > > > On Tue, 26 Mar 2002, Quentin Campbell wrote: > > > > Have recently installed MailScanner 3.12-5 on a new system > > > and notice > > > > that I no longer see "mailscanner" messages (eg. Scanning 2 > > > messages, > > > > ...) in the sendmail logs. This installation is a Linux > > > (RedHat 7.2) > > > > system. > > > > > > > > Is this a change in MailScanner since 3.10-3? I cannot > see why the > > > > syslog.conf file on Linux may be losing the "mailscanner" > > > messages as > > > > sendmail records are being logged as I require. > > > > > > The most likely cause is the lack of the "-r" flag in the syslogd > > > command-line. Check item 1 in the Installation FAQ for more info. > > > -- > > > Jules > > > jkf@ecs.soton.ac.uk > > > > > > From mike at ZANKER.ORG Wed Mar 27 13:44:02 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog In-Reply-To: References: Message-ID: <177525307.1017236642@mallard.open.ac.uk> On 27 March 2002 13:35 +0000 Quentin Campbell wrote: > As a RedHat 7.2 user with no Perl experience at all I am very > interested in Michael's contribution below. Any comments? > > It may be that I am among the first to notice a problem with RedHat > since I am also running MailScanner and sendmail on Solaris boxes and > so have noticed a difference between those systems in what is logged > to the mail logs. Just to confuse the issue I am also running on RedHat 7.2 and syslogging works fine. Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From fizz at BOMB.NET Wed Mar 27 13:49:29 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:34 2006 Subject: Sendmail things.. Message-ID: <000901c1d596$3762ff50$48cf75cc@fizz> I know this isnt really mailscanner related, but i know someone on here has had the same problem at one point or another... --Incoming Mail Queue: 10 --Outgoing Mail Queue: 237 those same 200+ messages have been in my outgoing queue for a while now. Most are like 12 hours old, if i delete dfg* which is stuff from yesterday, then the queue empties just fine and goes back down to 0. However i dont just like deleting mail, and would like to find a cause for this thanks ////// ( o o ) +--.oooO--(_)--Oooo.-----------------+ | [Kelly Hamlin] | kellyh@cyberstreet.com | http://www.bomb.net | .oooO | ( ) Oooo. +--- \ (----( )----------------------------+ \_) ) / (_/ From fizz at BOMB.NET Wed Mar 27 13:44:58 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:34 2006 Subject: Feature Request References: <000a01c1d548$3b2533e0$14792241@fizz> <163493491.1017222611@mallard.open.ac.uk> Message-ID: <007601c1d595$95c05da0$48cf75cc@fizz> that only works with address FROM: correct? if not then i have been off track on that one :P im meaning messages marked TO: and whitelist it ----- Original Message ----- From: "Mike Zanker" To: Sent: Wednesday, March 27, 2002 4:50 AM Subject: Re: Feature Request > On 26 March 2002 23:31 -0500 Kelly Hamlin wrote: > > > I would love to see better intergration ability with spamassassin and > > maybe razor in future releases. And maybe a flat text file whitelist > > for people you dont want mailscanner to mark ANY mail as spam, and > > still scan for virus's. > > We already have the latter, don't we - spam.whitelist.conf? > > Mike > -- > Mike Zanker > Northampton, UK > PGP Public Key: pgp@zanker.org > From mike at ZANKER.ORG Wed Mar 27 13:58:13 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:34 2006 Subject: Feature Request In-Reply-To: <007601c1d595$95c05da0$48cf75cc@fizz> References: <007601c1d595$95c05da0$48cf75cc@fizz> Message-ID: <178375890.1017237493@mallard.open.ac.uk> On 27 March 2002 08:44 -0500 Kelly Hamlin wrote: > that only works with address FROM: correct? if not then i have been > off track on that one :P > im meaning messages marked TO: and whitelist it OK, with you. Sorry, I misread your original "for" as "from". Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From kylist at SHCORP.COM Wed Mar 27 14:50:45 2002 From: kylist at SHCORP.COM (Kurt Yoder) Date: Thu Jan 12 21:14:34 2006 Subject: spamassassin not called on Debian? In-Reply-To: <1017159687.3362.73.camel@menix> References: <1017159687.3362.73.camel@menix> Message-ID: <45395.10.10.1.95.1017240645.squirrel@webmail.shcorp.com> Matt Miller said: >> Hmm... I didn't realize it needed to be running in daemon mode; >> however I've done what you said and now: >> >> root@pangaea:/var/log/mail# ps axf | grep spamd >> 3722 pts/0 S 0:00 \_ grep spamd >> 3120 ? S 0:00 perl /usr/sbin/spamd -d -c -D >> >> (I put spamd in debug mode) >> >> But my sample spam from yahoo.com still gets through untagged. Again, >> I tried a "spamassassin -t" on it, which flags it as spam. It almost >> seems like mailscanner isn't calling spamassassin... >> >> >> -- >> Kurt Yoder >> Sport & Health network administrator > > Are you using the Debian packages? > Maybe spamd doesn't need to be running; I'll test it and let you know. > Check to see if you have a /var/mail/.spamassassin/user_prefs. Edit the > file and uncomment the number of hits; I've got "required_hits 5". > And/or edit /usr/share/spamassassin/user_prefs.template and uncomment > the required_hits. > > I know that Spamassassin is working for me...here's an excerpt from a > header of a test e-mail I sent when I was testing mailscanner: > > X-MailScanner: Found to be clean > X-MailScanner-SpamCheck: SpamAssassin (13 hits) > > I'm going to attach my mailscanner.conf file. Maybe something > insightful can be derived from there as well... > Matt > # Define local networks from whom you should always accept mail, and # > never mark it as spam. This is useful in case your own mail servers # > are ever in the ORBS or MAPS lists. > #Accept Spam From = 152.78. > #Accept Spam From = 139.166. How stupid of me. I had an "accept from" line with my local IP in it. Problem is, I have another machine relaying to this one, so all email, even mail from the internet, was getting automatically accepted. I commented out this line, and now spam checking appears to be working... -- Kurt Yoder Sport & Health network administrator From jon at XNEXT.COM Wed Mar 27 14:55:15 2002 From: jon at XNEXT.COM (Jonothon Ortiz) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog In-Reply-To: <177525307.1017236642@mallard.open.ac.uk> Message-ID: RH 7.2 ENT over here - no apparent problems -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Mike Zanker Sent: Wednesday, March 27, 2002 8:44 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: MailScanner and syslog On 27 March 2002 13:35 +0000 Quentin Campbell wrote: > As a RedHat 7.2 user with no Perl experience at all I am very > interested in Michael's contribution below. Any comments? > > It may be that I am among the first to notice a problem with RedHat > since I am also running MailScanner and sendmail on Solaris boxes and > so have noticed a difference between those systems in what is logged > to the mail logs. Just to confuse the issue I am also running on RedHat 7.2 and syslogging works fine. Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From dustin.baer at IHS.COM Wed Mar 27 15:00:03 2002 From: dustin.baer at IHS.COM (Dustin Baer) Date: Thu Jan 12 21:14:34 2006 Subject: Sendmail things.. References: <000901c1d596$3762ff50$48cf75cc@fizz> Message-ID: <3CA1DE73.4A1EC9AF@ihs.com> Kelly Hamlin wrote: > > I know this isnt really mailscanner related, but i know someone on here has > had the same problem at one point or another... > --Incoming Mail Queue: 10 > --Outgoing Mail Queue: 237 > those same 200+ messages have been in my outgoing queue for a while now. > Most are like 12 hours old, if i delete dfg* which is stuff from yesterday, "dfg" is the stuff from 2002. Not just yesterday. You would be deleting all of the message bodies from the queue from this entire year. You also need to delete the associated qf files to completely remove the message. > then the queue empties just fine and goes back down to 0. However i dont > just like deleting mail, and would like to find a cause for this > thanks The "mailq" command will tell you why they are stuck in the queue. Dustin Baer Unix Administrator/Postmaster Information Handling Services 15 Inverness Way East Englewood, CO 80112 303-397-2836 From brose at MED.WAYNE.EDU Wed Mar 27 15:11:22 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:34 2006 Subject: Sendmail things.. Message-ID: Run sendmail -q -v It will start a sendmailprocess to process mqueue in verbose mode so you'll see all the connects and responses in your shell -----Original Message----- From: Kelly Hamlin [mailto:fizz@BOMB.NET] Sent: Wednesday, March 27, 2002 8:49 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Sendmail things.. I know this isnt really mailscanner related, but i know someone on here has had the same problem at one point or another... --Incoming Mail Queue: 10 --Outgoing Mail Queue: 237 those same 200+ messages have been in my outgoing queue for a while now. Most are like 12 hours old, if i delete dfg* which is stuff from yesterday, then the queue empties just fine and goes back down to 0. However i dont just like deleting mail, and would like to find a cause for this thanks ////// ( o o ) +--.oooO--(_)--Oooo.-----------------+ | [Kelly Hamlin] | kellyh@cyberstreet.com | http://www.bomb.net | .oooO | ( ) Oooo. +--- \ (----( )----------------------------+ \_) ) / (_/ From lbergman at abi.tconline.net Wed Mar 27 20:40:35 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:34 2006 Subject: virtual mail servers? Message-ID: <200203272040.g2RKeZn05888@lewis.abi.tconline.net> I seem to have problems with virtual mail servers now that mailscanner is in the mix. I was using a linuxconf setup that used a files structure like this: Each virtual domain has its own password, spool directory, and user aliases file. For each virtual email domain, linuxconf will setup /etc/vmail/passwd.virtual_domain /etc/vmail/shadow.virtual_domain /etc/vmail/aliases.virtual_domain /var/spool/vmail/virtual_domain/ /vhome/virtual_domain/ where virtual_domain is one domain, such as foo.com. Now when I mail to these domains I get this: 553 5.3.5 mail.hansoncattle.com. config error: mail loops back to me (MX problem?) 554 5.3.5 Local configuration error My DNS hasn't changed. The setup did work by setting up the DNS like so @ MX 5 mail.hansoncattle.com mail A 208.29.17.195 ( or whatever) 195 PTR mail.hansoncattle.com The server would then do a dns lookup on that IP to see what host it was supposed to be. Basically you could assign host simply by managing DNS if the above vmail type files were there. This also allowed a virtual pop3 that used the same method. Does anyone have an idea what might be going on or how to get this (or something similiar) to work again. Maybe even using normal sendmail alias files if neccessary. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From nwp at LEMON-COMPUTING.COM Wed Mar 27 21:26:53 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog In-Reply-To: References: Message-ID: <20020327212653.GD23954@hoiho.nz.lemon-computing.com> On Wed, Mar 27, 2002 at 01:35:10PM -0000, Quentin Campbell wrote: > Julian et al > > As a RedHat 7.2 user with no Perl experience at all I am very interested > in Michael's contribution below. Any comments? Yup. By default (and it used to be the only possible way, I believe), Perl's Sys::Syslog logs via 514/udp whether it's to localhost or whatever. A few months ago we debated whether or not to change the default in mailscanner to use a UNIX domain socket, as below, and decided not to - mainly because it's an unnecessary change for most people, and we were making enough changes as it was. Personally I think it would probably be a Good Thing to change it sooner or later, as it eliminates the need for firewalling 514/udp to prevent random jokers filling up your disk, or r00ting you via a broken syslogd. > It may be that I am among the first to notice a problem with RedHat > since I am also running MailScanner and sendmail on Solaris boxes and so > have noticed a difference between those systems in what is logged to the > mail logs. If the "-r" no longer helps, it may be that in the most recent RedHats something has changed - is 514/udp being filtered, is the syslogd different, is routing to localhost set up correctly? Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com An avocado-tone refrigerator would look good on your resume. From nwp at LEMON-COMPUTING.COM Thu Mar 28 02:41:23 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:34 2006 Subject: tnef Message-ID: <20020328024123.GP23954@hoiho.nz.lemon-computing.com> OK, I'm working on a configurer/installer for mailscanner. I'm trying to work out what the best way to deal with the tnef program is. Could somebody tell me: 1) Is there an RPM package of tnef "out there"? 2) Is there a solaris pkg of tnef "out there"? 3) For any other OS/distriibution that you might use (except Debian, which I know about), is there a prepackaged tnef available? 4) In each of the above cases, does the package include the "useful" version of tnef 1.1.1, with the sizelimit? Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com Try to value useful qualities in one who loves you. From Stephane.Lentz at ANSF.ALCATEL.FR Thu Mar 28 07:08:27 2002 From: Stephane.Lentz at ANSF.ALCATEL.FR (Stephane Lentz) Date: Thu Jan 12 21:14:34 2006 Subject: tnef In-Reply-To: <20020328024123.GP23954@hoiho.nz.lemon-computing.com> References: <20020328024123.GP23954@hoiho.nz.lemon-computing.com> Message-ID: <20020328070827.GA11972@iww.netfr.alcatel.fr> Hi Nick, according to rpmfind there are does exist some RPM for Mandrake Linux & RedHat Linux distributions : http://rpmfind.net//linux/RPM/contrib/libc6/i386/tnef-1.1-5.i386.html http://rpmfind.net//linux/RPM/mandrake/8.2/contrib/i586/tnef-1.1.1-1mdk.i586.html The tnef program in the RPM for Mandrake does not have the -x SIZE --maxsize=SIZE option. I'm afraid it will be the same for RedHat. regards, SL/ On Thu, Mar 28, 2002 at 02:41:23PM +1200, Nick Phillips wrote: > OK, I'm working on a configurer/installer for mailscanner. > > I'm trying to work out what the best way to deal with the tnef program is. > > Could somebody tell me: > > 1) Is there an RPM package of tnef "out there"? > 2) Is there a solaris pkg of tnef "out there"? > 3) For any other OS/distriibution that you might use (except Debian, which > I know about), is there a prepackaged tnef available? > 4) In each of the above cases, does the package include the "useful" version > of tnef 1.1.1, with the sizelimit? > > --- Stephane Lentz / Alcanet International - Internet Services From Q.G.Campbell at NEWCASTLE.AC.UK Thu Mar 28 09:14:09 2002 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog (fixed!) Message-ID: > -----Original Message----- > From: Nick Phillips [mailto:nwp@lemon-computing.com] > Sent: 27 March 2002 21:27 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner and syslog > [snip] > > If the "-r" no longer helps, it may be that in the most > recent RedHats something has changed - is 514/udp being > filtered, is the syslogd different, is routing to localhost > set up correctly? Nick, Mike It turns out that it was my mistake and "-r" is all that is needed in RedHat 7.2! The /etc/sysconfig/syslog file configures TWO utilities - syslogd and klogd (the kernel log daemon). I had added "-r" to klogd's options rather than those of syslogd. Sigh!! Re. your comments about port 514/udp, RedHat 7.2 does block this port by default in /etc/sysconfig/ipchains; in fact it blocks all UDP ports below 1024. I believe this default blocking is a feature new to 7.2. This does not appear to affect logging via syslog when the "-r" option is used and ipchains does not need to be changed. Note that I did change ipchains for port 514/udp but backed this off after the "-r" fix and then restarted ipchains to ensure the status quo ante. I am happy now that MailScanner logging is working but confused as to why it is working given Nick's comments and the default filtering of port 514/udp that is done in RedHat 7.2. Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From mike at ZANKER.ORG Thu Mar 28 10:12:45 2002 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog (fixed!) In-Reply-To: References: Message-ID: <251252762.1017310365@mallard.open.ac.uk> On 28 March 2002 09:14 +0000 Quentin Campbell wrote: > Re. your comments about port 514/udp, RedHat 7.2 does block this port > by default in /etc/sysconfig/ipchains; in fact it blocks all UDP ports > below 1024. I believe this default blocking is a feature new to 7.2. Doesn't the default ipchains also permit everything via the loopback interface, though? Mike -- Mike Zanker Northampton, UK PGP Public Key: pgp@zanker.org From Q.G.Campbell at NEWCASTLE.AC.UK Thu Mar 28 10:41:20 2002 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:14:34 2006 Subject: MailScanner and syslog (fixed!) Message-ID: > -----Original Message----- > From: Mike Zanker [mailto:mike@zanker.org] > Sent: 28 March 2002 10:13 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner and syslog (fixed!) > > > On 28 March 2002 09:14 +0000 Quentin Campbell > wrote: > > > Re. your comments about port 514/udp, RedHat 7.2 does block > this port > > by default in /etc/sysconfig/ipchains; in fact it blocks > all UDP ports > > below 1024. I believe this default blocking is a feature new to 7.2. > > Doesn't the default ipchains also permit everything via the > loopback interface, though? > That is not explicit, either in the ipchains man page or in the ipchains file itself. I would be interested to see the reference. If it is the case, however, then that would explain why internal writes to 514/udp are getting through ipchains. I hope this discussion has not got too far off topic. :-) Thanks to Nick, Mike and Michael for thir responses to my original enquiry. Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From S.R.Patterson at SOTON.AC.UK Thu Mar 28 12:24:32 2002 From: S.R.Patterson at SOTON.AC.UK (Steven Patterson) Date: Thu Jan 12 21:14:35 2006 Subject: tnef In-Reply-To: <20020328070827.GA11972@iww.netfr.alcatel.fr> Message-ID: <005201c1d653$9273b250$9865fea9@sucs.soton.ac.uk> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I can bundle up an rpm of the TNEF program with my -x/--maxsize= additions if you like, that's the easy part. Rewriting it to make it work better is the hard part ;) - -- Steven Patterson, MSci ---------------------- Tel: +44 (0) 2380 595810 | Electronic Information Systems Support and Development | | Computing Services, University of Southampton, UK. | +------ Public PGP Key: http://www.soton.ac.uk/~srp/pubkey.asc ------+ ...... ...... .. Give me ambiguity or give me something else. .. ...... ...... > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Stephane Lentz > Sent: 28 March 2002 07:08 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: tnef > > > Hi Nick, > > according to rpmfind there are does exist > some RPM for Mandrake Linux & RedHat Linux distributions : > http://rpmfind.net//linux/RPM/contrib/libc6/i3> 86/tnef-1.1-5.i386.html > http://rpmfind.net//linux/RPM/mandrake/8.2/contrib/i586/tnef-1 .1.1-1mdk.i586.html The tnef program in the RPM for Mandrake does not have the -x SIZE --maxsize=SIZE option. I'm afraid it will be the same for RedHat. regards, SL/ On Thu, Mar 28, 2002 at 02:41:23PM +1200, Nick Phillips wrote: > OK, I'm working on a configurer/installer for mailscanner. > > I'm trying to work out what the best way to deal with the tnef program > is. > > Could somebody tell me: > > 1) Is there an RPM package of tnef "out there"? > 2) Is there a solaris pkg of tnef "out there"? > 3) For any other OS/distriibution that you might use (except Debian, > which I know about), is there a prepackaged tnef available? > 4) In each of the above cases, does the package include the "useful" > version of tnef 1.1.1, with the sizelimit? > > - --- Stephane Lentz / Alcanet International - Internet Services -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBPKMKHq2fOiTs5+WvEQJi5wCg4sgG72Rae220kozpGvrf0Wuvf8QAnjco XxEUjRo+DYfXRNnBJZSj5N0N =+Ivi -----END PGP SIGNATURE----- From chicks at CHICKS.NET Thu Mar 28 13:44:20 2002 From: chicks at CHICKS.NET (Christopher Hicks) Date: Thu Jan 12 21:14:35 2006 Subject: MailScanner and syslog (fixed!) In-Reply-To: <251252762.1017310365@mallard.open.ac.uk> Message-ID: On Thu, 28 Mar 2002, Mike Zanker wrote: > Doesn't the default ipchains also permit everything via the loopback > interface, though? For Red Hat, yes: # grep "lo " /etc/sysconfig/ipchains -A input -s 0/0 -d 0/0 -i lo -j ACCEPT -- "Outside of a dog, a man's best friend is a good book. Inside of a dog, it's too dark to read." - Groucho Marx From dna at BRDINFO.RO Thu Mar 28 22:30:00 2002 From: dna at BRDINFO.RO (DNA) Date: Thu Jan 12 21:14:35 2006 Subject: Re InoculateIT Message-ID: <003701c1d6a8$19159860$8504370a@IULIANNN> Any news about my problem, could I resolve this one ? Thank you ! -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020328/006e6c01/attachment.html From LISTSERV at JISCMAIL.AC.UK Wed Mar 27 14:26:19 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: r.zimmermann@SIEGNETZ.DE requested to join Message-ID: <200203271426.OAA03778@magpie.ecs.soton.ac.uk> Wed, 27 Mar 2002 14:26:19 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Ralf Zimmermann You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER r.zimmermann@SIEGNETZ.DE Ralf Zimmermann PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER r.zimmermann@SIEGNETZ.DE Ralf Zimmermann // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 27 15:38:20 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: marc@EGWN.NET requested to join Message-ID: <200203271538.PAA17887@magpie.ecs.soton.ac.uk> Wed, 27 Mar 2002 15:38:20 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from marc@EGWN.NET You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER marc@EGWN.NET Marc PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER marc@EGWN.NET Marc // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 27 15:42:13 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: paul@CS.UKY.EDU requested to join Message-ID: <200203271542.PAA18582@magpie.ecs.soton.ac.uk> Wed, 27 Mar 2002 15:42:13 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Paul Linton You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER paul@CS.UKY.EDU Paul Linton PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER paul@CS.UKY.EDU Paul Linton // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 27 15:52:51 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: valianp@SOUTHWESTERN.EDU requested to join Message-ID: <200203271552.PAA20689@magpie.ecs.soton.ac.uk> Wed, 27 Mar 2002 15:52:51 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Peter Valian You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER valianp@SOUTHWESTERN.EDU Peter Valian PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER valianp@SOUTHWESTERN.EDU Peter Valian // EOJ From LISTSERV at JISCMAIL.AC.UK Thu Mar 28 01:51:44 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: greg@GMLNT.COM requested to join Message-ID: <200203280151.BAA16808@magpie.ecs.soton.ac.uk> Thu, 28 Mar 2002 01:51:44 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Greg Conway You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER greg@GMLNT.COM Greg Conway PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER greg@GMLNT.COM Greg Conway // EOJ From Q.G.Campbell at NEWCASTLE.AC.UK Wed Mar 27 09:20:23 2002 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:14:35 2006 Subject: MailScanner and syslog Message-ID: Julian That does not appear to fix things and I do not see why it should! The -r option allows syslogd to receive messages from a network socket. I thought the MailScanner messages are being received via a Unix socket? That is, if I am logging sendmail messages without the "-r" option then I should be logging MailScanner messages as well? I added the "-r" option to /etc/sysconfig/syslog and stopped/started syslogd so that it would reread its config file. I still do not see MailScanner messages in the file to which mail.* messages are being logged. A perplexed Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." > -----Original Message----- > From: Julian Field [mailto:jkf@ecs.soton.ac.uk] > Sent: 26 March 2002 17:13 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner and syslog > > > On Tue, 26 Mar 2002, Quentin Campbell wrote: > > Have recently installed MailScanner 3.12-5 on a new system > and notice > > that I no longer see "mailscanner" messages (eg. Scanning 2 > messages, > > ...) in the sendmail logs. This installation is a Linux > (RedHat 7.2) > > system. > > > > Is this a change in MailScanner since 3.10-3? I cannot see why the > > syslog.conf file on Linux may be losing the "mailscanner" > messages as > > sendmail records are being logged as I require. > > The most likely cause is the lack of the "-r" flag in the > syslogd command-line. Check item 1 in the Installation FAQ > for more info. > -- > Jules > jkf@ecs.soton.ac.uk > From LISTSERV at JISCMAIL.AC.UK Fri Mar 29 01:07:23 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: BenGrimm@HAIL.BENGRIMM.NET requested to join Message-ID: <200203290107.BAA09814@magpie.ecs.soton.ac.uk> Fri, 29 Mar 2002 01:07:23 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Wirehub! Internet You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER BenGrimm@HAIL.BENGRIMM.NET Wirehub! Internet PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER BenGrimm@HAIL.BENGRIMM.NET Wirehub! Internet // EOJ From LISTSERV at JISCMAIL.AC.UK Tue Mar 26 11:28:35 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: itcraze@YAHOO.COM left the JISCmail list Message-ID: <200203261128.LAA19793@magpie.ecs.soton.ac.uk> Tue, 26 Mar 2002 11:28:35 itcraze@YAHOO.COM has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Tue Mar 26 12:33:49 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: Ben.Soares@ED.AC.UK requested to join Message-ID: <200203261233.MAA02591@magpie.ecs.soton.ac.uk> Tue, 26 Mar 2002 12:33:49 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Ben Soares You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER Ben.Soares@ED.AC.UK Ben Soares PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER Ben.Soares@ED.AC.UK Ben Soares // EOJ From LISTSERV at JISCMAIL.AC.UK Tue Mar 26 13:20:53 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: admin@VIGINTA.LT left the JISCmail list Message-ID: <200203261320.NAA11696@magpie.ecs.soton.ac.uk> Tue, 26 Mar 2002 13:20:53 Aldas Nabazas has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Tue Mar 26 14:56:40 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: romero@KDE.ORG requested to join Message-ID: <200203261456.OAA00172@magpie.ecs.soton.ac.uk> Tue, 26 Mar 2002 14:56:40 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Victor Romero You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER romero@KDE.ORG Victor Romero PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER romero@KDE.ORG Victor Romero // EOJ From LISTSERV at JISCMAIL.AC.UK Tue Mar 26 15:16:55 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: dml@UNB.CA requested to join Message-ID: <200203261516.PAA04124@magpie.ecs.soton.ac.uk> Tue, 26 Mar 2002 15:16:55 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from David Lancaster The following membership options have been requested: NOACK NOREPRO CONCEAL. You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER dml@UNB.CA David Lancaster PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER dml@UNB.CA David Lancaster SET MAILSCANNER NOACK NOREPRO CONCEAL FOR dml@UNB.CA // EOJ From LISTSERV at JISCMAIL.AC.UK Tue Mar 26 16:16:47 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: mmabbas@LONGWOOD.LWC.EDU requested to join Message-ID: <200203261616.QAA15721@magpie.ecs.soton.ac.uk> Tue, 26 Mar 2002 16:16:47 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Mohamed Abbas You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mmabbas@LONGWOOD.LWC.EDU Mohamed Abbas PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mmabbas@LONGWOOD.LWC.EDU Mohamed Abbas // EOJ From LISTSERV at JISCMAIL.AC.UK Tue Mar 26 16:42:04 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: Alan.Thew@LIVERPOOL.AC.UK requested to join Message-ID: <200203261642.QAA20626@magpie.ecs.soton.ac.uk> Tue, 26 Mar 2002 16:42:04 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Alan Thew You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER Alan.Thew@LIVERPOOL.AC.UK Alan Thew PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER Alan.Thew@LIVERPOOL.AC.UK Alan Thew // EOJ From LISTSERV at JISCMAIL.AC.UK Wed Mar 27 21:45:20 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: nick@EMPHASYS.COM left the JISCmail list Message-ID: <200203272145.VAA29859@magpie.ecs.soton.ac.uk> Wed, 27 Mar 2002 21:45:20 Nick Bellomy has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Thu Mar 28 20:30:32 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: mmiller1@MPTOTALCARE.COM requested to join Message-ID: <200203282030.UAA19759@magpie.ecs.soton.ac.uk> Thu, 28 Mar 2002 20:30:32 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Matthew Miller You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mmiller1@MPTOTALCARE.COM Matthew Miller PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mmiller1@MPTOTALCARE.COM Matthew Miller // EOJ From nwp at LEMON-COMPUTING.COM Thu Mar 28 21:08:51 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:35 2006 Subject: tnef In-Reply-To: <005201c1d653$9273b250$9865fea9@sucs.soton.ac.uk> References: <20020328070827.GA11972@iww.netfr.alcatel.fr> <005201c1d653$9273b250$9865fea9@sucs.soton.ac.uk> Message-ID: <20020328210851.GZ23954@hoiho.nz.lemon-computing.com> On Thu, Mar 28, 2002 at 12:24:32PM -0000, Steven Patterson wrote: > I can bundle up an rpm of the TNEF program with my -x/--maxsize= > additions if you like, that's the easy part. I think it would make more sense to keep it in a separate package in the end; I'm only just learning autoconf, but it doesn't really seem to make sense to have it building the tnef thing anyway... ...if it's not found then I can just make it warn and cause mailscanner to reject all TNEFs (unless the AV scanner works with them). > Rewriting it to make it work better is the hard part ;) Is anyone actually putting any/much time/effort into this? Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com Think twice before speaking, but don't say "think think click click". From nwp at LEMON-COMPUTING.COM Thu Mar 28 21:08:51 2002 From: nwp at LEMON-COMPUTING.COM (Nick Phillips) Date: Thu Jan 12 21:14:35 2006 Subject: tnef In-Reply-To: <005201c1d653$9273b250$9865fea9@sucs.soton.ac.uk> References: <20020328070827.GA11972@iww.netfr.alcatel.fr> <005201c1d653$9273b250$9865fea9@sucs.soton.ac.uk> Message-ID: <20020328210851.GZ23954@hoiho.nz.lemon-computing.com> On Thu, Mar 28, 2002 at 12:24:32PM -0000, Steven Patterson wrote: > I can bundle up an rpm of the TNEF program with my -x/--maxsize= > additions if you like, that's the easy part. I think it would make more sense to keep it in a separate package in the end; I'm only just learning autoconf, but it doesn't really seem to make sense to have it building the tnef thing anyway... ...if it's not found then I can just make it warn and cause mailscanner to reject all TNEFs (unless the AV scanner works with them). > Rewriting it to make it work better is the hard part ;) Is anyone actually putting any/much time/effort into this? Cheers, Nick -- Nick Phillips -- nwp@lemon-computing.com Think twice before speaking, but don't say "think think click click". From brose at MED.WAYNE.EDU Fri Mar 29 02:26:10 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:35 2006 Subject: Spamassassin and compile_now() Message-ID: Julian, do you know if this guy is still broken? I'm just wondering if that would speed things up when spam checking? I take that if it's not used then the SA rules are read in every time correct? I'm not positive but I think this is the case since I know I've updated my local.cf for SA and Mailscanner picked up the changes without a restart. -=Bobby -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020328/4a1d7289/attachment.html From LISTSERV at JISCMAIL.AC.UK Fri Mar 29 18:25:39 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: BenGrimm@HAIL.BENGRIMM.NET left the JISCmail list Message-ID: <200203291825.SAA15554@magpie.ecs.soton.ac.uk> Fri, 29 Mar 2002 18:25:39 Wirehub! Internet has just left the MAILSCANNER JISCmail list (MailScanner mailing list). From LISTSERV at JISCMAIL.AC.UK Fri Mar 29 18:26:25 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: mailscanner-sub@WIREHUB.NET requested to join Message-ID: <200203291826.SAA15693@magpie.ecs.soton.ac.uk> Fri, 29 Mar 2002 18:26:25 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from Wirehub! Internet You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mailscanner-sub@WIREHUB.NET Wirehub! Internet PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mailscanner-sub@WIREHUB.NET Wirehub! Internet // EOJ From LISTSERV at JISCMAIL.AC.UK Sun Mar 31 23:31:25 2002 From: LISTSERV at JISCMAIL.AC.UK (L-Soft list server at JISCMAIL (1.8d)) Date: Thu Jan 12 21:14:35 2006 Subject: MAILSCANNER: mdm@INTERNET-TOOLS.COM requested to join Message-ID: <200203312231.XAA15371@magpie.ecs.soton.ac.uk> Sun, 31 Mar 2002 23:31:25 A request to join the MAILSCANNER JISCmail list (MailScanner mailing list) has been received from mark david mcCreary You can, at your discretion, send the following command to jiscmail@JISCMAIL.AC.UK to add this person to the JISCmail list: add MAILSCANNER mdm@INTERNET-TOOLS.COM mark david mcCreary PS: In order to facilitate the task, this message has been specially formatted so that you only need to forward it back to jiscmail@JISCMAIL.AC.UK and fill in the password below to have the command executed. Note that while the formats produced by the forwarding function of most mail packages are supported, replying will seldom work, so make sure to forward and not reply. ------------------------------------------------------------------------- // JOB PW=XXXXXXXX ADD MAILSCANNER mdm@INTERNET-TOOLS.COM mark david mcCreary // EOJ From fizz at BOMB.NET Sat Mar 30 02:50:19 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:36 2006 Subject: Just an FYI Message-ID: <000c01c1d795$a10ce3c0$14792241@fizz>
It wasnt announced unless i missed it, but 13.3-2 is out and it fixed my problems with sophos and mailscanner :)
 
 From fizz at BOMB.NET Sat Mar 30 02:33:10 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? References: Message-ID: <000901c1d793$3bea74f0$14792241@fizz> unfortunatly im not :( i have sendmail setup as a gateway, basically it has a set of rules for where to forward mail. Ex. You send me mail.. mail gateway gets it and decides it has to clean/check for spam, and then goes to my outbound sendmail queue, which then goes to the destination mail server. If im not mistaken, procmail is for local delivery of mail on the machine with sendmail correct? ----- Original Message ----- From: "Richard Ahlquist" To: Sent: Friday, March 29, 2002 9:23 PM Subject: Re: No SpamAssassin report with MailScanner? > On Fri, 29 Mar 2002 14:34:19 -0500, Kelly Hamlin wrote: > > >what about when your using sendmail as a gateway? :) > > Yes, Kelly, if you are using procmail for your delivery agent. > From newsletters at PCSITES.COM Sat Mar 30 02:23:34 2002 From: newsletters at PCSITES.COM (Richard Ahlquist) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? Message-ID: On Fri, 29 Mar 2002 14:34:19 -0500, Kelly Hamlin wrote: >what about when your using sendmail as a gateway? :) Yes, Kelly, if you are using procmail for your delivery agent. From fizz at BOMB.NET Sat Mar 30 00:58:58 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? References: Message-ID: <003601c1d786$12e0dac0$14792241@fizz> Would this make it so it includes the spamassassin report in the header when using mailscanner on a email gateway useing sendmail? ----- Original Message ----- From: "Rose, Bobby" To: Sent: Friday, March 29, 2002 4:53 PM Subject: Re: No SpamAssassin report with MailScanner? I added some code to the sendmail.pl that will call SA to rewrite the message with a report and dump that into a directory. I haven't spent any time to see about returning rewrite back since I think that may be more difficult. Here's the diffs. 289c289,290 < $SAResult = SAForkAndTest($SAspamtest, $spammail); --- > #Bobby added $mID > $SAResult = SAForkAndTest($SAspamtest, $spammail, $mID); 299c300,301 < my($Test, $Mail) = @_; --- > #Bobby added $mID > my($Test, $Mail, $mID) = @_; 312a315,327 > #Bobby's added code > my $SAScore = $spamness->get_hits(); > my $SAReqHits = $spamness->get_required_hits(); > Log::InfoLog("SpamAssassin score $SAScore of $SAReqHits"); > if ($SAScore >= $SAReqHits) { > #$spamness->report_as_spam ($Mail); > $spamness->rewrite_mail (); > my $SARewrite = $spamness->get_full_message_as_text(); > local(*DOUT); > open(DOUT, ">>/var/spam/queue/spr$mID") or Log::DieLog("Failed to create copy of spam message spr$mID"); > print DOUT $SARewrite; > close DOUT; > } -----Original Message----- From: Dan Kubilos [mailto:dan@OXNARDSD.ORG] Sent: Friday, March 29, 2002 4:40 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: No SpamAssassin report with MailScanner? Thanks Richard. I was looking for this. But . . . why the -P option > > :0fw > > | spamassassin -P > > As I mentioned before if your setup is typical then if you don't want -P The -P parameter will cause it to pipe the output to STDOUT instead. Why do you want it in standard out instead of the mail spool? Thanks -- Dan Kubilos __\o_ ^ K-8 Tech Coord http://www.oxnardsd.org From newsletters at PCSITES.COM Fri Mar 29 22:01:45 2002 From: newsletters at PCSITES.COM (Richard Ahlquist) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? Message-ID: On Fri, 29 Mar 2002 13:40:12 -0800, Dan Kubilos wrote: >Thanks Richard. I was looking for this. > >But . . . > >why the -P option > > >-P > >The -P parameter will cause it to pipe the output to STDOUT instead. > >Why do you want it in standard out instead of the mail spool? > >Thanks > > >-- >Dan Kubilos __\o_ ^ >K-8 Tech Coord >http://www.oxnardsd.org Dan, to be honest I am uncertain. Thats just how they have it written up all over the Spamassassin site. Here it is from the FAQ on the SA site. ----quote---- How do I use SpamAssassin with procmail? The following procmail recipe will pre-process your mail through SpamAssassin (one at a time), and if a mail is tagged as spam, will refile it into a folder called "caughtspam" in your home directory. :0fw | spamassassin -P :0: * ^X-Spam-Status: Yes caughtspam spamc can be used instead of spamassassin, if you intend to install and use the spamd server system-wide. Read 'man procmailrc' and 'man procmailex' for futher details and explanation. ---/quote--- There may be more documentation on 'why this is' but I am unsure of where as yet. From brose at MED.WAYNE.EDU Fri Mar 29 21:53:14 2002 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? Message-ID: I added some code to the sendmail.pl that will call SA to rewrite the message with a report and dump that into a directory. I haven't spent any time to see about returning rewrite back since I think that may be more difficult. Here's the diffs. 289c289,290 < $SAResult = SAForkAndTest($SAspamtest, $spammail); --- > #Bobby added $mID > $SAResult = SAForkAndTest($SAspamtest, $spammail, $mID); 299c300,301 < my($Test, $Mail) = @_; --- > #Bobby added $mID > my($Test, $Mail, $mID) = @_; 312a315,327 > #Bobby's added code > my $SAScore = $spamness->get_hits(); > my $SAReqHits = $spamness->get_required_hits(); > Log::InfoLog("SpamAssassin score $SAScore of $SAReqHits"); > if ($SAScore >= $SAReqHits) { > #$spamness->report_as_spam ($Mail); > $spamness->rewrite_mail (); > my $SARewrite = $spamness->get_full_message_as_text(); > local(*DOUT); > open(DOUT, ">>/var/spam/queue/spr$mID") or Log::DieLog("Failed to create copy of spam message spr$mID"); > print DOUT $SARewrite; > close DOUT; > } -----Original Message----- From: Dan Kubilos [mailto:dan@OXNARDSD.ORG] Sent: Friday, March 29, 2002 4:40 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: No SpamAssassin report with MailScanner? Thanks Richard. I was looking for this. But . . . why the -P option > > :0fw > > | spamassassin -P > > As I mentioned before if your setup is typical then if you don't want -P The -P parameter will cause it to pipe the output to STDOUT instead. Why do you want it in standard out instead of the mail spool? Thanks -- Dan Kubilos __\o_ ^ K-8 Tech Coord http://www.oxnardsd.org From dan at OXNARDSD.ORG Fri Mar 29 21:40:12 2002 From: dan at OXNARDSD.ORG (Dan Kubilos) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? In-Reply-To: Message-ID: Thanks Richard. I was looking for this. But . . . why the -P option > > :0fw > > | spamassassin -P > > As I mentioned before if your setup is typical then if you don't want -P The -P parameter will cause it to pipe the output to STDOUT instead. Why do you want it in standard out instead of the mail spool? Thanks -- Dan Kubilos __\o_ ^ K-8 Tech Coord http://www.oxnardsd.org From newsletters at PCSITES.COM Fri Mar 29 20:47:31 2002 From: newsletters at PCSITES.COM (Richard Ahlquist) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? Message-ID: On Fri, 29 Mar 2002 20:37:05 +0000, Richard Ahlquist wrote: >In the mailscanner.conf file usually found in /etc/mail make sure the >option for SpamAssassin says NO. > Oops thats /usr/local/MailScanner/etc/mailscanner.conf for the mailscanner.conf file. Sorry it friday and its been a long week. From newsletters at PCSITES.COM Fri Mar 29 20:37:05 2002 From: newsletters at PCSITES.COM (Richard Ahlquist) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? Message-ID: In the mailscanner.conf file usually found in /etc/mail make sure the option for SpamAssassin says NO. Then see if you have a file named procmailrc in the /etc directory (or wherever else you put procmail if you have procmail configured differently). If there isnt just create the file. It should contatin theses lines :0fw | spamassassin -P As I mentioned before if your setup is typical then if you don't want everyone to get their email run through spamassassin, then, instead of putting that file in, /etc put it in the home directory of each user who wants spamassassin run on their mail. Example if jdoe wanted this on my system I would put a file named ".procmailrc" in /home/jdoe/ inside that file would be the lines I mentioned above for the /etc/procmailrc file. NOTE: If the file is in /etc it is named "procmailrc" if it is in a users home directory its ".procmailrc" Thats it. This causes Mailscanner to launch sendmail, mail comes in, gets mailscanned, gets handed to procmail for delivery and gets spam scanned. I hope that answers Kelly's question too. Least thats the way I understand it, and I think it works well that way. May not be as smooth as Lewis mentions, but its the only way I know to get the full report. YMMV Richard ----- Original Message ----- From: "Jonothon Ortiz" To: Sent: Friday, March 29, 2002 11:39 AM Subject: Re: No SpamAssassin report with MailScanner? > Richard, would you mind specifying where we add this at? Thanks! > > > > The way I have gotten Mailscanner and Spamassassin to work together using > procmail is to have Mailscanner running configured for NO spamassasin and > then calling Spamassassin from /etc/procmailrc like this. > > :0fw > > | spamassassin -P > > Alternately if you want it to only work for some users you can put it in > their /home/usernamehere/.procmailrc > This will provide the full functionality of both programs. > > Hope this helps! > Richard From lbergman at abi.tconline.net Fri Mar 29 19:39:14 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? In-Reply-To: References: Message-ID: <200203291939.g2TJdEG10263@lewis.abi.tconline.net> On Friday 29 March 2002 12:59 pm, you wrote: > The way I have gotten Mailscanner and Spamassassin to work together using > procmail is to have Mailscanner running configured for NO spamassasin and > then calling Spamassassin from /etc/procmailrc like this. > > :0fw > : > | spamassassin -P > > Alternately if you want it to only work for some users you can put it in > their /home/usernamehere/.procmailrc > This will provide the full functionality of both programs. The problem is that mailscanner makes a really nice "one stop shop" for inserting these different techniques into the sendmail message pipe in a per user/domain way that would becomea real pain any other way. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From jon at XNEXT.COM Fri Mar 29 19:39:15 2002 From: jon at XNEXT.COM (Jonothon Ortiz) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? In-Reply-To: Message-ID: Richard, would you mind specifying where we add this at? Thanks! -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Richard Ahlquist Sent: Friday, March 29, 2002 1:59 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: No SpamAssassin report with MailScanner? The way I have gotten Mailscanner and Spamassassin to work together using procmail is to have Mailscanner running configured for NO spamassasin and then calling Spamassassin from /etc/procmailrc like this. :0fw | spamassassin -P Alternately if you want it to only work for some users you can put it in their /home/usernamehere/.procmailrc This will provide the full functionality of both programs. Hope this helps! Richard From fizz at BOMB.NET Fri Mar 29 19:34:19 2002 From: fizz at BOMB.NET (Kelly Hamlin) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? References: Message-ID: <002401c1d758$b84443e0$48cf75cc@fizz> what about when your using sendmail as a gateway? :) ----- Original Message ----- From: "Richard Ahlquist" To: Sent: Friday, March 29, 2002 1:59 PM Subject: Re: No SpamAssassin report with MailScanner? > The way I have gotten Mailscanner and Spamassassin to work together using > procmail is to have Mailscanner running configured for NO spamassasin and > then calling Spamassassin from /etc/procmailrc like this. > > :0fw > > | spamassassin -P > > Alternately if you want it to only work for some users you can put it in > their /home/usernamehere/.procmailrc > This will provide the full functionality of both programs. > > Hope this helps! > Richard > From newsletters at PCSITES.COM Fri Mar 29 18:59:28 2002 From: newsletters at PCSITES.COM (Richard Ahlquist) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? Message-ID: The way I have gotten Mailscanner and Spamassassin to work together using procmail is to have Mailscanner running configured for NO spamassasin and then calling Spamassassin from /etc/procmailrc like this. :0fw | spamassassin -P Alternately if you want it to only work for some users you can put it in their /home/usernamehere/.procmailrc This will provide the full functionality of both programs. Hope this helps! Richard From lbergman at abi.tconline.net Fri Mar 29 18:24:14 2002 From: lbergman at abi.tconline.net (Lewis Bergman) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? In-Reply-To: <1017426643.28537.31.camel@musuko.uchicago.edu> References: <1017426643.28537.31.camel@musuko.uchicago.edu> Message-ID: <200203291824.g2TIOEl10081@lewis.abi.tconline.net> > When I run SpamAssassin manually on test spam messages, I get reports, > but not when run via MailScanner. Is there some secret handshake I have > to know to get the reports? > > Thanks. > (Oh, yeah: SpamAssassin 2.11, MailScanner 3.12 on RedHat Linux 6.2 > (intel)) Me too. I was looking for ways to see why some spam gathers the required hits and others don't made the same changes you did but the header isn't added. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From s-luppescu at UCHICAGO.EDU Fri Mar 29 18:30:43 2002 From: s-luppescu at UCHICAGO.EDU (Stuart Luppescu) Date: Thu Jan 12 21:14:36 2006 Subject: No SpamAssassin report with MailScanner? Message-ID: <1017426643.28537.31.camel@musuko.uchicago.edu> I've been using MailScanner for while to scan for viruses, but only recently installed SpamAssassin. It works fine, but I don't get any SpamAssassin report, even though I've put use_terse_report 1 report_header 1 in /etc/mail/spamassassin/local.cf When I run SpamAssassin manually on test spam messages, I get reports, but not when run via MailScanner. Is there some secret handshake I have to know to get the reports? Thanks. (Oh, yeah: SpamAssassin 2.11, MailScanner 3.12 on RedHat Linux 6.2 (intel)) -- Stuart Luppescu -=- s-luppescu@uchicago.edu University of Chicago -=- CCSR 才文と智奈美の父 -=- Kernel 2.4.18-xfs If God had really intended men to fly, he'd make it easier to get to the airport. -- George Winters -------------- next part -------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEABECAAYFAjykstMACgkQDBHcBS0tWxPGXwCdEfrqHajDC646anCHoGtTwUt4 TUcAoLWC60ydABmqjL4xLrQGJ/ZaQOy/ =Umt1 -----END PGP SIGNATURE----- From patrickchan at GOODMARK.COM.CN Sun Mar 10 00:31:13 2002 From: patrickchan at GOODMARK.COM.CN (Patrick Chan) Date: Thu Jan 12 21:23:16 2006 Subject: Don't notify recipient Message-ID: <005301c1c7ca$e28039e0$290201a8@domain.com.cn> I've successfully built an e-mail server with antivirus feature. I use sendmail, MailScanner and clamav on Redhat. Because the volume of virus mail is very large nowadays, I don't want MailScanner to deliver a report to both sender and recipient. Just skipping the message is okay. How can I edit MailScanner.conf? I can't find such option. Thanks in advance. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20020310/fe007102/attachment.html