From patricksteiner at BLUEWIN.CH Tue Apr 1 02:23:53 2003 From: patricksteiner at BLUEWIN.CH (Patrick Steiner) Date: Thu Jan 12 21:17:40 2006 Subject: command line spamassassin make not the same test as mailscanner In-Reply-To: <5.2.0.9.2.20030331193454.02647698@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030331193454.02647698@imap.ecs.soton.ac.uk> Message-ID: <3E88EA29.5060209@bluewin.ch> yes i have see this line but i haven't set skip_rbl_checks --------snip----------- # By default, SpamAssassin will run RBL checks. If your ISP already # does this, set this to 1. # # skip_rbl_checks 1 ########################################################################### -------snip------------ Julian Field wrote: > The differences are that MailScanner for some reason didn't do the RBL > checks. > > RCVD_IN_OSIRUSOFT_COM (0.6 points) RBL: Received via a relay in > relays.osirusoft.com > [RBL check: found > 228.40.150.66.relays.osirusoft.com., type: 127.0.0.6] > X_OSIRU_SPAMWARE_SITE (1.1 points) RBL: DNSBL: sender is a Spamware > site or vendor > RCVD_IN_SBL (0.6 points) RBL: Received via SBLed relay, see > http://www.spamhaus.org/sbl/ > [RBL check: found 228.40.150.66.sbl.spamhaus.org.] > > Please check you spam.assassin.prefs.conf file and be sure you haven't > got > "skip_rbl_checks" set. > > At 18:07 31/03/2003, you wrote: > >> command line spamassassin make not the same test as mailscanner >> but this test is for me very important because it defined are this mail >> spam or not >> and this mail is a spam mail >> >> EXAMPLE: >> ------------- >> >> The follow report is from a spammail and mailscanner doesent catch >> this mail >> as spam >> >> >> Spamassassin -D >> ----------------- >> >> Content analysis details: (6.40 points, 5 required) >> SEARCH_ENGINE_PROMO (1.7 points) BODY: Discusses search engine listings >> HTML_WEB_BUGS (0.1 points) BODY: Image tag with an ID code to >> identify you >> HTML_30_40 (0.8 points) BODY: Message is 30% to 40% HTML >> HTML_MESSAGE (0.1 points) BODY: HTML included in message >> HTML_LINK_CLICK_HERE (0.1 points) BODY: HTML link text says "click >> here" >> HTML_TABLE_THICK_BORDER (1.1 points) BODY: HTML table has thick border >> HTML_FONT_COLOR_GRAY (0.1 points) BODY: HTML font color is gray >> RCVD_IN_OSIRUSOFT_COM (0.6 points) RBL: Received via a relay in >> relays.osirusoft.com >> [RBL check: found >> 228.40.150.66.relays.osirusoft.com., type: 127.0.0.6] >> X_OSIRU_SPAMWARE_SITE (1.1 points) RBL: DNSBL: sender is a Spamware >> site or vendor >> RCVD_IN_SBL (0.6 points) RBL: Received via SBLed relay, see >> http://www.spamhaus.org/sbl/ >> [RBL check: found 228.40.150.66.sbl.spamhaus.org.] >> CLICK_BELOW (0.1 points) Asks you to click below >> >> >> >> >> >> Mailscanner: >> ------------- >> >> X-MailScanner-SpamCheck: not spam, SpamAssassin (score=4.1, required >> 4.4, >> >> CLICK_BELOW, HTML_30_40, HTML_FONT_COLOR_GRAY, >> HTML_LINK_CLICK_HERE, >> HTML_MESSAGE, HTML_TABLE_THICK_BORDER, HTML_WEB_BUGS, >> SEARCH_ENGINE_PROMO) > > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > From patricksteiner at BLUEWIN.CH Tue Apr 1 02:34:46 2003 From: patricksteiner at BLUEWIN.CH (Patrick Steiner) Date: Thu Jan 12 21:17:40 2006 Subject: Dcc check doesn't work In-Reply-To: <5.2.0.9.2.20030331215247.0269d340@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030331215247.0269d340@imap.ecs.soton.ac.uk> Message-ID: <3E88ECB6.3040307@bluewin.ch> o.k thanks to jason and julian the static link has solved the problem (ln -s /usr/local/bin/dccproc /usr/bin) P?de Julian Field wrote: > At 21:45 31/03/2003, you wrote: > >> I was just having this problem too. I think I fixed it by making a >> symbolic link to dccproc in /usr/bin >> >> ln -s /usr/local/bin/dccproc /usr/bin >> >> I guess /usr/local/bin is not in the MailScanner's path. > > > Indeed. MailScanner's path is /sbin:/bin:/usr/sbin:/usr/bin so that > only system binaries will be found. This is quite intentional :) > It's at line 73 of /usr/sbin/MailScanner if you really want to change it. > >> >> You can also make sure you have >> >> use_dcc 1 >> >> in spam.assassin.prefs.conf >> >> Jason >> >> -----Original Message----- >> From: Patrick Steiner [mailto:patricksteiner@BLUEWIN.CH] >> Sent: Monday, March 31, 2003 1:01 PM >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Re: [MAILSCANNER] Dcc check doesn't work >> >> yes but it dosen't working and i don't now why....... >> i hope any people has any ideas to fix my problem >> >> Spicer, Kevin wrote: >> >>>> >>>>this line is the only one that i can find >>>> >>>> >>>># MailScanner: Comment out the next line to enable DCC checking if >>>>you >>>> >>>># >>>>have dcc installed (optional part of SpamAssassin) >>>> >>>>score DCC_CHECK 5 >>>> >>>> >>>> >>> >>>Thats the one! Normally it is... >>> >>>score DCC_CHECK 0 >>> >>>(giving a test a zero score disables it) so you would either comment >>>it out (to use the default spamassassin score) or give it a none zero >>>value, which is what you have done. It should be working. >>> >>> >>> >>> >>>BMRB International >>> >>>http://www.bmrb.co.uk >>> >>>+44 (0)20 8566 5000 >>> >>>_________________________________________________________________ >>> >>>This message (and any attachment) is intended only for the >>> >>>recipient and may contain confidential and/or privileged >>> >>>material. If you have received this in error, please contact >>>the >>> >>>sender and delete this message immediately. Disclosure, >>>copying >>> >>>or other action taken in respect of this email or in >>> >>>reliance on it is prohibited. BMRB International Limited >>> >>>accepts no liability in relation to any personal emails, or >>> >>>content of any email which does not directly relate to our >>> >>>business. >>> >>> >>> >>> >>> > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030401/dded9a2f/attachment.html From raymond at PROLOCATION.NET Tue Apr 1 07:36:33 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:40 2006 Subject: CERT Advisory CA-2003-12 Buffer Overflow in Sendmail In-Reply-To: Message-ID: Hi! > Their servers are difficult to get onto right now. But I found the > updates on one mirror: > > ftp://ftp.dc.aleron.net/pub/linux/redhat/ftp.redhat.com/linux/updates/ I run a official RedHAt mirror. ftp://ftp.quicknet.nl/pub/Linux/ftp.redhat.com/updates > I haven't had any luck running up2date either - just get errors > referring to "high load". Thats since RedHat 9 is out and ONLY available right now via RHN, so their link is loaded... Bye, Raymond. From raymond at PROLOCATION.NET Tue Apr 1 07:45:19 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:40 2006 Subject: MailScanner Status Check In-Reply-To: <20030331213548.GC2792@mew.kcbbs.gen.nz> Message-ID: Hi! > I've just upgraded sendmail on a Redhat 8.0 to v 8.12.8-5.80 8.12-5.80 ?? What do you mean ? > MailScanner: [ OK ] > incoming sendmail: [FAILED] > outgoing sendmail: [ OK ] > > But....everything *seems* to be working OK? killall -9 sendmail and restart mailscanner again. Bye, Raymond. From Kevin.Spicer at BMRB.CO.UK Tue Apr 1 07:51:38 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:40 2006 Subject: MailScanner Status Check Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF4E6@pascal.priv.bmrb.co.uk> > The status reports... > Checking MailScanner daemons: > MailScanner: [ OK ] > incoming sendmail: [FAILED] > outgoing sendmail: [ OK ] > > But....everything *seems* to be working OK? > Most probably it is! The recent kernel updates changed the output of ps, which caused the status check in the init script to break. See the "MailScanner 4.12-2 / 4.13-3 incoming failed" thread last week (I think there may have been a fix there too). BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From leduc at CTS.COM Tue Apr 1 08:09:58 2003 From: leduc at CTS.COM (Gene & Mary LeDuc) Date: Thu Jan 12 21:17:40 2006 Subject: MailScanner Status Check Message-ID: <2.2.16.20030401070958.10374792@crash.cts.com> I'm seeing the same thing on RH 8.0 with sendmail 8.12.8-5.80. It appears to be running, processing incoming and outgoing mail, but the command service MailScanner status gives >[root@organizer root]# service MailScanner status >Checking MailScanner daemons: > MailScanner: [ OK ] > incoming sendmail: [FAILED] > outgoing sendmail: [ OK ] 8.12.8-5.80 appears to be what RH decided to name 8.12.9 Killing the sendmail processes doesn't make any difference. Interestingly, the stop and start commands behave as expected: >[root@organizer root]# service MailScanner stop >Shutting down MailScanner daemons: > MailScanner: [ OK ] > incoming sendmail: [ OK ] > outgoing sendmail: [ OK ] >[root@organizer root]# killall -9 sendmail >sendmail: no process killed >[root@organizer root]# service MailScanner start >Starting MailScanner daemons: > incoming sendmail: [ OK ] > outgoing sendmail: [ OK ] > MailScanner: [ OK ] The status check at the beginning was run right after the above start and stop commands. From raymond at PROLOCATION.NET Tue Apr 1 08:10:41 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:40 2006 Subject: MailScanner Status Check In-Reply-To: <2.2.16.20030401070958.10374792@crash.cts.com> Message-ID: Hi! > >Starting MailScanner daemons: > > incoming sendmail: [ OK ] > > outgoing sendmail: [ OK ] > > MailScanner: [ OK ] > > The status check at the beginning was run right after the above start and > stop commands. My guess is that the instal script started sendmail right after. So if you restart mailscanner it would error once but thats it... Bye, Raymond. From jase at SENSIS.COM Tue Apr 1 16:27:34 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:40 2006 Subject: Logging stops after reload of syslog-ng Message-ID: I've been noticing in my mail.log file that there are gaps in the logs. Specifically, when syslog-ng is reloaded (every day around 6:30 am) MailScanner logs stop until MailScanner does its automatic restart. I am using Debian (Woody) and it looks like this is happening during the log rotation process. Syslog-ng is configured to run "/etc/init.d/syslog-ng reload" after it rotates log files. This appears to do a "kill -1" on the syslog-ng process. Other processes don't seem to have problems logging after this - just MailScanner. Manually restarting MailScanner also fixes the problem. I am running: MailScanner 4.12-2 syslog-ng 1.5.15-1.1 perl 5.6.1-8.2 Is anyone else seeing this behavior? Is this a problem specific to syslog-ng? I wonder if this could be fixed by re-opening the syslog? Would it be possible to check for an error when logging, or checking if the log is no longer opened, and if so, re-open it? Doing a quick look at perldoc Sys::Syslog does not indicate there are any return values for the syslog function. :-( Any ideas? Thanks. Jason From brian at UNEARTHED.ORG Tue Apr 1 18:47:13 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:40 2006 Subject: F-Secure Anti-Virus for Linux Release 4.50 build 2111 now available... Message-ID: <000901c2f878$0cd45080$8801020a@brianmay> Highlites: FSAV can now scan files with path names longer than 255 characters. New maximum length is 4076 characters. The archive scanning supports more archive types including LHA, RAR, GZIP, TAR, CAB and BZ2 archives. The Kaspersky Labs. AVP scan engine is included in addition to Frisk Software International F-PROT scan engine and files are scanned with two scan engines by default. The program has two binaries, namely fsav and fsavd. The fsavd works as a scanning daemon and fsav as a client to send scan requests to the daemon. The fsavd has one master process to control the client connections and scan engines and one process for each scan engine. The new architecture reduces the fsav startup time and increases the performance in subsequent scan requests. ========================================================================== RELEASE NOTES FOR F-Secure Anti-Virus for Linux Release 4.50 build 2111 ========================================================================== This Release Notes document is for F-Secure Anti-Virus for Linux. This Document contains late-breaking information about the product. Please refer to the manual for more information. The manual is available in man(1) page format on the installation media. * Technical Support World-wide web: http://www.F-Secure.com/support/ Your local contact: @F-Secure.com F-Secure contact: Anti-Virus-Support@F-Secure.com * Sales World-wide web: http://www.F-Secure.com/solutions/ Your local contact: @F-Secure.com F-Secure contact: Anti-Virus-Sales@F-Secure.com * F-Secure USA F-Secure Europe F-Secure Inc. F-Secure Corporation 675 N. First Street, Tammasaarenkatu 7 5th floor San Jose, CA 95112, USA FIN-00180 Helsinki, Finland tel (408) 938 6700 tel +358 9 2520 0700 fax (408) 938 6701 fax +358 9 2520 5001 http://www.F-Secure.com/ http://www.Europe.F-Secure.com/ Please do not call F-Secure directly if you have a local F-Secure Business Partner in your area. For an up-to-date listing of F-Secure Business Partners world-wide, see http://www.F-Secure.com/partners/. ========================================================================== Overview ========================================================================== F-Secure Anti-Virus for Linux provides virus scanning capabilities for Linux computers. The product supports a command line interface that is suitable for both manual use and integration in systems that need to perform virus scanning tasks. The command line interface supports full functionality for virus detection, disinfection and reporting. F-Secure Anti-Virus' detection rate is ensured by multiple scanning engines. Tools are provided for automated virus definition database updating directly from F-Secure. The product is especially optimized for use together with systems that need to perform virus scanning on for example mail traffic. Scanning engine daemon technology ensures optimal performance even in situations where the command line scanner is invoked separately for each scanned file. Further information can be found in the F-Secure Anti-Virus for Linux manual pages: fsav(1), fsavd(8), fsav.conf(5), fsavschedule(8) and dbupdate(8). ========================================================================== What Does It Include? ========================================================================== This release includes the following components: - F-Secure Anti-Virus for Linux v. 4.50 ========================================================================== What's New in F-Secure Anti-Virus for Linux v. 4.50 ========================================================================== The following features, enhancements and bug fixes have been implemented in this release: o Multiple virus scanning engines. o Improved http-based virus definition update tool. o Daemon-mode that improves the performance when integrating with for example mail scanning solutions. ========================================================================== Changes Compared to Previous Version ========================================================================== The installation directory hierarchy has changed and the package contains new files and directories. The program binaries are installed under bin/ -directory, databases under databases/ -directory, scan engines and File Management Library under lib/ -directory, manual pages under man/ -directory and example fsavd startup-script and configuration file under etc/ -directory. In addition the program uses run/ -directory for run-time files and update/ -directory for database updates. The directories are relative to installation directory. The Kaspersky Labs. AVP scan engine is included in addition to Frisk Software International F-PROT scan engine and files are scanned with two scan engines by default. The program has two binaries, namely fsav and fsavd. The fsavd works as a scanning daemon and fsav as a client to send scan requests to the daemon. The fsavd has one master process to control the client connections and scan engines and one process for each scan engine. The new architecture reduces the fsav startup time and increases the performance in subsequent scan requests. The F-Secure File Management Library is included as a shared library for better maintenance. The fsavd uses the library and is dynamically linked with the libfm.so. FSAV can now scan files with path names longer than 255 characters. New maximum length is 4076 characters. The program output has changed. The file infection and suspected infection message formats are different and are shown for each scan engine separately. The scan engines scan archive contents independently and the output may vary even if the same archive is scanned multiple times. The --list options does not list the clean files inside archives because of the asynchronous nature of the scan engines. Also, the nested archive names are not shown in infection and suspected infection messages. The configuration file format has changed. The older release cannot parse the new configuration file properly and will give parse errors, see the fsav.conf(5) manual page for details. The database update script name has changed from fsavupdate to dbupdate. The update script can do incremental database updates with external database download tool and validates the databases with the external validation tool. The database download tool is named getdbhtp and the validation tool dbtool. The database update must be done with dbupdate tool to validate the databases and to make sure the update process does not interfere any ongoing file scans. The archive scanning supports more archive types including LHA, RAR, GZIP, TAR, CAB and BZ2 archives. The action confirmation logic has changed. The 'All' answer applies to the confirmed action only. The --nocheck -option is dropped from options. New options introduced in this release: --configfile, --dbupdate, --socketname, --input, --exclude, --exclude-from, --maxnested, --scantimeout, --avp, --fprot, --shutdown, --standalone and --usedaemon, see the fsav(1) and fsavd(8) manual pages for details. The user can specify the directories to scan for fsavschedule, see the fsavschedule(8) manual page for details. ========================================================================== System Requirements ========================================================================== F-Secure Anti-Virus for Linux v. 4.50 should be installed on a computer that meets the following minimum system requirements: Processor: x86 Memory: 32 MB RAM or more Disk space to install: 30 MB (20 MB for AV databases and database backups) Supported Linux distributions: Red Hat Linux 6.2 (glibc 2.1.3-22 or later), Red Hat Linux 7.3, Red Hat Linux 8.0, Debian GNU/Linux 3.0, SuSE Linux 8.1 F-Secure Anti-Virus for Linux can be installed on any Linux x86 with correct glibc version. ========================================================================== Installation Instructions ========================================================================== Please consult F-Secure Anti-Virus for Linux Guide for full step-to-step instructions. KEY CODES FOR INSTALLATION The key code for installation can be found either: o On a sticker on the CD-ROM envelope. o On the back of the installation instructions booklet that comes with your CD-ROM. o In a mail that confirms your purchase. Quick installation instructions: - Make the installation package executable: # chmod a+x fsav-srv-4.50.XXXX - Execute the package: # ./fsav-srv-4.50.XXXX - The installer will ask for the license key. Enter the key code to continue or press CTRL-C to cancel the installation. - The installer will ask some questions. Press ENTER to accept the default value for each question. After the installation type "fsav --version" to verify that the installation was successful. The output should show product, scan engine and database versions. ========================================================================== Upgrading from Previous Version ========================================================================== F-Secure Anti-Virus for Linux cannot be upgraded. You will need to manually remove the previous version and configuration data before installing this version. You can uninstall previous version by removing installation directory /usr/local/fsav, configuration file /etc/fsav.conf or .fsav.conf in user's home directory, symbolic link to binary /usr/local/bin/fsav and symbolic link to manual page /usr/local/man/man1/fsav.1. ========================================================================== Known Problems ========================================================================== o SCR#26251: FSAV reports "clean" before "[disinfected]" when --list is used with --disinf. The output contains one extra "clean" line. This is the re-scan result after disinfection. The problem only exists when using --list together with disinfection turned on. The "clean" is only printed after disinfection, so it is factually correct information. o SCR#26223: fsavschedule schedules virus scans at midnight. If you schedule automatic virus scan with fsavschedule, the hour of scan will always be "0" no matter what is entered as as the hour of scan. o SCR#26042: FSAV does not scan multiple files in parallel. This may be a problem when large files block scanning of smaller files. Workaround is to use --standalone to launch a new separate daemon for every scan. o SCR#26023: If fsav client is killed, immediately started another scan may fail in certain circumstances. Adding a small delay before next scan request prevents the problem. o SCR#25995: dbupdate's signal handler prints an error on Red Hat 6.x (bash 1.14). The message can be ignored. o SCR#24479: File names inside archives should be printed when scanning. Currently name of the clean files inside archives are not printed when --list option is used. ========================================================================== Technical Support ========================================================================== Upon purchase and registration of F-Secure Anti-Virus software you are entitled to maintenance and support services for one (1) year (unless stated otherwise in your agreement). For the following years, the services can be purchased separately. F-Secure Technical Support is available by e-mail and from our Web site. You can access our Web site from your Web browser. For Technical Support for F-Secure Anti-Virus, go to: http://www.F-secure.com/support/ ========================================================================== F-Secure Web Club ========================================================================== F-Secure Web Club is open to all F-Secure customers. Web Club pages contain a great deal of useful information on latest software versions, user documentation, release notes, etc. To connect to the Web Club directly from within your Web browser, go to: http://www.F-Secure.com/webclub/ ========================================================================== Copyrights ========================================================================== F-Secure Anti-Virus for Linux Copyright (c) 1993-2003 F-Secure Corporation. All Rights Reserved. Portions Copyright (c) 1989-2003 Frisk Software International. Portions Copyright (c) 1991-2003 Kaspersky Lab. F-Secure and the triangle symbol are registered trademarks of F-Secure Corporation and F-Secure product names and symbols/logos are either trademarks or registered trademarks of F-Secure Corporation. ========================================================================== F-Secure License Terms ========================================================================== THE ACCOMPANYING SOFTWARE IS LICENSED TO YOU ONLY UPON THE CONDITION THAT YOU ACCEPT ALL OF THESE LICENSE TERMS. BY INSTALLING OR USING THE ACCOMPANYING SOFTWARE YOU AGREE THAT YOU HAVE READ THESE TERMS AND AGREE TO BE BOUND BY THEM. IF YOU DO NOT AGREE TO ALL OF THE TERMS, DO NOT INSTALL, USE OR COPY THE SOFTWARE. LICENSE These F-Secure License Terms cover any and all F-Secure programs including related documentation (together the "Software") licensed by the user ("You" or "Licensee"). The Software is licensed, not sold, to You for use only under the following terms. F-Secure reserves any and all rights not expressly granted to You. F-Secure retains ownership of all copies of the Software and released updates and upgrades to the Software. F-Secure provides You the Software either in electronic format or on storage media (typically CD-ROM). You may: A) Install and use the Software only on as many units (typically handheld devices, personal computers, servers or other hardware) as stated in the F-Secure License Certificate. In case the Software or its services are shared through a network or the Software is used to protect traffic from viruses or other malicious code at email servers, firewalls or gateways, You must have a license for the total number of users whom the Software provides services to. In that case You may install the Software on as many units as needed. B) Install and use F-Secure BackWeb(tm) in conjunction with licensed Software. F-Secure BackWeb may be used only for receiving updates and information on the Software. F-Secure BackWeb shall not be used for any other purpose or service. C) Use F-Secure Policy Manager(tm) in conjunction with licensed Software and install F-Secure Policy Manager on as many units as needed. D) Create copies of the Software for installation and backup purposes. E) Extend the number of licenses by purchasing additional licenses. You may not: A) Install and use the Software against these License Terms, the F-Secure License Certificate or the related documentation. B) Distribute copies of the Software to a third party, electronically transfer the Software to a computer belonging to a third party, or permit a third party to copy the Software. C) Modify, adapt, translate, rent, lease, resell, distribute or create derivative works based upon the Software or any part thereof. D) Decompile, reverse engineer, disassemble, or otherwise reduce the Software to any human-perceivable form as the Software contains or may contain trade secrets of F-Secure. E) Use the documentation for any purpose other than to support Your use of the Software. Please contact F-Secure directly if You are interested in any other rights to the Software other than those granted in this Agreement. MAINTENANCE AND SUPPORT SERVICES Upon purchase of F-Secure Anti-Virus(tm) Software or product bundles including F-Secure Anti-Virus Software You are provided with maintenance and support services, which include updates, upgrades, and technical support, for one (1) year. For other Software, the services can be purchased separately. The maintenance and support services will be provided to You by F-Secure or Your license provider. F-Secure reserves the right to provide Software updates for latest versions of the Software only if not otherwise agreed separately. Software upgrades and updates are made available to You as new Software versions are released. The services are delivered to persons registered as the support and maintenance contact. On request, the services can be provided to additional locations for an additional fee. For evaluation copies of the Software, F-Secure shall have no obligation to provide the services. In case the Software is integrated with 3rd party products, F-Secure provides support and maintenance for the licensed F-Secure Software only unless otherwise separately agreed. TITLE Title, ownership rights, and intellectual property rights in the Software shall remain those of F-Secure, and/or its suppliers. The Software is protected by copyright laws and international copyright and other intellectual property treaties. LIMITED WARRANTY AND DISCLAIMERS Limited Warranty on Media. F-Secure warrants the media on which the Software is recorded to be free from defect in material and workmanship under normal use for 30 days from the date of delivery. Any implied warranties on the media, including implied warranties of merchantability and fitness for a particular purpose, are limited in duration to 30 days from the date of delivery. F-Secure will, at its option, replace the media or refund the purchase price of the media. F-Secure shall have no responsibility to replace or refund the purchase price of media, which is damaged by accident, abuse, or misapplication. Disclaimer of Warranty on Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. F-SECURE EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. F-Secure does not guarantee the Software or related documentation in terms of their correctness, accuracy, reliability, or otherwise. You assume the entire risk as to the results and performance of the Software and related documentation. Complete Statement of Warranty. The limited warranties provided in the preceding paragraphs are the only warranties of any kind that are made by F-Secure on the Software. No oral or written information or advice given by F-Secure, its dealers, distributors, agents, or employees shall create a warranty or in any way increase the scope of the foregoing limited warranty, and You may not rely on any such information or advice. Some states do not allow the exclusion of implied warranties, so the above exclusion may not apply to You, and You may have other rights which may vary from state to state. Limitation of Liability. IN NO EVENT SHALL F-SECURE OR ITS SUPPLIERS BE LIABLE TO YOU FOR ANY SPECIAL, CONSEQUENTIAL, INCIDENTAL, OR INDIRECT DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOSS OF REVENUE OR PROFIT, LOST OR DAMAGED DATA OR OTHER COMMERCIAL OR ECONOMIC LOSS, ARISING OUT OF THE USE OF, OR INABILITY TO USE, THE SOFTWARE OR RELATED DOCUMENTATION, EVEN IF F-SECURE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Some states do not allow the limitation or exclusion of liability for incidental or consequential damages so the above limitation or exclusion may not apply to You. F-SECURE SHALL IN NO EVENT BE LIABLE FOR ANY DAMAGES ARISING FROM PERFORMANCE OR NON-PERFORMANCE OF THE SOFTWARE. OUR MAXIMUM LIABILITY TO YOU FOR ACTUAL DAMAGES FOR ANY CAUSE WHATSOEVER SHALL IN NO EVENT EXCEED THE AMOUNT PAID BY YOU FOR THE SOFTWARE. Nothing contained in these License Terms shall prejudice the statutory rights of any party dealing as a consumer. F-Secure is acting on behalf of its employees and licensors or subsidiaries for the purpose of disclaiming, excluding, and/or restricting obligations, warranties, and liability as provided in this clause, but in no other respects and for no other purpose. EXPORT RESTRICTIONS (EXCLUSIVELY FOR CRYPTOGRAPHIC SOFTWARE) 1. If the Software is shipped or otherwise distributed to You from the United States of America: The Licensee acknowledges that the Software and the maintenance and support services including without limitation technical services and technical data (e.g., manuals, blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications and instructions written or recorded and any other such technical services and technical data ("the Services") are of U.S. origin for purposes of U.S. export control laws, regulations, administrative acts or Executive Orders, and any amendments thereof, including without limitation the Export Administration Act of 1979, as amended (the "Act"), and the regulations promulgated thereunder (the "U.S. Export Control Laws"). The Licensee agrees to comply with all applicable U.S. Export Control Laws and any applicable international laws and regulations that apply to the Software and to the Services, including without limitation the Act as well as end-user, end-use and destination restrictions issued by the U.S. and other governments. 2. If the Software is shipped or otherwise distributed to You from a country other than the United States of America: The Licensee agrees to comply with the local regulations regarding exporting and/or using cryptographic software. In all cases, F-Secure will not be liable for the illegal export and/or use of its cryptographic software by the Licensee. U.S. GOVERNMENT RIGHTS If the Software is licensed for or on behalf of the United States of America, its agencies and/or instrumentalities ("U.S. Government") pursuant to solicitations issued on or after December 1, 1995, the Software is provided with the commercial rights and restrictions described elsewhere herein. If the Software is licensed for or on behalf of the U.S. Government pursuant to solicitations issued prior to December 1, 1995, the Software is provided with RESTRICTED RIGHTS as provided for in FAR, 48 CFR 52.227-14 (JUNE 1987) or DFAR, 48 CFR 252.227-7013 (OCT 1988), as applicable. HIGH RISK ACTIVITIES The Software is not fault-tolerant and is not designed, manufactured or intended for use or resale as on-line control equipment in hazardous environments requiring fail-safe performance, such as in the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control, direct life support machines, or weapons systems, in which the failure of the Software could lead directly to death, personal injury, or severe physical or environmental damage ("High Risk Activities"). F-Secure and its suppliers specifically disclaim any express or implied warranty of fitness for High Risk Activities. GENERAL These License Terms are effective from April 1st 2002 until further notice. The license will terminate immediately without notice if You are in breach of any of its terms and conditions. For evaluation copies of the Software, the license will terminate automatically: 1) if You fail to comply with the limitations described herein; 2) 30 days from the first installation of the Software; or 3) at the expiration of the allocated evaluation time. Upon termination of this License, You agree to destroy the Software and all copies thereof. If You purchase the Software before the expiration of the evaluation time and register the Software, You have a valid license and You do not need to destroy the Software. You shall not be entitled to a refund from F-Secure or any of its resellers as a result of termination. The terms and conditions concerning confidentiality and restrictions on use shall continue in force even after any termination. F-Secure may revise these terms at any time and the revised terms shall automatically apply to the corresponding versions of the Software distributed with the revised terms. If any part of these License Terms is found void and unenforceable, it will not affect the validity of rest of the License Terms, which shall remain valid and enforceable according to its terms. These License Terms may be modified in writing only by F-Secure. In case of controversy or inconsistency between translations of these License Terms to other languages, the English version issued by F-Secure shall prevail. These terms can be complemented with other documentation issued by F-Secure or agreed both by F-Secure and You or F-Secure and Your license provider. These terms shall be governed under the Laws of Finland without regard to conflict of laws rules and principles and without regard to the United Nations Convention of Contracts for the International Sales of Goods. The courts of Finland shall have the exclusive jurisdiction and venue to adjudicate any dispute arising out of these License Terms. Notwithstanding the foregoing, in the case of purchases made within or on behalf of licensees residing within or operating under the laws of the United States the governing law of these terms shall be the laws of the State of California without regard to conflict of laws rules and principles and without regard to the United Nations Convention of Contracts for the International Sales of Goods. The exclusive jurisdiction and venue to adjudicate any dispute arising out of these License Terms shall be of the federal and state courts of California. All correspondence regarding these License Terms should be addressed to F-Secure: F-Secure Corporation Tammasaarenkatu 7 FIN-00180 Helsinki, Finland E-mail: Helsinki@F-Secure.com Telephone: +358 9 2520 0700 Fax: +358 9 2520 5001 ========================================================================== End of RELEASE NOTES ========================================================================== From brian at UNEARTHED.ORG Tue Apr 1 19:13:26 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:40 2006 Subject: New F-Secure Anti-Virus for Linux version 4.50 build 2111 output... References: Message-ID: <002101c2f87b$6091f800$8801020a@brianmay> Below the --------- line is the new F-Secure output with 2 engines scanning a file... ----[]cut[]---- F-Secure Anti-Virus for Linux version 4.50 build 2111 Copyright (c) 1999-2003 F-Secure Corporation. All Rights Reserved. [eicar_com.zip] eicar.com: Infected: EICAR_Test_File [F-Prot] [eicar_com.zip] eicar.com: Infected: EICAR-Test-File [AVP] 1 file scanned 1 file infected ----[]cut[]---- From mailscanner at HRSERVERS.COM Tue Apr 1 20:37:39 2003 From: mailscanner at HRSERVERS.COM (SUBSCRIBE MAILSCANNER Anonymous) Date: Thu Jan 12 21:17:40 2006 Subject: F-Prot 3.13 support Message-ID: When trying to patch on MailScanner 4.13-3 I get the following error. Any ideas on what is going on there? patch < /root/SweepViruses.pm.patch patching file SweepViruses.pm Reversed (or previously applied) patch detected! Assume -R? [n] n Apply anyway? [n] n Skipping patch. 1 out of 1 hunk ignored -- saving rejects to file SweepViruses.pm.rej From brian at UNEARTHED.ORG Tue Apr 1 20:38:23 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:40 2006 Subject: F-Secure 4.50 not supported... Message-ID: <006f01c2f886$495839a0$8801020a@brianmay> If you are using F-Secure with MailScanner, version 4.5 will not work as the output has changed, and the location to fsav has changed as well.. Also, the command line for the scan is similar, MailScanner doesn't seem to pass the full path, just '.' and fsav seems to scan the computer, and not the working directory... I tried updating the source, but I can't seem to figure it out... I belive I got the SweepsVirus.pm file done... to match the output, but I can;t seem to figure out how to pass the working directory... Brian From hden at KCBBS.GEN.NZ Tue Apr 1 21:22:04 2003 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:17:40 2006 Subject: No subject In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF4E6@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EBF4E6@pascal.priv.bmrb.co.uk> Message-ID: <20030401202204.GA3472@mew.kcbbs.gen.nz> On Tue, Apr 01, 2003 at 07:51:38AM +0100, Spicer, Kevin wrote: > > [SNIP] > > incoming sendmail: [FAILED] > > outgoing sendmail: [ OK ] > > > > But....everything *seems* to be working OK? > > > Most probably it is! > > The recent kernel updates changed the output of ps, which caused the status check in the init script to break. See the "MailScanner 4.12-2 / 4.13-3 incoming failed" thread last week (I think there may have been a fix there too). Ahh, thanks, worked thru that thread. Curiosity, did those new scripts fix that problem? seemed (?) that it may not have for all (?)[IIUC] Obviously not critical as, as several have confirmed, all is working correctly.. Thanks Hendrik From ap at HPI.COM Tue Apr 1 21:23:05 2003 From: ap at HPI.COM (Adam Polkosnik) Date: Thu Jan 12 21:17:40 2006 Subject: MailScanner Status Check In-Reply-To: <20030331213548.GC2792@mew.kcbbs.gen.nz> References: <5.2.0.9.2.20030331215247.0269d340@imap.ecs.soton.ac.uk> <20030331213548.GC2792@mew.kcbbs.gen.nz> Message-ID: <3E89F529.70804@hpi.com> Update kills only one sendmail process... you should do /etc/init.d/MailScanner restart after upgrading sendmail. Hendrik den Hartog wrote: >Hello > > I've just upgraded sendmail on a Redhat 8.0 to v 8.12.8-5.80 > > Am using Mailscanner 4.14.5 > > The status reports... > Checking MailScanner daemons: > MailScanner: [ OK ] > incoming sendmail: [FAILED] > outgoing sendmail: [ OK ] > > But....everything *seems* to be working OK? > >Anything to worry about? Change? Check? > >Help/advice appreciated,,, > >Cheers! >Hendrik > > > From combs at MAGNET.FSU.EDU Tue Apr 1 23:04:15 2003 From: combs at MAGNET.FSU.EDU (Tom Combs) Date: Thu Jan 12 21:17:40 2006 Subject: startup with sendmail 8.12 .* Message-ID: Hello, I'd need to move from sendmail 8.11.6 to sendmail 8.12.9. I'm not clear how I need to start sendmail/mailscanner under the new smmsp set up. Would someone be so kind as to send me their init.d/sendmail script so I can see what needs to be done. TIA! --Tom Combs From neilb at DUNBARTON.COM Wed Apr 2 00:42:15 2003 From: neilb at DUNBARTON.COM (Neil Brockman) Date: Thu Jan 12 21:17:40 2006 Subject: Header missing on Warning Messages to Recipient Message-ID: <3E8A23D7.70504@dunbarton.com> We have installed Mailscanner 4.13-3 on an OpenBSD 3.2 machine running Sendmail. We followed the instructions in INSTALL.OpenBSD. Mailscanner seems to run fine (/var/log/maillog reports nothing unusual, the individual sending the email receives notification, attachments appear to be properly stripped out and stored) but the recipient's mailbox is overwritten with something like this (No header): Any ideas why? F------=_NextPart_000_320f_6e7_7856 Content-Type: text/plain; format=flowed Warning: This message has had one or more attachments removed Warning: (bitpro.exe). Warning: Please read the "VirusWarning.txt" attachment(s) for more information. ______________________________________ This email has been scanned for harmful attachments for domain @dunbarton.com by Inflex. From mike at CAMAROSS.NET Wed Apr 2 00:59:58 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:40 2006 Subject: startup with sendmail 8.12 .* In-Reply-To: Message-ID: <004001c2f8aa$ce615810$af01a8c0@home.middlefinger.net> Why do you *need* to move to 8.12? Just curious... -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Tom Combs Sent: Tuesday, April 01, 2003 4:04 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: startup with sendmail 8.12 .* Hello, I'd need to move from sendmail 8.11.6 to sendmail 8.12.9. I'm not clear how I need to start sendmail/mailscanner under the new smmsp set up. Would someone be so kind as to send me their init.d/sendmail script so I can see what needs to be done. TIA! --Tom Combs From danieltan at shopnsave.com.sg Wed Apr 2 03:34:24 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:40 2006 Subject: mailscanner can't send mail? Message-ID: <005c01c2f8c0$60b0bd40$3900a8c0@Daniel> did a top and found out my mailscanner has been trying to scan or send the mail for so many hours....what is wrong with it? i still have 56 requests stucj in mqueue.in. it seems like mailscanner is giving me a lot of problems 10:33am up 5 days, 22:36, 2 users, load average: 1.98, 1.99, 1.93 82 processes: 78 sleeping, 4 running, 0 zombie, 0 stopped CPU states: 98.8% user, 1.1% system, 0.0% nice, 0.0% idle Mem: 127760K av, 123352K used, 4408K free, 52580K shrd, 2704K buff Swap: 265032K av, 129084K used, 135948K free 38944K cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND 27832 root 12 0 17932 12 8 R 97.0 0.0 922:40 MailScanner 22416 root 1 0 1044 1044 816 R 0.5 0.8 0:00 top 15989 root 0 0 18768 11M 4412 S 0.3 9.0 0:19 MailScanner 16636 root 0 0 18632 10M 5660 S 0.3 8.1 0:16 MailScanner 16955 root 0 0 18120 9528 4740 S 0.3 7.4 0:13 MailScanner 17145 root 0 0 18808 10M 4248 S 0.3 8.7 0:14 MailScanner 1 root 0 0 116 76 56 S 0.0 0.0 1:12 init 2 root 0 0 0 0 0 SW 0.0 0.0 0:00 kflushd 3 root 0 0 0 0 0 SW 0.0 0.0 0:01 kupdate 4 root 0 0 0 0 0 SW 0.0 0.0 0:00 kpiod 5 root 0 0 0 0 0 SW 0.0 0.0 0:18 kswapd 6 root -20 -20 0 0 0 SW< 0.0 0.0 0:00 mdrecoveryd 65 root 0 0 0 0 0 SW 0.0 0.0 0:00 khubd 373 root 0 0 268 232 184 S 0.0 0.1 1:41 syslogd 383 root 0 0 396 0 0 SW 0.0 0.0 0:00 klogd 398 rpc 0 0 152 112 92 S 0.0 0.0 0:04 portmap 413 root 0 0 64 0 0 SW 0.0 0.0 0:00 apmd Regards, Daniel Tan 67469188 Ext.665 DID: 68430665 MIS Department Shop N Save Pte Ltd : danieltan@shopnsave.com.sg [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.] From dene at DATATECHIE.COM Wed Apr 2 04:57:59 2003 From: dene at DATATECHIE.COM (Dene Ulmschneider) Date: Thu Jan 12 21:17:40 2006 Subject: rogue messages in mail queue Message-ID: <5.1.0.14.2.20030401225752.00bb9ec8@192.168.1.112> Hi All- I recently started using MailScanner/SA/Razor2 and I must say that it ROCKS! It has reduced my spam by approximately 90 percent. I have noticed that since I implemented these tools I have been getting some mails stuck in my mail queue. The message info are similar to the snipit below... ~~snip~~ qfh3130Vj06415 Mon, 31 Mar 2003 22:00:31 -0500 "MailScanner" diet@xlphost.com 846 b Deferred: Connection timed out with mx3.xlprohosting.com. ~~end snip~~ I get about 5 or 6 a day that I delete manually. Can anyone explain why these are getting stuck in the queue and possibly offer a fix for this issue? Thank You Dene Ulmschneider Data Techie Inc. ------------------------------------------------------------------------- office: 718.738.8859 cell: 646.996.2976 email: dene@datatechie.com pager mail: denenow@datatechie.com website: www.datatechie.com ------------------------------------------------------------------------- "Life is too short...-...you should have dessert first" -- This message has been scanned for viruses and dangerous content by Data Techie, and is believed to be clean. Data Techie... always there to protect you! http://www.datatechie.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030401/7b42bb33/attachment.html From raymond at PROLOCATION.NET Wed Apr 2 06:53:03 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:40 2006 Subject: rogue messages in mail queue In-Reply-To: <5.1.0.14.2.20030401225752.00bb9ec8@192.168.1.112> Message-ID: Hi! > I recently started using MailScanner/SA/Razor2 and I must say that it > ROCKS! It has reduced my spam by approximately 90 percent. I have noticed > that since I implemented these tools I have been getting some mails stuck > in my mail queue. The message info are similar to the snipit below... > > ~~snip~~ > > qfh3130Vj06415 Mon, 31 Mar 2003 22:00:31 -0500 "MailScanner" > diet@xlphost.com 846 b Deferred: Connection > timed out with mx3.xlprohosting.com. > > ~~end snip~~ > > I get about 5 or 6 a day that I delete manually. Can anyone explain why > these are getting stuck in the queue and possibly offer a fix for this issue? Its retun responses, you dont need to delete those, your MTA will take care of this. Its normal. Bye, Raymond. From mike at CAMAROSS.NET Wed Apr 2 07:14:03 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:40 2006 Subject: I noticed this tonight... In-Reply-To: Message-ID: <006301c2f8df$108a74e0$af01a8c0@home.middlefinger.net> In the output of cron.daily, I saw this: Failed to create default user preference file //.spamassassin/user_prefs Is there a path somewhere not specified correctly? Mike From mike at CAMAROSS.NET Wed Apr 2 05:26:15 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:40 2006 Subject: rogue messages in mail queue In-Reply-To: <5.1.0.14.2.20030401225752.00bb9ec8@192.168.1.112> Message-ID: <005f01c2f8d0$00bd7ee0$af01a8c0@home.middlefinger.net> I get these from time to time and never worry about them. Depending on your spam actions (perhaps you are bouncing spam?)...it would make sense that an email to diet@xlphost.com might have delivery problems. Were they trying to sell you the most unbelievable diet in recent human history from a bogus email address? :) At any rate, the messages could stay in your queue and be deleted in 5 days (by default). I lowered mine to 2 days. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dene Ulmschneider Sent: Tuesday, April 01, 2003 9:58 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: rogue messages in mail queue Hi All- I recently started using MailScanner/SA/Razor2 and I must say that it ROCKS! It has reduced my spam by approximately 90 percent. I have noticed that since I implemented these tools I have been getting some mails stuck in my mail queue. The message info are similar to the snipit below... ~~snip~~ qfh3130Vj06415 Mon, 31 Mar 2003 22:00:31 -0500 "MailScanner" diet@xlphost.com 846 b Deferred: Connection timed out with mx3.xlprohosting.com. ~~end snip~~ I get about 5 or 6 a day that I delete manually. Can anyone explain why these are getting stuck in the queue and possibly offer a fix for this issue? Thank You Dene Ulmschneider Data Techie Inc. ------------------------------------------------------------------------- office: 718.738.8859 cell: 646.996.2976 email: dene@datatechie.com pager mail: denenow@datatechie.com website: www.datatechie.com ------------------------------------------------------------------------- "Life is too short...-...you should have dessert first" -- This message has been scanned for viruses and dangerous content by Data Techie, and is believed to be clean. Data Techie...always there to protect you! From S.R.Patterson at soton.ac.uk Wed Apr 2 08:37:49 2003 From: S.R.Patterson at soton.ac.uk (Steven Patterson) Date: Thu Jan 12 21:17:40 2006 Subject: startup with sendmail 8.12 .* In-Reply-To: <004001c2f8aa$ce615810$af01a8c0@home.middlefinger.net> References: <004001c2f8aa$ce615810$af01a8c0@home.middlefinger.net> Message-ID: On Apr 1, 2003 at 5:59pm Mike Kercher wrote: MK> Why do you *need* to move to 8.12? Just curious... Perhaps it's something to do with the root exploit for all versions of sendmail prior to 8.12.8? (which is not to say 8.12.8 doesn't have one - none found in 8.12.9 yet!) Steve -- Steven Patterson, MSci OCP. Tel: +44 (0)2380 595810 Primary Information Services Support and Development Information Systems Services, University of Southampton, UK. Public PGP Key: http://www.bottleneck.org/pubkey.php From mailscanner at ecs.soton.ac.uk Wed Apr 2 08:51:35 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:40 2006 Subject: F-Secure 4.50 not supported... In-Reply-To: <006f01c2f886$495839a0$8801020a@brianmay> Message-ID: <5.2.0.9.2.20030402084309.0226ba78@imap.ecs.soton.ac.uk> At 20:38 01/04/2003, you wrote: >If you are using F-Secure with MailScanner, version 4.5 will not work as the >output has changed, and the location to fsav has changed as well.. > >Also, the command line for the scan is similar, MailScanner doesn't seem to >pass the full path, just '.' and fsav seems to scan the computer, and not >the working directory... I tried updating the source, but I can't seem to >figure it out... I belive I got the SweepsVirus.pm file done... to match >the output, but I can;t seem to figure out how to pass the working >directory... Can you either email me a copy of the new version of F-Secure, or give me a URL where I can download it. Shouldn't take too long to adapt the output parser to the new version. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 2 08:48:35 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:40 2006 Subject: rogue messages in mail queue In-Reply-To: <5.1.0.14.2.20030401225752.00bb9ec8@192.168.1.112> Message-ID: <5.2.0.9.2.20030402084654.023a0c08@imap.ecs.soton.ac.uk> MailScanner is not involved in delivering mail or providing SMTP service. Sendmail is already very good at that. Your sendmail is trying to deliver messages to mx3.xlprohosting.com and the SMTP connection is timing out for some reason. The messages will stay in the queue until they can be delivered (or a week has passed) and sendmail/Exim will continue trying to deliver them during that period. At 04:57 02/04/2003, you wrote: >Hi All- >I recently started using MailScanner/SA/Razor2 and I must say that it >ROCKS! It has reduced my spam by approximately 90 percent. I have noticed >that since I implemented these tools I have been getting some mails stuck >in my mail queue. The message info are similar to the snipit below... > >~~snip~~ > >qfh3130Vj06415 Mon, 31 Mar 2003 22:00:31 -0500 "MailScanner" > diet@xlphost.com 846 b Deferred: Connection >timed out with mx3.xlprohosting.com. > >~~end snip~~ > >I get about 5 or 6 a day that I delete manually. Can anyone explain why >these are getting stuck in the queue and possibly offer a fix for this issue? > >Thank You > >Dene Ulmschneider >Data Techie Inc. >------------------------------------------------------------------------- >office: 718.738.8859 >cell: 646.996.2976 >email: dene@datatechie.com >pager mail: denenow@datatechie.com >website: www.datatechie.com >------------------------------------------------------------------------- >"Life is too short...-...you should have dessert first" >-- >This message has been scanned for viruses and >dangerous content by Data Techie, and is >believed to be clean. >Data Techie...always there to protect you! -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030402/a1a559a2/attachment.html From mailscanner at ecs.soton.ac.uk Wed Apr 2 08:50:24 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:40 2006 Subject: I noticed this tonight... In-Reply-To: <006301c2f8df$108a74e0$af01a8c0@home.middlefinger.net> References: Message-ID: <5.2.0.9.2.20030402084908.023ead88@imap.ecs.soton.ac.uk> At 07:14 02/04/2003, you wrote: >In the output of cron.daily, I saw this: > >Failed to create default user preference file //.spamassassin/user_prefs > >Is there a path somewhere not specified correctly? I would guess you are using Exim perhaps. It is trying to create a .spamassassin directory under "/" but does not have permission to do so. In your /etc/passwd file, have you specified the home directory of user "mail" to be "/"? If so, you need to make sure that user "mail" has a real home dir that it can write to. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 2 08:46:22 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:40 2006 Subject: mailscanner can't send mail? In-Reply-To: <005c01c2f8c0$60b0bd40$3900a8c0@Daniel> Message-ID: <5.2.0.9.2.20030402084548.0226e8b8@imap.ecs.soton.ac.uk> Please tell us what you are running OS + version MailScanner version SpamAssassin version virus scanner + version At 03:34 02/04/2003, you wrote: >did a top and found out my mailscanner has been trying to scan or send the >mail for so many hours....what is wrong with it? i still have 56 requests >stucj in mqueue.in. it seems like mailscanner is giving me a lot of problems > >10:33am up 5 days, 22:36, 2 users, load average: 1.98, 1.99, 1.93 >82 processes: 78 sleeping, 4 running, 0 zombie, 0 stopped >CPU states: 98.8% user, 1.1% system, 0.0% nice, 0.0% idle >Mem: 127760K av, 123352K used, 4408K free, 52580K shrd, 2704K >buff >Swap: 265032K av, 129084K used, 135948K free 38944K >cached > > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND >27832 root 12 0 17932 12 8 R 97.0 0.0 922:40 MailScanner >22416 root 1 0 1044 1044 816 R 0.5 0.8 0:00 top >15989 root 0 0 18768 11M 4412 S 0.3 9.0 0:19 MailScanner >16636 root 0 0 18632 10M 5660 S 0.3 8.1 0:16 MailScanner >16955 root 0 0 18120 9528 4740 S 0.3 7.4 0:13 MailScanner >17145 root 0 0 18808 10M 4248 S 0.3 8.7 0:14 MailScanner > 1 root 0 0 116 76 56 S 0.0 0.0 1:12 init > 2 root 0 0 0 0 0 SW 0.0 0.0 0:00 kflushd > 3 root 0 0 0 0 0 SW 0.0 0.0 0:01 kupdate > 4 root 0 0 0 0 0 SW 0.0 0.0 0:00 kpiod > 5 root 0 0 0 0 0 SW 0.0 0.0 0:18 kswapd > 6 root -20 -20 0 0 0 SW< 0.0 0.0 0:00 mdrecoveryd > 65 root 0 0 0 0 0 SW 0.0 0.0 0:00 khubd > 373 root 0 0 268 232 184 S 0.0 0.1 1:41 syslogd > 383 root 0 0 396 0 0 SW 0.0 0.0 0:00 klogd > 398 rpc 0 0 152 112 92 S 0.0 0.0 0:04 portmap > 413 root 0 0 64 0 0 SW 0.0 0.0 0:00 apmd > >Regards, >Daniel Tan >67469188 Ext.665 >DID: 68430665 >MIS Department >Shop N Save Pte Ltd >: danieltan@shopnsave.com.sg > >[This e-mail is confidential and may also be privileged. If you are not the >intended recipient, please delete it and notify us immediately; you should >not copy or use it for any purpose, nor disclose its contents to any other >person. Thank you.] -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Wed Apr 2 10:33:05 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:40 2006 Subject: startup with sendmail 8.12 .* In-Reply-To: Message-ID: Hi! > MK> Why do you *need* to move to 8.12? Just curious... > > Perhaps it's something to do with the root exploit for all versions of > sendmail prior to 8.12.8? (which is not to say 8.12.8 doesn't have one - > none found in 8.12.9 yet!) Most vendors came with fixes, also backported... Bye, Raymond. From mailscanner at ecs.soton.ac.uk Wed Apr 2 13:36:07 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:40 2006 Subject: F-Secure 4.50 not supported... In-Reply-To: <5.2.0.9.2.20030402084309.0226ba78@imap.ecs.soton.ac.uk> References: <006f01c2f886$495839a0$8801020a@brianmay> Message-ID: <5.2.0.9.2.20030402133441.025b9f50@imap.ecs.soton.ac.uk> At 08:51 02/04/2003, you wrote: >Can you either email me a copy of the new version of F-Secure, or give me a >URL where I can download it. Shouldn't take too long to adapt the output >parser to the new version. I now have the binary, but no licence key :-( If anyone is willing to share this with me (off the list) then I can personally guarantee that the key will never "leak" and it will be only used for development purposes. I have asked F-Secure for a licence key for this purpose, but no response yet. I sure hope they haven't forgotten that "." is the current directory... -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mike at CAMAROSS.NET Wed Apr 2 14:02:44 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:40 2006 Subject: I noticed this tonight... In-Reply-To: <5.2.0.9.2.20030402084908.023ead88@imap.ecs.soton.ac.uk> Message-ID: <006a01c2f918$27bb41b0$af01a8c0@home.middlefinger.net> I'm using sendmail and always have The user mail does have the correct ~ specified: mail:x:8:12:mail:/var/spool/mail:/sbin/nologin Any other ideas? Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Wednesday, April 02, 2003 1:50 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: I noticed this tonight... At 07:14 02/04/2003, you wrote: >In the output of cron.daily, I saw this: > >Failed to create default user preference file >//.spamassassin/user_prefs > >Is there a path somewhere not specified correctly? I would guess you are using Exim perhaps. It is trying to create a .spamassassin directory under "/" but does not have permission to do so. In your /etc/passwd file, have you specified the home directory of user "mail" to be "/"? If so, you need to make sure that user "mail" has a real home dir that it can write to. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From dot at DOTAT.AT Wed Apr 2 14:34:34 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:40 2006 Subject: I noticed this tonight... In-Reply-To: References: <5.2.0.9.2.20030402084908.023ead88@imap.ecs.soton.ac.uk> Message-ID: Mike Kercher wrote: > >Any other ideas? This patch prevents SpamAssassin from copying the user preferences file template into ~/.spamassassin --- lib/MailScanner/SA.pm 27 Mar 2003 16:55:18 -0000 1.1.1.4 +++ lib/MailScanner/SA.pm 27 Mar 2003 17:28:47 -0000 1.8 @@ -73,7 +74,7 @@ unless (MailScanner::Config::IsSimpleValue('usespamassassin') && !MailScanner::Config::Value('usespamassassin')) { require Mail::SpamAssassin; - $settings{dont_copy_prefs} = 0; + $settings{dont_copy_prefs} = 1; $prefs = MailScanner::Config::Value('spamassassinprefsfile'); $settings{userprefs_filename} = $prefs if defined $prefs; $val = MailScanner::Config::Value('debugspamassassin'); Tony. -- f.a.n.finch http://dotat.at/ WHITBY TO THE WASH: NORTHWEST 7, DECREASING 4 OR 5. SHOWERS, GRADUALLY DYING OUT. GOOD, BUT MODERATE IN SHOWERS. ROUGH. From danieltan at shopnsave.com.sg Thu Apr 3 03:28:24 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:40 2006 Subject: mailscanner can't send mail? References: <5.2.0.9.2.20030402084548.0226e8b8@imap.ecs.soton.ac.uk> Message-ID: <00ab01c2f988$b4f7c380$3900a8c0@Daniel> found this on mailscanner website..... i think i need to upgrade to overcome the problem right? Problems with SpamAssassin 2.50 There are problems with MailScanner and SpamAssassin 2.50. The solution is to use the CVS code for SpamAssassin 2.60. If SpamAssassin 2.51 has been released by the time you read this, then use 2.51 instead. The problems cannot cause any of your mail to be lost, but it may lock up your MailScanner, stopping processing of any mail. ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, April 02, 2003 3:46 PM Subject: Re: mailscanner can't send mail? Please tell us what you are running OS + version MailScanner version SpamAssassin version virus scanner + version At 03:34 02/04/2003, you wrote: >did a top and found out my mailscanner has been trying to scan or send the >mail for so many hours....what is wrong with it? i still have 56 requests >stucj in mqueue.in. it seems like mailscanner is giving me a lot of problems > >10:33am up 5 days, 22:36, 2 users, load average: 1.98, 1.99, 1.93 >82 processes: 78 sleeping, 4 running, 0 zombie, 0 stopped >CPU states: 98.8% user, 1.1% system, 0.0% nice, 0.0% idle >Mem: 127760K av, 123352K used, 4408K free, 52580K shrd, 2704K >buff >Swap: 265032K av, 129084K used, 135948K free 38944K >cached > > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND >27832 root 12 0 17932 12 8 R 97.0 0.0 922:40 MailScanner >22416 root 1 0 1044 1044 816 R 0.5 0.8 0:00 top >15989 root 0 0 18768 11M 4412 S 0.3 9.0 0:19 MailScanner >16636 root 0 0 18632 10M 5660 S 0.3 8.1 0:16 MailScanner >16955 root 0 0 18120 9528 4740 S 0.3 7.4 0:13 MailScanner >17145 root 0 0 18808 10M 4248 S 0.3 8.7 0:14 MailScanner > 1 root 0 0 116 76 56 S 0.0 0.0 1:12 init > 2 root 0 0 0 0 0 SW 0.0 0.0 0:00 kflushd > 3 root 0 0 0 0 0 SW 0.0 0.0 0:01 kupdate > 4 root 0 0 0 0 0 SW 0.0 0.0 0:00 kpiod > 5 root 0 0 0 0 0 SW 0.0 0.0 0:18 kswapd > 6 root -20 -20 0 0 0 SW< 0.0 0.0 0:00 mdrecoveryd > 65 root 0 0 0 0 0 SW 0.0 0.0 0:00 khubd > 373 root 0 0 268 232 184 S 0.0 0.1 1:41 syslogd > 383 root 0 0 396 0 0 SW 0.0 0.0 0:00 klogd > 398 rpc 0 0 152 112 92 S 0.0 0.0 0:04 portmap > 413 root 0 0 64 0 0 SW 0.0 0.0 0:00 apmd > >Regards, >Daniel Tan >67469188 Ext.665 >DID: 68430665 >MIS Department >Shop N Save Pte Ltd >: danieltan@shopnsave.com.sg > >[This e-mail is confidential and may also be privileged. If you are not the >intended recipient, please delete it and notify us immediately; you should >not copy or use it for any purpose, nor disclose its contents to any other >person. Thank you.] -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From danieltan at shopnsave.com.sg Thu Apr 3 02:23:40 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:40 2006 Subject: mailscanner can't send mail? References: <5.2.0.9.2.20030402084548.0226e8b8@imap.ecs.soton.ac.uk> Message-ID: <006a01c2f97f$a93b6500$3900a8c0@Daniel> forgot to attach the mqueue.in /var/spool/mqueue.in (1 request) ----Q-ID---- --Size-- -----Q-Time----- ------------Sender/Recipient--------- --- h32DJVH25446* 172 Wed Apr 2 21:19 ----------------------->suspect this address is causing the thing, as this is not a public domain and used for internal only ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, April 02, 2003 3:46 PM Subject: Re: mailscanner can't send mail? Please tell us what you are running OS + version MailScanner version SpamAssassin version virus scanner + version At 03:34 02/04/2003, you wrote: >did a top and found out my mailscanner has been trying to scan or send the >mail for so many hours....what is wrong with it? i still have 56 requests >stucj in mqueue.in. it seems like mailscanner is giving me a lot of problems > >10:33am up 5 days, 22:36, 2 users, load average: 1.98, 1.99, 1.93 >82 processes: 78 sleeping, 4 running, 0 zombie, 0 stopped >CPU states: 98.8% user, 1.1% system, 0.0% nice, 0.0% idle >Mem: 127760K av, 123352K used, 4408K free, 52580K shrd, 2704K >buff >Swap: 265032K av, 129084K used, 135948K free 38944K >cached > > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND >27832 root 12 0 17932 12 8 R 97.0 0.0 922:40 MailScanner >22416 root 1 0 1044 1044 816 R 0.5 0.8 0:00 top >15989 root 0 0 18768 11M 4412 S 0.3 9.0 0:19 MailScanner >16636 root 0 0 18632 10M 5660 S 0.3 8.1 0:16 MailScanner >16955 root 0 0 18120 9528 4740 S 0.3 7.4 0:13 MailScanner >17145 root 0 0 18808 10M 4248 S 0.3 8.7 0:14 MailScanner > 1 root 0 0 116 76 56 S 0.0 0.0 1:12 init > 2 root 0 0 0 0 0 SW 0.0 0.0 0:00 kflushd > 3 root 0 0 0 0 0 SW 0.0 0.0 0:01 kupdate > 4 root 0 0 0 0 0 SW 0.0 0.0 0:00 kpiod > 5 root 0 0 0 0 0 SW 0.0 0.0 0:18 kswapd > 6 root -20 -20 0 0 0 SW< 0.0 0.0 0:00 mdrecoveryd > 65 root 0 0 0 0 0 SW 0.0 0.0 0:00 khubd > 373 root 0 0 268 232 184 S 0.0 0.1 1:41 syslogd > 383 root 0 0 396 0 0 SW 0.0 0.0 0:00 klogd > 398 rpc 0 0 152 112 92 S 0.0 0.0 0:04 portmap > 413 root 0 0 64 0 0 SW 0.0 0.0 0:00 apmd > >Regards, >Daniel Tan >67469188 Ext.665 >DID: 68430665 >MIS Department >Shop N Save Pte Ltd >: danieltan@shopnsave.com.sg > >[This e-mail is confidential and may also be privileged. If you are not the >intended recipient, please delete it and notify us immediately; you should >not copy or use it for any purpose, nor disclose its contents to any other >person. Thank you.] -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From joan.bryan at KCL.AC.UK Thu Apr 3 09:58:48 2003 From: joan.bryan at KCL.AC.UK (Joan Bryan) Date: Thu Jan 12 21:17:40 2006 Subject: Mailscanner and Multiple output queues In-Reply-To: <003301c2f961$c58050e0$af01a8c0@home.middlefinger.net> References: <003301c2f961$c58050e0$af01a8c0@home.middlefinger.net> <5.2.0.9.2.20030321121546.0467e008@imap.ecs.soton.ac.uk> Message-ID: On Wed, 2 Apr 2003 15:49:41 -0600 Mike Kercher wrote: > Following up on this...do you still have to tell sendmail about the > additional queues? > Yes. The following information is courtesy of David http://www.sendmail.org/~gshapiro/8.10.Training/mqueue.html (which is very basic) http://www.sendmail.org/~ca/email/doc8.12/cf/m4/queue_groups.html (is your better bet along with the stated documentation bits). > > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Julian Field > Sent: Friday, March 21, 2003 6:18 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Mailscanner and Multiple output queues > > > At 11:51 21/03/2003, you wrote: > >We are considering implementing mutliple output queues to try to > >improve performance on our mailserver and I wonder if anyone could give > >me an idea of a ruleset for this. Ideally we would like mailscanner to > >write to one of a set of output queues, distributing mail roughly > >evenly across these directories. > > Outgoing Queue Dir = /etc/MailScanner/rules/outgoing.queue.rules > > and then in that file: > From: /^[a-g]/ /var/spool/mqueue1 > From: /^[h-m]/ /var/spool/mqueue2 > From: /^[n-s]/ /var/spool/mqueue3 > From: /^[t-z]/ /var/spool/mqueue4 > FromOrTo: default /var/spool/mqueue5 > > This just splits into 5 queues based on the first letter of the sender's > address. Hopefully that gives you enough of an idea of what you can do... > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support ---------------------- Joan Bryan joan.bryan@kcl.ac.uk From mike at CAMAROSS.NET Wed Apr 2 22:49:41 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:40 2006 Subject: Mailscanner and Multiple output queues In-Reply-To: <5.2.0.9.2.20030321121546.0467e008@imap.ecs.soton.ac.uk> Message-ID: <003301c2f961$c58050e0$af01a8c0@home.middlefinger.net> Following up on this...do you still have to tell sendmail about the additional queues? Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Friday, March 21, 2003 6:18 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Mailscanner and Multiple output queues At 11:51 21/03/2003, you wrote: >We are considering implementing mutliple output queues to try to >improve performance on our mailserver and I wonder if anyone could give >me an idea of a ruleset for this. Ideally we would like mailscanner to >write to one of a set of output queues, distributing mail roughly >evenly across these directories. Outgoing Queue Dir = /etc/MailScanner/rules/outgoing.queue.rules and then in that file: From: /^[a-g]/ /var/spool/mqueue1 From: /^[h-m]/ /var/spool/mqueue2 From: /^[n-s]/ /var/spool/mqueue3 From: /^[t-z]/ /var/spool/mqueue4 FromOrTo: default /var/spool/mqueue5 This just splits into 5 queues based on the first letter of the sender's address. Hopefully that gives you enough of an idea of what you can do... -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From baldguy33165 at yahoo.com Wed Apr 2 22:30:35 2003 From: baldguy33165 at yahoo.com (Juan Quesada) Date: Thu Jan 12 21:17:40 2006 Subject: SPAM? option just for one user Message-ID: <20030402213035.36534.qmail@web20806.mail.yahoo.com> I want to allow just one user to get the spam? modified subject. How can i accomplish this. __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com From mbowman at UDCOM.COM Wed Apr 2 22:29:00 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:40 2006 Subject: SPAM? option just for one user Message-ID: Hello, If you only wanted one user from a domain to get spam tagged e-mail and all others deleted for example you must modify MailScanner.conf Spam Actions = /etc/MailScanner/spam.actions.conf Create a file called spam.actions.conf and inside have these 2 lines To: user@domain.com deliver To: default delete Save the file and restart MailScanner Also take a few minutes to read the README files under rules/ they helped me a great deal. Regards, -- Matthew K Bowman Systems Administrator, Universal Digital Communications. 174 Park Avenue West, Mansfield. Ohio 44902 Tel : 419-524-4330 Fax : 419-524-0049 Email : mbowman@udcom.com Web: http://www.udcom.com/ Juan Quesada Sent by: MailScanner mailing list 04/02/2003 04:30 PM Please respond to MailScanner mailing list To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: SPAM? option just for one user I want to allow just one user to get the spam? modified subject. How can i accomplish this. __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com From Kevin.Spicer at BMRB.CO.UK Thu Apr 3 10:32:09 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:40 2006 Subject: whitelists Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF4F0@pascal.priv.bmrb.co.uk> > Hi all, > > I have a really strange problem with the whitelists, normally from a > certain travel company they send email all in caps, I have in the > whitelist this labeled as: > > From: *@COMPANY.COM yes > From: *@company.com yes > > also the whole address... user etc... sometimes it works sometimes it > doesn't... after checking quarantine I see that the messages > aren't even > marked (whitelisted) when I do a test by telneting to port 25 > and writing > a mail by hand I do see in the header of this mail that it is > whitelisted. Maybe there is a difference between the envelope address of the sender and the address in the headers, IIRC MailScanner looks at the envelope sender. Have you checked to see if your mail logs are showing any other addresses? BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From andersjk at SOL-INVICTUS.ORG Thu Apr 3 10:34:22 2003 From: andersjk at SOL-INVICTUS.ORG (Kevin Anderson) Date: Thu Jan 12 21:17:40 2006 Subject: whitelists Message-ID: Hi all, I have a really strange problem with the whitelists, normally from a certain travel company they send email all in caps, I have in the whitelist this labeled as: From: *@COMPANY.COM yes From: *@company.com yes also the whole address... user etc... sometimes it works sometimes it doesn't... after checking quarantine I see that the messages aren't even marked (whitelisted) when I do a test by telneting to port 25 and writing a mail by hand I do see in the header of this mail that it is whitelisted. Anyone else have problems with this??? Is there maybe on a busy server, we block daily around 1700 spam mails, that there is a chance it doesn't check the whitelist? thanks in advance, kevin anderson -- @ _____________________________________________ chaos, panic and disorder... my job is done... From andersjk at SOL-INVICTUS.ORG Thu Apr 3 10:53:10 2003 From: andersjk at SOL-INVICTUS.ORG (Kevin Anderson) Date: Thu Jan 12 21:17:40 2006 Subject: whitelists In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF4F0@pascal.priv.bmrb.co.uk> Message-ID: Ok, I thought it just looked at the From: I added the other as well... thanks for the tip! kevin On Thu, 3 Apr 2003, Spicer, Kevin wrote: > > Hi all, > > > > I have a really strange problem with the whitelists, normally from a > > certain travel company they send email all in caps, I have in the > > whitelist this labeled as: > > > > From: *@COMPANY.COM yes > > From: *@company.com yes > > > > also the whole address... user etc... sometimes it works sometimes it > > doesn't... after checking quarantine I see that the messages > > aren't even > > marked (whitelisted) when I do a test by telneting to port 25 > > and writing > > a mail by hand I do see in the header of this mail that it is > > whitelisted. > > Maybe there is a difference between the envelope address of the sender and the address in the headers, IIRC MailScanner looks at the envelope sender. Have you checked to see if your mail logs are showing any other addresses? > > > > BMRB International > http://www.bmrb.co.uk > +44 (0)20 8566 5000 > _________________________________________________________________ > This message (and any attachment) is intended only for the > recipient and may contain confidential and/or privileged > material. If you have received this in error, please contact the > sender and delete this message immediately. Disclosure, copying > or other action taken in respect of this email or in > reliance on it is prohibited. BMRB International Limited > accepts no liability in relation to any personal emails, or > content of any email which does not directly relate to our > business. > -- @ _____________________________________________ chaos, panic and disorder... my job is done... From brett.thomson at PRINTSOFT.COM Thu Apr 3 11:06:28 2003 From: brett.thomson at PRINTSOFT.COM (Brett Thomson) Date: Thu Jan 12 21:17:40 2006 Subject: SpamAssassin timed out and was killed, Message-ID: <1049364388.3e8c07a464fd6@mail.printsoft.com> Hi All, I have search and searched and have not been able able to find any information on this error message or anything on how to fix it. .....SpamAssassin timed out and was killed,..... I am running MailScanner version 4.13-3 and SpamAssassin version 2.52 Could anyone tell me how to do the following 1. Turn up the logging to achive better logging of SpamAssassin errors in syslog 2. What this error might be and point me in the direction of where to start looking. Many Thanks Brett. From combs at magnet.fsu.edu Thu Apr 3 15:21:27 2003 From: combs at magnet.fsu.edu (Tom Combs) Date: Thu Jan 12 21:17:40 2006 Subject: startup with sendmail 8.12 .* Message-ID: <200304031421.h33ELRda012959@osprey.magnet.fsu.edu> Yes, I should have used *want* instead of *need*. I have patched my 8.11.6 releases but I like to stay some what current with the sendmail releases after I'm sure they are stable. 8.12.* is a different beast and I'd like to make the change. --Tom > >Why do you *need* to move to 8.12? Just curious... > > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >Of Tom Combs >Sent: Tuesday, April 01, 2003 4:04 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: startup with sendmail 8.12 .* > > >Hello, > > I'd need to move from sendmail 8.11.6 to sendmail 8.12.9. I'm not > clear how I need to start sendmail/mailscanner under the new smmsp set up. > Would someone be so kind as to send me their init.d/sendmail script > so I can see what needs to be done. TIA! --Tom Combs -- Tom Combs E-mail: combs@magnet.fsu.edu National High Magnetic Field Laboratory Phone: (850) 644-1657 1800 E. Paul Dirac Drive Tallahassee, FL 32310 From sylvain.phaneuf at IMSU.OXFORD.AC.UK Thu Apr 3 15:44:52 2003 From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf) Date: Thu Jan 12 21:17:40 2006 Subject: clever s p a m Message-ID: Hi everyone, We have come across some spam html messages that contain some meaningless tags that break up keywords like v i a g r a. As mailscanner/spamassassin must look at the mime message, and not the decoded html part, these messages do not trigger big scores and are not blocked. Is there a way these could be blocked? see example below my signature Sylvain =========================================================== Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 Information Management Services Unit - Medical Sciences Division Oxford University | email : sylvain.phaneuf@imsu.ox.ac.uk Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 Oxford OX3 9DU England ===========================================================
Generic Viagra is now available to consumers
As low as $2.70 per dose (50 mg)
No Doctor's Consutation required
"Silagra is as good as Viagra - just cheaper!"
Costs over 65% less than Brand Name
(Generic Sildenafil Citrate (Silagra)
and Viagra. both consist of 100 mg of
sildenafil citrate)
Private delivery to your home within 14 working days
of payment verification - FREE SHIPPING
100% Money Back Guarantee - The First
Pharmaceutical to ever be guaranteed.


From brian at UNEARTHED.ORG Thu Apr 3 15:46:11 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:40 2006 Subject: F-Secure 4.50 not supported... In-Reply-To: <5.2.0.9.2.20030402133441.025b9f50@imap.ecs.soton.ac.uk> Message-ID: <03271286-65E3-11D7-88DD-000A9579E1DA@unearthed.org> Any word yet from F-Secure? Also, any emails to you are stopping at the server... maybe that is the reason? ----- The following addresses had transient non-fatal errors ----- jkf@roadrunner (expanded from: jkf) ----- Transcript of session follows ----- jkf@roadrunner... Deferred: Connection refused by roadrunner.ecs.soton.ac.uk. Warning: message still undelivered after 3 hours Will keep trying until message is 1 week old Reporting-MTA: dns; magpie.ecs.soton.ac.uk Arrival-Date: Wed, 2 Apr 2003 22:48:30 +0100 (BST) Final-Recipient: RFC822; jkf@magpie.ecs.soton.ac.uk X-Actual-Recipient: RFC822; jkf@ecs.soton.ac.uk Action: delayed Status: 4.4.1 Remote-MTA: DNS; roadrunner.ecs.soton.ac.uk Last-Attempt-Date: Thu, 3 Apr 2003 01:56:58 +0100 (BST) Will-Retry-Until: Wed, 9 Apr 2003 22:48:30 +0100 (BST) From henker at SHCOM.US Thu Apr 3 16:33:27 2003 From: henker at SHCOM.US (Steffan Henke) Date: Thu Jan 12 21:17:41 2006 Subject: clever s p a m In-Reply-To: References: Message-ID: On Thu, 3 Apr 2003, Sylvain Phaneuf wrote: > We have come across some spam html messages that contain some > meaningless tags that break up keywords like v i a g r a. As > Is there a way these could be blocked? see example below my signature For my own personal email, I use the python spambayes module like this: spam marked by SpamAssassin and/or junkfilter gets into a junkmail folder and every few hours, a cronjob processes this folder and "trains" the spambayes database so it "learns" what is spam and what isn't. Additionally, a procmail recipe checks for these spam headers the next time mail comes in. It works quite well, even for those "clever words". You may want to have a look at http://www.entrian.com/spambayes/ I haven't used the SpamAssassin bayes feature yet to achieve something like this globally. Regards, Steffan From jase at SENSIS.COM Thu Apr 3 16:39:54 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:41 2006 Subject: SpamAssassin timed out and was killed, Message-ID: I have had lots of SpamAssassin timeouts since upgrading to version 2.52. I had to disable bayes for things to work again. In spam.assassin.prefs.conf, I put use_bayes 0 auto_learn 0 You can try it too and see if that helps. For me, I have to wait until I get my new mail server in which can handle the increased load of bayes filtering. Jason > -----Original Message----- > From: Brett Thomson [mailto:brett.thomson@PRINTSOFT.COM] > Sent: Thursday, April 03, 2003 5:06 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [MAILSCANNER] SpamAssassin timed out and was killed, > > > Hi All, > > I have search and searched and have not been able able to > find any information > on this error message or anything on how to fix it. > > .....SpamAssassin timed out and was killed,..... > > I am running MailScanner version 4.13-3 and SpamAssassin version 2.52 > > Could anyone tell me how to do the following > 1. Turn up the logging to achive better logging of > SpamAssassin errors in syslog > 2. What this error might be and point me in the direction of > where to start > looking. > > Many Thanks > Brett. > From mbowman at UDCOM.COM Thu Apr 3 16:35:50 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:41 2006 Subject: what exactly does the blacklist do? Message-ID: Jody, Yes - It tags all entries in there with {SPAM?} and AFAIK doesn't bounce messages. Regards, -- Matthew K Bowman Systems Administrator, Universal Digital Communications. 174 Park Avenue West, Mansfield. Ohio 44902 Tel : 419-524-4330 Fax : 419-524-0049 Email : mbowman@udcom.com Web: http://www.udcom.com/ Jody Cleveland Sent by: MailScanner mailing list 04/03/2003 10:04 AM Please respond to MailScanner mailing list To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: what exactly does the blacklist do? Hello all, I'm just curious, what exactly does the blacklist do? Does it mark email from addresses in there with {SPAM?} no matter what? Or, does it bounce the message? -- Jody Cleveland (cleveland@winnefox.org) Winnefox Library System Computer Support Specialist From nathan at TCPNETWORKS.NET Thu Apr 3 19:43:40 2003 From: nathan at TCPNETWORKS.NET (Nathan Johanson) Date: Thu Jan 12 21:17:41 2006 Subject: Forward Spam Action Clarification Message-ID: Hello, I am getting ready to implement a spam actions ruleset: I have the following in /etc/MailScanner/rules/spam.actions.rules To: *@domain.com forward spam@domain.com I understand this and have tested it with success. Messages marked as spam are forwarded to the appropriate email address (and that' it). The message doesn't appear to be archived, sent to the original recipient, or anything more. However, I noticed that a few people have implemented the same rule but appended the delete action after the forwarding email address, like so: To: *@domain.com forward spam@domain.com delete Based on my testing, there doesn't seem to be a difference between these two rules. In other words, once it's forwarded, it's implicity deleted from the queue and appending delete as a second action doesn't seem to matter. Is this correct? Nathan From Cleveland at MAIL.WINNEFOX.ORG Thu Apr 3 16:04:35 2003 From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland) Date: Thu Jan 12 21:17:41 2006 Subject: what exactly does the blacklist do? Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4E5DC@MAIL> Hello all, I'm just curious, what exactly does the blacklist do? Does it mark email from addresses in there with {SPAM?} no matter what? Or, does it bounce the message? -- Jody Cleveland (cleveland@winnefox.org) Winnefox Library System Computer Support Specialist From baldguy33165 at YAHOO.COM Thu Apr 3 19:44:58 2003 From: baldguy33165 at YAHOO.COM (Juan Quesada) Date: Thu Jan 12 21:17:41 2006 Subject: Forward Spam Action Clarification In-Reply-To: Message-ID: <20030403184458.76663.qmail@web20803.mail.yahoo.com> I have noticed the same thing --- Nathan Johanson wrote: > Hello, > > I am getting ready to implement a spam actions > ruleset: > > I have the following in > /etc/MailScanner/rules/spam.actions.rules > > To: *@domain.com forward spam@domain.com > > I understand this and have tested it with success. > Messages marked as > spam are forwarded to the appropriate email address > (and that' it). The > message doesn't appear to be archived, sent to the > original recipient, > or anything more. > > However, I noticed that a few people have > implemented the same rule but > appended the delete action after the forwarding > email address, like so: > > To: *@domain.com forward spam@domain.com > delete > > Based on my testing, there doesn't seem to be a > difference between these > two rules. In other words, once it's forwarded, it's > implicity deleted > from the queue and appending delete as a second > action doesn't seem to > matter. Is this correct? > > Nathan __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com From mailscanner at ecs.soton.ac.uk Thu Apr 3 19:49:36 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: what exactly does the blacklist do? In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4E5DC@MAIL> Message-ID: <5.2.0.9.2.20030403194850.02622758@imap.ecs.soton.ac.uk> At 16:04 03/04/2003, you wrote: >Hello all, > >I'm just curious, what exactly does the blacklist do? > >Does it mark email from addresses in there with {SPAM?} no matter what? > >Or, does it bounce the message? It just forces mail from/to those addresses to be treated as spam according to your "Spam Actions" setting. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From dlovelace at HOTELS.COM Thu Apr 3 20:00:53 2003 From: dlovelace at HOTELS.COM (Dale Lovelace) Date: Thu Jan 12 21:17:41 2006 Subject: "Delete As Spam" button for Exchange Message-ID: <20030403130053.6e364e6a.dlovelace@hotels.com> Hi, I am trying to implement a "Delete As Spam" button in VBScript for Outlook/Exchange that would allow a user to delete a mail they considered spam from their Inbox, then forward it to a special email address that I will use to then feed to SpamAssassin's new bayesian learning. Before I got started I thought I would ask if anyone had done anything like that before, or if anyone knows of a script archive somewhere that might have something along these lines. I haven't done any VBScripting ever, so any tips at all would be great! I'll be sure to release whatever I do come up with to the world! Thanks, Dale -- Dale Lovelace System Administrator hotels.com (214) 361-7311 Ext. 1074 From jase at SENSIS.COM Thu Apr 3 20:19:24 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:41 2006 Subject: "Delete As Spam" button for Exchange Message-ID: Hi Dale. Unfortunately we use Outlook / Exchange here too. :-) I have written a script that will connect to an IMAP mailbox and pull all of the messages out and feed them to sa-learn. In Exchange, we created two folders (Spam and Not Spam) in the Public Folders area. The script I wrote is in perl and uses Mail::Cclient to access the IMAP folders. When everything is complete, we will just have the users drag and drop their spam (and ham if needed) into these folders, and our script run from cron will feed them to sa-learn. I chose this method because Outlook can only forward email (not bounce). And forwarding email would change the it a little bit, which may impact the bayes filters. Currently I have had to turn off bayes checking as it puts too much of a load on my server, so I haven't fully tested it out. But I should be getting new hardware next week. When I am done with the script, I will post it to the list. You can email me off list if you'd like a preliminary version. Jason > -----Original Message----- > From: Dale Lovelace [mailto:dlovelace@HOTELS.COM] > Sent: Thursday, April 03, 2003 2:01 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [MAILSCANNER] "Delete As Spam" button for Exchange > > > Hi, > > I am trying to implement a "Delete As Spam" button in > VBScript for Outlook/Exchange that would allow a user to > delete a mail they considered spam from their Inbox, then > forward it to a special email address that I will use to then > feed to SpamAssassin's new bayesian learning. Before I got > started I thought I would ask if anyone had done anything > like that before, or if anyone knows of a script archive > somewhere that might have something along these lines. I > haven't done any VBScripting ever, so any tips at all would > be great! I'll be sure to release whatever I do come up with > to the world! > > Thanks, > Dale > > -- > Dale Lovelace > System Administrator > hotels.com > (214) 361-7311 Ext. 1074 > From nicholas_esborn at AFFYMETRIX.COM Thu Apr 3 20:28:15 2003 From: nicholas_esborn at AFFYMETRIX.COM (Nicholas Esborn) Date: Thu Jan 12 21:17:41 2006 Subject: Exchange/Outlook client configuration Message-ID: <20030403192815.GB608@affymetrix.com> Hello, I'm working on a MailScanner deployment for my (primarily Outlook) user base. The biggest problem I have yet encountered is how to configure Outlook. I've found a successful Rules Wizard configuration, but that method is difficult to implement for ~800 users. How have other MailScanner sites with Outlook clients handled this problem? -nick -- Nicholas Esborn Affymetrix, Inc. 510/428.8505 Every message PGP signed -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 187 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030403/726aa75a/attachment.bin From mkettler at EVI-INC.COM Thu Apr 3 20:28:41 2003 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:17:41 2006 Subject: clever s p a m In-Reply-To: Message-ID: <5.2.0.9.0.20030403135958.0179d108@xanadu.evi-inc.com> You didn't state what version of SA you are using, however current versions of SA should at least catch most cases of this stuff as OBFUSCATING_COMMENT. It does appear however that multi-part messages (ie: ones that aren't HTML only) are exempt from the OBFUSCATING_COMMENT rule for the time being due to FPs in text-plain mime parts. All rules (except rawbody ones) should be matched after HTML tags and mime decoding is done, however last I checked there was still some clean-up of the HTML parsing going on. Some malformed/invalid HTML tags weren't being stripped because they confused the parser. I'm not sure if all/most of these are fixed in 2.52 or not, but I know there was a heavy push to get some HTML parsing issues fixed before 2.50 was out. Also you should note that in 2.5x the viagra rules have changed, and this message here shouldn't fire on them (they now look for phrase combinations such as herbal or natural varieties, all caps, or viagra in the subject.) There's a lot of talk over on SA-Talk regarding some of the not-so-new tricks of using HTML comments, and punctuation marks to obfuscate phrases, and there should be a fair amount of development writing newer, better rules for these soon (2.5x was really pushing to get bayes out, so wasn't very rule-development heavy). At 03:44 PM 4/3/2003 +0100, Sylvain Phaneuf wrote: >Hi everyone, > >We have come across some spam html messages that contain some meaningless >tags that break up keywords like v i a g r a. > >As mailscanner/spamassassin must look at the mime message, and not the >decoded html part, these messages do not trigger big scores and are not >blocked. > >Is there a way these could be blocked? see example below my signature > >Sylvain >=========================================================== >Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 >Information Management Services Unit - Medical Sciences Division >Oxford University | email : >sylvain.phaneuf@imsu.ox.ac.uk >Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 >Oxford OX3 9DU England >=========================================================== > > >Generic Viagra is now available to consumers >As low as $2.70 per dose (50 mg) >No Doctor's Consutation required >"Silagra is as good as Viagra - just cheaper!" >Costs over 65% less than Brand Name >(Generic Sildenafil Citrate (Silagra) >and Viagra. both consist of 100 mg of >sildenafil citrate) >Private delivery to your home within 14 working days >of payment verification - FREE SHIPPING >100% Money Back Guarantee - The First >Pharmaceutical to ever be guaranteed. > From kevins at BMRB.CO.UK Thu Apr 3 20:35:43 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:41 2006 Subject: "Delete As Spam" button for Exchange In-Reply-To: <20030403130053.6e364e6a.dlovelace@hotels.com> References: <20030403130053.6e364e6a.dlovelace@hotels.com> Message-ID: <1049398544.5103.16.camel@bach.kevinspicer.co.uk> On Thu, 2003-04-03 at 20:00, Dale Lovelace wrote: > Hi, > > I am trying to implement a "Delete As Spam" button in VBScript for > Outlook/Exchange that would allow a user to delete a mail they > considered spam from their Inbox, then forward it to a special email > address that I will use to then feed to SpamAssassin's new bayesian > learning. Before I got started I thought I would ask if anyone had > done anything like that before, or if anyone knows of a script archive > somewhere that might have something along these lines. I haven't done > any VBScripting ever, so any tips at all would be great! I'll be sure > to release whatever I do come up with to the world! > I haven't tried anything quite like this, but I do have a plan for dealing with this once I upgrade SA. I wanted to avoid using 'forward' because this slightly changes the content and replaces the headers. Here's my idea... 1) Create an exchange account for the MailScanner 2) Create two public folders, one called Spam, one called NotSpam. These folders are owned by the MailScanner user created above, writable by everyone, but not readable by anyone other than the MailScanner user (to protect users privacy). 3) Use fetchmail on the MailScanner machine to collect and delete messages from the two public folders (using IMAP) and push them to corresponding mail accounts on the MailScanner machine. 4) Use Julian's script to process the messages through salearn. I've tested the public folders bit and it works [its slightly disconcerting that you can't see the messages you've copied in there, but it works and the messages are unaltered]. I've not tested the fetchmail bit, but I'm confident it will work (I already access exchange through IMAP from evolution so I know that's okay). BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From jase at SENSIS.COM Thu Apr 3 20:39:41 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:41 2006 Subject: ANNOUNCE: MailScanner Monitor (msmon) 0.05 Message-ID: Hello. I have attached a simple program that I created that will monitor the output of MailScanner logs. It is a real time monitor, and will give the status of each MailScanner process. It is written in perl and uses the Gtk perl module. I originally wrote it to get a better idea of what MailScanner was doing, since watching the log file got too complicated with multiple processes. Changes since version 0.03: * Everything done in perl now - no external commands are run * Added ability to catch when MailScanner restarts for MailScanner >= 4.13 (I have not been able to test this yet, as I am still running MailScanner 4.12-2) * Added ability to have multiple rows - just specify the max number of columns, and msmon will add rows as needed * Added Total "Other Checks" for each process * Added Longest Wait Time for messages in the queue * Some better error messages msmon works for my MailScanner setup (Exim, Debian (Woody), MailScanner 4.12). You should be able to get it to work with your setup with some minor changes to variables at the top of the script (please check them before running the script). I hope someone else may find this useful. Contributions and comments are welcome. Jason -------------- next part -------------- A non-text attachment was scrubbed... Name: msmon.pl Type: application/octet-stream Size: 10706 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030403/d043a261/msmon.obj From craig at STRONG-BOX.NET Thu Apr 3 20:46:37 2003 From: craig at STRONG-BOX.NET (Craig Pratt) Date: Thu Jan 12 21:17:41 2006 Subject: Exchange/Outlook client configuration In-Reply-To: <20030403192815.GB608@affymetrix.com> Message-ID: On Thursday, April 3, 2003, at 11:28 AM, Nicholas Esborn wrote: > Hello, > > I'm working on a MailScanner deployment for my (primarily Outlook) user > base. The biggest problem I have yet encountered is how to configure > Outlook. I've found a successful Rules Wizard configuration, but that > method is difficult to implement for ~800 users. > > How have other MailScanner sites with Outlook clients handled this > problem? > > -nick Are you talking about filtering your spam into a separate mailbox folder? Any other outlook-related configuration doesn't have much to do with MailScanner. We use procmail to put messages identified as spam (currently using the subject line) into each user's "Bulk" folder, which is viewable via IMAP. This also allows the user to find any misclassified e-mails and - when we enable it - users can place false negatives in there for Bayes filter training. You can also run a daily job to purge old messages out of this folder. All this happens server-side - no outlook rules and such. Craig --- Craig Pratt Strongbox Network Services Inc. mailto:craig@strong-box.net -- This message checked for dangerous content by MailScanner on StrongBox. From zach at PROZACH.COM Thu Apr 3 21:13:30 2003 From: zach at PROZACH.COM (Zach Gelnett) Date: Thu Jan 12 21:17:41 2006 Subject: Mailscanner f-prot error Message-ID: Hey all, I'm getting this error with MailScanner 4.13 and f-prot 3.13 (current versions of both). I just installed both on a fresh install of RedHat 9. Any ideas? Apr 3 13:32:48 linuxbox MailScanner[24022]: New Batch: Scanning 1 messages, 3596 bytes Apr 3 13:32:48 linuxbox MailScanner[24022]: Virus and Content Scanning: Starting Apr 3 13:32:48 linuxbox MailScanner[24022]: Search: . Apr 3 13:32:49 linuxbox MailScanner[24022]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Search: .". Please mail the author of MailScanner Apr 3 13:32:49 linuxbox MailScanner[24022]: Action: Report only Apr 3 13:32:49 linuxbox MailScanner[24022]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Action: Report only". Please mail the author of MailScanner Apr 3 13:32:49 linuxbox MailScanner[24022]: Files: "Dumb" scan of all files Apr 3 13:32:49 linuxbox MailScanner[24022]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Files: "Dumb" scan of all files". Please mail the author of MailScanner Apr 3 13:32:49 linuxbox MailScanner[24022]: Switches: -ARCHIVE -OLD Apr 3 13:32:49 linuxbox MailScanner[24022]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Switches: -ARCHIVE -OLD". Please mail the author of MailScanner Apr 3 13:32:49 linuxbox MailScanner[24022]: Uninfected: Delivered 1 messages Thanks, Zach From raymond at PROLOCATION.NET Thu Apr 3 21:25:47 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:41 2006 Subject: Mailscanner f-prot error In-Reply-To: Message-ID: hi! > Apr 3 13:32:48 linuxbox MailScanner[24022]: Search: . > Apr 3 13:32:49 linuxbox MailScanner[24022]: Either you've found a bug in > MailScanner's F-Prot output parser, or F-Prot's output format has changed! Most likely you have to upgrade to the latest beta available on the Mailscanner site, there was a fix for the changed F-prot output. bye, Raymond. From l_candelario at CRC.UPR.CLU.EDU Thu Apr 3 21:57:30 2003 From: l_candelario at CRC.UPR.CLU.EDU (Larry Candelario) Date: Thu Jan 12 21:17:41 2006 Subject: Problems with F-prot working with zipped files Message-ID: Hello, I'm running Linux Red Hat 8.0, installed OpenWebmail 1.90, and recently installed MailScanner 4.13-3 with f-prot 3.12d. I modified mailscanner.conf to use f-prot instead of Sophos: Virus Scanner = f-prot Sweep = /usr/local/f-prot/f-protwrapper Modified viruses.to.delete.conf to use f-prot's definitions instead of Sophos In f-protwrapper my ScanOptions line is: ScanOptions="$ScanOptions -archive -old -dumb -auto" But when I'm testing with the EICAR files, only the eicar.com file is detected, not the eicar_com.zip or eicarcom2.zip files. I also checked with the cscript.exe which was detected, but if I zipped it then it wasn't detected. But if I check the file from a terminal commmand window: f-prot eicarcom2.zip Then f-prot does detect the zipped eicar.com file, so I know that f-prot is working okay in that regard. I've checked the install/configure instructions and just can't see what I'm missing or have done wrong. I imagine this has probably been asked over and over before, but I've gone thu the archives searching for EICAR and haven't found any clues yet, so I'd really appreciate any clues or hints or help. Thanks, Larry From mailscanner at ecs.soton.ac.uk Thu Apr 3 23:01:58 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: F-Secure 4.50 support Message-ID: <5.2.0.9.2.20030403225034.03e1d688@imap.ecs.soton.ac.uk> There are 2 parts to this. 1) Copy f-secure-wrapper to the directory containing all the other -wrapper scripts. This will probably be either /usr/lib/MailScanner or /opt/MailScanner/lib. 2) Apply the patch to the SweepViruses.pm file. Depending on the location of the file: cd /usr/lib/MailScanner/MailScanner or cd /opt/MailScanner/lib/MailScanner then patch < SweepViruses.pm.FSecure.patch Then restart MailScanner and you should now be fine with F-Secure 4.50. As usual, if you have installed F-Secure in somewhere other than the default location, you will need to put the path to your installation into f-secure-wrapper. -------------- next part -------------- A non-text attachment was scrubbed... Name: SweepViruses.pm.FSecure.patch Type: application/octet-stream Size: 5125 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030403/5076dfd7/SweepViruses.pm.FSecure.obj -------------- next part -------------- A non-text attachment was scrubbed... Name: f-secure-wrapper Type: application/octet-stream Size: 2472 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030403/5076dfd7/f-secure-wrapper.obj -------------- next part -------------- -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Thu Apr 3 23:16:28 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: I noticed this tonight... In-Reply-To: References: <5.2.0.9.2.20030402084908.023ead88@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030403231616.03e335b0@imap.ecs.soton.ac.uk> This patch will be in the next release. At 14:34 02/04/2003, you wrote: >Mike Kercher wrote: > > > >Any other ideas? > >This patch prevents SpamAssassin from copying the user preferences file >template into ~/.spamassassin > >--- lib/MailScanner/SA.pm 27 Mar 2003 16:55:18 -0000 1.1.1.4 >+++ lib/MailScanner/SA.pm 27 Mar 2003 17:28:47 -0000 1.8 >@@ -73,7 +74,7 @@ > unless (MailScanner::Config::IsSimpleValue('usespamassassin') && > !MailScanner::Config::Value('usespamassassin')) { > require Mail::SpamAssassin; >- $settings{dont_copy_prefs} = 0; >+ $settings{dont_copy_prefs} = 1; > $prefs = MailScanner::Config::Value('spamassassinprefsfile'); > $settings{userprefs_filename} = $prefs if defined $prefs; > $val = MailScanner::Config::Value('debugspamassassin'); > >Tony. >-- >f.a.n.finch http://dotat.at/ >WHITBY TO THE WASH: NORTHWEST 7, DECREASING 4 OR 5. SHOWERS, GRADUALLY DYING >OUT. GOOD, BUT MODERATE IN SHOWERS. ROUGH. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Thu Apr 3 23:21:08 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: Problems with F-prot working with zipped files In-Reply-To: Message-ID: <5.2.0.9.2.20030403231922.03df5008@imap.ecs.soton.ac.uk> At 21:57 03/04/2003, you wrote: >Hello, > >I'm running Linux Red Hat 8.0, installed OpenWebmail 1.90, and recently >installed MailScanner 4.13-3 with f-prot 3.12d. > >I modified mailscanner.conf to use f-prot instead of Sophos: >Virus Scanner = f-prot >Sweep = /usr/local/f-prot/f-protwrapper That's not a MailScanner 4.13-3 option, that's one from version 3. Please check the version you are running and the location of the configuration file you are editing. Something is wrong here. >Modified viruses.to.delete.conf to use f-prot's definitions instead of Sophos Again, that's a version 3 file. I have just tested the F-Prot 3.13 scanning functionality in the latest beta release and it is working fine. Happily detected viruses in zip files. >In f-protwrapper my ScanOptions line is: > >ScanOptions="$ScanOptions -archive -old -dumb -auto" > >But when I'm testing with the EICAR files, only the eicar.com file is >detected, not the eicar_com.zip or eicarcom2.zip files. I also checked with >the cscript.exe which was detected, but if I zipped it then it wasn't >detected. > >But if I check the file from a terminal commmand window: >f-prot eicarcom2.zip > >Then f-prot does detect the zipped eicar.com file, so I know that f-prot is >working okay in that regard. > >I've checked the install/configure instructions and just can't see what I'm >missing or have done wrong. > >I imagine this has probably been asked over and over before, but I've gone >thu the archives searching for EICAR and haven't found any clues yet, so I'd >really appreciate any clues or hints or help. > >Thanks, >Larry -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From nicholas_esborn at AFFYMETRIX.COM Thu Apr 3 23:50:53 2003 From: nicholas_esborn at AFFYMETRIX.COM (Nicholas Esborn) Date: Thu Jan 12 21:17:41 2006 Subject: Exchange/Outlook client configuration In-Reply-To: References: <20030403192815.GB608@affymetrix.com> Message-ID: <20030403225053.GD608@affymetrix.com> Craig, On Thu, Apr 03, 2003 at 11:46:37AM -0800, Craig Pratt wrote: > Are you talking about filtering your spam into a separate mailbox > folder? Any other outlook-related configuration doesn't have much to do > with MailScanner. Yes, I'm basically trying to partition Spam into a seperate mailbox or folder so that users don't see Spam in their normal mailbox, but can retrieve misclassified valid mail. > We use procmail to put messages identified as spam (currently using the > subject line) into each user's "Bulk" folder, which is viewable via > IMAP. This also allows the user to find any misclassified e-mails and - > when we enable it - users can place false negatives in there for Bayes > filter training. You can also run a daily job to purge old messages out > of this folder. All this happens server-side - no outlook rules and > such. Is this on a Unix mail server? In my case, the mailboxes reside on an Exchange server, which limits my options. Exchange can supposedly be automated with vbscript, but the Exchange admins at my site won't touch it with a ten foot pole. The way I see it, I can either: 1) send Spam to a different mailserver, possibly with a webmail front-end or 2) send Spam to the Exchange server, and configure Outlook clients to automatically dump tagged Spam into a Junk folder The key issue is tech support load. Any required user training or client configuration will have to be supported for ~800 users, and I do not want our tech support department to hate me. :) So it's very important for me to have the simplest user experience possible. It would be wonderful if I'm missing some simple, elegant solution here. :) -nick -- Nicholas Esborn Affymetrix, Inc. 510/428.8505 Every message PGP signed -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 187 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030403/1f3e6611/attachment.bin From tchamtieh at YAHOO.COM Thu Apr 3 23:55:17 2003 From: tchamtieh at YAHOO.COM (Thomas Chamtieh) Date: Thu Jan 12 21:17:41 2006 Subject: Quarantine Index File Message-ID: <20030403225517.96199.qmail@web13205.mail.yahoo.com> Hi all, This could be a new feature for the next MailScanner release. I was wondering if it was possible to automatically create/update an index file that would contain a list of all messages that have been quarantined. This would make it much easier and faster to parse (imagine having to to read 6000 files to parse through!) I think an index file file would make it much much faster. Any ideas how to implement this? Thanks, -Thomas --------------------------------- Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030403/caf8e5da/attachment.html From kevins at BMRB.CO.UK Fri Apr 4 00:23:14 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:41 2006 Subject: Exchange/Outlook client configuration In-Reply-To: <20030403225053.GD608@affymetrix.com> References: <20030403192815.GB608@affymetrix.com> <20030403225053.GD608@affymetrix.com> Message-ID: <1049412194.5103.31.camel@bach.kevinspicer.co.uk> > > It would be wonderful if I'm missing some simple, elegant solution here. :) > For what its worth I take the view that as any solution is going to involve some degree of user training (for example, how to access the webmail, explaining how & why their spam ended up in a different folder etc.) you may as well just tag the spam, deliver it and lets users set up their own rules to filter it. I've found that the majority of the spam goes to a minority of users, and flase positives are more likely to generate support calls. I set up a page on our intranet explaining what spam is ('borrowed' from the SA web site!), why their mail has been tagged as spam and how to set up an outlook rule to filter it. I gently publicised it and gave the helpdesk the link as a stock first line response to any calls. We have had very few calls and only about three (all false positives) have been escalated to me in the last six months. I think I would have had a lot more complaints had I filtered mail off elsewhere, as users would constantly have been forgetting how to access it, forgetting it exists & missing important emails which are false positives. (for comparison our Outlook user base is just a little smaller than yours). BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From brian at unearthed.com Fri Apr 4 00:30:22 2003 From: brian at unearthed.com (Brian May) Date: Thu Jan 12 21:17:41 2006 Subject: F-Secure 4.50 support References: <5.2.0.9.2.20030403225034.03e1d688@imap.ecs.soton.ac.uk> Message-ID: <001d01c2fa39$01e1a480$8801020a@brianmay> Julian, you are the man... the patch took a little munging, since you are working off an updated source than myself, (unless I missed an announcement.. running mailscanner-4.13-3).. other than that... perfection! got a wishlist or something I can get you something from? Brian ----- Original Message ----- From: "Julian Field" To: Sent: Thursday, April 03, 2003 2:01 PM Subject: F-Secure 4.50 support There are 2 parts to this. 1) Copy f-secure-wrapper to the directory containing all the other -wrapper scripts. This will probably be either /usr/lib/MailScanner or /opt/MailScanner/lib. 2) Apply the patch to the SweepViruses.pm file. Depending on the location of the file: cd /usr/lib/MailScanner/MailScanner or cd /opt/MailScanner/lib/MailScanner then patch < SweepViruses.pm.FSecure.patch Then restart MailScanner and you should now be fine with F-Secure 4.50. As usual, if you have installed F-Secure in somewhere other than the default location, you will need to put the path to your installation into f-secure-wrapper. ---------------------------------------------------------------------------- ---- -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From patricksteiner at BLUEWIN.CH Fri Apr 4 02:53:32 2003 From: patricksteiner at BLUEWIN.CH (Patrick Steiner) Date: Thu Jan 12 21:17:41 2006 Subject: The highest Spam score !!! Message-ID: <3E8CE59C.4090406@bluewin.ch> --------snip---------- X-MailScanner-VirusCheck: Found to be clean X-MailScanner-SpamCheck: spam, SpamAssassin (score=494.7, required 4.4, AWL, FOR_JUST_SOME_AMT, GTUBE, PATCH_UNIFIED_DIFF) X-MailScanner-SpamScore: ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss --------snip---------- It looks very funny but why is the score so very high??? From mkettler at EVI-INC.COM Fri Apr 4 03:37:49 2003 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:17:41 2006 Subject: The highest Spam score !!! In-Reply-To: <3E8CE59C.4090406@bluewin.ch> Message-ID: <5.2.0.9.0.20030403213458.017e5350@xanadu.evi-inc.com> because it matched the GTUBE test which has a +1000 score. GTUBE is a really bizarre fairly long case-sensitive string that is used as a Generic Test for Unsolicited Bulk Email. It's used by SpamAssassin the same way the EICAR test file is used to test a virus scanner. Was this actually an innocuous mail? or was someone discussing the GTUBE string or purposefully sending a GTUBE email? At 03:53 AM 4/4/2003 +0200, Patrick Steiner wrote: >--------snip---------- >X-MailScanner-VirusCheck: Found to be clean >X-MailScanner-SpamCheck: spam, SpamAssassin (score=494.7, required 4.4, AWL, > FOR_JUST_SOME_AMT, GTUBE, PATCH_UNIFIED_DIFF) >X-MailScanner-SpamScore: >ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss >--------snip---------- > >It looks very funny but why is the score so very high??? From danieltan at shopnsave.com.sg Fri Apr 4 05:23:28 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:41 2006 Subject: Using spam assassin Message-ID: <007e01c2fa61$f2a0ee80$3900a8c0@Daniel> Hi, typing in this command spamassassin --lint gave me this Cannot open bayes_path /root/.spamassassin/bayes R/O: No such file or directory ignored the error and continue to edit spam.assassin.prefs.conf file and wrote local rule set my ruleset can't work including those default nasty e-card filter. is it the right place to define my ruleset to search user's email on subject line and the body that contain words set in my ruleset, the email will be served as spam. eg. if my ruleset ask to search for words on "sex" or "adult" in the subject and body, the mail coming in will be considered spam if it has these words in it. Regards, Daniel Tan 67469188 Ext.665 DID: 68430665 MIS Department Shop N Save Pte Ltd : danieltan@shopnsave.com.sg [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.] From P.G.M.Peters at civ.utwente.nl Fri Apr 4 08:55:14 2003 From: P.G.M.Peters at civ.utwente.nl (Peter Peters) Date: Thu Jan 12 21:17:41 2006 Subject: Exchange/Outlook client configuration In-Reply-To: <20030403225053.GD608@affymetrix.com> References: <20030403192815.GB608@affymetrix.com> <20030403225053.GD608@affymetrix.com> Message-ID: <5heq8vkobntnbgctup3ncunnhrc7nipv48@4ax.com> On Thu, 3 Apr 2003 14:50:53 -0800, you wrote: > 2) send Spam to the Exchange server, and configure Outlook clients to > automatically dump tagged Spam into a Junk folder > >The key issue is tech support load. Any required user training or client >configuration will have to be supported for ~800 users, and I do not want >our tech support department to hate me. :) So it's very important for me >to have the simplest user experience possible. I have set up a website with instructions and have the users do it themselves. Have a look at http://home.student.utwente.nl/p.g.m.peters/outlookrule_viewlet.html. -- Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ From Douglas.Hall at PROQUEST.CO.UK Fri Apr 4 10:00:00 2003 From: Douglas.Hall at PROQUEST.CO.UK (Hall, Douglas) Date: Thu Jan 12 21:17:41 2006 Subject: Sophos Licensing Message-ID: Cany any mailscanner+sophos users can help me out here. I've received a quote from sophos for use with mailscanner, and they include pricing for SAV Interface and SAV Connect licenses. Does anyone know which license is needed for use with MailScanner. I am only asking for verification here, because the chap I spoke with at sophos seemed a little unsure(!). Given the huge differential in price, I'd like to be sure which is needed before I test sophos out any further. Perhaps this should be in the FAQ? thanks! -Douglas From jdostal at YCN.COM Fri Apr 4 10:04:06 2003 From: jdostal at YCN.COM (Joachim Dostal) Date: Thu Jan 12 21:17:41 2006 Subject: 2 x "from=<>" in the logs Message-ID: hi, have MailScanner 4.12, and 2 sendmail(8.12.8) processes. if i send a virus mail (e.g. eicar.com) to the server i get following to lines: === Apr 2 15:51:22 mailsrv sendmail[2065]: h32DpLnl002065: from=<>, size=1259, class=0, nrcpts=1, msgid=<200304021351.h32DpLnl002065@mailsrv.mydom.com>, relay=root@localhost Apr 2 15:51:22 mailsrv sendmail[2067]: h32DpMIg002067: from=<>, size=1513, class=0, nrcpts=1, msgid=<200304021351.h32DpLnl002065@mailsrv.mydom.com>, proto=ESMTP, daemon=MSA, relay=localhost [127.0.0.1] === are there any suggestions about this lines ? thx4your help, joachim From mailscanner at ecs.soton.ac.uk Fri Apr 4 10:15:30 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: SpamAssassin timed out and was killed, In-Reply-To: <1049364388.3e8c07a464fd6@mail.printsoft.com> Message-ID: <5.2.0.9.2.20030404101513.042d5ea8@imap.ecs.soton.ac.uk> At 11:06 03/04/2003, you wrote: >Hi All, > >I have search and searched and have not been able able to find any information >on this error message or anything on how to fix it. > >.....SpamAssassin timed out and was killed,..... > >I am running MailScanner version 4.13-3 and SpamAssassin version 2.52 > >Could anyone tell me how to do the following >1. Turn up the logging to achive better logging of SpamAssassin errors in >syslog >2. What this error might be and point me in the direction of where to start >looking. The next release will have a "Debug SpamAssassin" configuration option. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 10:09:17 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: Sophos Licensing In-Reply-To: Message-ID: <5.2.0.9.2.20030404100807.04273120@imap.ecs.soton.ac.uk> At 10:00 04/04/2003, you wrote: >Cany any mailscanner+sophos users can help me out here. I've >received a quote from sophos for use with mailscanner, and >they include pricing for SAV Interface and SAV Connect licenses. > >Does anyone know which license is needed for use with >MailScanner. I am only asking for verification here, because >the chap I spoke with at sophos seemed a little unsure(!). > >Given the huge differential in price, I'd like to be sure >which is needed before I test sophos out any further. I *believe* the right answer is SAV Interface (or SAVI) licences. That has certainly been the case in the past. It's not a cheap product by any means, but it is a good one. Check you aren't entitled to any discounts (quantity/education/charity/...) -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 10:16:35 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: F-Secure 4.50 not supported... In-Reply-To: <03271286-65E3-11D7-88DD-000A9579E1DA@unearthed.org> References: <5.2.0.9.2.20030402133441.025b9f50@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030404101605.0429f9a0@imap.ecs.soton.ac.uk> At 15:46 03/04/2003, you wrote: >Any word yet from F-Secure? All sorted. >Also, any emails to you are stopping at the server... maybe that is >the reason? One of our mail servers got screwed by the RedHat Network updates. Fixed now. > ----- The following addresses had transient non-fatal errors ----- >jkf@roadrunner > (expanded from: jkf) > > ----- Transcript of session follows ----- >jkf@roadrunner... Deferred: Connection refused by >roadrunner.ecs.soton.ac.uk. >Warning: message still undelivered after 3 hours >Will keep trying until message is 1 week old >Reporting-MTA: dns; magpie.ecs.soton.ac.uk >Arrival-Date: Wed, 2 Apr 2003 22:48:30 +0100 (BST) > >Final-Recipient: RFC822; jkf@magpie.ecs.soton.ac.uk >X-Actual-Recipient: RFC822; jkf@ecs.soton.ac.uk >Action: delayed >Status: 4.4.1 >Remote-MTA: DNS; roadrunner.ecs.soton.ac.uk >Last-Attempt-Date: Thu, 3 Apr 2003 01:56:58 +0100 (BST) >Will-Retry-Until: Wed, 9 Apr 2003 22:48:30 +0100 (BST) -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 10:12:21 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: Exchange/Outlook client configuration In-Reply-To: <20030403225053.GD608@affymetrix.com> References: <20030403192815.GB608@affymetrix.com> Message-ID: <5.2.0.9.2.20030404101023.042786b0@imap.ecs.soton.ac.uk> At 23:50 03/04/2003, you wrote: >Craig, > >On Thu, Apr 03, 2003 at 11:46:37AM -0800, Craig Pratt wrote: > > Are you talking about filtering your spam into a separate mailbox > > folder? Any other outlook-related configuration doesn't have much to do > > with MailScanner. > >Yes, I'm basically trying to partition Spam into a seperate mailbox or >folder so that users don't see Spam in their normal mailbox, but can >retrieve misclassified valid mail. > > > We use procmail to put messages identified as spam (currently using the > > subject line) into each user's "Bulk" folder, which is viewable via > > IMAP. This also allows the user to find any misclassified e-mails and - > > when we enable it - users can place false negatives in there for Bayes > > filter training. You can also run a daily job to purge old messages out > > of this folder. All this happens server-side - no outlook rules and > > such. > >Is this on a Unix mail server? In my case, the mailboxes reside on an >Exchange server, which limits my options. Exchange can supposedly be >automated with vbscript, but the Exchange admins at my site won't touch >it with a ten foot pole. The way I see it, I can either: > > 1) send Spam to a different mailserver, possibly with a webmail front-end > >or > > 2) send Spam to the Exchange server, and configure Outlook clients to > automatically dump tagged Spam into a Junk folder One approach to this, which a few people use, is to have 2 accounts per user. One for the usual mail (e.g. jim) and one for their spam (e.g. jim-spam). It is a trivial Custom Function to make the Spam Action forward to "username-spam@yourdomain.com". Still involves some user training though. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 10:22:48 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: 2 x "from=<>" in the logs In-Reply-To: Message-ID: <5.2.0.9.2.20030404102223.04273f00@imap.ecs.soton.ac.uk> At 10:04 04/04/2003, you wrote: >hi, > >have MailScanner 4.12, and 2 sendmail(8.12.8) processes. if i send a virus >mail (e.g. eicar.com) to the server i get following to lines: They are probably the sender and postmaster warning messages being sent. >=== >Apr 2 15:51:22 mailsrv sendmail[2065]: h32DpLnl002065: from=<>, size=1259, >class=0, nrcpts=1, msgid=<200304021351.h32DpLnl002065@mailsrv.mydom.com>, >relay=root@localhost > >Apr 2 15:51:22 mailsrv sendmail[2067]: h32DpMIg002067: from=<>, size=1513, >class=0, nrcpts=1, msgid=<200304021351.h32DpLnl002065@mailsrv.mydom.com>, >proto=ESMTP, daemon=MSA, relay=localhost [127.0.0.1] >=== >are there any suggestions about this lines ? > >thx4your help, joachim -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 10:17:15 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: SpamAssassin timed out and was killed, In-Reply-To: Message-ID: <5.2.0.9.2.20030404101700.04258728@imap.ecs.soton.ac.uk> The next release will work better with SpamAssassin 2.5x. At 16:39 03/04/2003, you wrote: >I have had lots of SpamAssassin timeouts since upgrading to version 2.52. I >had to disable bayes for things to work again. In spam.assassin.prefs.conf, >I put > >use_bayes 0 >auto_learn 0 > >You can try it too and see if that helps. For me, I have to wait until I >get my new mail server in which can handle the increased load of bayes >filtering. > >Jason > > > -----Original Message----- > > From: Brett Thomson [mailto:brett.thomson@PRINTSOFT.COM] > > Sent: Thursday, April 03, 2003 5:06 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: [MAILSCANNER] SpamAssassin timed out and was killed, > > > > > > Hi All, > > > > I have search and searched and have not been able able to > > find any information > > on this error message or anything on how to fix it. > > > > .....SpamAssassin timed out and was killed,..... > > > > I am running MailScanner version 4.13-3 and SpamAssassin version 2.52 > > > > Could anyone tell me how to do the following > > 1. Turn up the logging to achive better logging of > > SpamAssassin errors in syslog > > 2. What this error might be and point me in the direction of > > where to start > > looking. > > > > Many Thanks > > Brett. > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 10:19:28 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: Forward Spam Action Clarification In-Reply-To: Message-ID: <5.2.0.9.2.20030404101737.0425d3b0@imap.ecs.soton.ac.uk> At 19:43 03/04/2003, you wrote: >Hello, > >I am getting ready to implement a spam actions ruleset: > >I have the following in /etc/MailScanner/rules/spam.actions.rules > >To: *@domain.com forward spam@domain.com > >I understand this and have tested it with success. Messages marked as >spam are forwarded to the appropriate email address (and that' it). The >message doesn't appear to be archived, sent to the original recipient, >or anything more. > >However, I noticed that a few people have implemented the same rule but >appended the delete action after the forwarding email address, like so: > >To: *@domain.com forward spam@domain.com delete > >Based on my testing, there doesn't seem to be a difference between these >two rules. In other words, once it's forwarded, it's implicity deleted >from the queue and appending delete as a second action doesn't seem to >matter. Is this correct? That is correct. In this case "delete" is a null operation as you have also asked for it to go elsewhere, but do not want to deliver it to the original recipient. 1 point about rulesets: always safer to add a "default" rule as well, e.g. FromOrTo: default deliver so you know what it will do in all cases. My code does have defaults specified in it that will happen if you do not supply your own default rule, but it's better if you set it yourself so you can be sure it does what you want. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 11:59:06 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: ANNOUNCE: Version 4.14 released Message-ID: <5.2.0.9.2.20030404114833.04279048@imap.ecs.soton.ac.uk> I have just released MailScanner version 4.14. Major new features are: - Support for NOD32 1.99, F-Secure 4.50 and F-Prot 3.13. - Support for SAVI Perl module to completely avoid startup delays with Sophos scanner. - Support for quirks of SpamAssassin 2.50 - 2.53. - Fixed important bug in filename checking code causing it not to check long filenames properly. I strongly advise all 4.13 users to upgrade. People who should upgrade are: - Anyone running 4.13 - Anyone using SpamAssassin 2.50-2.53 - Anyone using F-Prot - Anyone using F-Secure - Anyone using NOD32 Download it as usual from www.mailscanner.info And why not help to spread the word by buying a T-shirt while you are there? The full ChangeLog is this: * New Features and Improvements * - Added support for new (1.99) version of NOD32, using the "nod32-1.99" Virus Scanner setting, which has totally different output and different command-line switches from previous versions. - Added support for new (4.50) version of F-Secure. Involves a new f-secure- wrapper as well as new main code. - Added support for new version of F-Prot 3.13. - Added support for SAVI Perl module, using the "sophossavi" Virus Scanner setting. See the main docs for instructions on how to install the SAVI Perl module. - Signed and/or encrypted messages can now be signed without breaking the PGP/GPG signed portion of the message. - RAV support improved in Cobalt RaQ systems. - Added "Include Scanner Name In Reports" option to allow the virus scanner name to appear in the scanning reports. - "Debug SpamAssassin" option to help you sort out SpamAssassin problems. - "Exim Split Spool" option to support split mail queues with Exim. - Full support for quirks of SpamAssassin 2.5x. - Added optional support in f-prot-wrapper script to support tmpfs and ramdisks which F-Prot cannot use without assistance. - Better error reporting when compiling configuration files. - Improved OpenBSD installation and upgrading instructions. - Added check of location of all required system commands. - Improved wording of message to spam senders. - Increased max size of messages sent to SpamAssassin. Spam messages are getting bigger. - All variables in the supplied conf file are now set to something, even if just a blank value. This will make upgrade_MailScanner_conf work better. - Speeded up deletion of working area directories (thanks to Tony F for that). - No more reliance on hard-coded paths in SystemDefs.pm, this entire file is now obsolete. - Improved RedHat scripts to cope with glibc 2.3.x. * Fixes * - Fixed important bug in filename checking code causing it not to check long filenames properly. I strongly advise all 4.13 users to upgrade. - Changed setuid/setgid code so taint mode is not switched on. - Fixed various other issues kindly brought to my attention by Tony Finch at Cambridge Univ. - Fixed problem with deleting recipients from messages with Exim. - Fixed problem with headers being passed to SpamAssassin from Exim incorrectly. - Fixed problem when running internal TNEF decoder. - Fixed locking problems when SpamAssassin 2.50 times out. - Fixed "RBL Timeout 20 of 7" problem, and problem when no RBL's in use at all. - Fixed dont_copy_prefs option in call to SpamAssassin. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Kevin.Spicer at BMRB.CO.UK Fri Apr 4 12:23:13 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:41 2006 Subject: "Delete As Spam" button for Exchange Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF4F5@pascal.priv.bmrb.co.uk> Looks like we had the same idea! I'm curious whether your script would add any headers to the message (through the Mail::Client interface), the one drawback to me using fetchmail is that both fetchmail and the local MTA add headers (although this is far preferable to forwarding with Outlook). Would you mind letting me have a copy off list? (kevins@bmrb.co.uk). I'm just about to start work on upgrading MS (I was waiting for the stable release of 4.14) so I'll be trying this out over the next few days. > > Hi Dale. > > Unfortunately we use Outlook / Exchange here too. :-) I > have written a > script that will connect to an IMAP mailbox and pull all of > the messages out > and feed them to sa-learn. In Exchange, we created two > folders (Spam and > Not Spam) in the Public Folders area. The script I wrote is > in perl and > uses Mail::Cclient to access the IMAP folders. When > everything is complete, > we will just have the users drag and drop their spam (and ham > if needed) > into these folders, and our script run from cron will feed > them to sa-learn. > > I chose this method because Outlook can only forward email > (not bounce). > And forwarding email would change the it a little bit, which > may impact the > bayes filters. > > Currently I have had to turn off bayes checking as it puts > too much of a > load on my server, so I haven't fully tested it out. But I should be > getting new hardware next week. When I am done with the > script, I will post > it to the list. You can email me off list if you'd like a preliminary > version. > > Jason > > > -----Original Message----- > > From: Dale Lovelace [mailto:dlovelace@HOTELS.COM] > > Sent: Thursday, April 03, 2003 2:01 PM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: [MAILSCANNER] "Delete As Spam" button for Exchange > > > > > > Hi, > > > > I am trying to implement a "Delete As Spam" button in > > VBScript for Outlook/Exchange that would allow a user to > > delete a mail they considered spam from their Inbox, then > > forward it to a special email address that I will use to then > > feed to SpamAssassin's new bayesian learning. Before I got > > started I thought I would ask if anyone had done anything > > like that before, or if anyone knows of a script archive > > somewhere that might have something along these lines. I > > haven't done any VBScripting ever, so any tips at all would > > be great! I'll be sure to release whatever I do come up with > > to the world! > > > > Thanks, > > Dale > > > > -- > > Dale Lovelace > > System Administrator > > hotels.com > > (214) 361-7311 Ext. 1074 > > > BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dll at SCITOOLS.COM Fri Apr 4 13:34:24 2003 From: dll at SCITOOLS.COM (Dan Leavitt) Date: Thu Jan 12 21:17:41 2006 Subject: Sophos Licensing References: <5.2.0.9.2.20030404100807.04273120@imap.ecs.soton.ac.uk> Message-ID: <009e01c2faa6$a72c03f0$170aa8c0@DELL> We just bought sophos for this purpose. You do indeed need the SAVI license. We were told that we could buy that alone or, depending on our needs and company size, it might be more cost-effective to purchase the SAV Desktop license which includes the use of SAVI and have desktop virus protection as well. We opted for the latter. Dan ----- Original Message ----- From: "Julian Field" To: Sent: Friday, April 04, 2003 4:09 AM Subject: Re: Sophos Licensing > At 10:00 04/04/2003, you wrote: > >Cany any mailscanner+sophos users can help me out here. I've > >received a quote from sophos for use with mailscanner, and > >they include pricing for SAV Interface and SAV Connect licenses. > > > >Does anyone know which license is needed for use with > >MailScanner. I am only asking for verification here, because > >the chap I spoke with at sophos seemed a little unsure(!). > > > >Given the huge differential in price, I'd like to be sure > >which is needed before I test sophos out any further. > > I *believe* the right answer is SAV Interface (or SAVI) licences. That has > certainly been the case in the past. It's not a cheap product by any means, > but it is a good one. Check you aren't entitled to any discounts > (quantity/education/charity/...) > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > From mbowman at UDCOM.COM Fri Apr 4 14:17:20 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:41 2006 Subject: Sophos Licensing Message-ID: Not aware of any License implications, however hen I contacted Sophos about 2 weeks ago to evaluate their product their pricing I thought is too high. Basically for an ISP they suggested that we pay per mailbox per month. For 1000 mail boxes it would cost is $300/month!. We are currently evaluating F-prot which I believe is $450/server per year -- much more appetizing. Regards, -- Matthew K Bowman "Hall, Douglas" Sent by: MailScanner mailing list 04/04/2003 04:00 AM Please respond to MailScanner mailing list To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: Sophos Licensing Cany any mailscanner+sophos users can help me out here. I've received a quote from sophos for use with mailscanner, and they include pricing for SAV Interface and SAV Connect licenses. Does anyone know which license is needed for use with MailScanner. I am only asking for verification here, because the chap I spoke with at sophos seemed a little unsure(!). Given the huge differential in price, I'd like to be sure which is needed before I test sophos out any further. Perhaps this should be in the FAQ? thanks! -Douglas From marco at MUW.EDU Fri Apr 4 15:16:13 2003 From: marco at MUW.EDU (Marco Obaid) Date: Thu Jan 12 21:17:41 2006 Subject: Sophos Licensing In-Reply-To: References: Message-ID: <1049465773.3e8d93adb4f14@webmail.MUW.Edu> Quoting Matthew Bowman : > Not aware of any License implications, however hen I contacted Sophos > about 2 weeks ago to evaluate their product their pricing I thought is too > high. Basically for an ISP they suggested that we pay per mailbox per > month. For 1000 mail boxes it would cost is $300/month!. We are currently > evaluating F-prot which I believe is $450/server per year -- much more > appetizing. > Also, look into CommandSoft (http://www.commandsoftware.com/index.cfm). I bought their product after I bought Sophos (I am running both). From cost- perepectives Command is a great deal. I honestly do not trust Sophos as a company anymore. The sales reps are not straight forward. The techs are good but are not quick to admit screw-ups. >From preformance perspectives, I am using Command with MailScanner since the last screwed-up engine that Sophos released. It is much better than Sophos on my end. At any rate, my advice is to take your time evaluating other products. Sophos is good but so are other products. Marco _________________________________________________________________ This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail For the latest MUW Events, visit http://www.MUW.Edu/calendar From david.osborne at NOTTINGHAM.AC.UK Fri Apr 4 14:55:13 2003 From: david.osborne at NOTTINGHAM.AC.UK (David Osborne) Date: Thu Jan 12 21:17:41 2006 Subject: Virus scanner lock file not removed Message-ID: <1049464512.13969.12.camel@simonside.ccc.nottingham.ac.uk> On our systems with MailScanner & Sophos, the sophos-autoupdate script creates /tmp/SophosBusy.lock but the file is never removed, preventing MailScanner from running. If I remove the file manually, everything is OK until the next hourly check. What's wrong with our installation? We're using MailScanner 4-12-2 (installed from RPM), Sophos, Exim 3.36, running on RedHat 8.0 -- David Osborne Information Services, University of Nottingham From mike at ZANKER.ORG Fri Apr 4 15:06:27 2003 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:17:41 2006 Subject: {Spam?} Re: The highest Spam score !!! In-Reply-To: <2s2r8vol25gahdr4g937hribnevgdm5cf8@4ax.com> References: <5.2.0.9.0.20030403213458.017e5350@xanadu.evi-inc.com> <3E8D84F7.50009@bluewin.ch> <2s2r8vol25gahdr4g937hribnevgdm5cf8@4ax.com> Message-ID: <57088484.1049468787@jemima.zanker.org> On 04 April 2003 15:41 +0200 Peter Peters wrote: > On Fri, 4 Apr 2003 15:13:27 +0200, you wrote: > >> Here is the full mail: >> >> ---------------------------------------------- >> testing. Let's get GTUBE in here: Oops - quoting that on this mailing list is probably not a good idea! Not only did this and the quoted e-mail score similarly but mailstats then blocked smtp.jiscmail.ac.uk :( Mike. From mike at CAMAROSS.NET Fri Apr 4 15:16:03 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:41 2006 Subject: {Spam?} Re: The highest Spam score !!! In-Reply-To: <57088484.1049468787@jemima.zanker.org> Message-ID: <00d801c2fab4$badb80c0$af01a8c0@home.middlefinger.net> My mailstats did the exact same thing! :) -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mike Zanker Sent: Friday, April 04, 2003 8:06 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: {Spam?} Re: The highest Spam score !!! On 04 April 2003 15:41 +0200 Peter Peters wrote: > On Fri, 4 Apr 2003 15:13:27 +0200, you wrote: > >> Here is the full mail: >> >> ---------------------------------------------- >> testing. Let's get GTUBE in here: Oops - quoting that on this mailing list is probably not a good idea! Not only did this and the quoted e-mail score similarly but mailstats then blocked smtp.jiscmail.ac.uk :( Mike. From jase at SENSIS.COM Fri Apr 4 15:22:09 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:41 2006 Subject: Virus scanner lock file not removed Message-ID: Check the ownership and permissions of the lock file. Perhaps you have virus update script running as root create the file, but MailScanner (running as user mail for Exim maybe) tries to lock the file but does not have permission? If this is the case, instead of deleting the file, try changing the owner of it to mail, or whoever you run MailScanner as. Jason > -----Original Message----- > From: David Osborne [mailto:david.osborne@NOTTINGHAM.AC.UK] > Sent: Friday, April 04, 2003 8:55 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [MAILSCANNER] Virus scanner lock file not removed > > > On our systems with MailScanner & Sophos, the sophos-autoupdate script > creates /tmp/SophosBusy.lock but the file is never removed, preventing > MailScanner from running. If I remove the file manually, everything is > OK until the next hourly check. What's wrong with our installation? > > We're using MailScanner 4-12-2 (installed from RPM), Sophos, > Exim 3.36, > running on RedHat 8.0 > > -- > David Osborne > Information Services, University of Nottingham > From david.osborne at NOTTINGHAM.AC.UK Fri Apr 4 16:19:47 2003 From: david.osborne at NOTTINGHAM.AC.UK (David Osborne) Date: Thu Jan 12 21:17:41 2006 Subject: Virus scanner lock file not removed In-Reply-To: References: Message-ID: <1049469586.13963.84.camel@simonside.ccc.nottingham.ac.uk> Thanks for the suggestion, Jason, but the file seems to have the right permissions, as we run our Exim as user exim, group exim: $ ls -l /tmp/SophosBusy.lock -rw------- 1 exim exim 94 Apr 4 16:01 \ /tmp/SophosBusy.lock The file contains Locked for updating Sophos IDE files by 1389 Unlocked after updating Sophos IDE files by 1389 as written by /usr/lib/MailScanner/sophos-autoupdate, where 1389 corresponds with a pid logged to /var/mail/maillog: Apr 4 16:01:00 elgar update.virus.scanners: Found sophos installed Apr 4 16:01:00 elgar update.virus.scanners: Updating sophos Apr 4 16:01:01 elgar Sophos-autoupdate[1389]: Sophos successfully updated in /usr/local/Sophos/366.200304041601 If I do nothing, the file's access time and contents change each time the update runs at 1 min past the hour but the presence of the file stops MailScanner from processing any mail waiting to be scanned. In the sophos-autoupdate script, the LockSophos subroutine creates the file and locks it and the UnlockSophos routine unlocks and closes it, but shouldn't it unlink it as well? David On Fri, 2003-04-04 at 15:22, Desai, Jason wrote: > Check the ownership and permissions of the lock file. Perhaps you have > virus update script running as root create the file, but MailScanner > (running as user mail for Exim maybe) tries to lock the file but does not > have permission? > > If this is the case, instead of deleting the file, try changing the owner of > it to mail, or whoever you run MailScanner as. -- David Osborne Information Services, University of Nottingham From Cleveland at MAIL.WINNEFOX.ORG Fri Apr 4 16:31:02 2003 From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland) Date: Thu Jan 12 21:17:41 2006 Subject: Exchange/Outlook client configuration Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4E5EF@MAIL> > I set up a page on our intranet explaining what > spam is ('borrowed' from the SA web site!), why their mail has been > tagged as spam and how to set up an outlook rule to filter > it. Any way I could "borrow" that page? Jody From mailscanner at ecs.soton.ac.uk Fri Apr 4 16:25:47 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: Virus scanner lock file not removed In-Reply-To: <1049469586.13963.84.camel@simonside.ccc.nottingham.ac.uk> References: Message-ID: <5.2.0.9.2.20030404162254.02bdc6a0@imap.ecs.soton.ac.uk> The file is created but it never needs to be deleted. When the autoupdate script does its job, it locks the file with an exclusive lock, does the update, then unlocks it again. MailScanner processes always lock the file with a "shared" lock when they want to use the scanner. Lots of "shared" locks can be used on a file at the same time (in this case, one per MailScanner child process), but only 1 "exclusive" lock can be held at a time, and that stops any "shared" locks as well (which is what the autoupdate script uses). So it's not the presence of the file that is stopping MailScanner running, it's something else. I use Sophos myself and have never had a problem of this sort, so I'm not quite sure what is going wrong... At 16:19 04/04/2003, you wrote: >Thanks for the suggestion, Jason, but the file seems to have the right >permissions, as we run our Exim as user exim, group exim: > >$ ls -l /tmp/SophosBusy.lock >-rw------- 1 exim exim 94 Apr 4 16:01 \ >/tmp/SophosBusy.lock > >The file contains > Locked for updating Sophos IDE files by 1389 > Unlocked after updating Sophos IDE files by 1389 >as written by /usr/lib/MailScanner/sophos-autoupdate, where 1389 >corresponds with a pid logged to /var/mail/maillog: > >Apr 4 16:01:00 elgar update.virus.scanners: Found sophos installed >Apr 4 16:01:00 elgar update.virus.scanners: Updating sophos >Apr 4 16:01:01 elgar Sophos-autoupdate[1389]: Sophos successfully >updated in /usr/local/Sophos/366.200304041601 > >If I do nothing, the file's access time and contents change each time >the update runs at 1 min past the hour but the presence of the file >stops MailScanner from processing any mail waiting to be scanned. In the >sophos-autoupdate script, the LockSophos subroutine creates the file and >locks it and the UnlockSophos routine unlocks and closes it, but >shouldn't it unlink it as well? > >David > >On Fri, 2003-04-04 at 15:22, Desai, Jason wrote: > > Check the ownership and permissions of the lock file. Perhaps you have > > virus update script running as root create the file, but MailScanner > > (running as user mail for Exim maybe) tries to lock the file but does not > > have permission? > > > > If this is the case, instead of deleting the file, try changing the > owner of > > it to mail, or whoever you run MailScanner as. > >-- >David Osborne >Information Services, University of Nottingham -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From jaearick at COLBY.EDU Fri Apr 4 16:35:54 2003 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:17:41 2006 Subject: SAVI-Perl-0.15 doesn't like Sun's compiler Message-ID: Hi, Having successfully upgraded to 4.14 this morning, I've decided to try SAVI-Perl-0.15. My setup: Sun Solaris 8, perl 5.8.0, built with Sun's Forte7 compiler. Bummer, it doesn't like my compiler, and I'm not going to rebuild perl with gcc to get around this: (37)> perl Makefile.PL Writing Makefile for SAVI (38)> gmake /opt/SUNWspro/bin/cc -c -I. -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O -DVERSION=\"0.15\" -DXS_VERSION=\"0.15\" -KPIC "-I/opt/perl5/lib/5.8.0/sun4-solaris/CORE" SAVI.c "sav_if/s_comput.h", line 706: #error: Unsupported compiler cc: acomp failed for SAVI.c gmake: *** [SAVI.o] Error 2 I sent a note to henson@acm.org asking for a way around this problem. Anybody else encountered this? Will SAVI-perl work with sophos 3.66, or only with later versions? I'm still running 3.66 because 3.67 was such a pig... --- Jeff Earickson From mailscanner at ecs.soton.ac.uk Fri Apr 4 16:49:22 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:41 2006 Subject: SAVI-Perl-0.15 doesn't like Sun's compiler In-Reply-To: Message-ID: <5.2.0.9.2.20030404164708.02c673c0@imap.ecs.soton.ac.uk> At 16:35 04/04/2003, you wrote: >Hi, > Having successfully upgraded to 4.14 this morning, I've >decided to try SAVI-Perl-0.15. My setup: Sun Solaris 8, >perl 5.8.0, built with Sun's Forte7 compiler. Bummer, it >doesn't like my compiler, and I'm not going to rebuild perl >with gcc to get around this: > >(37)> perl Makefile.PL >Writing Makefile for SAVI >(38)> gmake >/opt/SUNWspro/bin/cc -c -I. -I/usr/local/include -D_LARGEFILE_SOURCE >-D_FILE_OFFSET_BITS=64 -O -DVERSION=\"0.15\" -DXS_VERSION=\"0.15\" -KPIC >"-I/opt/perl5/lib/5.8.0/sun4-solaris/CORE" SAVI.c >"sav_if/s_comput.h", line 706: #error: Unsupported compiler >cc: acomp failed for SAVI.c >gmake: *** [SAVI.o] Error 2 > >I sent a note to henson@acm.org asking for a way around this >problem. Anybody else encountered this? All I can suggest is you install gcc from sunfreeware.com and try that. It's only a 30 second job to uninstall it again. >Will SAVI-perl work with sophos 3.66, or only with later >versions? I'm still running 3.66 because 3.67 was such a pig... It should work just fine with 3.66. 3.68 is better than 3.67. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From brian at UNEARTHED.ORG Fri Apr 4 17:11:29 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released References: <5.2.0.9.2.20030404114833.04279048@imap.ecs.soton.ac.uk> Message-ID: <006e01c2fac4$da0af380$4d01000a@local.unearthed.org> After the upgrade; when I restart MailScanner I get this message: Latest MAilScanner, RedHat 7.3 all up2date... Shutting down MailScanner daemons: MailScanner: [ OK ] incoming sendmail: head: /var/run/sendmail.in.pid: No such file or directory [ OK ] outgoing sendmail: [ OK ] Starting MailScanner daemons: incoming sendmail: [ OK ] outgoing sendmail: [ OK ] MailScanner: [ OK ] From mike at CAMAROSS.NET Fri Apr 4 17:11:59 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <006e01c2fac4$da0af380$4d01000a@local.unearthed.org> Message-ID: <00e001c2fac4$f2160aa0$af01a8c0@home.middlefinger.net> My upgrade went flawlessly -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Brian May Sent: Friday, April 04, 2003 10:11 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: ANNOUNCE: Version 4.14 released After the upgrade; when I restart MailScanner I get this message: Latest MAilScanner, RedHat 7.3 all up2date... Shutting down MailScanner daemons: MailScanner: [ OK ] incoming sendmail: head: /var/run/sendmail.in.pid: No such file or directory [ OK ] outgoing sendmail: [ OK ] Starting MailScanner daemons: incoming sendmail: [ OK ] outgoing sendmail: [ OK ] MailScanner: [ OK ] From sevans at FOUNDATION.SDSU.EDU Fri Apr 4 17:15:08 2003 From: sevans at FOUNDATION.SDSU.EDU (Steve Evans) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released Message-ID: Does this mean we should definitely switch to the SAVI perl module or is that still up for debate? Steve Evans SDSU Foundation (619) 594-0653 -----Original Message----- From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] Sent: Friday, April 04, 2003 2:59 AM To: MAILSCANNER@JISCMAIL.AC.UK I have just released MailScanner version 4.14. Major new features are: - Support for NOD32 1.99, F-Secure 4.50 and F-Prot 3.13. - Support for SAVI Perl module to completely avoid startup delays with Sophos scanner. - Support for quirks of SpamAssassin 2.50 - 2.53. - Fixed important bug in filename checking code causing it not to check long filenames properly. I strongly advise all 4.13 users to upgrade. People who should upgrade are: - Anyone running 4.13 - Anyone using SpamAssassin 2.50-2.53 - Anyone using F-Prot - Anyone using F-Secure - Anyone using NOD32 Download it as usual from www.mailscanner.info And why not help to spread the word by buying a T-shirt while you are there? The full ChangeLog is this: * New Features and Improvements * - Added support for new (1.99) version of NOD32, using the "nod32-1.99" Virus Scanner setting, which has totally different output and different command-line switches from previous versions. - Added support for new (4.50) version of F-Secure. Involves a new f-secure- wrapper as well as new main code. - Added support for new version of F-Prot 3.13. - Added support for SAVI Perl module, using the "sophossavi" Virus Scanner setting. See the main docs for instructions on how to install the SAVI Perl module. - Signed and/or encrypted messages can now be signed without breaking the PGP/GPG signed portion of the message. - RAV support improved in Cobalt RaQ systems. - Added "Include Scanner Name In Reports" option to allow the virus scanner name to appear in the scanning reports. - "Debug SpamAssassin" option to help you sort out SpamAssassin problems. - "Exim Split Spool" option to support split mail queues with Exim. - Full support for quirks of SpamAssassin 2.5x. - Added optional support in f-prot-wrapper script to support tmpfs and ramdisks which F-Prot cannot use without assistance. - Better error reporting when compiling configuration files. - Improved OpenBSD installation and upgrading instructions. - Added check of location of all required system commands. - Improved wording of message to spam senders. - Increased max size of messages sent to SpamAssassin. Spam messages are getting bigger. - All variables in the supplied conf file are now set to something, even if just a blank value. This will make upgrade_MailScanner_conf work better. - Speeded up deletion of working area directories (thanks to Tony F for that). - No more reliance on hard-coded paths in SystemDefs.pm, this entire file is now obsolete. - Improved RedHat scripts to cope with glibc 2.3.x. * Fixes * - Fixed important bug in filename checking code causing it not to check long filenames properly. I strongly advise all 4.13 users to upgrade. - Changed setuid/setgid code so taint mode is not switched on. - Fixed various other issues kindly brought to my attention by Tony Finch at Cambridge Univ. - Fixed problem with deleting recipients from messages with Exim. - Fixed problem with headers being passed to SpamAssassin from Exim incorrectly. - Fixed problem when running internal TNEF decoder. - Fixed locking problems when SpamAssassin 2.50 times out. - Fixed "RBL Timeout 20 of 7" problem, and problem when no RBL's in use at all. - Fixed dont_copy_prefs option in call to SpamAssassin. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Kevin.Spicer at BMRB.CO.UK Fri Apr 4 17:20:10 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF4FA@pascal.priv.bmrb.co.uk> I got that too, but I manually deleted var/run/sendmail*, killed all the sendmail processes then it was fine (although thinking on it now I'm not sure it was necessary). I think maybe the sendmail.in.pid is new for this version so the new init script couldn't find it because when you started it (with the old version) it wasn't created. > -----Original Message----- > From: Brian May [mailto:brian@UNEARTHED.ORG] > Sent: 04 April 2003 17:11 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] ANNOUNCE: Version 4.14 released > > > After the upgrade; when I restart MailScanner I get this message: > > Latest MAilScanner, RedHat 7.3 all up2date... > > Shutting down MailScanner daemons: > MailScanner: [ OK ] > incoming sendmail: head: /var/run/sendmail.in.pid: > No such file or > directory > [ OK ] > outgoing sendmail: [ OK ] > Starting MailScanner daemons: > incoming sendmail: [ OK ] > outgoing sendmail: [ OK ] > MailScanner: [ OK ] > BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From david.osborne at NOTTINGHAM.AC.UK Fri Apr 4 17:46:47 2003 From: david.osborne at NOTTINGHAM.AC.UK (David Osborne) Date: Thu Jan 12 21:17:42 2006 Subject: Virus scanner lock file not removed In-Reply-To: <5.2.0.9.2.20030404162254.02bdc6a0@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030404162254.02bdc6a0@imap.ecs.soton.ac.uk> Message-ID: <1049474806.16767.184.camel@simonside.ccc.nottingham.ac.uk> Julian -- thanks for the explanation. Yesterday, a batch of messages was only processed by MailScanner when I deleted the lock file. I've just rebooted the machine and a test message went straight through. David On Fri, 2003-04-04 at 16:25, Julian Field wrote: > The file is created but it never needs to be deleted. When the autoupdate > script does its job, it locks the file with an exclusive lock, does the > update, then unlocks it again. > > MailScanner processes always lock the file with a "shared" lock when they > want to use the scanner. Lots of "shared" locks can be used on a file at > the same time (in this case, one per MailScanner child process), but only 1 > "exclusive" lock can be held at a time, and that stops any "shared" locks > as well (which is what the autoupdate script uses). > > So it's not the presence of the file that is stopping MailScanner running, > it's something else. > > I use Sophos myself and have never had a problem of this sort, so I'm not > quite sure what is going wrong... -- David Osborne Information Services, University of Nottingham From mailscanner at ecs.soton.ac.uk Fri Apr 4 19:03:11 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: Virus scanner lock file not removed In-Reply-To: <1049474806.16767.184.camel@simonside.ccc.nottingham.ac.uk> References: <5.2.0.9.2.20030404162254.02bdc6a0@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030404162254.02bdc6a0@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030404190210.02203b78@imap.ecs.soton.ac.uk> Your OS should clean up advisory locks when the process finishes, however cleanly it does it. But it's possible that an OS bug could fail to release a lock. At 17:46 04/04/2003, you wrote: >Julian -- thanks for the explanation. Yesterday, a batch of messages was >only processed by MailScanner when I deleted the lock file. I've just >rebooted the machine and a test message went straight through. > >David > >On Fri, 2003-04-04 at 16:25, Julian Field wrote: > > The file is created but it never needs to be deleted. When the autoupdate > > script does its job, it locks the file with an exclusive lock, does the > > update, then unlocks it again. > > > > MailScanner processes always lock the file with a "shared" lock when they > > want to use the scanner. Lots of "shared" locks can be used on a file at > > the same time (in this case, one per MailScanner child process), but only 1 > > "exclusive" lock can be held at a time, and that stops any "shared" locks > > as well (which is what the autoupdate script uses). > > > > So it's not the presence of the file that is stopping MailScanner running, > > it's something else. > > > > I use Sophos myself and have never had a problem of this sort, so I'm not > > quite sure what is going wrong... > >-- >David Osborne >Information Services, University of Nottingham -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 19:00:09 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF4FA@pascal.priv.bmrb.co .uk> Message-ID: <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> At 17:20 04/04/2003, you wrote: >I got that too, but I manually deleted var/run/sendmail*, killed all the >sendmail processes then it was fine (although thinking on it now I'm not >sure it was necessary). I think maybe the sendmail.in.pid is new for this >version so the new init script couldn't find it because when you started >it (with the old version) it wasn't created. Yes, that's it. The restart tries to kill the old sendmail processes using the new pid file which won't exist yet. This will only occur once. You could avoid it by stopping the old MailScanner before upgrading to the new one. > > -----Original Message----- > > From: Brian May [mailto:brian@UNEARTHED.ORG] > > Sent: 04 April 2003 17:11 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: [MAILSCANNER] ANNOUNCE: Version 4.14 released > > > > > > After the upgrade; when I restart MailScanner I get this message: > > > > Latest MAilScanner, RedHat 7.3 all up2date... > > > > Shutting down MailScanner daemons: > > MailScanner: [ OK ] > > incoming sendmail: head: /var/run/sendmail.in.pid: > > No such file or > > directory > > [ OK ] > > outgoing sendmail: [ OK ] > > Starting MailScanner daemons: > > incoming sendmail: [ OK ] > > outgoing sendmail: [ OK ] > > MailScanner: [ OK ] > > > > > >BMRB International >http://www.bmrb.co.uk >+44 (0)20 8566 5000 >_________________________________________________________________ >This message (and any attachment) is intended only for the >recipient and may contain confidential and/or privileged >material. If you have received this in error, please contact the >sender and delete this message immediately. Disclosure, copying >or other action taken in respect of this email or in >reliance on it is prohibited. BMRB International Limited >accepts no liability in relation to any personal emails, or >content of any email which does not directly relate to our >business. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 19:01:37 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: Message-ID: <5.2.0.9.2.20030404190014.02242080@imap.ecs.soton.ac.uk> I'm planning on switching to the SAVI module on my systems the next time I upgrade them. I see no reason to switch urgently at all, my current setup works perfectly well. At 17:15 04/04/2003, you wrote: >Does this mean we should definitely switch to the SAVI perl module or is >that still up for debate? > >Steve Evans >SDSU Foundation >(619) 594-0653 > >-----Original Message----- >From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] >Sent: Friday, April 04, 2003 2:59 AM >To: MAILSCANNER@JISCMAIL.AC.UK > >I have just released MailScanner version 4.14. > >Major new features are: >- Support for NOD32 1.99, F-Secure 4.50 and F-Prot 3.13. >- Support for SAVI Perl module to completely avoid startup delays with >Sophos scanner. >- Support for quirks of SpamAssassin 2.50 - 2.53. >- Fixed important bug in filename checking code causing it not to check >long filenames properly. I strongly advise all 4.13 users to upgrade. > >People who should upgrade are: > - Anyone running 4.13 > - Anyone using SpamAssassin 2.50-2.53 > - Anyone using F-Prot > - Anyone using F-Secure > - Anyone using NOD32 > >Download it as usual from www.mailscanner.info > >And why not help to spread the word by buying a T-shirt while you are >there? > > >The full ChangeLog is this: > >* New Features and Improvements * > >- Added support for new (1.99) version of NOD32, using the "nod32-1.99" > Virus Scanner setting, which has totally different output and >different > command-line switches from previous versions. >- Added support for new (4.50) version of F-Secure. Involves a new >f-secure- > wrapper as well as new main code. >- Added support for new version of F-Prot 3.13. >- Added support for SAVI Perl module, using the "sophossavi" Virus >Scanner > setting. See the main docs for instructions on how to install the >SAVI > Perl module. >- Signed and/or encrypted messages can now be signed without breaking >the > PGP/GPG signed portion of the message. >- RAV support improved in Cobalt RaQ systems. >- Added "Include Scanner Name In Reports" option to allow the virus >scanner > name to appear in the scanning reports. >- "Debug SpamAssassin" option to help you sort out SpamAssassin >problems. >- "Exim Split Spool" option to support split mail queues with Exim. >- Full support for quirks of SpamAssassin 2.5x. >- Added optional support in f-prot-wrapper script to support tmpfs and > ramdisks which F-Prot cannot use without assistance. >- Better error reporting when compiling configuration files. >- Improved OpenBSD installation and upgrading instructions. >- Added check of location of all required system commands. >- Improved wording of message to spam senders. >- Increased max size of messages sent to SpamAssassin. > Spam messages are getting bigger. >- All variables in the supplied conf file are now set to something, even >if > just a blank value. This will make upgrade_MailScanner_conf work >better. >- Speeded up deletion of working area directories (thanks to Tony F for >that). >- No more reliance on hard-coded paths in SystemDefs.pm, this entire >file is > now obsolete. >- Improved RedHat scripts to cope with glibc 2.3.x. > >* Fixes * > >- Fixed important bug in filename checking code causing it not to check > long filenames properly. I strongly advise all 4.13 users to upgrade. >- Changed setuid/setgid code so taint mode is not switched on. >- Fixed various other issues kindly brought to my attention by Tony >Finch > at Cambridge Univ. >- Fixed problem with deleting recipients from messages with Exim. >- Fixed problem with headers being passed to SpamAssassin from Exim >incorrectly. >- Fixed problem when running internal TNEF decoder. >- Fixed locking problems when SpamAssassin 2.50 times out. >- Fixed "RBL Timeout 20 of 7" problem, and problem when no RBL's in use >at all. >- Fixed dont_copy_prefs option in call to SpamAssassin. >-- >Julian Field >www.MailScanner.info >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From sevans at FOUNDATION.SDSU.EDU Fri Apr 4 19:28:16 2003 From: sevans at FOUNDATION.SDSU.EDU (Steve Evans) Date: Thu Jan 12 21:17:42 2006 Subject: Sophos in Perl Message-ID: Where can you get it? I couldn't find it in the download section of Sophos's website. Steve Evans SDSU Foundation (619) 594-0653 From mailscanner at ecs.soton.ac.uk Fri Apr 4 19:37:14 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: Sophos in Perl In-Reply-To: Message-ID: <5.2.0.9.2.20030404193453.027ea6f0@imap.ecs.soton.ac.uk> At 19:28 04/04/2003, you wrote: >Where can you get it? I couldn't find it in the download section of >Sophos's website. Follow the instructions in the SAVI installation notes I have written. If you are running Linux you will find them in /usr/share/doc/mailscanner-4.14/html/install/SAVI.shtml. They are of course also on the website, in the "Installation Guides". -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From Steve at swaney.com Fri Apr 4 19:38:48 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:42 2006 Subject: Sophos in Perl In-Reply-To: References: Message-ID: <1049481528.16180.1.camel@speedy> Start here: http://www.sophos.com/downloads/products/?type=eval Steve Swaney Steve@Swaney.com On Fri, 2003-04-04 at 13:28, Steve Evans wrote: > Where can you get it? I couldn't find it in the download section of > Sophos's website. > > Steve Evans > SDSU Foundation > (619) 594-0653 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030404/2c78fbc6/attachment.html From mike at ZANKER.ORG Fri Apr 4 19:40:07 2003 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:17:42 2006 Subject: Sophos in Perl In-Reply-To: References: Message-ID: <73507984.1049485207@jemima.zanker.org> On 04 April 2003 10:28 -0800 Steve Evans wrote: > Where can you get it? I couldn't find it in the download section of > Sophos's website. Mike. From brian at UNEARTHED.ORG Fri Apr 4 19:29:49 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released References: <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> Message-ID: <001801c2fad8$7c6c7dc0$8801020a@brianmay> I'm getting this now... Apr 4 10:24:50 athena MailScanner[28166]: Commercial scanner f-secure timed out! I didn't have that on the previous version patched.... Brian ----- Original Message ----- From: "Julian Field" To: Sent: Friday, April 04, 2003 10:00 AM Subject: Re: ANNOUNCE: Version 4.14 released At 17:20 04/04/2003, you wrote: >I got that too, but I manually deleted var/run/sendmail*, killed all the >sendmail processes then it was fine (although thinking on it now I'm not >sure it was necessary). I think maybe the sendmail.in.pid is new for this >version so the new init script couldn't find it because when you started >it (with the old version) it wasn't created. Yes, that's it. The restart tries to kill the old sendmail processes using the new pid file which won't exist yet. This will only occur once. You could avoid it by stopping the old MailScanner before upgrading to the new one. > > -----Original Message----- > > From: Brian May [mailto:brian@UNEARTHED.ORG] > > Sent: 04 April 2003 17:11 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: [MAILSCANNER] ANNOUNCE: Version 4.14 released > > > > > > After the upgrade; when I restart MailScanner I get this message: > > > > Latest MAilScanner, RedHat 7.3 all up2date... > > > > Shutting down MailScanner daemons: > > MailScanner: [ OK ] > > incoming sendmail: head: /var/run/sendmail.in.pid: > > No such file or > > directory > > [ OK ] > > outgoing sendmail: [ OK ] > > Starting MailScanner daemons: > > incoming sendmail: [ OK ] > > outgoing sendmail: [ OK ] > > MailScanner: [ OK ] > > > > > >BMRB International >http://www.bmrb.co.uk >+44 (0)20 8566 5000 >_________________________________________________________________ >This message (and any attachment) is intended only for the >recipient and may contain confidential and/or privileged >material. If you have received this in error, please contact the >sender and delete this message immediately. Disclosure, copying >or other action taken in respect of this email or in >reliance on it is prohibited. BMRB International Limited >accepts no liability in relation to any personal emails, or >content of any email which does not directly relate to our >business. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 19:59:43 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <001801c2fad8$7c6c7dc0$8801020a@brianmay> References: <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030404195710.0282e258@imap.ecs.soton.ac.uk> At 19:29 04/04/2003, you wrote: >I'm getting this now... > >Apr 4 10:24:50 athena MailScanner[28166]: Commercial scanner f-secure timed >out! > >I didn't have that on the previous version patched.... Are you using the new f-secure-wrapper? If you modified the old one, you may well not have the right one. Check for /usr/lib/MailScanner/f-secure-wrapper.rpmnew and rename it over the top of f-secure-wrapper. 2 or 3 of the wrapper scripts have changed, so make sure you don't have any .rpmnew files that you aren't using. >----- Original Message ----- >From: "Julian Field" >To: >Sent: Friday, April 04, 2003 10:00 AM >Subject: Re: ANNOUNCE: Version 4.14 released > > >At 17:20 04/04/2003, you wrote: > >I got that too, but I manually deleted var/run/sendmail*, killed all the > >sendmail processes then it was fine (although thinking on it now I'm not > >sure it was necessary). I think maybe the sendmail.in.pid is new for this > >version so the new init script couldn't find it because when you started > >it (with the old version) it wasn't created. > >Yes, that's it. The restart tries to kill the old sendmail processes using >the new pid file which won't exist yet. >This will only occur once. You could avoid it by stopping the old >MailScanner before upgrading to the new one. > > > > > -----Original Message----- > > > From: Brian May [mailto:brian@UNEARTHED.ORG] > > > Sent: 04 April 2003 17:11 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: [MAILSCANNER] ANNOUNCE: Version 4.14 released > > > > > > > > > After the upgrade; when I restart MailScanner I get this message: > > > > > > Latest MAilScanner, RedHat 7.3 all up2date... > > > > > > Shutting down MailScanner daemons: > > > MailScanner: [ OK ] > > > incoming sendmail: head: /var/run/sendmail.in.pid: > > > No such file or > > > directory > > > [ OK ] > > > outgoing sendmail: [ OK ] > > > Starting MailScanner daemons: > > > incoming sendmail: [ OK ] > > > outgoing sendmail: [ OK ] > > > MailScanner: [ OK ] > > > > > > > > > > >BMRB International > >http://www.bmrb.co.uk > >+44 (0)20 8566 5000 > >_________________________________________________________________ > >This message (and any attachment) is intended only for the > >recipient and may contain confidential and/or privileged > >material. If you have received this in error, please contact the > >sender and delete this message immediately. Disclosure, copying > >or other action taken in respect of this email or in > >reliance on it is prohibited. BMRB International Limited > >accepts no liability in relation to any personal emails, or > >content of any email which does not directly relate to our > >business. > >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mkettler at EVI-INC.COM Fri Apr 4 20:13:37 2003 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:17:42 2006 Subject: {Spam?} Re: The highest Spam score !!! In-Reply-To: <00d801c2fab4$badb80c0$af01a8c0@home.middlefinger.net> References: <57088484.1049468787@jemima.zanker.org> Message-ID: <5.2.0.9.0.20030404140802.017ae260@xanadu.evi-inc.com> This would be one very good example of why using SpamAssassin as a criteria for block beyond the scope of a single email, or bouncing email is foolish at best. This is particularly true if you're not whitelisting mailing lists that discuss spam filtering tools. At 08:16 AM 4/4/2003 -0600, Mike Kercher wrote: >My mailstats did the exact same thing! :) > >-----Original Message----- > >Oops - quoting that on this mailing list is probably not a good idea! > >Not only did this and the quoted e-mail score similarly but mailstats then >blocked smtp.jiscmail.ac.uk :( > >Mike. From brian at UNEARTHED.ORG Fri Apr 4 20:47:25 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released References: <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030404195710.0282e258@imap.ecs.soton.ac.uk> Message-ID: <002001c2fae3$8ed0bd40$8801020a@brianmay> Julian, Yes, I am running the new wrappers... Although I have f-secure installed to /usr/local/fsav/ still... I updated the wrapper to point to /usr/local/fsav/bin Brian ----- Original Message ----- From: "Julian Field" To: Sent: Friday, April 04, 2003 10:59 AM Subject: Re: ANNOUNCE: Version 4.14 released At 19:29 04/04/2003, you wrote: >I'm getting this now... > >Apr 4 10:24:50 athena MailScanner[28166]: Commercial scanner f-secure timed >out! > >I didn't have that on the previous version patched.... Are you using the new f-secure-wrapper? If you modified the old one, you may well not have the right one. Check for /usr/lib/MailScanner/f-secure-wrapper.rpmnew and rename it over the top of f-secure-wrapper. 2 or 3 of the wrapper scripts have changed, so make sure you don't have any .rpmnew files that you aren't using. From dene at DATATECHIE.COM Fri Apr 4 21:17:14 2003 From: dene at DATATECHIE.COM (Dene Ulmschneider) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <5.2.0.9.2.20030404195710.0282e258@imap.ecs.soton.ac.uk> References: <001801c2fad8$7c6c7dc0$8801020a@brianmay> <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> Message-ID: <5.1.0.14.2.20030404145253.02bd7b90@192.168.1.112> I just upgraded to the latest version and I must say that it went perfectly. GREAT JOB Julian! No errors at all after stopping MailScanner service that was running and then doing upgrade and following all directions. I must admin that it wasn't until AFTER the upgrade was complete that the thought of all of the altered reports came into my mind - but to my surprise - they were not touched at all by the upgrade. Excellent product Julian - you can count on me for at least a T-Shirt or two...and when I can find some time even a link on my site. Thank You Dene Ulmschneider Data Techie Inc. ------------------------------------------------------------------------- office: 718.738.8859 email: dene@datatechie.com website: www.datatechie.com ------------------------------------------------------------------------- "Life is too short...-...you should have dessert first" At 07:59 PM 4/4/2003 +0100, you wrote: >At 19:29 04/04/2003, you wrote: >>I'm getting this now... >> >>Apr 4 10:24:50 athena MailScanner[28166]: Commercial scanner f-secure timed >>out! >> >>I didn't have that on the previous version patched.... > >Are you using the new f-secure-wrapper? >If you modified the old one, you may well not have the right one. Check for > /usr/lib/MailScanner/f-secure-wrapper.rpmnew >and rename it over the top of f-secure-wrapper. > >2 or 3 of the wrapper scripts have changed, so make sure you don't have any >.rpmnew files that you aren't using. > >>----- Original Message ----- >>From: "Julian Field" >>To: >>Sent: Friday, April 04, 2003 10:00 AM >>Subject: Re: ANNOUNCE: Version 4.14 released >> >> >>At 17:20 04/04/2003, you wrote: >> >I got that too, but I manually deleted var/run/sendmail*, killed all the >> >sendmail processes then it was fine (although thinking on it now I'm not >> >sure it was necessary). I think maybe the sendmail.in.pid is new for this >> >version so the new init script couldn't find it because when you started >> >it (with the old version) it wasn't created. >> >>Yes, that's it. The restart tries to kill the old sendmail processes using >>the new pid file which won't exist yet. >>This will only occur once. You could avoid it by stopping the old >>MailScanner before upgrading to the new one. >> >> >> > > -----Original Message----- >> > > From: Brian May [mailto:brian@UNEARTHED.ORG] >> > > Sent: 04 April 2003 17:11 >> > > To: MAILSCANNER@JISCMAIL.AC.UK >> > > Subject: Re: [MAILSCANNER] ANNOUNCE: Version 4.14 released >> > > >> > > >> > > After the upgrade; when I restart MailScanner I get this message: >> > > >> > > Latest MAilScanner, RedHat 7.3 all up2date... >> > > >> > > Shutting down MailScanner daemons: >> > > MailScanner: [ OK ] >> > > incoming sendmail: head: /var/run/sendmail.in.pid: >> > > No such file or >> > > directory >> > > [ OK ] >> > > outgoing sendmail: [ OK ] >> > > Starting MailScanner daemons: >> > > incoming sendmail: [ OK ] >> > > outgoing sendmail: [ OK ] >> > > MailScanner: [ OK ] >> > > >> > >> > >> > >> >BMRB International >> >http://www.bmrb.co.uk >> >+44 (0)20 8566 5000 >> >_________________________________________________________________ >> >This message (and any attachment) is intended only for the >> >recipient and may contain confidential and/or privileged >> >material. If you have received this in error, please contact the >> >sender and delete this message immediately. Disclosure, copying >> >or other action taken in respect of this email or in >> >reliance on it is prohibited. BMRB International Limited >> >accepts no liability in relation to any personal emails, or >> >content of any email which does not directly relate to our >> >business. >> >>-- >>Julian Field >>www.MailScanner.info >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support > >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >-- >This message has been scanned for viruses and dangerous >content by Data Techie, and is believed to be clean. >Data Techie... always there to protect you! >http://www.datatechie.com From jase at SENSIS.COM Fri Apr 4 21:17:33 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:42 2006 Subject: Virus Warnings with MailScanner 4.14-9 and multiple scanners Message-ID: Hello. I just upgraded to MailScanner 4.14-9 (great job, Julian). I am running McAfee and ClamAV for my virus scanners. I sent myself a test messages with the eicar test virus. The test virus was stripped from the message as I would expect, but the message is a little strange (it is also attached). The message in the body of the email mentions only ClamAV, and the attached VirusWarning.txt file only mentions McAfee. Reports to the sender and postmaster mention both as I would expect. This is not a major issue, as the virus is being blocked. Is this a bug, or a misconfiguration on my end? MailScanner.conf: Virus Scanning = yes Virus Scanners = mcafee clamav Deliver Disinfected Files = /usr/local/MailScanner/etc/rules/deliver.disinfected.rules deliver.disinfected.rules: To: *@sensis.com yes To: *@*.sensis.com yes FromTo: default no Thanks! Jason -------------- next part -------------- An embedded message was scrubbed... From: "Desai, Jason" Subject: {Virus?} Test Virus Date: Fri, 4 Apr 2003 14:59:40 -0500 Size: 1794 Url: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030404/5a0aff1b/attachment.mht From mailscanner at ecs.soton.ac.uk Fri Apr 4 21:19:03 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <002001c2fae3$8ed0bd40$8801020a@brianmay> References: <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030404195710.0282e258@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030404205734.03bccd78@imap.ecs.soton.ac.uk> Virus scanners are a little awkward this weekend. We've got a power-outage on Sunday while they fit a new feed to our big High Voltage Lab, so virtually all my MailScanner development servers are switched off for the weekend. I'll see what I can do to run a test set through it. I can't find F-Secure on their website to download. I managed to find it the other day, but I can't find it now. Can someone mail me the URL of the right download page please? At 20:47 04/04/2003, you wrote: >Julian, > >Yes, I am running the new wrappers... > >Although I have f-secure installed to /usr/local/fsav/ still... I updated >the wrapper to point to /usr/local/fsav/bin > >Brian > >----- Original Message ----- >From: "Julian Field" >To: >Sent: Friday, April 04, 2003 10:59 AM >Subject: Re: ANNOUNCE: Version 4.14 released > > >At 19:29 04/04/2003, you wrote: > >I'm getting this now... > > > >Apr 4 10:24:50 athena MailScanner[28166]: Commercial scanner f-secure >timed > >out! > > > >I didn't have that on the previous version patched.... > >Are you using the new f-secure-wrapper? >If you modified the old one, you may well not have the right one. Check for > /usr/lib/MailScanner/f-secure-wrapper.rpmnew >and rename it over the top of f-secure-wrapper. > >2 or 3 of the wrapper scripts have changed, so make sure you don't have any >.rpmnew files that you aren't using. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 4 21:23:53 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <5.1.0.14.2.20030404145253.02bd7b90@192.168.1.112> References: <5.2.0.9.2.20030404195710.0282e258@imap.ecs.soton.ac.uk> <001801c2fad8$7c6c7dc0$8801020a@brianmay> <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030404212236.03c07840@imap.ecs.soton.ac.uk> At 21:17 04/04/2003, you wrote: >I just upgraded to the latest version and I must say that it went >perfectly. GREAT JOB Julian! > >No errors at all after stopping MailScanner service that was running and >then doing upgrade and following all directions. I must admin that it >wasn't until AFTER the upgrade was complete that the thought of all of the >altered reports came into my mind - but to my surprise - they were not >touched at all by the upgrade. > >Excellent product Julian - you can count on me for at least a T-Shirt or >two...and when I can find some time even a link on my site. Glad to hear you like it! P.S. I make a grand $1 on each item in the Store, they are there to help spread the word, so I hope you don't mind being a walking advert :-) >At 07:59 PM 4/4/2003 +0100, you wrote: >>At 19:29 04/04/2003, you wrote: >>>I'm getting this now... >>> >>>Apr 4 10:24:50 athena MailScanner[28166]: Commercial scanner f-secure timed >>>out! >>> >>>I didn't have that on the previous version patched.... >> >>Are you using the new f-secure-wrapper? >>If you modified the old one, you may well not have the right one. Check for >> /usr/lib/MailScanner/f-secure-wrapper.rpmnew >>and rename it over the top of f-secure-wrapper. >> >>2 or 3 of the wrapper scripts have changed, so make sure you don't have any >>.rpmnew files that you aren't using. >> >>>----- Original Message ----- >>>From: "Julian Field" >>>To: >>>Sent: Friday, April 04, 2003 10:00 AM >>>Subject: Re: ANNOUNCE: Version 4.14 released >>> >>> >>>At 17:20 04/04/2003, you wrote: >>> >I got that too, but I manually deleted var/run/sendmail*, killed all the >>> >sendmail processes then it was fine (although thinking on it now I'm not >>> >sure it was necessary). I think maybe the sendmail.in.pid is new for this >>> >version so the new init script couldn't find it because when you started >>> >it (with the old version) it wasn't created. >>> >>>Yes, that's it. The restart tries to kill the old sendmail processes using >>>the new pid file which won't exist yet. >>>This will only occur once. You could avoid it by stopping the old >>>MailScanner before upgrading to the new one. >>> >>> >>> > > -----Original Message----- >>> > > From: Brian May [mailto:brian@UNEARTHED.ORG] >>> > > Sent: 04 April 2003 17:11 >>> > > To: MAILSCANNER@JISCMAIL.AC.UK >>> > > Subject: Re: [MAILSCANNER] ANNOUNCE: Version 4.14 released >>> > > >>> > > >>> > > After the upgrade; when I restart MailScanner I get this message: >>> > > >>> > > Latest MAilScanner, RedHat 7.3 all up2date... >>> > > >>> > > Shutting down MailScanner daemons: >>> > > MailScanner: [ OK ] >>> > > incoming sendmail: head: /var/run/sendmail.in.pid: >>> > > No such file or >>> > > directory >>> > > [ OK ] >>> > > outgoing sendmail: [ OK ] >>> > > Starting MailScanner daemons: >>> > > incoming sendmail: [ OK ] >>> > > outgoing sendmail: [ OK ] >>> > > MailScanner: [ OK ] >>> > > >>> > >>> > >>> > >>> >BMRB International >>> >http://www.bmrb.co.uk >>> >+44 (0)20 8566 5000 >>> >_________________________________________________________________ >>> >This message (and any attachment) is intended only for the >>> >recipient and may contain confidential and/or privileged >>> >material. If you have received this in error, please contact the >>> >sender and delete this message immediately. Disclosure, copying >>> >or other action taken in respect of this email or in >>> >reliance on it is prohibited. BMRB International Limited >>> >accepts no liability in relation to any personal emails, or >>> >content of any email which does not directly relate to our >>> >business. >>> >>>-- >>>Julian Field >>>www.MailScanner.info >>>Professional Support Services at www.MailScanner.biz >>>MailScanner thanks transtec Computers for their support >> >>-- >>Julian Field >>www.MailScanner.info >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support >> >>-- >>This message has been scanned for viruses and dangerous >>content by Data Techie, and is believed to be clean. >>Data Techie... always there to protect you! >>http://www.datatechie.com -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From l_candelario at CRC.UPR.CLU.EDU Fri Apr 4 21:59:13 2003 From: l_candelario at CRC.UPR.CLU.EDU (Larry Candelario) Date: Thu Jan 12 21:17:42 2006 Subject: Problems with F-prot working with zipped files Message-ID: Thanks Julian, I had a little mix-up going on, since I was using instructions from the Open WebMail site (which is where I got to know of MailScanner) and those instructions where for the 3.22-10 version, though I did indeed download and install 4.13-3. I decided to delete all directories/files of MailScanner, downloaded/installed 4.14-9 following your instructions for Linux-RPM, and now all four EICAR files are being detected properly. Thanks for the heads-up, Larry Candelario From l_candelario at CRC.UPR.CLU.EDU Fri Apr 4 21:59:13 2003 From: l_candelario at CRC.UPR.CLU.EDU (Larry Candelario) Date: Thu Jan 12 21:17:42 2006 Subject: Problems with F-prot working with zipped files Message-ID: Thanks Julian, I had a little mix-up going on, since I was using instructions from the Open WebMail site (which is where I got to know of MailScanner) and those instructions where for the 3.22-10 version, though I did indeed download and install 4.13-3. I decided to delete all directories/files of MailScanner, downloaded/installed 4.14-9 following your instructions for Linux-RPM, and now all four EICAR files are being detected properly. Thanks for the heads-up, Larry Candelario From brian at UNEARTHED.ORG Fri Apr 4 22:20:53 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:42 2006 Subject: Fw: ANNOUNCE: Version 4.14 released Message-ID: <001701c2faf0$18ebd940$8801020a@brianmay> >From F-Secure's email to me... http://europe.f-secure.com/exclude/download/fsav-wks-4-50-2111.zip Just tested the d/l, and it worked... so there goes! Brian ----- Original Message ----- From: "Julian Field" To: Sent: Friday, April 04, 2003 12:19 PM Subject: Re: ANNOUNCE: Version 4.14 released Virus scanners are a little awkward this weekend. We've got a power-outage on Sunday while they fit a new feed to our big High Voltage Lab, so virtually all my MailScanner development servers are switched off for the weekend. I'll see what I can do to run a test set through it. I can't find F-Secure on their website to download. I managed to find it the other day, but I can't find it now. Can someone mail me the URL of the right download page please? At 20:47 04/04/2003, you wrote: >Julian, > >Yes, I am running the new wrappers... > >Although I have f-secure installed to /usr/local/fsav/ still... I updated >the wrapper to point to /usr/local/fsav/bin > >Brian > >----- Original Message ----- >From: "Julian Field" >To: >Sent: Friday, April 04, 2003 10:59 AM >Subject: Re: ANNOUNCE: Version 4.14 released > > >At 19:29 04/04/2003, you wrote: > >I'm getting this now... > > > >Apr 4 10:24:50 athena MailScanner[28166]: Commercial scanner f-secure >timed > >out! > > > >I didn't have that on the previous version patched.... > >Are you using the new f-secure-wrapper? >If you modified the old one, you may well not have the right one. Check for > /usr/lib/MailScanner/f-secure-wrapper.rpmnew >and rename it over the top of f-secure-wrapper. > >2 or 3 of the wrapper scripts have changed, so make sure you don't have any >.rpmnew files that you aren't using. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Fri Apr 4 22:28:49 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:42 2006 Subject: wish list item (easy one :-) Message-ID: <3E8DCEE1.1257.47CF5347@localhost> Hi Julian, today I was installing a new machine with MS+SA+ZMailer (with my yet to be sufficiently tested queue-fooling scripts). I installed SA in a non-standard place (esp. the rules directories), and found that the SA rules weren't found at all. As the standard spamassassin script _did_ find everything I browsed it and found the following: my $PREFIX = '/usr'; # substituted at 'make' time my $DEF_RULES_DIR = '/app/SpamAssassin/etc/rules/default'; # substituted at 'make' time my $LOCAL_RULES_DIR = '/app/SpamAssassin/etc/rules/local'; # substituted at 'make' time and then... # create the tester factory my $spamtest = new Mail::SpamAssassin ({ rules_filename => $opt{'config-file'}, userprefs_filename => $opt{'prefs-file'}, local_tests_only => $opt{'local'}, debug => defined($opt{'debug-level'}), dont_copy_prefs => ($opt{'create-prefs'} ? 0 : 1), PREFIX => $PREFIX, DEF_RULES_DIR => $DEF_RULES_DIR, LOCAL_RULES_DIR => $LOCAL_RULES_DIR, }); I hardwired this into MailScanner/SA.pm like this: if ($prefs ne "") { $MailScanner::SA::SAspamtest = new Mail::SpamAssassin( {'userprefs_filename' => $prefs, 'PREFIX' => '/usr', 'DEF_RULES_DIR' => '/app/SpamAssassin/etc/rules/default', 'LOCAL_RULES_DIR' => '/app/SpamAssassin/etc/rules/local', 'dont_copy_prefs' => 0 }); } else { $MailScanner::SA::SAspamtest = new Mail::SpamAssassin( {'PREFIX' => '/usr', 'DEF_RULES_DIR' => '/app/SpamAssassin/etc/rules/default', 'LOCAL_RULES_DIR' => '/app/SpamAssassin/etc/rules/local'}); } but it would be nice if you could add a couple of lines to Config.pm and ConfigDefs.pl with some new config variables like SpamAssassin prefix SpamAssassin default rules directory SpamAssassin local rules directory or something like that. If you want, I can modify your latest release and send you the patches... AFAIK, it would only touch three files... -- Mariano Absatz El Baby ---------------------------------------------------------- Late one night in the middle of the day, two dead soldiers got up to fight. Back to back they faced each other, pulled out their swords and shot one another. A deaf policeman heard the noise, got up and shot the twice dead boys. If you don't believe me, ask the blind man who saw it all, through a knothole in a wooden brick wall. From mailscanner at ecs.soton.ac.uk Fri Apr 4 22:40:57 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: wish list item (easy one :-) In-Reply-To: <3E8DCEE1.1257.47CF5347@localhost> Message-ID: <5.2.0.9.2.20030404223947.022cce98@imap.ecs.soton.ac.uk> I obviously should have published these options after all :) There are already 3 undocumented configuration options for setting the location of SpamAssassin. They are: SpamAssassin Local Rules Dir SpamAssassin Default Rules Dir SpamAssassin Install Prefix A combination of those 3 will let you do what you need. At 22:28 04/04/2003, you wrote: >Hi Julian, > >today I was installing a new machine with MS+SA+ZMailer (with my yet to be >sufficiently tested queue-fooling scripts). > >I installed SA in a non-standard place (esp. the rules directories), and >found that the SA rules weren't found at all. As the standard spamassassin >script _did_ find everything I browsed it and found the following: > >my $PREFIX = '/usr'; # substituted at 'make' time >my $DEF_RULES_DIR = '/app/SpamAssassin/etc/rules/default'; # substituted at >'make' time >my $LOCAL_RULES_DIR = '/app/SpamAssassin/etc/rules/local'; # substituted at >'make' time > >and then... > ># create the tester factory > my $spamtest = new Mail::SpamAssassin ({ > rules_filename => $opt{'config-file'}, > userprefs_filename => $opt{'prefs-file'}, > local_tests_only => $opt{'local'}, > debug => defined($opt{'debug-level'}), > dont_copy_prefs => ($opt{'create-prefs'} ? 0 : 1), > PREFIX => $PREFIX, > DEF_RULES_DIR => $DEF_RULES_DIR, > LOCAL_RULES_DIR => $LOCAL_RULES_DIR, > }); > > >I hardwired this into MailScanner/SA.pm like this: > > if ($prefs ne "") { > $MailScanner::SA::SAspamtest = new Mail::SpamAssassin( > {'userprefs_filename' => $prefs, > 'PREFIX' => '/usr', > 'DEF_RULES_DIR' => '/app/SpamAssassin/etc/rules/default', > 'LOCAL_RULES_DIR' => '/app/SpamAssassin/etc/rules/local', > 'dont_copy_prefs' => 0 }); > } else { > $MailScanner::SA::SAspamtest = new Mail::SpamAssassin( > {'PREFIX' => '/usr', > 'DEF_RULES_DIR' => '/app/SpamAssassin/etc/rules/default', > 'LOCAL_RULES_DIR' => '/app/SpamAssassin/etc/rules/local'}); > } > >but it would be nice if you could add a couple of lines to Config.pm and >ConfigDefs.pl with some new config variables like >SpamAssassin prefix >SpamAssassin default rules directory >SpamAssassin local rules directory >or something like that. > >If you want, I can modify your latest release and send you the patches... >AFAIK, it would only touch three files... > > > >-- >Mariano Absatz >El Baby >---------------------------------------------------------- >Late one night in the middle of the day, two dead >soldiers got up to fight. Back to back they faced >each other, pulled out their swords and shot one >another. A deaf policeman heard the noise, got up >and shot the twice dead boys. If you don't believe >me, ask the blind man who saw it all, through a >knothole in a wooden brick wall. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mis at KAYNE.COM Fri Apr 4 22:45:33 2003 From: mis at KAYNE.COM (Joshua Pickering) Date: Thu Jan 12 21:17:42 2006 Subject: MailScanner/Sendmail for Dummies?? Message-ID: <015401c2faf3$8517ed90$fc64a8c0@jp1500> All, I realize that asking for a little help with Sendmail is slightly off-topic for this mailing list. However, I think MailScanner is an excellent product (*big* props to you, Julian) and I see the fact that you have to wrap your head around Sendmail prior to being able to deploy it as being a real Achilles heel to it. I was born in a Windows world and have been steadily making inroads into the land of OpenSource (even deploying my first Samba printserver last week). However, sendmail is a beast - a beast that requires a tremendous amount of knowledge to configure. The guy who wrote Sendmail wrote in the forward to the O'Reilly book that Sendmail is complicated because 'life is complicated.' With all due respect to him, I see that mentality as being one of the biggest obstacles to the OpenSource community. There are plenty of people in my position who would love to be able to work more with OpenSource Technologies, but are significantly hampered by the level of complexity of some of this stuff. The MailScanner.conf file is great - well commented, easy to understand variables and parameters (another tip of the hat to Julian). But the configuration of Sendmail is so convoluted that the configuration file has configuration files (M4)! It's like Vi or Emacs - so arcane! I realize that this type of technology is complicated, but configuring it shouldn't have to be. I wish I wrote code so I could contribute more. However, I think getting the configuration of this stuff to the point so that it's manageable to someone who doesn't have the bandwidth to learn Sendmail will be the key to more widespread adoption of it. I am looking to build a RedHat-based MailScanner/Sendmail/SpamAssassin/VirusScan box that would sit between my T1 and my Exchange server. For those familiar with it, I would be replacing an existing Windows 2000 Server running GFI MailEssentials. All email comes in through the T1, is processed by the MailEssentials box (virus scanning/content filtering, etc.) and is then passed on to the Exchange server. All outgoing mail is passed to the MailEssentials box and delivered from there. I would imagine this to be a fairly common type of configuration, with one of the only major deltas being multiple mail servers. I would like to propose the following (and will even donate webspace to that end) - let's create a repository of common Sendmail configurations, MySQL configurations, MTA configurations (e.g. Exchange Server tips) with the specific goal of facilitating MailScanner deployments. I know this is not a Sendmail list, but I think there must be plenty of people like me who would want to deploy MailScanner but are stopped in their tracks by the formidable task of configuring Sendmail. I would even be open to writing and hosting a 'MailScanner for Dummies' type website. The docs on the MailScanner site are a great place to start but, IMHO, have some holes that need to be filled. I'd like to help out for the common cause in any way I can. Anyway, it's just an idea. I'm not trying to make any enemies here - I genuinely want to help out. Your comments and thoughts are welcomed. And, if anyone has any good recommendations for books or sites that help simplify the configuration of Sendmail, I'm all ears (or eyes). Thanks, Joshua Pickering -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030404/af5f142e/attachment.html From mailscanner at ecs.soton.ac.uk Fri Apr 4 23:05:44 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: MailScanner/Sendmail for Dummies?? In-Reply-To: <015401c2faf3$8517ed90$fc64a8c0@jp1500> Message-ID: <5.2.0.9.2.20030404230015.0266c678@imap.ecs.soton.ac.uk> To get you started with sendmail, make sure you have both the "sendmail" RPM and the "sendmail-cf" RPM. Save a copy of your /etc/mail/sendmail.mc, and use this instead: divert(-1) divert(0)dnl VERSIONID(`@(#)Client.mc (Jules) 22/7/99') # # JKF These are the only things you need to change # define(`SMTPserver', exchange.yourdomain.com) OSTYPE(linux) # JKF Leave the rest of this alone define(`confDONT_INIT_GROUPS', `True') FEATURE(nullclient, SMTPserver) Put this in /etc/mail/sendmail.mc. Then put a line in /etc/mail/access like this: yourdomain.com RELAY Then do this: cd /etc/mail make which will build new versions of the config files for you. Then you should find that your sendmail will relay mail from the outside world onto your Exchange server. Once all that is working nicely, set about installing MailScanner. At 22:45 04/04/2003, you wrote: >All, > >I realize that asking for a little help with Sendmail is slightly >off-topic for this mailing list. However, I think MailScanner is an >excellent product (*big* props to you, Julian) and I see the fact that you >have to wrap your head around Sendmail prior to being able to deploy it as >being a real Achilles heel to it. I was born in a Windows world and have >been steadily making inroads into the land of OpenSource (even deploying >my first Samba printserver last week). However, sendmail is a beast - a >beast that requires a tremendous amount of knowledge to configure. The >guy who wrote Sendmail wrote in the forward to the O'Reilly book that >Sendmail is complicated because 'life is complicated.' With all due >respect to him, I see that mentality as being one of the biggest obstacles >to the OpenSource community. There are plenty of people in my position >who would love to be able to work more with OpenSource Technologies, but >are significantly hampered by the level of complexity of some of this >stuff. The MailScanner.conf file is great - well commented, easy to >understand variables and parameters (another tip of the hat to >Julian). But the configuration of Sendmail is so convoluted that the >configuration file has configuration files (M4)! It's like Vi or Emacs - >so arcane! I realize that this type of technology is complicated, but >configuring it shouldn't have to be. I wish I wrote code so I could >contribute more. However, I think getting the configuration of this stuff >to the point so that it's manageable to someone who doesn't have the >bandwidth to learn Sendmail will be the key to more widespread adoption of it. > >I am looking to build a RedHat-based >MailScanner/Sendmail/SpamAssassin/VirusScan box that would sit between my >T1 and my Exchange server. For those familiar with it, I would be >replacing an existing Windows 2000 Server running GFI MailEssentials. All >email comes in through the T1, is processed by the MailEssentials box >(virus scanning/content filtering, etc.) and is then passed on to the >Exchange server. All outgoing mail is passed to the MailEssentials box >and delivered from there. I would imagine this to be a fairly common type >of configuration, with one of the only major deltas being multiple mail >servers. > >I would like to propose the following (and will even donate webspace to >that end) - let's create a repository of common Sendmail configurations, >MySQL configurations, MTA configurations (e.g. Exchange Server tips) with >the specific goal of facilitating MailScanner deployments. I know this is >not a Sendmail list, but I think there must be plenty of people like me >who would want to deploy MailScanner but are stopped in their tracks by >the formidable task of configuring Sendmail. I would even be open to >writing and hosting a 'MailScanner for Dummies' type website. The docs on >the MailScanner site are a great place to start but, IMHO, have some holes >that need to be filled. I'd like to help out for the common cause in any >way I can. > >Anyway, it's just an idea. I'm not trying to make any enemies here - I >genuinely want to help out. Your comments and thoughts are >welcomed. And, if anyone has any good recommendations for books or sites >that help simplify the configuration of Sendmail, I'm all ears (or eyes). > >Thanks, > >Joshua Pickering -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030404/717fd0e0/attachment.html From mailscanner at LISTS.COM.AR Fri Apr 4 23:09:24 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:42 2006 Subject: wish list item (easy one :-) In-Reply-To: <5.2.0.9.2.20030404223947.022cce98@imap.ecs.soton.ac.uk> References: <3E8DCEE1.1257.47CF5347@localhost> Message-ID: <3E8DD864.7667.47F47B6E@localhost> El 4 Apr 2003 a las 22:40, Julian Field escribi?: > I obviously should have published these options after all :) Gee... I didn't see it 'cause I was working based on 4.13 (I try to develop over latest public release and not over beta, so I only debug my own errors)... since you just release 4-14 and it has this one thing I want, seems like I'll be forward-porting my mods this weekend... Great work, Julian! BTW, the guy working on the _real_ ZMailer port is advancing faster than I am, so maybe I'll be dropping my code soon... he was based on 4-14-3 or something like that, and he'll probably be forward-porting to 4-14-9 next week. Have a nice weekend. > > There are already 3 undocumented configuration options for setting the > location of SpamAssassin. They are: > SpamAssassin Local Rules Dir > SpamAssassin Default Rules Dir > SpamAssassin Install Prefix > A combination of those 3 will let you do what you need. > > At 22:28 04/04/2003, you wrote: > >Hi Julian, > > > >today I was installing a new machine with MS+SA+ZMailer (with my yet to be > >sufficiently tested queue-fooling scripts). > > > >I installed SA in a non-standard place (esp. the rules directories), and > >found that the SA rules weren't found at all. As the standard spamassassin > >script _did_ find everything I browsed it and found the following: > > > >my $PREFIX = '/usr'; # substituted at 'make' time > >my $DEF_RULES_DIR = '/app/SpamAssassin/etc/rules/default'; # substituted at > >'make' time > >my $LOCAL_RULES_DIR = '/app/SpamAssassin/etc/rules/local'; # substituted at > >'make' time > > > >and then... > > > ># create the tester factory > > my $spamtest = new Mail::SpamAssassin ({ > > rules_filename => $opt{'config-file'}, > > userprefs_filename => $opt{'prefs-file'}, > > local_tests_only => $opt{'local'}, > > debug => defined($opt{'debug-level'}), > > dont_copy_prefs => ($opt{'create-prefs'} ? 0 : 1), > > PREFIX => $PREFIX, > > DEF_RULES_DIR => $DEF_RULES_DIR, > > LOCAL_RULES_DIR => $LOCAL_RULES_DIR, > > }); > > > > > >I hardwired this into MailScanner/SA.pm like this: > > > > if ($prefs ne "") { > > $MailScanner::SA::SAspamtest = new Mail::SpamAssassin( > > {'userprefs_filename' => $prefs, > > 'PREFIX' => '/usr', > > 'DEF_RULES_DIR' => '/app/SpamAssassin/etc/rules/default', > > 'LOCAL_RULES_DIR' => '/app/SpamAssassin/etc/rules/local', > > 'dont_copy_prefs' => 0 }); > > } else { > > $MailScanner::SA::SAspamtest = new Mail::SpamAssassin( > > {'PREFIX' => '/usr', > > 'DEF_RULES_DIR' => '/app/SpamAssassin/etc/rules/default', > > 'LOCAL_RULES_DIR' => '/app/SpamAssassin/etc/rules/local'}); > > } > > > >but it would be nice if you could add a couple of lines to Config.pm and > >ConfigDefs.pl with some new config variables like > >SpamAssassin prefix > >SpamAssassin default rules directory > >SpamAssassin local rules directory > >or something like that. > > > >If you want, I can modify your latest release and send you the patches... > >AFAIK, it would only touch three files... > > -- Mariano Absatz El Baby ---------------------------------------------------------- Why should I care about posterity? What's posterity ever done for me? -- Groucho Marx From mailscanner at LISTS.COM.AR Fri Apr 4 23:24:56 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:42 2006 Subject: [O/T] Re: MailScanner/Sendmail for Dummies?? In-Reply-To: <015401c2faf3$8517ed90$fc64a8c0@jp1500> Message-ID: <3E8DDC08.29816.4802B440@localhost> El 4 Apr 2003 a las 13:45, Joshua Pickering escribi?: > All, > > I realize that asking for a little help with Sendmail is slightly > off-topic for this mailing list. However, I think MailScanner is an > excellent product (*big* props to you, Julian) and I see the fact that > you have to wrap your head around Sendmail prior to being able to deploy > it as being a real Achilles heel to it. I was born in a Windows world > and have been steadily making inroads into the land of OpenSource (even > deploying my first Samba printserver last week). However, sendmail is a > beast - a beast that requires a tremendous amount of knowledge to > configure. The guy who wrote Sendmail wrote in the forward to the > O'Reilly book that Sendmail is complicated because 'life is > complicated.' With all due respect to him, I see that mentality as > being one of the biggest obstacles to the OpenSource community. There Well... with all due respect to sendmail _and_ Eric Allman, you shouldn't take it as an open source reference... The problem with sendmail is not that it's open source... the problems are that 1) it's _very_ old, 2) it tries to do awfully many things... In fact, as he says in the bat book preface, he made the configuration flexible to adapt to the rapidly changing protocol scene of the 1980's... Well, for about a decade, the mail protocol scene has calmed down... there's little inter-domain mail away from SMTP/ESMTP, so, unless you are still using islands of UUCP, BITNET or some other archaic mail protocol/infrastructure, you should choose another mail server... or be prepare to study. I myself use another old (but not-so-old) mail server that also handles UUCP and other protocols (http://ZMailer.org), but I wouldn't recommend it to anyone that doesn't want to study a lot (even read C code). If you are up to using an open source mail server, I would suggest either Postfix or qmail. If you are in a plain SMTP world (as most of us are), both are really powerful, better engineered than sendmail (learnt from its mistakes), faster and _really_ easier to learn. I guess Exim also falls in this category, but I never used it... in fact, it _has_ to be easier than sendmail... almost _any_ server is easier to configure than sendmail... The fact that "life is complicated" is a problem if you want to model life... but modelling a mail environment (given you don't live in the 1980's) is usually easier than life :-) If you want to use MailScanner you should either use a plain vanilla rpm sendmail configuration or opt for Exim... If you want to see good, clean, open source software, stay away from sendmail (or bind, for that matter, another old beast). > are plenty of people in my position who would love to be able to work > more with OpenSource Technologies, but are significantly hampered by the > level of complexity of some of this stuff. The MailScanner.conf file is > great - well commented, easy to understand variables and parameters > (another tip of the hat to Julian). But the configuration of Sendmail > is so convoluted that the configuration file has configuration files > (M4)! It's like Vi or Emacs - so arcane! I realize that this type of > technology is complicated, but configuring it shouldn't have to be. I > wish I wrote code so I could contribute more. However, I think getting > the configuration of this stuff to the point so that it's manageable to > someone who doesn't have the bandwidth to learn Sendmail will be the key > to more widespread adoption of it. > > I am looking to build a RedHat-based > MailScanner/Sendmail/SpamAssassin/VirusScan box that would sit between > my T1 and my Exchange server. For those familiar with it, I would be > replacing an existing Windows 2000 Server running GFI MailEssentials. > All email comes in through the T1, is processed by the MailEssentials > box (virus scanning/content filtering, etc.) and is then passed on to > the Exchange server. All outgoing mail is passed to the MailEssentials > box and delivered from there. I would imagine this to be a fairly > common type of configuration, with one of the only major deltas being > multiple mail servers. > > I would like to propose the following (and will even donate webspace to > that end) - let's create a repository of common Sendmail configurations, > MySQL configurations, MTA configurations (e.g. Exchange Server tips) > with the specific goal of facilitating MailScanner deployments. I know > this is not a Sendmail list, but I think there must be plenty of people > like me who would want to deploy MailScanner but are stopped in their > tracks by the formidable task of configuring Sendmail. I would even be > open to writing and hosting a 'MailScanner for Dummies' type website. > The docs on the MailScanner site are a great place to start but, IMHO, > have some holes that need to be filled. I'd like to help out for the > common cause in any way I can. > > Anyway, it's just an idea. I'm not trying to make any enemies here - I > genuinely want to help out. Your comments and thoughts are welcomed. > And, if anyone has any good recommendations for books or sites that help > simplify the configuration of Sendmail, I'm all ears (or eyes). > > Thanks, > > Joshua Pickering > > > -- Mariano Absatz El Baby ---------------------------------------------------------- Your e-mail has been returned due to insufficient voltage. From mike at CAMAROSS.NET Fri Apr 4 23:49:56 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:42 2006 Subject: MailScanner/Sendmail for Dummies?? In-Reply-To: <5.2.0.9.2.20030404230015.0266c678@imap.ecs.soton.ac.uk> Message-ID: <011201c2fafc$84942880$af01a8c0@home.middlefinger.net> After you make the modifications to /etc/mail/sendmail.mc , don't forget to run "m4 /etc/mail/sendmail.mc > /etc/sendmail.cf" to generate your new /etc/sendmail.cf Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Friday, April 04, 2003 4:06 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: MailScanner/Sendmail for Dummies?? To get you started with sendmail, make sure you have both the "sendmail" RPM and the "sendmail-cf" RPM. Save a copy of your /etc/mail/sendmail.mc, and use this instead: divert(-1) divert(0)dnl VERSIONID(`@(#)Client.mc (Jules) 22/7/99') # # JKF These are the only things you need to change # define(`SMTPserver', exchange.yourdomain.com) OSTYPE(linux) # JKF Leave the rest of this alone define(`confDONT_INIT_GROUPS', `True') FEATURE(nullclient, SMTPserver) Put this in /etc/mail/sendmail.mc. Then put a line in /etc/mail/access like this: yourdomain.com RELAY Then do this: cd /etc/mail make which will build new versions of the config files for you. Then you should find that your sendmail will relay mail from the outside world onto your Exchange server. Once all that is working nicely, set about installing MailScanner. At 22:45 04/04/2003, you wrote: All, I realize that asking for a little help with Sendmail is slightly off-topic for this mailing list. However, I think MailScanner is an excellent product (*big* props to you, Julian) and I see the fact that you have to wrap your head around Sendmail prior to being able to deploy it as being a real Achilles heel to it. I was born in a Windows world and have been steadily making inroads into the land of OpenSource (even deploying my first Samba printserver last week). However, sendmail is a beast - a beast that requires a tremendous amount of knowledge to configure. The guy who wrote Sendmail wrote in the forward to the O'Reilly book that Sendmail is complicated because 'life is complicated.' With all due respect to him, I see that mentality as being one of the biggest obstacles to the OpenSource community. There are plenty of people in my position who would love to be able to work more with OpenSource Technologies, but are significantly hampered by the level of complexity of some of this stuff. The MailScanner.conf file is great - well commented, easy to understand variables and parameters (another tip of the hat to Julian). But the configuration of Sendmail is so convoluted that the configuration file has configuration files (M4)! It's like Vi or Emacs - so arcane! I realize that this type of technology is complicated, but configuring it shouldn't have to be. I wish I wrote code so I could contribute more. However, I think getting the configuration of this stuff to the point so that it's manageable to someone who doesn't have the bandwidth to learn Sendmail will be the key to more widespread adoption of it. I am looking to build a RedHat-based MailScanner/Sendmail/SpamAssassin/VirusScan box that would sit between my T1 and my Exchange server. For those familiar with it, I would be replacing an existing Windows 2000 Server running GFI MailEssentials. All email comes in through the T1, is processed by the MailEssentials box (virus scanning/content filtering, etc.) and is then passed on to the Exchange server. All outgoing mail is passed to the MailEssentials box and delivered from there. I would imagine this to be a fairly common type of configuration, with one of the only major deltas being multiple mail servers. I would like to propose the following (and will even donate webspace to that end) - let's create a repository of common Sendmail configurations, MySQL configurations, MTA configurations (e.g. Exchange Server tips) with the specific goal of facilitating MailScanner deployments. I know this is not a Sendmail list, but I think there must be plenty of people like me who would want to deploy MailScanner but are stopped in their tracks by the formidable task of configuring Sendmail. I would even be open to writing and hosting a 'MailScanner for Dummies' type website. The docs on the MailScanner site are a great place to start but, IMHO, have some holes that need to be filled. I'd like to help out for the common cause in any way I can. Anyway, it's just an idea. I'm not trying to make any enemies here - I genuinely want to help out. Your comments and thoughts are welcomed. And, if anyone has any good recommendations for books or sites that help simplify the configuration of Sendmail, I'm all ears (or eyes). Thanks, Joshua Pickering -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From joe at QITC.CO.UK Sat Apr 5 02:18:56 2003 From: joe at QITC.CO.UK (Joe Quinn) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released References: <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> Message-ID: <013f01c2fb11$54c7ef00$ac720550@T20> I tried these suggestions but the RaQ has a problem that can wait till morning :-( Joe Quinn www.qitc.net ----- Original Message ----- From: "Julian Field" To: Sent: Friday, April 04, 2003 7:00 PM Subject: Re: ANNOUNCE: Version 4.14 released At 17:20 04/04/2003, you wrote: >I got that too, but I manually deleted var/run/sendmail*, killed all the >sendmail processes then it was fine (although thinking on it now I'm not >sure it was necessary). I think maybe the sendmail.in.pid is new for this >version so the new init script couldn't find it because when you started >it (with the old version) it wasn't created. Yes, that's it. The restart tries to kill the old sendmail processes using the new pid file which won't exist yet. This will only occur once. You could avoid it by stopping the old MailScanner before upgrading to the new one. > > -----Original Message----- > > From: Brian May [mailto:brian@UNEARTHED.ORG] > > Sent: 04 April 2003 17:11 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: [MAILSCANNER] ANNOUNCE: Version 4.14 released > > > > > > After the upgrade; when I restart MailScanner I get this message: > > > > Latest MAilScanner, RedHat 7.3 all up2date... > > > > Shutting down MailScanner daemons: > > MailScanner: [ OK ] > > incoming sendmail: head: /var/run/sendmail.in.pid: > > No such file or > > directory > > [ OK ] > > outgoing sendmail: [ OK ] > > Starting MailScanner daemons: > > incoming sendmail: [ OK ] > > outgoing sendmail: [ OK ] > > MailScanner: [ OK ] > > > > > >BMRB International >http://www.bmrb.co.uk >+44 (0)20 8566 5000 >_________________________________________________________________ >This message (and any attachment) is intended only for the >recipient and may contain confidential and/or privileged >material. If you have received this in error, please contact the >sender and delete this message immediately. Disclosure, copying >or other action taken in respect of this email or in >reliance on it is prohibited. BMRB International Limited >accepts no liability in relation to any personal emails, or >content of any email which does not directly relate to our >business. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Sat Apr 5 03:54:53 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:42 2006 Subject: languages.conf Message-ID: <3E8E1B4D.8144.48F9DC03@localhost> Hi, I started using the Spanish translations in my test environment and found a couple of problems... All the mailers I have (Pegasus & Outlook for windows, plain old "mail" and elm for linux) don't correctly interpret MIME header encoding for unknown headers (e.g. X-MailScanner-SpamCheck:), so they look awful when they are encoded... This doesn't lead to a clear solution, since you _do_ have to encode 8 bit headers, but I was wondering: Do all texts that go into headers come from the languages.conf file? Do all texts that are in the languages.conf file go into headers? If both are true, at least in Spanish, I could edit them so they _don't_ have 8 bit characters, either by using other words or by, like in pre-MIME times replacing accented characters (or the infamous "?") by non-accented characters. If one of the premises is not true, could you identify which are the words/phrases that go into the headers? Another one: shouldn't these settings (in MailScanner.conf) be commented out? and be defaulted from language.conf entries? This would help towards internationalization... obviously, if entries in MailScanner.conf would override the defaults: Clean Header Value = Found to be clean Infected Header Value = Found to be infected Disinfected Header Value = Disinfected Information Header Value = Please contact the ISP for more information -- Mariano Absatz El Baby ---------------------------------------------------------- I write all my critical routines in assembler, and my comedy routines in FORTRAN. -- Anonymous From dh at UPTIME.AT Sat Apr 5 12:33:45 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:42 2006 Subject: [O/T] Re: MailScanner/Sendmail for Dummies?? In-Reply-To: <3E8DDC08.29816.4802B440@localhost> Message-ID: <7638EEAA-675A-11D7-A71D-000393920D6C@uptime.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 On Samstag, April 5, 2003, at 12:24 Uhr, Mariano Absatz wrote: > If you are up to using an open source mail server, I would suggest > either > Postfix or qmail. If you are in a plain SMTP world (as most of us > are), both > are really powerful, better engineered than sendmail (learnt from its > mistakes), faster and _really_ easier to learn. ?????????? ..and as always use the right tools for your specific setup. Even though I can agree with most parts we still use sendmail, why? Because with our specific load and the amount of data we pass in our specific setup every other MTA we tested choked and only sendmail chose to happily run through the peek hours. so be prepared to do a lot of testing and just on a personal account, sendmail can be made pretty secure even though it can be a kludge as well ;) - -d - - Face me and you shall surely perish. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+jr8fiW/Ta/pxHPQRA8RdAKCZvggV9rqTWxagNBK+kJ+UZ9W7GwCdGE6p E/mszNlBx/Djvmh82Nkh198= =46xQ -----END PGP SIGNATURE----- From mike at ZANKER.ORG Sat Apr 5 07:23:17 2003 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:17:42 2006 Subject: MailScanner/Sendmail for Dummies?? In-Reply-To: <011201c2fafc$84942880$af01a8c0@home.middlefinger.net> References: <011201c2fafc$84942880$af01a8c0@home.middlefinger.net> Message-ID: <115697843.1049527397@jemima.zanker.org> On 04 April 2003 16:49 -0600 Mike Kercher wrote: > After you make the modifications to /etc/mail/sendmail.mc , don't > forget to run "m4 /etc/mail/sendmail.mc > /etc/sendmail.cf" to > generate your new /etc/sendmail.cf That depends on the version of Red Hat being used. From 8.0 onwards sendmail.cf moved to /etc/mail and will be made from sendmail.mc by running "make" in that directory. Previous Red Hat versions (and the new Enterprise products) will need m4 running manually, as you said. Mike. From mailscanner at ecs.soton.ac.uk Sat Apr 5 13:48:24 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <013f01c2fb11$54c7ef00$ac720550@T20> References: <5.2.0.9.2.20030404185900.02203cd8@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030405134724.02494830@imap.ecs.soton.ac.uk> Shutdown all the sendmail processes before starting MailScanner for the first time. /etc/rc.d/init.d/sendmail stop then ps ax | grep -i mail and kill any leftovers. Then when you start MailScanner it should work. At 02:18 05/04/2003, you wrote: >I tried these suggestions but the RaQ has a problem that can wait till morning > >:-( > >Joe Quinn >www.qitc.net > >----- Original Message ----- >From: "Julian Field" >To: >Sent: Friday, April 04, 2003 7:00 PM >Subject: Re: ANNOUNCE: Version 4.14 released > > >At 17:20 04/04/2003, you wrote: > >I got that too, but I manually deleted var/run/sendmail*, killed all the > >sendmail processes then it was fine (although thinking on it now I'm not > >sure it was necessary). I think maybe the sendmail.in.pid is new for this > >version so the new init script couldn't find it because when you started > >it (with the old version) it wasn't created. > >Yes, that's it. The restart tries to kill the old sendmail processes using >the new pid file which won't exist yet. >This will only occur once. You could avoid it by stopping the old >MailScanner before upgrading to the new one. > > > > > -----Original Message----- > > > From: Brian May [mailto:brian@UNEARTHED.ORG] > > > Sent: 04 April 2003 17:11 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: [MAILSCANNER] ANNOUNCE: Version 4.14 released > > > > > > > > > After the upgrade; when I restart MailScanner I get this message: > > > > > > Latest MAilScanner, RedHat 7.3 all up2date... > > > > > > Shutting down MailScanner daemons: > > > MailScanner: [ OK ] > > > incoming sendmail: head: /var/run/sendmail.in.pid: > > > No such file or > > > directory > > > [ OK ] > > > outgoing sendmail: [ OK ] > > > Starting MailScanner daemons: > > > incoming sendmail: [ OK ] > > > outgoing sendmail: [ OK ] > > > MailScanner: [ OK ] > > > > > > > > > > >BMRB International > >http://www.bmrb.co.uk > >+44 (0)20 8566 5000 > >_________________________________________________________________ > >This message (and any attachment) is intended only for the > >recipient and may contain confidential and/or privileged > >material. If you have received this in error, please contact the > >sender and delete this message immediately. Disclosure, copying > >or other action taken in respect of this email or in > >reliance on it is prohibited. BMRB International Limited > >accepts no liability in relation to any personal emails, or > >content of any email which does not directly relate to our > >business. > >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From jaearick at COLBY.EDU Sat Apr 5 14:07:32 2003 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:17:42 2006 Subject: SAVI-Perl-0.15 doesn't like Sun's compiler In-Reply-To: <5.2.0.9.2.20030404164708.02c673c0@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030404164708.02c673c0@imap.ecs.soton.ac.uk> Message-ID: Julian, Paul Henson has provided me with a fix to this problem for SAVI-Perl-0.15, so (maybe) he might put out a new version in the near future. I also suggested that he have the Makefile.PL query for the sophos install location. Suggestion: add step 6 of http://www.sng.ecs.soton.ac.uk/mailscanner/install/SAVI.shtml to the Sophos.install script, if you haven't already done it. Thanks. --- Jeff Earickson From mailscanner at ecs.soton.ac.uk Sat Apr 5 14:23:06 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: SAVI-Perl-0.15 doesn't like Sun's compiler In-Reply-To: References: <5.2.0.9.2.20030404164708.02c673c0@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030404164708.02c673c0@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030405142248.02671e18@imap.ecs.soton.ac.uk> At 14:07 05/04/2003, you wrote: > Suggestion: add step 6 of >http://www.sng.ecs.soton.ac.uk/mailscanner/install/SAVI.shtml >to the Sophos.install script, if you haven't already done it. Good idea. Done. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sat Apr 5 15:21:50 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: MailScanner 4.14 on RaQ3 Message-ID: <5.2.0.9.2.20030405151449.039a34e8@imap.ecs.soton.ac.uk> If you are having trouble getting MailScanner 4.14 started/stopped on a RaQ3 system, replace /etc/rc.d/init.d/MailScanner with the file at http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/etc-rc.d-init.d-MailScanner.RaQ3 This does not apply to RaQ4 systems or anything newer than that. (It is caused by RaQ3 systems running sendmail 8.9.3) -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From scouty at BROMBERG.DEMON.NL Sat Apr 5 22:37:50 2003 From: scouty at BROMBERG.DEMON.NL (Matthijs Althoff) Date: Thu Jan 12 21:17:42 2006 Subject: "spamassassin" redhat 9 mailscanner Message-ID: my setup: OS : Redhat 9 Sendmail : 8.12.8/8.12.8 (rpm) MailScanner : 4.14.9 (rpm) Spamassassin : 2.53 (rpm) Tonight I have upgraded my Redhat 8 box to 9. The update process wend smooth with hardly problems worth mentioning. The only odd thing I found was that spamassassin was set back to 2.44 which comes with RedHat 9 and had overwritten my custom 2.52 on the system. I have de-installed the RPM cleanup files hanging on the system and installed the 2.53 rpm. The problem is that MailScanner is not starting with "Use SpamAssassin = yes" this is what the log shows.. Apr 5 23:14:38 bromberg MailScanner[10491]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 5 23:14:48 bromberg MailScanner[10495]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... and on and on and on and on and on and on and on and on... When I set "Use SpamAssassin = no" MailScanner starts fine MailScanner[10696]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... MailScanner[10696]: Using locktype = flock MailScanner[10700]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... MailScanner[10700]: Using locktype = flock but of course without spamassassin checks.. I have downgraded to 2.52 but this does not solve the problem. I have completely removed everything down to MailScanner, spamassassin and sendmail but have no clue where to look now.. From donovan at HUFFDATASYSTEMS.COM Sun Apr 6 07:59:24 2003 From: donovan at HUFFDATASYSTEMS.COM (Donovan Huff | HUFF DATA SYSTEMS) Date: Thu Jan 12 21:17:42 2006 Subject: Score is -35 but it is still marked as s p a m, why? Message-ID: <00fa01c2fc0a$100068d0$34c75a42@x27> I am wondering why messages marked with a score such as -35 are tagged as s p a m in the subject line when the required as 5 and all the header information says it is not s p a m, I have attached the message. I've had this issue several times and with different MailScanner versions. Regards, Donovan Huff Owner/Operator HUFF DATA SYSTEMS donovan@huffdatasystems.com http://www.huffdatasystems.com/ (361) 781-0631 ------------------------------------------------------ Web Hosting Starting at $5.00/mo http://www.huffdatasystems.com/ ------------------------------------------------------ -------------- next part -------------- An embedded message was scrubbed... From: Lewis Bergman Subject: Re: {Spam?} RE: [Motorola] Adjacent towers causing multipath/high noise? Date: Fri, 4 Apr 2003 18:40:37 -0600 Size: 2382 Url: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030406/ebd66f47/Re_Spam_RE_MotorolaAdjacenttowerscausingmultipath_highnoise_.eml From SJCJonker at SJC.NL Sun Apr 6 08:58:10 2003 From: SJCJonker at SJC.NL (Stijn Jonker) Date: Thu Jan 12 21:17:42 2006 Subject: Logging and high score spam email Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all, With the recent gtube sig on the maillinglist i noticed something strange. The message was nowhere to find an no log message or so. So i decided to finally do some testing. From an external account i send myself an email message with the gtube signature. In the attachment is an snippet of my log, it only list logging from the one email with the gtube signature. My settings: High SpamAssassin Score = 100 High Scoring Spam Actions = store Is it correct that it doesn't log anything to syslog? Maybe i missed a config options somewhere. On all other Mailscanner actions it always reports a final action like: "Uninfected delivered X messages" (Or cleaned etc etc) If it's nothing i missed maybe it is an idea to log a message when the high spam score is reached and what action is taken? Something like: Message is High score spam: For your info the following version details: MailScanner 4.14-9 Sendmail 8.11.6 (with fixes) Linux RH7.3 all patches Perl 5.6.1 let me know anybody needs more info. - -- Met Vriendelijke groet/Yours Sincerely Stijn Jonker -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE+j94UjU9r45tKnOARAiURAJ9JQbNRkNCqWuh21jzQucAdRtoBEgCgnqvD 1no5B3S/RI7TWfnhZ076qMY= =krgu -----END PGP SIGNATURE----- -------------- next part -------------- Apr 6 09:40:32 ph-dmz-01 sendmail[18093]: h367eLg18081: to=, delay=00:00:11, xdelay=00:00:00, mailer=esmtp, pri=120978, relay=smtp-final.sjc.nl. [192.168.175.101], dsn=2.0.0, stat=Sent (Ok: queued as 0DD091581D) Apr 6 09:43:07 ph-dmz-01 sendmail[18210]: h367h7g18210: from=, size=1039, class=0, nrcpts=1, msgid=<200304060743.h367h68i063567@xs1.xs4all.nl>, proto=ESMTP, daemon=MTA, relay=pd-zf-01.sjc.nl [192.168.253.254] Apr 6 09:43:07 ph-dmz-01 sendmail[18210]: h367h7g18210: to=, delay=00:00:00, mailer=esmtp, pri=31039, stat=queued Apr 6 09:43:11 ph-dmz-01 MailScanner[17873]: New Batch: Scanning 1 messages, 1468 bytes Apr 6 09:43:12 ph-dmz-01 MailScanner[17873]: Spam Checks: Found 1 spam messages Apr 6 09:43:12 ph-dmz-01 MailScanner[17873]: Virus and Content Scanning: Starting From so-mlist-alias at all-about-shift.com Sun Apr 6 10:42:56 2003 From: so-mlist-alias at all-about-shift.com (Soeren Gerlach) Date: Thu Jan 12 21:17:42 2006 Subject: Question regarding the Message.pm in lib/MailScanner Message-ID: <200304061142.56699.so-mlist-alias@all-about-shift.com> This one goes probably direct to Julian, as he might know best about it ,-)) I added a new function to CustomConfig.pm to get some extended logging about spam and virus for each mail. Although I found the information about spam quite easy for viruses it simply overwhelmed me, whats available in the message object ,-)) What is the appropriate hash or array to look at If I simply wan to know what's the name of the virus, if one has been found? Thanks & regards, Soeren Gerlach From scouty at BROMBERG.DEMON.NL Sun Apr 6 11:42:20 2003 From: scouty at BROMBERG.DEMON.NL (Matthijs Althoff) Date: Thu Jan 12 21:17:42 2006 Subject: "spamassassin" redhat 9 mailscanner Message-ID: On Sat, 5 Apr 2003 22:37:50 +0100, Matthijs Althoff wrote: >The problem is that MailScanner is not starting with "Use SpamAssassin >= yes" this is what the log shows.. I have removed spamassassin 2.53 and installed the standard 2.44 which comes with From mailscanner at ecs.soton.ac.uk Sun Apr 6 11:42:46 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: "spamassassin" redhat 9 mailscanner In-Reply-To: Message-ID: <5.2.0.9.2.20030406114154.024c2ec8@imap.ecs.soton.ac.uk> The RPM is installing SpamAssassin in a location where Perl can't find it. Build SpamAssassin from source (ie the .tar.gz distribution) instead. At 22:37 05/04/2003, you wrote: >my setup: > >OS : Redhat 9 >Sendmail : 8.12.8/8.12.8 (rpm) >MailScanner : 4.14.9 (rpm) >Spamassassin : 2.53 (rpm) > >Tonight I have upgraded my Redhat 8 box to 9. The update process wend >smooth with hardly problems worth mentioning. The only odd thing I found >was that spamassassin was set back to 2.44 which comes with RedHat 9 and >had overwritten my custom 2.52 on the system. I have de-installed the RPM >cleanup files hanging on the system and installed the 2.53 rpm. > >The problem is that MailScanner is not starting with "Use SpamAssassin >= yes" this is what the log shows.. > >Apr 5 23:14:38 bromberg MailScanner[10491]: >MailScanner E-Mail Virus Scanner version 4.14-9 starting... >Apr 5 23:14:48 bromberg MailScanner[10495]: >MailScanner E-Mail Virus Scanner version 4.14-9 starting... >and on and on and on and on and on and on and on and on... > >When I set "Use SpamAssassin = no" MailScanner starts fine > >MailScanner[10696]: MailScanner E-Mail Virus Scanner version 4.14-9 >starting... >MailScanner[10696]: Using locktype = flock >MailScanner[10700]: MailScanner E-Mail Virus Scanner version 4.14-9 >starting... >MailScanner[10700]: Using locktype = flock > >but of course without spamassassin checks.. I have downgraded to 2.52 but >this does not solve the problem. I have completely removed everything down >to MailScanner, spamassassin and sendmail but have no clue where to >look now.. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From scouty at BROMBERG.DEMON.NL Sun Apr 6 11:43:33 2003 From: scouty at BROMBERG.DEMON.NL (Matthijs Althoff) Date: Thu Jan 12 21:17:42 2006 Subject: "spamassassin" redhat 9 mailscanner Message-ID: On Sat, 5 Apr 2003 22:37:50 +0100, Matthijs Althoff wrote: ooops pressed the wrong button >The problem is that MailScanner is not starting with "Use SpamAssassin >= yes" this is what the log shows.. I have removed spamassassin 2.53 and installed the standard 2.44 which comes with RedHat 9 and it starts again. It seems the problems lays within MailScanner and the spamassassin rpm from spassassin.org.. From mailscanner at ecs.soton.ac.uk Sun Apr 6 11:52:50 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: Score is -35 but it is still marked as s p a m, why? In-Reply-To: <00fa01c2fc0a$100068d0$34c75a42@x27> Message-ID: <5.2.0.9.2.20030406115108.02690f00@imap.ecs.soton.ac.uk> What version of Perl are you running? There is a Perl bug somewhere around this code, I had to write it the way I did because Perl was getting arithmetic comparison wrong sometimes. What version of MailScanner are you running? At 07:59 06/04/2003, you wrote: >I am wondering why messages marked with a score such as -35 are tagged as >s p a m in the subject line when the required as 5 and all >the header information says it is not s p a m, I have attached the >message. I've had this issue several times and with different >MailScanner versions. > > >Regards, > >Donovan Huff >Owner/Operator >HUFF DATA SYSTEMS >donovan@huffdatasystems.com >http://www.huffdatasystems.com/ >(361) 781-0631 > >------------------------------------------------------ >Web Hosting Starting at $5.00/mo >http://www.huffdatasystems.com/ >------------------------------------------------------ > >Return-Path: >Received: from core.huffdatasystems.net (root@localhost) > by huffdatasystems.com (8.11.6/8.11.6) with ESMTP id h350nqp27062 > for ; Fri, 4 Apr 2003 18:49:52 -0600 >X-ClientAddr: 198.63.203.3 >Received: from part-15.org (mail.midconqc.com [198.63.203.3]) > by core.huffdatasystems.net (8.11.6/8.11.6) with SMTP id h350nlg27050 > for ; Fri, 4 Apr 2003 18:49:47 -0600 >Received: from lewis.abi.tconline.net [208.29.17.215] by pdqlink.com with >ESMTP > (SMTPD32-4.07) id A788E0013A; Fri, 04 Apr 2003 18:47:04 CDT >Received: from localhost (localhost [[UNIX: localhost]]) > by lewis.abi.tconline.net (8.11.6/8.11.6) id h350ecB12126 > for Motorola@part-15.org; Fri, 4 Apr 2003 18:40:38 -0600 >Content-Type: text/plain; > charset="iso-8859-1" >From: Lewis Bergman >Organization: Texas Communications, Inc. >To: Motorola@part-15.org >Date: Fri, 4 Apr 2003 18:40:37 -0600 >User-Agent: KMail/1.4.1 >References: <003001c2fb03$77925e70$0200a8c0@villanova.com> >In-Reply-To: <003001c2fb03$77925e70$0200a8c0@villanova.com> >MIME-Version: 1.0 >Content-Transfer-Encoding: 8bit >Message-Id: <200304041840.37839.lbergman@wtxs.net> >Subject: Re: {Spam?} RE: [Motorola] Adjacent towers causing multipath/high >noise? >Precedence: bulk >Sender: Motorola-owner@part-15.org >Reply-To: Motorola@part-15.org >X-MailScanner-Information: Please contact the ISP for more information >X-MailScanner: Found to be clean >X-MailScanner-SpamCheck: not spam, SpamAssassin (score=-35.1, required 5, > AWL, BAYES_01, IN_REP_TO, NORMAL_HTTP_TO_IP, QUOTED_EMAIL_TEXT, > REFERENCES, REPLY_WITH_QUOTES, SIGNATURE_LONG_DENSE, SMTPD_IN_RCVD, > USER_AGENT_KMAIL) >Status: > -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sun Apr 6 12:01:39 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: Question regarding the Message.pm in lib/MailScanner In-Reply-To: <200304061142.56699.so-mlist-alias@all-about-shift.com> Message-ID: <5.2.0.9.2.20030406115443.02664da0@imap.ecs.soton.ac.uk> At 10:42 06/04/2003, you wrote: >This one goes probably direct to Julian, as he might know best about it ,-)) > >I added a new function to CustomConfig.pm to get some extended logging about >spam and virus for each mail. Although I found the information about spam >quite easy for viruses it simply overwhelmed me, whats available in the >message object ,-)) What is the appropriate hash or array to look at If I >simply wan to know what's the name of the virus, if one has been found? The output parsers don't extract the name of the virus (except F-Prot and F-Secure if I remember rightly). The scanner report lines are stored though, so you could try and extract it from there, just for the scanners you are using. while(($filename, $report) = each %{$message->{virusreports}}) { push @allreports, split(/\n/, $report); } # You now have 1 virus report in each element of @allreports. # So, knowing the output structure of your particular scanner(s), # you can pull out the name of the virus. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From kevins at BMRB.CO.UK Sun Apr 6 12:16:16 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:42 2006 Subject: Score is -35 but it is still marked as s p a m, why? In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EDF6A9@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF6A9@pascal.priv.bmrb.co.uk> Message-ID: <1049627777.14684.15.camel@bach.kevinspicer.co.uk> On Sun, 2003-04-06 at 07:59, Donovan Huff | HUFF DATA SYSTEMS wrote: I am wondering why messages marked with a score such as -35 are tagged as s p a m in the subject line when the required as 5 and all the header information says it is not s p a m, I have attached the message. I've had this issue several times and with different MailScanner versions. If you look at the subject of the mail notice that it begins... Re: {Spam?} So the pass through a Mailscanner that generated the -35 score is not the same pass that altered the subject - it may not even have been your Mailscanner that did it. I would suggest changing your spam subject in some subtle way (maybe square brackets, ALL CAPS or two question marks) so you can see if it is generated by your mailscanner. BTW... one of the reasons it got such a low score is that you have auto-whitelisting on, which is probably not such a good idea with MS (unless this machine doesn't serve multiple users). Check the archives for the reasons! BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From so-mlist-alias at all-about-shift.com Sun Apr 6 13:09:16 2003 From: so-mlist-alias at all-about-shift.com (Soeren Gerlach) Date: Thu Jan 12 21:17:42 2006 Subject: Question regarding the Message.pm in lib/MailScanner In-Reply-To: <5.2.0.9.2.20030406115443.02664da0@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030406115443.02664da0@imap.ecs.soton.ac.uk> Message-ID: <200304061409.16457.so-mlist-alias@all-about-shift.com> Thanks for the answer! I'll give it a try. Best regards, Soeren > At 10:42 06/04/2003, you wrote: > >This one goes probably direct to Julian, as he might know best about it > > ,-)) > > > >I added a new function to CustomConfig.pm to get some extended logging > > about spam and virus for each mail. Although I found the information > > about spam quite easy for viruses it simply overwhelmed me, whats > > available in the message object ,-)) What is the appropriate hash or > > array to look at If I simply wan to know what's the name of the virus, > > if one has been found? > > The output parsers don't extract the name of the virus (except F-Prot and > F-Secure if I remember rightly). > The scanner report lines are stored though, so you could try and extract > it from there, just for the scanners you are using. > > while(($filename, $report) = each %{$message->{virusreports}}) { > push @allreports, split(/\n/, $report); > } > # You now have 1 virus report in each element of @allreports. > # So, knowing the output structure of your particular scanner(s), > # you can pull out the name of the virus. From scouty at BROMBERG.DEMON.NL Sun Apr 6 13:23:55 2003 From: scouty at BROMBERG.DEMON.NL (Matthijs Althoff) Date: Thu Jan 12 21:17:42 2006 Subject: "spamassassin" redhat 9 mailscanner Message-ID: On Sun, 6 Apr 2003 11:42:46 +0100, Julian Field wrote: >The RPM is installing SpamAssassin in a location where Perl can't find it. >Build SpamAssassin from source (ie the .tar.gz distribution) instead. That seems to do the job after building the 2.53 from tar.gz it runs fine.. From nathan at TCPNETWORKS.NET Sun Apr 6 15:20:24 2003 From: nathan at TCPNETWORKS.NET (Nathan Johanson) Date: Thu Jan 12 21:17:42 2006 Subject: MailScanner/Sendmail for Dummies?? Message-ID: Actually you can use "make" to build the *.cf file in earlier versions of RedHat as well (notably the 7.x series). The working directory is different. Instead of /etc/mail, it's /usr/share/sendmail-cf/cf. The redhat.mc file located in this directory is a good place to start (doesn't need a lot of changes), add your m4 macros, and then run make redhat.cf, and then cp redhat.cf /etc/sendmail.cf. Nathan -----Original Message----- From: Mike Zanker [mailto:mike@ZANKER.ORG] Sent: Fri 4/4/2003 10:23 PM To: MAILSCANNER@JISCMAIL.AC.UK Cc: Subject: Re: MailScanner/Sendmail for Dummies?? On 04 April 2003 16:49 -0600 Mike Kercher wrote: > After you make the modifications to /etc/mail/sendmail.mc , don't > forget to run "m4 /etc/mail/sendmail.mc > /etc/sendmail.cf" to > generate your new /etc/sendmail.cf That depends on the version of Red Hat being used. From 8.0 onwards sendmail.cf moved to /etc/mail and will be made from sendmail.mc by running "make" in that directory. Previous Red Hat versions (and the new Enterprise products) will need m4 running manually, as you said. Mike. From isp-list at TULSACONNECT.COM Sun Apr 6 16:46:59 2003 From: isp-list at TULSACONNECT.COM (ISP List) Date: Thu Jan 12 21:17:42 2006 Subject: Bayes database - can it be copied? Message-ID: <5.2.1.1.2.20030406104517.04b5fea8@securemail.tulsaconnect.com> I've got two identical boxes, both running MS 4.14 and SA 2.53. The first one is our 10 MX, the second is 20 MX. The first gets a *lot* more mail than the second, and as a result the Bayes database is 90% larger than on MX 20. Can I copy the bayes files in ~root/.spamassassion from the first machine to the second to "jump start" its Bayes functionality? ------------------------------------- Mike Bacher / mike@sparklogic.com Use OptiGold ISP? Check out OptiSkin! http://www.sparklogic.com/optiskin/ ------------------------------------- From mailscanner at ecs.soton.ac.uk Sun Apr 6 16:56:02 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:42 2006 Subject: Bayes database - can it be copied? In-Reply-To: <5.2.1.1.2.20030406104517.04b5fea8@securemail.tulsaconnect. com> Message-ID: <5.2.0.9.2.20030406164838.026aaaa8@imap.ecs.soton.ac.uk> At 16:46 06/04/2003, you wrote: >I've got two identical boxes, both running MS 4.14 and SA 2.53. The first >one is our 10 MX, the second is 20 MX. The first gets a *lot* more mail >than the second, and as a result the Bayes database is 90% larger than on >MX 20. Can I copy the bayes files in ~root/.spamassassion from the first >machine to the second to "jump start" its Bayes functionality? I think as long as you do it carefully, then you will probably be okay. The critical time is between the creation/update of the 2 db files. Say your machines are called mx10 and mx20, then something like this should do it pretty well. I'm assuming you are using scp, but just change the scp for rcp if that's what you are using. On mx20: cd ~root/.spamassassin mkdir new_files 2>/dev/null scp 'mx10:.spamassassin/*' new_files mv -f new_files/* . I do all the files at once to minimise the time when the db files aren't consistent with each other, as this isn't doing any proper locking. Just copying the files straight into ~/.spamassassin would make the "inconsistent" time a lot longer. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From donovan at HUFFDATASYSTEMS.COM Sun Apr 6 19:08:34 2003 From: donovan at HUFFDATASYSTEMS.COM (Donovan Huff | HUFF DATA SYSTEMS) Date: Thu Jan 12 21:17:42 2006 Subject: Score is -35 but it is still marked as s p a m, why? References: <5C0296D26910694BB9A9BBFC577E7AB0EDF6A9@pascal.priv.bmrb.co.uk> <1049627777.14684.15.camel@bach.kevinspicer.co.uk> Message-ID: <00f301c2fc67$8ae8f870$46c65a42@x27> Well unfortunatlly if I don't have auto whitelisting on it starts marking everything as spam for some reason that is unknown to me, that is actually why I turned it on because low scores (those below five) were even getting tagged as spam. As far as the "{Spam?}" in the subject, that is added by MailScanner without doubt as it is listed in the config and changing it will change the tag. If I can resolve the issue where when auto white listing is turned off just about everything starts being tagged as spam even if it is not found to be spam and has a lower than require score then I will turn off auto white listing. Right now with auto whitelisting on, it just tags some e-mail that it doesn't find to be spam and has a lower than required score with the modified subject line addition of "{Spam?}. Perl v5.6.0 MailScanner 4.13-3 SpamAssassin 2.52 ----- Original Message ----- From: "Kevin Spicer" To: Sent: Sunday, April 06, 2003 6:16 AM Subject: Re: Score is -35 but it is still marked as s p a m, why? > On Sun, 2003-04-06 at 07:59, Donovan Huff | HUFF DATA SYSTEMS wrote: > > > I am wondering why messages marked with a score such as -35 are tagged > as s p a m in the subject line when the required as 5 and all > the header information says it is not s p a m, I have attached the > message. I've had this issue several times and with different > MailScanner versions. > > If you look at the subject of the mail notice that it begins... > Re: {Spam?} > So the pass through a Mailscanner that generated the -35 score is not > the same pass that altered the subject - it may not even have been your > Mailscanner that did it. I would suggest changing your spam subject in > some subtle way (maybe square brackets, ALL CAPS or two question marks) > so you can see if it is generated by your mailscanner. > > BTW... one of the reasons it got such a low score is that you have > auto-whitelisting on, which is probably not such a good idea with MS > (unless this machine doesn't serve multiple users). Check the archives > for the reasons! > > > > > BMRB International > http://www.bmrb.co.uk > +44 (0)20 8566 5000 > _________________________________________________________________ > This message (and any attachment) is intended only for the > recipient and may contain confidential and/or privileged > material. If you have received this in error, please contact the > sender and delete this message immediately. Disclosure, copying > or other action taken in respect of this email or in > reliance on it is prohibited. BMRB International Limited > accepts no liability in relation to any personal emails, or > content of any email which does not directly relate to our > business. From donovan at HUFFDATASYSTEMS.COM Sun Apr 6 19:09:49 2003 From: donovan at HUFFDATASYSTEMS.COM (Donovan Huff | HUFF DATA SYSTEMS) Date: Thu Jan 12 21:17:43 2006 Subject: Score is -35 but it is still marked as s p a m, why? References: <5.2.0.9.2.20030406115108.02690f00@imap.ecs.soton.ac.uk> Message-ID: <00f901c2fc67$b81e9c00$46c65a42@x27> Running the following versions: Perl v5.6.0 MailScanner 4.13-3 SpamAssassin 2.52 TIA, Donovan ----- Original Message ----- From: "Julian Field" To: Sent: Sunday, April 06, 2003 5:52 AM Subject: Re: Score is -35 but it is still marked as s p a m, why? > What version of Perl are you running? There is a Perl bug somewhere around > this code, I had to write it the way I did because Perl was getting > arithmetic comparison wrong sometimes. > What version of MailScanner are you running? > > At 07:59 06/04/2003, you wrote: > > >I am wondering why messages marked with a score such as -35 are tagged as > >s p a m in the subject line when the required as 5 and all > >the header information says it is not s p a m, I have attached the > >message. I've had this issue several times and with different > >MailScanner versions. > > > > > >Regards, > > > >Donovan Huff > >Owner/Operator > >HUFF DATA SYSTEMS > >donovan@huffdatasystems.com > >http://www.huffdatasystems.com/ > >(361) 781-0631 > > > >------------------------------------------------------ > >Web Hosting Starting at $5.00/mo > >http://www.huffdatasystems.com/ > >------------------------------------------------------ > > > >Return-Path: > >Received: from core.huffdatasystems.net (root@localhost) > > by huffdatasystems.com (8.11.6/8.11.6) with ESMTP id h350nqp27062 > > for ; Fri, 4 Apr 2003 18:49:52 -0600 > >X-ClientAddr: 198.63.203.3 > >Received: from part-15.org (mail.midconqc.com [198.63.203.3]) > > by core.huffdatasystems.net (8.11.6/8.11.6) with SMTP id h350nlg27050 > > for ; Fri, 4 Apr 2003 18:49:47 -0600 > >Received: from lewis.abi.tconline.net [208.29.17.215] by pdqlink.com with > >ESMTP > > (SMTPD32-4.07) id A788E0013A; Fri, 04 Apr 2003 18:47:04 CDT > >Received: from localhost (localhost [[UNIX: localhost]]) > > by lewis.abi.tconline.net (8.11.6/8.11.6) id h350ecB12126 > > for Motorola@part-15.org; Fri, 4 Apr 2003 18:40:38 -0600 > >Content-Type: text/plain; > > charset="iso-8859-1" > >From: Lewis Bergman > >Organization: Texas Communications, Inc. > >To: Motorola@part-15.org > >Date: Fri, 4 Apr 2003 18:40:37 -0600 > >User-Agent: KMail/1.4.1 > >References: <003001c2fb03$77925e70$0200a8c0@villanova.com> > >In-Reply-To: <003001c2fb03$77925e70$0200a8c0@villanova.com> > >MIME-Version: 1.0 > >Content-Transfer-Encoding: 8bit > >Message-Id: <200304041840.37839.lbergman@wtxs.net> > >Subject: Re: {Spam?} RE: [Motorola] Adjacent towers causing multipath/high > >noise? > >Precedence: bulk > >Sender: Motorola-owner@part-15.org > >Reply-To: Motorola@part-15.org > >X-MailScanner-Information: Please contact the ISP for more information > >X-MailScanner: Found to be clean > >X-MailScanner-SpamCheck: not spam, SpamAssassin (score=-35.1, required 5, > > AWL, BAYES_01, IN_REP_TO, NORMAL_HTTP_TO_IP, QUOTED_EMAIL_TEXT, > > REFERENCES, REPLY_WITH_QUOTES, SIGNATURE_LONG_DENSE, SMTPD_IN_RCVD, > > USER_AGENT_KMAIL) > >Status: > > > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sun Apr 6 19:21:13 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Score is -35 but it is still marked as s p a m, why? In-Reply-To: <00f901c2fc67$b81e9c00$46c65a42@x27> References: <5.2.0.9.2.20030406115108.02690f00@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030406192002.02752978@imap.ecs.soton.ac.uk> I don't know of anyone else suffering problems with all mail being marked as spam, so I suspect it's something in your configuration. Try upgrading to SpamAssassin 2.53 as well, just in case you are hitting a bug there. At 19:09 06/04/2003, you wrote: >Running the following versions: > >Perl v5.6.0 >MailScanner 4.13-3 >SpamAssassin 2.52 > > >TIA, > >Donovan > >----- Original Message ----- >From: "Julian Field" >To: >Sent: Sunday, April 06, 2003 5:52 AM >Subject: Re: Score is -35 but it is still marked as s p a m, why? > > > > What version of Perl are you running? There is a Perl bug somewhere around > > this code, I had to write it the way I did because Perl was getting > > arithmetic comparison wrong sometimes. > > What version of MailScanner are you running? > > > > At 07:59 06/04/2003, you wrote: > > > > >I am wondering why messages marked with a score such as -35 are tagged as > > >s p a m in the subject line when the required as 5 and all > > >the header information says it is not s p a m, I have attached the > > >message. I've had this issue several times and with different > > >MailScanner versions. > > > > > > > > >Regards, > > > > > >Donovan Huff > > >Owner/Operator > > >HUFF DATA SYSTEMS > > >donovan@huffdatasystems.com > > >http://www.huffdatasystems.com/ > > >(361) 781-0631 > > > > > >------------------------------------------------------ > > >Web Hosting Starting at $5.00/mo > > >http://www.huffdatasystems.com/ > > >------------------------------------------------------ > > > > > >Return-Path: > > >Received: from core.huffdatasystems.net (root@localhost) > > > by huffdatasystems.com (8.11.6/8.11.6) with ESMTP id h350nqp27062 > > > for ; Fri, 4 Apr 2003 18:49:52 -0600 > > >X-ClientAddr: 198.63.203.3 > > >Received: from part-15.org (mail.midconqc.com [198.63.203.3]) > > > by core.huffdatasystems.net (8.11.6/8.11.6) with SMTP id > h350nlg27050 > > > for ; Fri, 4 Apr 2003 18:49:47 -0600 > > >Received: from lewis.abi.tconline.net [208.29.17.215] by pdqlink.com with > > >ESMTP > > > (SMTPD32-4.07) id A788E0013A; Fri, 04 Apr 2003 18:47:04 CDT > > >Received: from localhost (localhost [[UNIX: localhost]]) > > > by lewis.abi.tconline.net (8.11.6/8.11.6) id h350ecB12126 > > > for Motorola@part-15.org; Fri, 4 Apr 2003 18:40:38 -0600 > > >Content-Type: text/plain; > > > charset="iso-8859-1" > > >From: Lewis Bergman > > >Organization: Texas Communications, Inc. > > >To: Motorola@part-15.org > > >Date: Fri, 4 Apr 2003 18:40:37 -0600 > > >User-Agent: KMail/1.4.1 > > >References: <003001c2fb03$77925e70$0200a8c0@villanova.com> > > >In-Reply-To: <003001c2fb03$77925e70$0200a8c0@villanova.com> > > >MIME-Version: 1.0 > > >Content-Transfer-Encoding: 8bit > > >Message-Id: <200304041840.37839.lbergman@wtxs.net> > > >Subject: Re: {Spam?} RE: [Motorola] Adjacent towers causing multipath/high > > >noise? > > >Precedence: bulk > > >Sender: Motorola-owner@part-15.org > > >Reply-To: Motorola@part-15.org > > >X-MailScanner-Information: Please contact the ISP for more information > > >X-MailScanner: Found to be clean > > >X-MailScanner-SpamCheck: not spam, SpamAssassin (score=-35.1, required 5, > > > AWL, BAYES_01, IN_REP_TO, NORMAL_HTTP_TO_IP, QUOTED_EMAIL_TEXT, > > > REFERENCES, REPLY_WITH_QUOTES, SIGNATURE_LONG_DENSE, > SMTPD_IN_RCVD, > > > USER_AGENT_KMAIL) > > >Status: > > > > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From kevins at BMRB.CO.UK Sun Apr 6 21:20:35 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:43 2006 Subject: Score is -35 but it is still marked as s p a m, why? In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EDF6B7@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF6B7@pascal.priv.bmrb.co.uk> Message-ID: <1049660435.14663.33.camel@bach.kevinspicer.co.uk> Right now with auto whitelisting on, it just tags some e-mail that it doesn't find to be spam and has a lower than required score with the modified subject line addition of "{Spam?}. Okay, so you've established that its your MailScanner thats adding the tags. I don't know how representative the mail you posted was, but by virtue of the fact the '{Spam?}' tag is not the first thing on the subject line it might have been added when the email left your site (before being replied to). To find out if this is the case you might like to turn on spam logging in MailScanner.conf... Log Spam = yes Hopefully this will enable you to prove whether the spam tag is being added when the mail leaves your site & if so will capture the SpamAssassin rules triggered to enable you to work out why. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mailscanner at jiscmail.ac.uk Sun Apr 6 23:15:22 2003 From: mailscanner at jiscmail.ac.uk (mailscanner) Date: Thu Jan 12 21:17:43 2006 Subject: {VIRUS?} Worm Klez.E immunity Message-ID: <20030406221450.WCPW7505.simmts2-srv.bellnexxia.net@Qeqrgvf> An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030406/cb5e7ab1/attachment.html -------------- next part -------------- This is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "Support.exe" was believed to be infected by a virus and has been replaced by this warning message. If you wish to receive a copy of the *infected* attachment, please e-mail helpdesk and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. At Sun Apr 6 23:16:02 2003 the virus scanner said: >>> Virus 'W32/Klez-H' found in file Support.exe Executable DOS/Windows programs are dangerous in email (Support.exe) Note to Help Desk: Look on magpie in /export/2/var/MailScanner/quarantine/20030406 (message XAA11485). -- Postmaster Mailscanner thanks transtec Computers for their support From donovan at HUFFDATASYSTEMS.COM Sun Apr 6 22:46:37 2003 From: donovan at HUFFDATASYSTEMS.COM (Donovan Huff | HUFF DATA SYSTEMS) Date: Thu Jan 12 21:17:43 2006 Subject: Score is -35 but it is still marked as s p a m, why? References: <5C0296D26910694BB9A9BBFC577E7AB0EDF6B7@pascal.priv.bmrb.co.uk> <1049660435.14663.33.camel@bach.kevinspicer.co.uk> Message-ID: <023b01c2fc86$011b2a90$46c65a42@x27> Okay it must have been a bug with the previous version(s) of MailScanner and/or SpamAssassin because it is working now with the auto whitelisting off. It might have also been another option in the /etc/init.d/MailScanner that I had changed, but now went back to the stock MailScanner init.d script. MailScanner v14.4-9 SpamAssassin v2.53 Regards, Donovan Huff Owner/Operator HUFF DATA SYSTEMS donovan@huffdatasystems.com http://www.huffdatasystems.com/ (361) 781-0631 ------------------------------------------------------ Web Hosting Starting at $5.00/mo http://www.huffdatasystems.com/ ------------------------------------------------------ ----- Original Message ----- From: "Kevin Spicer" To: Sent: Sunday, April 06, 2003 3:20 PM Subject: Re: Score is -35 but it is still marked as s p a m, why? > Right now with auto whitelisting > on, it just tags some e-mail that it doesn't find to be spam and has a > lower than required score with the modified subject line > addition of "{Spam?}. > > Okay, so you've established that its your MailScanner thats adding the > tags. I don't know how representative the mail you posted was, but by > virtue of the fact the '{Spam?}' tag is not the first thing on the > subject line it might have been added when the email left your site > (before being replied to). > To find out if this is the case you might like to turn on spam logging > in MailScanner.conf... > Log Spam = yes > > Hopefully this will enable you to prove whether the spam tag is being > added when the mail leaves your site & if so will capture the > SpamAssassin rules triggered to enable you to work out why. > > > > > BMRB International > http://www.bmrb.co.uk > +44 (0)20 8566 5000 > _________________________________________________________________ > This message (and any attachment) is intended only for the > recipient and may contain confidential and/or privileged > material. If you have received this in error, please contact the > sender and delete this message immediately. Disclosure, copying > or other action taken in respect of this email or in > reliance on it is prohibited. BMRB International Limited > accepts no liability in relation to any personal emails, or > content of any email which does not directly relate to our > business. From jaearick at COLBY.EDU Mon Apr 7 02:25:11 2003 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:17:43 2006 Subject: sophossavi as beta support Message-ID: Julian, I installed Paul Henson's modified Perl-SAVI, set "sophossavi" in mailscanner, and got thumped on the head by the syslog warning pointing me to www.sng.ecs.soton.ac.uk/mailscanner/install/codestatus.shtml, so I suppose sophossavi should get a word of mention there.... --- Jeff Earickson From isp-list at TULSACONNECT.COM Mon Apr 7 03:24:27 2003 From: isp-list at TULSACONNECT.COM (ISP List) Date: Thu Jan 12 21:17:43 2006 Subject: Bayes database - can it be copied? In-Reply-To: <5.2.0.9.2.20030406164838.026aaaa8@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030406104517.04b5fea8@securemail.tulsaconnect. com> Message-ID: <5.2.1.1.2.20030406212214.04e24a88@securemail.tulsaconnect.com> >I think as long as you do it carefully, then you will probably be okay. The >critical time is between the creation/update of the 2 db files. > >Say your machines are called mx10 and mx20, then something like this should >do it pretty well. I'm assuming you are using scp, but just change the scp >for rcp if that's what you are using. > >On mx20: > >cd ~root/.spamassassin >mkdir new_files 2>/dev/null >scp 'mx10:.spamassassin/*' new_files >mv -f new_files/* . > >I do all the files at once to minimise the time when the db files aren't >consistent with each other, as this isn't doing any proper locking. Just >copying the files straight into ~/.spamassassin would make the >"inconsistent" time a lot longer. That seemed to work fine. Thanks. Now that I'm going to be feeding this box mass quantities of tasty spam, I had a thought. Does the bayesian stuff pay attention to the headers, e.g. the From and To lines? Since my E-mail address might be in the From line someplace (Eudora puts it there even if you do a Redirect, after the original From line..), the system won't start to think I'm a spammer since I'm sending it lots of spam, will it? :-) ------------------------------------- Mike Bacher / mike@sparklogic.com Use OptiGold ISP? Check out OptiSkin! http://www.sparklogic.com/optiskin/ ------------------------------------- From P.G.M.Peters at civ.utwente.nl Mon Apr 7 08:55:29 2003 From: P.G.M.Peters at civ.utwente.nl (Peter Peters) Date: Thu Jan 12 21:17:43 2006 Subject: Exchange/Outlook client configuration In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4E5EF@MAIL> References: <84CFA712F666B44A94CE6BE116BAF4B0B4E5EF@MAIL> Message-ID: On Fri, 4 Apr 2003 09:31:02 -0600, you wrote: >> I set up a page on our intranet explaining what >> spam is ('borrowed' from the SA web site!), why their mail has been >> tagged as spam and how to set up an outlook rule to filter >> it. > >Any way I could "borrow" that page? What do you mean with borrow? You can use it as you see fit. -- Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ From mailscanner at ecs.soton.ac.uk Mon Apr 7 10:16:17 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: 2 x "from=<>" in the logs In-Reply-To: Message-ID: <5.2.0.9.2.20030407101514.02596ee0@imap.ecs.soton.ac.uk> The "<>" addresses in the envelope are intentional, as they help stop automated bounce messages. But there are real addresses in the "From:" headers so that people can manually reply to the messages if they need to. At 08:43 07/04/2003, you wrote: >yes thats seems to be right ... but why have they an empty form field ... >is this a mailscanner problem or an sendmail trouble - need you more log- >lines for deeper explaination ? > >thx4allinfos, joachim -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From S.R.Patterson at SOTON.AC.UK Mon Apr 7 10:10:25 2003 From: S.R.Patterson at SOTON.AC.UK (Steven Patterson) Date: Thu Jan 12 21:17:43 2006 Subject: 2 x "from=<>" in the logs In-Reply-To: References: Message-ID: On Apr 7, 2003 at 8:43am Joachim Dostal wrote: JD> yes thats seems to be right ... but why have they an empty form field JD> ... is this a mailscanner problem or an sendmail trouble - need you JD> more log- lines for deeper explaination ? It's not a problem at all. It's a mail being bounced back to you from somewhere else. The empty from field is deliberate to stop mail-bouncing loops. If a bounced mail in turn bounces then it tries to go back to <>, which doesn't exist so the mail is just discarded. Steve -- Steven Patterson, MSci OCP. Tel: +44 (0)2380 595810 Primary Information Services Support and Development Information Systems Services, University of Southampton, UK. Public PGP Key: http://www.bottleneck.org/pubkey.php From jdostal at YCN.COM Mon Apr 7 10:30:01 2003 From: jdostal at YCN.COM (Joachim Dostal) Date: Thu Jan 12 21:17:43 2006 Subject: 2 x "from=<>" in the logs Message-ID: THX A LOT for this description... regards, joachim From mailscanner at ecs.soton.ac.uk Mon Apr 7 10:30:59 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: sophossavi as beta support In-Reply-To: Message-ID: <5.2.0.9.2.20030407103029.0271a9a0@imap.ecs.soton.ac.uk> At 02:25 07/04/2003, you wrote: >Julian, > I installed Paul Henson's modified Perl-SAVI, set "sophossavi" >in mailscanner, and got thumped on the head by the syslog warning >pointing me to >www.sng.ecs.soton.ac.uk/mailscanner/install/codestatus.shtml, >so I suppose sophossavi should get a word of mention there.... Thanks Jeff, I have updated the file. Far more scanners are fully supported now. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Mon Apr 7 10:33:00 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Bayes database - can it be copied? In-Reply-To: <5.2.1.1.2.20030406212214.04e24a88@securemail.tulsaconnect. com> References: <5.2.0.9.2.20030406164838.026aaaa8@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030406104517.04b5fea8@securemail.tulsaconnect. com> Message-ID: <5.2.0.9.2.20030407103205.0271a830@imap.ecs.soton.ac.uk> At 03:24 07/04/2003, you wrote: >>I think as long as you do it carefully, then you will probably be okay. The >>critical time is between the creation/update of the 2 db files. >> >>Say your machines are called mx10 and mx20, then something like this should >>do it pretty well. I'm assuming you are using scp, but just change the scp >>for rcp if that's what you are using. >> >>On mx20: >> >>cd ~root/.spamassassin >>mkdir new_files 2>/dev/null >>scp 'mx10:.spamassassin/*' new_files >>mv -f new_files/* . >> >>I do all the files at once to minimise the time when the db files aren't >>consistent with each other, as this isn't doing any proper locking. Just >>copying the files straight into ~/.spamassassin would make the >>"inconsistent" time a lot longer. > >That seemed to work fine. Thanks. > >Now that I'm going to be feeding this box mass quantities of tasty spam, I >had a thought. Does the bayesian stuff pay attention to the headers, e.g. >the From and To lines? Since my E-mail address might be in the From line >someplace (Eudora puts it there even if you do a Redirect, after the >original From line..), the system won't start to think I'm a spammer since >I'm sending it lots of spam, will it? :-) You can always add bayes_ignore_header To bayes_ignore_header From to ~root/.spamassassin/user_prefs to force it to ignore them. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From linux at mostert.nom.za Mon Apr 7 11:25:12 2003 From: linux at mostert.nom.za (Mozzi) Date: Thu Jan 12 21:17:43 2006 Subject: Nederland Spamblock Message-ID: <200304071225.13034.linux@mostert.nom.za> Hallo all I came acros this while looking up something on osirusoft . They offer an rsync service for this list that got me thinking ;-) http://basic.wirehub.nl/spamstats.html http://basic.wirehub.nl/spamlist.txt How can I addapt a ruleset to use this list? As the format is this: From: user@nasty.domain.com yes This way you can just rsync the list over everey hour and have additional spam protection espesially on larger installations where spamassassin causes to much hassle. Just athought Mozzi From mailscanner at ecs.soton.ac.uk Mon Apr 7 11:52:38 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Nederland Spamblock In-Reply-To: <200304071225.13034.linux@mostert.nom.za> Message-ID: <5.2.0.9.2.20030407115019.0227ee88@imap.ecs.soton.ac.uk> At 11:25 07/04/2003, you wrote: >Hallo all >I came acros this while looking up something on osirusoft . >They offer an rsync service for this list that got me thinking ;-) >http://basic.wirehub.nl/spamstats.html >http://basic.wirehub.nl/spamlist.txt > >How can I addapt a ruleset to use this list? As the format is this: >From: user@nasty.domain.com yes I would personally use a Custom Function to read this in its own format, similar to the per-domain spam whitelist/blacklist code, and then do a fast hash lookup at run time. Creating a rule for every entry will be a lot slower, as then it has to look through the rules in sequence, instead of just doing about 2 or 3 hash table lookups each time you process a message. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From linux at mostert.nom.za Mon Apr 7 12:00:16 2003 From: linux at mostert.nom.za (Mozzi) Date: Thu Jan 12 21:17:43 2006 Subject: Reporting Message-ID: <200304071300.16625.linux@mostert.nom.za> Hallo again I was asked for more spesific stats by the powers that be today. I have the mrtg graphs running and I like them. They want reports that state how may mails were processed, virii caught....etc I thought I saw someone with a developed script on the list, if so can I have the url please? Mozzi From P.G.M.Peters at civ.utwente.nl Mon Apr 7 12:52:44 2003 From: P.G.M.Peters at civ.utwente.nl (Peter Peters) Date: Thu Jan 12 21:17:43 2006 Subject: Reporting In-Reply-To: <200304071300.16625.linux@mostert.nom.za> References: <200304071300.16625.linux@mostert.nom.za> Message-ID: On Mon, 7 Apr 2003 13:00:16 +0200, you wrote: >Hallo again > >I was asked for more spesific stats by the powers that be today. >I have the mrtg graphs running and I like them. >They want reports that state how may mails were processed, virii caught....etc >I thought I saw someone with a developed script on the list, if so can I have >the url please? I have put up our scripts at home.student.utwente.nl/p.g.m.peters. They are called mailscanner2csv.pl and analog4mailscanner.pl. The second script I use to mail me the results of one day. The other one puts the same information in a csv-file. Occassionally I take that file and update the information in an excel spreadsheet. I report monthly about all kinds of security issues to our staff and I include the spreadsheet of the previous month. Manually I convert the csv and excel files to monthly versions. The spreadsheet for the current month is available as mailscanner.xls at the same location. You will have to edit both perl scripts to accomodate for the blacklists you use. -- Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ From David.While at UCE.AC.UK Mon Apr 7 13:07:52 2003 From: David.While at UCE.AC.UK (David While) Date: Thu Jan 12 21:17:43 2006 Subject: Reporting Message-ID: I think the one you are looking for is mine at http://staff.cie.uce.ac.uk/~dwhile/mailstats/ ----------------------------------------------------------------- David While Technical Development Manager Faculty of Computing, Information & English University of Central England Tel: 0121 331 6211 Mozzi Sent by: MailScanner mailing list 07/04/2003 12:00 Please respond to linux To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: Reporting Hallo again I was asked for more spesific stats by the powers that be today. I have the mrtg graphs running and I like them. They want reports that state how may mails were processed, virii caught....etc I thought I saw someone with a developed script on the list, if so can I have the url please? Mozzi -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030407/de371086/attachment.html From dot at DOTAT.AT Mon Apr 7 13:15:00 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:43 2006 Subject: Logging and high score spam email In-Reply-To: Message-ID: Stijn Jonker wrote: > >Is it correct that it doesn't log anything to syslog? Maybe i missed >a config options somewhere. Have you got "Log Spam = yes" in your configuration? I've recently been adding some logging actions to the code (under a "Log Message IDs" option) to make it easier to see what's happening to each message in normal operation, especially which messages are in which batch and how they get altered and where they end up. I've only covered about a quarter of the cases so far though. Tony. -- f.a.n.finch http://dotat.at/ BAILEY: SOUTHERLY 5 OR 6, OCCASIONALLY 7, VEERING NORTHWESTERLY 4 LATER. DRIZZLE THEN RAIN. MODERATE OR POOR. From lbergman at WTXS.NET Mon Apr 7 13:49:04 2003 From: lbergman at WTXS.NET (Lewis Bergman) Date: Thu Jan 12 21:17:43 2006 Subject: Score is -35 but it is still marked as s p a m, why? In-Reply-To: <023b01c2fc86$011b2a90$46c65a42@x27> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF6B7@pascal.priv.bmrb.co.uk> <1049660435.14663.33.camel@bach.kevinspicer.co.uk> <023b01c2fc86$011b2a90$46c65a42@x27> Message-ID: <9068.199.1.199.63.1049719744.squirrel@wtxs.net> Donovan Huff | HUFF DATA SYSTEMS said: > Okay it must have been a bug with the previous version(s) of MailScanner > and/or SpamAssassin because it is working now with the auto whitelisting > off. It might have also been another option in the > /etc/init.d/MailScanner that I had changed, but now went back to the > stock MailScanner init.d script. Most likely not a bug. Auto whitelisting is not a good feature to use for a site wide implementation. There was a lengthy explanation of why a few months back. The long and the short of it is a spammer can manipulate the auto whitelist, accidently or on purpose, so their mail goes through exactly as you noticed. -- Lewis Bergman Texas Communications 4309 Maple ST. Abilene, TX 79602 915-695-6962 From mike at CAMAROSS.NET Mon Apr 7 14:19:31 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:43 2006 Subject: Nederland Spamblock In-Reply-To: <200304071225.13034.linux@mostert.nom.za> Message-ID: <01d801c2fd08$5363a480$af01a8c0@home.middlefinger.net> I incorporated this list once...when I went to hash it to my access.db, it kicked back a bunch of duplicates that I had to go find and weed out. Other than that, it's worked fairly well. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mozzi Sent: Monday, April 07, 2003 5:25 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Nederland Spamblock Hallo all I came acros this while looking up something on osirusoft . They offer an rsync service for this list that got me thinking ;-) http://basic.wirehub.nl/spamstats.html http://basic.wirehub.nl/spamlist.txt How can I addapt a ruleset to use this list? As the format is this: From: user@nasty.domain.com yes This way you can just rsync the list over everey hour and have additional spam protection espesially on larger installations where spamassassin causes to much hassle. Just athought Mozzi From sylvain.phaneuf at IMSU.OXFORD.AC.UK Mon Apr 7 16:06:53 2003 From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf) Date: Thu Jan 12 21:17:43 2006 Subject: Reporting Message-ID: thats reminds me of a couple on unresolved questions I have... The 1st one is the top page header is not updated when mailstats.pl runs. See: http://mailscan.imsu.ox.ac.uk/mailstats-mrtg/ The graphs on that top page are updated fine and so are those produced individually for the messages entering the system, server load, etc. On those secondary pages, the headers are updated automatically. The second thing is that the graphs dont get reset to zero at midnight, but get reset only once a week, on Sundays. This may be as designed, but having used the MailScanner-MRTG, I find it useful that these number/graphs are reset to zero each day. Where can I change these settings? Can someone point me in the right direction please? Sylvain =========================================================== Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 Information Management Services Unit - Medical Sciences Division Oxford University | email : sylvain.phaneuf@imsu.ox.ac.uk Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 Oxford OX3 9DU England =========================================================== >>> David.While@UCE.AC.UK 07/04/2003 13:07:52 >>> I think the one you are looking for is mine at http://staff.cie.uce.ac.uk/~dwhile/mailstats/ ----------------------------------------------------------------- David While Technical Development Manager Faculty of Computing, Information & English University of Central England Tel: 0121 331 6211 Mozzi Sent by: MailScanner mailing list 07/04/2003 12:00 Please respond to linux To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: Reporting Hallo again I was asked for more spesific stats by the powers that be today. I have the mrtg graphs running and I like them. They want reports that state how may mails were processed, virii caught....etc I thought I saw someone with a developed script on the list, if so can I have the url please? Mozzi From dgeorgiades at POWERENG.COM Mon Apr 7 16:06:42 2003 From: dgeorgiades at POWERENG.COM (Derrick Georgiades) Date: Thu Jan 12 21:17:43 2006 Subject: Whitelisting half a site Message-ID: I have had the issue of an email that is tagged as spam is delivered to multiple recipients successfully if one recipient is whitelist. Some of my users want MailScanner scanning there incoming emails and some do not. Because of this I have about 300 user addresses in my whitelist file. IE: To: jdoe@mydomain.com yes This works except when a spam mail has multiple recipients for my domain. I know that there is no functionality to create two separate emails, but is there a better way to whitelist? From raymond at PROLOCATION.NET Mon Apr 7 16:14:13 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:43 2006 Subject: Reporting In-Reply-To: Message-ID: Hi! > The second thing is that the graphs dont get reset to zero at midnight, > but get reset only once a week, on Sundays. This may be as designed, but > having used the MailScanner-MRTG, I find it useful that these > number/graphs are reset to zero each day. Where can I change these > settings? Could it be this has to do with your logrotation ? Set the logrotation to rotate daily at 00:00 and it will work just fine. At least, that worked for me :) Most likely you only rotate one a week, at Sundays... Bye, Raymond. From sylvain.phaneuf at IMSU.OXFORD.AC.UK Mon Apr 7 16:30:50 2003 From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf) Date: Thu Jan 12 21:17:43 2006 Subject: Reporting Message-ID: Thanks, I have changed my log rotation this morning to daily. I will see tomorrow morning. How about the header that is not updated? Has anyone got any idea? Sylvain >>> raymond@PROLOCATION.NET 07/04/2003 16:14:13 >>> Hi! > The second thing is that the graphs dont get reset to zero at midnight, > but get reset only once a week, on Sundays. This may be as designed, but > having used the MailScanner-MRTG, I find it useful that these > number/graphs are reset to zero each day. Where can I change these > settings? Could it be this has to do with your logrotation ? Set the logrotation to rotate daily at 00:00 and it will work just fine. At least, that worked for me :) Most likely you only rotate one a week, at Sundays... Bye, Raymond. From raymond at PROLOCATION.NET Mon Apr 7 16:39:22 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:43 2006 Subject: Reporting In-Reply-To: Message-ID: Hi! > I have changed my log rotation this morning to daily. I will see > tomorrow morning. Also have a look on the time its changing logs, default for RH is 04:00 if i am right, if you dont want to see gaps make that 00:00 :)) Bye, Raymond. From Jan-Peter.Koopmann at SECEIDOS.DE Mon Apr 7 16:43:19 2003 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:17:43 2006 Subject: FreeBSD port 4.14-9 released Message-ID: <4E7026FF8A422749B1553FE508E0068007F11E@message.intern.akctech.de> Hi, You can download the newest FreeBSD port at http://www.seceidos.de/downloads/freebsd/ports/mailscanner-4.14.9.tgz Please give it a try and report any problems to me. Thanks, JP From michael at ERG.ABDN.AC.UK Mon Apr 7 18:08:11 2003 From: michael at ERG.ABDN.AC.UK (Michael Forrest) Date: Thu Jan 12 21:17:43 2006 Subject: Multiple Scanners Message-ID: <000001c2fd28$47312f00$0a01000a@ENTERPRISE> Hi All, I've just been playing with multiple virus scanners and I remember a thread a on this newsgroup about customising the output sent to the postmaster. I was wondering if this had become a feature yet, had a look through and didn't see anything on it. Basically, in the postmaster report would it be possible to include the names of scanners that detected the various viruses? -- The following e-mail messages were found to have viruses in them: Sender: xxxxx@aol.com IP Address: xxx.xxx.xxx.xxx Recipient: xxxxxx@erg.abdn.ac.uk Subject: Fwd: Newest Security Pack MessageID: h3783IKa013104 Report: >>> Virus 'W32/Gibe-D' found in file ./h3783IKa013104/patch152.exe patch152.exe contains Worm.Gibe.B Executable DOS/Windows programs are dangerous in email (patch152.exe) -- So the report could be or something similar? Report: Sophos - Virus 'W32/Gibe-D' found in file ./h3783IKa013104/patch152.exe ClamAV - patch152.exe contains Worm.Gibe.B Executable DOS/Windows programs are dangerous in email (patch152.exe) Anyone done this or what? Thanks, Michael. From Kevin.Spicer at BMRB.CO.UK Mon Apr 7 18:09:17 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:43 2006 Subject: Multiple Scanners Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF4FF@pascal.priv.bmrb.co.uk> Its in the latest version. > -----Original Message----- > From: Michael Forrest [mailto:michael@ERG.ABDN.AC.UK] > Sent: 07 April 2003 18:08 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Multiple Scanners > > > Hi All, > > I've just been playing with multiple virus scanners and I remember a > thread a on this newsgroup about customising the output sent to the > postmaster. I was wondering if this had become a feature yet, > had a look > through and didn't see anything on it. > > Basically, in the postmaster report would it be possible to > include the > names of scanners that detected the various viruses? > > -- > The following e-mail messages were found to have viruses in them: > > Sender: xxxxx@aol.com > IP Address: xxx.xxx.xxx.xxx > Recipient: xxxxxx@erg.abdn.ac.uk > Subject: Fwd: Newest Security Pack > MessageID: h3783IKa013104 > Report: >>> Virus 'W32/Gibe-D' found in file > ./h3783IKa013104/patch152.exe > patch152.exe contains Worm.Gibe.B > Executable DOS/Windows programs are dangerous in email > (patch152.exe) > -- > > > So the report could be or something similar? > > Report: Sophos - Virus 'W32/Gibe-D' found in file > ./h3783IKa013104/patch152.exe > ClamAV - patch152.exe contains Worm.Gibe.B > Executable DOS/Windows programs are dangerous in email > (patch152.exe) > > Anyone done this or what? > > Thanks, > > Michael. > BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mailscanner at ecs.soton.ac.uk Mon Apr 7 18:12:02 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Multiple Scanners In-Reply-To: <000001c2fd28$47312f00$0a01000a@ENTERPRISE> Message-ID: <5.2.0.9.2.20030407181143.023a0e30@imap.ecs.soton.ac.uk> # Include the name of the virus scanner in each of the scanner reports. # Very useful if you use several virus scanners, but a bad idea if you # don't want to let your customers know which scanners you use. Include Scanner Name In Reports = yes At 18:08 07/04/2003, you wrote: >Hi All, > >I've just been playing with multiple virus scanners and I remember a >thread a on this newsgroup about customising the output sent to the >postmaster. I was wondering if this had become a feature yet, had a look >through and didn't see anything on it. > >Basically, in the postmaster report would it be possible to include the >names of scanners that detected the various viruses? > >-- >The following e-mail messages were found to have viruses in them: > > Sender: xxxxx@aol.com >IP Address: xxx.xxx.xxx.xxx > Recipient: xxxxxx@erg.abdn.ac.uk > Subject: Fwd: Newest Security Pack > MessageID: h3783IKa013104 > Report: >>> Virus 'W32/Gibe-D' found in file >./h3783IKa013104/patch152.exe > patch152.exe contains Worm.Gibe.B > Executable DOS/Windows programs are dangerous in email >(patch152.exe) >-- > > >So the report could be or something similar? > >Report: Sophos - Virus 'W32/Gibe-D' found in file >./h3783IKa013104/patch152.exe > ClamAV - patch152.exe contains Worm.Gibe.B > Executable DOS/Windows programs are dangerous in email >(patch152.exe) > >Anyone done this or what? > >Thanks, > >Michael. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Mon Apr 7 18:18:17 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:43 2006 Subject: Multiple Scanners In-Reply-To: <000001c2fd28$47312f00$0a01000a@ENTERPRISE> Message-ID: Hi! > Basically, in the postmaster report would it be possible to include the > names of scanners that detected the various viruses? Its available, and working just fine :) # Include the name of the virus scanner in each of the scanner reports. # Very useful if you use several virus scanners, but a bad idea if you # don't want to let your customers know which scanners you use. Include Scanner Name In Reports = yes Bye, Raymond. From ralloway at WINBEAM.COM Mon Apr 7 18:10:47 2003 From: ralloway at WINBEAM.COM (Richard D Alloway) Date: Thu Jan 12 21:17:43 2006 Subject: Porn msg identification? Message-ID: Hi there! I was wondering if anyone had come up with a way to add a header or perhaps prepend the subject line with something like {Porn?} based on the language/content of an email? I want to be able to give our users something they can filter their mail against if they don't want to receive ANY adult messages. Our customers like the ability to filter against {Spam?} in the subject line for possible spam. Thanks! -Rich From mailscanner at ecs.soton.ac.uk Mon Apr 7 18:24:11 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Porn msg identification? In-Reply-To: Message-ID: <5.2.0.9.2.20030407182200.021ff8e8@imap.ecs.soton.ac.uk> The problem of nasty porn spam can largely be solved with the "striphtml" spam action, as it removes all images from spam. In case it's not really spam, all the links in the message are maintained, but you don't have to suffer the images. This is keeping most of my users happy here. At 18:10 07/04/2003, you wrote: >Hi there! > >I was wondering if anyone had come up with a way to add a header or >perhaps prepend the subject line with something like {Porn?} based on the >language/content of an email? > >I want to be able to give our users something they can filter their mail >against if they don't want to receive ANY adult messages. > >Our customers like the ability to filter against {Spam?} in the subject >line for possible spam. > >Thanks! > >-Rich -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Mon Apr 7 18:29:36 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Porn msg identification? In-Reply-To: <5.2.0.9.2.20030407182200.021ff8e8@imap.ecs.soton.ac.uk> References: Message-ID: <5.2.0.9.2.20030407182646.025a3008@imap.ecs.soton.ac.uk> Another thing you can do is go through the porn detection rules in SpamAssassin (look in /usr/share/spamassassin/20_porn.cf) and set a high score for each of them (probably need to do that in ~root/.spamassassin/user_prefs, but it may work in /etc/MailScanner/spam.assassin.prefs.conf). Then set a very high score for the "High Scoring" threshold, and "delete" for the High Scoring Spam Actions. At 18:24 07/04/2003, you wrote: >The problem of nasty porn spam can largely be solved with the "striphtml" >spam action, as it removes all images from spam. In case it's not really >spam, all the links in the message are maintained, but you don't have to >suffer the images. This is keeping most of my users happy here. > >At 18:10 07/04/2003, you wrote: >>Hi there! >> >>I was wondering if anyone had come up with a way to add a header or >>perhaps prepend the subject line with something like {Porn?} based on the >>language/content of an email? >> >>I want to be able to give our users something they can filter their mail >>against if they don't want to receive ANY adult messages. >> >>Our customers like the ability to filter against {Spam?} in the subject >>line for possible spam. >> >>Thanks! >> >>-Rich > >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From richard_cipher at YAHOO.COM Mon Apr 7 19:48:28 2003 From: richard_cipher at YAHOO.COM (Evert Ford) Date: Thu Jan 12 21:17:43 2006 Subject: Deleting all Messages with a specific address in the "To:" field.... Message-ID: An e-mail address associated with an old domain that is no longer used gets nothing but spam ? e-mail at that old address is forwarded to the new server by the ISP. The "To:" field is still tagged with the old server's domain. ? I have a rule to call everything at the old domain spam: To:me@olddomain.comyes I also have a rule for spam actions to delete it: To:me@olddomain.comdelete ? I look at the headers, and I see the old server info in the "To:" field, but the e-mail goes through just fine, and isn't marked as spam. I checked the whitelist rules, and it isn't whitelisted. ? Is the ISP forward what's making this not work? Any Ideas? If I use sendmail to delete it, it induces latency, and fetchmail dies ? I am using fetchmail version 6.2, sendmail version 8.12-7 and MailScanner 4.14 on a Redhat Linux 7.2 system ? Thanks for any Input! ? Evert Ford Westone Laboratories. http://www.westone.com From joelc at CTCHOUSTON.COM Mon Apr 7 19:59:15 2003 From: joelc at CTCHOUSTON.COM (Joel Colvin) Date: Thu Jan 12 21:17:43 2006 Subject: failed MIME-tools install on redhat 8 Message-ID: <02a101c2fd37$c8b6d890$c460c2cc@hewlett9por0s0> I've got a brand new install of RedHat 8.0 and it fails the install at the MIME-Tools section. I have attached a section of the log. I'm using MailScanner-4.14-9. So I installed MIME-tools manually and then reran install.sh and got no errors but then MailScanner sucked up all RAM in about 20 minutes and the whole boxed locked with out of memory errors. Now I have tried several other things to no avail. What is the best way to remove all perl modules without reloading so I can start over with the install? Anybody know why I got this install error to begin with? -----Install log file----- Attempting to build and install perl-MIME-tools-5.411-pl4.2 Installing perl-MIME-tools-5.411-pl4.2.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.78924 Patch #0 (mime-tools-patch1.txt): Patch #1 (mime-tools-patch2.txt): Patch #2 (mime-tools-patch3.txt): Patch #3 (mime-tools-patch4.txt): Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.78924 Checking if your kit is complete... Looks good Writing Makefile for MIME-tools cp lib/MIME/Decoder/Gzip64.pm blib/lib/MIME/Decoder/Gzip64.pm cp lib/MIME/Body.pm blib/lib/MIME/Body.pm cp lib/MIME/Field/ContDisp.pm blib/lib/MIME/Field/ContDisp.pm cp lib/MIME/Field/ContType.pm blib/lib/MIME/Field/ContType.pm cp lib/MIME/Decoder/NBit.pm blib/lib/MIME/Decoder/NBit.pm cp lib/MIME/Parser/Results.pm blib/lib/MIME/Parser/Results.pm cp lib/MIME/Words.pm blib/lib/MIME/Words.pm cp lib/MIME/Entity.pm blib/lib/MIME/Entity.pm cp lib/MIME/Parser/Filer.pm blib/lib/MIME/Parser/Filer.pm cp lib/MIME/Head.pm blib/lib/MIME/Head.pm cp lib/MIME/Field/ParamVal.pm blib/lib/MIME/Field/ParamVal.pm cp lib/MIME/Field/ConTraEnc.pm blib/lib/MIME/Field/ConTraEnc.pm cp lib/MIME/Tools.pm blib/lib/MIME/Tools.pm cp lib/MIME/Decoder/UU.pm blib/lib/MIME/Decoder/UU.pm cp lib/MIME/Decoder/Binary.pm blib/lib/MIME/Decoder/Binary.pm cp lib/MIME/Decoder.pm blib/lib/MIME/Decoder.pm cp lib/MIME/Decoder/Base64.pm blib/lib/MIME/Decoder/Base64.pm cp lib/MIME/Decoder/QuotedPrint.pm blib/lib/MIME/Decoder/QuotedPrint.pm cp lib/MIME/WordDecoder.pm blib/lib/MIME/WordDecoder.pm cp lib/MIME/Parser/Reader.pm blib/lib/MIME/Parser/Reader.pm cp lib/MIME/Parser.pm blib/lib/MIME/Parser.pm Manifying blib/man3/MIME::Body.3pm Manifying blib/man3/MIME::Decoder::Gzip64.3pm Manifying blib/man3/MIME::Field::ContDisp.3pm Manifying blib/man3/MIME::Parser::Results.3pm Manifying blib/man3/MIME::Field::ContType.3pm Manifying blib/man3/MIME::Decoder::NBit.3pm Manifying blib/man3/MIME::Entity.3pm Manifying blib/man3/MIME::Head.3pm Manifying blib/man3/MIME::Parser::Filer.3pm Manifying blib/man3/MIME::Words.3pm Manifying blib/man3/MIME::Field::ParamVal.3pm Manifying blib/man3/MIME::Tools.3pm Manifying blib/man3/MIME::Field::ConTraEnc.3pm Manifying blib/man3/MIME::Decoder::Binary.3pm Manifying blib/man3/MIME::Decoder.3pm Manifying blib/man3/MIME::Decoder::UU.3pm Manifying blib/man3/MIME::Decoder::QuotedPrint.3pm Manifying blib/man3/MIME::Decoder::Base64.3pm Manifying blib/man3/MIME::WordDecoder.3pm Manifying blib/man3/MIME::Parser.3pm Manifying blib/man3/MIME::Parser::Reader.3pm PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/Body...........dubious Test returned status 2 (wstat 512, 0x200) t/Decoder........dubious Test returned status 2 (wstat 512, 0x200) t/Entity.........dubious Test returned status 2 (wstat 512, 0x200) t/Gauntlet.......dubious Test returned status 2 (wstat 512, 0x200) t/Head...........dubious Test returned status 2 (wstat 512, 0x200) t/Misc...........dubious Test returned status 2 (wstat 512, 0x200) t/Parser.........dubious Test returned status 2 (wstat 512, 0x200) t/Ref............dubious Test returned status 2 (wstat 512, 0x200) t/WordDecoder....ok t/Words..........ok Failed Test Stat Wstat Total Fail Failed List of Failed ---------------------------------------------------------------------------- --- t/Body.t 2 512 ?? ?? % ?? t/Decoder.t 2 512 ?? ?? % ?? t/Entity.t 2 512 ?? ?? % ?? t/Gauntlet.t 2 512 ?? ?? % ?? t/Head.t 2 512 ?? ?? % ?? t/Misc.t 2 512 ?? ?? % ?? t/Parser.t 2 512 ?? ?? % ?? t/Ref.t 2 512 ?? ?? % ?? RPM build errors: From mailscanner at ecs.soton.ac.uk Mon Apr 7 20:12:54 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: failed MIME-tools install on redhat 8 In-Reply-To: <02a101c2fd37$c8b6d890$c460c2cc@hewlett9por0s0> Message-ID: <5.2.0.9.2.20030407201106.02709e00@imap.ecs.soton.ac.uk> At 19:59 07/04/2003, you wrote: >I've got a brand new install of RedHat 8.0 and it fails the install at the >MIME-Tools section. I have attached a section of the log. > >I'm using MailScanner-4.14-9. > >So I installed MIME-tools manually and then reran install.sh and got no >errors but then MailScanner sucked up all RAM in about 20 minutes and the >whole boxed locked with out of memory errors. > >Now I have tried several other things to no avail. What is the best way to >remove all perl modules without reloading so I can start over with the >install? Do a rpm -qa | grep -i perl to see all the perl RPM's you've got installed, then "rpm -e" them one at a time. Your manual MIME-tools build clearly didn't work properly as all the tests returned "dubious" rather than "okay". I would guess one of the earlier modules didn't install properly. >Anybody know why I got this install error to begin with? > >-----Install log file----- > >Attempting to build and install perl-MIME-tools-5.411-pl4.2 >Installing perl-MIME-tools-5.411-pl4.2.src.rpm >Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.78924 >Patch #0 (mime-tools-patch1.txt): >Patch #1 (mime-tools-patch2.txt): >Patch #2 (mime-tools-patch3.txt): >Patch #3 (mime-tools-patch4.txt): >Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.78924 >Checking if your kit is complete... >Looks good >Writing Makefile for MIME-tools >cp lib/MIME/Decoder/Gzip64.pm blib/lib/MIME/Decoder/Gzip64.pm >cp lib/MIME/Body.pm blib/lib/MIME/Body.pm >cp lib/MIME/Field/ContDisp.pm blib/lib/MIME/Field/ContDisp.pm >cp lib/MIME/Field/ContType.pm blib/lib/MIME/Field/ContType.pm >cp lib/MIME/Decoder/NBit.pm blib/lib/MIME/Decoder/NBit.pm >cp lib/MIME/Parser/Results.pm blib/lib/MIME/Parser/Results.pm >cp lib/MIME/Words.pm blib/lib/MIME/Words.pm >cp lib/MIME/Entity.pm blib/lib/MIME/Entity.pm >cp lib/MIME/Parser/Filer.pm blib/lib/MIME/Parser/Filer.pm >cp lib/MIME/Head.pm blib/lib/MIME/Head.pm >cp lib/MIME/Field/ParamVal.pm blib/lib/MIME/Field/ParamVal.pm >cp lib/MIME/Field/ConTraEnc.pm blib/lib/MIME/Field/ConTraEnc.pm >cp lib/MIME/Tools.pm blib/lib/MIME/Tools.pm >cp lib/MIME/Decoder/UU.pm blib/lib/MIME/Decoder/UU.pm >cp lib/MIME/Decoder/Binary.pm blib/lib/MIME/Decoder/Binary.pm >cp lib/MIME/Decoder.pm blib/lib/MIME/Decoder.pm >cp lib/MIME/Decoder/Base64.pm blib/lib/MIME/Decoder/Base64.pm >cp lib/MIME/Decoder/QuotedPrint.pm blib/lib/MIME/Decoder/QuotedPrint.pm >cp lib/MIME/WordDecoder.pm blib/lib/MIME/WordDecoder.pm >cp lib/MIME/Parser/Reader.pm blib/lib/MIME/Parser/Reader.pm >cp lib/MIME/Parser.pm blib/lib/MIME/Parser.pm >Manifying blib/man3/MIME::Body.3pm >Manifying blib/man3/MIME::Decoder::Gzip64.3pm >Manifying blib/man3/MIME::Field::ContDisp.3pm >Manifying blib/man3/MIME::Parser::Results.3pm >Manifying blib/man3/MIME::Field::ContType.3pm >Manifying blib/man3/MIME::Decoder::NBit.3pm >Manifying blib/man3/MIME::Entity.3pm >Manifying blib/man3/MIME::Head.3pm >Manifying blib/man3/MIME::Parser::Filer.3pm >Manifying blib/man3/MIME::Words.3pm >Manifying blib/man3/MIME::Field::ParamVal.3pm >Manifying blib/man3/MIME::Tools.3pm >Manifying blib/man3/MIME::Field::ConTraEnc.3pm >Manifying blib/man3/MIME::Decoder::Binary.3pm >Manifying blib/man3/MIME::Decoder.3pm >Manifying blib/man3/MIME::Decoder::UU.3pm >Manifying blib/man3/MIME::Decoder::QuotedPrint.3pm >Manifying blib/man3/MIME::Decoder::Base64.3pm >Manifying blib/man3/MIME::WordDecoder.3pm >Manifying blib/man3/MIME::Parser.3pm >Manifying blib/man3/MIME::Parser::Reader.3pm >PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" >"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t >t/Body...........dubious > Test returned status 2 (wstat 512, 0x200) >t/Decoder........dubious > Test returned status 2 (wstat 512, 0x200) >t/Entity.........dubious > Test returned status 2 (wstat 512, 0x200) >t/Gauntlet.......dubious > Test returned status 2 (wstat 512, 0x200) >t/Head...........dubious > Test returned status 2 (wstat 512, 0x200) >t/Misc...........dubious > Test returned status 2 (wstat 512, 0x200) >t/Parser.........dubious > Test returned status 2 (wstat 512, 0x200) >t/Ref............dubious > Test returned status 2 (wstat 512, 0x200) >t/WordDecoder....ok >t/Words..........ok >Failed Test Stat Wstat Total Fail Failed List of Failed >---------------------------------------------------------------------------- >--- >t/Body.t 2 512 ?? ?? % ?? >t/Decoder.t 2 512 ?? ?? % ?? >t/Entity.t 2 512 ?? ?? % ?? >t/Gauntlet.t 2 512 ?? ?? % ?? >t/Head.t 2 512 ?? ?? % ?? >t/Misc.t 2 512 ?? ?? % ?? >t/Parser.t 2 512 ?? ?? % ?? >t/Ref.t 2 512 ?? ?? % ?? > > >RPM build errors: -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Mon Apr 7 20:09:31 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Deleting all Messages with a specific address in the "To:" field.... In-Reply-To: Message-ID: <5.2.0.9.2.20030407200803.02714008@imap.ecs.soton.ac.uk> At 19:48 07/04/2003, you wrote: >An e-mail address associated with an old domain that is no longer used >gets nothing but spam > >e-mail at that old address is forwarded to the new server by the ISP. The >"To:" field is still tagged with the old server's domain. > >I have a rule to call everything at the old domain spam: >To:me@olddomain.comyes >I also have a rule for spam actions to delete it: >To:me@olddomain.comdelete > >I look at the headers, and I see the old server info in the "To:" field, >but the e-mail goes through just fine, and isn't marked as spam. I >checked the whitelist rules, and it isn't whitelisted. > >Is the ISP forward what's making this not work? Any Ideas? If I use >sendmail to delete it, it induces latency, and fetchmail dies MailScanner doesn't use the From: and To: headers at all, they aren't what is used to deliver the mail. It uses the envelope addresses which are what actually govern the delivery of the mail. If the old domain gets nothing but spam, why are you still receiving mail from it? Seems to me that all you need to do is tell the ISP to stop forwarding the old domain to the new one. > >I am using fetchmail version 6.2, sendmail version 8.12-7 and MailScanner >4.14 on a Redhat Linux 7.2 system > >Thanks for any Input! > >Evert Ford >Westone Laboratories. >http://www.westone.com > -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From kevins at BMRB.CO.UK Mon Apr 7 21:05:04 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:43 2006 Subject: Deleting all Messages with a specific address in the "To:" field.... In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EDF6DA@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF6DA@pascal.priv.bmrb.co.uk> Message-ID: <1049745911.14329.16.camel@bach.kevinspicer.co.uk> I am using fetchmail version 6.2, sendmail version 8.12-7 and MailScanner 4.14 on a Redhat Linux 7.2 system I think the problem may lie with the fact you're using fetchmail. As Julian mentioned, MS looks at the envelope address, but generally fetchmail doesn't know what that envelope address is (unless your ISP adds an Envelope-to [or similar] header). Even if fetchmail picks up clues to the envelope address it doesn't make any difference to MS because fetchmail only attempts to work out which local user the mail should be going to & pass that information onto your local MTA. In other words fetchmail gives each mail a fresh envelope address based on where it thinks it should end up. If you really can't get your ISP to stop forwarding these addresses then you may (depending on what headers your ISP add) be able to persuade fetchmail to redirect those mails to a dedicated user on your machine. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mbowman at UDCOM.COM Mon Apr 7 21:54:49 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:43 2006 Subject: Porn msg identification? Message-ID: Julian, I hadn't thought of using that until now. Would the correct syntax be:- To: default striphtml deliver ? Regards, -- Matthew K Bowman Systems Administrator, Universal Digital Communications. Julian Field Sent by: MailScanner mailing list 04/07/2003 01:24 PM Please respond to MailScanner mailing list To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: Re: Porn msg identification? The problem of nasty porn spam can largely be solved with the "striphtml" spam action, as it removes all images from spam. In case it's not really spam, all the links in the message are maintained, but you don't have to suffer the images. This is keeping most of my users happy here. At 18:10 07/04/2003, you wrote: >Hi there! > >I was wondering if anyone had come up with a way to add a header or >perhaps prepend the subject line with something like {Porn?} based on the >language/content of an email? > >I want to be able to give our users something they can filter their mail >against if they don't want to receive ANY adult messages. > >Our customers like the ability to filter against {Spam?} in the subject >line for possible spam. > >Thanks! > >-Rich -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From ralloway at WINBEAM.COM Tue Apr 8 01:48:03 2003 From: ralloway at WINBEAM.COM (Richard D Alloway) Date: Thu Jan 12 21:17:43 2006 Subject: Porn msg identification? In-Reply-To: <5.2.0.9.2.20030407182200.021ff8e8@imap.ecs.soton.ac.uk> Message-ID: Hmmm... I don't think that will satisfy my customers. The problem is the language as well as the images contained within porn spam. The issue with setting the scores very high is that some customers will want to receive "adult" emails while others don't want to receive any. If there was a generic way to build a ruleset to modify the subject line (or add/modify a header), that would probably take care of it! :) Any chance something like this could be in MailScanner's future? *hint hint* ;) -Rich On Mon, 7 Apr 2003, Julian Field wrote: > The problem of nasty porn spam can largely be solved with the "striphtml" > spam action, as it removes all images from spam. In case it's not really > spam, all the links in the message are maintained, but you don't have to > suffer the images. This is keeping most of my users happy here. > > At 18:10 07/04/2003, you wrote: > >Hi there! > > > >I was wondering if anyone had come up with a way to add a header or > >perhaps prepend the subject line with something like {Porn?} based on the > >language/content of an email? > > > >I want to be able to give our users something they can filter their mail > >against if they don't want to receive ANY adult messages. > > > >Our customers like the ability to filter against {Spam?} in the subject > >line for possible spam. > > > >Thanks! > > > >-Rich > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > From danieltan at shopnsave.com.sg Tue Apr 8 02:39:42 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:43 2006 Subject: ANNOUNCE: Version 4.14 released References: <5.2.0.9.2.20030404114833.04279048@imap.ecs.soton.ac.uk> Message-ID: <00a201c2fd6f$c0aaa040$3900a8c0@Daniel> how do you check the correct version of mailscanner and spam assassin? just recently i upgraded spam assassin to the latest version to avoid mails to be stuck due to mailscanner unable to send it out but i still got the problem yesterday.that's why i need to check whether it was upgraded correctly i am doing installing the latest version of mailscanner to avoid the old problem... hope it helps as the staff are gunning for my head coz their mails aren't sent "on time" ----- Original Message ----- From: "Julian Field" To: Sent: Friday, April 04, 2003 6:59 PM Subject: ANNOUNCE: Version 4.14 released I have just released MailScanner version 4.14. Major new features are: - Support for NOD32 1.99, F-Secure 4.50 and F-Prot 3.13. - Support for SAVI Perl module to completely avoid startup delays with Sophos scanner. - Support for quirks of SpamAssassin 2.50 - 2.53. - Fixed important bug in filename checking code causing it not to check long filenames properly. I strongly advise all 4.13 users to upgrade. People who should upgrade are: - Anyone running 4.13 - Anyone using SpamAssassin 2.50-2.53 - Anyone using F-Prot - Anyone using F-Secure - Anyone using NOD32 Download it as usual from www.mailscanner.info And why not help to spread the word by buying a T-shirt while you are there? The full ChangeLog is this: * New Features and Improvements * - Added support for new (1.99) version of NOD32, using the "nod32-1.99" Virus Scanner setting, which has totally different output and different command-line switches from previous versions. - Added support for new (4.50) version of F-Secure. Involves a new f-secure- wrapper as well as new main code. - Added support for new version of F-Prot 3.13. - Added support for SAVI Perl module, using the "sophossavi" Virus Scanner setting. See the main docs for instructions on how to install the SAVI Perl module. - Signed and/or encrypted messages can now be signed without breaking the PGP/GPG signed portion of the message. - RAV support improved in Cobalt RaQ systems. - Added "Include Scanner Name In Reports" option to allow the virus scanner name to appear in the scanning reports. - "Debug SpamAssassin" option to help you sort out SpamAssassin problems. - "Exim Split Spool" option to support split mail queues with Exim. - Full support for quirks of SpamAssassin 2.5x. - Added optional support in f-prot-wrapper script to support tmpfs and ramdisks which F-Prot cannot use without assistance. - Better error reporting when compiling configuration files. - Improved OpenBSD installation and upgrading instructions. - Added check of location of all required system commands. - Improved wording of message to spam senders. - Increased max size of messages sent to SpamAssassin. Spam messages are getting bigger. - All variables in the supplied conf file are now set to something, even if just a blank value. This will make upgrade_MailScanner_conf work better. - Speeded up deletion of working area directories (thanks to Tony F for that). - No more reliance on hard-coded paths in SystemDefs.pm, this entire file is now obsolete. - Improved RedHat scripts to cope with glibc 2.3.x. * Fixes * - Fixed important bug in filename checking code causing it not to check long filenames properly. I strongly advise all 4.13 users to upgrade. - Changed setuid/setgid code so taint mode is not switched on. - Fixed various other issues kindly brought to my attention by Tony Finch at Cambridge Univ. - Fixed problem with deleting recipients from messages with Exim. - Fixed problem with headers being passed to SpamAssassin from Exim incorrectly. - Fixed problem when running internal TNEF decoder. - Fixed locking problems when SpamAssassin 2.50 times out. - Fixed "RBL Timeout 20 of 7" problem, and problem when no RBL's in use at all. - Fixed dont_copy_prefs option in call to SpamAssassin. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Kevin.Spicer at BMRB.CO.UK Tue Apr 8 09:02:55 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:43 2006 Subject: Porn msg identification? Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4AD69@pascal.priv.bmrb.co.uk> > > Hmmm... I don't think that will satisfy my customers. > > The problem is the language as well as the images contained > within porn > spam. > > The issue with setting the scores very high is that some > customers will > want to receive "adult" emails while others don't want to receive any. > > If there was a generic way to build a ruleset to modify the > subject line > (or add/modify a header), that would probably take care of it! :) > I think that would be rather difficult to do! The problem is how to accurately identify it. SA does a pretty good job but isn't perfect (although personally I've not seen any of this type of spam which has got past SA). If someone had the time/effort it might be possible to adapt the filters in DansGuardian (or something similar), although IIRC they are mostly checks for certain language (which SA can do anyway) and blacklisted sites. I suppose it might be useful to filter out mails with hyperlinks to domains that would be blocked. I'm not aware of any free (as in freedom or beer) mail filters that do this. Back to MailScanner as it is, if you're worried about the language as well as the images why not just bump the scores as Julian suggested and use the delete action? BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From raymond at PROLOCATION.NET Tue Apr 8 08:49:30 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:43 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <00a201c2fd6f$c0aaa040$3900a8c0@Daniel> Message-ID: Hello Daniel, > how do you check the correct version of mailscanner and spam assassin? > just recently i upgraded spam assassin to the latest version to avoid mails > to be stuck due to mailscanner unable to send it out > but i still got the problem yesterday.that's why i need to check whether it For Spam Assasin: [root@master .spamassassin]# spamassassin --version SpamAssassin version 2.53 For Mailscanner, it prints the version number also in your maillog when starting up, so have a look there. > hope it helps as the staff are gunning for my head coz their mails aren't > sent "on time" Can you be a bit more specific ? Bye, Raymond. From mailscanner at ecs.soton.ac.uk Tue Apr 8 08:46:34 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Porn msg identification? In-Reply-To: Message-ID: <5.2.0.9.2.20030408084556.03e78c28@imap.ecs.soton.ac.uk> At 21:54 07/04/2003, you wrote: >Julian, > >I hadn't thought of using that until now. > >Would the correct syntax be:- > >To: default striphtml deliver If you want to use a ruleset, that's right. However if it is for all cases, just set Spam Actions = striphtml deliver High Scoring Spam Actions = striphtml deliver >? > >Regards, -- >Matthew K Bowman Systems Administrator, Universal Digital Communications. > > > > > >Julian Field >Sent by: MailScanner mailing list >04/07/2003 01:24 PM >Please respond to MailScanner mailing list > > > To: MAILSCANNER@JISCMAIL.AC.UK > cc: > Subject: Re: Porn msg identification? > > >The problem of nasty porn spam can largely be solved with the "striphtml" >spam action, as it removes all images from spam. In case it's not really >spam, all the links in the message are maintained, but you don't have to >suffer the images. This is keeping most of my users happy here. > >At 18:10 07/04/2003, you wrote: > >Hi there! > > > >I was wondering if anyone had come up with a way to add a header or > >perhaps prepend the subject line with something like {Porn?} based on the > >language/content of an email? > > > >I want to be able to give our users something they can filter their mail > >against if they don't want to receive ANY adult messages. > > > >Our customers like the ability to filter against {Spam?} in the subject > >line for possible spam. > > > >Thanks! > > > >-Rich > >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 8 08:55:05 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <00a201c2fd6f$c0aaa040$3900a8c0@Daniel> References: <5.2.0.9.2.20030404114833.04279048@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030408084742.03ec8900@imap.ecs.soton.ac.uk> At 02:39 08/04/2003, you wrote: >how do you check the correct version of mailscanner and spam assassin? perl -MMail::SpamAssassin -le 'print $Mail::SpamAssassin::VERSION;' grep MailScannerVersion /usr/sbin/MailScanner >just recently i upgraded spam assassin to the latest version to avoid mails >to be stuck due to mailscanner unable to send it out >but i still got the problem yesterday.that's why i need to check whether it >was upgraded correctly >i am doing installing the latest version of mailscanner to avoid the old >problem... >hope it helps as the staff are gunning for my head coz their mails aren't >sent "on time" > >----- Original Message ----- >From: "Julian Field" >To: >Sent: Friday, April 04, 2003 6:59 PM >Subject: ANNOUNCE: Version 4.14 released > > >I have just released MailScanner version 4.14. > >Major new features are: >- Support for NOD32 1.99, F-Secure 4.50 and F-Prot 3.13. >- Support for SAVI Perl module to completely avoid startup delays with >Sophos scanner. >- Support for quirks of SpamAssassin 2.50 - 2.53. >- Fixed important bug in filename checking code causing it not to check >long filenames properly. I strongly advise all 4.13 users to upgrade. > >People who should upgrade are: > - Anyone running 4.13 > - Anyone using SpamAssassin 2.50-2.53 > - Anyone using F-Prot > - Anyone using F-Secure > - Anyone using NOD32 > >Download it as usual from www.mailscanner.info > >And why not help to spread the word by buying a T-shirt while you are there? > > >The full ChangeLog is this: > >* New Features and Improvements * > >- Added support for new (1.99) version of NOD32, using the "nod32-1.99" > Virus Scanner setting, which has totally different output and different > command-line switches from previous versions. >- Added support for new (4.50) version of F-Secure. Involves a new f-secure- > wrapper as well as new main code. >- Added support for new version of F-Prot 3.13. >- Added support for SAVI Perl module, using the "sophossavi" Virus Scanner > setting. See the main docs for instructions on how to install the SAVI > Perl module. >- Signed and/or encrypted messages can now be signed without breaking the > PGP/GPG signed portion of the message. >- RAV support improved in Cobalt RaQ systems. >- Added "Include Scanner Name In Reports" option to allow the virus scanner > name to appear in the scanning reports. >- "Debug SpamAssassin" option to help you sort out SpamAssassin problems. >- "Exim Split Spool" option to support split mail queues with Exim. >- Full support for quirks of SpamAssassin 2.5x. >- Added optional support in f-prot-wrapper script to support tmpfs and > ramdisks which F-Prot cannot use without assistance. >- Better error reporting when compiling configuration files. >- Improved OpenBSD installation and upgrading instructions. >- Added check of location of all required system commands. >- Improved wording of message to spam senders. >- Increased max size of messages sent to SpamAssassin. > Spam messages are getting bigger. >- All variables in the supplied conf file are now set to something, even if > just a blank value. This will make upgrade_MailScanner_conf work better. >- Speeded up deletion of working area directories (thanks to Tony F for >that). >- No more reliance on hard-coded paths in SystemDefs.pm, this entire file is > now obsolete. >- Improved RedHat scripts to cope with glibc 2.3.x. > >* Fixes * > >- Fixed important bug in filename checking code causing it not to check > long filenames properly. I strongly advise all 4.13 users to upgrade. >- Changed setuid/setgid code so taint mode is not switched on. >- Fixed various other issues kindly brought to my attention by Tony Finch > at Cambridge Univ. >- Fixed problem with deleting recipients from messages with Exim. >- Fixed problem with headers being passed to SpamAssassin from Exim >incorrectly. >- Fixed problem when running internal TNEF decoder. >- Fixed locking problems when SpamAssassin 2.50 times out. >- Fixed "RBL Timeout 20 of 7" problem, and problem when no RBL's in use at >all. >- Fixed dont_copy_prefs option in call to SpamAssassin. >-- >Julian Field >www.MailScanner.info >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 8 08:47:33 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Porn msg identification? In-Reply-To: References: <5.2.0.9.2.20030407182200.021ff8e8@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030408084645.03ec8030@imap.ecs.soton.ac.uk> At 01:48 08/04/2003, you wrote: >Hmmm... I don't think that will satisfy my customers. > >The problem is the language as well as the images contained within porn >spam. > >The issue with setting the scores very high is that some customers will >want to receive "adult" emails while others don't want to receive any. Which is why you can set the spam high score using a ruleset so that different users get different scoring thresholds. >If there was a generic way to build a ruleset to modify the subject line >(or add/modify a header), that would probably take care of it! :) > >Any chance something like this could be in MailScanner's future? *hint >hint* ;) > >-Rich > >On Mon, 7 Apr 2003, Julian Field wrote: > > > The problem of nasty porn spam can largely be solved with the "striphtml" > > spam action, as it removes all images from spam. In case it's not really > > spam, all the links in the message are maintained, but you don't have to > > suffer the images. This is keeping most of my users happy here. > > > > At 18:10 07/04/2003, you wrote: > > >Hi there! > > > > > >I was wondering if anyone had come up with a way to add a header or > > >perhaps prepend the subject line with something like {Porn?} based on the > > >language/content of an email? > > > > > >I want to be able to give our users something they can filter their mail > > >against if they don't want to receive ANY adult messages. > > > > > >Our customers like the ability to filter against {Spam?} in the subject > > >line for possible spam. > > > > > >Thanks! > > > > > >-Rich > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From danieltan at shopnsave.com.sg Tue Apr 8 10:51:13 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:43 2006 Subject: ANNOUNCE: Version 4.14 released References: Message-ID: <040801c2fdb4$64c3f660$3900a8c0@Daniel> the reason why i am ugrading is due to the fact that spamassassin 2.50 has problems with mailscanner... it seems like doing spamassassin --version is still at 2.50...although i have already upgraded....now still to find out why it did not upgrade ----- Original Message ----- From: "Raymond Dijkxhoorn" To: Sent: Tuesday, April 08, 2003 3:49 PM Subject: Re: ANNOUNCE: Version 4.14 released Hello Daniel, > how do you check the correct version of mailscanner and spam assassin? > just recently i upgraded spam assassin to the latest version to avoid mails > to be stuck due to mailscanner unable to send it out > but i still got the problem yesterday.that's why i need to check whether it For Spam Assasin: [root@master .spamassassin]# spamassassin --version SpamAssassin version 2.53 For Mailscanner, it prints the version number also in your maillog when starting up, so have a look there. > hope it helps as the staff are gunning for my head coz their mails aren't > sent "on time" Can you be a bit more specific ? Bye, Raymond. From danieltan at shopnsave.com.sg Tue Apr 8 10:54:08 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:43 2006 Subject: ANNOUNCE: Version 4.14 released References: Message-ID: <040c01c2fdb4$cc510e80$3900a8c0@Daniel> oh ya...1 more thing...maillog did not show mailscanner version at all.... Apr 8 17:51:33 mail MailScanner[24342]: New Batch: Scanning 1 message, 2131 bytes ----- Original Message ----- From: "Raymond Dijkxhoorn" To: Sent: Tuesday, April 08, 2003 3:49 PM Subject: Re: ANNOUNCE: Version 4.14 released Hello Daniel, > how do you check the correct version of mailscanner and spam assassin? > just recently i upgraded spam assassin to the latest version to avoid mails > to be stuck due to mailscanner unable to send it out > but i still got the problem yesterday.that's why i need to check whether it For Spam Assasin: [root@master .spamassassin]# spamassassin --version SpamAssassin version 2.53 For Mailscanner, it prints the version number also in your maillog when starting up, so have a look there. > hope it helps as the staff are gunning for my head coz their mails aren't > sent "on time" Can you be a bit more specific ? Bye, Raymond. From raymond at PROLOCATION.NET Tue Apr 8 10:57:30 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:43 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <040c01c2fdb4$cc510e80$3900a8c0@Daniel> Message-ID: Hi! > oh ya...1 more thing...maillog did not show mailscanner version at all.... > > Apr 8 17:51:33 mail MailScanner[24342]: New Batch: Scanning 1 message, > 2131 bytes If you START or RESTART mailscanner it will... But as Julian suggested you could also grep the version number from the mailscanner itself. Bye, Raymond. From vanhorn at whidbey.com Tue Apr 8 10:57:41 2003 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Thu Jan 12 21:17:43 2006 Subject: New RBL to add (NJABL) References: <200304071300.16625.linux@mostert.nom.za> Message-ID: <3E929D15.140E5E28@whidbey.com> Greetings, I just learned of a new RBL that sounds reasonable, and is currently free, at njabl.org. Has anyone incorporated that in spam.lists.conf, and if so, will you share the lines you added? Van -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For web hosting and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ---------------------------------------------------------- From vanhorn at whidbey.com Tue Apr 8 11:00:47 2003 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Thu Jan 12 21:17:43 2006 Subject: Bayes setup Message-ID: <3E929DCF.1CBA0BD0@whidbey.com> Greetings: I am running SpamAssassin 2.52 in MailScanner, and I've also been following the discussions of the SpamBayes project fairly closely for some months. One of the crucial elements of Bayesian detection is training, but I don't see any place that documents how to get ham and spam messages routed back to the server for training. Is there some documentation? Am I just missing it by installing SpamAssassin from cpan and MailScanner from RPMs? Van -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For web hosting and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ---------------------------------------------------------- From dh at UPTIME.AT Tue Apr 8 11:11:27 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:43 2006 Subject: New Batch found xx Messages counter still broken ? Message-ID: <76210F79-69AA-11D7-9325-000393920D6C@uptime.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Hi.. I know there was some discussion about this way back. I just noticed, that the counter across MailScanner childs does not seem to take in account how many messages are allready currently processed. So Child A says New Batch found 11 Messages Scanning x messages and a second later the next child still says it found 11 messages (maybe because the queuefile count is 11? ) is that normal, a bug, or simply idiot operator ?= ;) (namely me) - -d - -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GCC d+ s: a-- C+ UB++++ P+ L++ E--- W N+ o+++ K w-- O M+ V++ PS PE Y++ PGP++++ t+ 5 X- R+ tv-- b++++ DI D+ G e++++ h+ r++ y++ - ------END GEEK CODE BLOCK------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+kqBTiW/Ta/pxHPQRAyuFAJ987X4B5QkLB87+iKs6WinxqBbytwCgzdsd NWKhuP8omtWgslf7RLcQqA8= =f89/ -----END PGP SIGNATURE----- From mike at ZANKER.ORG Tue Apr 8 11:23:41 2003 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:17:43 2006 Subject: New RBL to add (NJABL) In-Reply-To: <3E929D15.140E5E28@whidbey.com> References: <200304071300.16625.linux@mostert.nom.za> <3E929D15.140E5E28@whidbey.com> Message-ID: <70795734.1049801021@mallard.open.ac.uk> On 08 April 2003 02:57 -0700 "G. Armour Van Horn" wrote: > I just learned of a new RBL that sounds reasonable, and is currently > free, at njabl.org. Has anyone incorporated that in spam.lists.conf, > and if so, will you share the lines you added? You need something like: NJABL dnsbl.njabl.org. Mike. From mike at ZANKER.ORG Tue Apr 8 11:29:42 2003 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:17:43 2006 Subject: New RBL to add (NJABL) (fwd) Message-ID: <71156312.1049801382@mallard.open.ac.uk> ...and then add NJABL to the "Spam List = " line in MailScanner.conf. Mike. ---------- Forwarded Message ---------- Date: 08 April 2003 11:23 +0100 From: Mike Zanker To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: New RBL to add (NJABL) On 08 April 2003 02:57 -0700 "G. Armour Van Horn" wrote: > I just learned of a new RBL that sounds reasonable, and is currently > free, at njabl.org. Has anyone incorporated that in spam.lists.conf, > and if so, will you share the lines you added? You need something like: NJABL dnsbl.njabl.org. Mike. ---------- End Forwarded Message ---------- From jonathan.stanton at FREECOM.NET Tue Apr 8 12:32:56 2003 From: jonathan.stanton at FREECOM.NET (Jonathan Stanton) Date: Thu Jan 12 21:17:43 2006 Subject: Signed messages. Message-ID: <01a301c2fdc2$99ed6570$0971e20a@benny> Since the digital sig protects all message via a checksum and any modification of message (body) will cause a change in checksum maybe the answer to this is to have an option in the config "DONOTSIGNSIGNED" flag. If the message is clean then you don't sign the message (this is a bit like the "Sign Clean Messages" flag which I have to use a rule-set for all the people I know that have Digital Certs) This would make it alot easier. Any possibility? Regards Jonathan Jonathan Stanton Freecom.net (UK ISP) ------- I'm not in denial. I'm just selective about the reality I accept. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3273 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030408/8c15ce04/smime.bin From mailscanner at ecs.soton.ac.uk Tue Apr 8 14:35:16 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Bayes setup In-Reply-To: <3E929DCF.1CBA0BD0@whidbey.com> Message-ID: <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> At 11:00 08/04/2003, you wrote: >Greetings: > >I am running SpamAssassin 2.52 in MailScanner, and I've also been >following the discussions of the SpamBayes project fairly closely for >some months. One of the crucial elements of Bayesian detection is >training, but I don't see any place that documents how to get ham and >spam messages routed back to the server for training. > >Is there some documentation? Am I just missing it by installing >SpamAssassin from cpan and MailScanner from RPMs? There are 2 parts to the answer to this: 1) You can set up a "spam" and a "notspam" email address for people to dump wrongly categorised mail into. You then use sa-learn once every hour (or day) to teach SpamAssassin about the messages it got wrong. I have already posted a script to do this to this list, but have attached it again for you. 2) SpamAssassin is unique in being able to "auto-learn", i.e. teach itself. It uses its other traditional rules to produce a score for each message. If the score is very high (i.e. definitely spam) or very low (i.e. definitely ham) then it feeds the message back into the learning code for the Bayes engine. It only starts using the Bayes engine output as part of the overall message score once it has auto-learned about 600 messages (I might well be wrong on that figure, but it's a few hundred). -------------- next part -------------- A non-text attachment was scrubbed... Name: learn.spam Type: application/octet-stream Size: 748 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030408/30c90012/learn.obj -------------- next part -------------- -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 8 14:40:44 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: New Batch found xx Messages counter still broken ? In-Reply-To: <76210F79-69AA-11D7-9325-000393920D6C@uptime.at> Message-ID: <5.2.0.9.2.20030408143532.04b17438@imap.ecs.soton.ac.uk> At 11:11 08/04/2003, you wrote: >I know there was some discussion about this way back. >I just noticed, that the counter across MailScanner childs does not >seem to take in account how many messages are allready currently >processed. > >So Child A says > >New Batch found 11 Messages >Scanning x messages > >and a second later the next child still says it found 11 messages >(maybe because the queuefile count is 11? ) > >is that normal, a bug, or simply idiot operator ?= ;) (namely me) That is quite normal, and intentional. It looks through the queue counting the number of messages in there (hence the "11") then tries to get exclusive control over each message in turn. But it only gets control over some of them (hence the "x"). -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 8 14:27:24 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <040801c2fdb4$64c3f660$3900a8c0@Daniel> References: Message-ID: <5.2.0.9.2.20030408142512.03dc91a8@imap.ecs.soton.ac.uk> At 10:51 08/04/2003, you wrote: >the reason why i am ugrading is due to the fact that spamassassin 2.50 has >problems with mailscanner... >it seems like doing spamassassin --version is still at 2.50...although i >have already upgraded....now still to find out why it did not upgrade But what did perl -MMail::SpamAssassin -le 'print $Mail::SpamAssassin::VERSION;' say? That's checking the version of SpamAssassin you really have installed where perl is looking for it, not just some version you happen to have unpacked in another directory. >----- Original Message ----- >From: "Raymond Dijkxhoorn" >To: >Sent: Tuesday, April 08, 2003 3:49 PM >Subject: Re: ANNOUNCE: Version 4.14 released > > >Hello Daniel, > > > how do you check the correct version of mailscanner and spam assassin? > > just recently i upgraded spam assassin to the latest version to avoid >mails > > to be stuck due to mailscanner unable to send it out > > but i still got the problem yesterday.that's why i need to check whether >it > >For Spam Assasin: > >[root@master .spamassassin]# spamassassin --version >SpamAssassin version 2.53 > >For Mailscanner, it prints the version number also in your maillog when >starting up, so have a look there. > > > hope it helps as the staff are gunning for my head coz their mails aren't > > sent "on time" > >Can you be a bit more specific ? > >Bye, >Raymond. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 8 15:01:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: RedHat 9 Message-ID: <5.2.0.9.2.20030408150015.03dbe950@imap.ecs.soton.ac.uk> Just remembered to let you folks know that, as far as I can see, MailScanner works fine with RedHat 9. I've had it running here for quite a few days now, and it seems happy enough. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From isp-list at TULSACONNECT.COM Tue Apr 8 16:06:40 2003 From: isp-list at TULSACONNECT.COM (ISP List) Date: Thu Jan 12 21:17:43 2006 Subject: Bayes setup In-Reply-To: <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> References: <3E929DCF.1CBA0BD0@whidbey.com> Message-ID: <5.2.1.1.2.20030408100542.047271f8@securemail.tulsaconnect.com> >There are 2 parts to the answer to this: > >1) You can set up a "spam" and a "notspam" email address for people to dump >wrongly categorised mail into. You then use sa-learn once every hour (or >day) to teach SpamAssassin about the messages it got wrong. I have already >posted a script to do this to this list, but have attached it again for you. > >2) SpamAssassin is unique in being able to "auto-learn", i.e. teach itself. >It uses its other traditional rules to produce a score for each message. If >the score is very high (i.e. definitely spam) or very low (i.e. definitely >ham) then it feeds the message back into the learning code for the Bayes >engine. It only starts using the Bayes engine output as part of the overall >message score once it has auto-learned about 600 messages (I might well be >wrong on that figure, but it's a few hundred). Probably would be useful to write up a quick web page that has this script and explanation, as I expect this question will continue to get asked.. ------------------------------------- Mike Bacher / mike@sparklogic.com Use OptiGold ISP? Check out OptiSkin! http://www.sparklogic.com/optiskin/ ------------------------------------- From mailscanner at ecs.soton.ac.uk Tue Apr 8 16:27:31 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:43 2006 Subject: Bayes setup In-Reply-To: <5.2.1.1.2.20030408100542.047271f8@securemail.tulsaconnect. com> References: <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> <3E929DCF.1CBA0BD0@whidbey.com> Message-ID: <5.2.0.9.2.20030408162710.035e0a40@imap.ecs.soton.ac.uk> At 16:06 08/04/2003, you wrote: >>There are 2 parts to the answer to this: >> >>1) You can set up a "spam" and a "notspam" email address for people to dump >>wrongly categorised mail into. You then use sa-learn once every hour (or >>day) to teach SpamAssassin about the messages it got wrong. I have already >>posted a script to do this to this list, but have attached it again for you. >> >>2) SpamAssassin is unique in being able to "auto-learn", i.e. teach itself. >>It uses its other traditional rules to produce a score for each message. If >>the score is very high (i.e. definitely spam) or very low (i.e. definitely >>ham) then it feeds the message back into the learning code for the Bayes >>engine. It only starts using the Bayes engine output as part of the overall >>message score once it has auto-learned about 600 messages (I might well be >>wrong on that figure, but it's a few hundred). > >Probably would be useful to write up a quick web page that has this script >and explanation, as I expect this question will continue to get asked.. Which is why the Faq-o-matic is there, so you can write one :-) -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From lists at STHOMAS.NET Tue Apr 8 17:04:51 2003 From: lists at STHOMAS.NET (Steve Thomas) Date: Thu Jan 12 21:17:43 2006 Subject: Deleting all Messages with a specific address in the "To:" field.... In-Reply-To: ; from richard_cipher@YAHOO.COM on Mon, Apr 07, 2003 at 12:48:28PM -0600 References: Message-ID: <20030408090451.A2346@sthomas.net> On Mon, Apr 07, 2003 at 12:48:28PM -0600, Evert Ford is rumored to have said: > ? > Is the ISP forward what's making this not work? Any Ideas? If I use > sendmail to delete it, it induces latency, and fetchmail dies > ? > I am using fetchmail version 6.2, sendmail version 8.12-7 and MailScanner > 4.14 on a Redhat Linux 7.2 system Is procmail in that mix somewhere? :0 * ^TO_myold@addr.ess /dev/null -- Steve Thomas steve +at+ sthomas -dot- net ---------------------------------------------------------- "...subatomic matter in a particle accelerator that exists for only a few microseconds seems to exhibit more uptime than the RIAA's website." -- Andrew Orlowski TheRegister.co.uk From raymond at PROLOCATION.NET Tue Apr 8 17:59:01 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:44 2006 Subject: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss (fwd) Message-ID: Hi! Naturally nobody on the list uses Amavis anymore but just in case you see it happening: ---------- Forwarded message ---------- Date: Mon, 7 Apr 2003 14:23:47 +0200 From: Phil Cyc Subject: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss Hi everyone - with postfix using AMaViS-ng 0.1.6.x (tested: 0.1.6.2 and 0.1.6.3; 0.1.4.x is not vulnerable), all email gets forwarded to the address specified by the "To:" header line, ignoring the real recipient given via "RCPT TO:". Possible exploit: --%snip%-- #> telnet somemx.domain.tld 25 (220 somemx.domain.tld ESMTP Postfix) helo amavis-ng (250 somemx.domain.tld) mail from:userX@domainX.tld (250 ok) rcpt to:userY@domain.tld (250 ok) data (354 End data with .) From: userX@domainX.tld To: userZ@domainZ.tld Subject: AMaViS-ng 0.1.6.x bug . (250 Ok: queued as ...) quit (221 Bye) --%snip%-- Requirements: The mx (somemx.domain.tld) having postfix and AMaViS-ng 0.1.6.x installed must accept emails for userY@domain.tld. What does it to: userX@domainX.tld is sending an email to userY@domain.tld. The header of this email contains "To: userZ@domain.tld". AMaViS-ng seems to parse the header and forwards the email to userZ@domain.tld. userY@domain.tld does not get this email. As many postfix users trust their localhost (no restrictions for localhost), it is possible to relay an email or a spam mail this way. configuration files (relevant parts): # $postfix/master.cf smtp inet n - n - - smtpd -o content_filter=filter: filter unix - n n - - pipe flags=Rq user=mail argv=/usr/bin/amavis ${sender} -- ${recipient} # end of master.cf # $amavis-ng/amavis.conf [global] mail-transfer-agent = Postfix [Postfix] postfix = /usr/sbin/sendmail args = -i -f # end of amavis.conf There is no problem with AMaViS == 0.1.4.x Kind regards, Phil Cyc From ralloway at WINBEAM.COM Tue Apr 8 18:10:19 2003 From: ralloway at WINBEAM.COM (Richard D Alloway) Date: Thu Jan 12 21:17:44 2006 Subject: Porn msg identification? In-Reply-To: <5.2.0.9.2.20030408084645.03ec8030@imap.ecs.soton.ac.uk> Message-ID: Thanks for everyone's input for my problem, but I think the goal I am trying to work towards is being lost in translation :) What I think would be a great feature is to allow custom rulesets. The more I think about it, the more I think being able to create a customer header for the custom ruleset would be the way to go. I imagine it working just like the Spam Score Header. Based on the score from the ruleset file (in my case, I'd create an adult language file) with scores per word, a custom header could be created which shows the "severity" of the language: Custom Score Header = X-MailScanner-Maturity: Custom Score Header = A Custom Score Ruleset = /etc/MailScanner/rules/Maturity.rules /etc/MailScanner/rules/Maturity.rules could contain: frick 1 frack 5 Then, a message which contains the word 'frick' 3 times and 'frack' once would have a score of 8, so a header of: X-MailScanner-Maturity = AAAAAAAA A customer who wishes to never receive emails with any of the words in the list can filter on the X-MailScanner-Maturity header containing 'A'. A customer who wishes to receive mildly mature emails can filter on the X-MailScanner-Maturity header containing 'AAAA', and so on... This way, the email is delivered to the customer and the customer has the option of deleting, moving to another folder, or doing nothing with the email. The reason I can't use the high score action, etc is that we delete spam with a high score. As an ISP, we do not force adult/mature content filtering on our customers, but would like to offer a solution that empowers the end user to decide the level of filtering. Thanks for hearing me out...again :) -Rich On Tue, 8 Apr 2003, Julian Field wrote: > At 01:48 08/04/2003, you wrote: > >Hmmm... I don't think that will satisfy my customers. > > > >The problem is the language as well as the images contained within porn > >spam. > > > >The issue with setting the scores very high is that some customers will > >want to receive "adult" emails while others don't want to receive any. > > Which is why you can set the spam high score using a ruleset so that > different users get different scoring thresholds. > > >If there was a generic way to build a ruleset to modify the subject line > >(or add/modify a header), that would probably take care of it! :) > > > >Any chance something like this could be in MailScanner's future? *hint > >hint* ;) > > > >-Rich > > > >On Mon, 7 Apr 2003, Julian Field wrote: > > > > > The problem of nasty porn spam can largely be solved with the "striphtml" > > > spam action, as it removes all images from spam. In case it's not really > > > spam, all the links in the message are maintained, but you don't have to > > > suffer the images. This is keeping most of my users happy here. > > > > > > At 18:10 07/04/2003, you wrote: > > > >Hi there! > > > > > > > >I was wondering if anyone had come up with a way to add a header or > > > >perhaps prepend the subject line with something like {Porn?} based on the > > > >language/content of an email? > > > > > > > >I want to be able to give our users something they can filter their mail > > > >against if they don't want to receive ANY adult messages. > > > > > > > >Our customers like the ability to filter against {Spam?} in the subject > > > >line for possible spam. > > > > > > > >Thanks! > > > > > > > >-Rich > > > > > > -- > > > Julian Field > > > www.MailScanner.info > > > Professional Support Services at www.MailScanner.biz > > > MailScanner thanks transtec Computers for their support > > > > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > From richard_cipher at YAHOO.COM Tue Apr 8 18:10:54 2003 From: richard_cipher at YAHOO.COM (Evert Ford) Date: Thu Jan 12 21:17:44 2006 Subject: Deleting all Messages with a specific address in the "To:" field.... In-Reply-To: <20030408090451.A2346@sthomas.net> References: <20030408090451.A2346@sthomas.net> Message-ID: On Tue, 8 Apr 2003 09:04:51 -0700, Steve Thomas wrote: > On Mon, Apr 07, 2003 at 12:48:28PM -0600, Evert Ford is rumored to have > said: >> ? >> Is the ISP forward what's making this not work? Any Ideas? If I use >> sendmail to delete it, it induces latency, and fetchmail dies >> ? >> I am using fetchmail version 6.2, sendmail version 8.12-7 and >> MailScanner 4.14 on a Redhat Linux 7.2 system > > Is procmail in that mix somewhere? > > :0 > * ^TO_myold@addr.ess > /dev/null > > That should do the trick...I somehow forgot about procmail, and it won't make fetchmail die because of latency in sendmail, and I don't have to worry about the "To:" not matching the envelope. Excellent suggestion! Evert Ford Westone Laboratories www.westone.com From mailscanner at ecs.soton.ac.uk Tue Apr 8 18:12:23 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss (fwd) In-Reply-To: Message-ID: <5.2.0.9.2.20030408181135.0257b008@imap.ecs.soton.ac.uk> Am I allowed to sound smug and say "this is exactly why MailScanner doesn't get involved in SMTP provision or message delivery"... At 17:59 08/04/2003, you wrote: >Hi! > >Naturally nobody on the list uses Amavis anymore but just in >case you see it happening: > >---------- Forwarded message ---------- >Date: Mon, 7 Apr 2003 14:23:47 +0200 >From: Phil Cyc >Subject: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss > >Hi everyone - > >with postfix using AMaViS-ng 0.1.6.x (tested: 0.1.6.2 and 0.1.6.3; 0.1.4.x is >not vulnerable), all email gets forwarded to the address specified by the >"To:" header line, ignoring the real recipient given via "RCPT TO:". -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Tue Apr 8 18:20:43 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:44 2006 Subject: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss (fwd) In-Reply-To: <5.2.0.9.2.20030408181135.0257b008@imap.ecs.soton.ac.uk> Message-ID: Hi! > Am I allowed to sound smug and say "this is exactly why MailScanner doesn't > get involved in SMTP provision or message delivery"... > >Naturally nobody on the list uses Amavis anymore but just in > >case you see it happening: No, its very wise to leave such things up to an MTA. Thats designed to handle things like that. Bye, Raymond. From tchamtieh at YAHOO.COM Tue Apr 8 18:22:05 2003 From: tchamtieh at YAHOO.COM (Thomas Chamtieh) Date: Thu Jan 12 21:17:44 2006 Subject: Quarantine Indexing? Message-ID: <20030408172205.89055.qmail@web13203.mail.yahoo.com> I'm not sure if anyone has implemented this or not. I'm trying to create an index file that would contain an index (Subject, Date, From, To, Size, etc..) of all messages that are quarantined. I'm thinking, a code that is part of MailScanner that would write to that index file everytime a messages is quarantined. Any suggestions? ideas? where to start? Thanks, -Thomas --------------------------------- Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030408/9008f002/attachment.html From mailscanner at LISTS.COM.AR Tue Apr 8 18:49:10 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:44 2006 Subject: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss (fwd) In-Reply-To: <5.2.0.9.2.20030408181135.0257b008@imap.ecs.soton.ac.uk> References: Message-ID: <3E92E166.27159.5B9FF30B@localhost> It's suuuuuuch a gooooooood idea to NOT write SMTP server code every time you want to do something in a mail server... Having such a bunch of good to excelent mail servers developed by people that are mostly dedicated to it, it doesn't make sense to write another one just because you want to develope an antispam or antivirus or any other thing you might want to do with mail.... El 8 Apr 2003 a las 18:12, Julian Field escribi?: > Am I allowed to sound smug and say "this is exactly why MailScanner doesn't > get involved in SMTP provision or message delivery"... > > At 17:59 08/04/2003, you wrote: > >Hi! > > > >Naturally nobody on the list uses Amavis anymore but just in > >case you see it happening: > > > >---------- Forwarded message ---------- > >Date: Mon, 7 Apr 2003 14:23:47 +0200 > >From: Phil Cyc > >Subject: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss > > > >Hi everyone - > > > >with postfix using AMaViS-ng 0.1.6.x (tested: 0.1.6.2 and 0.1.6.3; 0.1.4.x is > >not vulnerable), all email gets forwarded to the address specified by the > >"To:" header line, ignoring the real recipient given via "RCPT TO:". > -- Mariano Absatz El Baby ---------------------------------------------------------- Ambivalent? Well, yes and no. From mailscanner at ecs.soton.ac.uk Tue Apr 8 18:50:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: Quarantine Indexing? In-Reply-To: <20030408172205.89055.qmail@web13203.mail.yahoo.com> Message-ID: <5.2.0.9.2.20030408184731.0253ceb0@imap.ecs.soton.ac.uk> At 18:22 08/04/2003, you wrote: >I'm not sure if anyone has implemented this or not. I'm trying to create >an index file that would contain an index (Subject, Date, From, To, Size, >etc..) of all messages that are quarantined. I'm thinking, a code that is >part of MailScanner that would write to that index file everytime a >messages is quarantined. > >Any suggestions? ideas? where to start? Take a look at CustomConfig.pm and the SQLLogging code in there. This is a good demonstration of a Custom Function with side effects (logging in this case). Work out what config option to hang the Custom Function off, and you should just be able to nick the code. If you do it exactly the same as the SQL Logging code does now, you could just log messages that are found to contain viruses or other nasty things, there are properties of the Message object which will tell you if this is the case. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Tue Apr 8 18:57:33 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:44 2006 Subject: Porn msg identification? In-Reply-To: References: <5.2.0.9.2.20030408084645.03ec8030@imap.ecs.soton.ac.uk> Message-ID: <3E92E35D.1400.5BA79E38@localhost> Hi Rich, The point is that MailScanner doesn't know anything about scoring messages... the spam score you see in MailScanner is actually done by the SpamAssassin library that MailScanner optionally uses. Now, _that_ library, including the rules that come with it, is developed and optimized to tag as much spam as possible _avoiding_ as many false positives as it can. Thus, SpamAssassin scans the message looking for patterns and it adds or substracts from the score as some conditions are met or not... You _could_ create a different set of rules for SpamAssassin and invoke it twice, once for spam detection and the other for "adulthood" detection, but that would imply at least modifying MailScanner and using a secondary set of SpamAssassin rules... it _will_ require some time and an effort to do it... El 8 Apr 2003 a las 13:10, Richard D Alloway escribi?: > Thanks for everyone's input for my problem, but I think the goal I am > trying to work towards is being lost in translation :) > > What I think would be a great feature is to allow custom rulesets. The > more I think about it, the more I think being able to create a customer > header for the custom ruleset would be the way to go. > > I imagine it working just like the Spam Score Header. > > Based on the score from the ruleset file (in my case, I'd create an adult > language file) with scores per word, a custom header could be created > which shows the "severity" of the language: > > Custom Score Header = X-MailScanner-Maturity: > > Custom Score Header = A > > Custom Score Ruleset = /etc/MailScanner/rules/Maturity.rules > > /etc/MailScanner/rules/Maturity.rules could contain: > frick 1 > frack 5 > > Then, a message which contains the word 'frick' 3 times and 'frack' once > would have a score of 8, so a header of: > X-MailScanner-Maturity = AAAAAAAA > > A customer who wishes to never receive emails with any of the words in the > list can filter on the X-MailScanner-Maturity header containing 'A'. > > A customer who wishes to receive mildly mature emails can filter on the > X-MailScanner-Maturity header containing 'AAAA', and so on... > > This way, the email is delivered to the customer and the customer has the > option of deleting, moving to another folder, or doing nothing with the > email. > > The reason I can't use the high score action, etc is that we delete spam > with a high score. > > As an ISP, we do not force adult/mature content filtering on our > customers, but would like to offer a solution that empowers the end user > to decide the level of filtering. > > Thanks for hearing me out...again :) > > -Rich > > On Tue, 8 Apr 2003, Julian Field wrote: > > > At 01:48 08/04/2003, you wrote: > > >Hmmm... I don't think that will satisfy my customers. > > > > > >The problem is the language as well as the images contained within porn > > >spam. > > > > > >The issue with setting the scores very high is that some customers will > > >want to receive "adult" emails while others don't want to receive any. > > > > Which is why you can set the spam high score using a ruleset so that > > different users get different scoring thresholds. > > > > >If there was a generic way to build a ruleset to modify the subject line > > >(or add/modify a header), that would probably take care of it! :) > > > > > >Any chance something like this could be in MailScanner's future? *hint > > >hint* ;) > > > > > >-Rich > > > > > >On Mon, 7 Apr 2003, Julian Field wrote: > > > > > > > The problem of nasty porn spam can largely be solved with the "striphtml" > > > > spam action, as it removes all images from spam. In case it's not really > > > > spam, all the links in the message are maintained, but you don't have to > > > > suffer the images. This is keeping most of my users happy here. > > > > > > > > At 18:10 07/04/2003, you wrote: > > > > >Hi there! > > > > > > > > > >I was wondering if anyone had come up with a way to add a header or > > > > >perhaps prepend the subject line with something like {Porn?} based on the > > > > >language/content of an email? > > > > > > > > > >I want to be able to give our users something they can filter their mail > > > > >against if they don't want to receive ANY adult messages. > > > > > > > > > >Our customers like the ability to filter against {Spam?} in the subject > > > > >line for possible spam. > > > > > > > > > >Thanks! > > > > > > > > > >-Rich -- Mariano Absatz El Baby ---------------------------------------------------------- To you I'm an atheist; to God, I'm the Loyal Opposition. -- Woody Allen From donovan at HUFFDATASYSTEMS.COM Tue Apr 8 19:23:31 2003 From: donovan at HUFFDATASYSTEMS.COM (Donovan Huff | HUFF DATA SYSTEMS) Date: Thu Jan 12 21:17:44 2006 Subject: How do I tag e-mails in foreign languages e-mails this as SPAM? Message-ID: <02b201c2fdfb$f6820550$06bc5a42@x27> How do I tag e-mails in foreign languages like this as SPAM (see attached e-mail)? I receive SPAM in French, Spanish, etc how do I tag this as well? Is there a way to maybe have MailScanner and SpamAssassin use multiple language files to solve this issue? I could block e-mail from .fr and .mx, but that is going overboard it seems. SPAM is bad, SPAM in a foreign language is worse IMO and seems pointless if the person doesn't understand the language. TIA, Donovan -------------- next part -------------- An embedded message was scrubbed... From: "MesFavorix.com" Subject: =?ISO-8859-1?Q?Un site =E0 d=E9couvrir !?= Date: Fri, 4 apr 2003 18:31:24 +0200 Size: 1964 Url: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030408/93cccca6/iso-8859-1QUn_site_E0_dE9couvrir_.mht From donovan at HUFFDATASYSTEMS.COM Tue Apr 8 19:33:22 2003 From: donovan at HUFFDATASYSTEMS.COM (Donovan Huff | HUFF DATA SYSTEMS) Date: Thu Jan 12 21:17:44 2006 Subject: Porn msg identification? References: <5.2.0.9.2.20030408084645.03ec8030@imap.ecs.soton.ac.uk> <3E92E35D.1400.5BA79E38@localhost> Message-ID: <02b801c2fdfd$56ace5c0$06bc5a42@x27> Hey, sometimes people swear/cuss/or whatever your name is for it in e-mails, sometimes multiple times etc. I just wanted to point that out. What e-mails is MailScanner w/ SpamAssassin not blocking are you using RBLs/DNSBLs? If not start and it should greatly help your problem; if you are using them, which ones because you likely need to use some additional ones as well. Check out this link (stats not that old) for an example of how effective this is: http://www.huffdatasystems.com/mailstats/ Only SPAM I have issues with are ones in foreign languages which are not too many at the moment, and I am working getting that issue resolved. Regards, Donovan Huff Owner/Operator HUFF DATA SYSTEMS donovan@huffdatasystems.com http://www.huffdatasystems.com/ (361) 781-0631 ------------------------------------------------------ Web Hosting Starting at $5.00/mo http://www.huffdatasystems.com/ ------------------------------------------------------ Internet Access Just About Anywhere http://UnlimitedCheapInternet.com/ ------------------------------------------------------ ----- Original Message ----- From: "Mariano Absatz" To: Sent: Tuesday, April 08, 2003 12:57 PM Subject: Re: Porn msg identification? > Hi Rich, > > The point is that MailScanner doesn't know anything about scoring messages... > the spam score you see in MailScanner is actually done by the SpamAssassin > library that MailScanner optionally uses. > > Now, _that_ library, including the rules that come with it, is developed and > optimized to tag as much spam as possible _avoiding_ as many false positives > as it can. > > Thus, SpamAssassin scans the message looking for patterns and it adds or > substracts from the score as some conditions are met or not... > > You _could_ create a different set of rules for SpamAssassin and invoke it > twice, once for spam detection and the other for "adulthood" detection, but > that would imply at least modifying MailScanner and using a secondary set of > SpamAssassin rules... it _will_ require some time and an effort to do it... > > El 8 Apr 2003 a las 13:10, Richard D Alloway escribi?: > > > Thanks for everyone's input for my problem, but I think the goal I am > > trying to work towards is being lost in translation :) > > > > What I think would be a great feature is to allow custom rulesets. The > > more I think about it, the more I think being able to create a customer > > header for the custom ruleset would be the way to go. > > > > I imagine it working just like the Spam Score Header. > > > > Based on the score from the ruleset file (in my case, I'd create an adult > > language file) with scores per word, a custom header could be created > > which shows the "severity" of the language: > > > > Custom Score Header = X-MailScanner-Maturity: > > > > Custom Score Header = A > > > > Custom Score Ruleset = /etc/MailScanner/rules/Maturity.rules > > > > /etc/MailScanner/rules/Maturity.rules could contain: > > frick 1 > > frack 5 > > > > Then, a message which contains the word 'frick' 3 times and 'frack' once > > would have a score of 8, so a header of: > > X-MailScanner-Maturity = AAAAAAAA > > > > A customer who wishes to never receive emails with any of the words in the > > list can filter on the X-MailScanner-Maturity header containing 'A'. > > > > A customer who wishes to receive mildly mature emails can filter on the > > X-MailScanner-Maturity header containing 'AAAA', and so on... > > > > This way, the email is delivered to the customer and the customer has the > > option of deleting, moving to another folder, or doing nothing with the > > email. > > > > The reason I can't use the high score action, etc is that we delete spam > > with a high score. > > > > As an ISP, we do not force adult/mature content filtering on our > > customers, but would like to offer a solution that empowers the end user > > to decide the level of filtering. > > > > Thanks for hearing me out...again :) > > > > -Rich > > > > On Tue, 8 Apr 2003, Julian Field wrote: > > > > > At 01:48 08/04/2003, you wrote: > > > >Hmmm... I don't think that will satisfy my customers. > > > > > > > >The problem is the language as well as the images contained within porn > > > >spam. > > > > > > > >The issue with setting the scores very high is that some customers will > > > >want to receive "adult" emails while others don't want to receive any. > > > > > > Which is why you can set the spam high score using a ruleset so that > > > different users get different scoring thresholds. > > > > > > >If there was a generic way to build a ruleset to modify the subject line > > > >(or add/modify a header), that would probably take care of it! :) > > > > > > > >Any chance something like this could be in MailScanner's future? *hint > > > >hint* ;) > > > > > > > >-Rich > > > > > > > >On Mon, 7 Apr 2003, Julian Field wrote: > > > > > > > > > The problem of nasty porn spam can largely be solved with the "striphtml" > > > > > spam action, as it removes all images from spam. In case it's not really > > > > > spam, all the links in the message are maintained, but you don't have to > > > > > suffer the images. This is keeping most of my users happy here. > > > > > > > > > > At 18:10 07/04/2003, you wrote: > > > > > >Hi there! > > > > > > > > > > > >I was wondering if anyone had come up with a way to add a header or > > > > > >perhaps prepend the subject line with something like {Porn?} based on the > > > > > >language/content of an email? > > > > > > > > > > > >I want to be able to give our users something they can filter their mail > > > > > >against if they don't want to receive ANY adult messages. > > > > > > > > > > > >Our customers like the ability to filter against {Spam?} in the subject > > > > > >line for possible spam. > > > > > > > > > > > >Thanks! > > > > > > > > > > > >-Rich > > -- > Mariano Absatz > El Baby > ---------------------------------------------------------- > To you I'm an atheist; to God, I'm the Loyal Opposition. > -- Woody Allen From mailscanner at ecs.soton.ac.uk Tue Apr 8 19:34:58 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: How do I tag e-mails in foreign languages e-mails this as SPAM? In-Reply-To: <02b201c2fdfb$f6820550$06bc5a42@x27> Message-ID: <5.2.0.9.2.20030408193424.025a2f68@imap.ecs.soton.ac.uk> At 19:23 08/04/2003, you wrote: >How do I tag e-mails in foreign languages like this as SPAM (see attached >e-mail)? I receive SPAM in French, Spanish, etc how do I >tag this as well? Is there a way to maybe have MailScanner and >SpamAssassin use multiple language files to solve this issue? I >could block e-mail from .fr and .mx, but that is going overboard it >seems. SPAM is bad, SPAM in a foreign language is worse IMO and >seems pointless if the person doesn't understand the language. Read "man Mail::SpamAssassin::Conf" and look for the language options in there. >TIA, > >Donovan >Return-Path: >Received: from core.huffdatasystems.net (root@localhost) > by huffdatasystems.com (8.11.6/8.11.6) with ESMTP id h37Evt510321 > for ; Mon, 7 Apr 2003 09:57:55 -0500 >X-ClientAddr: 62.62.156.28 >Received: from huva.hittite.isp.9tel.net (huva.hittite.isp.9tel.net >[62.62.156.28]) > by core.huffdatasystems.net (8.11.6/8.11.6) with ESMTP id > h37EvM810309 > for ; Mon, 7 Apr 2003 09:57:22 -0500 >Received: from monsieur (187.68.203.213.9lyon1-0-ro-as-i1-2.9tel.net >[213.203.68.187]) > by huva.hittite.isp.9tel.net (Postfix) with SMTP id 835BF11A992 > for ; Sun, 6 Apr 2003 07:54:04 > +0200 (CEST) >From: "MesFavorix.com" >Reply-To: "MesFavorix.com" >Subject: Un site ? d?couvrir ! >Date: Fri, 4 apr 2003 18:31:24 +0200 >Importance: normal >X-Mailer: GOTO Software Sarbacane Vs 1.10C >Mime-Version: 1.0 >Content-Type: text/plain; charset="ISO-8859-1" >X-mailer: Sarbacane 1.10 >Message-Id: <20030406055405.835BF11A992@huva.hittite.isp.9tel.net> >To: undisclosed-recipients:; >X-MailScanner-Information: Please contact the ISP for more information >X-MailScanner: Found to be clean >X-MailScanner-SpamCheck: not spam, SpamAssassin (score=4.1, required 5, > INVALID_DATE, MIME_LONG_LINE_QP, RCVD_IN_RFCI, UNDISC_RECIPS) >X-MailScanner-SpamScore: ssss >X-MIME-Autoconverted: from quoted-printable to 8bit by huffdatasystems.com >id h37Evt510321 >Status: >X-MIME-Autoconverted: from 8bit to quoted-printable by ori.rl.ac.uk id >h38INuE05415 > -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From sevans at FOUNDATION.SDSU.EDU Tue Apr 8 20:19:15 2003 From: sevans at FOUNDATION.SDSU.EDU (Steve Evans) Date: Thu Jan 12 21:17:44 2006 Subject: Bayes setup Message-ID: It's 200 not 600. Steve Evans SDSU Foundation (619) 594-0653 -----Original Message----- From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] Sent: Tuesday, April 08, 2003 6:35 AM To: MAILSCANNER@JISCMAIL.AC.UK At 11:00 08/04/2003, you wrote: >Greetings: > >I am running SpamAssassin 2.52 in MailScanner, and I've also been >following the discussions of the SpamBayes project fairly closely for >some months. One of the crucial elements of Bayesian detection is >training, but I don't see any place that documents how to get ham and >spam messages routed back to the server for training. > >Is there some documentation? Am I just missing it by installing >SpamAssassin from cpan and MailScanner from RPMs? There are 2 parts to the answer to this: 1) You can set up a "spam" and a "notspam" email address for people to dump wrongly categorised mail into. You then use sa-learn once every hour (or day) to teach SpamAssassin about the messages it got wrong. I have already posted a script to do this to this list, but have attached it again for you. 2) SpamAssassin is unique in being able to "auto-learn", i.e. teach itself. It uses its other traditional rules to produce a score for each message. If the score is very high (i.e. definitely spam) or very low (i.e. definitely ham) then it feeds the message back into the learning code for the Bayes engine. It only starts using the Bayes engine output as part of the overall message score once it has auto-learned about 600 messages (I might well be wrong on that figure, but it's a few hundred). From kevins at BMRB.CO.UK Tue Apr 8 20:59:42 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:44 2006 Subject: How do I tag e-mails in foreign languages e-mails this as SPAM? In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EDF700@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF700@pascal.priv.bmrb.co.uk> Message-ID: <1049831982.12386.24.camel@bach.kevinspicer.co.uk> Set the following in spam.assassin.prefs.conf ... ok_locales en ok_languages en This will cause mail mail other than en to trigger SA 'spam in a foreign language' type tests. For a full list of the country codes see http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html On Tue, 2003-04-08 at 19:23, Donovan Huff | HUFF DATA SYSTEMS wrote: How do I tag e-mails in foreign languages like this as SPAM (see attached e-mail)? I receive SPAM in French, Spanish, etc how do I tag this as well? Is there a way to maybe have MailScanner and SpamAssassin use multiple language files to solve this issue? I could block e-mail from .fr and .mx, but that is going overboard it seems. SPAM is bad, SPAM in a foreign language is worse IMO and seems pointless if the person doesn't understand the language. TIA, Donovan BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dll at SCITOOLS.COM Tue Apr 8 21:54:46 2003 From: dll at SCITOOLS.COM (Dan Leavitt) Date: Thu Jan 12 21:17:44 2006 Subject: scanning precedence Message-ID: <011c01c2fe11$1785a990$170aa8c0@DELL> I have MailScanner configured to use SpamAssassin and Sophos and I'm unclear about the order of events. Considering the recent performance issues with sweep, I'd like spam actions like delete to take precedence over and obviate the need for subsequent virus scanning. Is this already the case? Do we have this control? Thanks, Dan From mailscanner at LISTS.COM.AR Tue Apr 8 22:05:23 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:44 2006 Subject: languages.conf Message-ID: <3E930F63.8193.5C5398ED@localhost> I sent this message a couple of days ago and got no reply... Can we easily identify which messages go in the mail headers and which don't? Do all strings in language.conf go into the headers? Do all text put into the headers come from language.conf? Shouldn't all the MailScanner.conf values at the bottom of this message have a default in language.conf? Will the chainsaw kill Batman and Robin? Can the Riddler get away with the money? Will Gotham City fall into the hands of the evildoers? Don't miss the next chapter, at the same bat-hour in the same bat-channel!!! :-P Hi, I started using the Spanish translations in my test environment and found a couple of problems... All the mailers I have (Pegasus & Outlook for windows, plain old "mail" and elm for linux) don't correctly interpret MIME header encoding for unknown headers (e.g. X-MailScanner-SpamCheck:), so they look awful when they are encoded... This doesn't lead to a clear solution, since you _do_ have to encode 8 bit headers, but I was wondering: Do all texts that go into headers come from the languages.conf file? Do all texts that are in the languages.conf file go into headers? If both are true, at least in Spanish, I could edit them so they _don't_ have 8 bit characters, either by using other words or by, like in pre-MIME times replacing accented characters (or the infamous "?") by non-accented characters. If one of the premises is not true, could you identify which are the words/phrases that go into the headers? Another one: shouldn't these settings (in MailScanner.conf) be commented out? and be defaulted from language.conf entries? This would help towards internationalization... obviously, if entries in MailScanner.conf would override the defaults: Clean Header Value = Found to be clean Infected Header Value = Found to be infected Disinfected Header Value = Disinfected Information Header Value = Please contact the ISP for more information -- Mariano Absatz El Baby ---------------------------------------------------------- "An idiot with a computer is a faster, better idiot" -- Rich Julius From kevins at BMRB.CO.UK Tue Apr 8 22:57:48 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:44 2006 Subject: languages.conf In-Reply-To: <3E930F63.8193.5C5398ED@localhost> References: <3E930F63.8193.5C5398ED@localhost> Message-ID: <1049839068.14329.29.camel@bach.kevinspicer.co.uk> > Will the chainsaw kill Batman and Robin? > No > Can the Riddler get away with the money? > No > Will Gotham City fall into the hands of the evildoers? > No Hope that helps ;) BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mark at TIPPINGMAR.COM Wed Apr 9 05:19:04 2003 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:17:44 2006 Subject: Starting SpamAssassin Message-ID: <66409586-6A42-11D7-B3BC-0003939C8BF6@tippingmar.com> I'm adding SpamAssassin to an already working MailScanner setup. It looks like it is working now, but while I was setting it up I was uncertain if I needed to set Spam Checks = Yes in addition to Use SpamAssassin = Yes In other words, does the Spam Checks setting control the entire spam checking process or just the MailScanner RBL checks? I intended to let SpamAssassin do the RBL checks and turn them off in MailScanner. I finally settled on Spam Checks = Yes Spam List = Use SpamAssassin = Yes Was that the right way to do it? Thanks, Mark From bamcomp at YAHOO.COM Wed Apr 9 04:17:14 2003 From: bamcomp at YAHOO.COM (Brett Moss) Date: Thu Jan 12 21:17:44 2006 Subject: RedHat 9 and mcafee problems OT? In-Reply-To: <5.2.0.9.2.20030408150015.03dbe950@imap.ecs.soton.ac.uk> Message-ID: <20030409031714.87588.qmail@web13808.mail.yahoo.com> hi, is anyone else using mcafee uvscan either 416 or 424 able to get it to function with redhat 9? the scan on its own hangs the system with either version, and if i use it with MailScanner after a LONG delay ( hours)every email comes up infected with a DOS attack. i tried it with both an upgrade and a clean install. trying to contact nai/mcafee is maddening. sorry for the borderline/off topic post thanks, brett --- Julian Field wrote: > Just remembered to let you folks know that, as far > as I can see, > MailScanner works fine with RedHat 9. > I've had it running here for quite a few days now, > and it seems happy enough. > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com From mailscanner at ecs.soton.ac.uk Wed Apr 9 08:51:53 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: scanning precedence In-Reply-To: <011c01c2fe11$1785a990$170aa8c0@DELL> Message-ID: <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> At 21:54 08/04/2003, you wrote: >I have MailScanner configured to use SpamAssassin and Sophos >and I'm unclear about the order of events. Considering the recent >performance issues with sweep, I'd like spam actions like delete to >take precedence over and obviate the need for subsequent >virus scanning. Is this already the case? Do we have this control? In a batch of messages, there will always be some non-spam that needs scanning, so you can't actually do this. However, if you use the "sophossavi" scanner with the Perl-SAVI module, that avoids all the speed problems with sweep anyway. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 9 08:57:51 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: languages.conf In-Reply-To: <3E930F63.8193.5C5398ED@localhost> Message-ID: <5.2.0.9.2.20030409085332.0232ac38@imap.ecs.soton.ac.uk> At 22:05 08/04/2003, you wrote: >I sent this message a couple of days ago and got no reply... > >Can we easily identify which messages go in the mail headers and which don't? Certainly in my original English version, there are comments that explain briefly where every entry is used. >Shouldn't all the MailScanner.conf values at the bottom of this message have >a default in language.conf? Ideally yes. It's just that I wrote the language.conf file fairly recently and didn't want to move stuff that wasn't necessary. >Will the chainsaw kill Batman and Robin? >Can the Riddler get away with the money? >Will Gotham City fall into the hands of the evildoers? >Don't miss the next chapter, at the same bat-hour in the same bat-channel!!! The caped crusader will survive! He will!! >:-P > > > >Hi, > >I started using the Spanish translations in my test environment and found a >couple of problems... > >All the mailers I have (Pegasus & Outlook for windows, plain old "mail" and >elm for linux) don't correctly interpret MIME header encoding for unknown >headers (e.g. X-MailScanner-SpamCheck:), so they look awful when they are >encoded... > >This doesn't lead to a clear solution, since you _do_ have to encode 8 bit >headers, but I was wondering: > >Do all texts that go into headers come from the languages.conf file? > >Do all texts that are in the languages.conf file go into headers? > >If both are true, at least in Spanish, I could edit them so they _don't_ have >8 bit characters, either by using other words or by, like in pre-MIME times >replacing accented characters (or the infamous "?") by non-accented >characters. > >If one of the premises is not true, could you identify which are the >words/phrases that go into the headers? > >Another one: shouldn't these settings (in MailScanner.conf) be commented out? >and be defaulted from language.conf entries? This would help towards >internationalization... obviously, if entries in MailScanner.conf would >override the defaults: > >Clean Header Value = Found to be clean >Infected Header Value = Found to be infected >Disinfected Header Value = Disinfected >Information Header Value = Please contact the ISP for more information > > > >-- >Mariano Absatz >El Baby >---------------------------------------------------------- >"An idiot with a computer is a faster, better idiot" > -- Rich Julius -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 9 09:05:39 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: Starting SpamAssassin In-Reply-To: <66409586-6A42-11D7-B3BC-0003939C8BF6@tippingmar.com> Message-ID: <5.2.0.9.2.20030409090520.02416288@imap.ecs.soton.ac.uk> At 05:19 09/04/2003, you wrote: >I'm adding SpamAssassin to an already working MailScanner setup. It >looks like it is working now, but while I was setting it up I was >uncertain if I needed to set > >Spam Checks = Yes > >in addition to > >Use SpamAssassin = Yes Yes. >In other words, does the Spam Checks setting control the entire spam >checking process or just the MailScanner RBL checks? I intended to let >SpamAssassin do the RBL checks and turn them off in MailScanner. I >finally settled on > >Spam Checks = Yes >Spam List = >Use SpamAssassin = Yes > >Was that the right way to do it? Perfect. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From canau at KEKA.KPNQWEST.PT Wed Apr 9 10:14:22 2003 From: canau at KEKA.KPNQWEST.PT (Carlos Canau) Date: Thu Jan 12 21:17:44 2006 Subject: sophossavi [was Re: scanning precedence] In-Reply-To: <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> References: <011c01c2fe11$1785a990$170aa8c0@DELL> <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> Message-ID: <20030409091422.GA17460@ionia.eunet.pt> After last night IDE update from Sophos MailScanner started crashing: Apr 9 08:06:13 host MailScanner[25740]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 9 08:06:17 host MailScanner[25740]: SophosSAVI ERROR:: initializing savi: Unknown error (557) I've had to change back from sophossavi to sophos. Any hints on how to debug it on MailScanner ? /SAVI-Perl-0.15/example root@host# ./scan.pl /tmp/SPAM4.txt Version 3.68 (engine 2.14) recognizing 80962 viruses IDE /opt/sophos/lib/vdl.dat released 4/7/2003 Error setting Mac: 524 Error setting SafeMacDfHandling: 524 Scanning /tmp/SPAM4.txt - clean thanks, At 21:54 08/04/2003, you wrote: > >I have MailScanner configured to use SpamAssassin and Sophos > >and I'm unclear about the order of events. Considering the recent > >performance issues with sweep, I'd like spam actions like delete to > >take precedence over and obviate the need for subsequent > >virus scanning. Is this already the case? Do we have this control? > > In a batch of messages, there will always be some non-spam that needs > scanning, so you can't actually do this. However, if you use the > "sophossavi" scanner with the Perl-SAVI module, that avoids all the speed > problems with sweep anyway. > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 9 10:17:02 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: RedHat 9 and mcafee problems OT? In-Reply-To: <20030409031714.87588.qmail@web13808.mail.yahoo.com> References: <5.2.0.9.2.20030408150015.03dbe950@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030409100039.021dee78@imap.ecs.soton.ac.uk> At 04:17 09/04/2003, you wrote: >hi, >is anyone else using mcafee uvscan either 416 or 424 >able to get it to function with redhat 9? I have just downloaded the evaluation version which claims to be 424. Even on a RedHat 8 system, it relies on a RedHat 7.3 compatibility package for the old libstdc++ McAfee uses. This compatibility package doesn't get installed by default on RedHat 9. I have just installed the compat-libcstdc++ package. McAfee does indeed hang. Tracing it gives the following at the end: open("/proc/devices", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x402f5000 read(4, "Character devices:\n 1 mem\n 2 p"..., 4096) = 378 futex(0x80864b0, FUTEX_WAIT, -39, NULL so for some reason it is reading /proc/devices (I even passed "--noboot" on the command line). It then sits in a lock waiting for something that will never happen. So you are quite correct, McAfee does not work on RedHat 9. I'll post a news item on the MailScanner web site. >the scan on its own hangs the system with either >version, and if i use it with MailScanner after a LONG >delay ( hours)every email comes up infected with a DOS >attack. i tried it with both an upgrade and a clean >install. >trying to contact nai/mcafee is maddening. > >sorry for the borderline/off topic post > >thanks, >brett > > >--- Julian Field wrote: > > Just remembered to let you folks know that, as far > > as I can see, > > MailScanner works fine with RedHat 9. > > I've had it running here for quite a few days now, > > and it seems happy enough. > > -- > > Julian Field > > www.MailScanner.info > > MailScanner thanks transtec Computers for their >support > > >__________________________________________________ >Do you Yahoo!? >Yahoo! Tax Center - File online, calculators, forms, and more >http://tax.yahoo.com -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 9 10:40:03 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: sophossavi [was Re: scanning precedence] In-Reply-To: <20030409091422.GA17460@ionia.eunet.pt> References: <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> <011c01c2fe11$1785a990$170aa8c0@DELL> <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030409102916.0260af68@imap.ecs.soton.ac.uk> Can you send me the output of cd /usr/local/Sophos ls -alR (off-list). Anyone else experiencing this problem? If you did a new Sophos.install, you might have lost the link from libsavi.so to libsavi.so.3 in the /usr/local/Sophos/lib directory. If that is indeed the problem, then for the next release I have an improved Sophos.install script which replaces the link. At 10:14 09/04/2003, you wrote: >After last night IDE update from Sophos MailScanner started crashing: > >Apr 9 08:06:13 host MailScanner[25740]: MailScanner E-Mail Virus Scanner >version 4.14-9 starting... >Apr 9 08:06:17 host MailScanner[25740]: SophosSAVI ERROR:: initializing >savi: Unknown error (557) > >I've had to change back from sophossavi to sophos. > >Any hints on how to debug it on MailScanner ? > >/SAVI-Perl-0.15/example root@host# ./scan.pl /tmp/SPAM4.txt >Version 3.68 (engine 2.14) recognizing 80962 viruses > IDE /opt/sophos/lib/vdl.dat released 4/7/2003 >Error setting Mac: 524 >Error setting SafeMacDfHandling: 524 > >Scanning /tmp/SPAM4.txt - clean > >thanks, > > >On Wed, Apr 09, 2003 at 08:51:53AM +0100, Julian Field wrote: > > At 21:54 08/04/2003, you wrote: > > >I have MailScanner configured to use SpamAssassin and Sophos > > >and I'm unclear about the order of events. Considering the recent > > >performance issues with sweep, I'd like spam actions like delete to > > >take precedence over and obviate the need for subsequent > > >virus scanning. Is this already the case? Do we have this control? > > > > In a batch of messages, there will always be some non-spam that needs > > scanning, so you can't actually do this. However, if you use the > > "sophossavi" scanner with the Perl-SAVI module, that avoids all the speed > > problems with sweep anyway. > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From sblanc at CRI01.ORG Wed Apr 9 10:33:39 2003 From: sblanc at CRI01.ORG (Sylvain Blanc) Date: Thu Jan 12 21:17:44 2006 Subject: mailscanner[xxxx]: Cannot parse Message-ID: Hello, I have this error : Apr 6 08:43:17 mussy mailscanner[20349]: Cannot parse /var/spool/MailScanner/incoming/IAA20543.header and /var/spool/mqueue.in/dfIAA20543, write-open /var/spool/MailScanner/incoming/IAA20543/Bronze.JPG: No such file or directory at /usr/local/lib/site_perl/MIME/Body.pm line 414. My OS is a debian potato with : sendmail 8.9.3 mailscanner 3.27-1 and all require perl lib Any help or suggestions most appreciated! Thanks in advance, Sylvain Blanc From mailscanner at ecs.soton.ac.uk Wed Apr 9 10:48:56 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: mailscanner[xxxx]: Cannot parse In-Reply-To: Message-ID: <5.2.0.9.2.20030409104809.02613f50@imap.ecs.soton.ac.uk> I first guess would be that you have 2 MailScanner processes running, and one of them has cleared out the temporary working directories while the other one was using them. At 10:33 09/04/2003, you wrote: >Hello, > >I have this error : >Apr 6 08:43:17 mussy mailscanner[20349]: Cannot parse >/var/spool/MailScanner/incoming/IAA20543.header and >/var/spool/mqueue.in/dfIAA20543, write-open >/var/spool/MailScanner/incoming/IAA20543/Bronze.JPG: No such file or >directory at /usr/local/lib/site_perl/MIME/Body.pm line 414. > >My OS is a debian potato >with : >sendmail 8.9.3 >mailscanner 3.27-1 >and all require perl lib > >Any help or suggestions most appreciated! >Thanks in advance, > >Sylvain Blanc -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From sblanc at CRI01.ORG Tue Apr 8 12:53:27 2003 From: sblanc at CRI01.ORG (Sylvain Blanc - CRI du Pays De Gex et du Bassin Bellegardien) Date: Thu Jan 12 21:17:44 2006 Subject: mailscanner[xxxx]: Cannot parse References: <5.2.0.9.2.20030409104809.02613f50@imap.ecs.soton.ac.uk> Message-ID: <02b301c2fdc5$77ddbb80$6c01cac3@ccpaysdegex.fr> YES ! thanks I look the log more attentively and check_mailscanner run an other mailscanner The debian potato user must midofy the source of mailscanner : pid=`ps axww | grep '[ ]'$virusdir/$process | awk '{ print $1 }'` ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, April 09, 2003 11:48 AM Subject: Re: mailscanner[xxxx]: Cannot parse > I first guess would be that you have 2 MailScanner processes running, and > one of them has cleared out the temporary working directories while the > other one was using them. > > At 10:33 09/04/2003, you wrote: > >Hello, > > > >I have this error : > >Apr 6 08:43:17 mussy mailscanner[20349]: Cannot parse > >/var/spool/MailScanner/incoming/IAA20543.header and > >/var/spool/mqueue.in/dfIAA20543, write-open > >/var/spool/MailScanner/incoming/IAA20543/Bronze.JPG: No such file or > >directory at /usr/local/lib/site_perl/MIME/Body.pm line 414. > > > >My OS is a debian potato > >with : > >sendmail 8.9.3 > >mailscanner 3.27-1 > >and all require perl lib > > > >Any help or suggestions most appreciated! > >Thanks in advance, > > > >Sylvain Blanc > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > From stefaans at pop.co.za Wed Apr 9 13:12:07 2003 From: stefaans at pop.co.za (Stefaans Mostert) Date: Thu Jan 12 21:17:44 2006 Subject: load ans que problem Message-ID: <200304091412.07129.stefaans@pop.co.za> Hallo all I use redhat 7.3 MailScanner-4.14-9 Sendmail Problem is that @ the moment my load is verey high and all my mail is being qued. Being in an isp enviroment that is just not good ;-) I seem to have a lot of messages in my mque file. [root@mailscanner root]# ls /var/spool/mqueue | wc -w 208086 I think the problem is that sendmail is having trouble stating all the messages and is being kept busy trying to get them all out I see that a lot of the messages are from spam sources that I send back and either time out or cannot be delivered. Question How can I get rid of say all messages older than three days or have sendmail time out the messages quicker? I cannot just delete all the messages as some of my users still have messages in the que. Is there another way of rooting out the offenders? I really have a serius problem here Tnx Stefaans From raymond at PROLOCATION.NET Wed Apr 9 13:19:17 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:44 2006 Subject: load ans que problem In-Reply-To: <200304091412.07129.stefaans@pop.co.za> Message-ID: Hi! > I think the problem is that sendmail is having trouble stating all the > messages and is being kept busy trying to get them all out > I see that a lot of the messages are from spam sources that I send back > and either time out or cannot be delivered. Thats a problem with your MTA, sendmails queue mechanism is taking a lot of time to read them in, if you are interested i have a little script, pretty nasty, that will clean out your mail queue. It will remove MAILER-DEAMON mails, thats most likely the ones that are holding up now. > How can I get rid of say all messages older than three days or have > sendmail time out the messages quicker? You can define that in your sendmail config. You need to define the values in the sendmail.cf Standard its like: O Timeout.queuereturn=5d You can lower those to for example 3 days. > Is there another way of rooting out the offenders? > I really have a serius problem here Relatively :) Ive seen systems with much more in the queue then this. I will mail the script i use, let me know if it solved your problem. Bye, Raymond. From Kevin.Spicer at BMRB.CO.UK Wed Apr 9 13:41:48 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:44 2006 Subject: SurfControl email Filter Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4AD6C@pascal.priv.bmrb.co.uk> Does anyone on the list have any experience of SurfControl's email filter - specifically any comparison of its capabilities / reliability versus MailScanner. It's been suggested that we should use it instead of MailScanner, particularly because of its 'advanced filtering capabilities'. Unfortunately (read predictably)their web site is rather heavy on marketing and rather short on technical detail, as well as taking a pop at free alternatives. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From stefaans at pop.co.za Wed Apr 9 13:53:34 2003 From: stefaans at pop.co.za (Stefaans Mostert) Date: Thu Jan 12 21:17:44 2006 Subject: When stopping Maiscanner Message-ID: <200304091453.34837.stefaans@pop.co.za> When stopping Maiscanner I keep on getting this I upgraded from MailScanner-4.13-3 to MailScanner-4.14-9 [root@mailscanner spool]# /etc/rc.d/init.d/MailScanner stop Shutting down MailScanner daemons: MailScanner: [ OK ] incoming sendmail: [ OK ] outgoing sendmail: [ OK ] /bin/rm: cannot change to directory `12914/h399vrk26808': No such file or directory /bin/rm: cannot stat `12914/h399vuk26884': No such file or directory /bin/rm: cannot stat `12914/h399vhk26669': No such file or directory Any ideas? Stefaans From dml at UNB.CA Wed Apr 9 13:53:27 2003 From: dml at UNB.CA (David Lancaster) Date: Thu Jan 12 21:17:44 2006 Subject: RedHat 9 and mcafee problems OT? In-Reply-To: <5.2.0.9.2.20030409100039.021dee78@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030408150015.03dbe950@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030409100039.021dee78@imap.ecs.soton.ac.uk> Message-ID: <1049892807.3e9417c7ae86e@apollo.unb.ca> Interesting tidbit here: https://listman.redhat.com/pipermail/phoebe-list/2003-February/002128.html And for the version on my RH9 box (4.2.40), doing an: "export export LD_ASSUME_KERNEL=2.2.5" makes uvscan run without erroring or hanging. D. Quoting Julian Field : > At 04:17 09/04/2003, you wrote: > >hi, > >is anyone else using mcafee uvscan either 416 or 424 > >able to get it to function with redhat 9? > > I have just downloaded the evaluation version which claims to be 424. > Even on a RedHat 8 system, it relies on a RedHat 7.3 compatibility package > for the old libstdc++ McAfee uses. > This compatibility package doesn't get installed by default on RedHat 9. I > have just installed the compat-libcstdc++ package. McAfee does indeed hang. > Tracing it gives the following at the end: > > open("/proc/devices", O_RDONLY) = 4 > fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 > mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = > 0x402f5000 > read(4, "Character devices:\n 1 mem\n 2 p"..., 4096) = 378 > futex(0x80864b0, FUTEX_WAIT, -39, NULL > > so for some reason it is reading /proc/devices (I even passed "--noboot" on > the command line). It then sits in a lock waiting for something that will > never happen. > > So you are quite correct, McAfee does not work on RedHat 9. I'll post a > news item on the MailScanner web site. > > >the scan on its own hangs the system with either > >version, and if i use it with MailScanner after a LONG > >delay ( hours)every email comes up infected with a DOS > >attack. i tried it with both an upgrade and a clean > >install. > >trying to contact nai/mcafee is maddening. > > > >sorry for the borderline/off topic post > > > >thanks, > >brett > > > > > >--- Julian Field wrote: > > > Just remembered to let you folks know that, as far > > > as I can see, > > > MailScanner works fine with RedHat 9. > > > I've had it running here for quite a few days now, > > > and it seems happy enough. > > > -- > > > Julian Field > > > www.MailScanner.info > > > MailScanner thanks transtec Computers for their > >support > > > > > >__________________________________________________ > >Do you Yahoo!? > >Yahoo! Tax Center - File online, calculators, forms, and more > >http://tax.yahoo.com > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > -- ITS ESS UNB From campbell at CNPAPERS.COM Wed Apr 9 14:08:36 2003 From: campbell at CNPAPERS.COM (Stephe Campbell) Date: Thu Jan 12 21:17:44 2006 Subject: Problem with High Spam Score delivery options References: <5.2.0.9.2.20030329192207.0231ca38@imap.ecs.soton.ac.uk> Message-ID: <00dd01c2fe99$21af8e80$1f01a8c0@cnpapers.net> I have just upgraded to SA 2.53 from 2.43 and MS 4.14-9 from 4.12-2 and I am seeing this also. I am running RH 7.3. I have searched my collections of mailings from the list and also searched on the mailing list. There were only three listings for this thread, which deadended. Was there ever a solution? Steve Campbell campbell@cnpapers.com ----- Original Message ----- From: "Julian Field" To: Sent: Saturday, March 29, 2003 3:22 PM Subject: Re: Problem with High Spam Score delivery options > Has anyone else seen this problem? > > At 19:10 29/03/2003, you wrote: > >The "High Scoring Spam Action" was working just fine but since > >upgrading to SpamAssassin 2.51 and then 2.52 along with MailScanner > >4.13.3, I cannot get the "High Scoring Spam Action" setting have any > >effect. > > > >I have reinstalled all from scratch and only changed: > > > >Virus Scanner = sophos > >High Scoring Spam Action = bounce > >Use SpamAssassin = yes > > > > > >All else works as advertised > > > >I'm running redhat 8.0 and installed MailScanner and SpamAssassin from > >the rpms. > > > >Thanks, > > > >Steve > >Steve Swaney > >Phone: (202) 352-3262 > >Fax: (202) 294-9496 > >Steve@Swaney.com > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support From j.cormie at ABERTAY.AC.UK Wed Apr 9 14:09:03 2003 From: j.cormie at ABERTAY.AC.UK (Jason Cormie) Date: Thu Jan 12 21:17:44 2006 Subject: RedHat 9 and mcafee problems OT? Message-ID: Same with Debian you need to add libstdc++2.8_2.90.29-2.deb from Potato (old build) to get uvscan running -----Original Message----- From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] Sent: 09, April, 2003 10:17 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: RedHat 9 and mcafee problems OT? At 04:17 09/04/2003, you wrote: >hi, >is anyone else using mcafee uvscan either 416 or 424 >able to get it to function with redhat 9? I have just downloaded the evaluation version which claims to be 424. Even on a RedHat 8 system, it relies on a RedHat 7.3 compatibility package for the old libstdc++ McAfee uses. This compatibility package doesn't get installed by default on RedHat 9. I have just installed the compat-libcstdc++ package. McAfee does indeed hang. Tracing it gives the following at the end: open("/proc/devices", O_RDONLY) = 4 fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x402f5000 read(4, "Character devices:\n 1 mem\n 2 p"..., 4096) = 378 futex(0x80864b0, FUTEX_WAIT, -39, NULL so for some reason it is reading /proc/devices (I even passed "--noboot" on the command line). It then sits in a lock waiting for something that will never happen. So you are quite correct, McAfee does not work on RedHat 9. I'll post a news item on the MailScanner web site. >the scan on its own hangs the system with either >version, and if i use it with MailScanner after a LONG >delay ( hours)every email comes up infected with a DOS >attack. i tried it with both an upgrade and a clean >install. >trying to contact nai/mcafee is maddening. > >sorry for the borderline/off topic post > >thanks, >brett > > >--- Julian Field wrote: > > Just remembered to let you folks know that, as far > > as I can see, > > MailScanner works fine with RedHat 9. > > I've had it running here for quite a few days now, > > and it seems happy enough. > > -- > > Julian Field > > www.MailScanner.info > > MailScanner thanks transtec Computers for their >support > > >__________________________________________________ >Do you Yahoo!? >Yahoo! Tax Center - File online, calculators, forms, and more >http://tax.yahoo.com -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From campbell at CNPAPERS.COM Wed Apr 9 14:13:08 2003 From: campbell at CNPAPERS.COM (Stephe Campbell) Date: Thu Jan 12 21:17:44 2006 Subject: Problem with High Spam Score delivery options References: <5.2.0.9.2.20030329192207.0231ca38@imap.ecs.soton.ac.uk> <00dd01c2fe99$21af8e80$1f01a8c0@cnpapers.net> Message-ID: <00f101c2fe99$c39b9540$1f01a8c0@cnpapers.net> Never mind, these old eyes are having a problem seeing the minus sign in front of the score, but strange that I am getting so many negative scores lately. Steve Campbell campbell@cnpapers.com ----- Original Message ----- From: "Stephe Campbell" To: Sent: Wednesday, April 09, 2003 9:08 AM Subject: Re: Problem with High Spam Score delivery options > I have just upgraded to SA 2.53 from 2.43 and MS 4.14-9 from 4.12-2 and I am > seeing this also. I am running RH 7.3. I have searched my collections of > mailings from the list and also searched on the mailing list. There were > only three listings for this thread, which deadended. > > Was there ever a solution? > > Steve Campbell > campbell@cnpapers.com > > > ----- Original Message ----- > From: "Julian Field" > To: > Sent: Saturday, March 29, 2003 3:22 PM > Subject: Re: Problem with High Spam Score delivery options > > > > Has anyone else seen this problem? > > > > At 19:10 29/03/2003, you wrote: > > >The "High Scoring Spam Action" was working just fine but since > > >upgrading to SpamAssassin 2.51 and then 2.52 along with MailScanner > > >4.13.3, I cannot get the "High Scoring Spam Action" setting have any > > >effect. > > > > > >I have reinstalled all from scratch and only changed: > > > > > >Virus Scanner = sophos > > >High Scoring Spam Action = bounce > > >Use SpamAssassin = yes > > > > > > > > >All else works as advertised > > > > > >I'm running redhat 8.0 and installed MailScanner and SpamAssassin from > > >the rpms. > > > > > >Thanks, > > > > > >Steve > > >Steve Swaney > > >Phone: (202) 352-3262 > > >Fax: (202) 294-9496 > > >Steve@Swaney.com > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 9 14:07:42 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: SurfControl email Filter In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0A4AD6C@pascal.priv.bmrb.co .uk> Message-ID: <5.2.0.9.2.20030409140625.042dd858@imap.ecs.soton.ac.uk> At 13:41 09/04/2003, you wrote: >Does anyone on the list have any experience of SurfControl's email filter >- specifically any comparison of its capabilities / reliability versus >MailScanner. It's been suggested that we should use it instead of >MailScanner, particularly because of its 'advanced filtering >capabilities'. Unfortunately (read predictably)their web site is rather >heavy on marketing and rather short on technical detail, as well as taking >a pop at free alternatives. I would like to see a commercial app that had filters anything like as good as SpamAssassin. Most vendors think that a bit of keyword searching is "advanced". Ignore all the marketing hype, get a large test dataset together, and see how both products perform given the same data. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 9 14:11:23 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: RedHat 9 and mcafee problems OT? In-Reply-To: <1049892807.3e9417c7ae86e@apollo.unb.ca> References: <5.2.0.9.2.20030409100039.021dee78@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030408150015.03dbe950@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030409100039.021dee78@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030409141113.0437deb0@imap.ecs.soton.ac.uk> Thanks for that. I have updated the web site. At 13:53 09/04/2003, you wrote: >Interesting tidbit here: >https://listman.redhat.com/pipermail/phoebe-list/2003-February/002128.html > >And for the version on my RH9 box (4.2.40), doing an: >"export export LD_ASSUME_KERNEL=2.2.5" makes uvscan run without erroring >or hanging. > >D. > >Quoting Julian Field : > > > At 04:17 09/04/2003, you wrote: > > >hi, > > >is anyone else using mcafee uvscan either 416 or 424 > > >able to get it to function with redhat 9? > > > > I have just downloaded the evaluation version which claims to be 424. > > Even on a RedHat 8 system, it relies on a RedHat 7.3 compatibility package > > for the old libstdc++ McAfee uses. > > This compatibility package doesn't get installed by default on RedHat 9. I > > have just installed the compat-libcstdc++ package. McAfee does indeed hang. > > Tracing it gives the following at the end: > > > > open("/proc/devices", O_RDONLY) = 4 > > fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 > > mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = > > 0x402f5000 > > read(4, "Character devices:\n 1 mem\n 2 p"..., 4096) = 378 > > futex(0x80864b0, FUTEX_WAIT, -39, NULL > > > > so for some reason it is reading /proc/devices (I even passed "--noboot" on > > the command line). It then sits in a lock waiting for something that will > > never happen. > > > > So you are quite correct, McAfee does not work on RedHat 9. I'll post a > > news item on the MailScanner web site. > > > > >the scan on its own hangs the system with either > > >version, and if i use it with MailScanner after a LONG > > >delay ( hours)every email comes up infected with a DOS > > >attack. i tried it with both an upgrade and a clean > > >install. > > >trying to contact nai/mcafee is maddening. > > > > > >sorry for the borderline/off topic post > > > > > >thanks, > > >brett > > > > > > > > >--- Julian Field wrote: > > > > Just remembered to let you folks know that, as far > > > > as I can see, > > > > MailScanner works fine with RedHat 9. > > > > I've had it running here for quite a few days now, > > > > and it seems happy enough. > > > > -- > > > > Julian Field > > > > www.MailScanner.info > > > > MailScanner thanks transtec Computers for their > > >support > > > > > > > > >__________________________________________________ > > >Do you Yahoo!? > > >Yahoo! Tax Center - File online, calculators, forms, and more > > >http://tax.yahoo.com > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support > > > > >-- >ITS ESS >UNB -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Steve at swaney.com Wed Apr 9 14:23:54 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:44 2006 Subject: Problem with High Spam Score delivery options In-Reply-To: <00dd01c2fe99$21af8e80$1f01a8c0@cnpapers.net> References: <5.2.0.9.2.20030329192207.0231ca38@imap.ecs.soton.ac.uk> <00dd01c2fe99$21af8e80$1f01a8c0@cnpapers.net> Message-ID: <1049894633.8958.220.camel@speedy> I'm still having this problem on one system and have had no response from the list. The system that works: Redhat 7.3 Sendmail 8.12.8/8.12.8 (latest Redhat rpm) MailScanner 4.14-9 SpamAssassin 2.53 The system that "High scoring Spam" is failing on (with the same configuration files ???) Redhat 8.0 Sendmail 8.12.8/8.12.8 (latest Redhat rpm) MailScanner 4.14-9 SpamAssassin 2.53 Any help still appreciated. Steve Steve Swaney Steve@Swaney.com On Wed, 2003-04-09 at 09:08, Stephe Campbell wrote: > I have just upgraded to SA 2.53 from 2.43 and MS 4.14-9 from 4.12-2 and I am > seeing this also. I am running RH 7.3. I have searched my collections of > mailings from the list and also searched on the mailing list. There were > only three listings for this thread, which deadended. > > Was there ever a solution? > > Steve Campbell > campbell@cnpapers.com > > > ----- Original Message ----- > From: "Julian Field" > To: > Sent: Saturday, March 29, 2003 3:22 PM > Subject: Re: Problem with High Spam Score delivery options > > > > Has anyone else seen this problem? > > > > At 19:10 29/03/2003, you wrote: > > >The "High Scoring Spam Action" was working just fine but since > > >upgrading to SpamAssassin 2.51 and then 2.52 along with MailScanner > > >4.13.3, I cannot get the "High Scoring Spam Action" setting have any > > >effect. > > > > > >I have reinstalled all from scratch and only changed: > > > > > >Virus Scanner = sophos > > >High Scoring Spam Action = bounce > > >Use SpamAssassin = yes > > > > > > > > >All else works as advertised > > > > > >I'm running redhat 8.0 and installed MailScanner and SpamAssassin from > > >the rpms. > > > > > >Thanks, > > > > > >Steve > > >Steve Swaney > > >Phone: (202) 352-3262 > > >Fax: (202) 294-9496 > > >Steve@Swaney.com > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030409/09844626/attachment.html From Jan-Peter.Koopmann at SECEIDOS.DE Wed Apr 9 14:30:55 2003 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:17:44 2006 Subject: SurfControl email Filter Message-ID: <4E7026FF8A422749B1553FE508E0068007F149@message.intern.akctech.de> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, > capabilities / reliability versus MailScanner. It's been > suggested that we should use it instead of MailScanner, > particularly because of its 'advanced filtering > capabilities'. Well. I opened the database and the first thing that crossed my mind was "How come I never heard of these guys before if they claim to be the World's #1 Web and E-mail Filtering Company"? What are they using against spam? Well: - - "digital fingerprints of known spam content" --> probably not as advanced as pyzor/razor - - "plus a customizable Dictionary" --> big deal. You can have this with additonal SA rules in no time - - "great flexibility about ... Spam once identified: isolate, delete, forward, deliver" --> need I say more? Did they copy MailScanner? :-) All of this can be done with MailScanner as well - - Virtual Learning Agent --> Bayes - - HTML Stripper --> MailScanner > Unfortunately (read predictably)their web > site is rather heavy on marketing and rather short on > technical detail, as well as taking a pop at free alternatives. Surprising isn't it? Why waste money there. I have to agree with Julian. I have not seen anything as effective as SA. It sucks up resources but it is very efficient. Regards, JP -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQA/AwUBPpQgj8ljry2L+pqYEQKMzwCfamV/weqAvpiYRKgyUaNqsOJ9spQAoNEA BJ24ur4FDx3F6Kt+DIJUeuuY =4pXB -----END PGP SIGNATURE----- From Kevin.Spicer at BMRB.CO.UK Wed Apr 9 14:47:04 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:44 2006 Subject: SurfControl email Filter Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4AD6D@pascal.priv.bmrb.co.uk> > - - "digital fingerprints of known spam content" --> probably not as > advanced as pyzor/razor > - - "plus a customizable Dictionary" --> big deal. You can have this > with additonal SA rules in no time > - - "great flexibility about ... Spam once identified: > isolate, delete, > forward, deliver" --> need I say more? Did they copy MailScanner? :-) > All of this can be done with MailScanner as well > - - Virtual Learning Agent --> Bayes > - - HTML Stripper --> MailScanner That was pretty much as far as I got. The thing that they do thats got our management interested is the promised ability to filter images based on content. > Surprising isn't it? > > > Why waste money there. I have to agree with Julian. I have not seen > anything as effective as SA. It sucks up resources but it is very > efficient. > I should have made it clear in my previous post that I am already in agreement with both of you, but I was looking for any experiences anyone else may have had that could enhance my arguments. Julians suggestions about getting a test data set together is good advice, but I'm a little bit cautious about how to get a set of test emails of a sufficiently wide variety without ending up the wrong side of any laws (like RIP). BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From Kevin.Spicer at BMRB.CO.UK Wed Apr 9 14:49:08 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:44 2006 Subject: Problem with High Spam Score delivery options Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF50A@pascal.priv.bmrb.co.uk> > Never mind, these old eyes are having a problem seeing the > minus sign in > front of the score, but strange that I am getting so many > negative scores > lately. > Maybe the bayes stuff, when bayes returns a low probability a message is spam a negative score is applied. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From bamcomp at YAHOO.COM Wed Apr 9 15:00:32 2003 From: bamcomp at YAHOO.COM (Brett Moss) Date: Thu Jan 12 21:17:44 2006 Subject: RedHat 9 and mcafee problems OT? In-Reply-To: <1049892807.3e9417c7ae86e@apollo.unb.ca> Message-ID: <20030409140032.44398.qmail@web13801.mail.yahoo.com> good morning, thank you for the info i'll try that out thanks, brett --- David Lancaster wrote: > Interesting tidbit here: > https://listman.redhat.com/pipermail/phoebe-list/2003-February/002128.html > > And for the version on my RH9 box (4.2.40), doing > an: > "export export LD_ASSUME_KERNEL=2.2.5" makes uvscan > run without erroring or hanging. > > D. > > Quoting Julian Field : > > > At 04:17 09/04/2003, you wrote: > > >hi, > > >is anyone else using mcafee uvscan either 416 or > 424 > > >able to get it to function with redhat 9? > > > > I have just downloaded the evaluation version > which claims to be 424. > > Even on a RedHat 8 system, it relies on a RedHat > 7.3 compatibility package > > for the old libstdc++ McAfee uses. > > This compatibility package doesn't get installed > by default on RedHat 9. I > > have just installed the compat-libcstdc++ package. > McAfee does indeed hang. > > Tracing it gives the following at the end: > > > > open("/proc/devices", O_RDONLY) = 4 > > fstat64(4, {st_mode=S_IFREG|0444, st_size=0, ...}) > = 0 > > mmap2(NULL, 4096, PROT_READ|PROT_WRITE, > MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = > > 0x402f5000 > > read(4, "Character devices:\n 1 mem\n 2 p"..., > 4096) = 378 > > futex(0x80864b0, FUTEX_WAIT, -39, NULL > > > > so for some reason it is reading /proc/devices (I > even passed "--noboot" on > > the command line). It then sits in a lock waiting > for something that will > > never happen. > > > > So you are quite correct, McAfee does not work on > RedHat 9. I'll post a > > news item on the MailScanner web site. > > > > >the scan on its own hangs the system with either > > >version, and if i use it with MailScanner after a > LONG > > >delay ( hours)every email comes up infected with > a DOS > > >attack. i tried it with both an upgrade and a > clean > > >install. > > >trying to contact nai/mcafee is maddening. > > > > > >sorry for the borderline/off topic post > > > > > >thanks, > > >brett > > > > > > > > >--- Julian Field > wrote: > > > > Just remembered to let you folks know that, as > far > > > > as I can see, > > > > MailScanner works fine with RedHat 9. > > > > I've had it running here for quite a few days > now, > > > > and it seems happy enough. > > > > -- > > > > Julian Field > > > > www.MailScanner.info > > > > MailScanner thanks transtec Computers for > their > > >support > > > > > > > > > >__________________________________________________ > > >Do you Yahoo!? > > >Yahoo! Tax Center - File online, calculators, > forms, and more > > >http://tax.yahoo.com > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at > www.MailScanner.biz > > MailScanner thanks transtec Computers for their > support > > > > > -- > ITS ESS > UNB __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com From canau at KEKA.KPNQWEST.PT Wed Apr 9 15:01:29 2003 From: canau at KEKA.KPNQWEST.PT (Carlos Canau) Date: Thu Jan 12 21:17:44 2006 Subject: sophossavi [was Re: scanning precedence] In-Reply-To: <5.2.0.9.2.20030409102916.0260af68@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> <011c01c2fe11$1785a990$170aa8c0@DELL> <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030409102916.0260af68@imap.ecs.soton.ac.uk> Message-ID: <20030409140129.GB18344@ionia.eunet.pt> Opsss... I was running sophosautoupdate from version 3 instead of Sophos-autoupdate from version 4. "Problem" solved :-))) Can you send me the output of > cd /usr/local/Sophos > ls -alR > (off-list). > > Anyone else experiencing this problem? > > If you did a new Sophos.install, you might have lost the link from > libsavi.so to libsavi.so.3 in the /usr/local/Sophos/lib directory. > > If that is indeed the problem, then for the next release I have an improved > Sophos.install script which replaces the link. > > At 10:14 09/04/2003, you wrote: > >After last night IDE update from Sophos MailScanner started crashing: > > > >Apr 9 08:06:13 host MailScanner[25740]: MailScanner E-Mail Virus Scanner > >version 4.14-9 starting... > >Apr 9 08:06:17 host MailScanner[25740]: SophosSAVI ERROR:: initializing > >savi: Unknown error (557) > > > >I've had to change back from sophossavi to sophos. > > > >Any hints on how to debug it on MailScanner ? > > > >/SAVI-Perl-0.15/example root@host# ./scan.pl /tmp/SPAM4.txt > >Version 3.68 (engine 2.14) recognizing 80962 viruses > > IDE /opt/sophos/lib/vdl.dat released 4/7/2003 > >Error setting Mac: 524 > >Error setting SafeMacDfHandling: 524 > > > >Scanning /tmp/SPAM4.txt - clean > > > >thanks, > > > > > > >On Wed, Apr 09, 2003 at 08:51:53AM +0100, Julian Field wrote: > >> At 21:54 08/04/2003, you wrote: > >> >I have MailScanner configured to use SpamAssassin and Sophos > >> >and I'm unclear about the order of events. Considering the recent > >> >performance issues with sweep, I'd like spam actions like delete to > >> >take precedence over and obviate the need for subsequent > >> >virus scanning. Is this already the case? Do we have this control? > >> > >> In a batch of messages, there will always be some non-spam that needs > >> scanning, so you can't actually do this. However, if you use the > >> "sophossavi" scanner with the Perl-SAVI module, that avoids all the speed > >> problems with sweep anyway. > >> -- > >> Julian Field > >> www.MailScanner.info > >> Professional Support Services at www.MailScanner.biz > >> MailScanner thanks transtec Computers for their support > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 9 14:59:41 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: SurfControl email Filter In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0A4AD6D@pascal.priv.bmrb.co .uk> Message-ID: <5.2.0.9.2.20030409145731.02a32888@imap.ecs.soton.ac.uk> At 14:47 09/04/2003, you wrote: > > - - "digital fingerprints of known spam content" --> probably not as > > advanced as pyzor/razor > > - - "plus a customizable Dictionary" --> big deal. You can have this > > with additonal SA rules in no time > > - - "great flexibility about ... Spam once identified: > > isolate, delete, > > forward, deliver" --> need I say more? Did they copy MailScanner? :-) > > All of this can be done with MailScanner as well > > - - Virtual Learning Agent --> Bayes > > - - HTML Stripper --> MailScanner > >That was pretty much as far as I got. The thing that they do thats got >our management interested is the promised ability to filter images based >on content. > > > Surprising isn't it? > > > > > > Why waste money there. I have to agree with Julian. I have not seen > > anything as effective as SA. It sucks up resources but it is very > > efficient. > > > >I should have made it clear in my previous post that I am already in >agreement with both of you, but I was looking for any experiences anyone >else may have had that could enhance my arguments. >Julians suggestions about getting a test data set together is good advice, >but I'm a little bit cautious about how to get a set of test emails of a >sufficiently wide variety without ending up the wrong side of any laws >(like RIP). I work on the basis that I never look at the messages, and I have "anonymised" them by simply replacing the To:/From:/sender/recipient addresses. Does SurfControl run on non-Windows platforms at all? Do they have an evaluation licence system? I could pump a large test set through it for you, if it's not too hard a job. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 9 14:56:58 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: Problem with High Spam Score delivery options In-Reply-To: <1049894633.8958.220.camel@speedy> References: <00dd01c2fe99$21af8e80$1f01a8c0@cnpapers.net> <5.2.0.9.2.20030329192207.0231ca38@imap.ecs.soton.ac.uk> <00dd01c2fe99$21af8e80$1f01a8c0@cnpapers.net> Message-ID: <5.2.0.9.2.20030409145524.03c3bee8@imap.ecs.soton.ac.uk> At 14:23 09/04/2003, you wrote: >I'm still having this problem on one system and have had no response from >the list. > >The system that works: >Redhat 7.3 >Sendmail 8.12.8/8.12.8 (latest Redhat rpm) >MailScanner 4.14-9 >SpamAssassin 2.53 > > >The system that "High scoring Spam" is failing on (with the same >configuration files ???) >Redhat 8.0 >Sendmail 8.12.8/8.12.8 (latest Redhat rpm) >MailScanner 4.14-9 >SpamAssassin 2.53 I have just tried it with exactly that (2nd) configuration, precisely the same version numbers. I set the "High Scoring Spam Actions = bounce" and it duly bounced the message as expected. A non-spam message went through fine. Unfortunately, that doesn't help work out what is wrong with your setup... >Any help still appreciated. > >Steve > >Steve Swaney >Steve@Swaney.com > > > >On Wed, 2003-04-09 at 09:08, Stephe Campbell wrote: >> >>I have just upgraded to SA 2.53 from 2.43 and MS 4.14-9 from 4.12-2 and I am >>seeing this also. I am running RH 7.3. I have searched my collections of >>mailings from the list and also searched on the mailing list. There were >>only three listings for this thread, which deadended. >> >>Was there ever a solution? >> >>Steve Campbell >>campbell@cnpapers.com >> >> >>----- Original Message ----- >>From: "Julian Field" >>To: >>Sent: Saturday, March 29, 2003 3:22 PM >>Subject: Re: Problem with High Spam Score delivery options >> >> >> > Has anyone else seen this problem? >> > >> > At 19:10 29/03/2003, you wrote: >> > >The "High Scoring Spam Action" was working just fine but since >> > >upgrading to SpamAssassin 2.51 and then 2.52 along with MailScanner >> > >4.13.3, I cannot get the "High Scoring Spam Action" setting have any >> > >effect. >> > > >> > >I have reinstalled all from scratch and only changed: >> > > >> > >Virus Scanner = sophos >> > >High Scoring Spam Action = bounce >> > >Use SpamAssassin = yes >> > > >> > > >> > >All else works as advertised >> > > >> > >I'm running redhat 8.0 and installed MailScanner and SpamAssassin from >> > >the rpms. >> > > >> > >Thanks, >> > > >> > >Steve >> > >Steve Swaney >> > >Phone: (202) 352-3262 >> > >Fax: (202) 294-9496 >> > >Steve@Swaney.com >> > >> > -- >> > Julian Field >> > www.MailScanner.info >> > Professional Support Services at >> www.MailScanner.biz >> > MailScanner thanks transtec Computers for their support > > > > > > > > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Kevin.Spicer at BMRB.CO.UK Wed Apr 9 15:15:37 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:44 2006 Subject: SurfControl email Filter Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF50B@pascal.priv.bmrb.co.uk> > Does SurfControl run on non-Windows platforms at all? No, only windows > Do they have an > evaluation licence system? Yes > I could pump a large test set > through it for > you, if it's not too hard a job. I think it is really (it needs a sql backend etc. etc.), but thanks for the offer. If we do get round to evaluating it I'll push for us to run this sort of test against it. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mike at UNIXSECURITY.ORG Wed Apr 9 15:39:40 2003 From: mike at UNIXSECURITY.ORG (Mike Wallis) Date: Thu Jan 12 21:17:44 2006 Subject: sophossavi [was Re: scanning precedence] In-Reply-To: <5.2.0.9.2.20030409102916.0260af68@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> <011c01c2fe11$1785a990$170aa8c0@DELL> <5.2.0.9.2.20030409085029.02416008@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030409102916.0260af68@imap.ecs.soton.ac.uk> Message-ID: <3E9430AC.9060603@unixsecurity.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Julian Field wrote: | Anyone else experiencing this problem? | | If you did a new Sophos.install, you might have lost the link from | libsavi.so to libsavi.so.3 in the /usr/local/Sophos/lib directory. I'm not seeing this, but I'm still running on v3.67 of Sophos. I suppose I could upgrade to this month's release and see if that makes a difference. - -- Mike Wallis -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1-nr1 (Windows XP) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE+lDCsXes7jE7XvgsRAqOeAJ9Gwsf/WXXkexx58JbTeKoH1o0p7gCg44sb PByuO7U8Kjw08oU1ZMNVomU= =RQUT -----END PGP SIGNATURE----- From mike at CAMAROSS.NET Wed Apr 9 16:18:32 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:44 2006 Subject: SurfControl email Filter In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF50B@pascal.priv.bmrb.co.uk> Message-ID: <000001c2feab$491fd1c0$b501a8c0@home.middlefinger.net> So...in addition to buying their software, you also have to buy an OS license AND a SQL license? cha-ching! I'll stick with what works :) Kudos to Julian and the SA team! Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Spicer, Kevin Sent: Wednesday, April 09, 2003 9:16 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: SurfControl email Filter > Does SurfControl run on non-Windows platforms at all? No, only windows > Do they have an > evaluation licence system? Yes > I could pump a large test set > through it for > you, if it's not too hard a job. I think it is really (it needs a sql backend etc. etc.), but thanks for the offer. If we do get round to evaluating it I'll push for us to run this sort of test against it. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From brian at UNEARTHED.ORG Wed Apr 9 17:34:44 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:44 2006 Subject: Porn msg identification? References: <5C0296D26910694BB9A9BBFC577E7AB0A4AD69@pascal.priv.bmrb.co.uk> Message-ID: <001c01c2feb6$3ab21ed0$bc01020a@brianmay> setup all of the users scores in a SQL database.. then for each of the users that don't want or want, depending on which group is smaller, set thier scores in the DB.. everyone else will just get the defaults... I use the DB setup since I have spamassassin running on a different machine, and just pass the username to spamd to pickup the correct scores... works well... Brian ----- Original Message ----- From: "Spicer, Kevin" To: Sent: Tuesday, April 08, 2003 1:02 AM Subject: Re: Porn msg identification? > > Hmmm... I don't think that will satisfy my customers. > > The problem is the language as well as the images contained > within porn > spam. > > The issue with setting the scores very high is that some > customers will > want to receive "adult" emails while others don't want to receive any. > > If there was a generic way to build a ruleset to modify the > subject line > (or add/modify a header), that would probably take care of it! :) > I think that would be rather difficult to do! The problem is how to accurately identify it. SA does a pretty good job but isn't perfect (although personally I've not seen any of this type of spam which has got past SA). If someone had the time/effort it might be possible to adapt the filters in DansGuardian (or something similar), although IIRC they are mostly checks for certain language (which SA can do anyway) and blacklisted sites. I suppose it might be useful to filter out mails with hyperlinks to domains that would be blocked. I'm not aware of any free (as in freedom or beer) mail filters that do this. Back to MailScanner as it is, if you're worried about the language as well as the images why not just bump the scores as Julian suggested and use the delete action? BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From stefaans at pop.co.za Wed Apr 9 17:49:37 2003 From: stefaans at pop.co.za (Stefaans Mostert) Date: Thu Jan 12 21:17:44 2006 Subject: mqueue.in on tmpfs Message-ID: <200304091849.37099.stefaans@pop.co.za> Hi all I mounted /var/spool/mqueue.in on tmpfs and I keep getting this output. Sould I worry about it ? Apr 9 18:08:47 mailscanner MailScanner[18768]: /var/spool/mqueue.in & /var/spool/mqueue must be on the same filesystem/partition! Stefaans From Steve at swaney.com Wed Apr 9 18:00:32 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:44 2006 Subject: Problem with High Spam Score delivery options solved In-Reply-To: <5.2.0.9.2.20030409145524.03c3bee8@imap.ecs.soton.ac.uk> References: <00dd01c2fe99$21af8e80$1f01a8c0@cnpapers.net> <5.2.0.9.2.20030329192207.0231ca38@imap.ecs.soton.ac.uk> <00dd01c2fe99$21af8e80$1f01a8c0@cnpapers.net> <5.2.0.9.2.20030409145524.03c3bee8@imap.ecs.soton.ac.uk> Message-ID: <1049907632.8957.249.camel@speedy> Problem is solved thanks to a tip from Steve Ellis: "Did you install SpamAssassin from the rpm? When I tried that on a RedHat 8.0 system, the install appeared successful, but numerous problems occurred while scanning mail. Installing SpamAssassin from the tarball took care of the problems." I had installedSpamAssassin from the rpms. I removed all of the packages installed by the SpamAssassin 2-53 rpm and reinstalled using the -MCPAN method. I put the old configuration files back in place and restarted MailScanner and spamassassin. All is working perfectly (and wonderfully!). Thanks to all for the help and to Julian for an excellent product. Steve Steve Swaney Steve@LinuxSystemsSolutions.com www.LinuxSystemsSolutions.com Linux System Solutions, Inc. Phone: 202 352-3262 Fax: 202 352-3262 > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030409/d1a714c0/attachment.html From ralloway at WINBEAM.COM Wed Apr 9 19:45:27 2003 From: ralloway at WINBEAM.COM (Richard D Alloway) Date: Thu Jan 12 21:17:44 2006 Subject: Porn msg identification? In-Reply-To: <3E92E35D.1400.5BA79E38@localhost> Message-ID: On Tue, 8 Apr 2003, Mariano Absatz wrote: > Hi Rich, > > The point is that MailScanner doesn't know anything about scoring messages... > the spam score you see in MailScanner is actually done by the SpamAssassin > library that MailScanner optionally uses. This is, of course, quite true :) The reason I was suggesting it be part of MailScanner is the fact that MailScanner takes the output of SpamAssassin and modifies the subject and/or adds a header to the message. > Now, _that_ library, including the rules that come with it, is developed and > optimized to tag as much spam as possible _avoiding_ as many false positives > as it can. Well, I'm not necessarily looking to detect spam... legitimate email with mature content might not be spam. :) > Thus, SpamAssassin scans the message looking for patterns and it adds or > substracts from the score as some conditions are met or not... Which is the same functionality I'd be looking for in a word/phrase detection routine, but with a seperate set of actions from the spam portion. > You _could_ create a different set of rules for SpamAssassin and invoke it > twice, once for spam detection and the other for "adulthood" detection, but > that would imply at least modifying MailScanner and using a secondary set of > SpamAssassin rules... it _will_ require some time and an effort to do it... It seems I may be one of the very few actually looking for this type of feature...perhaps I will have to throw on the ol' coding hat for a while :) Julian, if I am (or anybody else is) able to create a relatively lightweight way of adding this feature to MailScanner, would you consider adding it to the production version? Thanks again for everyone's feedback! -Rich > El 8 Apr 2003 a las 13:10, Richard D Alloway escribió: > > > Thanks for everyone's input for my problem, but I think the goal I am > > trying to work towards is being lost in translation :) > > > > What I think would be a great feature is to allow custom rulesets. The > > more I think about it, the more I think being able to create a customer > > header for the custom ruleset would be the way to go. > > > > I imagine it working just like the Spam Score Header. > > > > Based on the score from the ruleset file (in my case, I'd create an adult > > language file) with scores per word, a custom header could be created > > which shows the "severity" of the language: > > > > Custom Score Header = X-MailScanner-Maturity: > > > > Custom Score Header = A > > > > Custom Score Ruleset = /etc/MailScanner/rules/Maturity.rules > > > > /etc/MailScanner/rules/Maturity.rules could contain: > > frick 1 > > frack 5 > > > > Then, a message which contains the word 'frick' 3 times and 'frack' once > > would have a score of 8, so a header of: > > X-MailScanner-Maturity = AAAAAAAA > > > > A customer who wishes to never receive emails with any of the words in the > > list can filter on the X-MailScanner-Maturity header containing 'A'. > > > > A customer who wishes to receive mildly mature emails can filter on the > > X-MailScanner-Maturity header containing 'AAAA', and so on... > > > > This way, the email is delivered to the customer and the customer has the > > option of deleting, moving to another folder, or doing nothing with the > > email. > > > > The reason I can't use the high score action, etc is that we delete spam > > with a high score. > > > > As an ISP, we do not force adult/mature content filtering on our > > customers, but would like to offer a solution that empowers the end user > > to decide the level of filtering. > > > > Thanks for hearing me out...again :) > > > > -Rich > > > > On Tue, 8 Apr 2003, Julian Field wrote: > > > > > At 01:48 08/04/2003, you wrote: > > > >Hmmm... I don't think that will satisfy my customers. > > > > > > > >The problem is the language as well as the images contained within porn > > > >spam. > > > > > > > >The issue with setting the scores very high is that some customers will > > > >want to receive "adult" emails while others don't want to receive any. > > > > > > Which is why you can set the spam high score using a ruleset so that > > > different users get different scoring thresholds. > > > > > > >If there was a generic way to build a ruleset to modify the subject line > > > >(or add/modify a header), that would probably take care of it! :) > > > > > > > >Any chance something like this could be in MailScanner's future? *hint > > > >hint* ;) > > > > > > > >-Rich > > > > > > > >On Mon, 7 Apr 2003, Julian Field wrote: > > > > > > > > > The problem of nasty porn spam can largely be solved with the "striphtml" > > > > > spam action, as it removes all images from spam. In case it's not really > > > > > spam, all the links in the message are maintained, but you don't have to > > > > > suffer the images. This is keeping most of my users happy here. > > > > > > > > > > At 18:10 07/04/2003, you wrote: > > > > > >Hi there! > > > > > > > > > > > >I was wondering if anyone had come up with a way to add a header or > > > > > >perhaps prepend the subject line with something like {Porn?} based on the > > > > > >language/content of an email? > > > > > > > > > > > >I want to be able to give our users something they can filter their mail > > > > > >against if they don't want to receive ANY adult messages. > > > > > > > > > > > >Our customers like the ability to filter against {Spam?} in the subject > > > > > >line for possible spam. > > > > > > > > > > > >Thanks! > > > > > > > > > > > >-Rich > > -- > Mariano Absatz > El Baby > ---------------------------------------------------------- > To you I'm an atheist; to God, I'm the Loyal Opposition. > -- Woody Allen > From mailscanner at ecs.soton.ac.uk Wed Apr 9 20:24:47 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:44 2006 Subject: mqueue.in on tmpfs In-Reply-To: <200304091849.37099.stefaans@pop.co.za> Message-ID: <5.2.0.9.2.20030409202107.0223e1e0@imap.ecs.soton.ac.uk> At 17:49 09/04/2003, you wrote: >Hi all >I mounted /var/spool/mqueue.in on tmpfs and I keep getting this output. >Sould I worry about it ? >Apr 9 18:08:47 mailscanner MailScanner[18768]: /var/spool/mqueue.in & >/var/spool/mqueue must be on the same filesystem/partition! Yes, you should. MailScanner will not operate unless the incoming and outgoing queue directories are on the same partition. Running with mqueue.in or mqueue on tmpfs is very dangerous unless you don't mind losing your customers' mail when you reboot your server. You can run with MailScanner/incoming on tmpfs quite safely, and it's worth doing on a server with high load as it saves a whole load of disk i/o. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Wed Apr 9 21:03:10 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:44 2006 Subject: mqueue.in on tmpfs In-Reply-To: <5.2.0.9.2.20030409202107.0223e1e0@imap.ecs.soton.ac.uk> Message-ID: Hi! > >I mounted /var/spool/mqueue.in on tmpfs and I keep getting this output. > >Sould I worry about it ? > >Apr 9 18:08:47 mailscanner MailScanner[18768]: /var/spool/mqueue.in & > >/var/spool/mqueue must be on the same filesystem/partition! > Yes, you should. MailScanner will not operate unless the incoming and > outgoing queue directories are on the same partition. Running with > mqueue.in or mqueue on tmpfs is very dangerous unless you don't mind losing > your customers' mail when you reboot your server. > You can run with MailScanner/incoming on tmpfs quite safely, and it's worth > doing on a server with high load as it saves a whole load of disk i/o. And dont forget to alter the f-prot wrapper if you run f-prot ... RamDisk=yes # Set this to yes if you are running in ramdisk or tmpfs Bye, Raymond. From raymond at PROLOCATION.NET Wed Apr 9 21:18:54 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: Message-ID: Julian, > > outgoing queue directories are on the same partition. Running with > > mqueue.in or mqueue on tmpfs is very dangerous unless you don't mind losing > > your customers' mail when you reboot your server. > > You can run with MailScanner/incoming on tmpfs quite safely, and it's worth > > doing on a server with high load as it saves a whole load of disk i/o. > And dont forget to alter the f-prot wrapper if you run f-prot ... > RamDisk=yes # Set this to yes if you are running in ramdisk or tmpfs In addition to this, i tested a little tonight, switched incomming to tmpfs and tested with f-prot I got: Apr 9 22:13:32 fallback MailScanner[29995]: New Batch: Scanning 1 messages, 23538 bytes Apr 9 22:13:32 fallback MailScanner[29995]: Spam Checks: Starting Apr 9 22:13:33 fallback MailScanner[29995]: Virus and Content Scanning: Starting Apr 9 22:13:34 fallback MailScanner[29995]: Error on reading ./h39KDVO30315/hallmark_bears%20 Apr 9 22:13:34 fallback MailScanner[29995]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Error on reading ./h39KDVO30315/hallmark_bears%20". Please mail the author of MailScanner Apr 9 22:13:34 fallback MailScanner[29995]: Error on reading (2).jpg Apr 9 22:13:34 fallback MailScanner[29995]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Error on reading (2).jpg". Please mail the author of MailScanner Apr 9 22:13:34 fallback MailScanner[29995]: Uninfected: Delivered 1 messages Only things i changed were the tmpfs for incomming and setting tmpfs to yes in the f-prot wrapper. I didnt get errors before, seems its not ok yet. Bye, Raymond. From raymond at PROLOCATION.NET Wed Apr 9 21:26:31 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: Message-ID: Hi! > Only things i changed were the tmpfs for incomming and setting tmpfs to > yes in the f-prot wrapper. > > I didnt get errors before, seems its not ok yet. Never mind me, i had a rpmnew in the dir laying around, so i was using a older one it seems. Looks ok to me now, with some test files: Apr 9 22:24:19 fallback MailScanner[30567]: New Batch: Scanning 1 messages, 644887 bytes Apr 9 22:24:19 fallback MailScanner[30567]: Spam Checks: Starting Apr 9 22:24:21 fallback MailScanner[30567]: Virus and Content Scanning: Starting Apr 9 22:24:21 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/scanner.zip->MSO-Patch-0071.exe Infection: W32/Lirva.D@mm Apr 9 22:24:21 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Lirva.D@mm Apr 9 22:24:21 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/scanner.zip->name.exe Infection: W32/Klez.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Klez.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/scanner.zip->setup.exe Infection: W32/Klez.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Klez.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/scanner.zip->SQL_4_Free.scr Infection: W32/Lentin.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Lentin.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/scanner.zip->width.pif Infection: W32/Klez.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Klez.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/scanner.zip->you.exe Infection: W32/Klez.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Klez.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/test.zip->Best_Friend.scr Infection: W32/Lentin.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Lentin.H@mm Apr 9 22:24:21 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/test.zip->friendship.scr Infection: W32/Lentin.H@mm Apr 9 22:24:22 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Lentin.H@mm Apr 9 22:24:22 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/test.zip->les.scr Infection: W32/Klez.H@mm Apr 9 22:24:22 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Klez.H@mm Apr 9 22:24:22 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/test.zip->love.scr Infection: W32/Lentin.H@mm Apr 9 22:24:22 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Lentin.H@mm Apr 9 22:24:22 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/test.zip->Sexy_Jenna.scr Infection: W32/Lentin.H@mm Apr 9 22:24:22 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Lentin.H@mm Apr 9 22:24:22 fallback MailScanner[30567]: /var/spool/MailScanner/incoming/30567/./h39KOI430771/test.zip->Untitled1.pif Infection: W32/Sobig.A@mm Apr 9 22:24:22 fallback MailScanner[30567]: Virus Scanning: F-Prot found virus W32/Sobig.A@mm Apr 9 22:24:22 fallback MailScanner[30567]: Virus Scanning: F-Prot found 12 infections Apr 9 22:24:22 fallback MailScanner[30567]: Virus Scanning: Found 12 viruses Apr 9 22:24:22 fallback MailScanner[30567]: Saved infected "test.zip" to /var/spool/MailScanner/quarantine/20030409/h39KOI430771 Apr 9 22:24:22 fallback MailScanner[30567]: Saved infected "scanner.zip" to /var/spool/MailScanner/quarantine/20030409/h39KO Bye, Raymond. From raymond at PROLOCATION.NET Wed Apr 9 21:31:47 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: Message-ID: Hi! > Never mind me, i had a rpmnew in the dir laying around, so i was using a > older one it seems. Looks ok to me now, with some test files: And a little later: Apr 9 22:29:34 fallback MailScanner[30563]: New Batch: Scanning 1 messages, 53729 bytes Apr 9 22:29:34 fallback MailScanner[30563]: Spam Checks: Starting Apr 9 22:29:34 fallback MailScanner[30563]: Virus and Content Scanning: Starting Apr 9 22:29:35 fallback MailScanner[30563]: Error on reading ./h39KTX431086/Verslag Apr 9 22:29:35 fallback MailScanner[30563]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Error on reading ./h39KTX431086/Verslag". Please mail the author of MailScanner Apr 9 22:29:35 fallback MailScanner[30563]: Error on reading Actiegroep Apr 9 22:29:35 fallback MailScanner[30563]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Error on reading Actiegroep". Please mail the author of MailScanner Apr 9 22:29:35 fallback MailScanner[30563]: Error on reading 09-04-03.doc Apr 9 22:29:35 fallback MailScanner[30563]: Either you've found a bug in MailScanner's F-Prot output parser, or F-Prot's output format has changed! F-Prot said this "Error on reading 09-04-03.doc". Please mail the author of MailScanner Apr 9 22:29:35 fallback MailScanner[30563]: Uninfected: Delivered 1 messages I will switch back to non tmpfs and see if i get the same. It started once i switched to tmpfs... Bye, Raymond. From mailscanner at ecs.soton.ac.uk Wed Apr 9 22:32:00 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: References: Message-ID: <5.2.0.9.2.20030409223049.022a6d68@imap.ecs.soton.ac.uk> I suspect the find command in the f-prot-wrapper with Ramdisk=yes. I forgot all the nasty stuff you have to do to make "find" cope with things like spaces in filenames. Advise you don't run it in tmpfs for now. I'll try to sort out a find command that will work. At 21:31 09/04/2003, you wrote: >Hi! > > > Never mind me, i had a rpmnew in the dir laying around, so i was using a > > older one it seems. Looks ok to me now, with some test files: > >And a little later: > >Apr 9 22:29:34 fallback MailScanner[30563]: New Batch: Scanning 1 >messages, 53729 bytes >Apr 9 22:29:34 fallback MailScanner[30563]: Spam Checks: Starting >Apr 9 22:29:34 fallback MailScanner[30563]: Virus and Content Scanning: >Starting >Apr 9 22:29:35 fallback MailScanner[30563]: Error on reading >./h39KTX431086/Verslag >Apr 9 22:29:35 fallback MailScanner[30563]: Either you've found a bug in >MailScanner's F-Prot output parser, or F-Prot's output format has >changed! F-Prot said this "Error on reading ./h39KTX431086/Verslag". >Please mail the author of MailScanner >Apr 9 22:29:35 fallback MailScanner[30563]: Error on reading Actiegroep >Apr 9 22:29:35 fallback MailScanner[30563]: Either you've found a bug in >MailScanner's F-Prot output parser, or F-Prot's output format has >changed! F-Prot said this "Error on reading Actiegroep". Please mail the >author of MailScanner >Apr 9 22:29:35 fallback MailScanner[30563]: Error on reading >09-04-03.doc >Apr 9 22:29:35 fallback MailScanner[30563]: Either you've found a bug in >MailScanner's F-Prot output parser, or F-Prot's output format has >changed! F-Prot said this "Error on reading 09-04-03.doc". Please mail >the author of MailScanner >Apr 9 22:29:35 fallback MailScanner[30563]: Uninfected: Delivered 1 >messages > >I will switch back to non tmpfs and see if i get the same. >It started once i switched to tmpfs... > >Bye, >Raymond. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From tchamtieh at YAHOO.COM Wed Apr 9 22:43:24 2003 From: tchamtieh at YAHOO.COM (Thomas Chamtieh) Date: Thu Jan 12 21:17:45 2006 Subject: Spam Actions Problem Message-ID: <20030409214324.20489.qmail@web13202.mail.yahoo.com> I set the following in MailScanner.conf: Spam Actions = /etc/MailScanner/rules/spam.actions.rules High Scoring Spam Actions = /etc/MailScanner/rules/spam.actions.rules Then in spam.actions.rules I have: FromOrTo: default deliver From: test@test.com delete Then I send myself an email from test@test.com and it doesn't get deleted! Am I doing something wrong? Thanks :) -Thomas --------------------------------- Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030409/72a6eed0/attachment.html From dwinkler at ALGORITHMICS.COM Wed Apr 9 22:48:23 2003 From: dwinkler at ALGORITHMICS.COM (Derek Winkler) Date: Thu Jan 12 21:17:45 2006 Subject: Spam Actions Problem Message-ID: <06EE2C86D3DAD5119A6C0060943F3C97055E6F12@tormail1.algorithmics.com> Rules are read from top to bottom, therefor your default action applies. Put default at the bottom. -----Original Message----- From: Thomas Chamtieh [mailto:tchamtieh@yahoo.com] Sent: Wednesday, April 09, 2003 5:43 PM To: MAILSCANNER@jiscmail.ac.uk Subject: Spam Actions Problem I set the following in MailScanner.conf: Spam Actions = /etc/MailScanner/rules/spam.actions.rules High Scoring Spam Actions = /etc/MailScanner/rules/spam.actions.rules Then in spam.actions.rules I have: FromOrTo: default deliver From: test@test.com delete Then I send myself an email from test@test.com and it doesn't get deleted! Am I doing something wrong? Thanks :) -Thomas _____ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030409/cb6e9aed/attachment.html From kevins at BMRB.CO.UK Wed Apr 9 22:52:05 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:45 2006 Subject: Spam Actions Problem In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EDF732@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF732@pascal.priv.bmrb.co.uk> Message-ID: <1049925126.14508.16.camel@bach.kevinspicer.co.uk> >Then in spam.actions.rules I have: > >FromOrTo: default deliver >From: test@test.com delete > > >Then I send myself an email from test@test.com and it doesn't get >deleted! That rather depends whether the mail you sent was detected as spam, as anything that doesn't have a score exceeding the spam trigger won't have the rules applied. You might like to set Always Include SpamAssassin Report = yes so that you can see the spam score in the headers & see if the trigger has been passed. One other point to note is that MS looks at the envelope address, not the addresses in the headers, which might be an issue depending on how you are generating your test mails. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From Steve at swaney.com Wed Apr 9 22:56:13 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:45 2006 Subject: Spam Actions Problem In-Reply-To: <20030409214324.20489.qmail@web13202.mail.yahoo.com> References: <20030409214324.20489.qmail@web13202.mail.yahoo.com> Message-ID: <1049925373.8957.334.camel@speedy> May be a silly question but does the test message get marked as Spam? If not I don't believe these actions will be used. Steve On Wed, 2003-04-09 at 17:43, Thomas Chamtieh wrote: > I set the following in MailScanner.conf: > > Spam Actions = /etc/MailScanner/rules/spam.actions.rules > High Scoring Spam Actions = /etc/MailScanner/rules/spam.actions.rules > > Then in spam.actions.rules I have: > > FromOrTo: default deliver > From: test@test.com delete > > > Then I send myself an email from test@test.com and it doesn't get > deleted! > > Am I doing something wrong? > > Thanks :) > > -Thomas > > > > > > ______________________________________________________________________ > Do you Yahoo!? > Yahoo! Tax Center - File online, calculators, forms, and more -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030409/d7c1ac52/attachment.html From tchamtieh at YAHOO.COM Wed Apr 9 23:12:24 2003 From: tchamtieh at YAHOO.COM (Thomas Chamtieh) Date: Thu Jan 12 21:17:45 2006 Subject: Spam Actions Problem In-Reply-To: <1049925126.14508.16.camel@bach.kevinspicer.co.uk> Message-ID: <20030409221224.33193.qmail@web13201.mail.yahoo.com> Well I guess you have a point, its getting a score of 5.9 which won't make it a spam, I can't believe I just overlooked the fact that it needs to be a spam in the first place :) So what I did was add that email to my spam.blacklist.rules and leave the spam.actions.rules as is and boom, it deletes it :) Thanks :) -Thomas Kevin Spicer wrote: >Then in spam.actions.rules I have: > >FromOrTo: default deliver >From: test@test.com delete > > >Then I send myself an email from test@test.com and it doesn't get >deleted! That rather depends whether the mail you sent was detected as spam, as anything that doesn't have a score exceeding the spam trigger won't have the rules applied. You might like to set Always Include SpamAssassin Report = yes so that you can see the spam score in the headers & see if the trigger has been passed. One other point to note is that MS looks at the envelope address, not the addresses in the headers, which might be an issue depending on how you are generating your test mails. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. --------------------------------- Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030409/bcb54b79/attachment.html From mailscanner at ecs.soton.ac.uk Wed Apr 9 23:13:13 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: Spam Actions Problem In-Reply-To: <06EE2C86D3DAD5119A6C0060943F3C97055E6F12@tormail1.algorith mics.com> Message-ID: <5.2.0.9.2.20030409231222.022f4e10@imap.ecs.soton.ac.uk> At 22:48 09/04/2003, you wrote: >Rules are read from top to bottom, therefor your default action applies. Rules are read from top to bottom, with the exception of the default action which is applied if none of the other rules apply. It doesn't matter where the default line is in the rules file. > >Put default at the bottom. >-----Original Message----- >From: Thomas Chamtieh [mailto:tchamtieh@yahoo.com] >Sent: Wednesday, April 09, 2003 5:43 PM >To: MAILSCANNER@jiscmail.ac.uk >Subject: Spam Actions Problem > >I set the following in MailScanner.conf: > >Spam Actions = /etc/MailScanner/rules/spam.actions.rules >High Scoring Spam Actions = /etc/MailScanner/rules/spam.actions.rules > >Then in spam.actions.rules I have: > >FromOrTo: default deliver >From: test@test.com delete > >Then I send myself an email from test@test.com and >it doesn't get deleted! > >Am I doing something wrong? > >Thanks :) > >-Thomas > > > > > >Do you Yahoo!? >Yahoo! Tax >Center - File online, calculators, forms, and more -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030409/d65b1e0c/attachment.html From raymond at PROLOCATION.NET Wed Apr 9 23:31:44 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: <5.2.0.9.2.20030409223049.022a6d68@imap.ecs.soton.ac.uk> Message-ID: Hi Julian, > I suspect the find command in the f-prot-wrapper with Ramdisk=yes. I forgot > all the nasty stuff you have to do to make "find" cope with things like > spaces in filenames. > > Advise you don't run it in tmpfs for now. I'll try to sort out a find > command that will work. Ok, good, if you need me to test some beta's let me know. Would be nice to get this working. Bye, Raymond. From dh at UPTIME.AT Thu Apr 10 09:55:35 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:45 2006 Subject: funny things happen when you use sophossavi on an Alpha.. Message-ID: <31506EF2-6B32-11D7-978E-00039379E28A@uptime.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Hello guys. I just wanted to report my findings so people could verify that I am not the only one experiencing this. We are running latest sophos, latest spamassassin , latest Maiscanner on an Aplha EV67 667Mhz with 768 MB RAM. The machine processes only around 3500 messages a day, so the machine seems to do well. I followed the install instructions on the web page (yet I do nto quite know where to put those lines for the symlinks I just created them by hand in the sophos lib dir) and whenever I use sophossavi the following things happen: The delay for a message until it delivers goes up to more than 90 seconds (when it is usually below 10). The Spam checks start to time out and spamassassin times out sometimes as well. Also mails start to accumulate in the inqueue. Ideas ? - -d -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+lTGMiW/Ta/pxHPQRA87QAKCyBKMhfJ/lreiMusdIrrxWOMbi3ACgh5pn ZhPNRovZMTNDpK1GdgBSTG0= =Rj24 -----END PGP SIGNATURE----- From hdbtroll at MOMENT.NET Thu Apr 10 03:38:19 2003 From: hdbtroll at MOMENT.NET (DB Troll) Date: Thu Jan 12 21:17:45 2006 Subject: Sendmail and MailScanner Failed Message-ID: <3E94D91B.502@moment.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Each time I boot I get sendmail and MailScanner Failed MailScanner Failed> '/etc/init.d/rc5.d/S08sshd start' exits with status 0 > /etc/init.d/rc5.d/S09nfs start > '/etc/init.d/rc5.d/S09nfs start' exits with status 0 > /etc/init.d/rc5.d/S10MailScanner start > Initializing sendmail and MailScannerstartproc: execve (/usr/sbin/sendmail) [ /usr/sbin/sendmail -OPrivacyOptions=noetrn -ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in -O DaemonPortOptions=Addr=127.0.0.1 -L sendmail-in -Am -bd -om ], [ PWD=/ HOSTNAME=linux CONSOLE=/dev/console PREVLEVEL=N AUTOBOOT=YES REDIRECT=/dev/tty1 MACHTYPE=i386-suse-linux LINES=26 SHLVL=2 COLUMNS=82 BOOT_IMAGE=linux SHELL=/bin/bash HOSTTYPE=i386 OSTYPE=linux HOME=/ TERM=linux PATH=/sbin:/bin:/usr/sbin:/usr/bin RUNLEVEL=5 INIT_VERSION=sysvinit-2.82 _=/sbin/startproc DAEMON=/usr/sbin/sendmail ] > startproc: execve (/usr/sbin/sendmail) [ /usr/sbin/sendmail -L sendmail-client -Ac -q30m ], [ PWD=/ HOSTNAME=linux CONSOLE=/dev/console PREVLEVEL=N AUTOBOOT=YES REDIRECT=/dev/tty1 MACHTYPE=i386-suse-linux LINES=26 SHLVL=2 COLUMNS=82 BOOT_IMAGE=linux SHELL=/bin/bash HOSTTYPE=i386 OSTYPE=linux HOME=/ TERM=linux PATH=/sbin:/bin:/usr/sbin:/usr/bin RUNLEVEL=5 INIT_VERSION=sysvinit-2.82 _=/sbin/startproc DAEMON=/usr/sbin/sendmail ] > startproc: execve (/usr/sbin/sendmail) [ /usr/sbin/sendmail -L sendmail-out -Am -q30m -om ], [ PWD=/ HOSTNAME=linux CONSOLE=/dev/console PREVLEVEL=N AUTOBOOT=YES REDIRECT=/dev/tty1 MACHTYPE=i386-suse-linux LINES=26 SHLVL=2 COLUMNS=82 BOOT_IMAGE=linux SHELL=/bin/bash HOSTTYPE=i386 OSTYPE=linux HOME=/ TERM=linux PATH=/sbin:/bin:/usr/sbin:/usr/bin RUNLEVEL=5 INIT_VERSION=sysvinit-2.82 _=/sbin/startproc DAEMON=/usr/sbin/sendmail ] > startproc: execve (/usr/sbin/check_MailScanner) [ /usr/sbin/check_MailScanner ], [ PWD=/ HOSTNAME=linux CONSOLE=/dev/console PREVLEVEL=N AUTOBOOT=YES REDIRECT=/dev/tty1 MACHTYPE=i386-suse-linux LINES=26 SHLVL=2 COLUMNS=82 BOOT_IMAGE=linux SHELL=/bin/bash HOSTTYPE=i386 OSTYPE=linux HOME=/ TERM=linux PATH=/sbin:/bin:/usr/sbin:/usr/bin RUNLEVEL=5 INIT_VERSION=sysvinit-2.82 _=/sbin/startproc DAEMON=/usr/sbin/check_MailScanner ] > > failed > > '/etc/init.d/rc5.d/S10MailScanner start' exits with status 7 > /etc/init.d/rc5.d/S10atd start > Starting service at daemonstartproc: execve (/usr/s Could someone please point me in the direction to correct this. TIA David -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE+lNkm3VVncqMjOZsRAqEZAJ0QewVT96aRtCmQRDUttyiTV7gM0gCfelQV CPA6USUseM/TgNOf7QS9H9E= =VfOG -----END PGP SIGNATURE----- From mailscanner at ecs.soton.ac.uk Thu Apr 10 11:08:23 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: References: <5.2.0.9.2.20030409223049.022a6d68@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030410110725.022ede98@imap.ecs.soton.ac.uk> At 23:31 09/04/2003, you wrote: >Hi Julian, > > > I suspect the find command in the f-prot-wrapper with Ramdisk=yes. I forgot > > all the nasty stuff you have to do to make "find" cope with things like > > spaces in filenames. > > > > Advise you don't run it in tmpfs for now. I'll try to sort out a find > > command that will work. > >Ok, good, if you need me to test some beta's let me know. >Would be nice to get this working. Try the attached. Looks like it should work. -------------- next part -------------- A non-text attachment was scrubbed... Name: f-prot-wrapper Type: application/octet-stream Size: 2806 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030410/a7533622/f-prot-wrapper.obj -------------- next part -------------- -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Thu Apr 10 15:22:44 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:45 2006 Subject: Porn msg identification? In-Reply-To: References: <3E92E35D.1400.5BA79E38@localhost> Message-ID: <3E955404.26915.652FCFA5@localhost> El 9 Apr 2003 a las 14:45, Richard D Alloway escribi?: > On Tue, 8 Apr 2003, Mariano Absatz wrote: > > > Hi Rich, > > > > The point is that MailScanner doesn't know anything about scoring messages... > > the spam score you see in MailScanner is actually done by the SpamAssassin > > library that MailScanner optionally uses. > > This is, of course, quite true :) > > The reason I was suggesting it be part of MailScanner is the fact that > MailScanner takes the output of SpamAssassin and modifies the subject > and/or adds a header to the message. > > > Now, _that_ library, including the rules that come with it, is developed and > > optimized to tag as much spam as possible _avoiding_ as many false positives > > as it can. > > Well, I'm not necessarily looking to detect spam... legitimate email with > mature content might not be spam. :) Right, but my point is that, so far, MailScanner invokes SpamAssassin at most once, and thus, it only uses one set of SA rules that, by default, is configured to detect spam. It would be easy (only a matter of configuration, not programming) to change the SA rules (and/or their scoring) to detect adult content, and modify the MailScanner.conf, so the X-MailScanner-xxxx and Subject be modified to report 'adulthood' rather than 'spamhood' of the message. The problem is if you want the _same_ MailScanner to do _both_ spam & adult content detection. For that to work you should modify MS to invoke SA twice, with a different set of rules and generate to sets of headers and subject: modification, based on what each of the two SA invocations yield. That would include duplicating some of MS's data structures representing messages with different names, configuration variables and their defaults, etc. A slower (from a performance point of view) but faster (from a development point of view) solution would be to run 2 instances of MailScanner on the same machine, one to do de usual spam & virus detection and the other one to do adult content detection. For this you'll have to set up another queue directory like /var/spool/mqueue.mid and set the first MS with that as the "output" directory and the second MS with that as the "input" directory... You should also change, for the second MS all the messages that speak about "spam" to speak about "adult content", configure it to not query (either internally or via SA any RBL), to not check for viruses, eliminate the internal MS content checks (IFRAME, attachment extensions, etc.) so as to avoid as much double-processing as you can.... The first MS should also change its "Sendmail2" invocation... I don't know much about Sendmail and Exim, but, for what I see, it should be kind of "/bin/true" since every file that the second MS finds in /var/spool/mqueue.mid (left there by the first MS) will automatically be processed by the second MailScanner without it needing to be invoked as sendmail does... Am I wrong, Julian, Nick? > > > Thus, SpamAssassin scans the message looking for patterns and it adds or > > substracts from the score as some conditions are met or not... > > Which is the same functionality I'd be looking for in a word/phrase > detection routine, but with a seperate set of actions from the spam > portion. > > > You _could_ create a different set of rules for SpamAssassin and invoke it > > twice, once for spam detection and the other for "adulthood" detection, but > > that would imply at least modifying MailScanner and using a secondary set of > > SpamAssassin rules... it _will_ require some time and an effort to do it... > > It seems I may be one of the very few actually looking for this type of > feature...perhaps I will have to throw on the ol' coding hat for a while > :) > > Julian, if I am (or anybody else is) able to create a relatively > lightweight way of adding this feature to MailScanner, would you consider > adding it to the production version? > > Thanks again for everyone's feedback! > > -Rich -- Mariano Absatz El Baby ---------------------------------------------------------- Honey, I Formatted the Kid! From raymond at PROLOCATION.NET Thu Apr 10 15:25:23 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: <5.2.0.9.2.20030410110725.022ede98@imap.ecs.soton.ac.uk> Message-ID: Hi! > > > Advise you don't run it in tmpfs for now. I'll try to sort out a find > > > command that will work. > >Ok, good, if you need me to test some beta's let me know. > >Would be nice to get this working. > > Try the attached. Looks like it should work. I have been running since this morning, it looks like this works, but it doenst :) I sended in zips with virusses, to test, they all went through just fine. I received the zip and mailscanner told me message clean. So it seems its not scanning the content at all currently. I resended the zip 3 times, and its still passing. So no errors in the script output anymore, like last night, but it seems its scanning something different, not the files i mail in :) Bye, Raymond From mailscanner at ecs.soton.ac.uk Thu Apr 10 15:30:39 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: References: <5.2.0.9.2.20030410110725.022ede98@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030410152947.04728e10@imap.ecs.soton.ac.uk> At 15:25 10/04/2003, you wrote: >Hi! > > > > > Advise you don't run it in tmpfs for now. I'll try to sort out a find > > > > command that will work. > > > >Ok, good, if you need me to test some beta's let me know. > > >Would be nice to get this working. > > > > Try the attached. Looks like it should work. > >I have been running since this morning, it looks like this works, but it >doenst :) I sended in zips with virusses, to test, they all went through >just fine. I received the zip and mailscanner told me message clean. So it >seems its not scanning the content at all currently. I resended the zip 3 >times, and its still passing. So no errors in the script output anymore, >like last night, but it seems its scanning something different, not the >files i mail in :) Is this a comparison of it running with tmpfs versus a real disk? Does it definitely work with a real disk, and definitely fails with tmpfs? -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Thu Apr 10 15:29:10 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: Porn msg identification? In-Reply-To: <3E955404.26915.652FCFA5@localhost> References: <3E92E35D.1400.5BA79E38@localhost> Message-ID: <5.2.0.9.2.20030410152900.02edd7e0@imap.ecs.soton.ac.uk> At 15:22 10/04/2003, you wrote: >El 9 Apr 2003 a las 14:45, Richard D Alloway escribi?: > > > On Tue, 8 Apr 2003, Mariano Absatz wrote: > > > > > Hi Rich, > > > > > > The point is that MailScanner doesn't know anything about scoring > messages... > > > the spam score you see in MailScanner is actually done by the > SpamAssassin > > > library that MailScanner optionally uses. > > > > This is, of course, quite true :) > > > > The reason I was suggesting it be part of MailScanner is the fact that > > MailScanner takes the output of SpamAssassin and modifies the subject > > and/or adds a header to the message. > > > > > Now, _that_ library, including the rules that come with it, is > developed and > > > optimized to tag as much spam as possible _avoiding_ as many false > positives > > > as it can. > > > > Well, I'm not necessarily looking to detect spam... legitimate email with > > mature content might not be spam. :) >Right, but my point is that, so far, MailScanner invokes SpamAssassin at most >once, and thus, it only uses one set of SA rules that, by default, is >configured to detect spam. > >It would be easy (only a matter of configuration, not programming) to change >the SA rules (and/or their scoring) to detect adult content, and modify the >MailScanner.conf, so the X-MailScanner-xxxx and Subject be modified to report >'adulthood' rather than 'spamhood' of the message. > >The problem is if you want the _same_ MailScanner to do _both_ spam & adult >content detection. > >For that to work you should modify MS to invoke SA twice, with a different >set of rules and generate to sets of headers and subject: modification, based >on what each of the two SA invocations yield. > >That would include duplicating some of MS's data structures representing >messages with different names, configuration variables and their defaults, >etc. > >A slower (from a performance point of view) but faster (from a development >point of view) solution would be to run 2 instances of MailScanner on the >same machine, one to do de usual spam & virus detection and the other one to >do adult content detection. > >For this you'll have to set up another queue directory like >/var/spool/mqueue.mid and set the first MS with that as the "output" >directory and the second MS with that as the "input" directory... > >You should also change, for the second MS all the messages that speak about >"spam" to speak about "adult content", configure it to not query (either >internally or via SA any RBL), to not check for viruses, eliminate the >internal MS content checks (IFRAME, attachment extensions, etc.) so as to >avoid as much double-processing as you can.... > >The first MS should also change its "Sendmail2" invocation... I don't know >much about Sendmail and Exim, but, for what I see, it should be kind of >"/bin/true" since every file that the second MS finds in >/var/spool/mqueue.mid (left there by the first MS) will automatically be >processed by the second MailScanner without it needing to be invoked as >sendmail does... > >Am I wrong, Julian, Nick? That should work fine. > > > > > Thus, SpamAssassin scans the message looking for patterns and it adds or > > > substracts from the score as some conditions are met or not... > > > > Which is the same functionality I'd be looking for in a word/phrase > > detection routine, but with a seperate set of actions from the spam > > portion. > > > > > You _could_ create a different set of rules for SpamAssassin and > invoke it > > > twice, once for spam detection and the other for "adulthood" > detection, but > > > that would imply at least modifying MailScanner and using a secondary > set of > > > SpamAssassin rules... it _will_ require some time and an effort to do > it... > > > > It seems I may be one of the very few actually looking for this type of > > feature...perhaps I will have to throw on the ol' coding hat for a while > > :) > > > > Julian, if I am (or anybody else is) able to create a relatively > > lightweight way of adding this feature to MailScanner, would you consider > > adding it to the production version? > > > > Thanks again for everyone's feedback! > > > > -Rich > >-- >Mariano Absatz >El Baby >---------------------------------------------------------- >Honey, I Formatted the Kid! -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Thu Apr 10 15:41:34 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: <5.2.0.9.2.20030410152947.04728e10@imap.ecs.soton.ac.uk> Message-ID: Hi! > >doenst :) I sended in zips with virusses, to test, they all went through > >just fine. I received the zip and mailscanner told me message clean. So it > >seems its not scanning the content at all currently. I resended the zip 3 > >times, and its still passing. So no errors in the script output anymore, > >like last night, but it seems its scanning something different, not the > >files i mail in :) > Is this a comparison of it running with tmpfs versus a real disk? > Does it definitely work with a real disk, and definitely fails with tmpfs? Yes, positive. I switched back to real disk, sended in the SAME zip again and pop, 6 virusses found, like before :) Bye, Raymond. From mailscanner at ecs.soton.ac.uk Thu Apr 10 17:04:41 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: References: <5.2.0.9.2.20030410152947.04728e10@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030410170339.04782a28@imap.ecs.soton.ac.uk> At 15:41 10/04/2003, you wrote: > > >doenst :) I sended in zips with virusses, to test, they all went through > > >just fine. I received the zip and mailscanner told me message clean. So it > > >seems its not scanning the content at all currently. I resended the zip 3 > > >times, and its still passing. So no errors in the script output anymore, > > >like last night, but it seems its scanning something different, not the > > >files i mail in :) > > > Is this a comparison of it running with tmpfs versus a real disk? > > Does it definitely work with a real disk, and definitely fails with tmpfs? > >Yes, positive. I switched back to real disk, sended in the SAME zip again >and pop, 6 virusses found, like before :) Okay, this one works a whole lot better. -------------- next part -------------- A non-text attachment was scrubbed... Name: f-prot-wrapper Type: application/octet-stream Size: 3118 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030410/d75d95de/f-prot-wrapper.obj -------------- next part -------------- -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From roberto at MEUPROVEDOR.COM.BR Thu Apr 10 18:39:03 2003 From: roberto at MEUPROVEDOR.COM.BR (Roberto Campos) Date: Thu Jan 12 21:17:45 2006 Subject: Mcafee autoupdate In-Reply-To: <5.2.0.9.2.20030410152900.02edd7e0@imap.ecs.soton.ac.uk> Message-ID: <003c01c2ff88$1498d270$2000a8c0@vaiobeto> Hi, I can't seen to find if my autoupdate is working or not. How can i do to chdck it. Abra?os, Roberto Campos _________________________________________ Meu Provedor Tecnologias e Informatica Ltda. Rua Camerino, 128 Gr. 302 ? Centro Rio de Janeiro ? RJ ? 20.080-010 Tel.: (21) 2518.1011 Fax: (21) 2518.1055 From mailscanner at ecs.soton.ac.uk Thu Apr 10 18:41:42 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: Mcafee autoupdate In-Reply-To: <003c01c2ff88$1498d270$2000a8c0@vaiobeto> References: <5.2.0.9.2.20030410152900.02edd7e0@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030410184125.027445c8@imap.ecs.soton.ac.uk> You should get new .dat files in your uvscan directory. At 18:39 10/04/2003, you wrote: >Hi, > >I can't seen to find if my autoupdate is working or not. >How can i do to chdck it. > >Abra?os, > >Roberto Campos >_________________________________________ >Meu Provedor Tecnologias e Informatica Ltda. >Rua Camerino, 128 Gr. 302 ? Centro >Rio de Janeiro ? RJ ? 20.080-010 >Tel.: (21) 2518.1011 Fax: (21) 2518.1055 -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Thu Apr 10 18:42:31 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: Mcafee autoupdate In-Reply-To: <003c01c2ff88$1498d270$2000a8c0@vaiobeto> References: <5.2.0.9.2.20030410152900.02edd7e0@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030410184159.02735bd0@imap.ecs.soton.ac.uk> The other thing you could do would be to delete one or two of the .dat files, and check that mcafee-autoupdate replaces them. At 18:39 10/04/2003, you wrote: >Hi, > >I can't seen to find if my autoupdate is working or not. >How can i do to chdck it. > >Abra?os, > >Roberto Campos >_________________________________________ >Meu Provedor Tecnologias e Informatica Ltda. >Rua Camerino, 128 Gr. 302 ? Centro >Rio de Janeiro ? RJ ? 20.080-010 >Tel.: (21) 2518.1011 Fax: (21) 2518.1055 -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From jharnish at CI.GRAND-RAPIDS.MI.US Thu Apr 10 19:39:51 2003 From: jharnish at CI.GRAND-RAPIDS.MI.US (Harnish, Joe) Date: Thu Jan 12 21:17:45 2006 Subject: putting the spam score in the header Message-ID: <221C759285B78647AEE6181FD6AF36A703A8E39F@bambi.grand-rapids.mi.us> I was wondering if there is a quick way in the MailScanner.conf file that I could have the Spam Subject look like this {Spam?} ##. Where ## would be the score. I have set this up for a test group and I need an easy way to let them know what the score was. Thanks Joe -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030410/f37fcc55/attachment.html From kevins at BMRB.CO.UK Thu Apr 10 21:05:08 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:45 2006 Subject: putting the spam score in the header In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EDF745@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF745@pascal.priv.bmrb.co.uk> Message-ID: <1050005113.1624.7.camel@bach.kevinspicer.co.uk> If you just want something quick and brutal for testing purposes (and you're running Outlook, which it looks like you might be...) you can set... Spam Header = X-Message-Flag This flags the message, and will show the entire spam report yellow information section at the top of the email when you open it. I wouldn't use this in production though as a) so many flagged messages can be annoying b) People might have legitimate reasons for flagging mail. The best way to actually filter mail into different folders according to the spam score is to filter on the value of the X-MailScanner-SpamScore header. On Thu, 2003-04-10 at 19:39, Harnish, Joe wrote: I was wondering if there is a quick way in the MailScanner.conf file that I could have the Spam Subject look like this {Spam?} ##. Where ## would be the score. I have set this up for a test group and I need an easy way to let them know what the score was. Thanks Joe BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From jharnish at CI.GRAND-RAPIDS.MI.US Thu Apr 10 22:07:11 2003 From: jharnish at CI.GRAND-RAPIDS.MI.US (Harnish, Joe) Date: Thu Jan 12 21:17:45 2006 Subject: putting the spam score in the header Message-ID: <221C759285B78647AEE6181FD6AF36A703A8E3A3@bambi.grand-rapids.mi.us> I actually have it move but what I am hoping for is something a little cleaner so that I can put it on all messages even though the message may not be marked as spam. I was looking at putting it into the place for {Scanned} to make it so they can see what their normal mail is scoring too. Thanks Joe -----Original Message----- From: Kevin Spicer [mailto:kevins@BMRB.CO.UK] Sent: Thursday, April 10, 2003 4:05 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: putting the spam score in the header If you just want something quick and brutal for testing purposes (and you're running Outlook, which it looks like you might be...) you can set... Spam Header = X-Message-Flag This flags the message, and will show the entire spam report yellow information section at the top of the email when you open it. I wouldn't use this in production though as a) so many flagged messages can be annoying b) People might have legitimate reasons for flagging mail. The best way to actually filter mail into different folders according to the spam score is to filter on the value of the X-MailScanner-SpamScore header. On Thu, 2003-04-10 at 19:39, Harnish, Joe wrote: I was wondering if there is a quick way in the MailScanner.conf file that I could have the Spam Subject look like this {Spam?} ##. Where ## would be the score. I have set this up for a test group and I need an easy way to let them know what the score was. Thanks Joe BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030410/14917bef/attachment.html From patricksteiner at BLUEWIN.CH Thu Apr 10 22:15:25 2003 From: patricksteiner at BLUEWIN.CH (Patrick Steiner) Date: Thu Jan 12 21:17:45 2006 Subject: How can i config Exim that local mail direct deliver Message-ID: <3E95DEED.7020709@bluewin.ch> Have anybody experience with the exim configuration file. I want to make that any mails there are comming from the local network (10.0.0.0/24) direct deliver without checking with the mailscanner. For example: any mail from the internet is store in the /var/spool/exim_incoming and then checking with the mailscanner any mail from 10.0.0.0/24 is direct deliver to the email receiver without checking with the mailscanner i think it is possibility to configure exim to check the ip that have connect to the smtp port From raymond at PROLOCATION.NET Fri Apr 11 00:46:12 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:45 2006 Subject: mqueue.in on tmpfs In-Reply-To: <5.2.0.9.2.20030410170339.04782a28@imap.ecs.soton.ac.uk> Message-ID: Hi! > > > Is this a comparison of it running with tmpfs versus a real disk? > > > Does it definitely work with a real disk, and definitely fails with tmpfs? > >Yes, positive. I switched back to real disk, sended in the SAME zip again > >and pop, 6 virusses found, like before :) > Okay, this one works a whole lot better. This at least scanned my test zips okay :) Can anyone else also test it a little more, its running some time now on my box and seems fine, however it would be nice to see more people toying around with it :)) Just do a tmpfs mount, and test :) Thanks, Raymond. From dot at DOTAT.AT Fri Apr 11 01:51:43 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:45 2006 Subject: Bayes setup In-Reply-To: References: <3E929DCF.1CBA0BD0@whidbey.com> Message-ID: Julian Field wrote: > >1) You can set up a "spam" and a "notspam" email address for people to dump >wrongly categorised mail into. You then use sa-learn once every hour (or >day) to teach SpamAssassin about the messages it got wrong. I have already >posted a script to do this to this list, but have attached it again for you. I'm a bit worried about how you could advertise a notspam address to your user without attracting spam to it. Tony. -- f.a.n.finch http://dotat.at/ THE MULL OF GALLOWAY TO MULL OF KINTYRE INCLUDING THE FIRTH OF CLYDE AND THE NORTH CHANNEL: EAST TO SOUTHEAST 3 OR 4, BECOMING WEST TO SOUTHWEST, BUT OFTEN VARIABLE 2. FAIR. GOOD. SLIGHT. From mailscanner at ecs.soton.ac.uk Fri Apr 11 08:45:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: Bayes setup In-Reply-To: References: <3E929DCF.1CBA0BD0@whidbey.com> Message-ID: <5.2.0.9.2.20030411084423.02b3b150@imap.ecs.soton.ac.uk> At 01:51 11/04/2003, you wrote: >Julian Field wrote: > > > >1) You can set up a "spam" and a "notspam" email address for people to dump > >wrongly categorised mail into. You then use sa-learn once every hour (or > >day) to teach SpamAssassin about the messages it got wrong. I have already > >posted a script to do this to this list, but have attached it again for you. > >I'm a bit worried about how you could advertise a notspam address to your >user without attracting spam to it. I did it by word of mouth, and a web page which is only available with username/password access. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From danieltan at shopnsave.com.sg Fri Apr 11 09:47:35 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:45 2006 Subject: ANNOUNCE: Version 4.14 released References: <5.2.0.9.2.20030408142512.03dc91a8@imap.ecs.soton.ac.uk> Message-ID: <041601c30007$00714460$3900a8c0@Daniel> sorry for posting OOT to mailscanner... how do u do a proper install with spam assassin ? i am trying to install the latest rpm the command u asked me to type in still says 2.50 i tried rpm -i --nodeps spamassassin-2.53-1.8.0.i386.rpm and this too - rpm -i --nodeps perl-Mail-SpamAssassin-2.53-1.8.0.i386.rpm i tried rpm with -U and --force options but still cant get it upgraded but after i type in your command..it still says 2.50 and even spamassassin -V says it is 2.50 ----- Original Message ----- From: "Julian Field" To: Sent: Tuesday, April 08, 2003 9:27 PM Subject: Re: ANNOUNCE: Version 4.14 released At 10:51 08/04/2003, you wrote: >the reason why i am ugrading is due to the fact that spamassassin 2.50 has >problems with mailscanner... >it seems like doing spamassassin --version is still at 2.50...although i >have already upgraded....now still to find out why it did not upgrade But what did perl -MMail::SpamAssassin -le 'print $Mail::SpamAssassin::VERSION;' say? That's checking the version of SpamAssassin you really have installed where perl is looking for it, not just some version you happen to have unpacked in another directory. >----- Original Message ----- >From: "Raymond Dijkxhoorn" >To: >Sent: Tuesday, April 08, 2003 3:49 PM >Subject: Re: ANNOUNCE: Version 4.14 released > > >Hello Daniel, > > > how do you check the correct version of mailscanner and spam assassin? > > just recently i upgraded spam assassin to the latest version to avoid >mails > > to be stuck due to mailscanner unable to send it out > > but i still got the problem yesterday.that's why i need to check whether >it > >For Spam Assasin: > >[root@master .spamassassin]# spamassassin --version >SpamAssassin version 2.53 > >For Mailscanner, it prints the version number also in your maillog when >starting up, so have a look there. > > > hope it helps as the staff are gunning for my head coz their mails aren't > > sent "on time" > >Can you be a bit more specific ? > >Bye, >Raymond. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 11 09:58:53 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <041601c30007$00714460$3900a8c0@Daniel> References: <5.2.0.9.2.20030408142512.03dc91a8@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030411095712.0293a500@imap.ecs.soton.ac.uk> rpm -e perl-Mail-SpamAssassin Then download the .tar.gz file tar xzf Mail-SpamAssassin-2.53.tar.gz cd Mail-SpamAssassin-2.53 perl Makefile.PL Then make sure you have the pre-requisites installed (the previous command will warn you if you don't) make make test make install At 09:47 11/04/2003, you wrote: >sorry for posting OOT to mailscanner... > >how do u do a proper install with spam assassin ? i am trying to install the >latest rpm > >the command u asked me to type in still says 2.50 >i tried rpm -i --nodeps spamassassin-2.53-1.8.0.i386.rpm >and this too - rpm -i --nodeps perl-Mail-SpamAssassin-2.53-1.8.0.i386.rpm > >i tried rpm with -U and --force options but still cant get it upgraded > >but after i type in your command..it still says 2.50 and even >spamassassin -V says it is 2.50 >----- Original Message ----- >From: "Julian Field" >To: >Sent: Tuesday, April 08, 2003 9:27 PM >Subject: Re: ANNOUNCE: Version 4.14 released > > >At 10:51 08/04/2003, you wrote: > >the reason why i am ugrading is due to the fact that spamassassin 2.50 has > >problems with mailscanner... > >it seems like doing spamassassin --version is still at 2.50...although i > >have already upgraded....now still to find out why it did not upgrade > >But what did >perl -MMail::SpamAssassin -le 'print $Mail::SpamAssassin::VERSION;' >say? >That's checking the version of SpamAssassin you really have installed where >perl is looking for it, not just some version you happen to have unpacked >in another directory. > > > >----- Original Message ----- > >From: "Raymond Dijkxhoorn" > >To: > >Sent: Tuesday, April 08, 2003 3:49 PM > >Subject: Re: ANNOUNCE: Version 4.14 released > > > > > >Hello Daniel, > > > > > how do you check the correct version of mailscanner and spam assassin? > > > just recently i upgraded spam assassin to the latest version to avoid > >mails > > > to be stuck due to mailscanner unable to send it out > > > but i still got the problem yesterday.that's why i need to check whether > >it > > > >For Spam Assasin: > > > >[root@master .spamassassin]# spamassassin --version > >SpamAssassin version 2.53 > > > >For Mailscanner, it prints the version number also in your maillog when > >starting up, so have a look there. > > > > > hope it helps as the staff are gunning for my head coz their mails >aren't > > > sent "on time" > > > >Can you be a bit more specific ? > > > >Bye, > >Raymond. > >-- >Julian Field >www.MailScanner.info >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From roberto at MEUPROVEDOR.COM.BR Fri Apr 11 11:53:05 2003 From: roberto at MEUPROVEDOR.COM.BR (Roberto Campos) Date: Thu Jan 12 21:17:45 2006 Subject: RES: Mcafee autoupdate In-Reply-To: <5.2.0.9.2.20030410184159.02735bd0@imap.ecs.soton.ac.uk> Message-ID: <005101c30018$88cbf970$2000a8c0@vaiobeto> Ok, so it's not working. I've tryed it my own and it's reporting this: #McAfee update failed: cannot find the update file, Connection timed out at /usr/lib/MailScanner/mcafee-autoupdate line 99. I've done it by hand and it works. I got the address and called: #cd /opt/VScan #ncftp -u anonymous #password: roberto@meuprovedor.com.br #cd /pub/antivirus/datfiles/4.x/ #ls #get *.dat And this way i got the file.... What my be the problem here? So you can help me here goes my config: RedHat 8.0 (stock - RHN_UPDATED) perl-5.8.0-55 mailscanner-4.14-9 spamassassin-2.31-16 Vscan: Product Release: April 9, 2003 - DAT Version: 4257 - Engine Version: 4.2.40 The Vscan version is so that i did it by hand... Thanks in advance, Roberto Campos _________________________________________ Meu Provedor Tecnologias e Informatica Ltda. Rua Camerino, 128 Gr. 302 ? Centro Rio de Janeiro ? RJ ? 20.080-010 Tel.: (21) 2518.1011 Fax: (21) 2518.1055 -----Mensagem original----- De: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Em nome de Julian Field Enviada em: quinta-feira, 10 de abril de 2003 14:43 Para: MAILSCANNER@JISCMAIL.AC.UK Assunto: Re: Mcafee autoupdate The other thing you could do would be to delete one or two of the .dat files, and check that mcafee-autoupdate replaces them. At 18:39 10/04/2003, you wrote: >Hi, > >I can't seen to find if my autoupdate is working or not. >How can i do to chdck it. > >Abra?os, > >Roberto Campos >_________________________________________ >Meu Provedor Tecnologias e Informatica Ltda. >Rua Camerino, 128 Gr. 302 ? Centro >Rio de Janeiro ? RJ ? 20.080-010 >Tel.: (21) 2518.1011 Fax: (21) 2518.1055 -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Fri Apr 11 11:57:07 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:45 2006 Subject: RES: Mcafee autoupdate In-Reply-To: <005101c30018$88cbf970$2000a8c0@vaiobeto> Message-ID: Hi! > I've tryed it my own and it's reporting this: > > #McAfee update failed: cannot find the update file, Connection timed out > at /usr/lib/MailScanner/mcafee-autoupdate line 99. > > I've done it by hand and it works. > I got the address and called: Do you have Net::FTP installed (Perl) ? Bye, Raymond. From dml at UNB.CA Fri Apr 11 12:34:58 2003 From: dml at UNB.CA (David Lancaster) Date: Thu Jan 12 21:17:45 2006 Subject: Bayes setup In-Reply-To: <5.2.0.9.2.20030411084423.02b3b150@imap.ecs.soton.ac.uk> References: <3E929DCF.1CBA0BD0@whidbey.com> <5.2.0.9.2.20030411084423.02b3b150@imap.ecs.soton.ac.uk> Message-ID: <1050060898.3e96a862ac24a@apollo.unb.ca> > >I'm a bit worried about how you could advertise a notspam address to your > >user without attracting spam to it. > > I did it by word of mouth, and a web page which is only available with > username/password access. Since you'd only want feedback from your users, some sort of filtering to only accept messages from your local domain(s) would be a good idea. Would prevent external "taint"ing of the system, although an internal user might still cause problems. If the idea of "spam@domain" and "notspam@domain" catches on in the future, I wouldn't be surprised to see spammers try to randomly flood those addresses to impair learning filters. D. -- ITS ESS UNB From brian at UNEARTHED.ORG Fri Apr 11 17:24:16 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:45 2006 Subject: ANNOUNCE: Version 4.14 released References: <5.2.0.9.2.20030408142512.03dc91a8@imap.ecs.soton.ac.uk> <041601c30007$00714460$3900a8c0@Daniel> Message-ID: <002501c30048$59859d80$bc01020a@brianmay> Did you try an uninstall, then an install? ----- Original Message ----- From: "Daniel Tan" To: Sent: Friday, April 11, 2003 1:47 AM Subject: Re: ANNOUNCE: Version 4.14 released sorry for posting OOT to mailscanner... how do u do a proper install with spam assassin ? i am trying to install the latest rpm the command u asked me to type in still says 2.50 i tried rpm -i --nodeps spamassassin-2.53-1.8.0.i386.rpm and this too - rpm -i --nodeps perl-Mail-SpamAssassin-2.53-1.8.0.i386.rpm i tried rpm with -U and --force options but still cant get it upgraded but after i type in your command..it still says 2.50 and even spamassassin -V says it is 2.50 ----- Original Message ----- From: "Julian Field" To: Sent: Tuesday, April 08, 2003 9:27 PM Subject: Re: ANNOUNCE: Version 4.14 released At 10:51 08/04/2003, you wrote: >the reason why i am ugrading is due to the fact that spamassassin 2.50 has >problems with mailscanner... >it seems like doing spamassassin --version is still at 2.50...although i >have already upgraded....now still to find out why it did not upgrade But what did perl -MMail::SpamAssassin -le 'print $Mail::SpamAssassin::VERSION;' say? That's checking the version of SpamAssassin you really have installed where perl is looking for it, not just some version you happen to have unpacked in another directory. >----- Original Message ----- >From: "Raymond Dijkxhoorn" >To: >Sent: Tuesday, April 08, 2003 3:49 PM >Subject: Re: ANNOUNCE: Version 4.14 released > > >Hello Daniel, > > > how do you check the correct version of mailscanner and spam assassin? > > just recently i upgraded spam assassin to the latest version to avoid >mails > > to be stuck due to mailscanner unable to send it out > > but i still got the problem yesterday.that's why i need to check whether >it > >For Spam Assasin: > >[root@master .spamassassin]# spamassassin --version >SpamAssassin version 2.53 > >For Mailscanner, it prints the version number also in your maillog when >starting up, so have a look there. > > > hope it helps as the staff are gunning for my head coz their mails aren't > > sent "on time" > >Can you be a bit more specific ? > >Bye, >Raymond. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Steve at swaney.com Fri Apr 11 18:16:28 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:45 2006 Subject: ANNOUNCE: Version 4.14 released In-Reply-To: <002501c30048$59859d80$bc01020a@brianmay> References: <5.2.0.9.2.20030408142512.03dc91a8@imap.ecs.soton.ac.uk> <041601c30007$00714460$3900a8c0@Daniel> <002501c30048$59859d80$bc01020a@brianmay> Message-ID: <1050081388.13096.69.camel@speedy> Find out if any SpamAssassin tools are installed: rpm -qa | grep ssassin Then remove any previously installed SpamAssassin rpms: rpm -e spamassassin-2.5X rpm -e spamassassin-tools-2.5X rpm -e perl-Mail-SpamAssassin-2.5X Then I'd suggest installing SpamAssassin using the CPAN method (You do Have the perl CPAN Module installed?). Installing from the rpm has caused some problems, at least when running SpamAssassin on Redhat 8.0 Installing SpamAssassin ----------------------- The easiest way to do this is using CPAN.pm, like so: perl -MCPAN -e shell [as root] o conf prerequisites_policy ask install Mail::SpamAssassin quit Hope this helps, If You can't use the cpan module, then the rpms must be installe in a certian order, namely: first: rpm -ivh perl-Mail-SpamAssassin-2.5X second: rpm -ivh spamassassin-tools-2.5X Finally: rpm -ivh spamassassin-2.5X Steve Steve Swaney Steve@Swaney.com Phone: 202 352-3262 Fax: 202 352-3262 On Fri, 2003-04-11 at 12:24, Brian May wrote: > Did you try an uninstall, then an install? > ----- Original Message ----- > From: "Daniel Tan" > To: > Sent: Friday, April 11, 2003 1:47 AM > Subject: Re: ANNOUNCE: Version 4.14 released > > > sorry for posting OOT to mailscanner... > > how do u do a proper install with spam assassin ? i am trying to install the > latest rpm > > the command u asked me to type in still says 2.50 > i tried rpm -i --nodeps spamassassin-2.53-1.8.0.i386.rpm > and this too - rpm -i --nodeps perl-Mail-SpamAssassin-2.53-1.8.0.i386.rpm > > i tried rpm with -U and --force options but still cant get it upgraded > > but after i type in your command..it still says 2.50 and even > spamassassin -V says it is 2.50 > ----- Original Message ----- > From: "Julian Field" > To: > Sent: Tuesday, April 08, 2003 9:27 PMusing > Subject: Re: ANNOUNCE: Version 4.14 released > > > At 10:51 08/04/2003, you wrote: > >the reason why i am ugrading is due to the fact that spamassassin 2.50 has > >problems with mailscanner... > >it seems like doing spamassassin --version is still at 2.50...although i > >have already upgraded....now still to find out why it did not upgrade > > But what did > perl -MMail::SpamAssassin -le 'print $Mail::SpamAssassin::VERSION;' > say? > That's checking the version of SpamAssassin you really have installed where > perl is looking for it, not just some version you happen to have unpacked > in another directory. > > > >----- Original Message ----- > >From: "Raymond Dijkxhoorn" > >To: > >Sent: Tuesday, April 08, 2003 3:49 PM > >Subject: Re: ANNOUNCE: Version 4.14 released > > > > > >Hello Daniel, > > > > > how do you check the correct version of mailscanner and spam assassin? > > > just recently i upgraded spam assassin to the latest version to avoid > >mails > > > to be stuck due to mailscanner unable to send it out > > > but i still got the problem yesterday.that's why i need to check whether > >it > > > >For Spam Assasin: > > > >[root@master .spamassassin]# spamassassin --version > >SpamAssassin version 2.53 > > > >For Mailscanner, it prints the version number also in your maillog when > >starting up, so have a look there. > > > > > hope it helps as the staff are gunning for my head coz their mails > aren't > > > sent "on time" > > > >Can you be a bit more specific ? > > > >Bye, > >Raymond. > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support From dot at DOTAT.AT Fri Apr 11 18:08:48 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:45 2006 Subject: RES: Mcafee autoupdate In-Reply-To: References: <5.2.0.9.2.20030410184159.02735bd0@imap.ecs.soton.ac.uk> Message-ID: Roberto Campos wrote: >Ok, so it's not working. >I've tryed it my own and it's reporting this: >#McAfee update failed: cannot find the update file, Connection timed out >at /usr/lib/MailScanner/mcafee-autoupdate line 99. That's an indication of network problems. I've posted this before, but the current version of my uvscan-update script is even more careful than it was. Unfortunately I can't edit the version in the faq-o-matic; I can only append which is ugly and leads to repetition. (You also can't fix broken item titles, which is a bit ugly. Perhaps it should be a wiki instead...) #!/bin/sh -e # # Update the McAfee data files. # # $Cambridge: hermes/build/bin/uvscan-update,v 1.14 2003/04/11 16:57:33 fanf2 Exp $ LIBDIR=/opt/uvscan FTPDIR=ftp://ftpeur.nai.com/pub/antivirus/datfiles/4.x # version number pattern MATCH=[0-9][0-9][0-9][0-9] # work out latest dat version SED="/^DATVersion=\($MATCH\).$/!d;s//\1/;q" VERSION=$(wget -q -O- $FTPDIR/update.ini | sed -e "$SED") DATDIR=$LIBDIR/$VERSION FILE=dat-$VERSION.tar badversion () { echo Failed to get McAfee datfile update from "$FTPDIR" echo FTP version number "\"$VERSION\"" "$@" exit 1 } # check the format of the version number case $VERSION in $MATCH) : ok ;; *) badversion does not match "$MATCH" ;; esac # already got it? if [ -d $DATDIR ] then # keep cron quiet by default case $1 in -v) echo Already have "$VERSION" esac exit fi # work out installed dat version cd $LIBDIR if ls -d $MATCH >/dev/null 2>&1 then INSTALLED=$(ls -d $MATCH | tail -1) else # no installed version so get whatever is available INSTALLED=0000 fi # check new version is actually newer if [ $VERSION -lt $INSTALLED ] then badversion older than installed "$INSTALLED" fi echo Installed dat file is "$INSTALLED" echo Latest dat file is "$VERSION" # now we are verbose run() { echo ">" "$@" "$@" } # fetch and extract dat files run mkdir $DATDIR run cd $DATDIR run wget --progress=dot:mega $FTPDIR/$FILE run tar xvf $FILE # verify the contents fail () { echo "$OUT" echo Test run failed -- removing bad McAfee data files run rm -rf $DATDIR exit 1 } trap fail EXIT CMD="uvscan --dat $DATDIR --version 2>&1" echo '> OUT=$('$CMD')' OUT=$($CMD) case "$OUT" in *"Missing or invalid DAT"* | \ *"Data file not found"* | \ *"Removal datafile clean.dat not found"* | \ *"Unable to remove viruses"* ) fail ;; esac trap EXIT echo "$OUT" echo Update OK # change the current dat file links run cd $LIBDIR run ln -sf $VERSION/*.dat . # remove some crap run cd $DATDIR run rm -f *.exe *.tar *.txt echo echo Completed OK # done Tony. -- f.a.n.finch http://dotat.at/ BISCAY: EASTERLY 4 IN NORTH AT FIRST, OTHERWISE WEST BACKING SOUTHEAST 5 TO 7. RAIN OR SHOWERS. MODERATE OR GOOD. From craig at STRONG-BOX.NET Fri Apr 11 18:28:10 2003 From: craig at STRONG-BOX.NET (Craig Pratt) Date: Thu Jan 12 21:17:45 2006 Subject: RES: Mcafee autoupdate In-Reply-To: Message-ID: I don't know if it's related, but wget behind a firewall typically needs to have the --passive-ftp flag set. The error from wget would be "Error in server response, closing control connection." if this flag isn't set and you're behind a firewalls. Craig On Friday, April 11, 2003, at 10:08 AM, Tony Finch wrote: > Roberto Campos wrote: >> Ok, so it's not working. >> I've tryed it my own and it's reporting this: >> #McAfee update failed: cannot find the update file, Connection timed >> out >> at /usr/lib/MailScanner/mcafee-autoupdate line 99. > > That's an indication of network problems. > > I've posted this before, but the current version of my uvscan-update > script is even more careful than it was. Unfortunately I can't edit the > version in the faq-o-matic; I can only append which is ugly and leads > to > repetition. (You also can't fix broken item titles, which is a bit > ugly. > Perhaps it should be a wiki instead...) > > #!/bin/sh -e > # > # Update the McAfee data files. > # > # $Cambridge: hermes/build/bin/uvscan-update,v 1.14 2003/04/11 > 16:57:33 fanf2 Exp $ > > LIBDIR=/opt/uvscan > > FTPDIR=ftp://ftpeur.nai.com/pub/antivirus/datfiles/4.x > > # version number pattern > MATCH=[0-9][0-9][0-9][0-9] > > # work out latest dat version > SED="/^DATVersion=\($MATCH\).$/!d;s//\1/;q" > VERSION=$(wget -q -O- $FTPDIR/update.ini | sed -e "$SED") > > DATDIR=$LIBDIR/$VERSION > FILE=dat-$VERSION.tar > > badversion () { > echo Failed to get McAfee datfile update from "$FTPDIR" > echo FTP version number "\"$VERSION\"" "$@" > exit 1 > } > > # check the format of the version number > case $VERSION in > $MATCH) : ok > ;; > *) badversion does not match "$MATCH" > ;; > esac > > # already got it? > if [ -d $DATDIR ] > then > # keep cron quiet by default > case $1 in > -v) echo Already have "$VERSION" > esac > exit > fi > > # work out installed dat version > cd $LIBDIR > if ls -d $MATCH >/dev/null 2>&1 > then > INSTALLED=$(ls -d $MATCH | tail -1) > else > # no installed version so get whatever is available > INSTALLED=0000 > fi > > # check new version is actually newer > if [ $VERSION -lt $INSTALLED ] > then > badversion older than installed "$INSTALLED" > fi > > echo Installed dat file is "$INSTALLED" > echo Latest dat file is "$VERSION" > > # now we are verbose > run() { > echo ">" "$@" > "$@" > } > > # fetch and extract dat files > run mkdir $DATDIR > run cd $DATDIR > run wget --progress=dot:mega $FTPDIR/$FILE > run tar xvf $FILE > > # verify the contents > fail () { > echo "$OUT" > echo Test run failed -- removing bad McAfee data files > run rm -rf $DATDIR > exit 1 > } > trap fail EXIT > CMD="uvscan --dat $DATDIR --version 2>&1" > echo '> OUT=$('$CMD')' > OUT=$($CMD) > case "$OUT" in > *"Missing or invalid DAT"* | \ > *"Data file not found"* | \ > *"Removal datafile clean.dat not found"* | \ > *"Unable to remove viruses"* ) > fail > ;; > esac > trap EXIT > > echo "$OUT" > echo Update OK > # change the current dat file links > run cd $LIBDIR > run ln -sf $VERSION/*.dat . > # remove some crap > run cd $DATDIR > run rm -f *.exe *.tar *.txt > > echo > echo Completed OK > > # done > > Tony. > -- > f.a.n.finch http://dotat.at/ > BISCAY: EASTERLY 4 IN NORTH AT FIRST, OTHERWISE WEST BACKING SOUTHEAST > 5 TO 7. > RAIN OR SHOWERS. MODERATE OR GOOD. > > -- > This message checked for dangerous content by MailScanner on StrongBox. > > --- Craig Pratt Strongbox Network Services Inc. mailto:craig@strong-box.net -- This message checked for dangerous content by MailScanner on StrongBox. From mailscanner at ecs.soton.ac.uk Fri Apr 11 19:13:21 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: RES: Mcafee autoupdate In-Reply-To: References: <5.2.0.9.2.20030410184159.02735bd0@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030411191230.025b19a0@imap.ecs.soton.ac.uk> Tony, 1 thing that worries me slightly. You do a CMD="uvscan --dat $DATDIR --version 2>&1" echo '> OUT=$('$CMD')' OUT=$($CMD) What happens when /opt/uvscan isn't on your path? At 18:08 11/04/2003, you wrote: >Roberto Campos wrote: > >Ok, so it's not working. > >I've tryed it my own and it's reporting this: > >#McAfee update failed: cannot find the update file, Connection timed out > >at /usr/lib/MailScanner/mcafee-autoupdate line 99. > >That's an indication of network problems. > >I've posted this before, but the current version of my uvscan-update >script is even more careful than it was. Unfortunately I can't edit the >version in the faq-o-matic; I can only append which is ugly and leads to >repetition. (You also can't fix broken item titles, which is a bit ugly. >Perhaps it should be a wiki instead...) > > #!/bin/sh -e > # > # Update the McAfee data files. > # > # $Cambridge: hermes/build/bin/uvscan-update,v 1.14 2003/04/11 > 16:57:33 fanf2 Exp $ > > LIBDIR=/opt/uvscan > > FTPDIR=ftp://ftpeur.nai.com/pub/antivirus/datfiles/4.x > > # version number pattern > MATCH=[0-9][0-9][0-9][0-9] > > # work out latest dat version > SED="/^DATVersion=\($MATCH\).$/!d;s//\1/;q" > VERSION=$(wget -q -O- $FTPDIR/update.ini | sed -e "$SED") > > DATDIR=$LIBDIR/$VERSION > FILE=dat-$VERSION.tar > > badversion () { > echo Failed to get McAfee datfile update from "$FTPDIR" > echo FTP version number "\"$VERSION\"" "$@" > exit 1 > } > > # check the format of the version number > case $VERSION in > $MATCH) : ok > ;; > *) badversion does not match "$MATCH" > ;; > esac > > # already got it? > if [ -d $DATDIR ] > then > # keep cron quiet by default > case $1 in > -v) echo Already have "$VERSION" > esac > exit > fi > > # work out installed dat version > cd $LIBDIR > if ls -d $MATCH >/dev/null 2>&1 > then > INSTALLED=$(ls -d $MATCH | tail -1) > else > # no installed version so get whatever is available > INSTALLED=0000 > fi > > # check new version is actually newer > if [ $VERSION -lt $INSTALLED ] > then > badversion older than installed "$INSTALLED" > fi > > echo Installed dat file is "$INSTALLED" > echo Latest dat file is "$VERSION" > > # now we are verbose > run() { > echo ">" "$@" > "$@" > } > > # fetch and extract dat files > run mkdir $DATDIR > run cd $DATDIR > run wget --progress=dot:mega $FTPDIR/$FILE > run tar xvf $FILE > > # verify the contents > fail () { > echo "$OUT" > echo Test run failed -- removing bad McAfee data files > run rm -rf $DATDIR > exit 1 > } > trap fail EXIT > CMD="uvscan --dat $DATDIR --version 2>&1" > echo '> OUT=$('$CMD')' > OUT=$($CMD) > case "$OUT" in > *"Missing or invalid DAT"* | \ > *"Data file not found"* | \ > *"Removal datafile clean.dat not found"* | \ > *"Unable to remove viruses"* ) > fail > ;; > esac > trap EXIT > > echo "$OUT" > echo Update OK > # change the current dat file links > run cd $LIBDIR > run ln -sf $VERSION/*.dat . > # remove some crap > run cd $DATDIR > run rm -f *.exe *.tar *.txt > > echo > echo Completed OK > > # done > >Tony. >-- >f.a.n.finch http://dotat.at/ >BISCAY: EASTERLY 4 IN NORTH AT FIRST, OTHERWISE WEST BACKING SOUTHEAST 5 TO 7. >RAIN OR SHOWERS. MODERATE OR GOOD. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From kevins at BMRB.CO.UK Fri Apr 11 19:35:13 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:45 2006 Subject: Mcafee autoupdate In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EDF752@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF752@pascal.priv.bmrb.co.uk> Message-ID: <1050086114.32599.3.camel@bach.kevinspicer.co.uk> > Unfortunately I can't edit the > version in the faq-o-matic; I can only append which is ugly and leads > to > repetition. (You also can't fix broken item titles, which is a bit > ugly. Actually you can do both, you just can't see the link to do so by default. Click on the 'appearance' link at the bottom of the page and select 'show' for 'expert editing commands'. You'll then have more editing options than you can shake a stick at (it looks awful though, which is probably why its off by default). I can (and have) edited my entries without trouble. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From james at PCXPERIENCE.COM Fri Apr 11 19:36:07 2003 From: james at PCXPERIENCE.COM (James A. Pattie) Date: Thu Jan 12 21:17:45 2006 Subject: Cyrus Imap spam learning script Message-ID: <3E970B17.5010302@pcxperience.com> Skipped content of type multipart/mixed-------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 252 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030411/f2ed685b/attachment.bin From dot at DOTAT.AT Fri Apr 11 19:32:39 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:45 2006 Subject: RES: Mcafee autoupdate In-Reply-To: References: <5.2.0.9.2.20030410184159.02735bd0@imap.ecs.soton.ac.uk> Message-ID: Julian Field wrote: > >1 thing that worries me slightly. You do a > >CMD="uvscan --dat $DATDIR --version 2>&1" >echo '> OUT=$('$CMD')' >OUT=$($CMD) > >What happens when /opt/uvscan isn't on your path? You need to run it with the right path, either set in the crontab or edited into the file. BTW, it'll also work if you install uvscan where McAfee expect it to be, i.e. LIBDIR=/usr/local/lib/uvscan Tony. -- f.a.n.finch http://dotat.at/ NORTH FORELAND TO SELSEY BILL: EAST OR SOUTHEAST 3 OR 4. FAIR. GOOD. SLIGHT. From mailscanner at ecs.soton.ac.uk Fri Apr 11 19:49:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:45 2006 Subject: RES: Mcafee autoupdate In-Reply-To: References: <5.2.0.9.2.20030410184159.02735bd0@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030411194805.025b9e10@imap.ecs.soton.ac.uk> At 19:32 11/04/2003, you wrote: >Julian Field wrote: > > > >1 thing that worries me slightly. You do a > > > >CMD="uvscan --dat $DATDIR --version 2>&1" > >echo '> OUT=$('$CMD')' > >OUT=$($CMD) > > > >What happens when /opt/uvscan isn't on your path? > >You need to run it with the right path, either set in the crontab or >edited into the file. BTW, it'll also work if you install uvscan where >McAfee expect it to be, i.e. LIBDIR=/usr/local/lib/uvscan So if I add PATH=/usr/bin:/bin:/usr/local/bin:/usr/local/uvscan export PATH then it should work on most systems? -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From dot at DOTAT.AT Fri Apr 11 20:02:07 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:45 2006 Subject: Mcafee autoupdate In-Reply-To: References: <5C0296D26910694BB9A9BBFC577E7AB0EDF752@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB0EDF752@pascal.priv.bmrb.co.uk> Message-ID: Kevin Spicer wrote: > >Actually you can do both, you just can't see the link to do so by >default. Ah magic. Now i have ultimate FAQ-o-Matic power! Tony. -- f.a.n.finch http://dotat.at/ ARDNAMURCHAN POINT TO CAPE WRATH INCLUDING THE OUTER HEBRIDES: WEST OR NORTHWEST 3 OR 4, BUT 5 IN NORTH AT FIRST, BECOMING VARIABLE 2 OR 3. SHOWERS BECOMING ISOLATED. MODERATE OR GOOD. MODERATE LOCALLY SLIGHT, BUT ROUGH FOR A WHILE OPEN WATERS. From dot at DOTAT.AT Fri Apr 11 20:10:29 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:45 2006 Subject: RES: Mcafee autoupdate In-Reply-To: References: <5.2.0.9.2.20030410184159.02735bd0@imap.ecs.soton.ac.uk> Message-ID: Julian Field wrote: > >So if I add >PATH=/usr/bin:/bin:/usr/local/bin:/usr/local/uvscan >export PATH >then it should work on most systems? Yes, though I suggest PATH=$LIBDIR:/usr/local/bin:/usr/bin:/bin so you only need to change it in one place (the setting of LIBDIR) if (like me) you install uvscan in a peculiar location. Tony. -- f.a.n.finch http://dotat.at/ IRISH SEA: SOUTHWEST OR VARIABLE 3 OR 4. FAIR. GOOD. From roberto at MEUPROVEDOR.COM.BR Fri Apr 11 20:37:51 2003 From: roberto at MEUPROVEDOR.COM.BR (Roberto Campos) Date: Thu Jan 12 21:17:45 2006 Subject: RES: RES: Mcafee autoupdate In-Reply-To: Message-ID: <006a01c30061$d70f07a0$2000a8c0@vaiobeto> I've coppied your script to the machine and it hangs after getting the update.ini file.... It seems that wget is not letting it go.... Roberto Campos _________________________________________ Meu Provedor Tecnologias e Informatica Ltda. Rua Camerino, 128 Gr. 302 - Centro Rio de Janeiro - RJ - 20.080-010 Tel.: (21) 2518.1011 Fax: (21) 2518.1055 -----Mensagem original----- De: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Em nome de Tony Finch Enviada em: sexta-feira, 11 de abril de 2003 16:10 Para: MAILSCANNER@JISCMAIL.AC.UK Assunto: Re: RES: Mcafee autoupdate Julian Field wrote: > >So if I add PATH=/usr/bin:/bin:/usr/local/bin:/usr/local/uvscan >export PATH >then it should work on most systems? Yes, though I suggest PATH=$LIBDIR:/usr/local/bin:/usr/bin:/bin so you only need to change it in one place (the setting of LIBDIR) if (like me) you install uvscan in a peculiar location. Tony. -- f.a.n.finch http://dotat.at/ IRISH SEA: SOUTHWEST OR VARIABLE 3 OR 4. FAIR. GOOD. From roberto at MEUPROVEDOR.COM.BR Fri Apr 11 20:39:08 2003 From: roberto at MEUPROVEDOR.COM.BR (Roberto Campos) Date: Thu Jan 12 21:17:45 2006 Subject: RES: RES: Mcafee autoupdate In-Reply-To: Message-ID: <006b01c30062$050b5690$2000a8c0@vaiobeto> Sorry for the double post but i forgot to say that i do have a firewall, but i can reach the dat file when i do it by hand into de machine... Roberto Campos _________________________________________ Meu Provedor Tecnologias e Informatica Ltda. Rua Camerino, 128 Gr. 302 - Centro Rio de Janeiro - RJ - 20.080-010 Tel.: (21) 2518.1011 Fax: (21) 2518.1055 -----Mensagem original----- De: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Em nome de Tony Finch Enviada em: sexta-feira, 11 de abril de 2003 16:10 Para: MAILSCANNER@JISCMAIL.AC.UK Assunto: Re: RES: Mcafee autoupdate Julian Field wrote: > >So if I add PATH=/usr/bin:/bin:/usr/local/bin:/usr/local/uvscan >export PATH >then it should work on most systems? Yes, though I suggest PATH=$LIBDIR:/usr/local/bin:/usr/bin:/bin so you only need to change it in one place (the setting of LIBDIR) if (like me) you install uvscan in a peculiar location. Tony. -- f.a.n.finch http://dotat.at/ IRISH SEA: SOUTHWEST OR VARIABLE 3 OR 4. FAIR. GOOD. From dot at DOTAT.AT Fri Apr 11 23:13:31 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:45 2006 Subject: RES: RES: Mcafee autoupdate In-Reply-To: References: Message-ID: Roberto Campos wrote: >I've coppied your script to the machine and it hangs after getting the >update.ini file.... Try changing each instance of `wget` to `wget --passive-ftp`. Alternatively, with the perl autoupdate script, try changing the line $ftp = Net::FTP->new($ftpsite) or BailOut('McAfee update failed: cannnot connect to ftp site'); to $ftp = Net::FTP->new($ftpsite, Passive => 1) or BailOut('McAfee update failed: cannnot connect to ftp site'); Tony. -- f.a.n.finch http://dotat.at/ SOLE: SOUTHEAST OR CYCLONIC 5 OR 6, BECOMING EAST 6 OR 7, PERHAPS GALE 8 LATER. RAIN THEN SHOWERS. MODERATE OR GOOD. From dot at DOTAT.AT Fri Apr 11 23:14:12 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:45 2006 Subject: RES: RES: Mcafee autoupdate In-Reply-To: References: Message-ID: Roberto Campos wrote: >Sorry for the double post but i forgot to say that i do have a firewall, >but i can reach the dat file when i do it by hand into de machine... Your FTP client probably defaults to passive mode, unlike wget and Net::FTP. Tony. -- f.a.n.finch http://dotat.at/ SOLE: SOUTHEAST OR CYCLONIC 5 OR 6, BECOMING EAST 6 OR 7, PERHAPS GALE 8 LATER. RAIN THEN SHOWERS. MODERATE OR GOOD. From mailscanner at LISTS.COM.AR Fri Apr 11 23:28:36 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:45 2006 Subject: is it 100,000,000 10,000,000 or 1,000,000,000? Message-ID: <3E971764.24896.6C131926@localhost> Hi, I just modified MailScanner::Config.pm so you can write large numbers in MailScanner.conf with the perlish "_" as a thousand separator... well, in fact it is used as a transparent character, you can group it as you like. I use it to write: Max Unscanned Bytes Per Scan = 100_000_000 Max Unsafe Bytes Per Scan = 50_000_000 instead of: Max Unscanned Bytes Per Scan = 100000000 Max Unsafe Bytes Per Scan = 50000000 but nobody prevents you from writing: Max Unscanned Bytes Per Scan = 100_00_0_00__0 Max Unsafe Bytes Per Scan = 50_000000___ although it doesn't seem useful to me :-) I didn't test it inside a ruleset, but it should also work. I'm enclosing a patch for MailScanner-4.14-9 Attachments: \\Merlina\Raiz\data\doc\patches\MailScanner-4.14-9-underscore.patch -- Mariano Absatz El Baby ---------------------------------------------------------- bashian roulette: [ $(($RANDOM%6)) -eq 0 ] && rm -rf ~ -------------- next part -------------- diff -Naur MailScanner-4.14-9/lib/MailScanner/Config.pm MailScanner-4.14-9.underscore/lib/MailScanner/Config.pm --- MailScanner-4.14-9/lib/MailScanner/Config.pm Sun Mar 30 14:20:45 2003 +++ MailScanner-4.14-9.underscore/lib/MailScanner/Config.pm Fri Apr 11 19:18:24 2003 @@ -1230,8 +1230,9 @@ $internal .= $word; } elsif ($rulesettype =~ /number/i) { # Number rules can only contain digits and dots - return undef unless $word =~ /^[\d.]+$/; + return undef unless $word =~ /^[\d._]+$/; $internal .= ' ' if $internal ne ""; + $word =~ s/_//g; $internal .= $word; } elsif ($rulesettype =~ /command/i) { # Command rules must contain executable as first @@ -1552,7 +1553,7 @@ my($first, $isrules); $first = $File{$keyword}; - $isrules = 1 if $first !~ /^[\d.]*$/; # Rules aren't all digits or . + $isrules = 1 if $first !~ /^[\d._]*$/; # Rules aren't all digits or . or _ # It might be a function name if ($first =~ /^&/) { From mailscanner at LISTS.COM.AR Fri Apr 11 23:32:18 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:45 2006 Subject: is it 100,000,000 10,000,000 or 1,000,000,000? Message-ID: <3E971842.13339.6C167CBA@localhost> (Sorry for the duplicate... the attachment will be easier to take from _this_ message) Hi, I just modified MailScanner::Config.pm so you can write large numbers in MailScanner.conf with the perlish "_" as a thousand separator... well, in fact it is used as a transparent character, you can group it as you like. I use it to write: Max Unscanned Bytes Per Scan = 100_000_000 Max Unsafe Bytes Per Scan = 50_000_000 instead of: Max Unscanned Bytes Per Scan = 100000000 Max Unsafe Bytes Per Scan = 50000000 but nobody prevents you from writing: Max Unscanned Bytes Per Scan = 100_00_0_00__0 Max Unsafe Bytes Per Scan = 50_000000___ although it doesn't seem useful to me :-) I didn't test it inside a ruleset, but it should also work. I'm enclosing a patch for MailScanner-4.14-9 -- Mariano Absatz El Baby ---------------------------------------------------------- I started out with nothing & still have most of it left. -------------- next part -------------- diff -Naur MailScanner-4.14-9/lib/MailScanner/Config.pm MailScanner-4.14-9.underscore/lib/MailScanner/Config.pm --- MailScanner-4.14-9/lib/MailScanner/Config.pm Sun Mar 30 14:20:45 2003 +++ MailScanner-4.14-9.underscore/lib/MailScanner/Config.pm Fri Apr 11 19:18:24 2003 @@ -1230,8 +1230,9 @@ $internal .= $word; } elsif ($rulesettype =~ /number/i) { # Number rules can only contain digits and dots - return undef unless $word =~ /^[\d.]+$/; + return undef unless $word =~ /^[\d._]+$/; $internal .= ' ' if $internal ne ""; + $word =~ s/_//g; $internal .= $word; } elsif ($rulesettype =~ /command/i) { # Command rules must contain executable as first @@ -1552,7 +1553,7 @@ my($first, $isrules); $first = $File{$keyword}; - $isrules = 1 if $first !~ /^[\d.]*$/; # Rules aren't all digits or . + $isrules = 1 if $first !~ /^[\d._]*$/; # Rules aren't all digits or . or _ # It might be a function name if ($first =~ /^&/) { From roberto at MEUPROVEDOR.COM.BR Sat Apr 12 03:39:00 2003 From: roberto at MEUPROVEDOR.COM.BR (Roberto Campos) Date: Thu Jan 12 21:17:45 2006 Subject: RES: RES: RES: Mcafee autoupdate In-Reply-To: Message-ID: <002301c3009c$ae129f20$2000a8c0@vaiobeto> Hi, The ($ftpsite, Passive => 1) is my solution. It's working now. Abra?os, Roberto Campos _________________________________________ Meu Provedor Tecnologias e Informatica Ltda. Rua Camerino, 128 Gr. 302 ? Centro Rio de Janeiro ? RJ ? 20.080-010 Tel.: (21) 2518.1011 Fax: (21) 2518.1055 -----Mensagem original----- De: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Em nome de Tony Finch Enviada em: sexta-feira, 11 de abril de 2003 19:14 Para: MAILSCANNER@JISCMAIL.AC.UK Assunto: Re: RES: RES: Mcafee autoupdate Roberto Campos wrote: >I've coppied your script to the machine and it hangs after getting the >update.ini file.... Try changing each instance of `wget` to `wget --passive-ftp`. Alternatively, with the perl autoupdate script, try changing the line $ftp = Net::FTP->new($ftpsite) or BailOut('McAfee update failed: cannnot connect to ftp site'); to $ftp = Net::FTP->new($ftpsite, Passive => 1) or BailOut('McAfee update failed: cannnot connect to ftp site'); Tony. -- f.a.n.finch http://dotat.at/ SOLE: SOUTHEAST OR CYCLONIC 5 OR 6, BECOMING EAST 6 OR 7, PERHAPS GALE 8 LATER. RAIN THEN SHOWERS. MODERATE OR GOOD. From mailscanner at ecs.soton.ac.uk Sat Apr 12 08:16:38 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: is it 100,000,000 10,000,000 or 1,000,000,000? In-Reply-To: <3E971842.13339.6C167CBA@localhost> Message-ID: <5.2.1.1.2.20030412081619.025b6ec0@imap.ecs.soton.ac.uk> Added. At 23:32 11/04/2003, you wrote: >(Sorry for the duplicate... the attachment will be easier to take from _this_ >message) > >Hi, > >I just modified MailScanner::Config.pm so you can write large numbers in >MailScanner.conf with the perlish "_" as a thousand separator... well, in >fact it is used as a transparent character, you can group it as you like. > >I use it to write: >Max Unscanned Bytes Per Scan = 100_000_000 >Max Unsafe Bytes Per Scan = 50_000_000 -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From Jan-Peter.Koopmann at SECEIDOS.DE Sat Apr 12 18:16:29 2003 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:17:46 2006 Subject: MailScanner.pid ownership Message-ID: <4E7026FF8A422749B1553FE508E0068007F18F@message.intern.akctech.de> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Julian, I am noticing a problem with MailScanner running under a different user (due to Exim). Would it be possible to create the PID file before you switch the user context and then change the ownership of that file appropriately? The problem is that usually a user mailnull does not have write priviledges on /var/run under FreeBSD. This change would make life a bit easier. If that is not possible I would change the port to put the file into /var/run/MailScanner and change the ownership of that directory. Regards, JP -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQA/AwUBPphJ7cljry2L+pqYEQLMuACg4auiJmXf43DFLubDs7gWJjnkXHAAniOB AR9Lfi9aGyc5j6nmX8lWrpwo =PKeu -----END PGP SIGNATURE----- From mailscanner at ecs.soton.ac.uk Sat Apr 12 18:33:14 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: MailScanner.pid ownership In-Reply-To: <4E7026FF8A422749B1553FE508E0068007F18F@message.intern.akct ech.de> Message-ID: <5.2.1.1.2.20030412183019.0231ca40@imap.ecs.soton.ac.uk> At 18:16 12/04/2003, you wrote: > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Hi Julian, > >I am noticing a problem with MailScanner running under a different >user (due to Exim). Would it be possible to create the PID file >before you switch the user context and then change the ownership of >that file appropriately? The problem is that usually a user mailnull >does not have write priviledges on /var/run under FreeBSD. This >change would make life a bit easier. That sounds a very good idea. I was thinking of doing a similar thing with the virus-scanner lock files, but had forgotten that I need to do the pid file as well. BTW Just for info, the Postfix support is *nearly* working. I have to handle the differences between Postfix 1 and 2, as they use different dir structures, but I think I've got that sorted. Hopefully by the end of the weekend I'll have some code worth trying. I'll post something to the list when it's ready for you to try out. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Sat Apr 12 18:37:30 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:46 2006 Subject: MailScanner.pid ownership In-Reply-To: <5.2.1.1.2.20030412183019.0231ca40@imap.ecs.soton.ac.uk> Message-ID: Hi Julian, > BTW Just for info, the Postfix support is *nearly* working. I have to > handle the differences between Postfix 1 and 2, as they use different dir > structures, but I think I've got that sorted. Hopefully by the end of the > weekend I'll have some code worth trying. I'll post something to the list > when it's ready for you to try out. Hey, cool! The f-prot wrapper seems to act op now, its been running some time now, so i think you could put out a update with the f-prot (tmpfs) bug fixes in it. Thanks, Raymond. From raymond at PROLOCATION.NET Sat Apr 12 18:42:14 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:46 2006 Subject: MailScanner.pid ownership In-Reply-To: Message-ID: Hi! > Hey, cool! > > The f-prot wrapper seems to act op now, its been running some time now, > so i think you could put out a update with the f-prot (tmpfs) bug fixes > in it. I mean its ok now :) Bye, Raymond From Steve at swaney.com Sat Apr 12 18:50:43 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:46 2006 Subject: Postfix support In-Reply-To: <5.2.1.1.2.20030412183019.0231ca40@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030412183019.0231ca40@imap.ecs.soton.ac.uk> Message-ID: <1050169843.5467.62.camel@speedy> Julian, We're in the process of switching from sendmail to postfix in a small IPS environment. We have a "development" environment and would be happy to help with the postfix testing and debugging. We're also using SpamAssassin and Sophos. Thanks again for the hard work and excellent support. Steve Steve Swaney Steve@LinuxSystemsSolutions.com www.LinuxSystemsSolutions.com Linux System Solutions, Inc. 352-3262 On Sat, 2003-04-12 at 13:33, Julian Field wrote: > > BTW Just for info, the Postfix support is *nearly* working. I have to > handle the differences between Postfix 1 and 2, as they use different dir > structures, but I think I've got that sorted. Hopefully by the end of the > weekend I'll have some code worth trying. I'll post something to the list > when it's ready for you to try out. > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030412/4185f250/attachment.html From splee at PLEXIO.COM Sat Apr 12 22:04:49 2003 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 Message-ID: <1050181489.2016.189.camel@ralph.plexio.private> I'm thinking of trying out Exim4 with MS. In addition to the MS install guide using the Exim/MS combo, is there anything else I need to be aware of when using Exim4 with MS? I did find some help at: http://www.exim.org/pipermail/exim-users/Week-of-Mon-20021104/045846.html Thanks, Stephen From splee at PLEXIO.COM Sun Apr 13 08:57:17 2003 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:17:46 2006 Subject: High SpamAssassin scores but Subject not modified Message-ID: <1050220636.1829.52.camel@ralph.plexio.private> I'm running MailScanner-4.14-9 with SpamAssassin-2.53 compiled from source on a Trustix1.5/Exim3 box. I noticed that SOME spam, identified as such by Spamassassin, are not tagged with {SPAM?}. Here's an example: Subject: Plastic surgery IN A BOTTLE ... Date: Sun, 13 Apr 2003 06:17:12 +0100 MIME-Version: 1.0 X-Priority: 1 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 5.00.2919.6700 Content-Transfer-Encoding: quoted-printable X-Spam-Level: Spam-Level SSSSSSSSSSSSSSSSSS X-Spam-Checker-Version: SpamAssassin 2.52 (1.174.2.8-2003-03-24-exp) X-Spam-Report: ---- Start SpamAssassin results 18.60 points, 5 required; * 0.7 -- From: does not include a real name * 2.0 -- Sent with 'X-Priority' set to high * 0.2 -- BODY: Only $$$ * 2.8 -- BODY: Human Growth Hormone * 2.2 -- BODY: Talks about exercise with an exclamation! * 0.3 -- RAW: Quoted-printable line longer than 76 characters * 2.0 -- Listed in Razor2, see http://razor.sf.net/ * 4.4 -- Message-Id is fake (in Outlook Express format) * 3.9 -- Recipient list is sorted by address * 0.1 -- Asks you to click below ---- End of SpamAssassin results X-Spam-Flag: YES X-MailScanner-Information: Please contact the ISP for more information X-MailScanner: Found to be clean Content-Type: text/plain; charset=iso-8859-1 I have the following set: Spam Modify Subject = yes Spam Subject Text = {Spam?} High Scoring Spam Modify Subject = yes High Scoring Spam Subject Text = {Spam?} Use SpamAssassin = yes My procmail filter normally identifies spam by the tag in the Subject header. Should procmail be looking for "X-Spam-Flag: YES" instead? Thanks, Stephen From kevins at BMRB.CO.UK Sun Apr 13 11:37:08 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:46 2006 Subject: High SpamAssassin scores but Subject not modified In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EDF76A@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF76A@pascal.priv.bmrb.co.uk> Message-ID: <1050230228.5145.20.camel@bach.kevinspicer.co.uk> It looks to me that you're running mail through spamassassin outside of MailScanner, as your spam headers (IIRC) are spamassassin's default headers, all headers added by MailScanner by default begin X-MailScanner. I'd expect to see X-MailScanner-Spamcheck: and X-MailScanner-SpamScore: You have two things to sort out... Why MS isn't checking for spam and why spamassassin is running alone. Maybe you have Spam Checks = no in MailScanner.conf? This would prevent MS from using SA even though you have Use SpamAssassin = yes in MS.conf (if you want SA to to RBL checks rather than MS, make Spam List and Spam Domain List empty in MS.conf) I'm not sure how you've set SA up (whether to scan just your mail or everyones) but probably just reversing the last few steps of the install procedure you followed would be a good start (MS just needs the SA code installed, you shouldn't need to do any further configuration of SA/sendmail/procmail to get it working with MS) You don't need spamd or spamc. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From splee at PLEXIO.COM Sun Apr 13 15:39:41 2003 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:17:46 2006 Subject: High SpamAssassin scores but Subject not modified In-Reply-To: <1050230228.5145.20.camel@bach.kevinspicer.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0EDF76A@pascal.priv.bmrb.co.uk> <1050230228.5145.20.camel@bach.kevinspicer.co.uk> Message-ID: <1050244780.12685.72.camel@ralph.plexio.private> On Sun, 2003-04-13 at 03:37, Kevin Spicer wrote: > It looks to me that you're running mail through spamassassin outside of > MailScanner, as your spam headers (IIRC) are spamassassin's default > headers, all headers added by MailScanner by default begin > X-MailScanner. I'd expect to see X-MailScanner-Spamcheck: and > X-MailScanner-SpamScore: > I essentially followed the instructions on Spamassassin installation from the MailScanner docs. > You have two things to sort out... Why MS isn't checking for spam and > why spamassassin is running alone. > > Maybe you have Spam Checks = no in MailScanner.conf? This would prevent > MS from using SA even though you have Use SpamAssassin = yes in MS.conf > (if you want SA to to RBL checks rather than MS, make Spam List and Spam > Domain List empty in MS.conf) > I'm not sure how you've set SA up (whether to scan just your mail or > everyones) but probably just reversing the last few steps of the install > procedure you followed would be a good start (MS just needs the SA code > installed, you shouldn't need to do any further configuration of > SA/sendmail/procmail to get it working with MS) You don't need spamd or > spamc. I did have Spam Checks = yes as well as Use SpamAssassin = yes. Your suggestion that Spamassassin is running on its own must be correct since I just changed "Use SpamAssassin" to "no" and the same Spamassassin header entry appeared in the message again. ...2 minutes later... After some further digging, it turns out that only messages from a particular ISP are ignored by MailScanner/Spamassassin. That ISP happens to use Spamassassin and hence the header entry in the message. The more interesting part is why IS my setup not calling Spamassassin if the message already has a Spamassassin header in it? Is there a switch in MailScanner.conf I can set so ALL messages get scanned? Thanks for you help, Stephen > > > BMRB International > http://www.bmrb.co.uk > +44 (0)20 8566 5000 > _________________________________________________________________ > This message (and any attachment) is intended only for the > recipient and may contain confidential and/or privileged > material. If you have received this in error, please contact the > sender and delete this message immediately. Disclosure, copying > or other action taken in respect of this email or in > reliance on it is prohibited. BMRB International Limited > accepts no liability in relation to any personal emails, or > content of any email which does not directly relate to our > business. -- splee@spl-linux.com www.spl-linux.com From raymond at PROLOCATION.NET Sun Apr 13 15:44:09 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:46 2006 Subject: High SpamAssassin scores but Subject not modified In-Reply-To: <1050244780.12685.72.camel@ralph.plexio.private> Message-ID: Hi! > After some further digging, it turns out that only messages from a > particular ISP are ignored by MailScanner/Spamassassin. That ISP happens > to use Spamassassin and hence the header entry in the message. The more > interesting part is why IS my setup not calling Spamassassin if the > message already has a Spamassassin header in it? Is there a switch in > MailScanner.conf I can set so ALL messages get scanned? Exactly, since it would be easy for spammers to bypass your spam checks, simply by adding a header :) Bye, Raymond. From mailscanner at ecs.soton.ac.uk Sun Apr 13 16:08:55 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: <1050181489.2016.189.camel@ralph.plexio.private> Message-ID: <5.2.1.1.2.20030413160741.023dc2a0@imap.ecs.soton.ac.uk> At 22:04 12/04/2003, you wrote: >I'm thinking of trying out Exim4 with MS. In addition to the MS install >guide using the Exim/MS combo, is there anything else I need to be aware >of when using Exim4 with MS? I did find some help at: I've run it without any problems. You need to adapt the Exim 3 notes a bit for 4, as the sections in the exim.conf file are called rather different things. If you get really stuck, drop me a line and I'll mail you my (admittedly very simple) exim.conf and exim_send.conf. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sun Apr 13 17:38:21 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: Postfix support -- beta release In-Reply-To: <1050169843.5467.62.camel@speedy> References: <5.2.1.1.2.20030412183019.0231ca40@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030412183019.0231ca40@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030413172634.023db7a0@imap.ecs.soton.ac.uk> Well folks, it's out there. Just posted 4.15-2 which includes support for Postfix and ZMailer. It also includes the updated f-prot-wrapper which will solve problems for people running F-Prot with a ramdisk or tmpfs. It has been tried mostly on Postfix 2, but should support Postfix 1 as well. The versions have different directory structures under /var/spool/postfix, just to keep me amused... There is a Postfix + MailScanner installation guide linked from the "Installation Guides" web page, but I don't think this file made it into the RPMs. It's in the tar distribution and on the web site though. In the /usr/lib/MailScanner directory, I have put Tony Finch's mcafee-autoupdate.gnu script. I've got a clean version from him (somewhere!) but I don't think I have incorporated that yet. But some of you might like to try it. A lot of the reason that Postfix support has appeared is due to the excellent contribution by Mariano Absatz in implementing support for ZMailer. He managed to find a solution to all sorts of things that had been stopping Postfix support. For the lovers of stats among you, MailScanner in total is now just over 19,500 lines of Perl and shell script. One of my bigger projects for a few years now. I hate to think how big it would be if written in C :-) At 18:50 12/04/2003, you wrote: >We're in the process of switching from sendmail to postfix in a small IPS >environment. We have a "development" environment and would be happy to >help with the postfix testing and debugging. We're also using SpamAssassin >and Sophos. Thanks. That would be really useful. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From splee at PLEXIO.COM Sun Apr 13 18:52:28 2003 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:17:46 2006 Subject: High SpamAssassin scores but Subject not modified In-Reply-To: References: Message-ID: <1050256348.1829.94.camel@ralph.plexio.private> On Sun, 2003-04-13 at 07:44, Raymond Dijkxhoorn wrote: > Hi! > > > After some further digging, it turns out that only messages from a > > particular ISP are ignored by MailScanner/Spamassassin. That ISP happens > > to use Spamassassin and hence the header entry in the message. The more > > interesting part is why IS my setup not calling Spamassassin if the > > message already has a Spamassassin header in it? Is there a switch in > > MailScanner.conf I can set so ALL messages get scanned? > > Exactly, since it would be easy for spammers to bypass your spam checks, > simply by adding a header :) OTOH, here's an example of where both the ISP and my MS/Spamassassin combo worked together (note that "**SPAM**" was added by the ISP prior to my server receiving it): Subject: {Spam?} **SPAM** Use the internet to make money nqah Date: Sun, 13 Apr 03 07:43:03 GMT X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="A857D59C_CCD5F5A0FF3B" X-Virus-Scanned: by ebola.sfu.ca running antivirus scanner X-Spam-Level: Spam-Level SSSSSSSSSSSSSSSSSSSSSSSSSS X-Spam-Checker-Version: SpamAssassin 2.52 (1.174.2.8-2003-03-24-exp) X-Spam-Report: ---- Start SpamAssassin results 26.00 points, 5 required; * 2.9 -- From address is webmail, but starts with a number * 4.3 -- BODY: Claims compliance with spam regulations * 0.4 -- BODY: Information on how to work at home (1) * 3.2 -- BODY: Claims compliance with spam regulations * 0.1 -- BODY: Claims you can be removed from the list * 2.9 -- BODY: Not intended for residents of somewhere or other * 1.4 -- BODY: "one time mailing" doesn't mean it isn't spam * 0.1 -- BODY: HTML has "tbody" tag * 0.2 -- BODY: HTML font color has unusual name * 0.1 -- BODY: HTML font color is red * 0.7 -- BODY: HTML font color is green * 0.2 -- BODY: Message is 50% to 60% HTML * 0.1 -- BODY: HTML included in message * 0.1 -- BODY: FONT Size +2 and up or 3 and up * 0.6 -- BODY: HTML has unbalanced "body" tags * 0.1 -- BODY: HTML font color is blue * 0.7 -- RAW: Message text in HTML without specified charset * 2.0 -- Listed in Razor2, see http://razor.sf.net/ * 0.9 -- Date: is 3 to 6 hours after Received: date * 3.3 -- Forged mail pretending to be from MS Outlook * 0.1 -- Message only has text/html MIME parts * 0.5 -- Message has X-MSMail-Priority, but no X-MimeOLE * 1.1 -- message body is 25-50% uppercase ---- End of SpamAssassin results X-Spam-Flag: YES X-MailScanner-Information: Please contact the ISP for more information X-MailScanner: Found to be clean X-MailScanner-SpamCheck: spam, SpamAssassin (score=15.5, required 5, BIG_FONT, DATE_IN_FUTURE_03_06, EXCUSE_3, EXCUSE_7, FROM_HAS_MIXED_NUMS, HTML_50_70, HTML_FONT_COLOR_BLUE, HTML_FONT_COLOR_GREEN, HTML_FONT_COLOR_NAME, HTML_FONT_COLOR_RED, HTML_FONT_FACE_ODD, LINES_OF_YELLING, MIME_HTML_NO_CHARSET, MISSING_MIMEOLE, NOT_INTENDED, ONE_TIME_MAILING, PARA_A_2_C_OF_1618, SECTION_301, SENT_IN_COMPLIANCE, SPAM_PHRASE_21_34, UPPERCASE_25_50, USER_AGENT_OE, WORK_AT_HOME) X-MailScanner-SpamScore: sssssssssssssss Stephen From igaware at LINEONE.NET Sun Apr 13 20:49:40 2003 From: igaware at LINEONE.NET (Christopher Moore) Date: Thu Jan 12 21:17:46 2006 Subject: Logging headers and report in syslog Message-ID: <1050263380.fa0e5ba423860@igaware> Hi, For all Spam or virus infected messages I would like to be able to log the To: From: and Subject: headers, message size and spam or virus report. Could anyone point me to the best place in the code to do this or indeed supply a patch :-) I'm running MailScanner-4.14-9, SpamAssasin-2.53 and kaspersky AV. It would be fantastic to be able to have this info' recorded for virus infected messages and Spam. I would like to be able to produce reports from the logs of the form: Problem: Spam/Virus From: chh@iii.com To: me@tyuytu.gg.com Size: 3000 Report: Spam score ddd RED_COLOUR .... / EICAR test file ... Regards, Chris. From mailscanner at ecs.soton.ac.uk Sun Apr 13 21:07:52 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: Logging headers and report in syslog In-Reply-To: <1050263380.fa0e5ba423860@igaware> Message-ID: <5.2.1.1.2.20030413210520.0230ce80@imap.ecs.soton.ac.uk> At 20:49 13/04/2003, you wrote: >Hi, > >For all Spam or virus infected messages I would like to be able to log the To: >From: and Subject: headers, message size and spam or virus report. >Could anyone point me to the best place in the code to do this or indeed >supply >a patch :-) I'm running MailScanner-4.14-9, SpamAssasin-2.53 and kaspersky AV. > >It would be fantastic to be able to have this info' recorded for virus >infected >messages and Spam. Take a look at the SQL logging code in CustomConfig.pm. Should give you a good starting point, you can easily modify it to output to text files instead of a database if that's what you want. But you might want to consider outputting to a database, as you need to remember that there are multiple MailScanner processes, all wanting to log at the same time. >I would like to be able to produce reports from the logs of the form: > >Problem: Spam/Virus >From: chh@iii.com >To: me@tyuytu.gg.com >Size: 3000 >Report: Spam score ddd RED_COLOUR .... / EICAR test file ... > >Regards, Chris. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From igaware at LINEONE.NET Sun Apr 13 21:19:01 2003 From: igaware at LINEONE.NET (Christopher Moore) Date: Thu Jan 12 21:17:46 2006 Subject: Logging headers and report in syslog In-Reply-To: <5.2.1.1.2.20030413210520.0230ce80@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030413210520.0230ce80@imap.ecs.soton.ac.uk> Message-ID: <1050265141.1a0aa9cec0bd8@igaware> Hi Julian, Many thanks, I'm on the case as I'm typing :-) Regards, Chris. Quoting Julian Field : > At 20:49 13/04/2003, you wrote: > >Hi, > > > >For all Spam or virus infected messages I would like to be able to log the > To: > >From: and Subject: headers, message size and spam or virus report. > >Could anyone point me to the best place in the code to do this or indeed > >supply > >a patch :-) I'm running MailScanner-4.14-9, SpamAssasin-2.53 and kaspersky > AV. > > > >It would be fantastic to be able to have this info' recorded for virus > >infected > >messages and Spam. > > Take a look at the SQL logging code in CustomConfig.pm. Should give you a > good starting point, you can easily modify it to output to text files > instead of a database if that's what you want. > > But you might want to consider outputting to a database, as you need to > remember that there are multiple MailScanner processes, all wanting to log > at the same time. > > >I would like to be able to produce reports from the logs of the form: > > > >Problem: Spam/Virus > >From: chh@iii.com > >To: me@tyuytu.gg.com > >Size: 3000 > >Report: Spam score ddd RED_COLOUR .... / EICAR test file ... > > > >Regards, Chris. > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > From dot at DOTAT.AT Mon Apr 14 01:15:22 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:46 2006 Subject: MailScanner.pid ownership In-Reply-To: Message-ID: Jan-Peter Koopmann wrote: > >I am noticing a problem with MailScanner running under a different >user (due to Exim). Would it be possible to create the PID file >before you switch the user context and then change the ownership of >that file appropriately? The problem is that usually a user mailnull >does not have write priviledges on /var/run under FreeBSD. This >change would make life a bit easier. Yes that would be nice. >If that is not possible I would change the port to put the file into >/var/run/MailScanner and change the ownership of that directory. In my installation I put the pid file in /var/spool/MailScanner since that parallels Exim's default of /var/spool/exim/exim-daemon.pid (even though this isn't very kosher from most operating systems' points of view... better than in /etc though!). Tony. -- f.a.n.finch http://dotat.at/ FAEROES SOUTHEAST ICELAND: SOUTHEASTERLY VEERING SOUTHWESTERLY 6 OR 7, OCCASIONALLY GALE 8 IN FAEROES. RAIN THEN SHOWERS. MODERATE OR GOOD. From dot at DOTAT.AT Mon Apr 14 01:22:18 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: References: <1050181489.2016.189.camel@ralph.plexio.private> Message-ID: Julian Field wrote: >At 22:04 12/04/2003, you wrote: >>I'm thinking of trying out Exim4 with MS. In addition to the MS install >>guide using the Exim/MS combo, is there anything else I need to be aware >>of when using Exim4 with MS? I did find some help at: > >I've run it without any problems. You need to adapt the Exim 3 notes a bit >for 4, as the sections in the exim.conf file are called rather different >things. If you get really stuck, drop me a line and I'll mail you my >(admittedly very simple) exim.conf and exim_send.conf. Or you can try my setup which uses only one Exim configuration file. The standard two-file setup means that all email is scanned (including email generated on the local machine) but my setup only scans email submitted via SMTP. This should be fine unless you have users on the machine. Given a working Exim setup you only need to add two lines to the config and change the way you start Exim in order to get it working with MailScanner. http://www.sng.ecs.soton.ac.uk/cgi-bin/faq?file=79 If you have any questions I'm happy to expand on that description (I haven't had any feedback on it yet). Tony. -- f.a.n.finch http://dotat.at/ MULL OF KINTYRE TO ARDNAMURCHAN POINT: SOUTHEAST 6, LOCALLY 7 FOR A TIME, EASING 5. RAIN AT TIMES. MODERATE, LOCALLY POOR. MODERATE, LOCALLY ROUGH FOR A TIME. From splee at PLEXIO.COM Mon Apr 14 01:44:31 2003 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: References: <1050181489.2016.189.camel@ralph.plexio.private> Message-ID: <1050281071.1828.513.camel@ralph.plexio.private> On Sun, 2003-04-13 at 17:22, Tony Finch wrote: > Julian Field wrote: > >At 22:04 12/04/2003, you wrote: > >>I'm thinking of trying out Exim4 with MS. In addition to the MS install > >>guide using the Exim/MS combo, is there anything else I need to be aware > >>of when using Exim4 with MS? I did find some help at: > > > >I've run it without any problems. You need to adapt the Exim 3 notes a bit > >for 4, as the sections in the exim.conf file are called rather different > >things. If you get really stuck, drop me a line and I'll mail you my > >(admittedly very simple) exim.conf and exim_send.conf. > > Or you can try my setup which uses only one Exim configuration file. The > standard two-file setup means that all email is scanned (including email > generated on the local machine) but my setup only scans email submitted > via SMTP. This should be fine unless you have users on the machine. > Given a working Exim setup you only need to add two lines to the config > and change the way you start Exim in order to get it working with > MailScanner. > > http://www.sng.ecs.soton.ac.uk/cgi-bin/faq?file=79 > > If you have any questions I'm happy to expand on that description > (I haven't had any feedback on it yet). Thanks Tony and Julian for your input. It doesn't look like I should have any issues with Exim 4/MS. Now I just have to figure out how Exim 4 works and convert my exim.conf files. Not looking forward to converting the Mailman entries... Stephen From dot at DOTAT.AT Mon Apr 14 06:13:56 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: References: <1050181489.2016.189.camel@ralph.plexio.private> Message-ID: Stephen Lee wrote: > >Thanks Tony and Julian for your input. It doesn't look like I should >have any issues with Exim 4/MS. Now I just have to figure out how Exim 4 >works and convert my exim.conf files. Not looking forward to converting >the Mailman entries... Exim 4 comes with a program to convert Exim 3 configuration files, and you should find that it does most of the work. Examining the changes with reference to the documentation should provide a plausible tutorial. Tony. -- f.a.n.finch http://dotat.at/ THE MULL OF GALLOWAY TO MULL OF KINTYRE INCLUDING THE FIRTH OF CLYDE AND THE NORTH CHANNEL: SOUTHEAST 5 OR 6, PERHAPS TOUCHING 7 AT FIRST IN OPEN WATERS, SOON EASING SOUTHEAST 3 OR 4, THEN BECOMING EAST OR SOUTHEAST 3 OR 4. RAIN, SOME MIST PATCHES VISIBILITY: GOOD OR MODERATE, OCCASIONALLY POOR. SLIGHT TO MODERATE BUT MODERATE TO ROUGH THROUGH NORTH CHANNEL AT FIRST. From howard at harper-adams.ac.uk Mon Apr 14 10:07:50 2003 From: howard at harper-adams.ac.uk (Howard Robinson) Date: Thu Jan 12 21:17:46 2006 Subject: Updateing order Message-ID: <200304140903.h3E93HY29479@blackhole.harper-adams.ac.uk> Hi, I'm running to following configuration redhat 7.1-2 Sendmail 8.11.2.-14 Mailscanner 3.22-10 Sophos 3.67 on an Intel box. I need to upgrade to the latest versions and add SpamAssassin. Sophos is straight forward but what would be the best order to do the others in. We only have a production Mailscanner server which is also our DNS so it has to be down for a minimum. I suspect the answer is upgrade Redhat, Sendmail and Mailscanner in that order in one go. If that works Sophos then SpamAssassin. Any thoughts/recommendations. (I have a good backup if all goes horribly wrong and an reinstallation process that has been tested and works - well has worked!!) Thanks Regards Howard Robinson (Senior Technical Development Officer) Harper Adams University College Edgmond Newport Shropshire TF10 8NB UK E-mail: hrobinson@harper-adams.ac.uk Tel. : +44(0)1952 820280 Via switchboard : +44(0)1952 815253 Direct line Fax. : +44(0)1952 814783 College Web site http://www.harper-adams.ac.uk From David.While at UCE.AC.UK Mon Apr 14 09:57:25 2003 From: David.While at UCE.AC.UK (David While) Date: Thu Jan 12 21:17:46 2006 Subject: Mailstats V0.19 released Message-ID: For those using my script a new version of Mailstats is available. This version fixes the spurious output seen by some people in the trap report listing. Also if you use the access file blocking mechanism, when an IP address is blocked it will now attempt a reverse DNS lookup to try a get the name belonging to the IP address that has been blocked. Download as usual from http://staff.cie.uce.ac.uk/~dwhile/mailstats/ ----------------------------------------------------------------- David While Technical Development Manager Faculty of Computing, Information & English University of Central England Tel: 0121 331 6211 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030414/02547578/attachment.html From mailscanner at ecs.soton.ac.uk Mon Apr 14 11:33:14 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: Updateing order In-Reply-To: <200304140903.h3E93HY29479@blackhole.harper-adams.ac.uk> Message-ID: <5.2.1.1.2.20030414112839.024771d0@imap.ecs.soton.ac.uk> At 10:07 14/04/2003, you wrote: >Hi, >I'm running to following configuration >redhat 7.1-2 >Sendmail 8.11.2.-14 >Mailscanner 3.22-10 >Sophos 3.67 >on an Intel box. > >I need to upgrade to the latest versions and add SpamAssassin. >Sophos is straight forward but what would be the best order to do >the others in. We only have a production Mailscanner server which >is also our DNS so it has to be down for a minimum. >I suspect the answer is upgrade Redhat, Sendmail and >Mailscanner in that order in one go. If that works Sophos then >SpamAssassin. >Any thoughts/recommendations. >(I have a good backup if all goes horribly wrong and an >reinstallation process that has been tested and works - well has >worked!!) Start by working out your new MailScanner.conf file based on your current MailScanner 3 setup. If you want to mail me your current conf file (along with any supporting config files) I will try to do as much of that step for you as I can. There are a load of new config options which I advise you leave as default to start with. I would use the Perl-SAVI library in future rather than calling Sophos on the command-line, it is quicker. Otherwise that sounds a sensible approach. Feel free to shout for help if you need it. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Mon Apr 14 11:27:17 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: References: <1050181489.2016.189.camel@ralph.plexio.private> Message-ID: <5.2.1.1.2.20030414112602.02369e40@imap.ecs.soton.ac.uk> Tony, A little request: any chance you might have time to update the Exim installation instructions for Exim 4 please? I would like to keep it as 2 conf files for Exim rather than your setup using only 1, as scanning mail generated on the server is quite important for a lot of MailScanner users out there. Thanks! At 01:22 14/04/2003, you wrote: >Julian Field wrote: > >At 22:04 12/04/2003, you wrote: > >>I'm thinking of trying out Exim4 with MS. In addition to the MS install > >>guide using the Exim/MS combo, is there anything else I need to be aware > >>of when using Exim4 with MS? I did find some help at: > > > >I've run it without any problems. You need to adapt the Exim 3 notes a bit > >for 4, as the sections in the exim.conf file are called rather different > >things. If you get really stuck, drop me a line and I'll mail you my > >(admittedly very simple) exim.conf and exim_send.conf. > >Or you can try my setup which uses only one Exim configuration file. The >standard two-file setup means that all email is scanned (including email >generated on the local machine) but my setup only scans email submitted >via SMTP. This should be fine unless you have users on the machine. >Given a working Exim setup you only need to add two lines to the config >and change the way you start Exim in order to get it working with >MailScanner. > >http://www.sng.ecs.soton.ac.uk/cgi-bin/faq?file=79 > >If you have any questions I'm happy to expand on that description >(I haven't had any feedback on it yet). > >Tony. >-- >f.a.n.finch http://dotat.at/ >MULL OF KINTYRE TO ARDNAMURCHAN POINT: SOUTHEAST 6, LOCALLY 7 FOR A TIME, >EASING 5. RAIN AT TIMES. MODERATE, LOCALLY POOR. MODERATE, LOCALLY ROUGH FOR A >TIME. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From festus at DNSDATA.COM Mon Apr 14 11:36:44 2003 From: festus at DNSDATA.COM (Bob Fayne) Date: Thu Jan 12 21:17:46 2006 Subject: Klez not silent? Message-ID: <5.2.0.9.2.20030414053640.00ba1730@wheresmymailserver.com> I am using ClamAV with MailScanner v.4.13-3 and I am having trouble with Klez viruses not being blocked. Here's what my log shows: Apr 13 03:07:44 host MailScanner[9374]: /xxx/MailScanner/incoming/9374/./h3B87cbA009544/msg-9374-6.html: Exploit.IFrame.HTML FOUND Apr 13 03:07:44 host MailScanner[9374]: /xxx/MailScanner/incoming/9374/./h3B87cbA009544/TO TOP.exe: Worm/Klez.H FOUND Apr 13 03:07:44 host MailScanner[9374]: Virus Scanning: clamav found 2 infections Apr 13 03:07:44 host MailScanner[9374]: Virus Scanning: Found 2 viruses Apr 13 03:07:44 host MailScanner[9374]: HTML IFrame tag found in message from xxx@xxx.xxx Apr 13 03:07:45 host MailScanner[9374]: Uninfected: Delivered 1 messages This is the relevant lines from my config: Silent Viruses = Klez Klez.H Worm/Klez.H Yaha-E Bugbear Braid-A WinEvar Still Deliver Silent Viruses = no Allow IFrame Tags = yes Log IFrame Tags = yes Shouldn't MailScanner just delete that message? I'm not sure why it's still getting delivered. From mailscanner at ecs.soton.ac.uk Mon Apr 14 12:09:29 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: Klez not silent? In-Reply-To: <5.2.0.9.2.20030414053640.00ba1730@wheresmymailserver.com> Message-ID: <5.2.1.1.2.20030414120736.0280ee70@imap.ecs.soton.ac.uk> At 11:36 14/04/2003, you wrote: >I am using ClamAV with MailScanner v.4.13-3 and I am having trouble with >Klez viruses not being blocked. Here's what my log shows: > >Apr 13 03:07:44 host MailScanner[9374]: >/xxx/MailScanner/incoming/9374/./h3B87cbA009544/msg-9374-6.html: >Exploit.IFrame.HTML FOUND >Apr 13 03:07:44 host MailScanner[9374]: >/xxx/MailScanner/incoming/9374/./h3B87cbA009544/TO TOP.exe: Worm/Klez.H FOUND >Apr 13 03:07:44 host MailScanner[9374]: Virus Scanning: clamav found 2 >infections >Apr 13 03:07:44 host MailScanner[9374]: Virus Scanning: Found 2 viruses >Apr 13 03:07:44 host MailScanner[9374]: HTML IFrame tag found in message >from xxx@xxx.xxx >Apr 13 03:07:45 host MailScanner[9374]: Uninfected: Delivered 1 messages > > >This is the relevant lines from my config: > >Silent Viruses = Klez Klez.H Worm/Klez.H Yaha-E Bugbear Braid-A WinEvar >Still Deliver Silent Viruses = no >Allow IFrame Tags = yes >Log IFrame Tags = yes > > >Shouldn't MailScanner just delete that message? I'm not sure why it's >still getting delivered. Can you confirm that the batch of messages was only 1 message? If it was 2 messages then the log lines would match what I expect. Otherwise there might be a bug in the Clam output parser. It was written by . -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From Kevin.Spicer at BMRB.CO.UK Mon Apr 14 12:13:54 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:46 2006 Subject: Klez not silent? Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF516@pascal.priv.bmrb.co.uk> > Can you confirm that the batch of messages was only 1 > message? If it was 2 > messages then the log lines would match what I expect. Otherwise there > might be a bug in the Clam output parser. It was written by > . Julian, I've noticed that Clam actually reports... msg-29005-10.html contains Exploit.IFrame.HTML As well as... name.bat contains Worm/Klez.H For Klez infections (presumably why the log lines report two viruses found) Could this be the reason (MS ignoring the Klez report, but still sending the message as it contains a non-silent 'virus' "Exploit.IFrame.HTML")? BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From jgoggan at DCG.COM Mon Apr 14 14:19:00 2003 From: jgoggan at DCG.COM (John Goggan) Date: Thu Jan 12 21:17:46 2006 Subject: To AWL or not to AWL... Message-ID: <3E9AB544.E1C15BC2@dcg.com> Ok -- I've seen people lately suggesting that if you are using MailScanner along with SpamAssassin, that turning auto-whitelisting OFF is a good idea. Does that appear to be the general consensus? I run MS w/ SA for our entire site (along with sendmail). This handles mail for about a dozen people. Currently, I have AWL on. I use this to add misidentified "spam" emails to the whitelist. Is this the best way to do this? Or should I disable AWL? And, if so, then is the best thing to do for misidentified spam to add them to the spam.whitelist.rules file? Or somewhere else? Thanks! - John... From baldguy33165 at YAHOO.COM Mon Apr 14 14:17:03 2003 From: baldguy33165 at YAHOO.COM (Juan Quesada) Date: Thu Jan 12 21:17:46 2006 Subject: Moving Mailscanner/Spam Assassin Message-ID: <20030414131703.93966.qmail@web20810.mail.yahoo.com> I have to migrate my existing Mail Scanner box to a new one. Anyone have any tips on this? __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - File online, calculators, forms, and more http://tax.yahoo.com From mailscanner at LISTS.COM.AR Mon Apr 14 14:28:51 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:46 2006 Subject: Postfix support -- beta release In-Reply-To: <5.2.1.1.2.20030413172634.023db7a0@imap.ecs.soton.ac.uk> References: <1050169843.5467.62.camel@speedy> Message-ID: <3E9A8D63.29696.79983A4C@localhost> El 13 Apr 2003 a las 17:38, Julian Field escribi?: > Well folks, it's out there. Just posted 4.15-2 which includes support for > Postfix and ZMailer. It also includes the updated f-prot-wrapper which will > solve problems for people running F-Prot with a ramdisk or tmpfs. > ... > > A lot of the reason that Postfix support has appeared is due to the > excellent contribution by Mariano Absatz in implementing support for > ZMailer. He managed to find a solution to all sorts of things that had been > stopping Postfix support. > Well... I actually only sketched the ZMailer port... the actual work was done by Leo Helman who is really a better programmer than I am... I'm only taking credit 'cause I speak and write better in English, so I kept the dialog with Julian, so actual kudos should go to Leo. I'll try to write a quick ZMailer+MailScanner installation guide in a few days. Regards. -- Mariano Absatz El Baby ---------------------------------------------------------- Build a system that even a fool can use, and only a fool will use it. From mailscanner at ecs.soton.ac.uk Mon Apr 14 14:36:50 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: To AWL or not to AWL... In-Reply-To: <3E9AB544.E1C15BC2@dcg.com> Message-ID: <5.2.0.9.2.20030414143008.04339430@imap.ecs.soton.ac.uk> At 14:19 14/04/2003, you wrote: >Ok -- I've seen people lately suggesting that if you are using MailScanner >along with SpamAssassin, that turning auto-whitelisting OFF is a good idea. >Does that appear to be the general consensus? Yes, definitely. >I run MS w/ SA for our entire site (along with sendmail). This handles mail >for about a dozen people. Currently, I have AWL on. I use this to add >misidentified "spam" emails to the whitelist. >Is this the best way to do this? Or should I disable AWL? And, if so, then >is the best thing to do for misidentified spam to add them to the >spam.whitelist.rules file? Or somewhere else? You can now feed mis-identified ham/spam back into the Bayes engine in SpamAssassin. I recently posted my script to do this from a pair of "spam" and "notspam" mailboxes. This will help SpamAssassin learn from its mistakes and make it better at differentiating spam and ham (non-spam). -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From howard at harper-adams.ac.uk Mon Apr 14 16:48:37 2003 From: howard at harper-adams.ac.uk (Howard Robinson) Date: Thu Jan 12 21:17:46 2006 Subject: Updateing order In-Reply-To: <5.2.1.1.2.20030414112839.024771d0@imap.ecs.soton.ac.uk> References: <200304140903.h3E93HY29479@blackhole.harper-adams.ac.uk> Message-ID: <200304141544.h3EFiDY08578@blackhole.harper-adams.ac.uk> On 14 Apr 03, at 11:33, Julian Field wrote: Thanks Julian I am away tomorrow but aiming to make a start Wednesday. Is Redhat v9 supported? I have attached sendmail.cf and mailscanner.conf. Are there other files that would be useful? > At 10:07 14/04/2003, you wrote: > >Hi, > >I'm running to following configuration > >redhat 7.1-2 > >Sendmail 8.11.2.-14 > >Mailscanner 3.22-10 > >Sophos 3.67 > >on an Intel box. > > > >I need to upgrade to the latest versions and add SpamAssassin. > >Sophos is straight forward but what would be the best order to do > >the others in. We only have a production Mailscanner server which > >is also our DNS so it has to be down for a minimum. > >I suspect the answer is upgrade Redhat, Sendmail and > >Mailscanner in that order in one go. If that works Sophos then > >SpamAssassin. > >Any thoughts/recommendations. > >(I have a good backup if all goes horribly wrong and an > >reinstallation process that has been tested and works - well has > >worked!!) > > Start by working out your new MailScanner.conf file based on your current > MailScanner 3 setup. If you want to mail me your current conf file (along > with any supporting config files) I will try to do as much of that step > for you as I can. There are a load of new config options which I advise > you leave as default to start with. > > I would use the Perl-SAVI library in future rather than calling Sophos on > the command-line, it is quicker. > > Otherwise that sounds a sensible approach. Feel free to shout for help if > you need it. -- Julian Field www.MailScanner.info Professional Support > Services at www.MailScanner.biz MailScanner thanks transtec Computers for > their support Regards Howard Robinson (Senior Technical Development Officer) Harper Adams University College Edgmond Newport Shropshire TF10 8NB UK E-mail: hrobinson@harper-adams.ac.uk Tel. : +44(0)1952 820280 Via switchboard : +44(0)1952 815253 Direct line Fax. : +44(0)1952 814783 College Web site http://www.harper-adams.ac.uk -------------- next part -------------- # # Copyright (c) 1998-2000 Sendmail, Inc. and its suppliers. # All rights reserved. # Copyright (c) 1983, 1995 Eric P. Allman. All rights reserved. # Copyright (c) 1988, 1993 # The Regents of the University of California. All rights reserved. # # By using this file, you agree to the terms and conditions set # forth in the LICENSE file which can be found at the top level of # the sendmail distribution. # # ###################################################################### ###################################################################### ##### ##### SENDMAIL CONFIGURATION FILE ##### ##### ###################################################################### ###################################################################### ##### $Id: cfhead.m4,v 8.76.4.13 2000/08/24 17:09:50 gshapiro Exp $ ##### ##### $Id: cf.m4,v 8.32 1999/02/07 07:26:14 gshapiro Exp $ ##### ##### JKF setup for Red Hat Linux for Harper Adams University College ##### ##### $Id: linux.m4,v 8.11.16.2 2000/09/17 17:04:22 gshapiro Exp $ ##### ##### $Id: local_procmail.m4,v 8.21 1999/11/18 05:06:23 ca Exp $ ##### ##### $Id: masquerade_envelope.m4,v 8.9 1999/02/07 07:26:10 gshapiro Exp $ ##### ##### $Id: allmasquerade.m4,v 8.11 1999/08/06 01:28:26 gshapiro Exp $ ##### ##### $Id: accept_unqualified_senders.m4,v 8.6 1999/02/07 07:26:07 gshapiro Exp $ ##### ##### $Id: always_add_domain.m4,v 8.9 1999/02/07 07:26:08 gshapiro Exp $ ##### ##### $Id: nouucp.m4,v 8.13 1999/11/24 18:37:07 ca Exp $ ##### ##### $Id: no_default_msa.m4,v 8.1.10.1 2000/09/17 17:04:22 gshapiro Exp $ ##### ##### $Id: smrsh.m4,v 8.14 1999/11/18 05:06:23 ca Exp $ ##### ##### $Id: mailertable.m4,v 8.18 1999/07/22 17:55:35 gshapiro Exp $ ##### ##### $Id: virtusertable.m4,v 8.16 1999/07/22 17:55:36 gshapiro Exp $ ##### ##### $Id: redirect.m4,v 8.15 1999/08/06 01:47:36 gshapiro Exp $ ##### ##### $Id: use_cw_file.m4,v 8.9 1999/02/07 07:26:13 gshapiro Exp $ ##### ##### $Id: use_ct_file.m4,v 8.9 1999/02/07 07:26:13 gshapiro Exp $ ##### ##### $Id: access_db.m4,v 8.15 1999/07/22 17:55:34 gshapiro Exp $ ##### ##### $Id: proto.m4,v 8.446.2.5.2.38 2000/12/28 03:37:28 ca Exp $ ##### # level 9 config file format V9/Berkeley # override file safeties - setting this option compromises system security, # addressing the actual file configuration problem is preferred # need to set this before any file actions are encountered in the cf file #O DontBlameSendmail=safe # default LDAP map specification # need to set this now before any LDAP maps are defined #O LDAPDefaultSpec=-h localhost ################## # local info # ################## Cwlocalhost # file containing names of hosts for which we receive email Fw/etc/mail/local-host-names # my official domain name # ... define this only if sendmail cannot automatically determine your domain #Dj$w.Foo.COM CP. # "Smart" relay host (may be null) DS # operators that cannot be in local usernames (i.e., network indicators) CO @ % # a class with just dot (for identifying canonical names) C.. # a class with just a left bracket (for identifying domain literals) C[[ # access_db acceptance class C{Accept}OK RELAY # Resolve map (to check if a host exists in check_mail) Kresolve host -a -T # Hosts for which relaying is permitted ($=R) FR-o /etc/mail/relay-domains # arithmetic map Karith arith # possible values for tls_connect in access map C{tls}VERIFY ENCR # who I send unqualified names to (null means deliver locally) DR # who gets all local email traffic ($R has precedence for unqualified names) DH # dequoting map Kdequote dequote # class E: names that should be exposed as from this host, even if we masquerade # class L: names that should be delivered locally, even if we have a relay # class M: domains that should be converted to $M # class N: domains that should not be converted to $M #CL root CRharper-adams.ac.uk CEroot # who I masquerade as (null for no masquerading) (see also $=M) DMharper-adams.ac.uk # my name for error messages DnMAILER-DAEMON # Mailer table (overriding domains) Kmailertable hash -o /etc/mail/mailertable # Virtual user table (maps incoming users) Kvirtuser hash -o /etc/mail/virtusertable CPREDIRECT # Access list database (for spam stomping) Kaccess hash /etc/mail/access # Configuration version number DZ8.11.2 ############### # Options # ############### # strip message body to 7 bits on input? O SevenBitInput=False # 8-bit data handling O EightBitMode=pass8 # wait for alias file rebuild (default units: minutes) O AliasWait=10 # location of alias file O AliasFile=/etc/aliases.staff,/etc/aliases.students # minimum number of free blocks on filesystem O MinFreeBlocks=100 # maximum message size # O MaxMessageSize=10000000 # substitution for space (blank) characters O BlankSub=. # avoid connecting to "expensive" mailers on initial submission? O HoldExpensive=False # checkpoint queue runs after every N successful deliveries #O CheckpointInterval=10 # default delivery mode O DeliveryMode=background # automatically rebuild the alias database? # NOTE: There is a potential for a denial of service attack if this is set. # This option is deprecated and will be removed from a future version. O AutoRebuildAliases # error message header/file #O ErrorHeader=/etc/mail/error-header # error mode #O ErrorMode=print # save Unix-style "From_" lines at top of header? #O SaveFromLine=False # temporary file mode O TempFileMode=0600 # match recipients against GECOS field? #O MatchGECOS=False # maximum hop count #O MaxHopCount=17 # location of help file O HelpFile=/etc/mail/helpfile # ignore dots as terminators in incoming messages? #O IgnoreDots=False # name resolver options #O ResolverOptions=+AAONLY # deliver MIME-encapsulated error messages? O SendMimeErrors=True # Forward file search path O ForwardPath=$z/.forward.$w:$z/.forward # open connection cache size O ConnectionCacheSize=2 # open connection cache timeout O ConnectionCacheTimeout=5m # persistent host status directory #O HostStatusDirectory=.hoststat # single thread deliveries (requires HostStatusDirectory)? #O SingleThreadDelivery=False # use Errors-To: header? O UseErrorsTo=False # log level O LogLevel=14 # send to me too, even in an alias expansion? #O MeToo=True # verify RHS in newaliases? O CheckAliases=False # default messages to old style headers if no special punctuation? O OldStyleHeaders=True # SMTP daemon options O DaemonPortOptions=Name=MTA # SMTP client options #O ClientPortOptions=Address=0.0.0.0 # privacy flags O PrivacyOptions=goaway # who (if anyone) should get extra copies of error messages #O PostmasterCopy=Postmaster # slope of queue-only function #O QueueFactor=600000 # queue directory O QueueDirectory=/var/spool/mqueue # timeouts (many of these) #O Timeout.initial=5m O Timeout.connect=1m #O Timeout.iconnect=5m #O Timeout.helo=5m #O Timeout.mail=10m #O Timeout.rcpt=1h #O Timeout.datainit=5m #O Timeout.datablock=1h #O Timeout.datafinal=1h #O Timeout.rset=5m #O Timeout.quit=2m #O Timeout.misc=2m #O Timeout.command=1h #O Timeout.ident=5s #O Timeout.fileopen=60s #O Timeout.control=2m O Timeout.queuereturn=5d #O Timeout.queuereturn.normal=5d #O Timeout.queuereturn.urgent=2d #O Timeout.queuereturn.non-urgent=7d O Timeout.queuewarn=4h #O Timeout.queuewarn.normal=4h #O Timeout.queuewarn.urgent=1h #O Timeout.queuewarn.non-urgent=12h #O Timeout.hoststatus=30m #O Timeout.resolver.retrans=5s #O Timeout.resolver.retrans.first=5s #O Timeout.resolver.retrans.normal=5s #O Timeout.resolver.retry=4 #O Timeout.resolver.retry.first=4 #O Timeout.resolver.retry.normal=4 # should we not prune routes in route-addr syntax addresses? #O DontPruneRoutes=False # queue up everything before forking? O SuperSafe=True # status file O StatusFile=/var/log/sendmail.st # time zone handling: # if undefined, use system default # if defined but null, use TZ envariable passed in # if defined and non-null, use that info #O TimeZoneSpec= # default UID (can be username or userid:groupid) O DefaultUser=8:12 # list of locations of user database file (null means no lookup) O UserDatabaseSpec=/etc/mail/userdb.db # fallback MX host #O FallbackMXhost=fall.back.host.net # if we are the best MX host for a site, try it directly instead of config err O TryNullMXList=true # load average at which we just queue messages #O QueueLA=8 # load average at which we refuse connections #O RefuseLA=12 # maximum number of children we allow at one time #O MaxDaemonChildren=12 # maximum number of new connections per second #O ConnectionRateThrottle=0 # work recipient factor #O RecipientFactor=30000 # deliver each queued job in a separate process? #O ForkEachJob=False # work class factor #O ClassFactor=1800 # work time factor #O RetryFactor=90000 # shall we sort the queue by hostname first? #O QueueSortOrder=priority # minimum time in queue before retry #O MinQueueAge=30m # default character set #O DefaultCharSet=iso-8859-1 # service switch file (ignored on Solaris, Ultrix, OSF/1, others) #O ServiceSwitchFile=/etc/mail/service.switch # hosts file (normally /etc/hosts) #O HostsFile=/etc/hosts # dialup line delay on connection failure #O DialDelay=10s # action to take if there are no recipients in the message #O NoRecipientAction=add-to-undisclosed # chrooted environment for writing to files #O SafeFileEnvironment=/arch # are colons OK in addresses? #O ColonOkInAddr=True # how many jobs can you process in the queue? #O MaxQueueRunSize=10000 # shall I avoid expanding CNAMEs (violates protocols)? #O DontExpandCnames=False # SMTP initial login message (old $e macro) O SmtpGreetingMessage=$j Sendmail $v/$Z; $b # UNIX initial From header format (old $l macro) O UnixFromLine=From $g $d # From: lines that have embedded newlines are unwrapped onto one line #O SingleLineFromHeader=False # Allow HELO SMTP command that does not include a host name #O AllowBogusHELO=False # Characters to be quoted in a full name phrase (@,;:\()[] are automatic) #O MustQuoteChars=. # delimiter (operator) characters (old $o macro) O OperatorChars=.:%@!^/[]+ # shall I avoid calling initgroups(3) because of high NIS costs? #O DontInitGroups=False # are group-writable :include: and .forward files (un)trustworthy? #O UnsafeGroupWrites=True # where do errors that occur when sending errors get sent? #O DoubleBounceAddress=postmaster # where to save bounces if all else fails #O DeadLetterDrop=/var/tmp/dead.letter # what user id do we assume for the majority of the processing? #O RunAsUser=sendmail # maximum number of recipients per SMTP envelope #O MaxRecipientsPerMessage=100 # shall we get local names from our installed interfaces? O DontProbeInterfaces=true # Return-Receipt-To: header implies DSN request #O RrtImpliesDsn=False # override connection address (for testing) #O ConnectOnlyTo=0.0.0.0 # Trusted user for file ownership and starting the daemon #O TrustedUser=root # Control socket for daemon management #O ControlSocketName=/var/spool/mqueue/.control # Maximum MIME header length to protect MUAs #O MaxMimeHeaderLength=0/0 # Maximum length of the sum of all headers #O MaxHeadersLength=32768 # Maximum depth of alias recursion #O MaxAliasRecursion=10 # location of pid file #O PidFile=/var/run/sendmail.pid # Prefix string for the process title shown on 'ps' listings #O ProcessTitlePrefix=prefix # Data file (df) memory-buffer file maximum size #O DataFileBufferSize=4096 # Transcript file (xf) memory-buffer file maximum size #O XscriptFileBufferSize=4096 # list of authentication mechanisms #O AuthMechanisms=GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5 # default authentication information for outgoing connections #O DefaultAuthInfo=/etc/mail/default-auth-info # SMTP AUTH flags O AuthOptions=A # CA directory #O CACERTPath # CA file #O CACERTFile # Server Cert #O ServerCertFile # Server private key #O ServerKeyFile # Client Cert #O ClientCertFile # Client private key #O ClientKeyFile # DHParameters (only required if DSA/DH is used) #O DHParameters # Random data source (required for systems without /dev/urandom under OpenSSL) #O RandFile ########################### # Message precedences # ########################### Pfirst-class=0 Pspecial-delivery=100 Plist=-30 Pbulk=-60 Pjunk=-100 ##################### # Trusted users # ##################### # this is equivalent to setting class "t" Ft/etc/mail/trusted-users Troot Tdaemon ######################### # Format of headers # ######################### H?P?Return-Path: <$g> HReceived: $?sfrom $s $.$?_($?s$|from $.$_) $.$?{auth_type}(authenticated$?{auth_ssf} (${auth_ssf} bits)$.) $.by $j ($v/$Z)$?r with $r$. id $i$?{tls_version} (using ${tls_version} with cipher ${cipher} (${cipher_bits} bits) verified ${verify})$.$?u for $u; $|; $.$b H?D?Resent-Date: $a H?D?Date: $a H?F?Resent-From: $?x$x <$g>$|$g$. H?F?From: $?x$x <$g>$|$g$. H?x?Full-Name: $x # HPosted-Date: $a # H?l?Received-Date: $b H?M?Resent-Message-Id: <$t.$i@$j> H?M?Message-Id: <$t.$i@$j> # ###################################################################### ###################################################################### ##### ##### REWRITING RULES ##### ###################################################################### ###################################################################### ############################################ ### Ruleset 3 -- Name Canonicalization ### ############################################ Scanonify=3 # handle null input (translate to <@> special case) R$@ $@ <@> # strip group: syntax (not inside angle brackets!) and trailing semicolon R$* $: $1 <@> mark addresses R$* < $* > $* <@> $: $1 < $2 > $3 unmark R@ $* <@> $: @ $1 unmark @host:... R$* :: $* <@> $: $1 :: $2 unmark node::addr R:include: $* <@> $: :include: $1 unmark :include:... R$* [ IPv6 $- ] <@> $: $1 [ IPv6 $2 ] unmark IPv6 addr R$* : $* [ $* ] $: $1 : $2 [ $3 ] <@> remark if leading colon R$* : $* <@> $: $2 strip colon if marked R$* <@> $: $1 unmark R$* ; $1 strip trailing semi R$* < $+ :; > $* $@ $2 :; <@> catch R$* < $* ; > $1 < $2 > bogus bracketed semi # null input now results from list:; syntax R$@ $@ :; <@> # strip angle brackets -- note RFC733 heuristic to get innermost item R$* $: < $1 > housekeeping <> R$+ < $* > < $2 > strip excess on left R< $* > $+ < $1 > strip excess on right R<> $@ < @ > MAIL FROM:<> case R< $+ > $: $1 remove housekeeping <> # strip route address <@a,@b,@c:user@d> -> R@ $+ , $+ $2 R@ $+ : $+ $2 # find focus for list syntax R $+ : $* ; @ $+ $@ $>Canonify2 $1 : $2 ; < @ $3 > list syntax R $+ : $* ; $@ $1 : $2; list syntax # find focus for @ syntax addresses R$+ @ $+ $: $1 < @ $2 > focus on domain R$+ < $+ @ $+ > $1 $2 < @ $3 > move gaze right R$+ < @ $+ > $@ $>Canonify2 $1 < @ $2 > already canonical # do some sanity checking R$* < @ $* : $* > $* $1 < @ $2 $3 > $4 nix colons in addrs # if we have % signs, take the rightmost one R$* % $* $1 @ $2 First make them all @s. R$* @ $* @ $* $1 % $2 @ $3 Undo all but the last. R$* @ $* $@ $>Canonify2 $1 < @ $2 > Insert < > and finish # else we must be a local name R$* $@ $>Canonify2 $1 ################################################ ### Ruleset 96 -- bottom half of ruleset 3 ### ################################################ SCanonify2=96 # handle special cases for local names R$* < @ localhost > $* $: $1 < @ $j . > $2 no domain at all R$* < @ localhost . $m > $* $: $1 < @ $j . > $2 local domain # check for IPv6 domain literal (save quoted form) R$* < @ [ IPv6 $- ] > $* $: $2 $| $1 < @@ [ $(dequote $2 $) ] > $3 mark IPv6 addr R$- $| $* < @@ $=w > $* $: $2 < @ $j . > $4 self-literal R$- $| $* < @@ [ $+ ] > $* $@ $2 < @ [ IPv6 $1 ] > $4 canon IP addr # check for IPv4 domain literal R$* < @ [ $+ ] > $* $: $1 < @@ [ $2 ] > $3 mark [a.b.c.d] R$* < @@ $=w > $* $: $1 < @ $j . > $3 self-literal R$* < @@ $+ > $* $@ $1 < @ $2 > $3 canon IP addr # hostnames ending in class P are always canonical R$* < @ $* $=P > $* $: $1 < @ $2 $3 . > $4 R$* < @ $* $~P > $* $: $&{daemon_flags} $| $1 < @ $2 $3 > $4 R$* CC $* $| $* < @ $+.$+ > $* $: $3 < @ $4.$5 . > $6 R$* CC $* $| $* $: $3 # pass to name server to make hostname canonical R$* $| $* < @ $* > $* $: $2 < @ $[ $3 $] > $4 R$* $| $* $: $2 # local host aliases and pseudo-domains are always canonical R$* < @ $=w > $* $: $1 < @ $2 . > $3 R$* < @ $=M > $* $: $1 < @ $2 . > $3 R$* < @ $={VirtHost} > $* $: $1 < @ $2 . > $3 R$* < @ $* . . > $* $1 < @ $2 . > $3 ################################################## ### Ruleset 4 -- Final Output Post-rewriting ### ################################################## Sfinal=4 R$+ :; <@> $@ $1 : handle R$* <@> $@ handle <> and list:; # strip trailing dot off possibly canonical name R$* < @ $+ . > $* $1 < @ $2 > $3 # eliminate internal code R$* < @ *LOCAL* > $* $1 < @ $j > $2 # externalize local domain info R$* < $+ > $* $1 $2 $3 defocus R@ $+ : @ $+ : $+ @ $1 , @ $2 : $3 canonical R@ $* $@ @ $1 ... and exit # delete duplicate local names R$+ % $=w @ $=w $1 @ $2 u%host@host => u@host ############################################################## ### Ruleset 97 -- recanonicalize and call ruleset zero ### ### (used for recursive calls) ### ############################################################## SRecurse=97 R$* $: $>canonify $1 R$* $@ $>parse $1 ###################################### ### Ruleset 0 -- Parse Address ### ###################################### Sparse=0 R$* $: $>Parse0 $1 initial parsing R<@> $#local $: <@> special case error msgs R$* $: $>ParseLocal $1 handle local hacks R$* $: $>Parse1 $1 final parsing # # Parse0 -- do initial syntax checking and eliminate local addresses. # This should either return with the (possibly modified) input # or return with a #error mailer. It should not return with a # #mailer other than the #error mailer. # SParse0 R<@> $@ <@> special case error msgs R$* : $* ; <@> $#error $@ 5.1.3 $: "501 List:; syntax illegal for recipient addresses" R@ <@ $* > < @ $1 > catch "@@host" bogosity R<@ $+> $#error $@ 5.1.3 $: "501 User address required" R$* $: <> $1 R<> $* < @ [ $+ ] > $* $1 < @ [ $2 ] > $3 R<> $* <$* : $* > $* $#error $@ 5.1.3 $: "501 Colon illegal in host name part" R<> $* $1 R$* < @ . $* > $* $#error $@ 5.1.2 $: "501 Invalid host name" R$* < @ $* .. $* > $* $#error $@ 5.1.2 $: "501 Invalid host name" R$* , $~O $* $#error $@ 5.1.2 $: "501 Invalid route address" # now delete the local info -- note $=O to find characters that cause forwarding R$* < @ > $* $@ $>Parse0 $>canonify $1 user@ => user R< @ $=w . > : $* $@ $>Parse0 $>canonify $2 @here:... -> ... R$- < @ $=w . > $: $(dequote $1 $) < @ $2 . > dequote "foo"@here R< @ $+ > $#error $@ 5.1.3 $: "501 User address required" R$* $=O $* < @ $=w . > $@ $>Parse0 $>canonify $1 $2 $3 ...@here -> ... R$- $: $(dequote $1 $) < @ *LOCAL* > dequote "foo" R< @ *LOCAL* > $#error $@ 5.1.3 $: "501 User address required" R$* $=O $* < @ *LOCAL* > $@ $>Parse0 $>canonify $1 $2 $3 ...@*LOCAL* -> ... R$* < @ *LOCAL* > $: $1 # # Parse1 -- the bottom half of ruleset 0. # SParse1 # handle numeric address spec R$* < @ [ $+ ] > $* $: $>ParseLocal $1 < @ [ $2 ] > $3 numeric internet spec R$* < @ [ $+ ] > $* $1 < @ [ $2 ] : $S > $3 Add smart host to path R$* < @ [ IPv6 $- ] : > $* $#esmtp $@ [ $(dequote $2 $) ] $: $1 < @ [IPv6 $2 ] > $3 no smarthost: send R$* < @ [ $+ ] : > $* $#esmtp $@ [$2] $: $1 < @ [$2] > $3 no smarthost: send R$* < @ [ $+ ] : $- : $*> $* $#$3 $@ $4 $: $1 < @ [$2] > $5 smarthost with mailer R$* < @ [ $+ ] : $+ > $* $#esmtp $@ $3 $: $1 < @ [$2] > $4 smarthost without mailer # handle virtual users R$+ $: $1 Mark for lookup R $+ < @ $={VirtHost} . > $: < $(virtuser $1 @ $2 $@ $1 $: @ $) > $1 < @ $2 . > R $+ < @ $=w . > $: < $(virtuser $1 @ $2 $@ $1 $: @ $) > $1 < @ $2 . > R<@> $+ + $* < @ $* . > $: < $(virtuser $1 + * @ $3 $@ $1 $@ $2 $: @ $) > $1 + $2 < @ $3 . > R<@> $+ + $* < @ $* . > $: < $(virtuser $1 @ $3 $@ $1 $: @ $) > $1 + $2 < @ $3 . > R<@> $+ + $+ < @ $+ . > $: < $(virtuser + * @ $3 $@ $1 $@ $2 $: @ $) > $1 + $2 < @ $3 . > R<@> $+ + $* < @ $+ . > $: < $(virtuser @ $3 $@ $1 $@ $2 $: @ $) > $1 + $2 < @ $3 . > R<@> $+ < @ $+ . > $: < $(virtuser @ $2 $@ $1 $: @ $) > $1 < @ $2 . > R<@> $+ $: $1 R $+ $: $1 R< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4 R< error : $- $+ > $* $#error $@ $(dequote $1 $) $: $2 R< $+ > $+ < @ $+ > $: $>Recurse $1 # short circuit local delivery so forwarded email works R$=L < @ $=w . > $#local $: @ $1 special local names R$+ < @ $=w . > $#local $: $1 regular local name # not local -- try mailer table lookup R$* <@ $+ > $* $: < $2 > $1 < @ $2 > $3 extract host name R< $+ . > $* $: < $1 > $2 strip trailing dot R< $+ > $* $: < $(mailertable $1 $) > $2 lookup R< $~[ : $* > $* $>MailerToTriple < $1 : $2 > $3 check -- resolved? R< $+ > $* $: $>Mailertable <$1> $2 try domain # resolve fake top level domains by forwarding to other hosts # figure out what should stay in our local mail system R$* < @ $+ .$m. > $* $#relay $@ $2.$m. $: $1 < @ $2.$m. > $3 R$* < @ $+ .haac.ac.uk. > $* $#relay $@ $2.$m. $: $1 < @ $2.$m. > $3 # pass names that still have a host to a smarthost (if defined) R$* < @ $* > $* $: $>MailerToTriple < $S > $1 < @ $2 > $3 glue on smarthost name # deal with other remote names R$* < @$* > $* $#esmtp $@ $2 $: $1 < @ $2 > $3 user@host.domain # handle locally delivered names R$=L $#local $: @ $1 special local names R$+ $#local $: $1 regular local names ########################################################################### ### Ruleset 5 -- special rewriting after aliases have been expanded ### ########################################################################### SLocal_localaddr Slocaladdr=5 R$+ $: $1 $| $>"Local_localaddr" $1 R$+ $| $#$* $#$2 R$+ $| $* $: $1 # deal with plussed users so aliases work nicely R$+ + * $#local $@ $&h $: $1 R$+ + $* $#local $@ + $2 $: $1 + * # prepend an empty "forward host" on the front R$+ $: <> $1 # see if we have a relay or a hub R< > $+ $: < $H > $1 try hub R< > $+ $: < $R > $1 try relay R< > $+ $: < > < $1 <> $&h > nope, restore +detail R< > < $+ <> + $* > $: < > < $1 + $2 > check whether +detail R< > < $+ <> $* > $: < > < $1 > else discard R< > < $+ + $* > $* < > < $1 > + $2 $3 find the user part R< > < $+ > + $* $#local $@ $2 $: @ $1 strip the extra + R< > < $+ > $@ $1 no +detail R$+ $: $1 <> $&h add +detail back in R$+ <> + $* $: $1 + $2 check whether +detail R$+ <> $* $: $1 else discard R< local : $* > $* $: $>MailerToTriple < local : $1 > $2 no host extension R< error : $* > $* $: $>MailerToTriple < error : $1 > $2 no host extension R< $- : $+ > $+ $: $>MailerToTriple < $1 : $2 > $3 < @ $2 > R< $+ > $+ $@ $>MailerToTriple < $1 > $2 < @ $1 > ################################################################### ### Ruleset 90 -- try domain part of mailertable entry ### ################################################################### SMailertable=90 R$* <$- . $+ > $* $: $1$2 < $(mailertable .$3 $@ $1$2 $@ $2 $) > $4 R$* <$~[ : $* > $* $>MailerToTriple < $2 : $3 > $4 check -- resolved? R$* < . $+ > $* $@ $>Mailertable $1 . <$2> $3 no -- strip & try again R$* < $* > $* $: < $(mailertable . $@ $1$2 $) > $3 try "." R< $~[ : $* > $* $>MailerToTriple < $1 : $2 > $3 "." found? R< $* > $* $@ $2 no mailertable match ################################################################### ### Ruleset 95 -- canonify mailer:[user@]host syntax to triple ### ################################################################### SMailerToTriple=95 R< > $* $@ $1 strip off null relay R< error : $-.$-.$- : $+ > $* $#error $@ $1.$2.$3 $: $4 R< error : $- $+ > $* $#error $@ $(dequote $1 $) $: $2 R< local : $* > $* $>CanonLocal < $1 > $2 R< $- : $+ @ $+ > $*<$*>$* $# $1 $@ $3 $: $2<@$3> use literal user R< $- : $+ > $* $# $1 $@ $2 $: $3 try qualified mailer R< $=w > $* $@ $2 delete local host R< [ IPv6 $+ ] > $* $#relay $@ $(dequote $1 $) $: $2 use unqualified mailer R< $+ > $* $#relay $@ $1 $: $2 use unqualified mailer ################################################################### ### Ruleset CanonLocal -- canonify local: syntax ### ################################################################### SCanonLocal # strip local host from routed addresses R< $* > < @ $+ > : $+ $@ $>Recurse $3 R< $* > $+ $=O $+ < @ $+ > $@ $>Recurse $2 $3 $4 # strip trailing dot from any host name that may appear R< $* > $* < @ $* . > $: < $1 > $2 < @ $3 > # handle local: syntax -- use old user, either with or without host R< > $* < @ $* > $* $#local $@ $1@$2 $: $1 R< > $+ $#local $@ $1 $: $1 # handle local:user@host syntax -- ignore host part R< $+ @ $+ > $* < @ $* > $: < $1 > $3 < @ $4 > # handle local:user syntax R< $+ > $* <@ $* > $* $#local $@ $2@$3 $: $1 R< $+ > $* $#local $@ $2 $: $1 ################################################################### ### Ruleset 93 -- convert header names to masqueraded form ### ################################################################### SMasqHdr=93 # do not masquerade anything in class N R$* < @ $* $=N . > $@ $1 < @ $2 $3 . > # special case the users that should be exposed R$=E < @ *LOCAL* > $@ $1 < @ $j . > leave exposed R$=E < @ $=M . > $@ $1 < @ $2 . > R$=E < @ $=w . > $@ $1 < @ $2 . > # handle domain-specific masquerading R$* < @ $=M . > $* $: $1 < @ $2 . @ $M > $3 convert masqueraded doms R$* < @ $=w . > $* $: $1 < @ $2 . @ $M > $3 R$* < @ *LOCAL* > $* $: $1 < @ $j . @ $M > $2 R$* < @ $+ @ > $* $: $1 < @ $2 > $3 $M is null R$* < @ $+ @ $+ > $* $: $1 < @ $3 . > $4 $M is not null ################################################################### ### Ruleset 94 -- convert envelope names to masqueraded form ### ################################################################### SMasqEnv=94 R$+ $@ $>MasqHdr $1 ################################################################### ### Ruleset 98 -- local part of ruleset zero (can be null) ### ################################################################### SParseLocal=98 # addresses sent to foo@host.REDIRECT will give a 551 error code R$* < @ $+ .REDIRECT. > $: $1 < @ $2 . REDIRECT . > < ${opMode} > R$* < @ $+ .REDIRECT. > $: $1 < @ $2 . REDIRECT. > R$* < @ $+ .REDIRECT. > < $- > $#error $@ 5.1.1 $: "551 User has moved; please try " <$1@$2> R$+ < @ haac.ac.uk. > $* $#local $@ $m. $: $1 Force use of aliases R$+ < @ $m. > $* $#local $@ $m. $: $1 Force use of aliases ###################################################################### ### LookUpDomain -- search for domain in access database ### ### Parameters: ### <$1> -- key (domain name) ### <$2> -- default (what to return if not found in db) ### <$3> -- passthru (additional data passed unchanged through) ### <$4> -- mark (must be <(!|+) single-token>) ### ! does lookup only with tag ### + does lookup with and without tag ###################################################################### SLookUpDomain R<[IPv6 $-]> <$+> <$*> <$*> $: <[$(dequote $1 $)]> <$2> <$3> <$4> R<$*> <$+> <$*> <$- $-> $: < $(access $5:$1 $: ? $) > <$1> <$2> <$3> <$4 $5> R <$+> <$+> <$*> <+ $*> $: < $(access $1 $: ? $) > <$1> <$2> <$3> <+ $4> R <[$+.$-]> <$+> <$*> <$*> $@ $>LookUpDomain <[$1]> <$3> <$4> <$5> R <[$+::$-]> <$+> <$*> <$*> $: $>LookUpDomain <[$1]> <$3> <$4> <$5> R <[$+:$-]> <$+> <$*> <$*> $: $>LookUpDomain <[$1]> <$3> <$4> <$5> R <$+.$+> <$+> <$*> <$*> $@ $>LookUpDomain <$2> <$3> <$4> <$5> R <$+> <$+> <$*> <$*> $@ <$2> <$3> R<$*> <$+> <$+> <$*> <$*> $@ <$1> <$4> ###################################################################### ### LookUpAddress -- search for host address in access database ### ### Parameters: ### <$1> -- key (dot quadded host address) ### <$2> -- default (what to return if not found in db) ### <$3> -- passthru (additional data passed through) ### <$4> -- mark (must be <(!|+) single-token>) ### ! does lookup only with tag ### + does lookup with and without tag ###################################################################### SLookUpAddress R<$+> <$+> <$*> <$- $+> $: < $(access $5:$1 $: ? $) > <$1> <$2> <$3> <$4 $5> R <$+> <$+> <$*> <+ $+> $: < $(access $1 $: ? $) > <$1> <$2> <$3> <+ $4> R <$+::$-> <$+> <$*> <$*> $@ $>LookUpAddress <$1> <$3> <$4> <$5> R <$+:$-> <$+> <$*> <$*> $@ $>LookUpAddress <$1> <$3> <$4> <$5> R <$+.$-> <$+> <$*> <$*> $@ $>LookUpAddress <$1> <$3> <$4> <$5> R <$+> <$+> <$*> <$*> $@ <$2> <$3> R<$*> <$+> <$+> <$*> <$*> $@ <$1> <$4> ###################################################################### ### CanonAddr -- Convert an address into a standard form for ### relay checking. Route address syntax is ### crudely converted into a %-hack address. ### ### Parameters: ### $1 -- full recipient address ### ### Returns: ### parsed address, not in source route form ###################################################################### SCanonAddr R$* $: $>Parse0 $>canonify $1 make domain canonical ###################################################################### ### ParseRecipient -- Strip off hosts in $=R as well as possibly ### $* $=m or the access database. ### Check user portion for host separators. ### ### Parameters: ### $1 -- full recipient address ### ### Returns: ### parsed, non-local-relaying address ###################################################################### SParseRecipient R$* $: $>CanonAddr $1 R $* < @ $* . > $1 < @ $2 > strip trailing dots R $- < @ $* > $: $(dequote $1 $) < @ $2 > dequote local part # if no $=O character, no host in the user portion, we are done R $* $=O $* < @ $* > $: $1 $2 $3 < @ $4> R $* $@ $1 R $* < @ $* $=R > $: $1 < @ $2 $3 > R $* < @ $+ > $: $>LookUpDomain <$2> <$1 < @ $2 >> <+To> R<$+> <$+> $: <$1> $2 R $* < @ $* > $@ $>ParseRecipient $1 R<$-> $* $@ $2 ###################################################################### ### check_relay -- check hostname/address on SMTP startup ###################################################################### SLocal_check_relay Scheck_relay R$* $: $1 $| $>"Local_check_relay" $1 R$* $| $* $| $#$* $#$3 R$* $| $* $| $* $@ $>"Basic_check_relay" $1 $| $2 SBasic_check_relay # check for deferred delivery mode R$* $: < ${deliveryMode} > $1 R< d > $* $@ deferred R< $* > $* $: $2 R$+ $| $+ $: $>LookUpDomain < $1 > < $2 > <+Connect> R <$+> $: $>LookUpAddress < $1 > < $1 > <+Connect> no: another lookup R < $+ > $: $1 found nothing R<$={Accept}> < $* > $@ $1 return value of lookup R $* $#error $@ 5.7.1 $: "550 Access denied" R $* $#discard $: discard R <$*> $#error $@ $1.$2.$3 $: $4 R <$*> $#error $: $1 R<$+> <$*> $#error $: $1 ###################################################################### ### check_mail -- check SMTP `MAIL FROM:' command argument ###################################################################### SLocal_check_mail Scheck_mail R$* $: $1 $| $>"Local_check_mail" $1 R$* $| $#$* $#$2 R$* $| $* $@ $>"Basic_check_mail" $1 SBasic_check_mail # check for deferred delivery mode R$* $: < ${deliveryMode} > $1 R< d > $* $@ deferred R< $* > $* $: $2 # authenticated? R$* $: $1 $| $>"tls_client" $&{verify} $| MAIL R$* $| $#$+ $#$2 R$* $| $* $: $1 R<> $@ we MUST accept <> (RFC 1123) R$* $: $>CanonAddr $1 canonify sender address and mark it R $* < @ $+ . > $1 < @ $2 > strip trailing dots # handle non-DNS hostnames (*.bitnet, *.decnet, *.uucp, etc) R $* < @ $* $=P > $: $1 < @ $2 $3 > R $* < @ $+ > $: $) > $1 < @ $2 > R> $* < @ $+ > $: <$2> $3 < @ $4 > # check sender address: user@address, user@, address R<$+> $+ < @ $* > $: @<$1> <$2 < @ $3 >> $| R<$+> $+ $: @<$1> <$2> $| R@ <$+> <$*> $| <$+> $: <@> <$1> <$2> $| $>SearchList <+From> $| <$3> <> R<@> <$+> <$*> $| <$*> $: <$3> <$1> <$2> reverse result # retransform for further use R <$+> <$*> $: <$1> $2 no match R<$+> <$+> <$*> $: <$1> $3 relevant result, keep it # check results R $* $: @ $1 mark address: nothing known about it R $* $@ R $* $#error $@ 4.1.8 $: "451 Domain of sender address " $&f " does not resolve" R $* $#error $@ 5.1.8 $: "501 Domain of sender address " $&f " does not exist" R<$={Accept}> $* $# $1 R $* $#discard $: discard R $* $#error $@ 5.7.1 $: "550 Access denied" R $* $#error $@ $1.$2.$3 $: $4 R $* $#error $: $1 R<$+> $* $#error $: $1 error from access db ###################################################################### ### check_rcpt -- check SMTP `RCPT TO:' command argument ###################################################################### SLocal_check_rcpt Scheck_rcpt R$* $: $1 $| $>"Local_check_rcpt" $1 R$* $| $#$* $#$2 R$* $| $* $@ $>"Basic_check_rcpt" $1 SBasic_check_rcpt # check for deferred delivery mode R$* $: < ${deliveryMode} > $1 R< d > $* $@ deferred R< $* > $* $: $2 R$* $: $>ParseRecipient $1 strip relayable hosts # authenticated? R$* $: $1 $| $>RelayAuth $1 $| $&{verify} client authenticated? R$* $| $# $+ $# $2 error/ok? R$* $| $* $: $1 no # authenticated by a trusted mechanism? R$* $: $1 $| $&{auth_type} R$* $| $: $1 R$* $| $={TrustAuthMech} $# RELAYAUTH R$* $| $* $: $1 # anything terminating locally is ok R$+ < @ $=w > $@ RELAYTO R$+ < @ $* $=R > $@ RELAYTO R$+ < @ $+ > $: $>LookUpDomain <$2> <$1 < @ $2 >> <+To> R $* $@ RELAYTO R<$*> <$*> $: $2 # check for local user (i.e. unqualified address) R$* $: $1 R $* < @ $+ > $: $1 < @ $2 > # local user is ok R $+ $@ RELAYTOLOCAL R<$+> $* $: $2 # anything originating locally is ok # check IP address R$* $: $&{client_addr} R$@ $@ RELAYFROM originated locally R0 $@ RELAYFROM originated locally R$=R $* $@ RELAYFROM relayable IP address R$* $: $>LookUpAddress <$1> <$1> <+Connect> R $* $@ RELAYFROM relayable IP address R<$*> <$*> $: $2 R$* $: [ $1 ] put brackets around it... R$=w $@ RELAYFROM ... and see if it is local # check client name: first: did it resolve? R$* $: < $&{client_resolve} > R $#error $@ 4.7.1 $: "450 Relaying temporarily denied. Cannot resolve PTR record for " $&{client_addr} R $#error $@ 5.7.1 $: "550 Relaying denied. IP name possibly forged " $&{client_name} R $#error $@ 5.7.1 $: "550 Relaying denied. IP name lookup failed " $&{client_name} R$* $: $&{client_name} # pass to name server to make hostname canonical R $* $~P $: $[ $1 $2 $] R$* . $1 strip trailing dots R $@ RELAYFROM R $=w $@ RELAYFROM R $* $=R $@ RELAYFROM R $* $: $>LookUpDomain <$1> <$1> <+Connect> R $* $@ RELAYFROM R<$*> <$*> $: $2 # anything else is bogus R$* $#error $@ 5.7.1 $: "550 Relaying denied" ###################################################################### ### SearchList: search a list of items in the access map ### Parameters: ### $| ... <> ### where "exact" is either "+" or "!": ### <+ TAG> lookup with and w/o tag ### lookup with tag ### possible values for "mark" are: ### H: recursive host lookup (LookUpDomain) ### E: exact lookup, no modifications ### F: full lookup, try user+ext@domain and user@domain ### U: user lookup, try user+ext and user (input must have trailing @) ### return: or (not found) ###################################################################### # class with valid marks for SearchList C{src}E F H U SSearchList # mark H: lookup domain R<$+> $| <$*> $: <$1> $| <@> $>LookUpDomain <$2> <$3> <$1> R<$+> $| <@> <$+> <$*> $: <$1> $| <$2> <$3> R<$- $-> $| <$={src}:$+> <$*> $: <$1 $2> $| <$(access $2:$4 $: $3:$4 $)> <$5> R<+ $-> $| <$={src}:$+> <$*> $: <+ $1> $| <$(access $3 $: $2:$3 $)> <$4> R<$- $-> $| <$*> $: <$1 $2> $| <$(access $2:$3@$5 $: F:$3 + $4@$5$)> <$6> R<+ $-> $| <$*> $: <+ $1> $| <$(access $2@$4 $: F:$2 + $3@$4$)> <$5> R<$- $-> $| <$*> $: <$1 $2> $| <$(access $2:$3@ $: U:$3 + $4$)> <$5> R<+ $-> $| <$*> $: <+ $1> $| <$(access $2@ $: U:$2 + $3$)> <$4> R<$+> $| <$={src}:$+> <$+> $@ $>SearchList <$1> $| <$4> R<$+> $| <$={src}:$+> <> $@ R<$+> $| <$+> <$*> $@ <$2> R<$+> $| <$+> $@ <$2> # is user trusted to authenticate as someone else? Strust_auth R$* $: $&{auth_type} $| $1 # required by RFC 2554 section 4. R$@ $| $* $#error $@ 5.7.1 $: "550 not authenticated" R$* $| $&{auth_authen} $@ identical R$* $| <$&{auth_authen}> $@ identical R$* $| $* $: $1 $| $>"Local_trust_auth" $1 R$* $| $#$* $#$2 R$* $#error $@ 5.7.1 $: "550 " $&{auth_authen} " not allowed to act as " $&{auth_author} SLocal_trust_auth # is connection with client "good" enough? (done in server) # input: ${verify} $| (MAIL|STARTTLS) Stls_client R$* $| $* $: $1 $| $>LookUpDomain <$&{client_name}> <> R$* $| $* $: $1 $| $>LookUpAddress <$&{client_addr}> <> R$* $| $* $: $1 $| <$(access TLS_Clt: $: ? $)> R$* $@ $>"tls_connection" $1 # is connection with server "good" enough? (done in client) # input: ${verify} Stls_server R$* $: $1 $| $>LookUpDomain <$&{server_name}> <> R$* $| $* $: $1 $| $>LookUpAddress <$&{server_addr}> <> R$* $| $* $: $1 $| <$(access TLS_Srv: $: ? $)> R$* $@ $>"tls_connection" $1 Stls_connection R$* $| <$*>$* $: $1 $| <$2> R$* $| $: $1 $| <503:5.7.0> <$2 $3> R$* $| $: $1 $| <403:4.7.0> <$2 $3> R$* $| <$={tls} $*> $: $1 $| <403:4.7.0> <$2 $3> RSOFTWARE $| <$-:$+> $* $#error $@ $2 $: $1 " TLS handshake failed." RSOFTWARE $| $* $#error $@ 4.7.0 $: "403 TLS handshake failed." R$* $| <$*> $: <$2> $1 R$* $| <$*> <$={tls}:$->$* $: <$2> <$3:$4> $1 R$* $| $* $@ OK # authentication required: give appropriate error # other side did authenticate (via STARTTLS) R<$*> OK $@ OK R<$*> OK $: <$1> R<$*> $* $: <$1> R<$-:$+> $#error $@ $2 $: $1 " authentication required" R<$-:$+> FAIL $#error $@ $2 $: $1 " authentication failed" R<$-:$+> NO $#error $@ $2 $: $1 " not authenticated" R<$-:$+> NONE $#error $@ $2 $: $1 " other side does not support STARTTLS" R<$-:$+> $+ $#error $@ $2 $: $1 " authentication failure " $4 R<$*> $: <$1> $>max $&{cipher_bits} : $&{auth_ssf} R<$*> $- $: <$1> <$2:$3> $(arith l $@ $3 $@ $2 $) R<$-:$+><$-:$-> TRUE $#error $@ $2 $: $1 " encryption too weak " $4 " less than " $3 Smax R: $: 0 R:$- $: $1 R$-: $: $1 R$-:$- $: $(arith l $@ $1 $@ $2 $) : $1 : $2 RTRUE:$-:$- $: $2 R$-:$-:$- $: $2 SRelayAuth # authenticated? R$* $| OK $: $1 R$* $| $* $@ NO not authenticated R$* $: $1 $| $&{cert_issuer} R$* $| $+ $: $1 $| $(access CERTISSUER:$2 $) R$* $| RELAY $# RELAYCERTISSUER R$* $| SUBJECT $: $1 $| <@> $&{cert_subject} R$* $| <@> $+ $: $1 $| <@> $(access CERTSUBJECT:$2 $) R$* $| <@> RELAY $# RELAYCERTSUBJECT R$* $| $* $: $1 # ###################################################################### ###################################################################### ##### ##### MAILER DEFINITIONS ##### ###################################################################### ###################################################################### ##################################### ### SMTP Mailer specification ### ##################################### ##### $Id: smtp.m4,v 8.56.2.1.2.3 2000/09/25 13:53:27 ca Exp $ ##### # # common sender and masquerading recipient rewriting # SMasqSMTP=61 R$* < @ $* > $* $@ $1 < @ $2 > $3 already fully qualified R$+ $@ $1 < @ *LOCAL* > add local qualification # # convert pseudo-domain addresses to real domain addresses # SPseudoToReal=51 # pass s through R< @ $+ > $* $@ < @ $1 > $2 resolve # output fake domains as user%fake@relay # # envelope sender rewriting # SEnvFromSMTP=11 R$+ $: $>PseudoToReal $1 sender/recipient common R$* :; <@> $@ list:; special case R$* $: $>MasqSMTP $1 qualify unqual'ed names R$+ $: $>MasqEnv $1 do masquerading # # envelope recipient rewriting -- # also header recipient if not masquerading recipients # SEnvToSMTP=21 R$+ $: $>PseudoToReal $1 sender/recipient common R$+ $: $>MasqSMTP $1 qualify unqual'ed names R$* < @ *LOCAL* > $* $: $1 < @ $j . > $2 # # header sender and masquerading header recipient rewriting # SHdrFromSMTP=31 R$+ $: $>PseudoToReal $1 sender/recipient common R:; <@> $@ list:; special case # do special header rewriting R$* <@> $* $@ $1 <@> $2 pass null host through R< @ $* > $* $@ < @ $1 > $2 pass route-addr through R$* $: $>MasqSMTP $1 qualify unqual'ed names R$+ $: $>MasqHdr $1 do masquerading # # relay mailer header masquerading recipient rewriting # SMasqRelay=71 R$+ $: $>MasqSMTP $1 R$+ $: $>MasqHdr $1 Msmtp, P=[IPC], F=mDFMuX, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP, E=\r\n, L=990, T=DNS/RFC822/SMTP, A=TCP $h Mesmtp, P=[IPC], F=mDFMuXa, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP, E=\r\n, L=990, T=DNS/RFC822/SMTP, A=TCP $h Msmtp8, P=[IPC], F=mDFMuX8, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP, E=\r\n, L=990, T=DNS/RFC822/SMTP, A=TCP $h Mdsmtp, P=[IPC], F=mDFMuXa%, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP, E=\r\n, L=990, T=DNS/RFC822/SMTP, A=TCP $h Mrelay, P=[IPC], F=mDFMuXa8, S=EnvFromSMTP/HdrFromSMTP, R=MasqSMTP/MasqRelay, E=\r\n, L=2040, T=DNS/RFC822/SMTP, A=TCP $h ################################################## ### Local and Program Mailer specification ### ################################################## ##### $Id: local.m4,v 8.50.16.2 2000/09/17 17:04:22 gshapiro Exp $ ##### # # Envelope sender rewriting # SEnvFromL=10 R<@> $n errors to mailer-daemon R@ <@ $*> $n temporarily bypass Sun bogosity R$+ $: $>AddDomain $1 add local domain if needed R$* $: $>MasqEnv $1 do masquerading # # Envelope recipient rewriting # SEnvToL=20 R$+ < @ $* > $: $1 strip host part # # Header sender rewriting # SHdrFromL=30 R<@> $n errors to mailer-daemon R@ <@ $*> $n temporarily bypass Sun bogosity R$+ $: $>AddDomain $1 add local domain if needed R$* $: $>MasqHdr $1 do masquerading # # Header recipient rewriting # SHdrToL=40 R$+ $: $>AddDomain $1 add local domain if needed R$* $: $>MasqHdr $1 do all-masquerading # # Common code to add local domain name (only if always-add-domain) # SAddDomain=50 R$* < @ $* > $* $@ $1 < @ $2 > $3 already fully qualified R$+ $@ $1 < @ *LOCAL* > add local qualification Mlocal, P=/usr/bin/procmail, F=lsDFMAw5:/|@qSPfhn9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, T=DNS/RFC822/X-Unix, A=procmail -Y -a $h -d $u Mprog, P=/usr/sbin/smrsh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/, T=X-Unix/X-Unix/X-Unix, A=smrsh -c $u -------------- next part -------------- The following section of this message contains a file attachment prepared for transmission using the Internet MIME message format. If you are using Pegasus Mail, or any another MIME-compliant system, you should be able to save it or view it from within your mailer. If you cannot, please ask your system administrator for assistance. ---- File information ----------- File: mailscanner.conf Date: 14 Apr 2003, 9:40 Size: 22104 bytes. Type: Unknown -------------- next part -------------- A non-text attachment was scrubbed... Name: mailscanner.conf Type: application/octet-stream Size: 22104 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030414/e9c99d9d/mailscanner.obj From festus at DNSDATA.COM Mon Apr 14 18:02:51 2003 From: festus at DNSDATA.COM (Bob Fayne) Date: Thu Jan 12 21:17:46 2006 Subject: Klez not silent? Message-ID: On Mon, 14 Apr 2003 12:09:29 +0100, Julian Field wrote: >Can you confirm that the batch of messages was only 1 message? If it was 2 >messages then the log lines would match what I expect. Otherwise there >might be a bug in the Clam output parser. It was written by >. Here are the log lines that I neglected to include... Apr 13 03:07:40 host MailScanner[9374]: New Batch: Scanning 1 messages, 157801 bytes Apr 13 03:07:40 host MailScanner[9374]: Spam Checks: Starting Apr 13 03:07:42 host MailScanner[9374]: Virus and Content Scanning: Starting There was only 1 message, but ClamAV indentified that one file as having 2 viruses. I would think that it certainly could have two, but if one is Klez then the message should be discarded. From mark at TIPPINGMAR.COM Mon Apr 14 18:41:02 2003 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:17:46 2006 Subject: MajorSophos update script rev. In-Reply-To: <3E5DE02F.20750.1E94BE5F@localhost> Message-ID: <3E9A903E.24768.1D3C7E93@localhost> A revised version of the shell script "MajorSophos.sh" is attached. The script downloads and (optionally) installs the monthly Sophos program updates. The revision is different from the original posted Feb 27 only in the default environment variables, which have been updated for the 4.x series of MailScanner. The following description is from the original post: It downloads the file from the Sophos website using your sophos username and password and installs it using the script provided with MailScanner. It works either interactively or from cron. It has an option to download the file but not install it. If run from cron, it can report its results by e-mail and/or write to a log. Even if you don't set it up to run from cron, it is a timesaver to use it interactively. It does a fair amount of error checking, so I don't see how it could ever mess up a working installation. It reports the version of installed sophos before and after running. It does this by running sweep (via sophos-wrapper) with the "-v" switch, so you can be pretty confident that the install was a success. If you want to give it a try, I advise the following procedure to build up some confidence in it: 1. Edit the variables at the top of the script to suit your configuration. 2. Run with no arguments to see a usage statement. 3. Run with "-download" argument to see if it can download the file. 4. rm the temp directory created in 3. (/tmp/MajorSophos.sh.xxxxxx) 5. Run with "-install" argument to see if it can download and install. 6. Repeat all of the above from cron, if you like. I wrote in on a RedHat 7.3 system. It requires "which" and "mktemp", but if you don't have those it would be simple to modify. -- Mark W. Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave, Berkeley, CA 94704 visit our website at http://www.tippingmar.com -------------- next part -------------- #!/bin/sh # Shell script to download latest version of Sophos and # (optionally) install it using the MailScanner installer. # Developed on Red Hat Linux 7.3. rev 4-14-2003 # Mark Nienberg # Use as you please at your own risk. # --------Usage:-------------------------------------------------- # run the program with no options for a Usage printout # --------Set Environment Variables------------------------------- # Set SWEEP to the location of the MailScanner wrapper for sweep. # This is only used to report the Sophos version. If it is wrong, # it won't prevent the successful download or installation. SWEEP=/usr/lib/MailScanner/sophos-wrapper # Program to run to install Sophos after downloading it INSTALL=/usr/sbin/Sophos.install # Username provide by Sophos WEBUSER="myusername" # Password provided by Sophos WEBPASS="mypassword" # Website to download from. It must end with "/" WEBSITE="http://www.us.sophos.com/sophos/products/full/" # Name of the file to download DOWNFILE="linux.intel.libc6.tar.Z" # The rest of the variables (6 total) are only used if run from cron APPENDLOG="yes" # Append report to a log? yes or no LOGFILE="/var/log/MajorSophos.log" # Append report to this log file EMAIL="yes" # Send report by email? yes or no MAILPROG="/bin/mail" # Program used to send e-mail MAILNAMES="someone@some.domain" # Persons to receive e-mail # The "install.sh" provided by Sophos, which is called by Mailscanner's # "Sophos.install" script, uses ldconfig on Linux and FreeBSD. But # ldconfig may not be in cron's path. If you list it here, we can fix # cron's path so the installation will work. RedHat definitely needs this. # Alternatively, you could specify it in your crontab file. # It will be ignored for other platforms, and when not running from cron. LDCONFIGPATH="/sbin" # --------End Environment Variables------------------------------- # --------Function to handle output------------------------------- printout() { # we'll write to stdout if interactive, otherwise write to a file if [ "$LOG" = "no" ] ; then echo $@ else echo $@ >>$TMPLOG fi } # --------Subroutine to find the current version of Sophos-------- sweepVer() { # find version of sweep currently installed by running it with -v if [ -f $SWEEP ]; then printout "Current Sophos version information follows:" printout `$SWEEP -v | egrep 'Product|Released'` else printout "Sophos is not currently installed or the SWEEP variable is wrong" fi } # --------Subroutine to download the file------------------------- download() { TMPDIR=`mktemp -d -q /tmp/$BASE.XXXXXX` if [ $? -ne 0 ]; then printout "$BASE: Can't create temp directory, exiting" cleanUp fi cd $TMPDIR if [ "$LOG" = "yes" ] ; then wget -a$TMPLOG -t10 --progress=dot:mega --http-user=$WEBUSER --http-passwd=$WEBPASS $WEBSITE$DOWNFILE else wget -t10 --progress=dot:mega --http-user=$WEBUSER --http-passwd=$WEBPASS $WEBSITE$DOWNFILE fi if [ $? -eq 0 ]; then DOWNLOAD="success" printout "Download of $DOWNFILE succeeded" else DOWNLOAD="failure" printout "Download of $DOWNFILE failed" fi } # --------Subroutine to test for ldconfig------------------------- ldconfigTest() { if [ "`uname -s`" = "Linux" ] || [ "`uname -s`" = "FreeBSD" ] ; then printout "Platform is `uname -s`" which ldconfig > /dev/null 2>&1 if [ $? -ne 0 ] ; then printout "Cannot find ldconfig" printout "Current path is $PATH" if [ -d $LDCONFIGPATH ] ; then printout "adding $LDCONFIGPATH to the path" PATH=$PATH:$LDCONFIGPATH ; export PATH printout "New path is $PATH" # try once more which ldconfig > /dev/null 2>&1 if [ $? -ne 0 ] ; then printout "Still cannot find ldconfig, exiting." cleanUp else printout "Found ldconfig" fi else printout "LDCONFIGPATH variable is not valid, exiting." cleanUp fi fi fi } # --------Subroutine to end & handle log, if one was made.-------- cleanUp() { if [ "$LOG" = "yes" ] ; then if [ "$EMAIL" = "yes" ] ; then $MAILPROG -s 'MajorSophos Update Log' $MAILNAMES<$TMPLOG fi if [ "$APPENDLOG" = "yes" ] ; then cat $TMPLOG>>$LOGFILE fi rm $TMPLOG fi exit } ######### Execution starts here ################################## BASE=`basename $0` # --------See if we are running interactively or from cron-------- if tty -s ; then LOG="no" else LOG="yes" TMPLOG=`mktemp -q /tmp/$BASE.XXXXXX` if [ $? -ne 0 ]; then echo "$BASE: Can't create temp log file, exiting" exit fi printout printout "$BASE $1 started `date`" fi # --------See how we were called---------------------------------- case "$1" in -download) # download only sweepVer download cleanUp ;; -install) # download and install sweepVer if [ "$LOG" = "yes" ] ; then ldconfigTest ; fi ; download if [ "$DOWNLOAD" = "success" ] ; then printout "Starting the MailScanner Sophos installation script" if [ "$LOG" = "yes" ] ; then $INSTALL >> $TMPLOG else $INSTALL fi sweepVer printout "Cleaning up installation files" cd /tmp rm -rf $TMPDIR printout "Done." else printout "Installation was not attempted." fi cleanUp ;; *) #no option or an invalid option if [ "$LOG" = "yes" ] ; then printout "$BASE was not started with a valid option" printout "Run from command line with no options for a Usage Statement" else echo echo "Usage: $BASE [-install | -download]" echo " -install Download and install the latest Sophos program." echo " -download Download only, do not install." fi cleanUp ;; esac From mailscanner at ecs.soton.ac.uk Mon Apr 14 18:47:25 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: MajorSophos update script rev. In-Reply-To: <3E9A903E.24768.1D3C7E93@localhost> References: <3E5DE02F.20750.1E94BE5F@localhost> Message-ID: <5.2.1.1.2.20030414184625.023029a0@imap.ecs.soton.ac.uk> If you store that on a www or ftp site, I will happily publish the URL in the downloads page of www.mailscanner.info. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From jase at SENSIS.COM Mon Apr 14 18:57:26 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 Message-ID: What about setting SPOOL = /var/spool/exim.in in exim.conf, and then have your second exim process called with -DSPOOL=/var/spool/exim This way, you could still use only one config file, and have mail generated by the server scanned too. Would this work? Jason > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: Monday, April 14, 2003 6:27 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Exim4 > > > Tony, > > A little request: any chance you might have time to update the Exim > installation instructions for Exim 4 please? > > I would like to keep it as 2 conf files for Exim rather than > your setup > using only 1, as scanning mail generated on the server is > quite important > for a lot of MailScanner users out there. > > Thanks! > > At 01:22 14/04/2003, you wrote: > >Julian Field wrote: > > >At 22:04 12/04/2003, you wrote: > > >>I'm thinking of trying out Exim4 with MS. In addition to > the MS install > > >>guide using the Exim/MS combo, is there anything else I > need to be aware > > >>of when using Exim4 with MS? I did find some help at: > > > > > >I've run it without any problems. You need to adapt the > Exim 3 notes a bit > > >for 4, as the sections in the exim.conf file are called > rather different > > >things. If you get really stuck, drop me a line and I'll > mail you my > > >(admittedly very simple) exim.conf and exim_send.conf. > > > >Or you can try my setup which uses only one Exim > configuration file. The > >standard two-file setup means that all email is scanned > (including email > >generated on the local machine) but my setup only scans > email submitted > >via SMTP. This should be fine unless you have users on the machine. > >Given a working Exim setup you only need to add two lines to > the config > >and change the way you start Exim in order to get it working with > >MailScanner. > > > >http://www.sng.ecs.soton.ac.uk/cgi-bin/faq?file=79 > > > >If you have any questions I'm happy to expand on that description > >(I haven't had any feedback on it yet). > > > >Tony. > >-- > >f.a.n.finch http://dotat.at/ > >MULL OF KINTYRE TO ARDNAMURCHAN POINT: SOUTHEAST 6, LOCALLY > 7 FOR A TIME, > >EASING 5. RAIN AT TIMES. MODERATE, LOCALLY POOR. MODERATE, > LOCALLY ROUGH FOR A > >TIME. > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > From campbell at CNPAPERS.COM Mon Apr 14 19:50:15 2003 From: campbell at CNPAPERS.COM (Stephe Campbell) Date: Thu Jan 12 21:17:46 2006 Subject: Catch 22 Whitelist & BlackList Message-ID: <002401c302b6$b03877e0$5e01a8c0@cnpapers.net> We have someone spoofing mail to and from a particular user at one of our domains. I would like to get rid of all of this mail. Some of this is spoofed to the user and some is bounced back to the user. I can not locate where it is originating. If I set up whitelisting such as: FromOrTo: BadUser@our.domain no FromOrTo: *@our.domain yes FromOrTo: default no and blacklist such as: FromOrTo: BadUser@our.domain yes FromOrTo: default no Will this allow all mail from everyone at our.domain to pass either way with the exception of BadUser@our.domain? Steve Campbell campbell@cnpapers.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030414/84c2912e/attachment.html From dot at DOTAT.AT Mon Apr 14 19:43:47 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: Message-ID: "Desai, Jason" wrote: > >What about setting > >SPOOL = /var/spool/exim.in > >in exim.conf, and then have your second exim process called with > >-DSPOOL=/var/spool/exim > >This way, you could still use only one config file, and have mail generated >by the server scanned too. Would this work? Yes it works, though you missed out the spool_directory = SPOOL line. http://www.sng.ecs.soton.ac.uk/cgi-bin/faq?file=79 Tony. -- f.a.n.finch http://dotat.at/ ROCKALL: SOUTHWESTERLY 5 OR 6 BECOMING VARIABLE, THEN EASTERLY, 3 OR 4. MAINLY FAIR. MODERATE OR GOOD. From jase at SENSIS.COM Mon Apr 14 20:04:18 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 Message-ID: I was just designating changes from your FAQ post. :-) Thanks for confirming it would work. I will probably set it up this way when I move to exim4. Jason > -----Original Message----- > From: Tony Finch [mailto:dot@DOTAT.AT] > Sent: Monday, April 14, 2003 2:44 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Exim4 > > > "Desai, Jason" wrote: > > > >What about setting > > > >SPOOL = /var/spool/exim.in > > > >in exim.conf, and then have your second exim process called with > > > >-DSPOOL=/var/spool/exim > > > >This way, you could still use only one config file, and have > mail generated > >by the server scanned too. Would this work? > > Yes it works, though you missed out the spool_directory = SPOOL line. > > http://www.sng.ecs.soton.ac.uk/cgi-bin/faq?file=79 > > Tony. > -- > f.a.n.finch http://dotat.at/ > ROCKALL: SOUTHWESTERLY 5 OR 6 BECOMING VARIABLE, THEN > EASTERLY, 3 OR 4. MAINLY > FAIR. MODERATE OR GOOD. > From mike at CAMAROSS.NET Mon Apr 14 20:02:40 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:46 2006 Subject: MajorSophos update script rev. In-Reply-To: <5.2.1.1.2.20030414184625.023029a0@imap.ecs.soton.ac.uk> Message-ID: <009a01c302b8$6d334360$af01a8c0@home.middlefinger.net> I'll be happy to provide space if needed. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Monday, April 14, 2003 12:47 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: MajorSophos update script rev. If you store that on a www or ftp site, I will happily publish the URL in the downloads page of www.mailscanner.info. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Mon Apr 14 20:27:16 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: Catch 22 Whitelist & BlackList In-Reply-To: <002401c302b6$b03877e0$5e01a8c0@cnpapers.net> Message-ID: <5.2.1.1.2.20030414202522.0223b008@imap.ecs.soton.ac.uk> The rules are processed in top to bottom order. The default rule is used only if none of the other rules match. The whitelist check is done before the blacklist check, and will over-ride it. At 19:50 14/04/2003, you wrote: >We have someone spoofing mail to and from a particular user at one of our >domains. I would like to get rid of all of this mail. Some of this is >spoofed to the user and some is bounced back to the user. I can not locate >where it is originating. If I set up whitelisting such as: > >FromOrTo: BadUser@our.domain no >FromOrTo: *@our.domain yes >FromOrTo: default no > >and blacklist such as: > >FromOrTo: BadUser@our.domain yes >FromOrTo: default no > >Will this allow all mail from everyone at our.domain to pass either way >with the exception of BadUser@our.domain? > >Steve Campbell >campbell@cnpapers.com -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mark at TIPPINGMAR.COM Mon Apr 14 20:43:47 2003 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:17:46 2006 Subject: MajorSophos update script rev. In-Reply-To: <5.2.1.1.2.20030414184625.023029a0@imap.ecs.soton.ac.uk> References: <3E9A903E.24768.1D3C7E93@localhost> Message-ID: <3E9AAD03.18564.1DACA906@localhost> Thanks Julian, http://www.tippingmar.com/majorsophos On 14 Apr 2003 at 18:47, Julian Field wrote: > If you store that on a www or ftp site, I will happily publish the URL in > the downloads page of www.mailscanner.info. > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support -- Mark W. Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave, Berkeley, CA 94704 visit our website at http://www.tippingmar.com From splee at PLEXIO.COM Mon Apr 14 20:56:20 2003 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: <5.2.1.1.2.20030414112602.02369e40@imap.ecs.soton.ac.uk> References: <1050181489.2016.189.camel@ralph.plexio.private> <5.2.1.1.2.20030414112602.02369e40@imap.ecs.soton.ac.uk> Message-ID: <1050350180.12801.571.camel@ralph.plexio.private> On Mon, 2003-04-14 at 03:27, Julian Field wrote: > Tony, > > A little request: any chance you might have time to update the Exim > installation instructions for Exim 4 please? > > I would like to keep it as 2 conf files for Exim rather than your setup > using only 1, as scanning mail generated on the server is quite important > for a lot of MailScanner users out there. > Many of my users use Squirrelmail (web-based mua), whether in the office or on the road. Since Squirrelmail runs on the same server as imap/exim, all mail is generated locally. Will the 1 exim.conf approach impact on this setup? Thanks, Stephen From mailscanner at ecs.soton.ac.uk Mon Apr 14 21:04:36 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: MajorSophos update script rev. In-Reply-To: <3E9AAD03.18564.1DACA906@localhost> References: <5.2.1.1.2.20030414184625.023029a0@imap.ecs.soton.ac.uk> <3E9A903E.24768.1D3C7E93@localhost> Message-ID: <5.2.1.1.2.20030414210401.02383cd0@imap.ecs.soton.ac.uk> Linked from the downloads page. I'm definitely going to use this one myself, very handy :-) At 20:43 14/04/2003, you wrote: >Thanks Julian, > >http://www.tippingmar.com/majorsophos > > >On 14 Apr 2003 at 18:47, Julian Field wrote: > > > If you store that on a www or ftp site, I will happily publish the URL in > > the downloads page of www.mailscanner.info. > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support > > >-- >Mark W. Nienberg, SE >Tipping Mar + associates >1906 Shattuck Ave, Berkeley, CA 94704 >visit our website at http://www.tippingmar.com -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Mon Apr 14 21:05:22 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: <1050350180.12801.571.camel@ralph.plexio.private> References: <5.2.1.1.2.20030414112602.02369e40@imap.ecs.soton.ac.uk> <1050181489.2016.189.camel@ralph.plexio.private> <5.2.1.1.2.20030414112602.02369e40@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030414210458.0264ac80@imap.ecs.soton.ac.uk> At 20:56 14/04/2003, you wrote: >On Mon, 2003-04-14 at 03:27, Julian Field wrote: > > Tony, > > > > A little request: any chance you might have time to update the Exim > > installation instructions for Exim 4 please? > > > > I would like to keep it as 2 conf files for Exim rather than your setup > > using only 1, as scanning mail generated on the server is quite important > > for a lot of MailScanner users out there. > > > >Many of my users use Squirrelmail (web-based mua), whether in the office >or on the road. Since Squirrelmail runs on the same server as imap/exim, >all mail is generated locally. Will the 1 exim.conf approach impact on >this setup? Yes. Hence my request for him to document the 2 conf file approach :-) -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From dot at DOTAT.AT Mon Apr 14 21:24:25 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: References: <1050181489.2016.189.camel@ralph.plexio.private> <5.2.1.1.2.20030414112602.02369e40@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030414112602.02369e40@imap.ecs.soton.ac.uk> Message-ID: Stephen Lee wrote: > >Many of my users use Squirrelmail (web-based mua), whether in the office >or on the road. Since Squirrelmail runs on the same server as imap/exim, >all mail is generated locally. Will the 1 exim.conf approach impact on >this setup? Yes, their email will not be scanned -- however since you have more control over this setup than over a computer that provides full shell access you can force the users (or rather Squirrelmail) to do the right thing. Instead of submitting email with `sendmail -t` (or whatever the exact command line is) you should configure it to use `exim -bd -odq -DSPOOL=/var/spool/exim.in -t`. Tony. -- f.a.n.finch http://dotat.at/ BISCAY EAST FITZROY: SOUTHEAST 4 OR 5, OCCASIONALLY 6 IN NORTH BISCAY AT FIRST. THUNDERY RAIN OR SHOWERS. MODERATE OR GOOD. From raymond at PROLOCATION.NET Mon Apr 14 21:39:47 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 In-Reply-To: Message-ID: Hi! > >all mail is generated locally. Will the 1 exim.conf approach impact on > >this setup? > Yes, their email will not be scanned -- however since you have more > control over this setup than over a computer that provides full shell > access you can force the users (or rather Squirrelmail) to do the > right thing. Instead of submitting email with `sendmail -t` (or > whatever the exact command line is) you should configure it to use > `exim -bd -odq -DSPOOL=/var/spool/exim.in -t`. By default you do a local delivery, but you can also connect to the real hostname, so it will be scanned after all. At least, works for me :) Update SMTP Settings : localhost:25 You can change the localhost to the name of your mx ... Bye, Raymond. From raymond at PROLOCATION.NET Tue Apr 15 08:24:51 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner In-Reply-To: <010501c3031f$ac6474c0$8201a8c0@Phoenix> Message-ID: Hi! > Guys any recommedation for an opensource virusscanner that works > similar with sophos, I would like to use an opensource viruscanner for > our mailscanner. ClamAV. Bye, Raymond. From glynn at MAKATI.TECHSQUARE.COM Tue Apr 15 08:21:43 2003 From: glynn at MAKATI.TECHSQUARE.COM (Glynn Condez) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner Message-ID: <010501c3031f$ac6474c0$8201a8c0@Phoenix> Hi everyone, Guys any recommedation for an opensource virusscanner that works similar with sophos, I would like to use an opensource viruscanner for our mailscanner. tia -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030415/d1410c4b/attachment.html From glynn at MAKATI.TECHSQUARE.COM Tue Apr 15 08:43:52 2003 From: glynn at MAKATI.TECHSQUARE.COM (Glynn Condez) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner References: Message-ID: <011901c30322$c2bf8a90$8201a8c0@Phoenix> Hi Raymond, Are you using ClamAV viruscanner incorporate with mailscanner? What should be the ClamAV version I should get the snapshot or stable? tia glynn > Hi! > > > Guys any recommedation for an opensource virusscanner that works > > similar with sophos, I would like to use an opensource viruscanner for > > our mailscanner. > > ClamAV. > > Bye, > Raymond. > From raymond at PROLOCATION.NET Tue Apr 15 08:41:02 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner In-Reply-To: <011901c30322$c2bf8a90$8201a8c0@Phoenix> Message-ID: Hi! > Are you using ClamAV viruscanner incorporate with mailscanner? > What should be the ClamAV version I should get the snapshot or stable? I am using f-prot mostly... Stable sounds ok to me, just have a go at it. Bye, Raymond. From glynn at MAKATI.TECHSQUARE.COM Tue Apr 15 08:51:21 2003 From: glynn at MAKATI.TECHSQUARE.COM (Glynn Condez) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner References: Message-ID: <013401c30323$ce78d570$8201a8c0@Phoenix> From: "Raymond Dijkxhoorn" F-Prot an opensource virus scanner? > I am using f-prot mostly... Stable sounds ok to me, just have a go at it. tia glynn From Jan-Peter.Koopmann at SECEIDOS.DE Tue Apr 15 08:46:51 2003 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:17:46 2006 Subject: Exim4 Message-ID: <4E7026FF8A422749B1553FE508E0068007F1BF@message.intern.akctech.de> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, > Yes. Hence my request for him to document the 2 conf file approach > :-) I have to agree with Julian - surprising isn't it :-) I personally prefer the two file approach as well. With the defer router you can make absolutely sure that NO mail is routed without being "mailscanned". And be honest: It is not that hard to work with two files at all. > Yes, their email will not be scanned -- however since you have more > control over this setup than over a computer that provides full > shell access you can force the users (or rather Squirrelmail) to > do the right thing. Instead of submitting email with `sendmail > -t` (or whatever the exact command line is) you should configure > it to use `exim -bd -odq -DSPOOL=/var/spool/exim.in -t`. And then you install a second product, forget to make this change and uups... That mail is not being scanned then. I stick with KISS (just in case: Keep It Simple Stupid). Once Exim/MailScanner is setup correctly it does not matter how dumb I or an other administrator in my network is: mail WILL have to pass MailScanner. Kind regards, JP -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQA/AwUBPpu468ljry2L+pqYEQIJXACdG1D6SZyQvZCQRd5cdJ0UaAwEcEwAniRI 8rHoAU2ENDBg+R/VJoJt2Z6s =fNSo -----END PGP SIGNATURE----- From Jan-Peter.Koopmann at SECEIDOS.DE Tue Apr 15 08:47:53 2003 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner Message-ID: <4E7026FF8A422749B1553FE508E0068007F1C0@message.intern.akctech.de> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > F-Prot an opensource virus scanner? No. But free for personal use. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQA/AwUBPpu5Kcljry2L+pqYEQLbKgCeLWskGSQ4EoQbgDJ3ZdTu4ECPIikAnAjY F+q6s+bKoGPDDZipDMc7ipsc =su6e -----END PGP SIGNATURE----- From raymond at PROLOCATION.NET Tue Apr 15 08:52:02 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner In-Reply-To: <013401c30323$ce78d570$8201a8c0@Phoenix> Message-ID: Hi! > F-Prot an opensource virus scanner? > > > I am using f-prot mostly... Stable sounds ok to me, just have a go at it. You didnt ask me if i use open source myself, you asked what i am using, thats a commerial product, f-prot, free for personal use btw. Clam has a smaller avirus database, but its free and open source, take your pick. I personally think f-prot has a very great pricing scheme for mailscanning. Bye, Raymond. From glynn at MAKATI.TECHSQUARE.COM Tue Apr 15 08:55:23 2003 From: glynn at MAKATI.TECHSQUARE.COM (Glynn Condez) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner References: <4E7026FF8A422749B1553FE508E0068007F1C0@message.intern.akctech.de> Message-ID: <014001c30324$608ee7b0$8201a8c0@Phoenix> From: "Jan-Peter Koopmann" > > F-Prot an opensource virus scanner? > > No. But free for personal use. Okay. Im going to use the virus scanner for something production. I think I should go with ClamAV? tia From raymond at PROLOCATION.NET Tue Apr 15 08:53:35 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:46 2006 Subject: Opensource Virusscanner In-Reply-To: <014001c30324$608ee7b0$8201a8c0@Phoenix> Message-ID: Hi! > > > F-Prot an opensource virus scanner? > > No. But free for personal use. > Okay. Im going to use the virus scanner for something production. I think I > should go with ClamAV? Thats up to you ? :) I would rather go for something like f-prot or sophos in a production envirionment. Bye, Raymond From glynn at MAKATI.TECHSQUARE.COM Tue Apr 15 09:04:16 2003 From: glynn at MAKATI.TECHSQUARE.COM (Glynn Condez) Date: Thu Jan 12 21:17:47 2006 Subject: Opensource Virusscanner References: Message-ID: <015801c30325$9c8ac800$8201a8c0@Phoenix> Thanks alot guys, now i should think what should i use. maybe ill try first the opensource Clam. tia glen From Kevin.Spicer at BMRB.CO.UK Tue Apr 15 09:08:38 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:47 2006 Subject: Opensource Virusscanner Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4AD72@pascal.priv.bmrb.co.uk> > Okay. Im going to use the virus scanner for something > production. I think I > should go with > ClamAV? > I run MailScanner in two places, on our coporate mail server and on my home machine. At work it runs with Sophos and ClamAV and at home I use F-prot and ClamAV. Whilst Clam has proven stable and has (as far as I can recall) caught everything the commercial virus scanners caught I would not recommend using it alone because it sometime is not so quick off the mark with updates, and there was an occaision lately where the update server was unavailable for a substantial period of time. My strategy is to use a commercial scanner, with Clam as a backup in case something goes wrong with the commercial scanner updates (This is particularly handy at work where Sophos needs to be updated every three months). BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dot at DOTAT.AT Tue Apr 15 13:12:54 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:47 2006 Subject: Exim4 In-Reply-To: Message-ID: Jan-Peter Koopmann wrote: > >> Yes, their email will not be scanned -- however since you have more >> control over this setup than over a computer that provides full >> shell access you can force the users (or rather Squirrelmail) to >> do the right thing. Instead of submitting email with `sendmail >> -t` (or whatever the exact command line is) you should configure >> it to use `exim -bd -odq -DSPOOL=3D/var/spool/exim.in -t`. =20 > >And then you install a second product, forget to make this change and >uups... That mail is not being scanned then. Right. It wasn't intended for use in that situation, but for use on a mail exchanger that does nothing but relay email via SMTP. Tony. -- f.a.n.finch http://dotat.at/ CROMARTY FORTH TYNE: SOUTHEAST 5 OR 6, OCCASIONALLY 7 AT FIRST. MAINLY FAIR. MODERATE OR POOR, OCCASIONALLY GOOD LATER. From Peter.Bates at LSHTM.AC.UK Tue Apr 15 14:20:26 2003 From: Peter.Bates at LSHTM.AC.UK (Peter Bates) Date: Thu Jan 12 21:17:47 2006 Subject: Postfix support -- beta release Message-ID: Hello all... > mailscanner@ECS.SOTON.AC.UK 13/04/03 17:38:21 >>> >Well folks, it's out there. Just posted 4.15-2 which includes support for >Postfix and ZMailer. It also includes the updated f-prot-wrapper which >will solve problems for people running F-Prot with a ramdisk or tmpfs. As a Postfix user, I've noticed two things trying out the new version (or the Beta support)... Firstly, a slew of errors at startup, as the second instance of Postfix (or rather, the 'incoming' instance configured from /etc/postfix.in) didn't have the same chroot jail stuff in /var/spool/postfix.in ... Copying the stuff in, however, lead to my second problem... mail working fine (i.e. relaying), but not being scanned at all by MS, and passing straight through... Has anyone out there testing this got a copy of master.cf I could look at (from either or both of the 'incoming' and 'outgoing' Postfix dirs)... Ta... ---------------------------------------------------------------------------------------------------> Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-958 8353 / Fax: 0207- 636 9838 From mailscanner at ecs.soton.ac.uk Tue Apr 15 14:37:46 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Postfix support -- beta release In-Reply-To: Message-ID: <5.2.0.9.2.20030415143503.030db730@imap.ecs.soton.ac.uk> At 14:20 15/04/2003, you wrote: >Hello all... > > > mailscanner@ECS.SOTON.AC.UK 13/04/03 17:38:21 >>> > >Well folks, it's out there. Just posted 4.15-2 which includes support for > >Postfix and ZMailer. It also includes the updated f-prot-wrapper which > >will solve problems for people running F-Prot with a ramdisk or tmpfs. > >As a Postfix user, I've noticed two things trying out the new version (or >the Beta support)... > >Firstly, a slew of errors at startup, as the second instance of Postfix >(or rather, the 'incoming' instance configured from /etc/postfix.in) >didn't have the same chroot jail stuff in /var/spool/postfix.in ... You shouldn't need that. >Copying the stuff in, however, lead to my second problem... mail working >fine (i.e. relaying), but not being scanned at all by MS, and passing >straight through... Are you sure you've got the "defer_transports" setting in /etc/postfix.in/main.cf? The incoming postfix should just dump everything in the "deferred" queue (/var/spool/postfix.in/deferred). >Has anyone out there testing this got a copy of master.cf I could look at >(from either or both of the 'incoming' and 'outgoing' Postfix dirs)... From my setup, the relevant bits of /etc/postfix.in/main.cf are defer_transports = smtp local virtual queue_directory = /var/spool/postfix.in -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From campbell at CNPAPERS.COM Tue Apr 15 18:55:16 2003 From: campbell at CNPAPERS.COM (Stephe Campbell) Date: Thu Jan 12 21:17:47 2006 Subject: Catch 22 Whitelist & BlackList References: <5.2.1.1.2.20030414202522.0223b008@imap.ecs.soton.ac.uk> Message-ID: <002101c30378$2c0cc8a0$5e01a8c0@cnpapers.net> Clarification then, please: A match for a "yes" and a match for a "no" are both matches, and will then terminate the scan through the table of whitelists and proceed to the blacklist to scan for matches (which you have indicated will override the whitelist match)? I have to say to all: I never imagined the many ways to use MailScanner when I first started using it. The flexibility of this application is amazing once you learn the ins and outs. Thank you very much Steve Campbell ----- Original Message ----- From: "Julian Field" To: Sent: Monday, April 14, 2003 3:27 PM Subject: Re: Catch 22 Whitelist & BlackList > The rules are processed in top to bottom order. The default rule is used > only if none of the other rules match. The whitelist check is done before > the blacklist check, and will over-ride it. > > At 19:50 14/04/2003, you wrote: > >We have someone spoofing mail to and from a particular user at one of our > >domains. I would like to get rid of all of this mail. Some of this is > >spoofed to the user and some is bounced back to the user. I can not locate > >where it is originating. If I set up whitelisting such as: > > > >FromOrTo: BadUser@our.domain no > >FromOrTo: *@our.domain yes > >FromOrTo: default no > > > >and blacklist such as: > > > >FromOrTo: BadUser@our.domain yes > >FromOrTo: default no > > > >Will this allow all mail from everyone at our.domain to pass either way > >with the exception of BadUser@our.domain? > > > >Steve Campbell > >campbell@cnpapers.com > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support From joe at QITC.CO.UK Tue Apr 15 19:00:03 2003 From: joe at QITC.CO.UK (Joe Quinn) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages Message-ID: <089d01c30378$d75b7580$ac720550@T20> Hi folks, I'm still trying to get certain messages deleted with a "To" address. I've tried this but the messages still get through and I have delete high score set to yes in the mailscanner conf. In /etc/MailScanner/spam.assassin.prefs.conf >>> header KELTICA_MEDIA To =~ /admin@keltica-media.co.uk/i describe KELTICA_MEDIA To: admin@keltica-media.co.uk score KELTICA_MEDIA 100.0 <<< Any ideas? Joe Quinn, QITC Internet Solutions (joe@qitc.co.uk) Cisco re-seller, Cobalt Sapphire Partner. www.qitc.net/stocklist Web Site Hosting, Server Hosting, Co-location. Tel: (UK) +44 776 737 1234 From kevins at BMRB.CO.UK Tue Apr 15 19:07:48 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174F95@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174F95@pascal.priv.bmrb.co.uk> Message-ID: <1050430078.6068.2.camel@bach.kevinspicer.co.uk> If you just want to delete all mail to that address why don't you just add them to sendmail's access db as a REJECT (or whatever the equivalent on exim is)? On Tue, 2003-04-15 at 19:00, Joe Quinn wrote: Hi folks, I'm still trying to get certain messages deleted with a "To" address. I've tried this but the messages still get through and I have delete high score set to yes in the mailscanner conf. In /etc/MailScanner/spam.assassin.prefs.conf >>> header KELTICA_MEDIA To =~ /admin@keltica-media.co.uk/i describe KELTICA_MEDIA To: admin@keltica-media.co.uk score KELTICA_MEDIA 100.0 <<< Any ideas? Joe Quinn, QITC Internet Solutions (joe@qitc.co.uk) Cisco re-seller, Cobalt Sapphire Partner. www.qitc.net/stocklist Web Site Hosting, Server Hosting, Co-location. Tel: (UK) +44 776 737 1234 BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From kevins at BMRB.CO.UK Tue Apr 15 19:16:08 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174F95@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174F95@pascal.priv.bmrb.co.uk> Message-ID: <1050430568.6068.10.camel@bach.kevinspicer.co.uk> >>> header KELTICA_MEDIA To =~ /admin@keltica-media.co.uk/i describe KELTICA_MEDIA To: admin@keltica-media.co.uk score KELTICA_MEDIA 100.0 <<< This is testing the headers, not the envelope address. Its possible that the original mail doesn't contain the address in a To: header (especially if its spam). I'm not sure what the RFC's say but I wouldn't be at all surprised if some MTA's / mail clients don't add missing To: headers (In which case the delivered mail may contain To: headers that are not present when SA checks). BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From joe at QITC.CO.UK Tue Apr 15 19:32:47 2003 From: joe at QITC.CO.UK (Joe Quinn) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages References: <5C0296D26910694BB9A9BBFC577E7AB001174F95@pascal.priv.bmrb.co.uk> <1050430078.6068.2.camel@bach.kevinspicer.co.uk> Message-ID: <08ca01c3037d$6a0c1d40$ac720550@T20> > If you just want to delete all mail to that address why don't you just > add them to sendmail's access db as a REJECT (or whatever the equivalent > on exim is)? > It's only that username on that domain I want to reject, I need the domain to receive everything else. Cheers, Joe From mike at ZANKER.ORG Tue Apr 15 19:36:40 2003 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <08ca01c3037d$6a0c1d40$ac720550@T20> References: <5C0296D26910694BB9A9BBFC577E7AB001174F95@pascal.priv.bmrb.co .uk> <1050430078.6068.2.camel@bach.kevinspicer.co.uk> <08ca01c3037d$6a0c1d40$ac720550@T20> Message-ID: <74225734.1050435400@jemima.zanker.org> On 15 April 2003 19:32 +0100 Joe Quinn wrote: > It's only that username on that domain I want to reject, I need the > domain to receive everything else. You can still do that with the access db - just specify the whole e-mail address. Mike. From kevins at BMRB.CO.UK Tue Apr 15 19:43:20 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174F98@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174F98@pascal.priv.bmrb.co.uk> Message-ID: <1050432201.6069.21.camel@bach.kevinspicer.co.uk> On Tue, 2003-04-15 at 19:32, Joe Quinn wrote: > If you just want to delete all mail to that address why don't you just > add them to sendmail's access db as a REJECT (or whatever the equivalent > on exim is)? > It's only that username on that domain I want to reject, I need the domain to receive everything else. You can certainly do that with sendmail, I've been setting something similar up myself over the last couple of days and did a bit of testing. Even if the message is addressed to the user you are blocking and ANother@yourdomain.com ANother still gets the message. Heres the structure of my access db # Default allow localhost localhost.localdomain RELAY # My domains mydomain.com RELAY myotherdomain.com RELAY # Stop 'Out Of Office' replies to some machines that send out alerts To:somebox.mydomain.com DISCARD To:someotherbox.mydomain.com DISCARD # Reject these users who have left # but seem to be on every spam list on the planet To:some.luser@mydomain.com REJECT To:another.luser@mydomain.com REJECT etc.... BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dot at DOTAT.AT Tue Apr 15 19:51:52 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: Message-ID: Joe Quinn wrote: > >I'm still trying to get certain messages deleted with a "To" address. I've tried this but the >messages still get through and I have delete high score set to yes in the mailscanner conf. > >In /etc/MailScanner/spam.assassin.prefs.conf > >>>> >header KELTICA_MEDIA To =~ /admin@keltica-media.co.uk/i >describe KELTICA_MEDIA To: admin@keltica-media.co.uk >score KELTICA_MEDIA 100.0 ><<< > >Any ideas? I sent an email to Julian about this a couple of weeks ago. The default spam.assassin.prefs.conf is misleading. MailScanner's spam.assassin.prefs.conf is a user preferences file, and SpamAssassin doesn't let you define rules in a user preferences file (though it does let you change their scores). If you turn on the MailScanner configuration options "Debug" and "Debug SpamAssassin" you'll see it complaining that the above lines are invalid and have been ignored. To work around the problem you should put those lines in SpamAssassin's local.cf which it looks for in '/usr/local/etc/spamassassin', '/usr/pkg/etc/spamassassin', '/usr/etc/spamassassin', '/etc/mail/spamassassin', '/etc/spamassassin', and if you don't like any of those places you can use the (undocumented) MailScanner configuration option "SpamAssassin Local Rules Dir". Tony. -- f.a.n.finch http://dotat.at/ LANDS END TO ST DAVIDS HEAD INCLUDING THE BRISTOL CHANNEL: EAST OR SOUTHEAST 3 OR 4, PERHAPS LOCALLY 5. MOSTLY FAIR PERHAPS AN ISOLATED SHOWER. GOOD SEA STATE: SLIGHT, LOCALLY MODERATE IN WEST. From joe at QITC.CO.UK Tue Apr 15 20:15:52 2003 From: joe at QITC.CO.UK (Joe Quinn) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages References: <5C0296D26910694BB9A9BBFC577E7AB001174F98@pascal.priv.bmrb.co.uk> <1050432201.6069.21.camel@bach.kevinspicer.co.uk> Message-ID: <092001c30383$6ef4ec50$ac720550@T20> > On Tue, 2003-04-15 at 19:32, Joe Quinn wrote: > > > If you just want to delete all mail to that address why don't you just > > add them to sendmail's access db as a REJECT (or whatever the > equivalent > > on exim is)? > > > It's only that username on that domain I want to reject, I need the > domain to receive everything > else. > > You can certainly do that with sendmail, I've been setting something > similar up myself over the last couple of days and did a bit of > testing. Even if the message is addressed to the user you are blocking > and ANother@yourdomain.com ANother still gets the message. > > Heres the structure of my access db > > # Default allow localhost > localhost.localdomain RELAY > # My domains > mydomain.com RELAY > myotherdomain.com RELAY > # Stop 'Out Of Office' replies to some machines that send out alerts > To:somebox.mydomain.com DISCARD > To:someotherbox.mydomain.com DISCARD > # Reject these users who have left > # but seem to be on every spam list on the planet > To:some.luser@mydomain.com REJECT > To:another.luser@mydomain.com REJECT > > etc.... Tried this, it didn't work. Thanks anyway, Joe From joe at QITC.CO.UK Tue Apr 15 20:14:59 2003 From: joe at QITC.CO.UK (Joe Quinn) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages References: <5C0296D26910694BB9A9BBFC577E7AB001174F95@pascal.priv.bmrb.co .uk> <1050430078.6068.2.camel@bach.kevinspicer.co.uk> <08ca01c3037d$6a0c1d40$ac720550@T20> <74225734.1050435400@jemima.zanker.org> Message-ID: <091a01c30383$501b6e80$ac720550@T20> > You can still do that with the access db - just specify the whole > e-mail address. Tried this, no joy :-( Thanks anyway, Joe From joe at QITC.CO.UK Tue Apr 15 20:16:39 2003 From: joe at QITC.CO.UK (Joe Quinn) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages References: Message-ID: <092601c30383$8abff1a0$ac720550@T20> Subject: Re: Deleting high score messages > Joe Quinn wrote: > > > >I'm still trying to get certain messages deleted with a "To" address. I've tried this but the > >messages still get through and I have delete high score set to yes in the mailscanner conf. > > > >In /etc/MailScanner/spam.assassin.prefs.conf > > > >>>> > >header KELTICA_MEDIA To =~ /admin@keltica-media.co.uk/i > >describe KELTICA_MEDIA To: admin@keltica-media.co.uk > >score KELTICA_MEDIA 100.0 > ><<< > > > >Any ideas? > > I sent an email to Julian about this a couple of weeks ago. The > default spam.assassin.prefs.conf is misleading. MailScanner's > spam.assassin.prefs.conf is a user preferences file, and SpamAssassin > doesn't let you define rules in a user preferences file (though it does > let you change their scores). If you turn on the MailScanner configuration > options "Debug" and "Debug SpamAssassin" you'll see it complaining that > the above lines are invalid and have been ignored. > > To work around the problem you should put those lines in SpamAssassin's > local.cf which it looks for in '/usr/local/etc/spamassassin', > '/usr/pkg/etc/spamassassin', '/usr/etc/spamassassin', > '/etc/mail/spamassassin', '/etc/spamassassin', and if you don't like any > of those places you can use the (undocumented) MailScanner configuration > option "SpamAssassin Local Rules Dir". > > Tony. Tried this, it didn't work. Thanks anyway, Joe From kevins at BMRB.CO.UK Tue Apr 15 20:26:14 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174F9D@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174F9D@pascal.priv.bmrb.co.uk> Message-ID: <1050434774.6068.37.camel@bach.kevinspicer.co.uk> > To:some.luser@mydomain.com REJECT > To:another.luser@mydomain.com REJECT > > etc.... Tried this, it didn't work. Thanks anyway, Thats v odd. Works fine for me. Two possible problems spring to mind... a) Are you sure that the address you are blocking is the envelope to address (check the mail logs??) b) [Checking the obvious, no offense meant!...] you did do makemap hash /etc/mail/access < /etc/mail/access service MailScanner restart didn't you? BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dgeorgiades at POWERENG.COM Tue Apr 15 20:27:30 2003 From: dgeorgiades at POWERENG.COM (Derrick Georgiades) Date: Thu Jan 12 21:17:47 2006 Subject: Possible spoofing causing problems with whitelisting? Message-ID: This is an odd one. A user received a piece of junk mail today that was whitelisted, I do not know why it was whitelisted. The user@mydomain.com is not whitelisted nor the sender. I do whitelist everything from *@mydomain.com. But what is interesting is the Received lines in the header. It originates from 191.146.230.212 and claims to be received from the ip of my server, however the next received line has my server ip but with an ip that was resolved that is not mine, then it claims that my server received it from itself, then onto my internal exchange server. This is not what a typical header looks like for my site. Below is a copy of the header. I have changed the DNS name of my server to "gatewayserver" and the ip to "gatewayserverip". Any ideas why the email would be whitelisted? Is there anything suspicious about the header? Thanks Derrick Georgiades Power Engineers, Inc. Received: from gatewayserver by exchangeserver with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21) id 2KR7L08K; Tue, 15 Apr 2003 07:21:23 -0600 Received: from gatewayserverip ([61.129.112.58]) by gatewayserver (8.12.8/8.12.8) with SMTP id h3FDKPpo009805; Tue, 15 Apr 2003 07:20:28 -0600 (MDT) Received: from 0jg9t.j3gm5z.net [191.146.230.212] by gatewayserverip; Tue, 15 Apr 2003 20:18:03 -0700 Message-ID: <79gcjv90l5977sp0$fs3mac$478$d94@g137.18.l.bu8l> From: "Robyn Richey" To: user@mydomain.com Subject: Re:how to make large profits on eBay Date: Tue, 15 Apr 03 20:18:03 GMT X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_16B_C_0AC5.5_1BC" X-MailScanner: Found to be clean X-MailScanner-Information: Please contact the ISP for more information X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=16.9, required 4, CLICK_BELOW_CAPS, DATE_IN_FUTURE_06_12, FORGED_MUA_OUTLOOK, FROM_HAS_MIXED_NUMS, HOME_EMPLOYMENT, HTML_50_60, HTML_FONT_BIG, HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE, HTTP_USERNAME_USED, LINES_OF_YELLING, LINES_OF_YELLING_2, LINES_OF_YELLING_3, MIME_HTML_NO_CHARSET, MIME_HTML_ONLY, MISSING_MIMEOLE, OPPORTUNITY, REMOVE_PAGE, UPPERCASE_25_50, USERPASS, WORK_AT_HOME) This is a multi-part message in MIME format. --_16B_C_0AC5.5_1BC Content-Type: text/html Content-Transfer-Encoding: quoted-printable --_16B_C_0AC5.5_1BC-- -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030415/c53e4cff/attachment.html From craig at STRONG-BOX.NET Tue Apr 15 20:35:12 2003 From: craig at STRONG-BOX.NET (Craig Pratt) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <1050434774.6068.37.camel@bach.kevinspicer.co.uk> Message-ID: <601D2C18-6F79-11D7-9C54-000393B9390A@strong-box.net> On Tuesday, April 15, 2003, at 12:26 PM, Kevin Spicer wrote: >> To:some.luser@mydomain.com REJECT >> To:another.luser@mydomain.com REJECT >> >> etc.... > > Tried this, it didn't work. Uh, this doesn't look like the access DB file format. The "To:" prefix are not access db format. And the TABs are important. According to the comments in my access file, format is: # # # # ^^^^^^^^^ # (these are stops) # OK (accept mails even if other rules would reject them) # REJECT (reject mails even if other rules would accept them) # RELAY (relay this domain, implicit OK within other rules) # DISCARD (mail are discard) # # or an `###' RFC 821 compliant error code and some text, e.g. # # ERROR:"550 We don't accept mail from spammers" # # Examples: # #cyberspammer.com ERROR:"550 We don't accept mail from spammers" #sendmail.org OK #192.168 RELAY --- Craig Pratt Strongbox Network Services Inc. mailto:craig@strong-box.net -- This message checked for dangerous content by MailScanner on StrongBox. From Denis.Beauchemin at USHERBROOKE.CA Tue Apr 15 20:37:20 2003 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: References: Message-ID: <1050435440.2529.61.camel@dbeauchemin.si.usherbrooke.ca> Tony, I have many such lines in my spam.assassin.prefs.conf file and they work just fine. I use them to assign high scores to hoaxes and I see many every day. Never tried the new debug options though... Denis Le mar 15/04/2003 ? 14:51, Tony Finch a ?crit : > Joe Quinn wrote: > > > >I'm still trying to get certain messages deleted with a "To" address. I've tried this but the > >messages still get through and I have delete high score set to yes in the mailscanner conf. > > > >In /etc/MailScanner/spam.assassin.prefs.conf > > > >>>> > >header KELTICA_MEDIA To =~ /admin@keltica-media.co.uk/i > >describe KELTICA_MEDIA To: admin@keltica-media.co.uk > >score KELTICA_MEDIA 100.0 > ><<< > > > >Any ideas? > > I sent an email to Julian about this a couple of weeks ago. The > default spam.assassin.prefs.conf is misleading. MailScanner's > spam.assassin.prefs.conf is a user preferences file, and SpamAssassin > doesn't let you define rules in a user preferences file (though it does > let you change their scores). If you turn on the MailScanner configuration > options "Debug" and "Debug SpamAssassin" you'll see it complaining that > the above lines are invalid and have been ignored. > > To work around the problem you should put those lines in SpamAssassin's > local.cf which it looks for in '/usr/local/etc/spamassassin', > '/usr/pkg/etc/spamassassin', '/usr/etc/spamassassin', > '/etc/mail/spamassassin', '/etc/spamassassin', and if you don't like any > of those places you can use the (undocumented) MailScanner configuration > option "SpamAssassin Local Rules Dir". > > Tony. > -- > f.a.n.finch http://dotat.at/ > LANDS END TO ST DAVIDS HEAD INCLUDING THE BRISTOL CHANNEL: EAST OR SOUTHEAST 3 > OR 4, PERHAPS LOCALLY 5. MOSTLY FAIR PERHAPS AN ISOLATED SHOWER. GOOD SEA > STATE: SLIGHT, LOCALLY MODERATE IN WEST. -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From joe at QITC.CO.UK Tue Apr 15 20:39:42 2003 From: joe at QITC.CO.UK (Joe Quinn) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages References: <5C0296D26910694BB9A9BBFC577E7AB001174F9D@pascal.priv.bmrb.co.uk> <1050434774.6068.37.camel@bach.kevinspicer.co.uk> Message-ID: <096a01c30386$d3713aa0$ac720550@T20> From: "Kevin Spicer" > > To:some.luser@mydomain.com REJECT > > To:another.luser@mydomain.com REJECT > > > > etc.... > > Tried this, it didn't work. > > Thanks anyway, > > Thats v odd. Works fine for me. Two possible problems spring to > mind... > a) Are you sure that the address you are blocking is the envelope to > address (check the mail logs??) Here's the output from the log when I fired a test message at it; Apr 15 20:31:23 raq1 sendmail[30112]: UAA30112: from=, size=2753, class=0, pri=32753, nrcpts=1, msgid=<094401c30385$9bb61140$ac720550@T20>, proto=ESMTP, relay=mta05-svc.ntlworld.com [62.253.162.45] Apr 15 20:31:25 raq1 MailScanner[30080]: New Batch: Scanning 1 messages, 3179 bytes Apr 15 20:31:25 raq1 MailScanner[30080]: Spam Checks: Starting Apr 15 20:31:25 raq1 MailScanner[30108]: Using locktype = flock Apr 15 20:31:26 raq1 MailScanner[30080]: Virus and Content Scanning: Starting Apr 15 20:31:27 raq1 MailScanner[30080]: Uninfected: Delivered 1 messages Apr 15 20:31:27 raq1 sendmail[30118]: UAA30112: to=, delay=00:00:04, xdelay=00:00:00, mailer=local, stat=Sent > b) [Checking the obvious, no offense meant!...] you did do No offence is ever taken from advice I get from these mailing lists, it's how I learn things! > makemap hash /etc/mail/access < /etc/mail/access Done it again just to be sure. > service MailScanner restart > didn't you? Slightly different procedure on a RaQ but it has the same effect. Still no luck, the emails are still accepted. Regards, Joe From kevins at BMRB.CO.UK Tue Apr 15 20:40:54 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:47 2006 Subject: Possible spoofing causing problems with whitelisting? In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174FA0@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174FA0@pascal.priv.bmrb.co.uk> Message-ID: <1050435654.6069.43.camel@bach.kevinspicer.co.uk> On Tue, 2003-04-15 at 20:27, Derrick Georgiades wrote: This is an odd one. A user received a piece of junk mail today that was whitelisted, I do not know why it was whitelisted. The user@mydomain.com is not whitelisted nor the sender. I do whitelist everything from *@mydomain.com. But what is interesting is the Received lines in the header. It originates from 191.146.230.212 and claims to be received from the ip of my server, however the next received line has my server ip but with an ip that was resolved that is not mine, then it claims that my server received it from itself, then onto my internal exchange server. This is not what a typical header looks like for my site. Probably the spambot which sent this sent a HELO saying it was whatever your IP is. Then send a MAIL From:user@yourdomain.com. This would set the envelope from address (which doesn;t appear in the header) to be 'from' your domain. MS looks at the envelope not the header addresses so this would fool the whitelists. The answer is to whitelist your internal mail server IP's (or netblock if users send smtp mail directly to the MS server) rather than the domain name. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dot at DOTAT.AT Tue Apr 15 20:35:24 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: References: Message-ID: Joe Quinn wrote: >> >> I sent an email to Julian about this a couple of weeks ago. The >> default spam.assassin.prefs.conf is misleading. MailScanner's >> spam.assassin.prefs.conf is a user preferences file, and SpamAssassin >> doesn't let you define rules in a user preferences file (though it does >> let you change their scores). If you turn on the MailScanner configuration >> options "Debug" and "Debug SpamAssassin" you'll see it complaining that >> the above lines are invalid and have been ignored. > >Tried this, it didn't work. You should have tried turning on debugging. I did some work to improve this area, so you now get details such as Global symbol "@keltica" requires explicit package name at /opt/MailScanner/etc/mail/spamassassin/local.cf, rule KELTICA_MEDIA, line 1. Failed to run header SpamAssassin tests, skipping some: In string, @keltica now must be written as \@keltica at /opt/MailScanner/etc/mail/spamassassin/local.cf, rule KELTICA_MEDIA, line 1, near "admin@keltica" So you should try header KELTICA_MEDIA To =~ /admin\@keltica-media\.co\.uk/i describe KELTICA_MEDIA To: admin@keltica-media.co.uk score KELTICA_MEDIA 100.0 Tony. -- f.a.n.finch http://dotat.at/ SELSEY BILL TO LYME REGIS: EAST OR SOUTHEAST 3 OR 4, BECOMING 4. MOSTLY FAIR PERHAPS AN ISOLATED SHOWER, SOME HAZE. GOOD, LOCALLY MODERATE SEA STATE: SLIGHT. From kevins at BMRB.CO.UK Tue Apr 15 20:49:09 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174FA1@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174FA1@pascal.priv.bmrb.co.uk> Message-ID: <1050436149.6068.50.camel@bach.kevinspicer.co.uk> > Uh, this doesn't look like the access DB file format. > The "To:" prefix are not access db format. And the TABs are important. I'll agree with you about the TABS, I should have made that clear. However I'll have to differ about the To: prefix. This is new to more recent versions of sendmail (but by 'new' I mean last few years not months) - see the following extract from the sendmail-cf README for 8.12.6... Finer control by using tags for the LHS of the access map --------------------------------------------------------- Read this section only if the options listed so far are not sufficient for your purposes. There is now the option to tag entries in the access map according to their type. Three tags are available: Connect: connection information (${client_addr}, ${client_name}) From: envelope sender To: envelope recipient If the required item is looked up in a map, it will be tried first with the corresponding tag in front, then (as fallback to enable backward compatibility) without any tag, unless the specific feature requires a tag. For example, From:spammer@some.dom REJECT To:friend.domain RELAY Connect:friend.domain OK Connect:from.domain RELAY From:good@another.dom OK From:another.dom REJECT This would deny mails from spammer@some.dom but you could still send mail to that address even if FEATURE(`blacklist_recipients') is enabled. Your system will allow relaying to friend.domain, but not from it (unless enabled by other means). Connections from that domain will be allowed even if it ends up in one of the DNS based rejection lists. Relaying is enabled from from.domain but not to it (since relaying is based on the connection information for outgoing relaying, the tag Connect: must be used; for incoming relaying, which is based on the recipient address, To: must be used). The last two entries allow mails from good@another.dom but reject mail from all other addresses with another.dom as domain part. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dot at DOTAT.AT Tue Apr 15 20:49:35 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: References: Message-ID: Denis Beauchemin wrote: > >I have many such lines in my spam.assassin.prefs.conf file and they work >just fine. I use them to assign high scores to hoaxes and I see many >every day. You probably have allow_user_rules turned on somewhere. Tony. -- f.a.n.finch http://dotat.at/ ST DAVIDS HEAD TO COLWYN BAY, INCLUDING ST GEORGES CHANNEL: EAST OR SOUTHEAST OCCASIONALLY VARIABLE 3 OR 4, PERHAPS LOCALLY 5. MOSTLY FAIR PERHAPS AN ISOLATED SHOWER. GOOD SEA STATE: SLIGHT, LOCALLY MODERATE IN SOUTH. From dgeorgiades at POWERENG.COM Tue Apr 15 21:01:55 2003 From: dgeorgiades at POWERENG.COM (Derrick Georgiades) Date: Thu Jan 12 21:17:47 2006 Subject: Possible spoofing causing problems with whitelisting? Message-ID: Thanks, I wasn't aware that I could whitelist ip addresses. I will change my rules from- From: *@mydomain yes To this- From: 192.168.0.1 yes And all the other ip's of any systems that are internal that relay. Is this the proper way? What do you mean by "netblock"? I added the spammers ip to my sendmail access list for discarding. -----Original Message----- From: Kevin Spicer [mailto:kevins@BMRB.CO.UK] Sent: Tuesday, April 15, 2003 1:41 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Possible spoofing causing problems with whitelisting? On Tue, 2003-04-15 at 20:27, Derrick Georgiades wrote: This is an odd one. A user received a piece of junk mail today that was whitelisted, I do not know why it was whitelisted. The user@mydomain.com is not whitelisted nor the sender. I do whitelist everything from *@mydomain.com. But what is interesting is the Received lines in the header. It originates from 191.146.230.212 and claims to be received from the ip of my server, however the next received line has my server ip but with an ip that was resolved that is not mine, then it claims that my server received it from itself, then onto my internal exchange server. This is not what a typical header looks like for my site. Probably the spambot which sent this sent a HELO saying it was whatever your IP is. Then send a MAIL From:user@yourdomain.com. This would set the envelope from address (which doesn;t appear in the header) to be 'from' your domain. MS looks at the envelope not the header addresses so this would fool the whitelists. The answer is to whitelist your internal mail server IP's (or netblock if users send smtp mail directly to the MS server) rather than the domain name. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From kevins at BMRB.CO.UK Tue Apr 15 21:04:48 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174FA3@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174FA3@pascal.priv.bmrb.co.uk> Message-ID: <1050437089.6069.59.camel@bach.kevinspicer.co.uk> On Tue, 2003-04-15 at 20:39, Joe Quinn wrote: >> offense > offence Bugger! Does anyone know how to change Evolution to use British English :>) > makemap hash /etc/mail/access < /etc/mail/access > service MailScanner restart > didn't you? > Slightly different procedure on a RaQ but it has the same effect. >Still no luck, the emails are > still accepted. It's been pointed out that I didn't make it clear that you should use TABs not SPACEs in /etc/mail/access - you might like to check that. Is your sendmail configured to use the access db? [something like FEATURE(`access_db',`hash -o /etc/mail/access.db')dnl in sendmail.mc] Did the MailScanner restart restart both sendmail processes (particularly the listener)? I can't think of anything else right now that could stop it working. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From kevins at BMRB.CO.UK Tue Apr 15 21:09:06 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:47 2006 Subject: Possible spoofing causing problems with whitelisting? In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174FA8@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174FA8@pascal.priv.bmrb.co.uk> Message-ID: <1050437346.6069.64.camel@bach.kevinspicer.co.uk> On Tue, 2003-04-15 at 21:01, Derrick Georgiades wrote: Thanks, I wasn't aware that I could whitelist ip addresses. I will change my rules from- From: *@mydomain yes To this- From: 192.168.0.1 yes And all the other ip's of any systems that are internal that relay. Is this the proper way?# Yes - at least I hope so as that how I do it ;) What do you mean by "netblock"? I added the spammers ip to my sendmail access list for discarding. I just meant that if your users PC's send direct to your MS server you could include the whole range of IP addresses you use (block as in 'big lump' rather than as in 'prohibit'!) eg. From: 192.168.0. yes -----Original Message----- From: Kevin Spicer [mailto:kevins@BMRB.CO.UK] Sent: Tuesday, April 15, 2003 1:41 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Possible spoofing causing problems with whitelisting? On Tue, 2003-04-15 at 20:27, Derrick Georgiades wrote: This is an odd one. A user received a piece of junk mail today that was whitelisted, I do not know why it was whitelisted. The user@mydomain.com is not whitelisted nor the sender. I do whitelist everything from *@mydomain.com. But what is interesting is the Received lines in the header. It originates from 191.146.230.212 and claims to be received from the ip of my server, however the next received line has my server ip but with an ip that was resolved that is not mine, then it claims that my server received it from itself, then onto my internal exchange server. This is not what a typical header looks like for my site. Probably the spambot which sent this sent a HELO saying it was whatever your IP is. Then send a MAIL From:user@yourdomain.com. This would set the envelope from address (which doesn;t appear in the header) to be 'from' your domain. MS looks at the envelope not the header addresses so this would fool the whitelists. The answer is to whitelist your internal mail server IP's (or netblock if users send smtp mail directly to the MS server) rather than the domain name. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From joe at QITC.CO.UK Tue Apr 15 21:13:57 2003 From: joe at QITC.CO.UK (Joe Quinn) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages SUCCESS! References: Message-ID: <09b301c3038b$8c37a3e0$ac720550@T20> From: "Tony Finch" > >> I sent an email to Julian about this a couple of weeks ago. The > >> default spam.assassin.prefs.conf is misleading. MailScanner's > >> spam.assassin.prefs.conf is a user preferences file, and SpamAssassin > >> doesn't let you define rules in a user preferences file (though it does > >> let you change their scores). If you turn on the MailScanner configuration > >> options "Debug" and "Debug SpamAssassin" you'll see it complaining that > >> the above lines are invalid and have been ignored. > > > >Tried this, it didn't work. > > You should have tried turning on debugging. I did some work to improve > this area, so you now get details such as > > Global symbol "@keltica" requires explicit package name at /opt/MailScanner/etc/mail/spamassassin/local.cf, rule KELTICA_MEDIA, line 1. > Failed to run header SpamAssassin tests, skipping some: In string, @keltica now must be written as \@keltica at /opt/MailScanner/etc/mail/spamassassin/local.cf, rule KELTICA_MEDIA, line 1, near "admin@keltica" > > So you should try > > header KELTICA_MEDIA To =~ /admin\@keltica-media\.co\.uk/i > describe KELTICA_MEDIA To: admin@keltica-media.co.uk > score KELTICA_MEDIA 100.0 > > Tony. OUTSTANDING SUCCESS! I had to insert those lines in /etc/MailScanner/spam.assassin.prefs.conf as they had no effect in the spamassassin local.cf file. I've fired off several emails to different users on the domain and from different accounts of my own just to test it and it seems to work.......... :-))))) Thanks. Joe Quinn, QITC Internet Solutions (joe@qitc.co.uk) Cisco re-seller, Cobalt Sapphire Partner. www.qitc.net/stocklist Web Site Hosting, Server Hosting, Co-location. Tel: (UK) +44 776 737 1234 From mailscanner at ecs.soton.ac.uk Tue Apr 15 21:31:51 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Catch 22 Whitelist & BlackList In-Reply-To: <002101c30378$2c0cc8a0$5e01a8c0@cnpapers.net> References: <5.2.1.1.2.20030414202522.0223b008@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030415212159.0278eed8@imap.ecs.soton.ac.uk> At 18:55 15/04/2003, you wrote: >Clarification then, please: > >A match for a "yes" and a match for a "no" are both matches, and will then >terminate the scan through the table of whitelists and proceed to the >blacklist to scan for matches (which you have indicated will override the >whitelist match)? The rules are processed in top to bottom order until any rule matches (whether it's a yes or a no). If no rule matches after all have been tried, the "default" rule value is used. I'm just checking the code right now. What happens is this: Is the sender address whitelisted? If so, then get out and don't do any more spam checks. Is the sender address blacklisted? If so, then get out and don't do any more spam checks. Do the RBL checks, then the SA checks. So my previous message was wrong. The whitelist is done first. Having "yes" in the whitelist and "yes" in the blacklist will cause the message to be whitelisted. >I have to say to all: I never imagined the many ways to use MailScanner when >I first started using it. The flexibility of this application is amazing >once you learn the ins and outs. The configuration system is not quite as flexible as I would like (you can't write expressions in it) but it's 99% there, which is quite good enough for most people most of the time. And if I had written expression support in it, I bet that only a few people would ever work out how to use it anyway. Which is why the Custom Function support is there, so you can implement anything else you like. >Thank you very much Pleasure. >----- Original Message ----- >From: "Julian Field" >To: >Sent: Monday, April 14, 2003 3:27 PM >Subject: Re: Catch 22 Whitelist & BlackList > > > > The rules are processed in top to bottom order. The default rule is used > > only if none of the other rules match. The whitelist check is done before > > the blacklist check, and will over-ride it. > > > > At 19:50 14/04/2003, you wrote: > > >We have someone spoofing mail to and from a particular user at one of our > > >domains. I would like to get rid of all of this mail. Some of this is > > >spoofed to the user and some is bounced back to the user. I can not >locate > > >where it is originating. If I set up whitelisting such as: > > > > > >FromOrTo: BadUser@our.domain no > > >FromOrTo: *@our.domain yes > > >FromOrTo: default no > > > > > >and blacklist such as: > > > > > >FromOrTo: BadUser@our.domain yes > > >FromOrTo: default no > > > > > >Will this allow all mail from everyone at our.domain to pass either way > > >with the exception of BadUser@our.domain? > > > > > >Steve Campbell > > >campbell@cnpapers.com > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 15 21:41:45 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Possible spoofing causing problems with whitelisting? In-Reply-To: <1050437346.6069.64.camel@bach.kevinspicer.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174FA8@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB001174FA8@pascal.priv.bmrb.co.uk> Message-ID: <5.2.1.1.2.20030415214037.02732d28@imap.ecs.soton.ac.uk> The docs on what you can put in rulesets are at http://www.sng.ecs.soton.ac.uk/mailscanner/man/MailScanner.conf.3.html#RULESETS There are examples there of netblocks and IP expressions. At 21:09 15/04/2003, you wrote: >On Tue, 2003-04-15 at 21:01, Derrick Georgiades wrote: > >Thanks, >I wasn't aware that I could whitelist ip addresses. >I will change my rules from- >From: *@mydomain yes >To this- >From: 192.168.0.1 yes >And all the other ip's of any systems that are internal that relay. >Is this the proper way?# > >Yes - at least I hope so as that how I do it ;) > >What do you mean by "netblock"? I added the spammers ip to my sendmail >access list for discarding. > >I just meant that if your users PC's send direct to your MS server you >could include the whole range of IP addresses you use (block as in 'big >lump' rather than as in 'prohibit'!) eg. > >From: 192.168.0. yes > > >-----Original Message----- >From: Kevin Spicer [mailto:kevins@BMRB.CO.UK] >Sent: Tuesday, April 15, 2003 1:41 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Possible spoofing causing problems with whitelisting? > > >On Tue, 2003-04-15 at 20:27, Derrick Georgiades wrote: > >This is an odd one. A user received a piece of junk mail today that was >whitelisted, I do not know why it was whitelisted. The >user@mydomain.com is >not whitelisted nor the sender. I do whitelist everything from >*@mydomain.com. But what is interesting is the Received lines in the >header. It originates from 191.146.230.212 and claims to be received >from >the ip of my server, however the next received line has my server ip but >with an ip that was resolved that is not mine, then it claims that my >server >received it from itself, then onto my internal exchange server. This is >not >what a typical header looks like for my site. > >Probably the spambot which sent this sent a HELO saying it was whatever >your >IP is. Then send a MAIL From:user@yourdomain.com. This would set the >envelope from address (which doesn;t appear in the >header) to be 'from' your domain. MS looks at the envelope not the >header >addresses so this would fool the whitelists. The answer is to whitelist >your >internal mail server IP's (or netblock if users send smtp mail directly >to >the MS server) rather than the domain name. > > > > >BMRB International >http://www.bmrb.co.uk >+44 (0)20 8566 5000 >_________________________________________________________________ >This message (and any attachment) is intended only for the recipient and >may >contain confidential and/or privileged material. If you have received >this >in error, please contact the sender and delete this message immediately. >Disclosure, copying or other action taken in respect of this email or in >reliance on it is prohibited. BMRB International Limited accepts no >liability in relation to any personal emails, or content of any email >which >does not directly relate to our business. > > > > > > >BMRB International >http://www.bmrb.co.uk >+44 (0)20 8566 5000 >_________________________________________________________________ >This message (and any attachment) is intended only for the >recipient and may contain confidential and/or privileged >material. If you have received this in error, please contact the >sender and delete this message immediately. Disclosure, copying >or other action taken in respect of this email or in >reliance on it is prohibited. BMRB International Limited >accepts no liability in relation to any personal emails, or >content of any email which does not directly relate to our >business. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From jase at SENSIS.COM Tue Apr 15 21:42:05 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:47 2006 Subject: Opensource Virusscanner Message-ID: Just to let you know my experiences with Clam. For the most part, it has been pretty good. But I have come across one viruses in a zip file that it did not find. After manually unzipping the file, Clam would detect the virus. McAfee detected this virus in the zip file fine. So using Clam as a backup is a good idea. Using Clam by itself is better than nothing, but not perfect. Jason > -----Original Message----- > From: Spicer, Kevin [mailto:Kevin.Spicer@BMRB.CO.UK] > Sent: Tuesday, April 15, 2003 4:09 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Opensource Virusscanner > > > > Okay. Im going to use the virus scanner for something > > production. I think I > > should go with > > ClamAV? > > > > I run MailScanner in two places, on our coporate mail server > and on my home machine. At work it runs with Sophos and > ClamAV and at home I use F-prot and ClamAV. Whilst Clam has > proven stable and has (as far as I can recall) caught > everything the commercial virus scanners caught I would not > recommend using it alone because it sometime is not so quick > off the mark with updates, and there was an occaision lately > where the update server was unavailable for a substantial > period of time. My strategy is to use a commercial scanner, > with Clam as a backup in case something goes wrong with the > commercial scanner updates (This is particularly handy at > work where Sophos needs to be updated every three months). > > > > BMRB International > http://www.bmrb.co.uk > +44 (0)20 8566 5000 > _________________________________________________________________ > This message (and any attachment) is intended only for the > recipient and may contain confidential and/or privileged > material. If you have received this in error, please contact the > sender and delete this message immediately. Disclosure, copying > or other action taken in respect of this email or in > reliance on it is prohibited. BMRB International Limited > accepts no liability in relation to any personal emails, or > content of any email which does not directly relate to our > business. > From craig at STRONG-BOX.NET Tue Apr 15 21:50:30 2003 From: craig at STRONG-BOX.NET (Craig Pratt) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: <1050436149.6068.50.camel@bach.kevinspicer.co.uk> Message-ID: On Tuesday, April 15, 2003, at 12:49 PM, Kevin Spicer wrote: >> Uh, this doesn't look like the access DB file format. > >> The "To:" prefix are not access db format. And the TABs are important. > > I'll agree with you about the TABS, I should have made that clear. > However I'll have to differ about the To: prefix. This is new to more > recent versions of sendmail (but by 'new' I mean last few years not > months) - see the following extract from the sendmail-cf README for > 8.12.6... Strange - guess SuSE hasn't updated their example access file in a while - mine was from SuSE 8.1. I stand corrected - and better educated! Thanks Kevin. Hopefully, it's the tabs. Or maybe the access db is in the wrong directory? C > > Finer control by using tags for the LHS of the access map > --------------------------------------------------------- > > Read this section only if the options listed so far are not sufficient > for your purposes. There is now the option to tag entries in the > access map according to their type. Three tags are available: > > Connect: connection information (${client_addr}, > ${client_name}) > From: envelope sender > To: envelope recipient > > If the required item is looked up in a map, it will be tried first > with the corresponding tag in front, then (as fallback to enable > backward compatibility) without any tag, unless the specific feature > requires a tag. For example, > > From:spammer@some.dom REJECT > To:friend.domain RELAY > Connect:friend.domain OK > Connect:from.domain RELAY > From:good@another.dom OK > From:another.dom REJECT > > This would deny mails from spammer@some.dom but you could still > send mail to that address even if FEATURE(`blacklist_recipients') > is enabled. Your system will allow relaying to friend.domain, but > not from it (unless enabled by other means). Connections from that > domain will be allowed even if it ends up in one of the DNS based > rejection lists. Relaying is enabled from from.domain but not to > it (since relaying is based on the connection information for > outgoing relaying, the tag Connect: must be used; for incoming > relaying, which is based on the recipient address, To: must be > used). The last two entries allow mails from good@another.dom but > reject mail from all other addresses with another.dom as domain > part. > > > > > > > > BMRB International > http://www.bmrb.co.uk > +44 (0)20 8566 5000 > _________________________________________________________________ > This message (and any attachment) is intended only for the > recipient and may contain confidential and/or privileged > material. If you have received this in error, please contact the > sender and delete this message immediately. Disclosure, copying > or other action taken in respect of this email or in > reliance on it is prohibited. BMRB International Limited > accepts no liability in relation to any personal emails, or > content of any email which does not directly relate to our > business. > --- Craig Pratt Strongbox Network Services Inc. mailto:craig@strong-box.net -- This message checked for dangerous content by MailScanner on StrongBox. From dot at DOTAT.AT Tue Apr 15 21:53:45 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: References: Message-ID: Tony Finch wrote: >Denis Beauchemin wrote: >> >>I have many such lines in my spam.assassin.prefs.conf file and they work >>just fine. I use them to assign high scores to hoaxes and I see many >>every day. > >You probably have allow_user_rules turned on somewhere. Actually that's wrong -- I had too much faith in the error messages. If you have some local rules in your spam.assassin.prefs.conf and you run MailScanner with debugging on you will see near the end of the startup messages: debug: Failed to parse line in SpamAssassin configuration, skipping: header FROM_CRSID From =~ /\d\d\@([a-z0-9-+]\.)?cam\.ac\.uk/ However if you put an actual error in the file, you will see the following line *twice*, once near the start and once near the end: debug: Failed to parse line in SpamAssassin configuration, skipping: this_line_will_cause_an_error Which indicates that this patch would be appropriate: --- lib/MailScanner/SA.pm 4 Apr 2003 19:19:48 -0000 1.10 +++ lib/MailScanner/SA.pm 15 Apr 2003 20:38:20 -0000 @@ -129,7 +129,6 @@ # Need to delete lock file now or compile_now may never return unlink $MailScanner::SA::SABayesLock; $MailScanner::SA::SAspamtest->compile_now(); - $MailScanner::SA::SAspamtest->read_scoreonly_config($prefs); } } Tony. -- f.a.n.finch http://dotat.at/ ARDNAMURCHAN POINT TO CAPE WRATH INCLUDING THE OUTER HEBRIDES: SOUTHEAST 5, OCCASIONALLY 3 OR 4. FAIR, PERHAPS A SHOWER LATER ON WEDNESDAY VISIBILITY: GOOD. SLIGHT OR MODERATE. From mailscanner at ecs.soton.ac.uk Tue Apr 15 22:14:44 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: References: Message-ID: <5.2.1.1.2.20030415221202.023662c8@imap.ecs.soton.ac.uk> At 21:53 15/04/2003, you wrote: >Tony Finch wrote: > >Denis Beauchemin wrote: > >> > >>I have many such lines in my spam.assassin.prefs.conf file and they work > >>just fine. I use them to assign high scores to hoaxes and I see many > >>every day. > > > >You probably have allow_user_rules turned on somewhere. > >Actually that's wrong -- I had too much faith in the error messages. >If you have some local rules in your spam.assassin.prefs.conf and you >run MailScanner with debugging on you will see near the end of the >startup messages: > >debug: Failed to parse line in SpamAssassin configuration, skipping: >header FROM_CRSID From =~ /\d\d\@([a-z0-9-+]\.)?cam\.ac\.uk/ > >However if you put an actual error in the file, you will see the >following line *twice*, once near the start and once near the end: > >debug: Failed to parse line in SpamAssassin configuration, skipping: >this_line_will_cause_an_error > >Which indicates that this patch would be appropriate: > >--- lib/MailScanner/SA.pm 4 Apr 2003 19:19:48 -0000 1.10 >+++ lib/MailScanner/SA.pm 15 Apr 2003 20:38:20 -0000 >@@ -129,7 +129,6 @@ > # Need to delete lock file now or compile_now may never return > unlink $MailScanner::SA::SABayesLock; > $MailScanner::SA::SAspamtest->compile_now(); >- $MailScanner::SA::SAspamtest->read_scoreonly_config($prefs); > } > } I don't know about anyone else, but I'm getting a little lost here. Denis puts rules and scores in spam.assassin.prefs.conf and says they work fine. Tony says that it can't, which does rather contradict Denis's empirical evidence. And removing the read_scoreonly_config() call will result in the spam.assassin.prefs.conf file not being used at all, which surely can't be right. So what version of this story is consistent with both Tony and Denis's working setups? And how is the spam.assassin.prefs.conf file supposed to be used? -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From admin at thenamegame.com Tue Apr 15 22:32:52 2003 From: admin at thenamegame.com (Michael Szabados) Date: Thu Jan 12 21:17:47 2006 Subject: Exim+Mailscanner duplicate message scans Message-ID: <0ba701c30396$91e3a9a0$6401a8c0@thenamegame.com> Hello, Im running Exim+Mailscanner and my current configuration works great but i am a little confused about the scanning messages in /var/log/maillog. When a msg comes it i see duplicate msgs in maillog. Either its being scanned twice or Mailscanner is recording it as being scanned twice; Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Found 2 messages waiting Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Found 2 messages waiting Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Scanning 1 messages, 12850 bytes Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Scanning 1 messages, 12850 bytes Apr 15 12:39:05 srv05 MailScanner[19913]: Spam Checks: Starting Apr 15 12:39:05 srv05 MailScanner[19913]: Spam Checks: Starting Also, if you look at the msg above you will see 2 msgs in NEW BATCH but it says only 1 is being scanned? I dont understand this. Does that mean only one msg was scanned and why the duplicates? Is that just the way it works with Exim? Thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030415/80820336/attachment.html From dot at DOTAT.AT Tue Apr 15 22:49:30 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:47 2006 Subject: Deleting high score messages In-Reply-To: References: Message-ID: Julian Field wrote: > >I don't know about anyone else, but I'm getting a little lost here. Denis >puts rules and scores in spam.assassin.prefs.conf and says they work fine. >Tony says that it can't, which does rather contradict Denis's empirical >evidence. And removing the read_scoreonly_config() call will result in the >spam.assassin.prefs.conf file not being used at all, which surely can't be >right. If you look at SpamAssassin::init (called from compile_now) you'll see that it loads the userprefs file along with the rest of the configuration. (I didn't see this earlier.) At this time additional rules *are* accepted. MailScanner then calls read_scoreonly_config which loads the userprefs file a second time, but this time rules are not accepted and it reports errors in debug mode (which fooled me). This second step is redundant. Tony. -- f.a.n.finch http://dotat.at/ LYME REGIS TO LANDS END INCLUDING THE ISLES OF SCILLY: EAST OR SOUTHEAST 3 OR 4, BECOMING SOUTHEAST 4, LOCALLY 5 IN WEST. MOSTLY FAIR PERHAPS AN ISOLATED SHOWER. GOOD SEA STATE: SLIGHT, LOCALLY MODERATE. From brose at MED.WAYNE.EDU Tue Apr 15 22:59:35 2003 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:17:47 2006 Subject: Mailscanner and restart Message-ID: I've noticed that after updating to 4.14.9 that it seems to have problems with child processes dying for some reason until there aren't enough to do the job. I just noticed about 1300 messages in mqueue.in and found that the there were only 3 mailscanner processes running. Has anyone else been seeing this? I'm running on Solaris 8, perl 5.6.1, and I start using check_mailscanner and have been running v4 for quite awhile so I do have so MS experience under the belt and haven't seen this with the previous versions. -=Bobby -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030415/03fdf26c/attachment.html From admin at thenamegame.com Tue Apr 15 23:10:38 2003 From: admin at thenamegame.com (Michael Szabados) Date: Thu Jan 12 21:17:47 2006 Subject: Exim, 1,300 message loop out of control. Message-ID: <0bc401c3039b$d8cddc50$6401a8c0@thenamegame.com> We had a very interesting situation arise yesterday that i have never seen before. Call it a spoof, a spam attack of somekind, Mailscanner going out of control and looping. I dont know what it was exactly but here is what happend. We are runing MailScanner 4.13+ Exim Around 1pm i noticed 100's of emails being pumped out from our server. It was being delivered to a user named pornomag6999@yaho.com. By this time over 600msgs have left my server. I spent the next 5hrs trying to get this under control without too much success. What i noticed was that if shutdown MailScanner and just let Exim do the work the messages stopped sending. Anyhow i finally decided to just stop MailScanner for the next 6hrs to see if this was happening by just letting Exim do the work. No more messages were sent out to this user but by the time i got a clue i over 1,300 msg had left my server. After doing some investigation i came to the conclusion that one of our sites has a E-Greeting card site where a user can send a greeting card to other users. Well this is what we found out after working with the site owner. Whoever entered the address pornomag6999@yaho.com also used pornomag6999@yaho.com as the receipient. Call this a malicous user if you want but it seems he knew exactly what to do to throw our mailling system into a whirl. I left MailScanner offline till i re enabled it this morning. Any chance that MailScanner is the culprit here? I mean by turning MailScanner off completely those messages stopped. I cleaned out the retry db's this morning and restart MailScanner and its working just fine right now. I also banned this userid in the Exim.conf but wasnt sure how to ban the user in MailScanner. Thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030415/05823613/attachment.html From dot at DOTAT.AT Wed Apr 16 00:18:49 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:47 2006 Subject: The joy of software Message-ID: :; uvscan '' Segmentation fault (core dumped) Tony. -- f.a.n.finch http://dotat.at/ EAST DOGGER FISHER GERMAN BIGHT: EAST OR SOUTHEAST 4 OR 5, OCCASIONALLY 6. FAIR. MAINLY MODERATE. From festus at DNSDATA.COM Wed Apr 16 00:51:22 2003 From: festus at DNSDATA.COM (Bob Fayne) Date: Thu Jan 12 21:17:47 2006 Subject: Klez not silent? Message-ID: On Mon, 14 Apr 2003 12:09:29 +0100, Julian Field wrote: >>Shouldn't MailScanner just delete that message? I'm not sure why it's >>still getting delivered. > >Can you confirm that the batch of messages was only 1 message? If it was 2 >messages then the log lines would match what I expect. Otherwise there >might be a bug in the Clam output parser. It was written by >. Where is the code for the Clam output parser in MailScanner? I'd like to see what it's doing. Thanks. From festus at DNSDATA.COM Wed Apr 16 00:51:22 2003 From: festus at DNSDATA.COM (Bob Fayne) Date: Thu Jan 12 21:17:47 2006 Subject: Klez not silent? Message-ID: On Mon, 14 Apr 2003 12:09:29 +0100, Julian Field wrote: >>Shouldn't MailScanner just delete that message? I'm not sure why it's >>still getting delivered. > >Can you confirm that the batch of messages was only 1 message? If it was 2 >messages then the log lines would match what I expect. Otherwise there >might be a bug in the Clam output parser. It was written by >. Where is the code for the Clam output parser in MailScanner? I'd like to see what it's doing. Thanks. From mailscanner at ecs.soton.ac.uk Wed Apr 16 09:12:00 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Exim+Mailscanner duplicate message scans In-Reply-To: <0ba701c30396$91e3a9a0$6401a8c0@thenamegame.com> Message-ID: <5.2.0.9.2.20030416091109.03058458@imap.ecs.soton.ac.uk> At 22:32 15/04/2003, you wrote: >Hello, Im running Exim+Mailscanner and my current configuration works >great but i am a little confused about the scanning messages in >/var/log/maillog. > >When a msg comes it i see duplicate msgs in maillog. Either its being >scanned twice or Mailscanner is recording it as being scanned twice; > >Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Found 2 messages waiting >Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Found 2 messages waiting >Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Scanning 1 messages, >12850 bytes >Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Scanning 1 messages, >12850 bytes >Apr 15 12:39:05 srv05 MailScanner[19913]: Spam Checks: Starting >Apr 15 12:39:05 srv05 MailScanner[19913]: Spam Checks: Starting Check you /etc/syslog.conf doesn't have 2 separate lines for /var/log/maillog. >Also, if you look at the msg above you will see 2 msgs in NEW BATCH but it >says only 1 is being scanned? I dont understand this. Does that mean only >one msg was scanned and why the duplicates? Is that just the way it works >with Exim? If another thread is already scanning one of the messages (or it is still arriving from the SMTP connection) then you will see exactly this. Don't worry about it. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 16 09:15:21 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Klez not silent? In-Reply-To: Message-ID: <5.2.0.9.2.20030416091445.030d07f0@imap.ecs.soton.ac.uk> At 00:51 16/04/2003, you wrote: >On Mon, 14 Apr 2003 12:09:29 +0100, Julian Field > wrote: > > >>Shouldn't MailScanner just delete that message? I'm not sure why it's > >>still getting delivered. > > > >Can you confirm that the batch of messages was only 1 message? If it was 2 > >messages then the log lines would match what I expect. Otherwise there > >might be a bug in the Clam output parser. It was written by > >. > > > >Where is the code for the Clam output parser in MailScanner? I'd like to >see what it's doing. sub ProcessClamAVOutput in SweepViruses.pm. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From dlovelace at HOTELS.COM Tue Apr 15 17:09:53 2003 From: dlovelace at HOTELS.COM (Dale Lovelace) Date: Thu Jan 12 21:17:47 2006 Subject: /etc/cron.hourly/check_MailScanner Message-ID: <20030415110953.4aa4af16.dlovelace@hotels.com> I have some machines where I have MailScanner installed for testing, etc. where I don't necesarily want it to run all of the time, but I am unable to turn it off because the /etc/cron.hourly/check_MailScanner script will restart it regardless of whether I have it set to run. I have modified the check_MailScanner script to find out what runlevel you are in, then check /etc/rc$RUNLEVEL.d/S??MailScanner to make sure MailScanner is supposed to be started before trying to run /usr/sbin/check_MailScanner.. Perhaps if this looks good it could find it's way into the distro.. Thanks, Dale -- Dale Lovelace System Administrator hotels.com (214) 361-7311 Ext. 1074 -------------- next part -------------- A non-text attachment was scrubbed... Name: check_MailScanner Type: application/octet-stream Size: 647 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030415/c90e5bc8/check_MailScanner.obj From Peter.Bates at LSHTM.AC.UK Tue Apr 15 16:55:03 2003 From: Peter.Bates at LSHTM.AC.UK (Peter Bates) Date: Thu Jan 12 21:17:47 2006 Subject: Postfix support -- beta release Message-ID: Hello again all... I'm posting this to the list, unless you think I should send it directly, Julian... >Are you sure you've got the "defer_transports" setting in >/etc/postfix.in/main.cf? The incoming postfix should just dump >everything in the "deferred" queue (/var/spool/postfix.in/deferred). Yup... # postconf -c /etc/postfix.in defer_transports defer_transports = smtp local virtual I see this: (with the 'errors' highlighted by asterisks!) When MailScanner starts, I see: *Apr 15 16:38:37 hancock MailScanner[12862]: User's home directory /var/spool/postfix is not writable* Then: Apr 15 16:38:57 hancock postfix/smtpd[12864]: connect from unknown[193.63.251.18] Apr 15 16:38:57 hancock postfix/smtpd[12864]: 5C8E414A12C: client=unknown[193.63.251.18] Apr 15 16:38:57 hancock postfix/cleanup[12865]: 5C8E414A12C: message-id=<20030415153857.5C8E414A12C@hancock.lshtm.ac.uk> Apr 15 16:38:57 hancock postfix/qmgr[12759]: 5C8E414A12C: from=, size=17954, nrcpt=1 (queue active) *Apr 15 16:38:57 hancock postfix/smtp[12868]: fatal: unknown service: smtp/tcp* Apr 15 16:38:57 hancock postfix/smtpd[12864]: disconnect from unknown[193.63.251.18] *Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: premature end-of-input on private/relay socket while reading input attribute name* *Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: private/relay socket: malformed response* *Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: transport relay failure -- see a previous warning/fatal/panic logfile record for the problem description* *Apr 15 16:38:58 hancock postfix/master[12757]: warning: process /usr/libexec/postfix/smtp pid 12868 exit status 1* *Apr 15 16:38:58 hancock postfix/master[12757]: warning: /usr/libexec/postfix/smtp: bad command startup -- throttling* All of the above are about Postfix not being able to run 'smtp', the thing that essentially delivers via SMTP (as opposed to smtpd, which listens). Apr 15 16:39:00 hancock MailScanner[12852]: New Batch: Scanning 1 messages, 18275 bytes Apr 15 16:39:00 hancock MailScanner[12852]: Spam Checks: Starting Apr 15 16:39:10 hancock MailScanner[12862]: SophosSAVI 3.68 (engine 2.14) recognizing 80978 viruses Apr 15 16:39:10 hancock MailScanner[12862]: SophosSAVI using 14 IDE files Apr 15 16:39:10 hancock MailScanner[12862]: Using locktype = flock Apr 15 16:39:30 hancock MailScanner[12852]: SpamAssassin timed out and was killed, consecutive failure 1 of 20 Apr 15 16:39:34 hancock MailScanner[12852]: Virus and Content Scanning: Starting Apr 15 16:39:34 hancock MailScanner[12852]: Filename Checks: Allowing msg-12852-1.txt Apr 15 16:39:34 hancock MailScanner[12852]: Filename Checks: Allowing newX15.GIF Apr 15 16:39:34 hancock postfix/qmgr[12834]: 66D3615601E: from=, size=18118, nrcpt=1 (queue active) Apr 15 16:39:34 hancock MailScanner[12852]: Uninfected: Delivered 1 messages Apr 15 16:39:34 hancock postfix/smtp[12879]: 66D3615601E: to=, relay=193.63.251.120[193.63.251.120], delay=37, status=sent (250 Ok) It seems to (or in fact does) get through here, but SA hasn't run for some reason... again possibly because user 'postfix' can't run it??? I also see a few: Apr 15 16:48:23 hancock postfix/smtp[12905]: warning: corrupted queue file: active/6/66F4715601F If I copy /etc/services into /var/spool/postfix.in/etc/services to stop the above 'fatal unknown service' error, then the mail gets delivered directly... ???!!! ---------------------------------------------------------------------------------------------------> Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-958 8353 / Fax: 0207- 636 9838 From mailscanner at LISTS.COM.AR Tue Apr 15 17:21:45 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:47 2006 Subject: MailScanner.conf include? Message-ID: <3E9C0769.19895.FBEC80@localhost> Hi Julian, I know I can browse thru the code and maybe find it, but... does MailScanner.conf allow for including another file as part of it? I have an installation where I want to let the admin fiddle with a couple of settings but don't want to overwhelm him with all the MailScanner.conf options and don't want him to touch a bunch of them... I'd like to have a /etc/youcantouchthisfile.conf being included from MailScanner.conf and let him change the options there... I know he could add some valid option there and MailScanner will stop working if I have that option set somewhere else, but that is not a problem... -- Mariano Absatz El Baby ---------------------------------------------------------- Suicidal twin kills sister by mistake! From Stephen.Dawes at GOV.CALGARY.AB.CA Tue Apr 15 17:31:20 2003 From: Stephen.Dawes at GOV.CALGARY.AB.CA (Dawes, Stephen) Date: Thu Jan 12 21:17:47 2006 Subject: Off Topic, article that may be of interest: Message-ID: Off Topic, article that may be of interest:

Although this article is somewhat off topic, it talks about AOL's latest attack against spam.

I thought that it may be of interest to some of you.

Enjoy!

- - - - - - - - - - - - - - - - - - - - - - - - - - - -

AOL TAKES SPAMMERS TO COURT

Posted April 15, 2003 6:00 AM Pacific Time

AOL Time Warner has filed five lawsuits accusing users of spamming its subscribers with junk e-mail, according to the Wall Street Journal's (WSJ) online edition Tuesday.

The spammers have sent about 1 billion spam messages, generating about eight million individual complaints from users via AOL's "spam report" feature, the WSJ said.

For the full story: http://www.infoworld.com/article/03/04/15/HNaolspammers_1.html

- - - - - - - - - - - - - - - - - - - - - - - - - - - -


Stephen Dawes  <B.A., B.Sc.>
The City of Calgary                   |  Phone: (403) 268-5527
   Web Business Office #8300          |  Fax:   (403) 268-6423
   PO Box 2100 Postal Station M.      |  Email: Stephen.Dawes@calgary.ca
   Calgary, Alberta, Canada. T2P 2M5  |  Web:  http://www.calgary.ca



NOTICE::
This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation.

 From mailscanner at ecs.soton.ac.uk Wed Apr 16 10:14:16 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: MailScanner.conf include? In-Reply-To: <3E9C0769.19895.FBEC80@localhost> Message-ID: <5.2.0.9.2.20030416101345.04a47bf0@imap.ecs.soton.ac.uk> At 17:21 15/04/2003, you wrote: >Hi Julian, > >I know I can browse thru the code and maybe find it, but... does >MailScanner.conf allow for including another file as part of it? No, sorry. >I have an installation where I want to let the admin fiddle with a couple of >settings but don't want to overwhelm him with all the MailScanner.conf >options and don't want him to touch a bunch of them... > >I'd like to have a /etc/youcantouchthisfile.conf being included from >MailScanner.conf and let him change the options there... > >I know he could add some valid option there and MailScanner will stop working >if I have that option set somewhere else, but that is not a problem... > > >-- >Mariano Absatz >El Baby >---------------------------------------------------------- >Suicidal twin kills sister by mistake! -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 16 10:12:53 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Postfix support -- beta release In-Reply-To: Message-ID: <5.2.0.9.2.20030416100915.0417ca58@imap.ecs.soton.ac.uk> At 16:55 15/04/2003, you wrote: >Hello again all... > >I'm posting this to the list, unless you think I should send it directly, >Julian... > > >Are you sure you've got the "defer_transports" setting in > >/etc/postfix.in/main.cf? The incoming postfix should just dump > >everything in the "deferred" queue (/var/spool/postfix.in/deferred). > >Yup... > ># postconf -c /etc/postfix.in defer_transports >defer_transports = smtp local virtual > >I see this: (with the 'errors' highlighted by asterisks!) > >When MailScanner starts, I see: > >*Apr 15 16:38:37 hancock MailScanner[12862]: User's home directory >/var/spool/postfix is not writable* 4.15-3 shouldn't say that. >Then: > >Apr 15 16:38:57 hancock postfix/smtpd[12864]: connect from >unknown[193.63.251.18] >Apr 15 16:38:57 hancock postfix/smtpd[12864]: 5C8E414A12C: >client=unknown[193.63.251.18] >Apr 15 16:38:57 hancock postfix/cleanup[12865]: 5C8E414A12C: >message-id=<20030415153857.5C8E414A12C@hancock.lshtm.ac.uk> >Apr 15 16:38:57 hancock postfix/qmgr[12759]: 5C8E414A12C: >from=, size=17954, nrcpt=1 (queue active) That's the first bit that's wrong. Can you send me your /etc/postfix.in/master.cf and main.cf (off-list). Also what version of Postfix are you running? >*Apr 15 16:38:57 hancock postfix/smtp[12868]: fatal: unknown service: >smtp/tcp* That's the chroot jail missing. >Apr 15 16:38:57 hancock postfix/smtpd[12864]: disconnect from >unknown[193.63.251.18] >*Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: premature >end-of-input on private/relay socket while reading input attribute name* >*Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: private/relay >socket: malformed response* >*Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: transport relay >failure -- see a previous warning/fatal/panic logfile record for the >problem description* >*Apr 15 16:38:58 hancock postfix/master[12757]: warning: process >/usr/libexec/postfix/smtp pid 12868 exit status 1* >*Apr 15 16:38:58 hancock postfix/master[12757]: warning: >/usr/libexec/postfix/smtp: bad command startup -- throttling* > >All of the above are about Postfix not being able to run 'smtp', the thing >that essentially delivers via SMTP (as opposed to smtpd, which listens). > >Apr 15 16:39:00 hancock MailScanner[12852]: New Batch: Scanning 1 >messages, 18275 bytes >Apr 15 16:39:00 hancock MailScanner[12852]: Spam Checks: Starting >Apr 15 16:39:10 hancock MailScanner[12862]: SophosSAVI 3.68 (engine 2.14) >recognizing 80978 viruses >Apr 15 16:39:10 hancock MailScanner[12862]: SophosSAVI using 14 IDE files >Apr 15 16:39:10 hancock MailScanner[12862]: Using locktype = flock >Apr 15 16:39:30 hancock MailScanner[12852]: SpamAssassin timed out and was >killed, consecutive failure 1 of 20 >Apr 15 16:39:34 hancock MailScanner[12852]: Virus and Content Scanning: >Starting >Apr 15 16:39:34 hancock MailScanner[12852]: Filename Checks: Allowing >msg-12852-1.txt >Apr 15 16:39:34 hancock MailScanner[12852]: Filename Checks: Allowing >newX15.GIF >Apr 15 16:39:34 hancock postfix/qmgr[12834]: 66D3615601E: >from=, size=18118, nrcpt=1 (queue active) >Apr 15 16:39:34 hancock MailScanner[12852]: Uninfected: Delivered 1 messages >Apr 15 16:39:34 hancock postfix/smtp[12879]: 66D3615601E: >to=, relay=193.63.251.120[193.63.251.120], >delay=37, status=sent (250 Ok) > >It seems to (or in fact does) get through here, but SA hasn't run for some >reason... again possibly because user 'postfix' can't run it??? > >I also see a few: >Apr 15 16:48:23 hancock postfix/smtp[12905]: warning: corrupted queue >file: active/6/66F4715601F Could you send me 1 or 2 of those if you can extract them before Postfix removes them? Looks like I've got some more work to do... -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 16 10:35:38 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Postfix support -- beta release In-Reply-To: <5.2.0.9.2.20030416100915.0417ca58@imap.ecs.soton.ac.uk> References: Message-ID: <5.2.0.9.2.20030416102931.04a48800@imap.ecs.soton.ac.uk> I just tried defer_transports = smtp, local, virtual and it seemed happy with that syntax too. Might be worth a try. If you stop MailScanner but leave the Postfix processes running, here's what I get in my log. Apr 16 09:33:23 tinker postfix/smtpd[24504]: connect from unknown[127.0.0.1] Apr 16 09:33:33 tinker postfix/smtpd[24504]: 5434B24187: client=unknown[127.0.0.1] Apr 16 09:33:58 tinker postfix/cleanup[24505]: 5434B24187: message-id=<20030416093333.5434B24187@tinker.ecs.soton.ac.uk> Apr 16 09:33:58 tinker postfix/nqmgr[24502]: 5434B24187: from=, size=409, nrcpt=1 (queue active) Apr 16 09:33:58 tinker postfix/nqmgr[24502]: 5434B24187: to=, relay=none, delay=25, status=deferred (deferred transport) Apr 16 09:33:59 tinker postfix/smtpd[24504]: disconnect from unknown[127.0.0.1] So you can see it going into the active queue, at which point it tries to deliver via smtp. But that's set as a deferred transport so it pushes it into the deferred queue instead. Putting /etc/services into /var/spool/postfix/etc/services seems to be just enough to let the smtp transport work. I am running the RPM version of postfix-1.1.11-5 as shipped with RedHat 8 on this machine. At 10:12 16/04/2003, you wrote: >At 16:55 15/04/2003, you wrote: >>Hello again all... >> >>I'm posting this to the list, unless you think I should send it directly, >>Julian... >> >> >Are you sure you've got the "defer_transports" setting in >> >/etc/postfix.in/main.cf? The incoming postfix should just dump >> >everything in the "deferred" queue (/var/spool/postfix.in/deferred). >> >>Yup... >> >># postconf -c /etc/postfix.in defer_transports >>defer_transports = smtp local virtual >> >>I see this: (with the 'errors' highlighted by asterisks!) >> >>When MailScanner starts, I see: >> >>*Apr 15 16:38:37 hancock MailScanner[12862]: User's home directory >>/var/spool/postfix is not writable* > >4.15-3 shouldn't say that. > > >>Then: >> >>Apr 15 16:38:57 hancock postfix/smtpd[12864]: connect from >>unknown[193.63.251.18] >>Apr 15 16:38:57 hancock postfix/smtpd[12864]: 5C8E414A12C: >>client=unknown[193.63.251.18] >>Apr 15 16:38:57 hancock postfix/cleanup[12865]: 5C8E414A12C: >>message-id=<20030415153857.5C8E414A12C@hancock.lshtm.ac.uk> >>Apr 15 16:38:57 hancock postfix/qmgr[12759]: 5C8E414A12C: >>from=, size=17954, nrcpt=1 (queue active) > >That's the first bit that's wrong. Can you send me your >/etc/postfix.in/master.cf and main.cf (off-list). Also what version of >Postfix are you running? > >>*Apr 15 16:38:57 hancock postfix/smtp[12868]: fatal: unknown service: >>smtp/tcp* > >That's the chroot jail missing. > >>Apr 15 16:38:57 hancock postfix/smtpd[12864]: disconnect from >>unknown[193.63.251.18] >>*Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: premature >>end-of-input on private/relay socket while reading input attribute name* >>*Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: private/relay >>socket: malformed response* >>*Apr 15 16:38:58 hancock postfix/qmgr[12759]: warning: transport relay >>failure -- see a previous warning/fatal/panic logfile record for the >>problem description* >>*Apr 15 16:38:58 hancock postfix/master[12757]: warning: process >>/usr/libexec/postfix/smtp pid 12868 exit status 1* >>*Apr 15 16:38:58 hancock postfix/master[12757]: warning: >>/usr/libexec/postfix/smtp: bad command startup -- throttling* >> >>All of the above are about Postfix not being able to run 'smtp', the thing >>that essentially delivers via SMTP (as opposed to smtpd, which listens). >> >>Apr 15 16:39:00 hancock MailScanner[12852]: New Batch: Scanning 1 >>messages, 18275 bytes >>Apr 15 16:39:00 hancock MailScanner[12852]: Spam Checks: Starting >>Apr 15 16:39:10 hancock MailScanner[12862]: SophosSAVI 3.68 (engine 2.14) >>recognizing 80978 viruses >>Apr 15 16:39:10 hancock MailScanner[12862]: SophosSAVI using 14 IDE files >>Apr 15 16:39:10 hancock MailScanner[12862]: Using locktype = flock >>Apr 15 16:39:30 hancock MailScanner[12852]: SpamAssassin timed out and was >>killed, consecutive failure 1 of 20 >>Apr 15 16:39:34 hancock MailScanner[12852]: Virus and Content Scanning: >>Starting >>Apr 15 16:39:34 hancock MailScanner[12852]: Filename Checks: Allowing >>msg-12852-1.txt >>Apr 15 16:39:34 hancock MailScanner[12852]: Filename Checks: Allowing >>newX15.GIF >>Apr 15 16:39:34 hancock postfix/qmgr[12834]: 66D3615601E: >>from=, size=18118, nrcpt=1 (queue active) >>Apr 15 16:39:34 hancock MailScanner[12852]: Uninfected: Delivered 1 messages >>Apr 15 16:39:34 hancock postfix/smtp[12879]: 66D3615601E: >>to=, relay=193.63.251.120[193.63.251.120], >>delay=37, status=sent (250 Ok) >> >>It seems to (or in fact does) get through here, but SA hasn't run for some >>reason... again possibly because user 'postfix' can't run it??? >> >>I also see a few: >>Apr 15 16:48:23 hancock postfix/smtp[12905]: warning: corrupted queue >>file: active/6/66F4715601F > >Could you send me 1 or 2 of those if you can extract them before Postfix >removes them? > >Looks like I've got some more work to do... >-- >Julian Field >www.MailScanner.info >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From linux at mostert.nom.za Wed Apr 16 12:43:06 2003 From: linux at mostert.nom.za (Mozzi) Date: Thu Jan 12 21:17:47 2006 Subject: Spam ruleset Message-ID: <200304161343.06180.linux@mostert.nom.za> Hi all I would like to ban certain words and frases from entering the system here also it helps to control certain types of spam. I want to do this both for subject lines and frases in the body of the mail Now I have figured out that I need a ruleset ;-) *kidding* I think I should do it here # Spam Blacklist: # Make this point to a ruleset, and anything in that ruleset whose value # is "yes" will *always* be marked as spam. # This can also be the filename of a ruleset. Is Definitely Spam = no And change that to Is Definitely Spam = /etc/MailScanner/rules/spam.words.rules (my own rules file) I am just not sure how to setup the ruleset. from or to is no problem but frases? Would spamassassin be a better option? I havn't used it yet as I am in an ISP enviroment and it will cause to much hassle. Tnx Mozzi From raymond at PROLOCATION.NET Wed Apr 16 12:43:12 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:47 2006 Subject: Spam ruleset In-Reply-To: <200304161343.06180.linux@mostert.nom.za> Message-ID: Hi! > Is Definitely Spam = /etc/MailScanner/rules/spam.words.rules (my own rules > file) > > I am just not sure how to setup the ruleset. > from or to is no problem but frases? > > Would spamassassin be a better option? I havn't used it yet as I am in an ISP > enviroment and it will cause to much hassle. We run spammassassin also in a ISP and people are pretty happy with it. Bye, Raymond. From marco at MUW.EDU Wed Apr 16 13:22:55 2003 From: marco at MUW.EDU (Marco Obaid) Date: Thu Jan 12 21:17:47 2006 Subject: Disable Virus Scanning for local mail In-Reply-To: <5.2.0.9.2.20030312200952.025e7890@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030312181023.0222e958@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030312200952.025e7890@imap.ecs.soton.ac.uk> Message-ID: <1050495775.3e9d4b1fbef4b@webmail.MUW.Edu> Good day all, I have a mailing list with about 1500 subscribers which resides on a different server than my MailScanner server. Everytime a member sends an e-mail the load on the server jumps so high for about 55 to 70 seconds. It almost freezes the server for that period. My mail server is running a dual xeon 700mhz with 2mb of cache on each processor and all scsi drives with 3GB RAM. All the subscribers to this mailing list are local users of my MailScanner server (mail server). Would it be advisable to *not* scan messeages sent within my local domain? and what is the best way to do this? I created a ruleset called virus.scanning.rules, which has: FromOrTo: localhost no FromOrTo: *@my.mailing.list.server no FromOrTo: default yes Is this correct? I am afraid of adding From: mydomain.edu no which may not scan outgoing mail. I should mention that the mailman server is handeling html stripping and is not allowing any attachments period so I am not worried about dangerous mail coming from the mailing list. Please advise Thank you Marco _________________________________________________________________ This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail For the latest MUW Events, visit http://www.MUW.Edu/calendar From Q.G.Campbell at NEWCASTLE.AC.UK Wed Apr 16 13:10:47 2003 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:17:47 2006 Subject: If HTML -> text conversion fails: A suggestion/request Message-ID: <52E50E4D595DDE4D861117A1FB62E79D221151@bond.ncl.ac.uk> This site uses the MS option to convert the HTML in the body of all tagged messages to plain text. This leaves just the text and the links and the converted message is normally easy to read. This conversion has the great merit of preventing offensive content in a tagged message from popping up all over the user's screen. Occasionally the conversion leaves a very messy and unreadable message. Most of the time this does not matter because the message is really spam and will be ignored anyway. However if a "false positive" is incompletely converted and this message is an airline/train/hotel booking confirmation then it can be extremely inconvenient for the recipient. We would like to see an option in MailScanner that has the effect of saving the original HTML text of the message body as an attachment so that in the event of incomplete conversion leaving the message practically unreadable, the original message can be viewed as a last resort. This would also help Julian and other code authors to debug and improve the code that does the HTML -> plain text conversion. Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From Kevin.Spicer at BMRB.CO.UK Wed Apr 16 13:05:38 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:47 2006 Subject: Disable Virus Scanning for local mail Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF524@pascal.priv.bmrb.co.uk> Assuming all messages to the mailing list server go through your MS server I would have thought the best (and safest) answer would be not to scan mail _from_ your mailing list server but to continue to scan mail _to_ you mailing lists server [ since the mailing list server presumably only resends mail sent into it? ] That way you avoid any problems caused by someone sending a virus to a list. > -----Original Message----- > From: Marco Obaid [mailto:marco@MUW.EDU] > Sent: 16 April 2003 13:23 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Disable Virus Scanning for local mail > > > Good day all, > > I have a mailing list with about 1500 subscribers which > resides on a different > server than my MailScanner server. Everytime a member sends > an e-mail the load > on the server jumps so high for about 55 to 70 seconds. It > almost freezes the > server for that period. My mail server is running a dual xeon > 700mhz with 2mb > of cache on each processor and all scsi drives with 3GB RAM. > > All the subscribers to this mailing list are local users of > my MailScanner > server (mail server). Would it be advisable to *not* scan > messeages sent within > my local domain? and what is the best way to do this? > > I created a ruleset called virus.scanning.rules, which has: > > FromOrTo: localhost no > FromOrTo: *@my.mailing.list.server no > FromOrTo: default yes > > Is this correct? > > I am afraid of adding From: mydomain.edu no which may not > scan outgoing mail. > > I should mention that the mailman server is handeling html > stripping and is not > allowing any attachments period so I am not worried about > dangerous mail coming > from the mailing list. > > Please advise > Thank you > Marco > > _________________________________________________________________ > This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail > For the latest MUW Events, visit http://www.MUW.Edu/calendar > BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mailscanner at ecs.soton.ac.uk Wed Apr 16 13:45:24 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:47 2006 Subject: Spam ruleset In-Reply-To: <200304161343.06180.linux@mostert.nom.za> Message-ID: <5.2.0.9.2.20030416134429.04a511f0@imap.ecs.soton.ac.uk> At 12:43 16/04/2003, you wrote: >Hi all >I would like to ban certain words and frases from entering the system here >also it helps to control certain types of spam. >I want to do this both for subject lines and frases in the body of the mail > >Now I have figured out that I need a ruleset ;-) *kidding* > >I think I should do it here ># Spam Blacklist: ># Make this point to a ruleset, and anything in that ruleset whose value ># is "yes" will *always* be marked as spam. ># This can also be the filename of a ruleset. >Is Definitely Spam = no > >And change that to >Is Definitely Spam = /etc/MailScanner/rules/spam.words.rules (my own rules >file) > >I am just not sure how to setup the ruleset. >from or to is no problem but frases? You can't do it that way at all. You need to install SpamAssassin and use that to do it (I didn't see any reason to re-implement functionality that SpamAssassin already does very well). Read man Mail::SpamAssassin::Conf -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From campbell at CNPAPERS.COM Wed Apr 16 13:52:39 2003 From: campbell at CNPAPERS.COM (Stephe Campbell) Date: Thu Jan 12 21:17:47 2006 Subject: Catch 22 Whitelist & BlackList References: <5.2.1.1.2.20030414202522.0223b008@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030415212159.0278eed8@imap.ecs.soton.ac.uk> Message-ID: <000701c30417$10155be0$5e01a8c0@cnpapers.net> Then my example does not work. Based on what you say, if I am understanding you correctly, by putting this individual user (a member of the domain) in the whitelist as a "no" before the entire domain, which has "yes" will cause the whitelisting parameter to be effective and never check the blacklist, where the user is flagged as "yes". Correct? Or are you saying once the first whitelist rule match is made, the blacklist is then consulted? "Yes" matches would become inclusive (or decisive, whichever makes more sense) and "No" matches are exclusive? The table below is a better way of asking Whitelist Blacklist Result no no no yes no yes (whitelist) no yes yes(blacklist) - my example yes yes yes(whitelist) - your reply I realize that the first and last table entries are not logical, but this covers all bases. What I am trying to do is exclude a single user from being whitelisted from the following domain catch-all whitelisting and flag that particular user as a blacklisted user. I need both situations met. It seems to work sometimes and other times not. I'm still not sure of when either of these times occur. Sorry that this seems to be such a simple thing, and so hard to understand. Your reply "if so, then get out and don't do any more spam checks" has me a little confused as to whether you meant "any more spam checks" or "any more spam checks in this ruleset, but continue to the next ruleset". Thanks for the time and effort! Steve Campbell campbell@cnpapers.com ----- Original Message ----- From: "Julian Field" To: Sent: Tuesday, April 15, 2003 4:31 PM Subject: Re: Catch 22 Whitelist & BlackList > At 18:55 15/04/2003, you wrote: > >Clarification then, please: > > > >A match for a "yes" and a match for a "no" are both matches, and will then > >terminate the scan through the table of whitelists and proceed to the > >blacklist to scan for matches (which you have indicated will override the > >whitelist match)? > > The rules are processed in top to bottom order until any rule matches > (whether it's a yes or a no). If no rule matches after all have been tried, > the "default" rule value is used. > > I'm just checking the code right now. What happens is this: > Is the sender address whitelisted? If so, then get out and don't do any > more spam checks. > Is the sender address blacklisted? If so, then get out and don't do any > more spam checks. > Do the RBL checks, then the SA checks. > > So my previous message was wrong. The whitelist is done first. > Having "yes" in the whitelist and "yes" in the blacklist will cause the > message to be whitelisted. > > >I have to say to all: I never imagined the many ways to use MailScanner when > >I first started using it. The flexibility of this application is amazing > >once you learn the ins and outs. > > The configuration system is not quite as flexible as I would like (you > can't write expressions in it) but it's 99% there, which is quite good > enough for most people most of the time. And if I had written expression > support in it, I bet that only a few people would ever work out how to use > it anyway. Which is why the Custom Function support is there, so you can > implement anything else you like. > > >Thank you very much > > Pleasure. > > >----- Original Message ----- > >From: "Julian Field" > >To: > >Sent: Monday, April 14, 2003 3:27 PM > >Subject: Re: Catch 22 Whitelist & BlackList > > > > > > > The rules are processed in top to bottom order. The default rule is used > > > only if none of the other rules match. The whitelist check is done before > > > the blacklist check, and will over-ride it. > > > > > > At 19:50 14/04/2003, you wrote: > > > >We have someone spoofing mail to and from a particular user at one of our > > > >domains. I would like to get rid of all of this mail. Some of this is > > > >spoofed to the user and some is bounced back to the user. I can not > >locate > > > >where it is originating. If I set up whitelisting such as: > > > > > > > >FromOrTo: BadUser@our.domain no > > > >FromOrTo: *@our.domain yes > > > >FromOrTo: default no > > > > > > > >and blacklist such as: > > > > > > > >FromOrTo: BadUser@our.domain yes > > > >FromOrTo: default no > > > > > > > >Will this allow all mail from everyone at our.domain to pass either way > > > >with the exception of BadUser@our.domain? > > > > > > > >Steve Campbell > > > >campbell@cnpapers.com > > > > > > -- > > > Julian Field > > > www.MailScanner.info > > > Professional Support Services at www.MailScanner.biz > > > MailScanner thanks transtec Computers for their support > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 16 13:46:53 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: If HTML -> text conversion fails: A suggestion/request In-Reply-To: <52E50E4D595DDE4D861117A1FB62E79D221151@bond.ncl.ac.uk> Message-ID: <5.2.0.9.2.20030416134648.03180250@imap.ecs.soton.ac.uk> Good idea. At 13:10 16/04/2003, you wrote: >This site uses the MS option to convert the HTML in the body of all >tagged messages to plain text. This leaves just the text and the links >and the converted message is normally easy to read. This conversion has >the great merit of preventing offensive content in a tagged message from >popping up all over the user's screen. > >Occasionally the conversion leaves a very messy and unreadable message. >Most of the time this does not matter because the message is really spam >and will be ignored anyway. > >However if a "false positive" is incompletely converted and this message >is an airline/train/hotel booking confirmation then it can be extremely >inconvenient for the recipient. > >We would like to see an option in MailScanner that has the effect of >saving the original HTML text of the message body as an attachment so >that in the event of incomplete conversion leaving the message >practically unreadable, the original message can be viewed as a last >resort. This would also help Julian and other code authors to debug and >improve the code that does the HTML -> plain text conversion. > >Quentin >--- >PHONE: +44 191 222 8209 Computing Service, University of Newcastle >FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. >------------------------------------------------------------------------ >"Any opinion expressed above is mine. The University can get its own." -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From dh at UPTIME.AT Wed Apr 16 14:05:39 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:48 2006 Subject: [OT] F-Prot for Alpha? Message-ID: <1EF9CB63-700C-11D7-87BE-000393920D6C@uptime.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 I know it is a bit OT, but is there a f-prot binary for Alpha? Thank you - -d - -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GCC d+ s: a-- C+ UB++++ P+ L++ E--- W N+ o+++ K w-- O M+ V++ PS PE Y++ PGP++++ t+ 5 X- R+ tv-- b++++ DI D+ G e++++ h+ r++ y++ - ------END GEEK CODE BLOCK------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+nVUniW/Ta/pxHPQRA15EAJ9QNQo9VLvnEcvxW/kXn9DrD+ta/gCeJ13d Ewim4hRG7zFtD/BOySSlK+8= =f79o -----END PGP SIGNATURE----- From mailscanner at ecs.soton.ac.uk Wed Apr 16 14:16:41 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: Catch 22 Whitelist & BlackList In-Reply-To: <000701c30417$10155be0$5e01a8c0@cnpapers.net> References: <5.2.1.1.2.20030414202522.0223b008@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030415212159.0278eed8@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030416141133.03164620@imap.ecs.soton.ac.uk> I think I'm getting confused by my own code as well :-) Whitelist Blacklist Result no no Do all RBL checks and SpamAssassin checks yes no yes (whitelist) no yes yes (blacklist) yes yes yes (whitelist) To make an entire domain whitelisted, except for one user who is to be blacklisted: In the whitelist put this: From: user@domain.com no From: *@domain.com yes In the blacklist put this: From: user@domain.com yes At 13:52 16/04/2003, you wrote: >Then my example does not work. Based on what you say, if I am understanding >you correctly, by putting this individual user (a member of the domain) in >the whitelist as a "no" before the entire domain, which has "yes" will cause >the whitelisting parameter to be effective and never check the blacklist, >where the user is flagged as "yes". Correct? Or are you saying once the >first whitelist rule match is made, the blacklist is then consulted? "Yes" >matches would become inclusive (or decisive, whichever makes more sense) and >"No" matches are exclusive? > >The table below is a better way of asking > >Whitelist Blacklist Result >no no no >yes no yes (whitelist) >no yes yes(blacklist) - my example >yes yes yes(whitelist) - your reply > >I realize that the first and last table entries are not logical, but this >covers all bases. What I am trying to do is exclude a single user from being >whitelisted from the following domain catch-all whitelisting and flag that >particular user as a blacklisted user. I need both situations met. > >It seems to work sometimes and other times not. I'm still not sure of when >either of these times occur. > >Sorry that this seems to be such a simple thing, and so hard to understand. >Your reply "if so, then get out and don't do any more spam checks" has me a >little confused as to whether you meant "any more spam checks" or "any more >spam checks in this ruleset, but continue to the next ruleset". > >Thanks for the time and effort! >Steve Campbell >campbell@cnpapers.com > > > >----- Original Message ----- >From: "Julian Field" >To: >Sent: Tuesday, April 15, 2003 4:31 PM >Subject: Re: Catch 22 Whitelist & BlackList > > > > At 18:55 15/04/2003, you wrote: > > >Clarification then, please: > > > > > >A match for a "yes" and a match for a "no" are both matches, and will >then > > >terminate the scan through the table of whitelists and proceed to the > > >blacklist to scan for matches (which you have indicated will override the > > >whitelist match)? > > > > The rules are processed in top to bottom order until any rule matches > > (whether it's a yes or a no). If no rule matches after all have been >tried, > > the "default" rule value is used. > > > > I'm just checking the code right now. What happens is this: > > Is the sender address whitelisted? If so, then get out and don't do any > > more spam checks. > > Is the sender address blacklisted? If so, then get out and don't do any > > more spam checks. > > Do the RBL checks, then the SA checks. > > > > So my previous message was wrong. The whitelist is done first. > > Having "yes" in the whitelist and "yes" in the blacklist will cause the > > message to be whitelisted. > > > > >I have to say to all: I never imagined the many ways to use MailScanner >when > > >I first started using it. The flexibility of this application is amazing > > >once you learn the ins and outs. > > > > The configuration system is not quite as flexible as I would like (you > > can't write expressions in it) but it's 99% there, which is quite good > > enough for most people most of the time. And if I had written expression > > support in it, I bet that only a few people would ever work out how to use > > it anyway. Which is why the Custom Function support is there, so you can > > implement anything else you like. > > > > >Thank you very much > > > > Pleasure. > > > > >----- Original Message ----- > > >From: "Julian Field" > > >To: > > >Sent: Monday, April 14, 2003 3:27 PM > > >Subject: Re: Catch 22 Whitelist & BlackList > > > > > > > > > > The rules are processed in top to bottom order. The default rule is >used > > > > only if none of the other rules match. The whitelist check is done >before > > > > the blacklist check, and will over-ride it. > > > > > > > > At 19:50 14/04/2003, you wrote: > > > > >We have someone spoofing mail to and from a particular user at one of >our > > > > >domains. I would like to get rid of all of this mail. Some of this is > > > > >spoofed to the user and some is bounced back to the user. I can not > > >locate > > > > >where it is originating. If I set up whitelisting such as: > > > > > > > > > >FromOrTo: BadUser@our.domain no > > > > >FromOrTo: *@our.domain yes > > > > >FromOrTo: default no > > > > > > > > > >and blacklist such as: > > > > > > > > > >FromOrTo: BadUser@our.domain yes > > > > >FromOrTo: default no > > > > > > > > > >Will this allow all mail from everyone at our.domain to pass either >way > > > > >with the exception of BadUser@our.domain? > > > > > > > > > >Steve Campbell > > > > >campbell@cnpapers.com > > > > > > > > -- > > > > Julian Field > > > > www.MailScanner.info > > > > Professional Support Services at www.MailScanner.biz > > > > MailScanner thanks transtec Computers for their support > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 16 14:55:13 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: [OT] F-Prot for Alpha? In-Reply-To: <1EF9CB63-700C-11D7-87BE-000393920D6C@uptime.at> Message-ID: <5.2.0.9.2.20030416145434.10223ec0@imap.ecs.soton.ac.uk> At 14:05 16/04/2003, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: RIPEMD160 > >I know it is a bit OT, but is there a f-prot binary for Alpha? I believe the answer to this is "no". However, the tech support folks at F-Prot would be the obvious people to ask, not this list. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mbowman at UDCOM.COM Wed Apr 16 15:12:23 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:48 2006 Subject: mailscanner mrtg Message-ID: Hello I'm in the same predicament http://smithers.vbcomm.net/mailscanner-mrtg/ I believe the .cfg has a set limit to what is recorded but haven't fathomed out what or where it need to be changed. Regards, -- Matthew K Bowman Systems Administrator, Universal Digital Communications. Mozzi Sent by: MailScanner mailing list 04/16/2003 10:16 AM Please respond to linux To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: mailscanner mrtg Hi all For some reason my Bytes of Mail Transferred Daily Graph stopped working Any ideas ? Mozzi From linux at mostert.nom.za Wed Apr 16 15:16:32 2003 From: linux at mostert.nom.za (Mozzi) Date: Thu Jan 12 21:17:48 2006 Subject: mailscanner mrtg Message-ID: <200304161616.32971.linux@mostert.nom.za> Hi all For some reason my Bytes of Mail Transferred Daily Graph stopped working Any ideas ? Mozzi From linux at mostert.nom.za Wed Apr 16 15:24:12 2003 From: linux at mostert.nom.za (Mozzi) Date: Thu Jan 12 21:17:48 2006 Subject: Spamassassin Message-ID: <200304161624.12191.linux@mostert.nom.za> Hi me again ;-) when using Mailscanner 4.14-9 is it safe to use spamassassin-2.53 ? Tnx Mozzi From campbell at CNPAPERS.COM Wed Apr 16 15:44:08 2003 From: campbell at CNPAPERS.COM (Stephe Campbell) Date: Thu Jan 12 21:17:48 2006 Subject: Catch 22 Whitelist & BlackList References: <5.2.1.1.2.20030414202522.0223b008@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030415212159.0278eed8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030416141133.03164620@imap.ecs.soton.ac.uk> Message-ID: <001801c30426$a35c2820$5e01a8c0@cnpapers.net> As per my original example. Thanks loads. Steve ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, April 16, 2003 9:16 AM Subject: Re: Catch 22 Whitelist & BlackList > I think I'm getting confused by my own code as well :-) > > Whitelist Blacklist Result > no no Do all RBL checks and SpamAssassin > checks > yes no yes (whitelist) > no yes yes (blacklist) > yes yes yes (whitelist) > > To make an entire domain whitelisted, except for one user who is to be > blacklisted: > In the whitelist put this: > From: user@domain.com no > From: *@domain.com yes > In the blacklist put this: > From: user@domain.com yes > > At 13:52 16/04/2003, you wrote: > >Then my example does not work. Based on what you say, if I am understanding > >you correctly, by putting this individual user (a member of the domain) in > >the whitelist as a "no" before the entire domain, which has "yes" will cause > >the whitelisting parameter to be effective and never check the blacklist, > >where the user is flagged as "yes". Correct? Or are you saying once the > >first whitelist rule match is made, the blacklist is then consulted? "Yes" > >matches would become inclusive (or decisive, whichever makes more sense) and > >"No" matches are exclusive? > > > >The table below is a better way of asking > > > >Whitelist Blacklist Result > >no no no > >yes no yes (whitelist) > >no yes yes(blacklist) - my example > >yes yes yes(whitelist) - your reply > > > >I realize that the first and last table entries are not logical, but this > >covers all bases. What I am trying to do is exclude a single user from being > >whitelisted from the following domain catch-all whitelisting and flag that > >particular user as a blacklisted user. I need both situations met. > > > >It seems to work sometimes and other times not. I'm still not sure of when > >either of these times occur. > > > >Sorry that this seems to be such a simple thing, and so hard to understand. > >Your reply "if so, then get out and don't do any more spam checks" has me a > >little confused as to whether you meant "any more spam checks" or "any more > >spam checks in this ruleset, but continue to the next ruleset". > > > >Thanks for the time and effort! > >Steve Campbell > >campbell@cnpapers.com > > > > > > > >----- Original Message ----- > >From: "Julian Field" > >To: > >Sent: Tuesday, April 15, 2003 4:31 PM > >Subject: Re: Catch 22 Whitelist & BlackList > > > > > > > At 18:55 15/04/2003, you wrote: > > > >Clarification then, please: > > > > > > > >A match for a "yes" and a match for a "no" are both matches, and will > >then > > > >terminate the scan through the table of whitelists and proceed to the > > > >blacklist to scan for matches (which you have indicated will override the > > > >whitelist match)? > > > > > > The rules are processed in top to bottom order until any rule matches > > > (whether it's a yes or a no). If no rule matches after all have been > >tried, > > > the "default" rule value is used. > > > > > > I'm just checking the code right now. What happens is this: > > > Is the sender address whitelisted? If so, then get out and don't do any > > > more spam checks. > > > Is the sender address blacklisted? If so, then get out and don't do any > > > more spam checks. > > > Do the RBL checks, then the SA checks. > > > > > > So my previous message was wrong. The whitelist is done first. > > > Having "yes" in the whitelist and "yes" in the blacklist will cause the > > > message to be whitelisted. > > > > > > >I have to say to all: I never imagined the many ways to use MailScanner > >when > > > >I first started using it. The flexibility of this application is amazing > > > >once you learn the ins and outs. > > > > > > The configuration system is not quite as flexible as I would like (you > > > can't write expressions in it) but it's 99% there, which is quite good > > > enough for most people most of the time. And if I had written expression > > > support in it, I bet that only a few people would ever work out how to use > > > it anyway. Which is why the Custom Function support is there, so you can > > > implement anything else you like. > > > > > > >Thank you very much > > > > > > Pleasure. > > > > > > >----- Original Message ----- > > > >From: "Julian Field" > > > >To: > > > >Sent: Monday, April 14, 2003 3:27 PM > > > >Subject: Re: Catch 22 Whitelist & BlackList > > > > > > > > > > > > > The rules are processed in top to bottom order. The default rule is > >used > > > > > only if none of the other rules match. The whitelist check is done > >before > > > > > the blacklist check, and will over-ride it. > > > > > > > > > > At 19:50 14/04/2003, you wrote: > > > > > >We have someone spoofing mail to and from a particular user at one of > >our > > > > > >domains. I would like to get rid of all of this mail. Some of this is > > > > > >spoofed to the user and some is bounced back to the user. I can not > > > >locate > > > > > >where it is originating. If I set up whitelisting such as: > > > > > > > > > > > >FromOrTo: BadUser@our.domain no > > > > > >FromOrTo: *@our.domain yes > > > > > >FromOrTo: default no > > > > > > > > > > > >and blacklist such as: > > > > > > > > > > > >FromOrTo: BadUser@our.domain yes > > > > > >FromOrTo: default no > > > > > > > > > > > >Will this allow all mail from everyone at our.domain to pass either > >way > > > > > >with the exception of BadUser@our.domain? > > > > > > > > > > > >Steve Campbell > > > > > >campbell@cnpapers.com > > > > > > > > > > -- > > > > > Julian Field > > > > > www.MailScanner.info > > > > > Professional Support Services at www.MailScanner.biz > > > > > MailScanner thanks transtec Computers for their support > > > > > > -- > > > Julian Field > > > www.MailScanner.info > > > Professional Support Services at www.MailScanner.biz > > > MailScanner thanks transtec Computers for their support > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support From campbell at CNPAPERS.COM Wed Apr 16 15:47:15 2003 From: campbell at CNPAPERS.COM (Stephe Campbell) Date: Thu Jan 12 21:17:48 2006 Subject: Catch 22 Whitelist & BlackList References: <5.2.1.1.2.20030414202522.0223b008@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030415212159.0278eed8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030416141133.03164620@imap.ecs.soton.ac.uk> Message-ID: <003301c30427$125fa6c0$5e01a8c0@cnpapers.net> BTW, my "Thanks loads" was sincere, not smart-assed like it may have come across. (I got to thinking about it after I hit the send button). Steve ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, April 16, 2003 9:16 AM Subject: Re: Catch 22 Whitelist & BlackList > I think I'm getting confused by my own code as well :-) > > Whitelist Blacklist Result > no no Do all RBL checks and SpamAssassin > checks > yes no yes (whitelist) > no yes yes (blacklist) > yes yes yes (whitelist) > > To make an entire domain whitelisted, except for one user who is to be > blacklisted: > In the whitelist put this: > From: user@domain.com no > From: *@domain.com yes > In the blacklist put this: > From: user@domain.com yes > > At 13:52 16/04/2003, you wrote: > >Then my example does not work. Based on what you say, if I am understanding > >you correctly, by putting this individual user (a member of the domain) in > >the whitelist as a "no" before the entire domain, which has "yes" will cause > >the whitelisting parameter to be effective and never check the blacklist, > >where the user is flagged as "yes". Correct? Or are you saying once the > >first whitelist rule match is made, the blacklist is then consulted? "Yes" > >matches would become inclusive (or decisive, whichever makes more sense) and > >"No" matches are exclusive? > > > >The table below is a better way of asking > > > >Whitelist Blacklist Result > >no no no > >yes no yes (whitelist) > >no yes yes(blacklist) - my example > >yes yes yes(whitelist) - your reply > > > >I realize that the first and last table entries are not logical, but this > >covers all bases. What I am trying to do is exclude a single user from being > >whitelisted from the following domain catch-all whitelisting and flag that > >particular user as a blacklisted user. I need both situations met. > > > >It seems to work sometimes and other times not. I'm still not sure of when > >either of these times occur. > > > >Sorry that this seems to be such a simple thing, and so hard to understand. > >Your reply "if so, then get out and don't do any more spam checks" has me a > >little confused as to whether you meant "any more spam checks" or "any more > >spam checks in this ruleset, but continue to the next ruleset". > > > >Thanks for the time and effort! > >Steve Campbell > >campbell@cnpapers.com > > > > > > > >----- Original Message ----- > >From: "Julian Field" > >To: > >Sent: Tuesday, April 15, 2003 4:31 PM > >Subject: Re: Catch 22 Whitelist & BlackList > > > > > > > At 18:55 15/04/2003, you wrote: > > > >Clarification then, please: > > > > > > > >A match for a "yes" and a match for a "no" are both matches, and will > >then > > > >terminate the scan through the table of whitelists and proceed to the > > > >blacklist to scan for matches (which you have indicated will override the > > > >whitelist match)? > > > > > > The rules are processed in top to bottom order until any rule matches > > > (whether it's a yes or a no). If no rule matches after all have been > >tried, > > > the "default" rule value is used. > > > > > > I'm just checking the code right now. What happens is this: > > > Is the sender address whitelisted? If so, then get out and don't do any > > > more spam checks. > > > Is the sender address blacklisted? If so, then get out and don't do any > > > more spam checks. > > > Do the RBL checks, then the SA checks. > > > > > > So my previous message was wrong. The whitelist is done first. > > > Having "yes" in the whitelist and "yes" in the blacklist will cause the > > > message to be whitelisted. > > > > > > >I have to say to all: I never imagined the many ways to use MailScanner > >when > > > >I first started using it. The flexibility of this application is amazing > > > >once you learn the ins and outs. > > > > > > The configuration system is not quite as flexible as I would like (you > > > can't write expressions in it) but it's 99% there, which is quite good > > > enough for most people most of the time. And if I had written expression > > > support in it, I bet that only a few people would ever work out how to use > > > it anyway. Which is why the Custom Function support is there, so you can > > > implement anything else you like. > > > > > > >Thank you very much > > > > > > Pleasure. > > > > > > >----- Original Message ----- > > > >From: "Julian Field" > > > >To: > > > >Sent: Monday, April 14, 2003 3:27 PM > > > >Subject: Re: Catch 22 Whitelist & BlackList > > > > > > > > > > > > > The rules are processed in top to bottom order. The default rule is > >used > > > > > only if none of the other rules match. The whitelist check is done > >before > > > > > the blacklist check, and will over-ride it. > > > > > > > > > > At 19:50 14/04/2003, you wrote: > > > > > >We have someone spoofing mail to and from a particular user at one of > >our > > > > > >domains. I would like to get rid of all of this mail. Some of this is > > > > > >spoofed to the user and some is bounced back to the user. I can not > > > >locate > > > > > >where it is originating. If I set up whitelisting such as: > > > > > > > > > > > >FromOrTo: BadUser@our.domain no > > > > > >FromOrTo: *@our.domain yes > > > > > >FromOrTo: default no > > > > > > > > > > > >and blacklist such as: > > > > > > > > > > > >FromOrTo: BadUser@our.domain yes > > > > > >FromOrTo: default no > > > > > > > > > > > >Will this allow all mail from everyone at our.domain to pass either > >way > > > > > >with the exception of BadUser@our.domain? > > > > > > > > > > > >Steve Campbell > > > > > >campbell@cnpapers.com > > > > > > > > > > -- > > > > > Julian Field > > > > > www.MailScanner.info > > > > > Professional Support Services at www.MailScanner.biz > > > > > MailScanner thanks transtec Computers for their support > > > > > > -- > > > Julian Field > > > www.MailScanner.info > > > Professional Support Services at www.MailScanner.biz > > > MailScanner thanks transtec Computers for their support > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Wed Apr 16 16:28:16 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:48 2006 Subject: Spamassassin In-Reply-To: <200304161624.12191.linux@mostert.nom.za> Message-ID: <3E9D4C60.29482.5F1634F@localhost> Yup... in fact, I think is the recommended version since the first 2.5x's had a couple of bugs... El 16 Apr 2003 a las 16:24, Mozzi escribi?: > Hi me again ;-) > when using Mailscanner 4.14-9 > is it safe to use spamassassin-2.53 ? > > Tnx > > > Mozzi -- Mariano Absatz El Baby ---------------------------------------------------------- I write all my critical routines in assembler, and my comedy routines in FORTRAN. -- Anonymous From mike at CAMAROSS.NET Wed Apr 16 16:28:11 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:48 2006 Subject: [OT] Any Mailman gurus? In-Reply-To: <003301c30427$125fa6c0$5e01a8c0@cnpapers.net> Message-ID: <004e01c3042c$ca8bfd70$a91cbdcf@home.middlefinger.net> Sorry for posting off topic, but I'm in need of a Mailman guru and the mailman-users list has been no help. If you know MM2.1, please contact me off the list. Mike From mailscanner at ecs.soton.ac.uk Wed Apr 16 16:32:13 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: Spamassassin In-Reply-To: <200304161624.12191.linux@mostert.nom.za> Message-ID: <5.2.0.9.2.20030416163204.030fac38@imap.ecs.soton.ac.uk> At 15:24 16/04/2003, you wrote: >Hi me again ;-) >when using Mailscanner 4.14-9 >is it safe to use spamassassin-2.53 ? Yes. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From lists at DILLONST.COM Wed Apr 16 17:43:25 2003 From: lists at DILLONST.COM (Daron) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 Message-ID: <20030416163937.M92228@dillonst.com> Yesterday I upgraded MS to the latest version and Spamassassin to 2.53 and now it marks all mail as spam even with a score like -119. I have stopped the tagging for now to make the clients happy but I need to get this fixed. Here is the setup MailScanner 4.14-9 SpamAssassin 2.53 Sendmail Perl 5.60 RedHat 7.2 Ensim 3.10 Thanks, Daron From raymond at PROLOCATION.NET Wed Apr 16 17:48:43 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:48 2006 Subject: Spamassassin In-Reply-To: <200304161624.12191.linux@mostert.nom.za> Message-ID: Hi! > Hi me again ;-) > when using Mailscanner 4.14-9 > is it safe to use spamassassin-2.53 ? Runs just fine here, install with CPAN is preferred btw, not the RPM. As suggested earlier this week on the list allready. Bye, Raymond. From joelc at CTCHOUSTON.COM Wed Apr 16 18:14:53 2003 From: joelc at CTCHOUSTON.COM (Joel Colvin) Date: Thu Jan 12 21:17:48 2006 Subject: SpamAssassin Timeouts Message-ID: <027201c3043b$b375cfd0$6400a8c0@hewlett9por0s0> How can I get some more detail on SpamAssassin timeouts? Out of last night's 36,000 messages, there were 491 timeouts but I can't find any detail about why. ------------------------------------------------------ Joel Colvin From mailscanner at ecs.soton.ac.uk Wed Apr 16 18:19:36 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 In-Reply-To: <20030416163937.M92228@dillonst.com> Message-ID: <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> At 17:43 16/04/2003, you wrote: >Yesterday I upgraded MS to the latest version and Spamassassin to 2.53 and >now it marks all mail as spam even with a score like -119. I have stopped >the tagging for now to make the clients happy but I need to get this fixed. Is your mail server in one of the RBL's ("Spam List") ? If you set Spam List = (i.e. set it to nothing) then what happens? >Here is the setup > >MailScanner 4.14-9 >SpamAssassin 2.53 >Sendmail >Perl 5.60 >RedHat 7.2 >Ensim 3.10 > >Thanks, >Daron -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From ivan at NUCCI.COM.BR Wed Apr 16 18:30:10 2003 From: ivan at NUCCI.COM.BR (Ivan Mirisola) Date: Thu Jan 12 21:17:48 2006 Subject: RPM for redhat v9.0 In-Reply-To: <200304161148.h3GBm6n07848@blackhole.harper-adams.ac.uk> References: <200304161148.h3GBm6n07848@blackhole.harper-adams.ac.uk> Message-ID: <1050514210.3e9d93225a07f@www.nucci.com.br> Howard, I have recently installed RH 9 and I already comes with a sendmail package. Have you looked up the RPMS on the first CD. There are 3 CDs for the whole instalation and you can also configure the up2date program to download and install it for you. ]# up2date -i sendmail Beste Regards, Ivan Citando Howard Robinson : > Hello, > I'm looking for an Sendmail.8.12.9.rpm file for Redhat V9 on I368. > I have had a look on ftp.mirrir.ac.uk/sites/ftp.redhat.com and can > find one for Redhat V8. Do you know of one for V9? > > > > Regards > > Howard Robinson > (Senior Technical Development Officer) > Harper Adams University College > Edgmond > Newport > Shropshire > TF10 8NB UK > > E-mail: hrobinson@harper-adams.ac.uk > Tel. : +44(0)1952 820280 Via switchboard > : +44(0)1952 815253 Direct line > Fax. : +44(0)1952 814783 > College Web site http://www.harper-adams.ac.uk > From Steve at swaney.com Wed Apr 16 18:29:56 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 In-Reply-To: <20030416163937.M92228@dillonst.com> References: <20030416163937.M92228@dillonst.com> Message-ID: <1050514196.28184.9.camel@speedy> I have the same setup, except for Sophos, on one of my servers. On both my 7.2 and 8.0 Redhat servers I had to completely uninstall, in the following order, the SpamAssassin rpms: rpm -e perl-Mail-SpamAssassin-2.53-1 rpm -e spamassassin-tools-2.53-1 rpm -e spamassassin-2.53-1 Then install using the CPAM module install: perl -MCPAN -e shell [as root] o conf prerequisites_policy ask install Mail::SpamAssassin quit This fixed both systems don't forget to save (before removing rpms) and restore /etc/mail/spamassassin/local.cf (after installing from CPAN Steve Steve Swaney Steve@Swaney.com On Wed, 2003-04-16 at 12:43, Daron wrote: > Yesterday I upgraded MS to the latest version and Spamassassin to 2.53 and > now it marks all mail as spam even with a score like -119. I have stopped > the tagging for now to make the clients happy but I need to get this fixed. > > Here is the setup > > MailScanner 4.14-9 > SpamAssassin 2.53 > Sendmail > Perl 5.60 > RedHat 7.2 > Ensim 3.10 > > Thanks, > Daron -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030416/f1b24aff/attachment.html From lists at DILLONST.COM Wed Apr 16 18:35:21 2003 From: lists at DILLONST.COM (Daron) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 In-Reply-To: <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> References: <20030416163937.M92228@dillonst.com> <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> Message-ID: <20030416173416.M18045@dillonst.com> I have check all the RBL's we use and we are clean. Like i said it was working fine with the same config before the upgrade and the scores are correct but MS should not be tagging the subject line. On Wed, 16 Apr 2003 18:19:36 +0100, Julian Field wrote > At 17:43 16/04/2003, you wrote: > >Yesterday I upgraded MS to the latest version and Spamassassin to 2.53 and > >now it marks all mail as spam even with a score like -119. I have stopped > >the tagging for now to make the clients happy but I need to get this fixed. > > Is your mail server in one of the RBL's ("Spam List") ? > If you set > Spam List = > (i.e. set it to nothing) > then what happens? > > >Here is the setup > > > >MailScanner 4.14-9 > >SpamAssassin 2.53 > >Sendmail > >Perl 5.60 > >RedHat 7.2 > >Ensim 3.10 > > > >Thanks, > >Daron > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support From mark at TIPPINGMAR.COM Wed Apr 16 19:04:00 2003 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:17:48 2006 Subject: SpamAssassin Timeouts In-Reply-To: <027201c3043b$b375cfd0$6400a8c0@hewlett9por0s0> Message-ID: <3E9D38A0.5684.4895BCA@localhost> I'm not sure how to troubleshoot the timeouts but after I installed SpamAssassin it timed out for about 10%-15% of the messages. When I changed to SpamAssassin Timeout = 40 from its default value of 30, the problem disappeared entirely. Maybe a function of our internet connection speed or the server speed or something, I don't know. Mark On 16 Apr 2003 at 12:14, Joel Colvin wrote: > How can I get some more detail on SpamAssassin timeouts? Out of last > night's 36,000 messages, there were 491 timeouts but I can't find any detail > about why. -- Mark W. Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave, Berkeley, CA 94704 visit our website at http://www.tippingmar.com From mailscanner at ecs.soton.ac.uk Wed Apr 16 18:47:52 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: SpamAssassin Timeouts In-Reply-To: <027201c3043b$b375cfd0$6400a8c0@hewlett9por0s0> Message-ID: <5.2.1.1.2.20030416184718.0235ecd8@imap.ecs.soton.ac.uk> At 18:14 16/04/2003, you wrote: >How can I get some more detail on SpamAssassin timeouts? Out of last >night's 36,000 messages, there were 491 timeouts but I can't find any detail >about why. You could try setting Debug SpamAssassin = yes which should be in the Advanced section of MailScanner.conf (right near the end of the file). -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mkettler at EVI-INC.COM Wed Apr 16 20:44:43 2003 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:17:48 2006 Subject: SpamAssassin Timeouts In-Reply-To: <3E9D38A0.5684.4895BCA@localhost> References: <027201c3043b$b375cfd0$6400a8c0@hewlett9por0s0> Message-ID: <5.2.0.9.0.20030416153629.0188d830@xanadu.evi-inc.com> No, this is likely a continuation of sillyness between MailScanner and spamassassin about default choices of timeout. MailScanner by default runs SA with a 30 second timeout. SA by default queries DNSBL's with a 30 second timeout. Thus, any time a DNSBL server fails to respond, MailScanner kills SA before SA can complete. It's a bug to expect an application to complete within 30 seconds, when you know that one of the operations used within that can take 30 seconds on it's own. As far as I know this bug has always been present in the default MailScanner config. I'm running a very old version (almost a year old) and it was there, and well known, back then. Apparently this has not changed. The appropriate part of man Mail::SpamAssassin::Conf is: rbl_timeout n (default 30) All RBL queries are started at the beginning and we try to read the results at the end. In case some of them are hanging or not returning, you can specify here how long you're willing to wait for them before deciding that they timed out Either the SA timeout that MS uses should be 35 (or longer), or the rbl_timeout that SA uses should be changed to 25 (or less) in spam.assassin.prefs.conf to prevent this sillyness. I personally run with a 10 second rbl_timeout. At 11:04 AM 4/16/2003 -0700, Mark Nienberg wrote: >I'm not sure how to troubleshoot the timeouts but after I installed >SpamAssassin it timed out for about 10%-15% of the messages. When I >changed to > >SpamAssassin Timeout = 40 > >from its default value of 30, the problem disappeared entirely. Maybe a >function of our internet connection speed or the server speed or >something, I don't know. > >Mark From vanhorn at whidbey.com Wed Apr 16 20:54:55 2003 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Thu Jan 12 21:17:48 2006 Subject: Porn msg identification? References: <3E92E35D.1400.5BA79E38@localhost> <5.2.0.9.2.20030410152900.02edd7e0@imap.ecs.soton.ac.uk> Message-ID: <3E9DB50F.818AFBC2@whidbey.com> Julian, I had a fax yesterday from one of the beneficiaries of my MailScanner system complaining about porn spam, and then I saw a note in the Politech list about the subject, referring to this story: http://news.com.com/2100-1032-995658.html That suggests that companies handling work-related mail could, in some jurisdictions (both important ones like Australia and minor ones like the US ) could end up with different obligations in handling porn pam than all other kinds of solicitations. We now have two levels of labeling we can apply, for messages that make our standard and our high spam score thresholds. Currently I am just labeling both (the standard label for score of 5, "{Grossly Blatantl SPAM?}" for score of 20), but as a lot of the mail I carry ends up in the workplace (and my service paid for by employers) this article made me wonder. My wondering led me to think about the spam tests that are identified on the X-MailScanner-SpamCheck: line. Could there be a third tier based on a ruleset, said ruleset being a list of SA's codes? I'm not sure I trust SA enough to delete messages based on a single SpamCheck code, but if I could give MS a list of codes that would be checked after messages had hit my Spam threshold, I would be just delighted. I.e., if the message is already declared spam, delete rather than re-subject if any of my list of PornCheck codes is present. Does this make sense? Van Julian Field wrote: > At 15:22 10/04/2003, you wrote: > >El 9 Apr 2003 a las 14:45, Richard D Alloway escribi?: > > > > > On Tue, 8 Apr 2003, Mariano Absatz wrote: > > > > > > > Hi Rich, > > > > > > > > The point is that MailScanner doesn't know anything about scoring > > messages... > > > > the spam score you see in MailScanner is actually done by the > > SpamAssassin > > > > library that MailScanner optionally uses. > > > > > > This is, of course, quite true :) > > > > > > The reason I was suggesting it be part of MailScanner is the fact that > > > MailScanner takes the output of SpamAssassin and modifies the subject > > > and/or adds a header to the message. > > > > > > > Now, _that_ library, including the rules that come with it, is > > developed and > > > > optimized to tag as much spam as possible _avoiding_ as many false > > positives > > > > as it can. > > > > > > Well, I'm not necessarily looking to detect spam... legitimate email with > > > mature content might not be spam. :) > >Right, but my point is that, so far, MailScanner invokes SpamAssassin at most > >once, and thus, it only uses one set of SA rules that, by default, is > >configured to detect spam. > > > >It would be easy (only a matter of configuration, not programming) to change > >the SA rules (and/or their scoring) to detect adult content, and modify the > >MailScanner.conf, so the X-MailScanner-xxxx and Subject be modified to report > >'adulthood' rather than 'spamhood' of the message. > > > >The problem is if you want the _same_ MailScanner to do _both_ spam & adult > >content detection. > > > >For that to work you should modify MS to invoke SA twice, with a different > >set of rules and generate to sets of headers and subject: modification, based > >on what each of the two SA invocations yield. > > > >That would include duplicating some of MS's data structures representing > >messages with different names, configuration variables and their defaults, > >etc. > > > >A slower (from a performance point of view) but faster (from a development > >point of view) solution would be to run 2 instances of MailScanner on the > >same machine, one to do de usual spam & virus detection and the other one to > >do adult content detection. > > > >For this you'll have to set up another queue directory like > >/var/spool/mqueue.mid and set the first MS with that as the "output" > >directory and the second MS with that as the "input" directory... > > > >You should also change, for the second MS all the messages that speak about > >"spam" to speak about "adult content", configure it to not query (either > >internally or via SA any RBL), to not check for viruses, eliminate the > >internal MS content checks (IFRAME, attachment extensions, etc.) so as to > >avoid as much double-processing as you can.... > > > >The first MS should also change its "Sendmail2" invocation... I don't know > >much about Sendmail and Exim, but, for what I see, it should be kind of > >"/bin/true" since every file that the second MS finds in > >/var/spool/mqueue.mid (left there by the first MS) will automatically be > >processed by the second MailScanner without it needing to be invoked as > >sendmail does... > > > >Am I wrong, Julian, Nick? > > That should work fine. > > > > > > > > Thus, SpamAssassin scans the message looking for patterns and it adds or > > > > substracts from the score as some conditions are met or not... > > > > > > Which is the same functionality I'd be looking for in a word/phrase > > > detection routine, but with a seperate set of actions from the spam > > > portion. > > > > > > > You _could_ create a different set of rules for SpamAssassin and > > invoke it > > > > twice, once for spam detection and the other for "adulthood" > > detection, but > > > > that would imply at least modifying MailScanner and using a secondary > > set of > > > > SpamAssassin rules... it _will_ require some time and an effort to do > > it... > > > > > > It seems I may be one of the very few actually looking for this type of > > > feature...perhaps I will have to throw on the ol' coding hat for a while > > > :) > > > > > > Julian, if I am (or anybody else is) able to create a relatively > > > lightweight way of adding this feature to MailScanner, would you consider > > > adding it to the production version? > > > > > > Thanks again for everyone's feedback! > > > > > > -Rich > > > >-- > >Mariano Absatz > >El Baby > >---------------------------------------------------------- > >Honey, I Formatted the Kid! > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For web hosting and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ---------------------------------------------------------- From kevins at BMRB.CO.UK Wed Apr 16 21:25:02 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:48 2006 Subject: Porn msg identification? In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174FDC@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174FDC@pascal.priv.bmrb.co.uk> Message-ID: <1050524703.12072.21.camel@bach.kevinspicer.co.uk> > I'm not sure I trust SA enough to delete messages based on a single > SpamCheck > code, but if I could give MS a list of codes that would be checked > after messages > had hit my Spam threshold, I would be just delighted. I.e., if the > message is > already declared spam, delete rather than re-subject if any of my list > of > PornCheck codes is present. I tried something similar a while ago, just as an experiment with custom functions. The principal difference was that I decided to try and differentiate hoaxes from ordinary spams. I think I got it working (but I'm not 100% sure - I never got it into production because the number of SA rules which suggest hoaxes didn't seem high enough to make it reliable). I've attached my _untested_ code in case its any use to you. DON'T USE IT IN PRODUCTION WITHOUT SERIOUS TESTING!!! Heres a brief explanation of what I did... My approach was to create a file (/etc/MailScanner/sahoaxrules.list) which contained lines of the form SA_rule_namescore (I think the score might have needed to be an integer - so you can't just copy the SA scores) A CustomConfig function splits the SA header into rules names that have been matched and then checks each against those in sahoaxrules.list - where a match occurs the score is added up, and if a threshold (2 - hardcoded in - you should probably change this) is exceeded it returns {HOAX??}, otherwise it returns {SPAM??}. Then, in MailScanner.conf you specify Spam Subject Text = &HoaxCheck (or whatever you name it - you'll also need to change 'High Scoring Spam Subject Text' - you may need to produce two versions of the function to get different texts for ordinary and high scoring spam). If you want to check the filter is working, without modifying messages, uncomment all the lines containing HOSTLOG, make sure that path is writeable by your MailScanner user and comment out if($totscore>=2) {return "{HOAX??}"}; This writes a summary of scores for messages seen into the file specified without changing from the default. Feel free to adapt or ignore this as you see fit, but if you get it working please do share it back. Kevin [Despite the disclaimer below this code is a product of my private endeavours and in no way the fault of my employer!] BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. -------------- next part -------------- # # MailScanner - SMTP E-Mail Virus Scanner # Copyright (C) 2002 Julian Field # # $Id: CustomConfig.pm,v 1.2 2002/11/01 11:10:05 jkf Exp $ # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # # The author, Julian Field, can be contacted by email at # Jules@JulianField.net # or by paper mail at # Julian Field # Dept of Electronics & Computer Science # University of Southampton # Southampton # SO17 1BJ # United Kingdom # package MailScanner::CustomConfig; use strict 'vars'; use strict 'refs'; no strict 'subs'; # Allow bare words for parameter %'s use vars qw($VERSION); ### The package version, both in 1.23 style *and* usable by MakeMaker: $VERSION = substr q$Revision: 1.2 $, 10; # # These are the custom functions that you can write to produce a value # for any configuration keyword that you want to do clever things such # as retrieve values from a database. # # Your function may be passed a "message" object, and must return # a legal value for the configuration parameter. No checking will be # done on the result, for extra speed. If you want to find out what # there is in a "message" object, look at Message.pm as they are all # listed there. # # You must handle the case when no "message" object is passed to your # function. In this case it should return a sensible default value. # # Return value: You must return the internal form of the result values. # For example, if you are producing a yes or no value, # you return 1 or 0. To find all the internal values # look in ConfigDefs.pl. # # For each function "FooValue" that you write, there needs to be a # function "InitFooValue" which will be called when the configuration # file is read. In the InitFooValue function, you will need to set up # any global state such as create database connections, read more # configuration files and so on. # ## ## This is a trivial example function to get you started. ## You could use it in the main MailScanner configuration file like ## this: ## VirusScanning = &ScanningValue ## #sub InitScanningValue { # # No initialisation needs doing here at all. # MailScanner::Log::InfoLog("Initialising ScanningValue"); #} # #sub EndScanningValue { # # No shutdown code needed here at all. # # This function could log total stats, close databases, etc. # MailScanner::Log::InfoLog("Ending ScanningValue"); #} # ## This will return 1 for all messages except those generated by this ## computer. #sub ScanningValue { # my($message) = @_; # # return 1 unless $message; # Default if no message passed in # # return 0 if $message->{subject} =~ /jules/i; # return 1; # # #my($IPAddress); # #$IPAddress = $message->{clientip}; # #return 0 if $IPAddress eq '127.0.0.1'; # #return 1; #} my(@sarules); sub InitHoaxCheck { # No initialisation needs doing here at all. open(RULELIST, "/etc/MailScanner/sahoaxrules.list"); while(){ push(@sarules, $_); } close(RULELIST); # open(HOAXLOG, ">>", "/root/hoaxlog"); # print HOAXLOG "@sarules"; MailScanner::Log::InfoLog("Initialising Hoax Checking"); } sub EndHoaxCheck { # No shutdown code needed here at all. # This function could log total stats, close databases, etc. #close(HOAXLOG); MailScanner::Log::InfoLog("Ending Hoax Checking"); } # ## This will return 1 for all messages except those generated by this ## computer. sub HoaxCheck { my($message) = @_; my(@scored, $rname, $rscore, $totscore); $message->{spamreport} =~ /^spam, SpamAssassin\s*\(score=[0-9.]*,\s*required\s*\d*(.*)\)$/s; $message->{spamreport} = $1; $message->{spamreport} =~ s/\n//sg; push(@scored, split(/(\s+|,+)+/, $message->{spamreport})); foreach(@sarules){ ($rname, $rscore) = /^(\S*)\s*(\S*)\s*.*$/; foreach(@scored){ if (/^$rname$/) { $totscore += $rscore; } } } #print HOAXLOG $totscore; #print HOAXLOG "\n"; #print HOAXLOG "@sarules"; #print HOAXLOG "\n"; #print HOAXLOG "@scored"; if($totscore>=2) {return "{HOAX??}"}; return "{SPAM??}"; # # return 1 unless $message; # Default if no message passed in # # return 0 if $message->{subject} =~ /jules/i; # return 1; # # #my($IPAddress); # #$IPAddress = $message->{clientip}; # #return 0 if $IPAddress eq '127.0.0.1'; # #return 1; } 1; -------------- next part -------------- NIGERIAN_TRANSACTION_1 2 US_DOLLARS 2 US_DOLLARS_3 2 US_DOLLARS_4 2 OFFSHORE_SCAM 2 VACATION_SCAM 3 NIGERIAN_SCAM 2 PSYCHIC 1 FRIEND_GREETINGS 2 FRIEND_GREETINGS2 2 From vanhorn at whidbey.com Wed Apr 16 21:51:32 2003 From: vanhorn at whidbey.com (G. Armour Van Horn) Date: Thu Jan 12 21:17:48 2006 Subject: Porn msg identification? References: <5C0296D26910694BB9A9BBFC577E7AB001174FDC@pascal.priv.bmrb.co.uk> <1050524703.12072.21.camel@bach.kevinspicer.co.uk> Message-ID: <3E9DC254.A078F0E5@whidbey.com> I'll look at it this weekend. I think I can probably ignore the spam vs high-scoring spam by deleting the high-scoring stuff, which I was already contemplating. If I don't need a three-way decision, it sounds like your approach would work. Van Kevin Spicer wrote: > > I'm not sure I trust SA enough to delete messages based on a single > > SpamCheck > > code, but if I could give MS a list of codes that would be checked > > after messages > > had hit my Spam threshold, I would be just delighted. I.e., if the > > message is > > already declared spam, delete rather than re-subject if any of my list > > of > > PornCheck codes is present. > > I tried something similar a while ago, just as an experiment with custom > functions. The principal difference was that I decided to try and > differentiate hoaxes from ordinary spams. I think I got it working (but > I'm not 100% sure - I never got it into production because the number of > SA rules which suggest hoaxes didn't seem high enough to make it > reliable). I've attached my _untested_ code in case its any use to > you. DON'T USE IT IN PRODUCTION WITHOUT SERIOUS TESTING!!! > -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For web hosting and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ---------------------------------------------------------- From admin at thenamegame.com Wed Apr 16 22:04:10 2003 From: admin at thenamegame.com (Michael Szabados) Date: Thu Jan 12 21:17:48 2006 Subject: Exim+Mailscanner duplicate message scans References: <5.2.0.9.2.20030416091109.03058458@imap.ecs.soton.ac.uk> Message-ID: <008c01c3045b$b9c18b70$6401a8c0@thenamegame.com> Well my syslog.conf contains two lines as you said. Since im running Bastille firewall it seems another line has been added by Bastille to log it Here is what i see; This is the origional line # Log all the mail messages in one place. local0.notice;local0.debug;mail.*;mail.none;mail.info;local0.info /var/log/maillog And then i have another one here ############ BASTILLE ADDITIONS BELOW : ################# # Log warning and errors to the new file /var/log/syslog *.warn;*.err /var/log/syslog # Log all kernel messages to the new file /var/log/kernel kern.* /var/log/kernel # Log all logins to /var/log/loginlog auth.*;user.*;daemon.none /var/log/loginlog # Log additional data to the Alt-F7 and Alt-F8 screens (Pseudo TTY 7 and 8) *.info;mail.none;authpriv.none /dev/tty7 authpriv.* /dev/tty7 *.warn;*.err /dev/tty7 kern.* /dev/tty7 local0.notice;local0.debug;mail.*;mail.none;mail.info;local0.info /var/log/maillog So your saying i should remove one? ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, April 16, 2003 1:12 AM Subject: Re: Exim+Mailscanner duplicate message scans > At 22:32 15/04/2003, you wrote: > >Hello, Im running Exim+Mailscanner and my current configuration works > >great but i am a little confused about the scanning messages in > >/var/log/maillog. > > > >When a msg comes it i see duplicate msgs in maillog. Either its being > >scanned twice or Mailscanner is recording it as being scanned twice; > > > >Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Found 2 messages waiting > >Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Found 2 messages waiting > >Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Scanning 1 messages, > >12850 bytes > >Apr 15 12:39:05 srv05 MailScanner[19913]: New Batch: Scanning 1 messages, > >12850 bytes > >Apr 15 12:39:05 srv05 MailScanner[19913]: Spam Checks: Starting > >Apr 15 12:39:05 srv05 MailScanner[19913]: Spam Checks: Starting > > Check you /etc/syslog.conf doesn't have 2 separate lines for /var/log/maillog. > > >Also, if you look at the msg above you will see 2 msgs in NEW BATCH but it > >says only 1 is being scanned? I dont understand this. Does that mean only > >one msg was scanned and why the duplicates? Is that just the way it works > >with Exim? > > If another thread is already scanning one of the messages (or it is still > arriving from the SMTP connection) then you will see exactly this. Don't > worry about it. > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > From brian at UNEARTHED.ORG Wed Apr 16 22:07:27 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:48 2006 Subject: Porn msg identification? References: <5C0296D26910694BB9A9BBFC577E7AB001174FDC@pascal.priv.bmrb.co.uk> <1050524703.12072.21.camel@bach.kevinspicer.co.uk> <3E9DC254.A078F0E5@whidbey.com> Message-ID: <003b01c3045d$16272680$bc01020a@brianmay> I *NEVER* delete or auto report spam based on a score (unless it;s a spam trap)... There will always be a false positive that you wish you never killed. But I know there will be the lazy... ----- Original Message ----- From: "G. Armour Van Horn" To: Sent: Wednesday, April 16, 2003 1:51 PM Subject: Re: Porn msg identification? I'll look at it this weekend. I think I can probably ignore the spam vs high-scoring spam by deleting the high-scoring stuff, which I was already contemplating. If I don't need a three-way decision, it sounds like your approach would work. Van Kevin Spicer wrote: > > I'm not sure I trust SA enough to delete messages based on a single > > SpamCheck > > code, but if I could give MS a list of codes that would be checked > > after messages > > had hit my Spam threshold, I would be just delighted. I.e., if the > > message is > > already declared spam, delete rather than re-subject if any of my list > > of > > PornCheck codes is present. > > I tried something similar a while ago, just as an experiment with custom > functions. The principal difference was that I decided to try and > differentiate hoaxes from ordinary spams. I think I got it working (but > I'm not 100% sure - I never got it into production because the number of > SA rules which suggest hoaxes didn't seem high enough to make it > reliable). I've attached my _untested_ code in case its any use to > you. DON'T USE IT IN PRODUCTION WITHOUT SERIOUS TESTING!!! > -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For web hosting and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ---------------------------------------------------------- From mailscanner at ecs.soton.ac.uk Wed Apr 16 23:12:20 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 In-Reply-To: <20030416173416.M18045@dillonst.com> References: <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> <20030416163937.M92228@dillonst.com> <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030416231140.02283a28@imap.ecs.soton.ac.uk> Are you *absolutely* 100% sure you didn't decide to change anything else at the same time? Lots of other people have done this upgrade without any problem... At 18:35 16/04/2003, you wrote: >I have check all the RBL's we use and we are clean. Like i said it was >working fine with the same config before the upgrade and the scores are >correct but MS should not be tagging the subject line. > >On Wed, 16 Apr 2003 18:19:36 +0100, Julian Field wrote > > At 17:43 16/04/2003, you wrote: > > >Yesterday I upgraded MS to the latest version and Spamassassin to 2.53 and > > >now it marks all mail as spam even with a score like -119. I have stopped > > >the tagging for now to make the clients happy but I need to get this >fixed. > > > > Is your mail server in one of the RBL's ("Spam List") ? > > If you set > > Spam List = > > (i.e. set it to nothing) > > then what happens? > > > > >Here is the setup > > > > > >MailScanner 4.14-9 > > >SpamAssassin 2.53 > > >Sendmail > > >Perl 5.60 > > >RedHat 7.2 > > >Ensim 3.10 > > > > > >Thanks, > > >Daron > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 16 23:15:36 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: SpamAssassin Timeouts In-Reply-To: <5.2.0.9.0.20030416153629.0188d830@xanadu.evi-inc.com> References: <3E9D38A0.5684.4895BCA@localhost> <027201c3043b$b375cfd0$6400a8c0@hewlett9por0s0> Message-ID: <5.2.1.1.2.20030416231326.02382ad0@imap.ecs.soton.ac.uk> How about I change the default timeout to be 40 seconds then? The only problem there is that it won't get picked up by people using upgrade_MailScanner_conf as that will copy their old value into the new conf file. But it will help new users. At 20:44 16/04/2003, you wrote: >No, this is likely a continuation of sillyness between MailScanner and >spamassassin about default choices of timeout. > >MailScanner by default runs SA with a 30 second timeout. > >SA by default queries DNSBL's with a 30 second timeout. > >Thus, any time a DNSBL server fails to respond, MailScanner kills SA before >SA can complete. It's a bug to expect an application to complete within 30 >seconds, when you know that one of the operations used within that can take >30 seconds on it's own. > >As far as I know this bug has always been present in the default >MailScanner config. I'm running a very old version (almost a year old) and >it was there, and well known, back then. Apparently this has not changed. > >The appropriate part of man Mail::SpamAssassin::Conf is: > > rbl_timeout n (default 30) > All RBL queries are started at the beginning and we try to read > the results at the end. In case some of them are hanging or not > returning, you can specify here how long you're willing to wait > for them before deciding that they timed out > >Either the SA timeout that MS uses should be 35 (or longer), or the >rbl_timeout that SA uses should be changed to 25 (or less) in >spam.assassin.prefs.conf to prevent this sillyness. I personally run with a >10 second rbl_timeout. > > >At 11:04 AM 4/16/2003 -0700, Mark Nienberg wrote: >>I'm not sure how to troubleshoot the timeouts but after I installed >>SpamAssassin it timed out for about 10%-15% of the messages. When I >>changed to >> >>SpamAssassin Timeout = 40 >> >>from its default value of 30, the problem disappeared entirely. Maybe a >>function of our internet connection speed or the server speed or >>something, I don't know. >> >>Mark -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mike at CAMAROSS.NET Wed Apr 16 23:21:45 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 In-Reply-To: <5.2.1.1.2.20030416231140.02283a28@imap.ecs.soton.ac.uk> Message-ID: <006701c30466$911bcf40$af01a8c0@home.middlefinger.net> The script you wrote to upgrade_MailScanner_conf really helped me in upgrading multiple servers. A REAL timesaver and lessens the likelihood of an error between the keyboard and the chair :) Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Wednesday, April 16, 2003 5:12 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Big problems after upgrading to 4.14-9 Are you *absolutely* 100% sure you didn't decide to change anything else at the same time? Lots of other people have done this upgrade without any problem... At 18:35 16/04/2003, you wrote: >I have check all the RBL's we use and we are clean. Like i said it was >working fine with the same config before the upgrade and the scores are >correct but MS should not be tagging the subject line. > >On Wed, 16 Apr 2003 18:19:36 +0100, Julian Field wrote > > At 17:43 16/04/2003, you wrote: > > >Yesterday I upgraded MS to the latest version and Spamassassin to > > >2.53 and now it marks all mail as spam even with a score like -119. > > >I have stopped the tagging for now to make the clients happy but I > > >need to get this >fixed. > > > > Is your mail server in one of the RBL's ("Spam List") ? > > If you set > > Spam List = > > (i.e. set it to nothing) > > then what happens? > > > > >Here is the setup > > > > > >MailScanner 4.14-9 > > >SpamAssassin 2.53 > > >Sendmail > > >Perl 5.60 > > >RedHat 7.2 > > >Ensim 3.10 > > > > > >Thanks, > > >Daron > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz MailScanner > > thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mkettler at EVI-INC.COM Wed Apr 16 23:44:04 2003 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:17:48 2006 Subject: SpamAssassin Timeouts In-Reply-To: <5.2.1.1.2.20030416231326.02382ad0@imap.ecs.soton.ac.uk> References: <5.2.0.9.0.20030416153629.0188d830@xanadu.evi-inc.com> <3E9D38A0.5684.4895BCA@localhost> <027201c3043b$b375cfd0$6400a8c0@hewlett9por0s0> Message-ID: <5.2.0.9.0.20030416184207.0164bbb8@xanadu.evi-inc.com> Works for me. At least this way the number of users affected will be decreasing instead of increasing, which is much better overall. At 11:15 PM 4/16/2003 +0100, Julian Field wrote: >How about I change the default timeout to be 40 seconds then? >The only problem there is that it won't get picked up by people using >upgrade_MailScanner_conf as that will copy their old value into the new >conf file. But it will help new users. From lists at DILLONST.COM Wed Apr 16 23:52:56 2003 From: lists at DILLONST.COM (Daron) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 In-Reply-To: <5.2.1.1.2.20030416231140.02283a28@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> <20030416163937.M92228@dillonst.com> <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030416231140.02283a28@imap.ecs.soton.ac.uk> Message-ID: <20030416225149.M5112@dillonst.com> Julian, The only thing I did different on this upgrade from all the others is use the config script updater. I would love for you to look at my system if you would like. On Wed, 16 Apr 2003 23:12:20 +0100, Julian Field wrote > Are you *absolutely* 100% sure you didn't decide to change anything > else at the same time? Lots of other people have done this upgrade > without any problem... > > At 18:35 16/04/2003, you wrote: > >I have check all the RBL's we use and we are clean. Like i said it was > >working fine with the same config before the upgrade and the scores are > >correct but MS should not be tagging the subject line. > > > >On Wed, 16 Apr 2003 18:19:36 +0100, Julian Field wrote > > > At 17:43 16/04/2003, you wrote: > > > >Yesterday I upgraded MS to the latest version and Spamassassin to 2.53 and > > > >now it marks all mail as spam even with a score like -119. I have stopped > > > >the tagging for now to make the clients happy but I need to get this > >fixed. > > > > > > Is your mail server in one of the RBL's ("Spam List") ? > > > If you set > > > Spam List = > > > (i.e. set it to nothing) > > > then what happens? > > > > > > >Here is the setup > > > > > > > >MailScanner 4.14-9 > > > >SpamAssassin 2.53 > > > >Sendmail > > > >Perl 5.60 > > > >RedHat 7.2 > > > >Ensim 3.10 > > > > > > > >Thanks, > > > >Daron > > > > > > -- > > > Julian Field > > > www.MailScanner.info > > > Professional Support Services at www.MailScanner.biz > > > MailScanner thanks transtec Computers for their support > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 16 23:29:10 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 In-Reply-To: <006701c30466$911bcf40$af01a8c0@home.middlefinger.net> References: <5.2.1.1.2.20030416231140.02283a28@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030416232825.02603ca8@imap.ecs.soton.ac.uk> It was one of those things that suddenly occurred to me on a Saturday morning that it really wasn't that hard to do. It only took an hour to write once I had realised how to do it :-) At 23:21 16/04/2003, you wrote: >The script you wrote to upgrade_MailScanner_conf really helped me in >upgrading multiple servers. A REAL timesaver and lessens the likelihood of >an error between the keyboard and the chair :) > >Mike > > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >Of Julian Field >Sent: Wednesday, April 16, 2003 5:12 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Big problems after upgrading to 4.14-9 > > >Are you *absolutely* 100% sure you didn't decide to change anything else at >the same time? Lots of other people have done this upgrade without any >problem... > >At 18:35 16/04/2003, you wrote: > >I have check all the RBL's we use and we are clean. Like i said it was > >working fine with the same config before the upgrade and the scores are > >correct but MS should not be tagging the subject line. > > > >On Wed, 16 Apr 2003 18:19:36 +0100, Julian Field wrote > > > At 17:43 16/04/2003, you wrote: > > > >Yesterday I upgraded MS to the latest version and Spamassassin to > > > >2.53 and now it marks all mail as spam even with a score like -119. > > > >I have stopped the tagging for now to make the clients happy but I > > > >need to get this > >fixed. > > > > > > Is your mail server in one of the RBL's ("Spam List") ? > > > If you set > > > Spam List = > > > (i.e. set it to nothing) > > > then what happens? > > > > > > >Here is the setup > > > > > > > >MailScanner 4.14-9 > > > >SpamAssassin 2.53 > > > >Sendmail > > > >Perl 5.60 > > > >RedHat 7.2 > > > >Ensim 3.10 > > > > > > > >Thanks, > > > >Daron > > > > > > -- > > > Julian Field > > > www.MailScanner.info > > > Professional Support Services at www.MailScanner.biz MailScanner > > > thanks transtec Computers for their support > >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz MailScanner thanks >transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 16 23:58:57 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:48 2006 Subject: Big problems after upgrading to 4.14-9 In-Reply-To: <20030416225149.M5112@dillonst.com> References: <5.2.1.1.2.20030416231140.02283a28@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> <20030416163937.M92228@dillonst.com> <5.2.1.1.2.20030416181701.0258fe48@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030416231140.02283a28@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030416235651.02607da8@imap.ecs.soton.ac.uk> At 23:52 16/04/2003, you wrote: >Julian, > >The only thing I did different on this upgrade from all the others is use >the config script updater. > >I would love for you to look at my system if you would like. Sure thing. Only slight snags are that (1) it is just about midnight here, and (2) I am going to my parents' house in Wales in the morning until Tuesday morning and will have very limited bandwidth. But mail me (off-list) full access details (IP, username, password + root passsword) and I will take a look as soon as I can (possibly Thursday evening if I get a chance). >On Wed, 16 Apr 2003 23:12:20 +0100, Julian Field wrote > > Are you *absolutely* 100% sure you didn't decide to change anything > > else at the same time? Lots of other people have done this upgrade > > without any problem... > > > > At 18:35 16/04/2003, you wrote: > > >I have check all the RBL's we use and we are clean. Like i said it was > > >working fine with the same config before the upgrade and the scores are > > >correct but MS should not be tagging the subject line. > > > > > >On Wed, 16 Apr 2003 18:19:36 +0100, Julian Field wrote > > > > At 17:43 16/04/2003, you wrote: > > > > >Yesterday I upgraded MS to the latest version and Spamassassin to >2.53 and > > > > >now it marks all mail as spam even with a score like -119. I have >stopped > > > > >the tagging for now to make the clients happy but I need to get this > > >fixed. > > > > > > > > Is your mail server in one of the RBL's ("Spam List") ? > > > > If you set > > > > Spam List = > > > > (i.e. set it to nothing) > > > > then what happens? > > > > > > > > >Here is the setup > > > > > > > > > >MailScanner 4.14-9 > > > > >SpamAssassin 2.53 > > > > >Sendmail > > > > >Perl 5.60 > > > > >RedHat 7.2 > > > > >Ensim 3.10 > > > > > > > > > >Thanks, > > > > >Daron > > > > > > > > -- > > > > Julian Field > > > > www.MailScanner.info > > > > Professional Support Services at www.MailScanner.biz > > > > MailScanner thanks transtec Computers for their support > > > > -- > > Julian Field > > www.MailScanner.info > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From Steve at swaney.com Thu Apr 17 03:27:25 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:48 2006 Subject: Pos In-Reply-To: <006701c30466$911bcf40$af01a8c0@home.middlefinger.net> References: <006701c30466$911bcf40$af01a8c0@home.middlefinger.net> Message-ID: <1050546444.28184.34.camel@speedy> I think I've just about got it working. A few problems with the documentation / configuration which I'll document once I get it working. My last (maybe) problem - mail is stuck in the deferred queue. it's put there and stays. Apr 17 02:10:41 dell postfix/nqmgr[6361]: 877F86040B9: to=, relay=none, delay=1, status=deferred (deferred transport) MailScanner is running the the MailScanner,conf lines are accurate: Run As User = postfix Run As Group = postfix Incoming Queue Dir = /var/spool/postfix.in/deferred Outgoing Queue Dir = /var/spool/postfix/incoming MTA = postfix I'm behind a firewall but I was careful to make sure that Postfix was woring correctly befor I made the MailScanner configurations. Thanks, Steve Swaney Steve@Swaney.com -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030416/8667698c/attachment.html From zampatti at ZMA.COM.AR Thu Apr 17 05:04:00 2003 From: zampatti at ZMA.COM.AR (Zampatti) Date: Thu Jan 12 21:17:48 2006 Subject: unsuscribe Message-ID: <001301c30496$611aaed0$0200a8c0@PC1> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030417/9f4c90b9/attachment.html From sylvain.phaneuf at IMSU.OXFORD.AC.UK Thu Apr 17 10:09:11 2003 From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf) Date: Thu Jan 12 21:17:48 2006 Subject: stopping awl Message-ID: Hi, I would like to stop awl for a while and I have disabled it in the MailScanner.conf file (SpamAssassin Auto Whitelist = no). But it looks like MS is still using the scores that were built up when awl was on. Can I disable that ? Is there a file that contains these score than I can rename/delete. If yes where is it? MS 4.12-2 SA 2.50 RedHat 8.0 Thanks in advance, Sylvain =========================================================== Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 Information Management Services Unit - Medical Sciences Division Oxford University | email : sylvain.phaneuf@imsu.ox.ac.uk Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 Oxford OX3 9DU England =========================================================== From Peter.Bates at LSHTM.AC.UK Thu Apr 17 12:37:52 2003 From: Peter.Bates at LSHTM.AC.UK (Peter Bates) Date: Thu Jan 12 21:17:48 2006 Subject: Postfix support -- beta release Message-ID: Hello all... I've been working with the new support for Postfix in MS, and just thought I'd add a few things to what Julian has already said (and some of which he's added to the Installation guide at http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml ...) Firstly, I'd recommend copying over the chroot jail stuff over to the new /var/spool/postfix.in directory structure you create during the install: cp -rp /var/spool/postfix/etc /var/spool/postfix.in/etc cp -rp /var/spool/postfix/lib /var/spool/postfix.in/lib cp -rp /var/spool/postfix/usr /var/spool/postfix.in/usr ... to avoid the 'unknown service' errors, but also to allow DNS lookups to operate in the chroot. If you're using RBLs/DNSBLs on your 'incoming' Postfix, they naturally won't work without it! My Postfix box is used as a 'mail hub/gateway', and has no local users, so all of its mail uses the 'relay' transport, so the original suggestion of: defer_transports = smtp local virtual was missing 'relay', so things didn't work until I changed it to: defer_transports = smtp local virtual relay However, if you want to be really crafty, you can use Postfix's 'transport_maps' to be more specific about what you do with different domains... I already use this to force delivery to certain systems hidden behind my mailhub. If you have: transport_maps = hash:/etc/postfix.in/transport in main.cf You can then put lines in there like: domain.x.com scanner:[a.b.c.d] If you then add a definition for your 'scanner' transport to master.cf: scanner unix - - y - - smtp You can then put defer_transports = scanner into main.cf, and only those specific domains you want scanned will pass through MS at all... might be useful for some. I've also found adding these sorts of aliases to your shell are very useful for diagnosis/fiddling: alias inq='/usr/sbin/postqueue -c /etc/postfix.in -p' alias outq='/usr/sbin/postqueue -c /etc/postfix -p' alias postin='/usr/sbin/postfix -c /etc/postfix.in' alias postout='/usr/sbin/postfix -c /etc/postfix' So you can list the 'inbound' queue with 'inq', and the converse for 'outq', and likewise type 'postin reload' to reload the configuration on the incoming instance of Postfix. My one remaining problem with regard to getting Postfix to 'route' the mail properly was that I'm using address verification (available in recent snapshots of Postfix) to cache the 'valid' addresses, as, being a relay, my Postfix box has no idea of whether a certain address is 'valid' or not. Using deferred transports, these address lookups are then also deferred, so all mail is held off with a 45x error. I'm working at using LDAP to verify the incoming addresses (this reduces the load on MS, etc.), but that's another story and nothing whatsoever to do with MailScanner at all! Thanks as ever to Julian and crew (Mariano/Leo) for introducing the Postfix support in the first place... ---------------------------------------------------------------------------------------------------> Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-958 8353 / Fax: 0207- 636 9838 From Q.G.Campbell at NEWCASTLE.AC.UK Thu Apr 17 13:13:01 2003 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:17:48 2006 Subject: Sophos "sweep" problem - a funny thing happended... Message-ID: <52E50E4D595DDE4D861117A1FB62E79D2211E6@bond.ncl.ac.uk> Upgraded the Sophos stuff on our Linux boxes yesterday afternoon from the Sophos April CD. Installed a later libsavi (libsavi.so.3.2.05.033) into /usr/local/Sophos/lib but noticed it also replaced "sweep" in /usr/local/Sophos/bin. All seemed to be working well afterwards with viruses being detected up until 04:00 today. At 04:00 the Sophos autoupdate script ran to update the IDE files, etc. From mbowman at UDCOM.COM Thu Apr 17 13:40:17 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:48 2006 Subject: Client Administration GUI Message-ID: Hi, Has anyone developed a GUI front end for MailScanner that will empower the recipient to either Approve (whitelist) Delete Block (blacklist) Any e-mail they receive tagged as {SPAM?} I'm looking for a solution as a growing number of out clients who benefit from MailScanner now want to be able to control the e-mail flow without having to harass me to update the whitelist and blacklist rules. My installation runs on a RH 7.2 box which acts purely as a gateway and has no mailboxes locally for any clients. Thanks Matthew Bowman From Denis.Beauchemin at USHERBROOKE.CA Thu Apr 17 13:53:08 2003 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:17:48 2006 Subject: stopping awl In-Reply-To: References: Message-ID: <1050583987.2529.132.camel@dbeauchemin.si.usherbrooke.ca> I believe the file is: /root/.spamassassin/auto-whitelist.db Just delete or rename it. Denis Le jeu 17/04/2003 ? 05:09, Sylvain Phaneuf a ?crit : > Hi, > > I would like to stop awl for a while and I have disabled it in the MailScanner.conf file (SpamAssassin Auto Whitelist = no). But it looks like MS is still using the scores that were built up when awl was on. Can I disable that ? Is there a file that contains these score than I can rename/delete. If yes where is it? > > MS 4.12-2 > SA 2.50 > RedHat 8.0 > > Thanks in advance, > > > > > Sylvain > > =========================================================== > Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 > Information Management Services Unit - Medical Sciences Division > Oxford University | email : sylvain.phaneuf@imsu.ox.ac.uk > Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 > Oxford OX3 9DU England > =========================================================== -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From sylvain.phaneuf at IMSU.OXFORD.AC.UK Thu Apr 17 14:26:25 2003 From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf) Date: Thu Jan 12 21:17:48 2006 Subject: stopping awl Message-ID: Merci Denis. We have /root/.spamassassin/auto-whitelist without the db extension and the file size is 10 MB. It is a binary file. I renamed it then sent myself a test message from a yahoo account. The spam score is still in the minus side (exactly the same score as before the renaming of the file) suggesting that awl of some sort is still running: X-MailScanner-SpamCheck: not spam, SpamAssassin (score=-6.6, required 4.9, BAYES_01) Would I need to disable somthing else? Should the Bayes file in the same directory be renamed/deleted as well? -rw------- 1 root root 166314927 Apr 17 14:14 bayes_journal -rw------- 1 root root 3454 Apr 17 14:14 bayes_msgcount -rw------- 1 root root 5206016 Apr 17 14:13 bayes_seen -rw------- 1 root root 42049536 Apr 17 14:13 bayes_toks Sylvain >>> Denis.Beauchemin@USHERBROOKE.CA 17/04/2003 13:53:08 >>> I believe the file is: /root/.spamassassin/auto-whitelist.db Just delete or rename it. Denis Le jeu 17/04/2003 ? 05:09, Sylvain Phaneuf a ?crit : > Hi, > > I would like to stop awl for a while and I have disabled it in the MailScanner.conf file (SpamAssassin Auto Whitelist = no). But it looks like MS is still using the scores that were built up when awl was on. Can I disable that ? Is there a file that contains these score than I can rename/delete. If yes where is it? > > MS 4.12-2 > SA 2.50 > RedHat 8.0 > > Thanks in advance, > > > > > Sylvain > > =========================================================== > Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 > Information Management Services Unit - Medical Sciences Division > Oxford University | email : sylvain.phaneuf@imsu.ox.ac.uk > Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 > Oxford OX3 9DU England > =========================================================== -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From Steve at swaney.com Thu Apr 17 14:29:33 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:48 2006 Subject: Client Administration GUI In-Reply-To: References: Message-ID: <1050586173.28181.51.camel@speedy> A friend of mine is just finishing an installation of ispman, www.ispman.org for his small hosting company. This ispman installation will integrate postfix with LDAP support, MailScanner, and SpamAssassin with MySQL sopport. It will allow users, administrators and resellers to manage email accounts and DNS maps through the ispman web-based interface. As part of this application we're planning to add web based support for users or administrators to manipulate their own: white_lists black_lists spam scores We don't plan to implement a delete function. I'd hope we're within a month of putting this in production. I'll let you know when we have the SpamAssassin user administrator up. The code wil be integrated into the ipsman interface but it should give you a direction. Steve Steve Swaney Steve@Swaney.com On Thu, 2003-04-17 at 08:40, Matthew Bowman wrote: > Hi, > > Has anyone developed a GUI front end for MailScanner that will empower the > recipient to either > > Approve (whitelist) > Delete > Block (blacklist) > > Any e-mail they receive tagged as {SPAM?} > > I'm looking for a solution as a growing number of out clients who benefit > from MailScanner now want to be able > to control the e-mail flow without having to harass me to update the > whitelist and blacklist rules. > > My installation runs on a RH 7.2 box which acts purely as a gateway and > has no mailboxes locally for any clients. > > Thanks > > Matthew Bowman -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030417/a7664f61/attachment.html From dwinkler at ALGORITHMICS.COM Thu Apr 17 14:34:42 2003 From: dwinkler at ALGORITHMICS.COM (Derek Winkler) Date: Thu Jan 12 21:17:48 2006 Subject: Client Administration GUI Message-ID: <06EE2C86D3DAD5119A6C0060943F3C97055E6F20@tormail1.algorithmics.com> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: whitelist-requests.pl Type: application/octet-stream Size: 4187 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030417/75402cd7/whitelist-requests.obj From Denis.Beauchemin at USHERBROOKE.CA Thu Apr 17 14:42:00 2003 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:17:48 2006 Subject: stopping awl In-Reply-To: References: Message-ID: <1050586920.2528.144.camel@dbeauchemin.si.usherbrooke.ca> Sylvain, Now it is the Bayesian filter that is scoring your email. If you execute (my SpamAssassin installed itself in /usr/share/spamassassin): grep BAYES_01 /usr/share/spamassassin/* /usr/share/spamassassin/23_bayes.cf:body BAYES_01 eval:check_bayes('0.01', '0.10') /usr/share/spamassassin/23_bayes.cf:tflags BAYES_01 nice learn /usr/share/spamassassin/23_bayes.cf:describe BAYES_01 Bayesian classifier says spam probability is 1 to 10% /usr/share/spamassassin/30_text_fr.cf:lang fr describe BAYES_01 L'algorythme Bayesian a ?valu? la proba d'?tre un spam entre 1 and 10% /usr/share/spamassassin/50_scores.cf:score BAYES_01 0 0 -6.600 -6.600 you can see that this rule has a negative value because SA believes it is not SPAM. You could save the message to disk and use: sa-learn --spam --single < msg to train SA. Denis Le jeu 17/04/2003 ? 09:26, Sylvain Phaneuf a ?crit : > Merci Denis. We have /root/.spamassassin/auto-whitelist without the db extension and the file size is 10 MB. It is a binary file. > > I renamed it then sent myself a test message from a yahoo account. The spam score is still in the minus side (exactly the same score as before the renaming of the file) suggesting that awl of some sort is still running: > X-MailScanner-SpamCheck: not spam, SpamAssassin (score=-6.6, required 4.9, BAYES_01) > > Would I need to disable somthing else? Should the Bayes file in the same directory be renamed/deleted as well? > > -rw------- 1 root root 166314927 Apr 17 14:14 bayes_journal > -rw------- 1 root root 3454 Apr 17 14:14 bayes_msgcount > -rw------- 1 root root 5206016 Apr 17 14:13 bayes_seen > -rw------- 1 root root 42049536 Apr 17 14:13 bayes_toks > > Sylvain > > > > > >>> Denis.Beauchemin@USHERBROOKE.CA 17/04/2003 13:53:08 >>> > I believe the file is: /root/.spamassassin/auto-whitelist.db > > Just delete or rename it. > > Denis > > Le jeu 17/04/2003 ? 05:09, Sylvain Phaneuf a ?crit : > > Hi, > > > > I would like to stop awl for a while and I have disabled it in the MailScanner.conf file (SpamAssassin Auto Whitelist = no). But it looks like MS is still using the scores that were built up when awl was on. Can I disable that ? Is there a file that contains these score than I can rename/delete. If yes where is it? > > > > MS 4.12-2 > > SA 2.50 > > RedHat 8.0 > > > > Thanks in advance, > > > > > > > > > > Sylvain > > > > =========================================================== > > Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 > > Information Management Services Unit - Medical Sciences Division > > Oxford University | email : sylvain.phaneuf@imsu.ox.ac.uk > > Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 > > Oxford OX3 9DU England > > =========================================================== -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From jaearick at COLBY.EDU Thu Apr 17 14:42:12 2003 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:17:48 2006 Subject: Porn msg identification? In-Reply-To: <3E9DB50F.818AFBC2@whidbey.com> References: <3E92E35D.1400.5BA79E38@localhost> <5.2.0.9.2.20030410152900.02edd7e0@imap.ecs.soton.ac.uk> <3E9DB50F.818AFBC2@whidbey.com> Message-ID: Julian, Our IT director was ranting about this same legal-problems sexual harrassment article last week, and I told him that MailScanner already had a great solution: the striphtml option for spam. You designed this option to strip off the porn pix from spam, right? Anyway, he hated the idea, so I turned off the striphtml option, which I had been using. You can't win... --- Jeff Earickson On Wed, 16 Apr 2003, G. Armour Van Horn wrote: > Date: Wed, 16 Apr 2003 12:54:55 -0700 > From: G. Armour Van Horn > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Porn msg identification? > > Julian, > > I had a fax yesterday from one of the beneficiaries of my MailScanner system > complaining about porn spam, and then I saw a note in the Politech list about the > subject, referring to this story: > > http://news.com.com/2100-1032-995658.html > > That suggests that companies handling work-related mail could, in some > jurisdictions (both important ones like Australia and minor ones like the US > ) could end up with different obligations in handling porn pam than all > other kinds of solicitations. > From sylvain.phaneuf at IMSU.OXFORD.AC.UK Thu Apr 17 15:14:17 2003 From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf) Date: Thu Jan 12 21:17:48 2006 Subject: stopping awl Message-ID: Great ! Merci encore une fois. Sylvain >>> Denis.Beauchemin@USHERBROOKE.CA 17/04/2003 14:42:00 >>> Sylvain, Now it is the Bayesian filter that is scoring your email. If you execute (my SpamAssassin installed itself in /usr/share/spamassassin): grep BAYES_01 /usr/share/spamassassin/* /usr/share/spamassassin/23_bayes.cf:body BAYES_01 eval:check_bayes('0.01', '0.10') /usr/share/spamassassin/23_bayes.cf:tflags BAYES_01 nice learn /usr/share/spamassassin/23_bayes.cf:describe BAYES_01 Bayesian classifier says spam probability is 1 to 10% /usr/share/spamassassin/30_text_fr.cf:lang fr describe BAYES_01 L'algorythme Bayesian a ?valu? la proba d'?tre un spam entre 1 and 10% /usr/share/spamassassin/50_scores.cf:score BAYES_01 0 0 -6.600 -6.600 you can see that this rule has a negative value because SA believes it is not SPAM. You could save the message to disk and use: sa-learn --spam --single < msg to train SA. Denis Le jeu 17/04/2003 ? 09:26, Sylvain Phaneuf a ?crit : > Merci Denis. We have /root/.spamassassin/auto-whitelist without the db extension and the file size is 10 MB. It is a binary file. > > I renamed it then sent myself a test message from a yahoo account. The spam score is still in the minus side (exactly the same score as before the renaming of the file) suggesting that awl of some sort is still running: > X-MailScanner-SpamCheck: not spam, SpamAssassin (score=-6.6, required 4.9, BAYES_01) > > Would I need to disable somthing else? Should the Bayes file in the same directory be renamed/deleted as well? > > -rw------- 1 root root 166314927 Apr 17 14:14 bayes_journal > -rw------- 1 root root 3454 Apr 17 14:14 bayes_msgcount > -rw------- 1 root root 5206016 Apr 17 14:13 bayes_seen > -rw------- 1 root root 42049536 Apr 17 14:13 bayes_toks > > Sylvain > > > > > >>> Denis.Beauchemin@USHERBROOKE.CA 17/04/2003 13:53:08 >>> > I believe the file is: /root/.spamassassin/auto-whitelist.db > > Just delete or rename it. > > Denis > > Le jeu 17/04/2003 ? 05:09, Sylvain Phaneuf a ?crit : > > Hi, > > > > I would like to stop awl for a while and I have disabled it in the MailScanner.conf file (SpamAssassin Auto Whitelist = no). But it looks like MS is still using the scores that were built up when awl was on. Can I disable that ? Is there a file that contains these score than I can rename/delete. If yes where is it? > > > > MS 4.12-2 > > SA 2.50 > > RedHat 8.0 > > > > Thanks in advance, > > > > > > > > > > Sylvain > > > > =========================================================== > > Sylvain Phaneuf --- Computing Manager | phone : +44 (0)1865 221323 > > Information Management Services Unit - Medical Sciences Division > > Oxford University | email : sylvain.phaneuf@imsu.ox.ac.uk > > Room 3A25B John Radcliffe Hospital | fax : +44 (0) 1865 221322 > > Oxford OX3 9DU England > > =========================================================== -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From lbergman at wtxs.net Thu Apr 17 17:57:07 2003 From: lbergman at wtxs.net (Lewis Bergman) Date: Thu Jan 12 21:17:48 2006 Subject: script for reviewing df/qf before sending to sa-learn Message-ID: <200304171157.07349.lbergman@wtxs.net> I have all my spam going to store. The df and qf are stored in the quarinteen so I can use df2mbox. I was wondering if anyone has made a script that cycles through each df/qf pair and then waits for keyboard input as to whether or not it is spam. Ideally the script would have a configurable mbox or directory and after the messaged was paged it would ask "Is this message spam?" [Y/N] and maybe default to yes. Yes answers would then be delivered to the spam address and no to the notspam address. Then when the script from Julian runs those have verified messages in them for sa-learn to use. Maybe I am thinking backwards on this but I don't see a better way to run it. I am not ready to do the web page deal or explain to all my users about how to redirect messages out of outlook. Any ideas on how to do this? Or maybe something better? -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From sevans at FOUNDATION.SDSU.EDU Thu Apr 17 18:32:24 2003 From: sevans at FOUNDATION.SDSU.EDU (Steve Evans) Date: Thu Jan 12 21:17:48 2006 Subject: Redirect Users Mail Message-ID: I have a user that needs all mail to their address to go to a different address. The situation is test@foundation.sdsu.edu needs to go to test@projects.sdsu.edu. My MX's for both of those domains reside on the mailscanner box, and all the mail gets routed to their respective internal server. So I tried to do this with virtusertable of sendmail but because neither domain is in the local-host-names file it doesn't work. So my question is can I do this easily with MailScanner? I was thinking of the redirect feature of spam could somehow be implemented here. Steve Evans SDSU Foundation (619) 594-0653 From Denis.Beauchemin at USHERBROOKE.CA Thu Apr 17 18:52:09 2003 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:17:48 2006 Subject: Redirect Users Mail In-Reply-To: References: Message-ID: <1050601929.2528.147.camel@dbeauchemin.si.usherbrooke.ca> I think it should work in /etc/aliases. Don't forget to run newaliases after modifying the file. Denis Le jeu 17/04/2003 ? 13:32, Steve Evans a ?crit : > I have a user that needs all mail to their address to go to a different > address. > > The situation is test@foundation.sdsu.edu needs to go to > test@projects.sdsu.edu. My MX's for both of those domains reside on the > mailscanner box, and all the mail gets routed to their respective > internal server. > > So I tried to do this with virtusertable of sendmail but because neither > domain is in the local-host-names file it doesn't work. > > So my question is can I do this easily with MailScanner? I was thinking > of the redirect feature of spam could somehow be implemented here. > > Steve Evans > SDSU Foundation > (619) 594-0653 -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From sevans at FOUNDATION.SDSU.EDU Thu Apr 17 18:55:14 2003 From: sevans at FOUNDATION.SDSU.EDU (Steve Evans) Date: Thu Jan 12 21:17:48 2006 Subject: Redirect Users Mail Message-ID: The problem is the sendmail box holds no mail accounts at all. (Except for root, etc) All of the mail is routed to internal mail servers using the mailertable file. My understanding of the alias file is that you can redirect mail intended for a local user to an external user. For example if I wanted all mail for root to be sent to an address on another server. Steve Evans SDSU Foundation (619) 594-0653 -----Original Message----- From: Denis Beauchemin [mailto:Denis.Beauchemin@USHERBROOKE.CA] Sent: Thursday, April 17, 2003 10:52 AM To: MAILSCANNER@JISCMAIL.AC.UK I think it should work in /etc/aliases. Don't forget to run newaliases after modifying the file. Denis Le jeu 17/04/2003 ? 13:32, Steve Evans a ?crit : > I have a user that needs all mail to their address to go to a > different address. > > The situation is test@foundation.sdsu.edu needs to go to > test@projects.sdsu.edu. My MX's for both of those domains reside on > the mailscanner box, and all the mail gets routed to their respective > internal server. > > So I tried to do this with virtusertable of sendmail but because > neither domain is in the local-host-names file it doesn't work. > > So my question is can I do this easily with MailScanner? I was > thinking of the redirect feature of spam could somehow be implemented here. > > Steve Evans > SDSU Foundation > (619) 594-0653 -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From Steve at swaney.com Thu Apr 17 19:15:27 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:49 2006 Subject: Postfix MailScanner init.d scripts In-Reply-To: <5.2.0.9.2.20030416100915.0417ca58@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030416100915.0417ca58@imap.ecs.soton.ac.uk> Message-ID: <1050603326.28171.136.camel@speedy> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: MailScanner Type: text/x-sh Size: 2660 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030417/96d19119/MailScanner.bin -------------- next part -------------- A non-text attachment was scrubbed... Name: postfix Type: text/x-sh Size: 4345 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030417/96d19119/postfix.bin From mikew at CRUCIS.NET Thu Apr 17 19:30:14 2003 From: mikew at CRUCIS.NET (Mike W) Date: Thu Jan 12 21:17:49 2006 Subject: Redirect Users Mail In-Reply-To: References: Message-ID: <200304171330.17752.mikew@crucis.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thursday 17 April 2003 12:32 pm, you wrote: > I have a user that needs all mail to their address to go to a > different address. > > The situation is test@foundation.sdsu.edu needs to go to > test@projects.sdsu.edu. My MX's for both of those domains reside on > the mailscanner box, and all the mail gets routed to their respective > internal server. > > So I tried to do this with virtusertable of sendmail but because > neither domain is in the local-host-names file it doesn't work. > > So my question is can I do this easily with MailScanner? I was > thinking of the redirect feature of spam could somehow be implemented > here. > > Steve Evans > SDSU Foundation > (619) 594-0653 Why not try creating a .forward file in their local directory to forward the mail to the "new" account? mw - -- Registered Linux - 256979 NRA Life ARS: W?TMW -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE+nvK55fq6h2uDDlQRAm/zAJ9fa2pzdJvhs+yXTDjYFwDqsZGXZwCgn49o xto0r4wLba3ANDlYAUcOTO4= =WEt7 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by F-Prot and MailScanner, and is believed to be clean. From sevans at FOUNDATION.SDSU.EDU Thu Apr 17 19:44:42 2003 From: sevans at FOUNDATION.SDSU.EDU (Steve Evans) Date: Thu Jan 12 21:17:49 2006 Subject: Redirect Users Mail Message-ID: They're not local users to the MailScanner/Sendmail box, which is where I really would prefer to do this for several politcal reasons. Steve Evans SDSU Foundation (619) 594-0653 -----Original Message----- From: Mike W [mailto:mikew@CRUCIS.NET] Sent: Thursday, April 17, 2003 11:30 AM To: MAILSCANNER@JISCMAIL.AC.UK -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Thursday 17 April 2003 12:32 pm, you wrote: > I have a user that needs all mail to their address to go to a > different address. > > The situation is test@foundation.sdsu.edu needs to go to > test@projects.sdsu.edu. My MX's for both of those domains reside on > the mailscanner box, and all the mail gets routed to their respective > internal server. > > So I tried to do this with virtusertable of sendmail but because > neither domain is in the local-host-names file it doesn't work. > > So my question is can I do this easily with MailScanner? I was > thinking of the redirect feature of spam could somehow be implemented > here. > > Steve Evans > SDSU Foundation > (619) 594-0653 Why not try creating a .forward file in their local directory to forward the mail to the "new" account? mw - -- Registered Linux - 256979 NRA Life ARS: W?TMW -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE+nvK55fq6h2uDDlQRAm/zAJ9fa2pzdJvhs+yXTDjYFwDqsZGXZwCgn49o xto0r4wLba3ANDlYAUcOTO4= =WEt7 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by F-Prot and MailScanner, and is believed to be clean. From info at pro-invest.ca Thu Apr 17 19:45:50 2003 From: info at pro-invest.ca (Professional Investments Investor Services) Date: Thu Jan 12 21:17:49 2006 Subject: Redirect Users Mail In-Reply-To: Message-ID: .forward file? Contents of .forward .. test@projects.sdsu.edu ?? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Steve Evans Sent: Thursday, April 17, 2003 1:55 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Redirect Users Mail The problem is the sendmail box holds no mail accounts at all. (Except for root, etc) All of the mail is routed to internal mail servers using the mailertable file. My understanding of the alias file is that you can redirect mail intended for a local user to an external user. For example if I wanted all mail for root to be sent to an address on another server. Steve Evans SDSU Foundation (619) 594-0653 -----Original Message----- From: Denis Beauchemin [mailto:Denis.Beauchemin@USHERBROOKE.CA] Sent: Thursday, April 17, 2003 10:52 AM To: MAILSCANNER@JISCMAIL.AC.UK I think it should work in /etc/aliases. Don't forget to run newaliases after modifying the file. Denis Le jeu 17/04/2003 ? 13:32, Steve Evans a ?crit : > I have a user that needs all mail to their address to go to a > different address. > > The situation is test@foundation.sdsu.edu needs to go to > test@projects.sdsu.edu. My MX's for both of those domains reside on > the mailscanner box, and all the mail gets routed to their respective > internal server. > > So I tried to do this with virtusertable of sendmail but because > neither domain is in the local-host-names file it doesn't work. > > So my question is can I do this easily with MailScanner? I was > thinking of the redirect feature of spam could somehow be implemented here. > > Steve Evans > SDSU Foundation > (619) 594-0653 -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From combs at magnet.fsu.edu Thu Apr 17 20:25:02 2003 From: combs at magnet.fsu.edu (Tom Combs) Date: Thu Jan 12 21:17:49 2006 Subject: SMTP Greeting Failure 421 SMTP... Message-ID: <200304171925.h3HJP2l1025013@osprey.magnet.fsu.edu> Hello All, Moderator - please put this in the bit bucket if deemed inappropriate. I just posted the following to comp.mail.sendmail. I thought I'd bounce it off this list due to the high quality of activity on this list. TIA.. Hello, I just upgraded from sendmail-8.11.6 to sendmail-8.12.9 on a box running Solaris 9. Everything is running fine EXCEPT I can not sendmail directly from the server itself unless I'm root. The error from Pine is SMTP Greeting Failure 421 SMTP connection went away. I did a google search and see that this is a common problem but none of the solutions seem to match my situation. Given that it works for root but not standard users seems to indicate that it is a permissions problem. However, I've been over everything a dozen times and don't see what the problem could be. Here are some relevant listings: drwxr-xr-x 3 root root 1024 Apr 17 13:50 /etc/mail/ -rw-r--r-- 1 root root 2241 Apr 17 11:46 access -rw-r----- 1 root root 24576 Apr 17 11:46 access.db -rw-r--r-- 1 root root 99292 Apr 17 10:43 aliases -rw------- 1 root root 172032 Apr 17 10:43 aliases.db -rw-r--r-- 1 root root 106 Apr 17 09:33 local-host-names -rw------- 1 root root 8 Apr 17 09:33 relay-domains -r--r--r-- 1 root bin 54602 Apr 17 14:11 sendmail.cf -r--r--r-- 1 root bin 38844 Apr 17 14:11 submit.cf -r-xr-sr-x 1 root smmsp 867208 Apr 17 14:08 /usr/lib/sendmail drwxrwx--- 2 smmsp smmsp 512 Apr 17 14:38 /var/spool/clientmqueue/ drwxr-xr-x 4 root other 512 Jul 5 2002 /var/spool/MailScanner drw------- 4 root root 512 Apr 17 15:02 /var/spool/spamassassin/ drwx------ 2 root bin 1024 Apr 17 15:02 /var/spool/mqueue/ drwxr-x--- 2 root bin 512 Apr 17 15:02 /var/spool/mqueue.in/ magnet# /usr/lib/sendmail -Am -bs -d44.4 safefile(/etc/mail/sendmail.cf, uid=0, gid=0, flags=6000, mode=400): safedirpath(/etc/mail, uid=0, gid=0, flags=6000, level=0, offset=0): [dir /etc/mail] OK [uid 0, nlink 1, stat 100444, mode 400] OK safefile(/etc/mail/local-host-names, uid=0, gid=0, flags=6580, mode=400): safedirpath(/etc/mail, uid=0, gid=0, flags=6580, level=0, offset=0): [dir /etc/mail] OK [uid 0, nlink 1, stat 100644, mode 400] OK safefile(/etc/mail/relay-domains, uid=0, gid=0, flags=6580, mode=400): safedirpath(/etc/mail, uid=0, gid=0, flags=6580, level=0, offset=0): [dir /etc/mail] OK [uid 0, nlink 1, stat 100600, mode 400] OK safedirpath(/var/spool/mqueue, uid=0, gid=0, flags=4, level=0, offset=0): [dir /var/spool/mqueue] OK safefile(/etc/mail/access.db, uid=0, gid=0, flags=584, mode=400): safedirpath(/etc/mail, uid=0, gid=0, flags=584, level=0, offset=0): [dir /etc/mail] OK [uid 0, nlink 1, stat 100640, mode 400] OK 220 magnet.fsu.edu ESMTP Sendmail 8.12.9/8.12.9; Thu, 17 Apr 2003 15:04:40 -0400 (EDT) What drives me nuts is I have another server running the same stuff and it works fine. Fortunately most of the users don't login to check their mail. Any help will be greatly appreciated! -- Tom Combs E-mail: combs@magnet.fsu.edu National High Magnetic Field Laboratory Phone: (850) 644-1657 1800 E. Paul Dirac Drive Tallahassee, FL 32310 From kevins at BMRB.CO.UK Thu Apr 17 21:41:49 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:49 2006 Subject: SMTP Greeting Failure 421 SMTP... In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174FFD@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174FFD@pascal.priv.bmrb.co.uk> Message-ID: <1050612112.7236.23.camel@bach.kevinspicer.co.uk> I just upgraded from sendmail-8.11.6 to sendmail-8.12.9 on a box running Solaris 9. I don't have access to Solaris 9, but I do have 8 & 2.6 (plus plenty of linux boxes) and I think theres a couple of odd things in the permissions. -r-xr-sr-x 1 root smmsp 867208 Apr 17 14:08 /usr/lib/sendmail Note that sendmail is running setgid but not setuid (probably not wrong but a change on earlier Solaris versions I think) This means (assuming pine calls sendmail directly, I'm not sure whether it does or not) a none root user won't be able to read these configuration files. -rw-r----- 1 root root 24576 Apr 17 11:46 access.db -rw------- 1 root root 172032 Apr 17 10:43 aliases.db -rw------- 1 root root 8 Apr 17 09:33 relay-domains [ You might change these to 644?] It also won't be able to write to mqueue... drwx------ 2 root bin 1024 Apr 17 15:02 /var/spool/mqueue/ [I'd have thought that should be 750 root:smmsp] You might like to try invoking /usr/lib/sendmail from the command line as a none privileged user to see if that throws up any errors. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From raymond at PROLOCATION.NET Thu Apr 17 21:48:12 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:49 2006 Subject: SMTP Greeting Failure 421 SMTP... In-Reply-To: <1050612112.7236.23.camel@bach.kevinspicer.co.uk> Message-ID: Hi! > I just upgraded from sendmail-8.11.6 to sendmail-8.12.9 on > a box running Solaris 9. > [ You might change these to 644?] > It also won't be able to write to mqueue... > > drwx------ 2 root bin 1024 Apr 17 15:02 /var/spool/mqueue/ > > [I'd have thought that should be 750 root:smmsp] 8.12.x does deliver to clientqueue if i am right, not directly to mqueue Does that dir have the right perms ? Bye, Raymond. From mailscanner at ecs.soton.ac.uk Thu Apr 17 21:57:38 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Postfix support beta 4.15-4 Message-ID: <1050613058.3e9f1542efe8a@secure.ecs.soton.ac.uk> I have just posted 4.15-4 on the web site. This fixes a couple of important bugs that could cause Postfix to delete some messages rather than deliver them. Many thanks to Peter and Steve for alerting me to one of them. -- Jules mailscanner@ecs.soton.ac.uk From kevins at BMRB.CO.UK Thu Apr 17 23:01:12 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:49 2006 Subject: SMTP Greeting Failure 421 SMTP... In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001174FFF@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001174FFF@pascal.priv.bmrb.co.uk> Message-ID: <1050616876.30935.6.camel@bach.kevinspicer.co.uk> O > drwx------ 2 root bin 1024 Apr 17 15:02 /var/spool/mqueue/ > > [I'd have thought that should be 750 root:smmsp] 8.12.x does deliver to clientqueue if i am right, not directly to mqueue Does that dir have the right perms ? I think you're right - I know I was slightly wrong as changing the permissions of mqueue to 750 root:smmsp still won't make it writeable by anyone other than root. Had a 'doh!' moment there, sorry! BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mark at TIPPINGMAR.COM Fri Apr 18 03:05:13 2003 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:17:49 2006 Subject: Sophos "sweep" problem - a funny thing happended... In-Reply-To: <52E50E4D595DDE4D861117A1FB62E79D2211E6@bond.ncl.ac.uk> Message-ID: <3111561E-7142-11D7-95D1-0003939C8BF6@tippingmar.com> You didn't upgrade using the install program on the CD did you? The correct way is to run the "Sophos.install" script that came with MailScanner which sets the appropriate environment for you. Then sophos-wrapper (v4.x) or sophoswrapper(v3.x) should work. If sweep runs directly without complaining, I don't think your sophos installation is right. Mark On Thursday, April 17, 2003, at 05:13 AM, Quentin Campbell wrote: > Upgraded the Sophos stuff on our Linux boxes yesterday afternoon from > the Sophos April CD. Installed a later libsavi (libsavi.so.3.2.05.033) > into /usr/local/Sophos/lib but noticed it also replaced "sweep" in > /usr/local/Sophos/bin. > > All seemed to be working well afterwards with viruses being detected up > until 04:00 today. > > At 04:00 the Sophos autoupdate script ran to update the IDE files, etc. >> From that point on whenever "/usr/local/Sophos/bin/sophoswrapper" ran >> it > gave "Error initialising detection engine - missing part of virus > data". > > Invoked the "autoupdate" script again which appears to run OK. The > files > under /usr/local/Sophos/* appeared to be updated OK again but the error > still appeared. > > However noticed that when I invoked "sweep" directly on a file it works > OK. That is: > > ./sweep /tmp/eicar.com # OK > > ./sophoswrapper /tmp/eicar.com # Error initialising detection ... > > So modified "sophoswrapper" as follows ( added #TMP#) so that "sweep" > is > run without the $SAV_IDE and $LD_LIBRARY_PATH environment variables > being set - "sophoswrapper" is now working OK. > > Can anyone suggest why the new "sweep" suddenly started behaving > differently after the 04:00 IDE update? > > ------------------------------ cut here > (/usr/local/Sophos/bin/sophoswrapper) > PackageDir=/usr/local/Sophos > prog=sweep # `basename $0` > > #TMP#SAV_IDE=$PackageDir/ide > #TMP#LD_LIBRARY_PATH=$PackageDir/lib > #TMP#export SAV_IDE > #TMP#export LD_LIBRARY_PATH > > exec ${PackageDir}/bin/$prog "$@" > ------------------------------ cut here > > Quentin > --- > PHONE: +44 191 222 8209 Computing Service, University of Newcastle > FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 > 7RU. > ----------------------------------------------------------------------- > - > "Any opinion expressed above is mine. The University can get its own." From lbergman at wtxs.net Fri Apr 18 16:24:36 2003 From: lbergman at wtxs.net (Lewis Bergman) Date: Thu Jan 12 21:17:49 2006 Subject: script for reviewing df/qf before sending to sa-learn In-Reply-To: <200304171157.07349.lbergman@wtxs.net> References: <200304171157.07349.lbergman@wtxs.net> Message-ID: <200304181024.36283.lbergman@wtxs.net> Anyone want to write something like this for me for a fee? On Thursday 17 April 2003 11:57 am, Lewis Bergman wrote: > I have all my spam going to store. The df and qf are stored in the > quarinteen so I can use df2mbox. I was wondering if anyone has made a > script that cycles through each df/qf pair and then waits for keyboard > input as to whether or not it is spam. > > Ideally the script would have a configurable mbox or directory and after > the messaged was paged it would ask "Is this message spam?" [Y/N] and maybe > default to yes. Yes answers would then be delivered to the spam address and > no to the notspam address. Then when the script from Julian runs those have > verified messages in them for sa-learn to use. > > Maybe I am thinking backwards on this but I don't see a better way to run > it. I am not ready to do the web page deal or explain to all my users about > how to redirect messages out of outlook. > > Any ideas on how to do this? Or maybe something better? -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From mailscanner at ecs.soton.ac.uk Fri Apr 18 20:50:05 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Sophos "sweep" problem - a funny thing happended... In-Reply-To: <3111561E-7142-11D7-95D1-0003939C8BF6@tippingmar.com> References: <3111561E-7142-11D7-95D1-0003939C8BF6@tippingmar.com> Message-ID: <1050695405.3ea056edeb1ed@secure.ecs.soton.ac.uk> If you are running MailScanner version 4, don't use any of the old version 3 scripts that you still might have lying around in /usr/local/Sophos. The supporting scripts in version 4 are all in /usr/lib/MailScanner. You are looking for sophos-wrapper and sophos-autoupdate Sophos recently changed the structure of their virus pattern library, and this new layout is only recognised by the version 4 sophos-autoupdate script, not by the old version 3 script. If you are still running MailScanner 3, then download the tarball of MailScanner 4 and pull the sophos-autoupdate script out of it. It will almost certainly work just fine with MailScanner 3 :-) > On Thursday, April 17, 2003, at 05:13 AM, Quentin Campbell wrote: > > > Upgraded the Sophos stuff on our Linux boxes yesterday afternoon from > > the Sophos April CD. Installed a later libsavi (libsavi.so.3.2.05.033) > > into /usr/local/Sophos/lib but noticed it also replaced "sweep" in > > /usr/local/Sophos/bin. > > > > All seemed to be working well afterwards with viruses being detected up > > until 04:00 today. > > > > At 04:00 the Sophos autoupdate script ran to update the IDE files, etc. > >> From that point on whenever "/usr/local/Sophos/bin/sophoswrapper" ran > >> it > > gave "Error initialising detection engine - missing part of virus > > data". > > > > Invoked the "autoupdate" script again which appears to run OK. The > > files > > under /usr/local/Sophos/* appeared to be updated OK again but the error > > still appeared. > > > > However noticed that when I invoked "sweep" directly on a file it works > > OK. That is: > > > > ./sweep /tmp/eicar.com # OK > > > > ./sophoswrapper /tmp/eicar.com # Error initialising detection ... > > > > So modified "sophoswrapper" as follows ( added #TMP#) so that "sweep" > > is > > run without the $SAV_IDE and $LD_LIBRARY_PATH environment variables > > being set - "sophoswrapper" is now working OK. > > > > Can anyone suggest why the new "sweep" suddenly started behaving > > differently after the 04:00 IDE update? > > > > ------------------------------ cut here > > (/usr/local/Sophos/bin/sophoswrapper) > > PackageDir=/usr/local/Sophos > > prog=sweep # `basename $0` > > > > #TMP#SAV_IDE=$PackageDir/ide > > #TMP#LD_LIBRARY_PATH=$PackageDir/lib > > #TMP#export SAV_IDE > > #TMP#export LD_LIBRARY_PATH > > > > exec ${PackageDir}/bin/$prog "$@" > > ------------------------------ cut here From email at ace.net.au Sat Apr 19 06:59:45 2003 From: email at ace.net.au (Peter Nitschke) Date: Thu Jan 12 21:17:49 2006 Subject: Bayes setup In-Reply-To: <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> Message-ID: <200304191529450075.02961BBE@smtp1.ace.net.au> Julian, is this affected by the addition of {Spam?} to the Subject line? Peter *********** REPLY SEPARATOR *********** On 8/04/2003 at 2:35 PM Julian Field wrote: >There are 2 parts to the answer to this: > >1) You can set up a "spam" and a "notspam" email address for people to dump >wrongly categorised mail into. You then use sa-learn once every hour (or >day) to teach SpamAssassin about the messages it got wrong. I have already >posted a script to do this to this list, but have attached it again for >you. > >2) SpamAssassin is unique in being able to "auto-learn", i.e. teach itself. >It uses its other traditional rules to produce a score for each message. If >the score is very high (i.e. definitely spam) or very low (i.e. definitely >ham) then it feeds the message back into the learning code for the Bayes >engine. It only starts using the Bayes engine output as part of the overall >message score once it has auto-learned about 600 messages (I might well be >wrong on that figure, but it's a few hundred). >-- >Julian Field >www.MailScanner.info >MailScanner thanks transtec Computers for their support From splee at PLEXIO.COM Sat Apr 19 19:13:48 2003 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:17:49 2006 Subject: Spamassassin score always 0 Message-ID: <1050776028.32062.86.camel@ralph.plexio.private> I'm runnig MS4.14-9/SA2.53/perl5.6.1/exim3.34 on a Trustix 1.5 system. While I have "Use SpamAssassin = yes" and "Spam Checks = yes" set, the Spamassassin score is always 0: X-MailScanner-Information: Please contact the ISP for more information X-MailScanner: Found to be clean X-MailScanner-SpamCheck: not spam, SpamAssassin (score=0, required 4) Even though "Log Spam = yes", the maillog shows no evidence of Spamassassin starting: Apr 19 10:21:21 mail MailScanner[5544]: New Batch: Scanning 1 messages, 4645 bytes Apr 19 10:21:21 mail MailScanner[5544]: Spam Checks: Starting Apr 19 10:21:21 mail MailScanner[5544]: Virus and Content Scanning: Starting Apr 19 10:21:22 mail MailScanner[5544]: Uninfected: Delivered 1 message Apr 19 10:25:01 mail MailScanner[5542]: New Batch: Scanning 1 messages, 2414 bytes MS runs as user exim so I presume Spamassassin will write to /home/exim/.spamassassin - even thought the SA whitelist is not called within MailScanner.Conf. Could there be some permissions issues? MS was installed from rpm and I followed the MS website instructions on installing SA. What other diagnostics can I look for? Thanks for any advice, Stephen From dot at DOTAT.AT Sun Apr 20 03:58:47 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:49 2006 Subject: Spamassassin score always 0 In-Reply-To: Message-ID: Stephen Lee wrote: > >What other diagnostics can I look for? Turn on the MailScanner Debug and Debug SpamAssassin options, and check that the pathnames and number of rules that it reports are sane. Tony. -- f.a.n.finch http://dotat.at/ FAIR ISLE: SOUTHEAST BACKING NORTHEAST 4 OR 5, OCCASIONALLY 6 IN SOUTH LATER. MAINLY FAIR. MODERATE OR GOOD, OCCASIONALLY POOR IN NORTH LATER. From splee at PLEXIO.COM Sun Apr 20 04:57:45 2003 From: splee at PLEXIO.COM (Stephen Lee) Date: Thu Jan 12 21:17:49 2006 Subject: Spamassassin score always 0 In-Reply-To: References: Message-ID: <1050811065.32062.115.camel@ralph.plexio.private> On Sat, 2003-04-19 at 19:58, Tony Finch wrote: > Stephen Lee wrote: > > > >What other diagnostics can I look for? > > Turn on the MailScanner Debug and Debug SpamAssassin options, and check > that the pathnames and number of rules that it reports are sane. Thanks Tony! It turns out that the Spamassassin installation creates /usr/share/spamassassin/ with root-only access. Since I run Exim as exim.exim, Mailscanner couldn't read any of the spamassassin files. While I have the floor, install.sh creates /var/spool/MailScanner which is only readable by root. It would be nice if install.sh could remind users to ensure permissions are correct for that directory. Thanks, Stephen From louie at OKFIT.COM Sun Apr 20 17:50:54 2003 From: louie at OKFIT.COM (Louie Ching) Date: Thu Jan 12 21:17:49 2006 Subject: Using Sophos SAVI Library Message-ID: Hi there, I just upgrade to the new MailScanner V4.14-9 and use the Sophos V3.68 for virus scanning. The installation and upgrade do not have any error. Today, I just install to use the SAVI Library, and edit the MailScanner.conf for the "Virus Scanners = sophossavi". When I try to start the MailScanner, it give out the error(repeatly) as below: Apr 18 18:58:48 venus sendmail[735]: alias database /etc/aliases rebuilt by rootApr 18 18:58:48 venus sendmail[735]: /etc/aliases: 63 aliases, longest 10 bytes, 608 bytes total Apr 18 18:58:49 venus sendmail[744]: starting daemon (8.12.8): SMTPApr 18 18:58:49 venus sendmail[749]: starting daemon (8.12.8): queueing@00:15:00Apr 18 18:58:51 venus MailScanner[768]: MailScanner E- Mail Virus Scanner version 4.14-9 starting... Apr 18 18:58:55 venus MailScanner[768]: SophosSAVI ERROR:: initializing savi: The main body of virus data is missing (544)Apr 18 18:59:01 venus MailScanner[905]: MailScanner E-Mail Virus Scanner version 4.14-9 starting...Apr 18 18:59:02 venus MailScanner[905]: SophosSAVI ERROR:: initializing savi: The main body of virus data is missing (544) Thus, it continue to generate some MailScanner Defunct processesb, can anyone advise me how to solve this error? Thank, lc.. From mailscanner at ecs.soton.ac.uk Sun Apr 20 18:42:54 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Porn msg identification? In-Reply-To: References: <3E9DB50F.818AFBC2@whidbey.com> <3E92E35D.1400.5BA79E38@localhost> <5.2.0.9.2.20030410152900.02edd7e0@imap.ecs.soton.ac.uk> <3E9DB50F.818AFBC2@whidbey.com> Message-ID: <5.2.1.1.2.20030420183147.0232ce88@imap.ecs.soton.ac.uk> At 14:42 17/04/2003, you wrote: >Julian, > > Our IT director was ranting about this same legal-problems sexual >harrassment article last week, and I told him that MailScanner already >had a great solution: the striphtml option for spam. You designed this >option to strip off the porn pix from spam, right? Exactly. And the people here that use it love it. It just converts porn spam into a rectangle of totally unintelligible garbage, which is precisely what they want. > Anyway, he hated the >idea, so I turned off the striphtml option, which I had been using. >You can't win... Worth a try. One of my future projects is a content filter which will be passed attachment files and return modified attachments, so you can remove or alter any content you like. >--- Jeff Earickson > >On Wed, 16 Apr 2003, G. Armour Van Horn wrote: > > > Date: Wed, 16 Apr 2003 12:54:55 -0700 > > From: G. Armour Van Horn > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Porn msg identification? > > > > Julian, > > > > I had a fax yesterday from one of the beneficiaries of my MailScanner > system > > complaining about porn spam, and then I saw a note in the Politech list > about the > > subject, referring to this story: > > > > http://news.com.com/2100-1032-995658.html > > > > That suggests that companies handling work-related mail could, in some > > jurisdictions (both important ones like Australia and minor ones like > the US > > ) could end up with different obligations in handling porn pam > than all > > other kinds of solicitations. > > -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sun Apr 20 19:31:48 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Bayes setup In-Reply-To: <200304191529450075.02961BBE@smtp1.ace.net.au> References: <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030420193050.03577e98@imap.ecs.soton.ac.uk> At 06:59 19/04/2003, you wrote: >Julian, is this affected by the addition of {Spam?} to the Subject line? You can always tell SA to ignore the subject line when learning spam. I personally don't bother as no-one ever puts anything in "notspam" anyway as I set the threshold a bit on the high side so we never get false positives. >Peter > >*********** REPLY SEPARATOR *********** > >On 8/04/2003 at 2:35 PM Julian Field wrote: > > >There are 2 parts to the answer to this: > > > >1) You can set up a "spam" and a "notspam" email address for people to >dump > >wrongly categorised mail into. You then use sa-learn once every hour (or > >day) to teach SpamAssassin about the messages it got wrong. I have already > >posted a script to do this to this list, but have attached it again for > >you. > > > >2) SpamAssassin is unique in being able to "auto-learn", i.e. teach >itself. > >It uses its other traditional rules to produce a score for each message. >If > >the score is very high (i.e. definitely spam) or very low (i.e. definitely > >ham) then it feeds the message back into the learning code for the Bayes > >engine. It only starts using the Bayes engine output as part of the >overall > >message score once it has auto-learned about 600 messages (I might well be > >wrong on that figure, but it's a few hundred). > >-- > >Julian Field > >www.MailScanner.info > >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sun Apr 20 19:33:50 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Using Sophos SAVI Library In-Reply-To: Message-ID: <5.2.1.1.2.20030420193323.01fb5e30@imap.ecs.soton.ac.uk> At 17:50 20/04/2003, you wrote: >Hi there, > >I just upgrade to the new MailScanner V4.14-9 and use the Sophos V3.68 for >virus scanning. The installation and upgrade do not have any error. Did you do the Sophos upgrade using my "Sophos.install" script? Failing to do that would cause the symptoms you are seeing. >Today, I just install to use the SAVI Library, and edit the >MailScanner.conf for the "Virus Scanners = sophossavi". > >When I try to start the MailScanner, it give out the error(repeatly) as >below: > >Apr 18 18:58:48 venus sendmail[735]: alias database /etc/aliases rebuilt >by rootApr 18 18:58:48 venus sendmail[735]: /etc/aliases: 63 aliases, >longest 10 bytes, 608 bytes total >Apr 18 18:58:49 venus sendmail[744]: starting daemon (8.12.8): SMTPApr 18 >18:58:49 venus sendmail[749]: starting daemon (8.12.8): >queueing@00:15:00Apr 18 18:58:51 venus MailScanner[768]: MailScanner E- >Mail Virus Scanner version 4.14-9 starting... >Apr 18 18:58:55 venus MailScanner[768]: SophosSAVI ERROR:: initializing >savi: The main body of virus data is missing (544)Apr 18 18:59:01 venus >MailScanner[905]: MailScanner E-Mail Virus Scanner version 4.14-9 >starting...Apr 18 18:59:02 venus MailScanner[905]: SophosSAVI ERROR:: >initializing savi: The main body of virus data is missing (544) > >Thus, it continue to generate some MailScanner Defunct processesb, can >anyone advise me how to solve this error? > >Thank, >lc.. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mikea at MIKEA.ATH.CX Mon Apr 21 12:43:17 2003 From: mikea at MIKEA.ATH.CX (mikea) Date: Thu Jan 12 21:17:49 2006 Subject: filename rules questioned In-Reply-To: <200304211115.h3LBF3xx030822@avalon.Dartmouth.EDU>; from steve@AVALON.DARTMOUTH.EDU on Mon, Apr 21, 2003 at 07:15:03AM -0400 References: <200304211115.h3LBF3xx030822@avalon.Dartmouth.EDU> Message-ID: <20030421064317.A3217@mikea.ath.cx> On Mon, Apr 21, 2003 at 07:15:03AM -0400, Steve Campbell wrote: > Folks, > > We occasionally get complaints from users about harmless enclosures in email > they send or receive being deleted by MailScanner's filename.rules.conf > mechanism. Especially in a college environment like ours, we need to weigh the > risk of allowing enclosures through against the likelihood of false positives > and the resulting interference with legitimate enclosures. > > So my question is, is there any documented (not just anecdotal) evidence to > justify the blocking of enclosures with certain filenames as specified by > filename.rules.conf? Hi, all. First post to the list. Be gentle. Certainly there is as regards the executables (.exe, .bat, .com, .pif, .scr, and the like): those have been 100% worm/virus at my day job. The "iframe" tag is used in both malicious and benign mail; I strip it out because I can't tell the nature of the mail fast enough and well enough to justify the effort of that determination. I have considerable problems with benign files which had names of the form "a.b.c.d.e.f.doc", where a, b, c, d, e, and f are multicharacter strings. I work for a state highway department, and our design and engineering folks commonly use multi-part names to describe the project a file is related to. Moreover, the Feds and other state government agencies, both in this state and in other states, do the same. This has meant that I spend a half hour or so every day pulling and forwarding quarantined files; thank $DEITY for smbfs, which lets me copy them directly from a file on the MailScanner box to a file on the WIN-2K box. A _benefit_ of this activity is that the users are kept aware that we are scanning their mail for nasty things, but I'm about to the point of modifying the rules to not quarantine files of the form "*.wpd", "*.doc", and "*.pdf", and trust the second-level antivirus code that Lotus Notes invokes to catch anything with a name of that form. -- Mike Andrews mikea@mikea.ath.cx Tired old sysadmin since 1964 From lbergman at wtxs.net Mon Apr 21 14:07:37 2003 From: lbergman at wtxs.net (Lewis Bergman) Date: Thu Jan 12 21:17:49 2006 Subject: Bayes setup In-Reply-To: <5.2.1.1.2.20030420193050.03577e98@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030420193050.03577e98@imap.ecs.soton.ac.uk> Message-ID: <200304210807.37521.lbergman@wtxs.net> On Sunday 20 April 2003 01:31 pm, Julian Field wrote: > At 06:59 19/04/2003, you wrote: > >Julian, is this affected by the addition of {Spam?} to the Subject line? > > You can always tell SA to ignore the subject line when learning spam. > I personally don't bother as no-one ever puts anything in "notspam" anyway > as I set the threshold a bit on the high side so we never get false > positives. How do you tell it to ignore the subject? I can't find that option in man for sa-learn. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 915-695-6962 ext 115 From jaearick at COLBY.EDU Mon Apr 21 15:04:59 2003 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:17:49 2006 Subject: filename rules questioned In-Reply-To: <200304211115.h3LBF3xx030822@avalon.Dartmouth.EDU> References: <200304211115.h3LBF3xx030822@avalon.Dartmouth.EDU> Message-ID: Steve, FYI, we use all of the filename.rules.conf rules except for: deny \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$ which I comment out. With this rule, I get complaints about people who have something.something.something style documents being rejected. The hassle to these people isn't worth it, so I disable this rule. --- Jeff Earickson Colby College On Mon, 21 Apr 2003, Steve Campbell wrote: > Date: Mon, 21 Apr 2003 07:15:03 -0400 > From: Steve Campbell > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: filename rules questioned > > Folks, > > We occasionally get complaints from users about harmless enclosures in email > they send or receive being deleted by MailScanner's filename.rules.conf > mechanism. Especially in a college environment like ours, we need to weigh the > risk of allowing enclosures through against the likelihood of false positives > and the resulting interference with legitimate enclosures. > > So my question is, is there any documented (not just anecdotal) evidence to > justify the blocking of enclosures with certain filenames as specified by > filename.rules.conf? > > Steve Campbell > Dartmouth College > Hanover, NH US > From steve at AVALON.DARTMOUTH.EDU Mon Apr 21 12:15:03 2003 From: steve at AVALON.DARTMOUTH.EDU (Steve Campbell) Date: Thu Jan 12 21:17:49 2006 Subject: filename rules questioned Message-ID: <200304211115.h3LBF3xx030822@avalon.Dartmouth.EDU> Folks, We occasionally get complaints from users about harmless enclosures in email they send or receive being deleted by MailScanner's filename.rules.conf mechanism. Especially in a college environment like ours, we need to weigh the risk of allowing enclosures through against the likelihood of false positives and the resulting interference with legitimate enclosures. So my question is, is there any documented (not just anecdotal) evidence to justify the blocking of enclosures with certain filenames as specified by filename.rules.conf? Steve Campbell Dartmouth College Hanover, NH US From mailscanner at ecs.soton.ac.uk Mon Apr 21 18:29:42 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Bayes setup In-Reply-To: <200304210807.37521.lbergman@wtxs.net> References: <5.2.1.1.2.20030420193050.03577e98@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030408142846.04af7f88@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030420193050.03577e98@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030421182813.025dfeb8@imap.ecs.soton.ac.uk> At 14:07 21/04/2003, you wrote: >On Sunday 20 April 2003 01:31 pm, Julian Field wrote: > > At 06:59 19/04/2003, you wrote: > > >Julian, is this affected by the addition of {Spam?} to the Subject line? > > > > You can always tell SA to ignore the subject line when learning spam. > > I personally don't bother as no-one ever puts anything in "notspam" anyway > > as I set the threshold a bit on the high side so we never get false > > positives. >How do you tell it to ignore the subject? I can't find that option in man for >sa-learn. It's in "man Mail::SpamAssassin::Conf". I have already put some examples in spam.assassin.prefs.conf: # For spam and notspam bins bayes_ignore_header X-MailScanner bayes_ignore_header X-MailScanner-SpamCheck bayes_ignore_header X-MailScanner-SpamScore bayes_ignore_header X-MailScanner-Information so just add bayes_ignore_header Subject to that list. >-- >Lewis Bergman >Texas Communications >4309 Maple St. >Abilene, TX 79602-8044 >915-695-6962 ext 115 -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From marco at MUW.EDU Mon Apr 21 20:36:30 2003 From: marco at MUW.EDU (Marco Obaid) Date: Thu Jan 12 21:17:49 2006 Subject: Outgoing mail In-Reply-To: <5.2.0.9.2.20030313190023.0204b008@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030312210113.02725ef8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030312210113.02725ef8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030313190023.0204b008@imap.ecs.soton.ac.uk> Message-ID: <1050953790.3ea4483e0d406@webmail.MUW.Edu> Good day everyone, My mail server has been crawling lately due to increased mail usage and lots of presistent spammers. So I hope someone could provide some advice. It seems that virus-scanning and spam-checking are eating up lots of resources. I was thinking of creating another machine for processing only *outgoing* mail and keep my existing machine (with thousands of users) to process only *incoming* mail. I am hoping to reduce the load on the existing machine. I am not sure though where to start ... specifically, how to make a piece of mail go to the outgoing-mail server when a user sends a message. Does anyone know or have a document on doing such a setup? Am I on the right track for even going this route? I am using Sendmail on RH 7.3 w/MailScanner-Latest and SA-Latest Thank you for any advice/hint you could provide Marco _________________________________________________________________ This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail For the latest MUW Events, visit http://www.MUW.Edu/calendar From raymond at PROLOCATION.NET Mon Apr 21 20:18:27 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:49 2006 Subject: Outgoing mail In-Reply-To: <1050953790.3ea4483e0d406@webmail.MUW.Edu> Message-ID: Hi! > I am not sure though where to start ... specifically, how to make a piece of > mail go to the outgoing-mail server when a user sends a message. > > Does anyone know or have a document on doing such a setup? > Am I on the right track for even going this route? > > I am using Sendmail on RH 7.3 w/MailScanner-Latest and SA-Latest You could simply put a scanning machine in front of the box, to reduce load. Or, also an simple option, make a smart relay host that handles the outgoing queues ... Bye, Raymond. From mikea at MIKEA.ATH.CX Mon Apr 21 20:24:32 2003 From: mikea at MIKEA.ATH.CX (mikea) Date: Thu Jan 12 21:17:49 2006 Subject: Outgoing mail In-Reply-To: <1050953790.3ea4483e0d406@webmail.MUW.Edu>; from marco@MUW.EDU on Mon, Apr 21, 2003 at 02:36:30PM -0500 References: <5.2.0.9.2.20030312210113.02725ef8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030312210113.02725ef8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030313190023.0204b008@imap.ecs.soton.ac.uk> <1050953790.3ea4483e0d406@webmail.MUW.Edu> Message-ID: <20030421142432.A7260@mikea.ath.cx> On Mon, Apr 21, 2003 at 02:36:30PM -0500, Marco Obaid wrote: > Good day everyone, > > My mail server has been crawling lately due to increased mail usage and lots > of presistent spammers. So I hope someone could provide some advice. It seems > that virus-scanning and spam-checking are eating up lots of resources. > > I was thinking of creating another machine for processing only *outgoing* mail > and keep my existing machine (with thousands of users) to process only > *incoming* mail. I am hoping to reduce the load on the existing machine. > > I am not sure though where to start ... specifically, how to make a piece of > mail go to the outgoing-mail server when a user sends a message. > > Does anyone know or have a document on doing such a setup? > Am I on the right track for even going this route? > > I am using Sendmail on RH 7.3 w/MailScanner-Latest and SA-Latest > > Thank you for any advice/hint you could provide > Marco Hi, Marco. This is a fairly common technique which lets ISPs tailor mail-handler systems for their intended function. I think that if you're using sendmail on your main mailserver, you could just tell it to use your outbound mailsystem as a smarthost. I Could Be Wrong. If I am, I'm sure someone else will have the right answer. -- Mike Andrews mikea@mikea.ath.cx Tired old sysadmin since 1964 From marco at MUW.EDU Mon Apr 21 21:18:07 2003 From: marco at MUW.EDU (Marco Obaid) Date: Thu Jan 12 21:17:49 2006 Subject: Outgoing mail In-Reply-To: <20030421142432.A7260@mikea.ath.cx> References: <5.2.0.9.2.20030312210113.02725ef8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030312210113.02725ef8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030313190023.0204b008@imap.ecs.soton.ac.uk> <1050953790.3ea4483e0d406@webmail.MUW.Edu> <20030421142432.A7260@mikea.ath.cx> Message-ID: <1050956287.3ea451ff29628@webmail.MUW.Edu> > This is a fairly common technique which lets ISPs tailor mail-handler > systems for their intended function. I think that if you're using > sendmail on your main mailserver, you could just tell it to use your > outbound mailsystem as a smarthost. Execuse my ignorance ... what is a smarthost? _________________________________________________________________ This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail For the latest MUW Events, visit http://www.MUW.Edu/calendar From Mark.Puchalski at HONIGMAN.COM Mon Apr 21 21:01:03 2003 From: Mark.Puchalski at HONIGMAN.COM (Mark Puchalski) Date: Thu Jan 12 21:17:49 2006 Subject: Outbound disclaimer issue Message-ID: I've been setting up MailScanner w/SpamAssassin in a test lab as we prepare to migrate from GroupWise to Exchange in the next few months. I have gotten my sig.rules file set up so that inbound messages do not receive the disclaimer, but all outbound messages do. I want to exclude certain domains from this, however. My sig.rules file is a follows: From: 10.50. yes FromTo: default no To: *@mobile.mycingular.com no To: *@messaging.sprintpcs.com no To: *@archwireless.net no To: *@page.nextel.com no To: *@honigmanmiller.com no I'm pretty new to this, so can anyone tell me why the outbound disclaimer is being added to the domains specified above? Thank you. -------------------------------------------------------------- Mark A. Puchalski Network Engineer Honigman Miller Schwartz and Cohn LLP Office: 313.465.7167 Fax: 313.465.8267 ********************************************************************* Confidential: This electronic message and all contents contain information from the law firm of Honigman Miller Schwartz and Cohn LLP which may be privileged, confidential or otherwise protected from disclosure. The information is intended to be for the addressee only. If you are not the addressee, any disclosure, copy, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify us immediately (313.465.7000) and destroy the original message and all copies. ********************************************************************* From marco at MUW.EDU Mon Apr 21 21:38:10 2003 From: marco at MUW.EDU (Marco Obaid) Date: Thu Jan 12 21:17:49 2006 Subject: Outbound disclaimer issue In-Reply-To: References: Message-ID: <1050957490.3ea456b2033ce@webmail.MUW.Edu> Quoting Mark Puchalski : > From: 10.50. yes > FromTo: default no Isn't this supposed to be FromOrTo: default no ? _________________________________________________________________ This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail For the latest MUW Events, visit http://www.MUW.Edu/calendar From mikea at MIKEA.ATH.CX Mon Apr 21 21:14:06 2003 From: mikea at MIKEA.ATH.CX (mikea) Date: Thu Jan 12 21:17:49 2006 Subject: Outgoing mail In-Reply-To: <1050956287.3ea451ff29628@webmail.MUW.Edu>; from marco@muw.edu on Mon, Apr 21, 2003 at 03:18:07PM -0500 References: <5.2.0.9.2.20030312210113.02725ef8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030312210113.02725ef8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030313190023.0204b008@imap.ecs.soton.ac.uk> <1050953790.3ea4483e0d406@webmail.MUW.Edu> <20030421142432.A7260@mikea.ath.cx> <1050956287.3ea451ff29628@webmail.MUW.Edu> Message-ID: <20030421151406.A7884@mikea.ath.cx> On Mon, Apr 21, 2003 at 03:18:07PM -0500, Marco Obaid wrote: > > This is a fairly common technique which lets ISPs tailor mail-handler > > systems for their intended function. I think that if you're using > > sendmail on your main mailserver, you could just tell it to use your > > outbound mailsystem as a smarthost. > > Execuse my ignorance ... what is a smarthost? That was a question I had to ask not all that long ago. Ignorance is excusable, so long as you take steps to correct it -- as you have; thank you! It is nothing more than a host which your outbound mail handler knows is the next step in the mail path. It may itself be pointed to yet another smarthost, or connect directly to the recipient MTA. At the moment, if I read your initial post correctly, your outbound mail goes directly from your mail servers, or from the MailScanner machine; I'm not sure which. The change probably won't be difficult or expensive. -- Mike Andrews mikea@mikea.ath.cx Tired old sysadmin since 1964 From kevins at BMRB.CO.UK Mon Apr 21 21:21:52 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:49 2006 Subject: Outgoing mail In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175015@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175015@pascal.priv.bmrb.co.uk> Message-ID: <1050956516.11951.10.camel@bach.kevinspicer.co.uk> On Mon, 2003-04-21 at 21:18, Marco Obaid wrote: > This is a fairly common technique which lets ISPs tailor mail-handler > systems for their intended function. I think that if you're using > sendmail on your main mailserver, you could just tell it to use your > outbound mailsystem as a smarthost. Execuse my ignorance ... what is a smarthost? Its a host all non-local mail is sent to, which then handles onward delivery, rather than attempting to deliver mail directly to the recipient's mail server. For example, my home setup is to use my ISP's smtp server as a smarthost, so that I don't have to worry about the reliability of my internet connection, problems caused by the reverse lookup of my IP address (which I can't control) and servers which reject contacts from addresses in dial-up pools. smarthost is configured in sendmail.mc define(`SMART_HOST',`yoursmarthost.yourdomain.co.uk')dnl [then rebuild sendmail.cf] BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From kevins at BMRB.CO.UK Mon Apr 21 21:25:30 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:49 2006 Subject: Outbound disclaimer issue In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175016@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175016@pascal.priv.bmrb.co.uk> Message-ID: <1050956730.11951.14.camel@bach.kevinspicer.co.uk> On Mon, 2003-04-21 at 21:01, Mark Puchalski wrote: I've been setting up MailScanner w/SpamAssassin in a test lab as we prepare to migrate from GroupWise to Exchange in the next few months. I have gotten my sig.rules file set up so that inbound messages do not receive the disclaimer, but all outbound messages do. I want to exclude certain domains from this, however. My sig.rules file is a follows: From: 10.50. yes FromTo: default no To: *@mobile.mycingular.com no To: *@messaging.sprintpcs.com no To: *@archwireless.net no To: *@page.nextel.com no To: *@honigmanmiller.com no I'm pretty new to this, so can anyone tell me why the outbound disclaimer is being added to the domains specified above? At a guess because the mail is being sent from a 10.50.x.x address. IIRC rules are checked in the order they appear in the file (top to bottom) with the exception of the default rule which is always checked last. Moving your first line to the end of the list should solve the problem I think. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From Mark.Puchalski at HONIGMAN.COM Mon Apr 21 21:25:38 2003 From: Mark.Puchalski at HONIGMAN.COM (Mark Puchalski) Date: Thu Jan 12 21:17:49 2006 Subject: Outbound disclaimer issue Message-ID: Looking at the EXAMPLES file, it's denoted 'FromTo:' -------------------------------------------------------------- Mark A. Puchalski Network Engineer Honigman Miller Schwartz and Cohn LLP Office: 313.465.7167 Fax: 313.465.8267 >>> marco@MUW.EDU 4/21/03 4:38:10 PM >>> Quoting Mark Puchalski : > From: 10.50. yes > FromTo: default no Isn't this supposed to be FromOrTo: default no ? _________________________________________________________________ This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail For the latest MUW Events, visit http://www.MUW.Edu/calendar ********************************************************************* Confidential: This electronic message and all contents contain information from the law firm of Honigman Miller Schwartz and Cohn LLP which may be privileged, confidential or otherwise protected from disclosure. The information is intended to be for the addressee only. If you are not the addressee, any disclosure, copy, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify us immediately (313.465.7000) and destroy the original message and all copies. ********************************************************************* -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030421/868af74e/attachment.html From mikea at MIKEA.ATH.CX Mon Apr 21 22:39:40 2003 From: mikea at MIKEA.ATH.CX (mikea) Date: Thu Jan 12 21:17:49 2006 Subject: " timed out and was killed ..." Message-ID: <20030421163940.B8818@mikea.ath.cx> Would someone shine a light around and dispel some ignorance on my part, please? I see lots of these. Does it mean that the DNSBL server is just too busy, or should I fire up tcpdump and watch the DNS activity to see what's going on? : Apr 21 08:39:55 isdmonitor MailScanner[93474]: RBL Check : timed out and was killed, consecutive : failure 1 of 7 : Apr 21 08:39:55 isdmonitor MailScanner[93485]: RBL Check : timed out and was killed, consecutive : failure 1 of 7 And do these mean that I need to get a faster CPU, or faster disk, or at least to increase the SpamAssassin timeout value? : Apr 21 08:40:49 isdmonitor MailScanner[93466]: SpamAssassin timed out : and was killed, consecutive failure 1 of 20 : Apr 21 08:41:04 isdmonitor MailScanner[93474]: SpamAssassin timed out : and was killed, consecutive failure 1 of 20 FWIW, I've already increased the timer values somewhat. The machine that this is running on is underpowered (233 MHz), undersized (64 MBytes RAM), and running IDE disks; the OS is vanilla FreeBSD 4.3, right off the CD. -- Mike Andrews mikea@mikea.ath.cx Tired old sysadmin since 1964 From raymond at PROLOCATION.NET Mon Apr 21 22:42:56 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:49 2006 Subject: " timed out and was killed ..." In-Reply-To: <20030421163940.B8818@mikea.ath.cx> Message-ID: Hi! > I see lots of these. Does it mean that the DNSBL server is just > too busy, or should I fire up tcpdump and watch the DNS activity > to see what's going on? > > : Apr 21 08:39:55 isdmonitor MailScanner[93474]: RBL Check > : timed out and was killed, consecutive > : failure 1 of 7 > : Apr 21 08:39:55 isdmonitor MailScanner[93485]: RBL Check > : timed out and was killed, consecutive > : failure 1 of 7 > > And do these mean that I need to get a faster CPU, or faster disk, > or at least to increase the SpamAssassin timeout value? This means the response of the RBL server is too slow, might be a busy RBL or network problems somewhere. > FWIW, I've already increased the timer values somewhat. The machine that > this is running on is underpowered (233 MHz), undersized (64 MBytes > RAM), and running IDE disks; the OS is vanilla FreeBSD 4.3, right off > the CD. Its all depending on the mail load you have, its not a very heavy box anyway, but for low volume it should be ok. Bye, Raymond. From mike at CAMAROSS.NET Mon Apr 21 22:39:50 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:49 2006 Subject: " timed out and was killed ..." In-Reply-To: <20030421163940.B8818@mikea.ath.cx> Message-ID: <019d01c3084e$8a3d2480$af01a8c0@home.middlefinger.net> I see these from time to time. It could indicate a problem with the DNSBL or a network issue between you and the DNSBL. It usually clears itself up in a short time. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of mikea Sent: Monday, April 21, 2003 4:40 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: " timed out and was killed ..." Would someone shine a light around and dispel some ignorance on my part, please? I see lots of these. Does it mean that the DNSBL server is just too busy, or should I fire up tcpdump and watch the DNS activity to see what's going on? : Apr 21 08:39:55 isdmonitor MailScanner[93474]: RBL Check : timed out and was killed, consecutive : failure 1 of 7 : Apr 21 08:39:55 isdmonitor MailScanner[93485]: RBL Check : timed out and was killed, consecutive : failure 1 of 7 And do these mean that I need to get a faster CPU, or faster disk, or at least to increase the SpamAssassin timeout value? : Apr 21 08:40:49 isdmonitor MailScanner[93466]: SpamAssassin timed out : and was killed, consecutive failure 1 of 20 : Apr 21 08:41:04 isdmonitor MailScanner[93474]: SpamAssassin timed out : and was killed, consecutive failure 1 of 20 FWIW, I've already increased the timer values somewhat. The machine that this is running on is underpowered (233 MHz), undersized (64 MBytes RAM), and running IDE disks; the OS is vanilla FreeBSD 4.3, right off the CD. -- Mike Andrews mikea@mikea.ath.cx Tired old sysadmin since 1964 From jase at SENSIS.COM Mon Apr 21 23:02:17 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:49 2006 Subject: Locking failing? Message-ID: Hello. I am trying to get my new MailScanner server up and running, and I tried to test it with some queue files that were quarantined from my current MailScanner server. I've attached the MailScanner log, but it looks to me like two MailScanner processes were scanning the same email. Am I missing something, like maybe some perl module which needs to be installed? Thanks. Jason -------------- next part -------------- A non-text attachment was scrubbed... Name: mail.log Type: application/octet-stream Size: 5386 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030421/afbfd824/mail.obj From mk at quadstone.com Tue Apr 22 11:05:00 2003 From: mk at quadstone.com (Michael Keightley) Date: Thu Jan 12 21:17:49 2006 Subject: sa-learn and forwarded messages Message-ID: <20030422100459.GA10243@quadstone.com> I've setup a spam user to train the bayesian engine in SpamAssassin 2.53 (using the script on the MailScanner FAQ). If someone forwards messages to this user from a mailer like Mozilla or Outlook, the header will all be changed and it will have their signature etc in the message. Will this cause problems with sa-learn? If so, how can non-techie users send misidentified messages to this user? (I can use the bounce feature in Mutt to do this). Michael -- Michael Keightley Tel: +44 131 220 4491 Systems Manager, Quadstone Limited, Fax: +44 131 220 4492 16 Chester Street, Edinburgh EH3 7RA, Scotland http://www.quadstone.com From P.G.M.Peters at civ.utwente.nl Tue Apr 22 08:52:58 2003 From: P.G.M.Peters at civ.utwente.nl (Peter Peters) Date: Thu Jan 12 21:17:49 2006 Subject: UID of dir's (Was: Spamassassin score always 0) In-Reply-To: <1050811065.32062.115.camel@ralph.plexio.private> References: <1050811065.32062.115.camel@ralph.plexio.private> Message-ID: On Sat, 19 Apr 2003 20:57:45 -0700, you wrote: >On Sat, 2003-04-19 at 19:58, Tony Finch wrote: >> Stephen Lee wrote: >> > >> >What other diagnostics can I look for? >> >> Turn on the MailScanner Debug and Debug SpamAssassin options, and check >> that the pathnames and number of rules that it reports are sane. > >Thanks Tony! It turns out that the Spamassassin installation creates >/usr/share/spamassassin/ with root-only access. Since I run Exim as >exim.exim, Mailscanner couldn't read any of the spamassassin files. > >While I have the floor, install.sh creates /var/spool/MailScanner which >is only readable by root. It would be nice if install.sh could remind >users to ensure permissions are correct for that directory. As a feature request: Isn't it possible for the install script to install (and/or check) the directories and files whether the can be read/written by the user specified in MailScanner.conf? -- Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ From mailscanner at ecs.soton.ac.uk Tue Apr 22 12:58:59 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Outbound disclaimer issue In-Reply-To: <1050957490.3ea456b2033ce@webmail.MUW.Edu> References: Message-ID: <5.2.1.1.2.20030422125834.027439a8@imap.ecs.soton.ac.uk> At 21:38 21/04/2003, you wrote: >Quoting Mark Puchalski : > > > From: 10.50. yes > > FromTo: default no > >Isn't this supposed to be > >FromOrTo: default no ? FromOrTo will work just as well as FromTo. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From Mark.Puchalski at HONIGMAN.COM Tue Apr 22 13:04:48 2003 From: Mark.Puchalski at HONIGMAN.COM (Mark Puchalski) Date: Thu Jan 12 21:17:49 2006 Subject: Outbound disclaimer issue Message-ID: I moved the 10.50. reference to the end of the file, but that didn't fix it. Any other suggestions? -------------------------------------------------------------- Mark A. Puchalski Network Engineer Honigman Miller Schwartz and Cohn LLP Office: 313.465.7167 Fax: 313.465.8267 >>> kevins@BMRB.CO.UK 4/21/03 4:25:30 PM >>> On Mon, 2003-04-21 at 21:01, Mark Puchalski wrote: I've been setting up MailScanner w/SpamAssassin in a test lab as we prepare to migrate from GroupWise to Exchange in the next few months. I have gotten my sig.rules file set up so that inbound messages do not receive the disclaimer, but all outbound messages do. I want to exclude certain domains from this, however. My sig.rules file is a follows: From: 10.50. yes FromTo: default no To: *@mobile.mycingular.com no To: *@messaging.sprintpcs.com no To: *@archwireless.net no To: *@page.nextel.com no To: *@honigmanmiller.com no I'm pretty new to this, so can anyone tell me why the outbound disclaimer is being added to the domains specified above? At a guess because the mail is being sent from a 10.50.x.x address. IIRC rules are checked in the order they appear in the file (top to bottom) with the exception of the default rule which is always checked last. Moving your first line to the end of the list should solve the problem I think. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. ********************************************************************* Confidential: This electronic message and all contents contain information from the law firm of Honigman Miller Schwartz and Cohn LLP which may be privileged, confidential or otherwise protected from disclosure. The information is intended to be for the addressee only. If you are not the addressee, any disclosure, copy, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify us immediately (313.465.7000) and destroy the original message and all copies. ********************************************************************* -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030422/7ab3cbc9/attachment.html From dot at DOTAT.AT Tue Apr 22 15:16:15 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:49 2006 Subject: Locking failing? In-Reply-To: Message-ID: "Desai, Jason" wrote: > >I am trying to get my new MailScanner server up and running, and I tried to >test it with some queue files that were quarantined from my current >MailScanner server. I've attached the MailScanner log, but it looks to me >like two MailScanner processes were scanning the same email. Am I missing >something, like maybe some perl module which needs to be installed? I have seen this very occasionally with Exim. Are you using Sendmail or Exim? Tony. -- f.a.n.finch http://dotat.at/ SELSEY BILL TO LYME REGIS: VARIABLE 1 TO 3 BECOMING EAST OR NORTHEAST 3 OR 4. MAINLY FAIR. MODERATE OR GOOD. SLIGHT OR SMOOTH. From mailscanner at REXWIRE.COM Tue Apr 22 16:19:01 2003 From: mailscanner at REXWIRE.COM (mailscanner@REXWIRE.COM) Date: Thu Jan 12 21:17:49 2006 Subject: FW: Forwarding mail after scanning Message-ID: <005001c308e2$819850e0$1a01a8c0@AlanRoss.local> Has anyone been able to forward mail for a domain to another smtp server after checking for virus and spam? Any help or reference material will be appreciated. SKIP From raymond at PROLOCATION.NET Tue Apr 22 16:35:08 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:49 2006 Subject: FW: Forwarding mail after scanning In-Reply-To: <005001c308e2$819850e0$1a01a8c0@AlanRoss.local> Message-ID: Hi! > Has anyone been able to forward mail for a domain to another smtp server > after checking for virus and spam? Any help or reference material will be > appreciated. Sure. Thats simple. Assuming you use sendmail: Edit /etc/mail/mailertable Put in a entry like this: prolocation.net smtp:[myotherserver.prolocation.net] Bye, Raymond. From jase at SENSIS.COM Tue Apr 22 17:02:52 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:49 2006 Subject: Locking failing? Message-ID: I am using Exim 3.35. Jason > -----Original Message----- > From: Tony Finch [mailto:dot@DOTAT.AT] > Sent: Tuesday, April 22, 2003 10:16 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Locking failing? > > > "Desai, Jason" wrote: > > > >I am trying to get my new MailScanner server up and running, > and I tried to > >test it with some queue files that were quarantined from my current > >MailScanner server. I've attached the MailScanner log, but > it looks to me > >like two MailScanner processes were scanning the same email. > Am I missing > >something, like maybe some perl module which needs to be installed? > > I have seen this very occasionally with Exim. Are you using > Sendmail or Exim? > > Tony. > -- > f.a.n.finch http://dotat.at/ > SELSEY BILL TO LYME REGIS: VARIABLE 1 TO 3 BECOMING EAST OR > NORTHEAST 3 OR 4. > MAINLY FAIR. MODERATE OR GOOD. SLIGHT OR SMOOTH. > From Denis.Beauchemin at USHERBROOKE.CA Tue Apr 22 21:31:26 2003 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:17:49 2006 Subject: Message contains NUL characters Message-ID: <1051043486.22047.39.camel@dbeauchemin.si.usherbrooke.ca> Hello, My postmaster reported the following error to me: >Reporting-MTA: dns; email.usherbrooke.ca >Received-From-MTA: DNS; smtpabc.usherb.ca >Arrival-Date: Fri, 18 Apr 2003 19:58:02 -0400 > >Final-Recipient: RFC822; bb+mydelivery@livraison.locale >Action: failed >Status: 5.6.0 >Diagnostic-Code: X-Unix; 554 5.6.0 Message contains NUL characters >Last-Attempt-Date: Fri, 18 Apr 2003 19:58:02 -0400 Could this be caused by the following directives (mailscanner-4.14-9): Spam Actions = deliver forward spam@usherbrooke.ca High Scoring Spam Actions = deliver forward spam@usherbrooke.ca If not, could MS strip those NULs from the emails? Thanks! Denis -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From mailscanner at ecs.soton.ac.uk Tue Apr 22 21:43:32 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Message contains NUL characters In-Reply-To: <1051043486.22047.39.camel@dbeauchemin.si.usherbrooke.ca> Message-ID: <5.2.1.1.2.20030422214146.025dba28@imap.ecs.soton.ac.uk> At 21:31 22/04/2003, you wrote: >Hello, > >My postmaster reported the following error to me: > >Reporting-MTA: dns; email.usherbrooke.ca > >Received-From-MTA: DNS; smtpabc.usherb.ca > >Arrival-Date: Fri, 18 Apr 2003 19:58:02 -0400 > > > >Final-Recipient: RFC822; bb+mydelivery@livraison.locale > >Action: failed > >Status: 5.6.0 > >Diagnostic-Code: X-Unix; 554 5.6.0 Message contains NUL characters > >Last-Attempt-Date: Fri, 18 Apr 2003 19:58:02 -0400 > >Could this be caused by the following directives (mailscanner-4.14-9): > Spam Actions = deliver forward spam@usherbrooke.ca > High Scoring Spam Actions = deliver forward spam@usherbrooke.ca > >If not, could MS strip those NULs from the emails? Searching through the entire message for NULs would severely slow things down (it would involve another traversal of the entire message). That's really the job of the MTA, if it happens to dislike NUL characters in messages. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From copper_shotgun at HOTMAIL.COM Tue Apr 22 23:17:54 2003 From: copper_shotgun at HOTMAIL.COM (Richard Alexander) Date: Thu Jan 12 21:17:49 2006 Subject: MailScanner on Red Hat 9.0 Message-ID: I have recently started testing Mailscanner and SpamAssassin on a Red Hat 9.0 server running the default install of Sendmail and Spam Assassin. All the test mail that I send through it seems to stay in the mail queue even though i set it to run in queue mode. I did a service MailScanner status and everything has status of okay. I can manually restart sendmail (/etc/init.d/sendmail restart) and it will process the mail and tag it as it should. If i go ahead and send another test, it delivers it immediately, but does not tag it as Spam? I searched the archives but could not find anything specific to the problem. If it is something easy please forgive me as I am relatively new to Linux. From copper_shotgun at HOTMAIL.COM Tue Apr 22 23:22:37 2003 From: copper_shotgun at HOTMAIL.COM (Copper Shotgun) Date: Thu Jan 12 21:17:49 2006 Subject: MailScanner on Red Hat 9.0 Message-ID: I have recently started testing Mailscanner and SpamAssassin on a Red Hat 9.0 server running the default install of Sendmail and Spam Assassin. All the test mail that I send through it seems to stay in the mail queue even though i set it to run in queue mode. I did a service MailScanner status and everything has status of okay. I can manually restart sendmail (/etc/init.d/sendmail restart) and it will process the mail and tag it as it should. If i go ahead and send another test, it delivers it immediately, but does not tag it as Spam? I searched the archives but could not find anything specific to the problem. If it is something easy please forgive me as I am relatively new to Linux. _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail From raymond at PROLOCATION.NET Tue Apr 22 23:34:26 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:49 2006 Subject: MailScanner on Red Hat 9.0 In-Reply-To: Message-ID: Hi! > I have recently started testing Mailscanner and SpamAssassin on a Red Hat > 9.0 server running the default install of Sendmail and Spam Assassin. All > the test mail that I send through it seems to stay in the mail queue even > though i set it to run in queue mode. I did a service MailScanner status I am running on RH9 just fine, also on production machines. Did you install SA via RPM ? Try to disable SA and see if thats the problem. What does your mail log tell ? Bye, Raymond. From mike at CAMAROSS.NET Tue Apr 22 23:33:44 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:49 2006 Subject: MailScanner on Red Hat 9.0 In-Reply-To: Message-ID: <01f301c3091f$3c7f7cd0$af01a8c0@home.middlefinger.net> On the older versions of RH, the sendmail service is disabled and MailScanner starts the appropriate sendmail processes. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Copper Shotgun Sent: Tuesday, April 22, 2003 5:23 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: MailScanner on Red Hat 9.0 I have recently started testing Mailscanner and SpamAssassin on a Red Hat 9.0 server running the default install of Sendmail and Spam Assassin. All the test mail that I send through it seems to stay in the mail queue even though i set it to run in queue mode. I did a service MailScanner status and everything has status of okay. I can manually restart sendmail (/etc/init.d/sendmail restart) and it will process the mail and tag it as it should. If i go ahead and send another test, it delivers it immediately, but does not tag it as Spam? I searched the archives but could not find anything specific to the problem. If it is something easy please forgive me as I am relatively new to Linux. _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail From raymond at PROLOCATION.NET Tue Apr 22 23:36:37 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:49 2006 Subject: MailScanner on Red Hat 9.0 In-Reply-To: Message-ID: Hi! > and everything has status of okay. I can manually restart sendmail > (/etc/init.d/sendmail restart) and it will process the mail and tag it as it > should. If i go ahead and send another test, it delivers it immediately, > but does not tag it as Spam? Ohw btw, dont use sendmail restart, use MailScanner restart, you should not touch the sendmail scripts anymore, MS is handling that now. Bye, Raymond From dene at DATATECHIE.COM Wed Apr 23 02:04:26 2003 From: dene at DATATECHIE.COM (Dene Ulmschneider) Date: Thu Jan 12 21:17:49 2006 Subject: ignoring bounce messages from bounced emails Message-ID: <5.1.0.14.2.20030422210409.02883870@192.168.1.112> Hey all- sorry for the confusing subject of my email - but it's the most accurate way to state what I am looking to do. I am running RHL 7.3 with the latest MailScanner and SA 2.53. I am currently forwarding regular spam but I am bouncing high scoring spam. Obviously - there are lots of spam messages that come form forged addresses and bouncing those messages is in turn causing me to get a bounce message back. This is due to the fact that I am bouncing the spam from an address that does not and probably never will really exist. My question is this: Is there a way to ignore the bounces that I get back form forged addresses? What would be the best way to discard and ignore those particular messages. Is there a setting in SA or MS that will allow that? Thank You Dene Ulmschneider Data Techie Inc. ------------------------------------------------------------------------- office: 718.738.8859 cell: 646.996.2976 email: dene@datatechie.com pager mail: denenow@datatechie.com website: www.datatechie.com ------------------------------------------------------------------------- "Life is too short...-...you should have dessert first" From mikea at MIKEA.ATH.CX Wed Apr 23 02:43:28 2003 From: mikea at MIKEA.ATH.CX (mikea) Date: Thu Jan 12 21:17:49 2006 Subject: ignoring bounce messages from bounced emails In-Reply-To: <5.1.0.14.2.20030422210409.02883870@192.168.1.112>; from dene@DATATECHIE.COM on Tue, Apr 22, 2003 at 09:04:26PM -0400 References: <5.1.0.14.2.20030422210409.02883870@192.168.1.112> Message-ID: <20030422204328.A14774@mikea.ath.cx> On Tue, Apr 22, 2003 at 09:04:26PM -0400, Dene Ulmschneider wrote: > Hey all- > > sorry for the confusing subject of my email - but it's the most accurate > way to state what I am looking to do. > > I am running RHL 7.3 with the latest MailScanner and SA 2.53. I am > currently forwarding regular spam but I am bouncing high scoring spam. > Obviously - there are lots of spam messages that come form forged addresses > and bouncing those messages is in turn causing me to get a bounce message > back. This is due to the fact that I am bouncing the spam from an address > that does not and probably never will really exist. > > My question is this: > Is there a way to ignore the bounces that I get back form forged addresses? > What would be the best way to discard and ignore those particular messages. > Is there a setting in SA or MS that will allow that? I don't know that there's a SA or MS setting, but it is possible to set procmail to grab-and-disappear them. This *WILL* cause you to lose other, valid bounce messages, and you will not be compliant with the parts of RFC *822 (IIRC) that require you to accept bounces. I see maybe 50 bounces/day at the state agency I run MailScanner for, with only about 2300 externally-visible E-mail addresses, and it is a PITA. But I handle them, because it means that I also see valid bounces. Someone else may have a better solution. -- Mike Andrews mikea@mikea.ath.cx Tired old sysadmin since 1964 From brian at UNEARTHED.ORG Wed Apr 23 04:05:11 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:49 2006 Subject: ignoring bounce messages from bounced emails References: <5.1.0.14.2.20030422210409.02883870@192.168.1.112> <20030422204328.A14774@mikea.ath.cx> Message-ID: <000801c30945$291d8620$4d01000a@local.unearthed.org> If you use procmail, add a X-loop: mydomain@address header... if you see that header, drop the message.. if not.. do what you would normally do... That works... right? Brian ----- Original Message ----- From: "mikea" To: Sent: Tuesday, April 22, 2003 6:43 PM Subject: Re: ignoring bounce messages from bounced emails > On Tue, Apr 22, 2003 at 09:04:26PM -0400, Dene Ulmschneider wrote: > > Hey all- > > > > sorry for the confusing subject of my email - but it's the most accurate > > way to state what I am looking to do. > > > > I am running RHL 7.3 with the latest MailScanner and SA 2.53. I am > > currently forwarding regular spam but I am bouncing high scoring spam. > > Obviously - there are lots of spam messages that come form forged addresses > > and bouncing those messages is in turn causing me to get a bounce message > > back. This is due to the fact that I am bouncing the spam from an address > > that does not and probably never will really exist. > > > > My question is this: > > Is there a way to ignore the bounces that I get back form forged addresses? > > What would be the best way to discard and ignore those particular messages. > > Is there a setting in SA or MS that will allow that? > > I don't know that there's a SA or MS setting, but it is possible to > set procmail to grab-and-disappear them. This *WILL* cause you to lose > other, valid bounce messages, and you will not be compliant with the > parts of RFC *822 (IIRC) that require you to accept bounces. > > I see maybe 50 bounces/day at the state agency I run MailScanner for, > with only about 2300 externally-visible E-mail addresses, and it is a > PITA. But I handle them, because it means that I also see valid > bounces. > > Someone else may have a better solution. > > -- > Mike Andrews > mikea@mikea.ath.cx > Tired old sysadmin since 1964 > From davidclosson at MSN.COM Wed Apr 23 05:59:56 2003 From: davidclosson at MSN.COM (David Closson) Date: Thu Jan 12 21:17:49 2006 Subject: Spamassassin seems to be causing Mailscanner to die Message-ID: Spamassassin seems to be causing Mailscanner to die. MailScanner works beautifully with Spamassassin disabled. I am using MailScanner-4.14-9 and Spamassassin 2.6 cvs. I noticed this after upgrading MailScanner from the last release. I have since upgraded Spamassassin to 2.53 and then finally to 2.6 cvs. I am using Linux RH 7.3 with PERL 5.61. _________ Sincerely, David Closson 209-736-0111 _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 From mailscanner at ecs.soton.ac.uk Wed Apr 23 08:57:17 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: Spamassassin seems to be causing Mailscanner to die In-Reply-To: Message-ID: <5.2.0.9.2.20030423085553.029c58f8@imap.ecs.soton.ac.uk> Try setting skip_rbl_checks 1 in your spam.assassin.prefs.conf. Someone else reported a similar problem the other day. At 05:59 23/04/2003, you wrote: >Spamassassin seems to be causing Mailscanner to die. > >MailScanner works beautifully with Spamassassin disabled. > >I am using MailScanner-4.14-9 and Spamassassin 2.6 cvs. > >I noticed this after upgrading MailScanner from the last release. I have >since upgraded Spamassassin to 2.53 and then finally to 2.6 cvs. > >I am using Linux RH 7.3 with PERL 5.61. > > >_________ >Sincerely, >David Closson >209-736-0111 > > > > >_________________________________________________________________ >Protect your PC - get McAfee.com VirusScan Online >http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 23 08:54:12 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:49 2006 Subject: MailScanner on Red Hat 9.0 In-Reply-To: References: Message-ID: <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> At 23:36 22/04/2003, you wrote: >Hi! > > > and everything has status of okay. I can manually restart sendmail > > (/etc/init.d/sendmail restart) and it will process the mail and tag it > as it > > should. If i go ahead and send another test, it delivers it immediately, > > but does not tag it as Spam? > >Ohw btw, dont use sendmail restart, use MailScanner restart, you should >not touch the sendmail scripts anymore, MS is handling that now. And you can stop RedHat's installation of SpamAssassin as well, as that controls the "spamd" process which MailScanner doesn't use anyway, you are just wasting resources running spamd. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From postmaster at tinker.ecs.soton.ac.uk Tue Apr 22 15:31:45 2003 From: postmaster at tinker.ecs.soton.ac.uk (MailScanner) Date: Thu Jan 12 21:17:49 2006 Subject: Warning: E-mail viruses detected Message-ID: <200304221431.h3MEVjun020350@tinker.ecs.soton.ac.uk> Our virus detector has just been triggered by a message you sent:- To: sysjkf@ecs.soton.ac.uk Subject: eicar.zip Date: Tue Apr 22 15:31:45 2003 Any infected parts of the message (eicar.com) have not been delivered. This message is simply to warn you that your computer system may have a virus present and should be checked. The virus detector said this about the message: Report: eicar.com - Eicar test file -- MailScanner Email Virus Scanner www.mailscanner.info Mailscanner thanks transtec Computers for their support From copper_shotgun at HOTMAIL.COM Wed Apr 23 14:09:23 2003 From: copper_shotgun at HOTMAIL.COM (Copper Shotgun) Date: Thu Jan 12 21:17:49 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) Message-ID: Ok. After i restart the server the maillog shows the following: Apr 23 07:46:56 inet3 sendmail[2205]: starting daemon (8.12.8): SMTP Apr 23 07:46:56 inet3 sendmail[2210]: starting daemon (8.12.8): queueing@00:15:00 Apr 23 07:47:00 inet3 MailScanner[2229]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 23 07:47:05 inet3 MailScanner[2229]: Using locktype = flock Apr 23 07:47:05 inet3 spamd[2239]: server started on port 783 (running version 2.44) Apr 23 07:47:10 inet3 MailScanner[2406]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 23 07:47:12 inet3 MailScanner[2406]: Using locktype = flock Apr 23 07:47:20 inet3 MailScanner[2407]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 23 07:47:22 inet3 MailScanner[2407]: Using locktype = flock Apr 23 07:47:30 inet3 MailScanner[2408]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... ***Several more times Messages file has the following: Apr 23 07:46:55 inet3 xinetd: xinetd startup succeeded Apr 23 07:46:56 inet3 MailScanner: Starting MailScanner daemons: Apr 23 07:46:56 inet3 MailScanner: incoming sendmail: Apr 23 07:46:56 inet3 MailScanner: succeeded Apr 23 07:46:56 inet3 MailScanner: ^[[60G Apr 23 07:46:56 inet3 MailScanner: Apr 23 07:46:56 inet3 MailScanner: outgoing sendmail: Apr 23 07:46:56 inet3 MailScanner: succeeded Apr 23 07:46:56 inet3 MailScanner: ^[[60G Apr 23 07:46:56 inet3 MailScanner: Apr 23 07:46:56 inet3 MailScanner: MailScanner: Apr 23 07:47:00 inet3 MailScanner: succeeded Apr 23 07:47:00 inet3 MailScanner: ^[[60G Apr 23 07:47:00 inet3 MailScanner: Apr 23 07:47:00 inet3 rc: Starting MailScanner: succeeded Apr 23 07:47:03 inet3 spamassassin: spamd startup succeeded Mailscanner status: [root@inet3 log]# service MailScanner status Checking MailScanner daemons: MailScanner: [ OK ] incoming sendmail: [ OK ] outgoing sendmail: [ OK ] I just sent a Non-Spam test email and it is sitting in the mailq. This is what maillog shows: Apr 23 08:05:06 inet3 sendmail[2507]: h3ND56Ij002507: from=, size=1177, class=0, nrcpts=1, msgid=<000801c30998$e64079d0$7bc8a8c0@ralexand>, proto=SMTP, daemon=MTA, relay=[192.168.200.123] Apr 23 08:05:06 inet3 sendmail[2507]: h3ND56Ij002507: to=, delay=00:00:00, mailer=esmtp, pri=30456, stat=queued Apr 23 08:05:08 inet3 MailScanner[2229]: New Batch: Forwarding 1 unscanned messages, 1642 bytes Apr 23 08:05:08 inet3 MailScanner[2229]: Spam Checks: Starting Apr 23 08:05:13 inet3 imapd[2510]: imap service init from 192.168.200.123 Apr 23 08:05:13 inet3 imapd[2510]: Login user=ralexand host=[192.168.200.123] Apr 23 08:05:16 inet3 MailScanner[2229]: Unscanned: Delivered 1 messages Apr 23 08:05:16 inet3 MailScanner[2229]: Virus and Content Scanning: Starting _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail From mailscanner at ecs.soton.ac.uk Wed Apr 23 14:34:55 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) In-Reply-To: Message-ID: <5.2.0.9.2.20030423143315.1031a3d0@imap.ecs.soton.ac.uk> At 14:09 23/04/2003, you wrote: >Ok. After i restart the server the maillog shows the following: > >Apr 23 07:46:56 inet3 sendmail[2205]: starting daemon (8.12.8): SMTP >Apr 23 07:46:56 inet3 sendmail[2210]: starting daemon (8.12.8): >queueing@00:15:00 >Apr 23 07:47:00 inet3 MailScanner[2229]: MailScanner E-Mail Virus Scanner >version 4.14-9 starting... >Apr 23 07:47:05 inet3 MailScanner[2229]: Using locktype = flock >Apr 23 07:47:05 inet3 spamd[2239]: server started on port 783 (running >version 2.44) You don't need to start spamd at all, why are you doing that? >Apr 23 07:47:10 inet3 MailScanner[2406]: MailScanner E-Mail Virus Scanner >version 4.14-9 starting... >Apr 23 07:47:12 inet3 MailScanner[2406]: Using locktype = flock >Apr 23 07:47:20 inet3 MailScanner[2407]: MailScanner E-Mail Virus Scanner >version 4.14-9 starting... >Apr 23 07:47:22 inet3 MailScanner[2407]: Using locktype = flock >Apr 23 07:47:30 inet3 MailScanner[2408]: MailScanner E-Mail Virus Scanner >version 4.14-9 starting... >***Several more times Correct. >Messages file has the following: >Apr 23 07:46:55 inet3 xinetd: xinetd startup succeeded >Apr 23 07:46:56 inet3 MailScanner: Starting MailScanner daemons: >Apr 23 07:46:56 inet3 MailScanner: incoming sendmail: >Apr 23 07:46:56 inet3 MailScanner: succeeded >Apr 23 07:46:56 inet3 MailScanner: ^[[60G >Apr 23 07:46:56 inet3 MailScanner: >Apr 23 07:46:56 inet3 MailScanner: outgoing sendmail: >Apr 23 07:46:56 inet3 MailScanner: succeeded >Apr 23 07:46:56 inet3 MailScanner: ^[[60G >Apr 23 07:46:56 inet3 MailScanner: >Apr 23 07:46:56 inet3 MailScanner: MailScanner: >Apr 23 07:47:00 inet3 MailScanner: succeeded >Apr 23 07:47:00 inet3 MailScanner: ^[[60G >Apr 23 07:47:00 inet3 MailScanner: >Apr 23 07:47:00 inet3 rc: Starting MailScanner: succeeded >Apr 23 07:47:03 inet3 spamassassin: spamd startup succeeded > > >Mailscanner status: > >[root@inet3 log]# service MailScanner status >Checking MailScanner daemons: > MailScanner: [ OK ] > incoming sendmail: [ OK ] > outgoing sendmail: [ OK ] > >I just sent a Non-Spam test email and it is sitting in the mailq. This is >what maillog shows: > >Apr 23 08:05:06 inet3 sendmail[2507]: h3ND56Ij002507: >from=, size=1177, class=0, nrcpts=1, >msgid=<000801c30998$e64079d0$7bc8a8c0@ralexand>, proto=SMTP, daemon=MTA, >relay=[192.168.200.123] >Apr 23 08:05:06 inet3 sendmail[2507]: h3ND56Ij002507: >to=, delay=00:00:00, mailer=esmtp, pri=30456, >stat=queued >Apr 23 08:05:08 inet3 MailScanner[2229]: New Batch: Forwarding 1 unscanned >messages, 1642 bytes >Apr 23 08:05:08 inet3 MailScanner[2229]: Spam Checks: Starting >Apr 23 08:05:13 inet3 imapd[2510]: imap service init from 192.168.200.123 >Apr 23 08:05:13 inet3 imapd[2510]: Login user=ralexand >host=[192.168.200.123] >Apr 23 08:05:16 inet3 MailScanner[2229]: Unscanned: Delivered 1 messages >Apr 23 08:05:16 inet3 MailScanner[2229]: Virus and Content Scanning: >Starting In your MailScanner.conf file, what is "Delivery Method" set to? Are the 2 Sendmail settings pointing to the correct location of your sendmail binary? I assume that's what the problem is, as you never actually told us what you thought was wrong :-) -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Peter.Bates at LSHTM.AC.UK Wed Apr 23 15:24:10 2003 From: Peter.Bates at LSHTM.AC.UK (Peter Bates) Date: Thu Jan 12 21:17:50 2006 Subject: SpamAssassin weirdness... Message-ID: Hello all... I'm still testing/playing with the new Postfix support (which seems fine and dandy), but I'm now seeing strangeness with SA. Here's the 'sample-spam.txt' from the SA distribution (md5sum f903a50b57f303b5395bb4c74058b60d if anyone wants to check!) sent through MS & SA: Apr 23 15:05:27 hancock MailScanner[15586]: Message 5BE7514A139 from [193.63.251.41] (anstpbat@gilliam.lshtm.ac.uk) to lshtm.ac.uk is spam, SpamAssassin (score=8.4, required 8, DATE_IN_PAST_12_24, DRASTIC_REDUCED, HOME_EMPLOYMENT, INVALID_DATE, INVALID_MSGID, NO_REAL_NAME, ONCE_IN_LIFETIME, RCVD_IN_OSIRUSOFT_COM, REMOVE_SUBJ, UNDISC_RECIPS) Now, if I set 'Debug = yes' in MailScanner.conf, and also 'Debug SpamAssassin = yes', and send the same message through, the end score is: debug: is spam? score=11.5 required=8 tests=DATE_IN_PAST_12_24,DCC_CHECK,DRASTIC_REDUCED,HOME_EMPLOYMENT,INVALID_DATE,INVALID_MSGID,NO_REAL_NAME,ONCE_IN_LIFETIME,RCVD_IN_OSIRUSOFT_COM,REMOVE_SUBJ,UNDISC_RECIPS Observe now how DCC is being run. I have added a score for DCC to /etc/MailScanner/spam.assassin.prefs.conf, and also had to set: dcc_path /usr/local/bin/dccproc ... as running MS as the 'Postfix' user, /usr/local/bin was clearly not in the $PATH. Now, even weirder, if I run: spamassassin -D -t < sample-spam.txt > spam.out X-Spam-Status: Yes, hits=13.5 required=8.0 tests=DATE_IN_PAST_12_24,DCC_CHECK,DRASTIC_REDUCED, HOME_EMPLOYMENT,INVALID_DATE,INVALID_MSGID,NO_REAL_NAME, ONCE_IN_LIFETIME,RAZOR2_CHECK,RCVD_IN_OSIRUSOFT_COM, REMOVE_SUBJ,UNDISC_RECIPS The score is 13.5, and DCC and RAZOR2 checks have been run... This is all SA 2.53, by the way. Anyone any clues, and additionally, I'd be curious to know how many people are running SA with: - DCC - Razor (2) - any of the others (Pyzor, etc.) ... ---------------------------------------------------------------------------------------------------> Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-958 8353 / Fax: 0207- 636 9838 From Q.G.Campbell at NEWCASTLE.AC.UK Wed Apr 23 15:38:28 2003 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:17:50 2006 Subject: Sophos "sweep" problem - a funny thing happended... Message-ID: <52E50E4D595DDE4D861117A1FB62E79D2212C7@bond.ncl.ac.uk> > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: 18 April 2003 20:50 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Sophos "sweep" problem - a funny thing happended... > > > If you are running MailScanner version 4, don't use any of > the old version 3 scripts that you still might have lying > around in /usr/local/Sophos. The supporting scripts in > version 4 are all in /usr/lib/MailScanner. You are looking for > sophos-wrapper > and sophos-autoupdate > > Sophos recently changed the structure of their virus pattern > library, and this new layout is only recognised by the > version 4 sophos-autoupdate script, not by the old version 3 script. > > If you are still running MailScanner 3, then download the > tarball of MailScanner 4 and pull the sophos-autoupdate > script out of it. It will almost certainly work just fine > with MailScanner 3 :-) > I am running MS 4.10-1 although with an old, modified, "sophoswrapper" script whose contents are shown below. I fixed the problem by commenting out the "SAV_IDE" lines in this script. Note also that the LD_LIBRARY_PATH lines are not needed at this site although I have not commented them out in the script. ---------------- cut here #!/bin/sh PackageDir=/usr/local/Sophos prog=sweep # `basename $0` #SAV_IDE=$PackageDir/ide LD_LIBRARY_PATH=$PackageDir/lib #export SAV_IDE export LD_LIBRARY_PATH exec ${PackageDir}/bin/$prog "$@" ----------------- cut here Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From davidclosson at MSN.COM Wed Apr 23 15:50:00 2003 From: davidclosson at MSN.COM (David Closson) Date: Thu Jan 12 21:17:50 2006 Subject: Spamassassin seems to be causing Mailscanner to die Message-ID: Thank for the quick reply but "skip_rbl_checks 1" has always been set as such in spam.assassin.prefs.conf -we perform those spam check with sendmail before accepting the message. _________ Sincerely, David Closson 209-736-0111 >From: Julian Field >Reply-To: MailScanner mailing list >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Spamassassin seems to be causing Mailscanner to die >Date: Wed, 23 Apr 2003 08:57:17 +0100 >MIME-Version: 1.0 >Received: from smtp.jiscmail.ac.uk ([130.246.192.48]) by >mc7-f26.law1.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600); Wed, 23 Apr >2003 00:58:33 -0700 >Received: from LISTSERV.JISCMAIL.AC.UK (jiscmail.ac.uk) by >smtp.jiscmail.ac.uk (LSMTP for Windows NT v1.1b) with SMTP id ><9.000205CE@smtp.jiscmail.ac.uk>; Wed, 23 Apr 2003 8:58:28 +0100 >Received: from JISCMAIL.AC.UK by JISCMAIL.AC.UK (LISTSERV-TCP/IP release >1.8e) with spool id 21061911 for MAILSCANNER@JISCMAIL.AC.UK; Wed, >23 Apr 2003 08:58:28 +0100 >Received: from 130.246.192.52 by JISCMAIL.AC.UK (SMTPL release 1.0i) with >TCP; Wed, 23 Apr 2003 08:58:28 +0100 >Received: from raven.ecs.soton.ac.uk (raven.ecs.soton.ac.uk [152.78.70.1]) >by ori.rl.ac.uk (8.11.1/8.11.1) with ESMTP id h3N7wQS15798 for > ; Wed, 23 Apr 2003 08:58:26 +0100 >Received: from pigeon.ecs.soton.ac.uk (ns1 [152.78.68.1]) by >raven.ecs.soton.ac.uk (8.9.3/8.9.3) with ESMTP id IAA02336 for >; Wed, 23 Apr 2003 08:58:25 +0100 (BST) >Received: from tailor.ecs.soton.ac.uk (tailor [152.78.69.139]) by >pigeon.ecs.soton.ac.uk (8.9.3p2/8.9.3) with ESMTP id IAA26148 for >; Wed, 23 Apr 2003 08:58:25 +0100 (BST) >X-Message-Info: JGTYoYF78jEHjJx36Oi8+Q1OJDRSDidP >X-RAL-MFrom: >X-RAL-Connect: >X-Sender: (Unverified) >X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 >Message-ID: <5.2.0.9.2.20030423085553.029c58f8@imap.ecs.soton.ac.uk> >Sender: MailScanner mailing list >In-Reply-To: >Precedence: list >Return-Path: owner-mailscanner@JISCMAIL.AC.UK >X-OriginalArrivalTime: 23 Apr 2003 07:58:33.0372 (UTC) >FILETIME=[22F01DC0:01C3096E] > >Try setting > >in your spam.assassin.prefs.conf. Someone else reported a similar problem >the other day. > >At 05:59 23/04/2003, you wrote: >>Spamassassin seems to be causing Mailscanner to die. >> >>MailScanner works beautifully with Spamassassin disabled. >> >>I am using MailScanner-4.14-9 and Spamassassin 2.6 cvs. >> >>I noticed this after upgrading MailScanner from the last release. I have >>since upgraded Spamassassin to 2.53 and then finally to 2.6 cvs. >> >>I am using Linux RH 7.3 with PERL 5.61. >> >> >>_________ >>Sincerely, >>David Closson >>209-736-0111 >> >> >> >> >>_________________________________________________________________ >>Protect your PC - get McAfee.com VirusScan Online >>http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 > >-- >Julian Field >www.MailScanner.info >MailScanner thanks transtec Computers for their support _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 From copper_shotgun at hotmail.com Wed Apr 23 16:22:30 2003 From: copper_shotgun at hotmail.com (Richard Alexander) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) Message-ID: My original post was because the mail seemed to be hanging up in the mail queue, even though i set it to be in queue mode and process every 5 seconds (i thought). After leaving it in there for a while, it seems to be delivering it after about 15 minutes. (this is a test server, and the only traffic is the couple of messages that I am sending). These are outgoing mails. >You don't need to start spamd at all, why are you doing that? Maybe i am confused on that. I did the default install of Red Hat 9.0 and chose Spam Assassin as one of the install options. I also set to run on startup in ntsysv. I just removed that. MailScanner.conf Delivery Method = queue Thanks for the help From smhickel at CHARTERMI.NET Wed Apr 23 16:25:13 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> Message-ID: <1051111512.11551.14.camel@steve.hickel.info> All, I have RH 8.0 with latest Mailscanner set up on it. It is located inside a local NT domain subnet. I am attempting to get mail to go from the exchange cluster via a smarthost setup under Virtual SMTP server SMTP properties delivery advanced and I have my smart host in left right brackets so it won't do a domain lookup. It seems to send the first couple of messages fine but then I get this weird error on a system admin message in outlook that tells me that I don't have permission to send to that receipient Relaying denied. I made sure I had added the mailscanner address into the relay allowed list on the exchange relay section, but that doesn't seem to resolve it. In addition, the messages I get don't have any indication that I have virus checked them with f-prot on the way out of the mailscanner box to my test email account outside the local email system. Thus, I have two issues: 1) What am I doing wrong with exchange that I get such a message? 2) How do I test the f-prot set up to see if it is working for outgoing messages or is this something one doesn't see unless there are virii? Finally, I haven't set up the incoming bit yet until I get the smart host feature working. Do I need an SMTP connector setup???? in exchange? Thanks in advance. Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/3605398e/attachment.bin From raymond at PROLOCATION.NET Wed Apr 23 16:29:43 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <1051111512.11551.14.camel@steve.hickel.info> Message-ID: Hi! > 1) What am I doing wrong with exchange that I get such a message? > 2) How do I test the f-prot set up to see if it is working for outgoing > messages or is this something one doesn't see unless there are virii? > > Finally, I haven't set up the incoming bit yet until I get the smart > host feature working. Do I need an SMTP connector setup???? in exchange? Most likely you didnt configure the linux box to relay properly, can it be that one is giving the faults ? Have a look in your mail log on the linux box, i think its going wrong there. Bye, Raymond. From smhickel at CHARTERMI.NET Wed Apr 23 16:35:55 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: References: Message-ID: <1051112154.11554.17.camel@steve.hickel.info> Here is the exact message I get from sysadmin on the exchange box. I will check into the relay thing on the linux box though. It does seem the message is coming from the exchange box though. STeve The following recipient(s) could not be reached: 'steve@korehicom.com' on 4/23/2003 11:09 AM You do not have permission to send to this recipient. For assistance, contact your system administrator. ... Relaying denied> On Wed, 2003-04-23 at 11:29, Raymond Dijkxhoorn wrote: > Hi! > > > 1) What am I doing wrong with exchange that I get such a message? > > 2) How do I test the f-prot set up to see if it is working for outgoing > > messages or is this something one doesn't see unless there are virii? > > > > Finally, I haven't set up the incoming bit yet until I get the smart > > host feature working. Do I need an SMTP connector setup???? in exchange? > > Most likely you didnt configure the linux box to relay properly, can it be > that one is giving the faults ? Have a look in your mail log on the linux > box, i think its going wrong there. > > Bye, > Raymond. -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/644b56e2/attachment.bin From mailscanner at LISTS.COM.AR Wed Apr 23 16:48:38 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:50 2006 Subject: ignoring bounce messages from bounced emails In-Reply-To: <5.1.0.14.2.20030422210409.02883870@192.168.1.112> Message-ID: <3EA68BA6.8831.2A111729@localhost> For what the MailScanner.conf doc says: # Set where to find the messages that are delivered to the sender, # when they have sent a message that was detected as spam and caused the # "bounce" action to happen. This message is sent with its envelope # constructed so that the message cannot bounce. it is creating the messages with an envelope from of <> to prevent bouncing back... nonetheless, there are brain dead MTAs out there that insist on bouncing to the RFC822 From: header address (thus violating RFC821)... Maybe you can edit these files: /opt/MailScanner/etc/reports/en/sender.spam.report.txt /opt/MailScanner/etc/reports/en/sender.spam.rbl.report.txt /opt/MailScanner/etc/reports/en/sender.spam.sa.report.txt (or whichever you are using) and change the line that says: From: "MailScanner" <$localpostmaster> to something like From: "MailScanner" <> or From: "if you are a human being and want to report something do it to $localpostmaster" <> El 22 Apr 2003 a las 21:04, Dene Ulmschneider escribi?: > Hey all- > > sorry for the confusing subject of my email - but it's the most accurate > way to state what I am looking to do. > > I am running RHL 7.3 with the latest MailScanner and SA 2.53. I am > currently forwarding regular spam but I am bouncing high scoring spam. > Obviously - there are lots of spam messages that come form forged addresses > and bouncing those messages is in turn causing me to get a bounce message > back. This is due to the fact that I am bouncing the spam from an address > that does not and probably never will really exist. > > My question is this: > Is there a way to ignore the bounces that I get back form forged addresses? > What would be the best way to discard and ignore those particular messages. > Is there a setting in SA or MS that will allow that? > > > Thank You > > Dene Ulmschneider > Data Techie Inc. > ------------------------------------------------------------------------- > office: 718.738.8859 > cell: 646.996.2976 > email: dene@datatechie.com > pager mail: denenow@datatechie.com > website: www.datatechie.com > ------------------------------------------------------------------------- > "Life is too short...-...you should have dessert first" -- Mariano Absatz El Baby ---------------------------------------------------------- Justify my text? I'm sorry but it has no excuse. From jgoggan at DCG.COM Wed Apr 23 17:01:53 2003 From: jgoggan at DCG.COM (John Goggan) Date: Thu Jan 12 21:17:50 2006 Subject: Incoming Work Dir not hidden? Message-ID: <3EA6B8F1.1787211B@dcg.com> I am still having trouble with the incoming work directory not being hidden in virus messages sent to the recipient of the virus. I am running MailScanner 4.14-9 and SpamAssassin 2.53. My MailScanner.conf contains: Hide Incoming Work Dir = yes Hide Incoming Work Dir in Notices = yes But a test message with EICAR from an outside party to me still says: Note to Help Desk: Look on DCG's MailScanner in /var/spool/MailScanner/quarantine/20030423 (message h3NFd5nR026403). ...obviously showing the current work directory. Any thoughts on what I'm doing wrong and/or missing? - John... From mailscanner at LISTS.COM.AR Wed Apr 23 16:58:45 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <3DFD0E385303F649AB7C31D651DEDD000A96F9@mafalda.pert.com.ar> Message-ID: <3EA68E05.6640.2A1A5936@localhost> Hi Steve... this confirms what Reymond said... the linux box doesn't want to relay mail for you... this is the default setup in all reasonable MTA these days for reasons that should be obvious on this list. You have to configure sendmail (or exim, or postfix, or zmailer) in your linux box so that it allows relaying for mails coming from the IP address of the exchange box. I only know how you do this in zmailer, but I guess some sendmail guru out there will gladly help you with that. El 23 Apr 2003 a las 12:35, Steve Hickel escribi?: > Here is the exact message I get from sysadmin on the exchange box. I > will check into the relay thing on the linux box though. It does seem > the message is coming from the exchange box though. > > STeve > > The following recipient(s) could not be reached: > > > > 'steve@korehicom.com' on 4/23/2003 11:09 AM > > You do not have permission to send to this recipient. For > assistance, contact your system administrator. > > ... Relaying denied> > > > > On Wed, 2003-04-23 at 11:29, Raymond Dijkxhoorn wrote: > > Hi! > > > > > 1) What am I doing wrong with exchange that I get such a message? > > > 2) How do I test the f-prot set up to see if it is working for > outgoing > > > messages or is this something one doesn't see unless there are > virii? > > > > > > Finally, I haven't set up the incoming bit yet until I get the smart > > > host feature working. Do I need an SMTP connector setup???? in > exchange? > > > > Most likely you didnt configure the linux box to relay properly, can > it be > > that one is giving the faults ? Have a look in your mail log on the > linux > > box, i think its going wrong there. > > > > Bye, > > Raymond. > -- > Steve Hickel -- Mariano Absatz El Baby ---------------------------------------------------------- Bug? That's not a bug, that's a feature. -- T. John Wendel From jgoggan at DCG.COM Wed Apr 23 17:05:55 2003 From: jgoggan at DCG.COM (John Goggan) Date: Thu Jan 12 21:17:50 2006 Subject: "report_header 1" invalid for SA? Message-ID: <3EA6B9E3.6419ECC3@dcg.com> I'm running MailScanner 4.14-9. In the spam.assassin.prefs.conf file, by default, there is a commented-out "report_header 1" option. If I enable this, it seems to work as intended (I actually have had it on for several versions now and not tested without, so I may be assuming that it works -- but it appears to be how I want it in any case), but doing a "spamassassin --lint" gives: "Failed to parse line in SpamAssassin configuration, skipping: report_header 1" Is this "normal"? Or am I doing something incorrectly? Or did something change in the latest SA (I'm running 2.53) that makes this different/invalid? Or is that option really just for MailScanner? Thanks! - John... From mailscanner at LISTS.COM.AR Wed Apr 23 17:09:21 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) In-Reply-To: Message-ID: <3EA69081.1157.2A24104D@localhost> El 23 Apr 2003 a las 16:22, Richard Alexander escribi?: > My original post was because the mail seemed to be hanging up in the mail > queue, even though i set it to be in queue mode and process every 5 seconds > (i thought). After leaving it in there for a while, it seems to be > delivering it after about 15 minutes. (this is a test server, and the > only traffic is the couple of messages that I am sending). These are > outgoing mails. > > > >You don't need to start spamd at all, why are you doing that? > > Maybe i am confused on that. I did the default install of Red Hat 9.0 and > chose Spam Assassin as one of the install options. I also set to run on I gues spamassassin's default installation thinks you want to run spamd... you can probably disable that via /etc/rc.d/init.d/spamassassin stop chkconfig --del spamassassin (so it doesn't start next time you reboot). > startup in ntsysv. I just removed that. > > MailScanner.conf > Delivery Method = queue This is probably the culprit... if you use "Delivery Method = queue", MailScanner just leaves the messages in the sendmail queue, which, usually is processed every 15 minutes (you can change that in the MailScanner startup script at /etc/rc.d/init.d/MailScanner). If you use "Delivery Method = batch", MailScanner directly invokes sendmail to immediately deliver your messages after it has processed them > > Thanks for the help -- Mariano Absatz El Baby ---------------------------------------------------------- /"\ | \ / ASCII RIBBON CAMPAIGN | X AGAINST HTML MAIL | / \ | From mailscanner at ecs.soton.ac.uk Wed Apr 23 17:21:41 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <1051111512.11551.14.camel@steve.hickel.info> References: <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030423171527.103a1610@imap.ecs.soton.ac.uk> At 16:25 23/04/2003, you wrote: >I have RH 8.0 with latest Mailscanner set up on it. It is located inside a >local NT domain subnet. I am attempting to get mail to go from the >exchange cluster via >a smarthost setup under Virtual SMTP server SMTP properties delivery >advanced and I have my smart host in left right brackets so it won't do a >domain lookup. It seems >to send the first couple of messages fine but then I get this weird error >on a system admin message in outlook that tells me that I don't have >permission to send to that receipient >Relaying denied. I made sure I had added the mailscanner address into the >relay allowed list on the exchange relay section, but that doesn't seem to >resolve it. As your later-posted error message reads, it tends to imply your mail relaying on the Linux box isn't right. Try testing it by hand like this: telnet your.linux.box 25 HELO yourdomain.com MAIL from: steve@korehicom.com RCPT to: me@jules.fm DATA Subject: This is a test From: you To: me This is a test message. . QUIT and see if it accepts the from and the to addresses. I suspect it will complain. >In addition, the messages I get don't have any indication that I have >virus checked them with f-prot on the way out of the mailscanner box to my >test email account outside the local email system. MailScanner will add an X-MailScanner-Information header if it passes through MailScanner at all, assuming you have that configuration option switched on. Look for "Information" in MailScanner.conf and you'll find it. >1) What am I doing wrong with exchange that I get such a message? >2) How do I test the f-prot set up to see if it is working for outgoing >messages or is this something one doesn't see unless there are virii? > >Finally, I haven't set up the incoming bit yet until I get the smart host >feature working. Do I need an SMTP connector setup???? in exchange? In many Exchange setups, you don't actually need an SMTP Connector at all. The properties of the Virtual SMTP server are flexible enough that you should be able to specify a smarthost there. Lots of people add SMTP Connectors when they don't need to. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 23 17:14:01 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) In-Reply-To: Message-ID: <5.2.0.9.2.20030423171226.02ba9e68@imap.ecs.soton.ac.uk> In version 4, I haven't yet seen a server which required "Delivery Method = queue". I was actually thinking of removing that option altogether. Just set it to Delivery Method = batch Many versions of sendmail will only have 1 queue-runner at a time. So asking it to run the queue every 5 seconds means that it will try to start a queue-runner every 5 seconds. Most of the time it will fail as there is already a queue-runner running. At 16:22 23/04/2003, you wrote: >My original post was because the mail seemed to be hanging up in the mail >queue, even though i set it to be in queue mode and process every 5 seconds >(i thought). After leaving it in there for a while, it seems to be >delivering it after about 15 minutes. (this is a test server, and the >only traffic is the couple of messages that I am sending). These are >outgoing mails. > > > >You don't need to start spamd at all, why are you doing that? > >Maybe i am confused on that. I did the default install of Red Hat 9.0 and >chose Spam Assassin as one of the install options. I also set to run on >startup in ntsysv. I just removed that. > >MailScanner.conf >Delivery Method = queue > >Thanks for the help -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at SARGAM.COM Wed Apr 23 17:16:19 2003 From: mailscanner at SARGAM.COM (mailscanner@SARGAM.COM) Date: Thu Jan 12 21:17:50 2006 Subject: Panda and MailScanner Message-ID: <000501c309b3$ad158310$6f01a8c0@AlanRoss.local> We are running panda perimeter scan for Sendmail with MailScanner and it works fine. Unfortunatly it does incoming mail and not outgoing. This might have something to do with how MailScanner splits sendmails duties. -Sanjay From mailscanner at ecs.soton.ac.uk Wed Apr 23 17:23:40 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: Incoming Work Dir not hidden? In-Reply-To: <3EA6B8F1.1787211B@dcg.com> Message-ID: <5.2.0.9.2.20030423172307.02c37008@imap.ecs.soton.ac.uk> At 17:01 23/04/2003, you wrote: >I am still having trouble with the incoming work directory not being hidden in >virus messages sent to the recipient of the virus. I am running MailScanner >4.14-9 and SpamAssassin 2.53. My MailScanner.conf contains: > >Hide Incoming Work Dir = yes >Hide Incoming Work Dir in Notices = yes > >But a test message with EICAR from an outside party to me still says: > >Note to Help Desk: Look on DCG's MailScanner in >/var/spool/MailScanner/quarantine/20030423 (message h3NFd5nR026403). > >...obviously showing the current work directory. > >Any thoughts on what I'm doing wrong and/or missing? Check exactly what path is set in the quarantine dir setting in MailScanner.conf. It must exactly match what is being seen above. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 23 17:39:44 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: "report_header 1" invalid for SA? In-Reply-To: <3EA6B9E3.6419ECC3@dcg.com> Message-ID: <5.2.0.9.2.20030423173900.02a6b488@imap.ecs.soton.ac.uk> The "report_header" option in SpamAssassin has no effect on MailScanner, as it does not use the standard SpamAssassin reports but constructs its own instead. At 17:05 23/04/2003, you wrote: >I'm running MailScanner 4.14-9. > >In the spam.assassin.prefs.conf file, by default, there is a commented-out >"report_header 1" option. If I enable this, it seems to work as intended (I >actually have had it on for several versions now and not tested without, so I >may be assuming that it works -- but it appears to be how I want it in any >case), but doing a "spamassassin --lint" gives: > >"Failed to parse line in SpamAssassin configuration, skipping: report_header >1" > >Is this "normal"? Or am I doing something incorrectly? Or did something >change in the latest SA (I'm running 2.53) that makes this different/invalid? >Or is that option really just for MailScanner? > >Thanks! > > - John... -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From jgoggan at DCG.COM Wed Apr 23 17:35:21 2003 From: jgoggan at DCG.COM (John Goggan) Date: Thu Jan 12 21:17:50 2006 Subject: Incoming Work Dir not hidden? References: <5.2.0.9.2.20030423172307.02c37008@imap.ecs.soton.ac.uk> Message-ID: <3EA6C0C9.BC396CA5@dcg.com> Julian Field wrote: > >/var/spool/MailScanner/quarantine/20030423 (message h3NFd5nR026403). > > Check exactly what path is set in the quarantine dir setting in > MailScanner.conf. It must exactly match what is being seen above. I believe that it does. Here are all of my Quarantine settings from my MailScanner.conf: Quarantine Dir = /var/spool/MailScanner/quarantine Quarantine Infections = yes Quarantine Whole Message = yes Quarantine Whole Messages As Queue Files = no Seems to match exactly to me... Anything else to check? - John... From smhickel at CHARTERMI.NET Wed Apr 23 17:34:57 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <5.2.0.9.2.20030423171527.103a1610@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030423171527.103a1610@imap.ecs.soton.ac.uk> Message-ID: <1051115696.11551.33.camel@steve.hickel.info> Julian, I did the below and it did the following: When I put in the RCPT to: me@jules.fm it said: relaying denied IP lookup failed and some address on my network that I need to determine exactly what it is, but it is probably my notebooks.Yes, it is my notebooks IP number. So what is it that I must correct to make this fly? Also, I note that I get 250 localhost.localdomain Hello back when I put in the HELO. Steve So On Wed, 2003-04-23 at 12:21, Julian Field wrote: > At 16:25 23/04/2003, you wrote: > >I have RH 8.0 with latest Mailscanner set up on it. It is located inside a > >local NT domain subnet. I am attempting to get mail to go from the > >exchange cluster via > >a smarthost setup under Virtual SMTP server SMTP properties delivery > >advanced and I have my smart host in left right brackets so it won't do a > >domain lookup. It seems > >to send the first couple of messages fine but then I get this weird error > >on a system admin message in outlook that tells me that I don't have > >permission to send to that receipient > >Relaying denied. I made sure I had added the mailscanner address into the > >relay allowed list on the exchange relay section, but that doesn't seem to > >resolve it. > > As your later-posted error message reads, it tends to imply your mail > relaying on the Linux box isn't right. Try testing it by hand like this: > > telnet your.linux.box 25 > HELO yourdomain.com > MAIL from: steve@korehicom.com > RCPT to: me@jules.fm > DATA > Subject: This is a test > From: you > To: me > > This is a test message. > . > QUIT > > and see if it accepts the from and the to addresses. I suspect it will > complain. > > >In addition, the messages I get don't have any indication that I have > >virus checked them with f-prot on the way out of the mailscanner box to my > >test email account outside the local email system. > > MailScanner will add an X-MailScanner-Information header if it passes > through MailScanner at all, assuming you have that configuration option > switched on. Look for "Information" in MailScanner.conf and you'll find it. > > >1) What am I doing wrong with exchange that I get such a message? > >2) How do I test the f-prot set up to see if it is working for outgoing > >messages or is this something one doesn't see unless there are virii? > > > >Finally, I haven't set up the incoming bit yet until I get the smart host > >feature working. Do I need an SMTP connector setup???? in exchange? > > In many Exchange setups, you don't actually need an SMTP Connector at all. > The properties of the Virtual SMTP server are flexible enough that you > should be able to specify a smarthost there. Lots of people add SMTP > Connectors when they don't need to. > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/421d318e/attachment.bin From smhickel at CHARTERMI.NET Wed Apr 23 17:49:26 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <3EA68E05.6640.2A1A5936@localhost> References: <3EA68E05.6640.2A1A5936@localhost> Message-ID: <1051116563.11437.40.camel@steve.hickel.info> Even though the exchange box is sending mail for one domain known on the internet the exchange is sending mail to the sendmail box as though it was from the local W2K domain as the guru who set it up called it two different things. So, I could masquerade it, as I saw that in exchange somewhere, (just above the smart host) or I can leave it as it is because I put the w2k domain name into the relay sections of sendmail. Thanks, Steve On Wed, 2003-04-23 at 11:58, Mariano Absatz wrote: > Hi Steve... > > this confirms what Reymond said... the linux box doesn't want to relay mail > for you... this is the default setup in all reasonable MTA these days for > reasons that should be obvious on this list. > > You have to configure sendmail (or exim, or postfix, or zmailer) in your > linux box so that it allows relaying for mails coming from the IP address of > the exchange box. > > I only know how you do this in zmailer, but I guess some sendmail guru out > there will gladly help you with that. > > El 23 Apr 2003 a las 12:35, Steve Hickel escribi?: > > > Here is the exact message I get from sysadmin on the exchange box. I > > will check into the relay thing on the linux box though. It does seem > > the message is coming from the exchange box though. > > > > STeve > > > > The following recipient(s) could not be reached: > > > > > > > > 'steve@korehicom.com' on 4/23/2003 11:09 AM > > > > You do not have permission to send to this recipient. For > > assistance, contact your system administrator. > > > > > ... Relaying denied> > > > > > > > > On Wed, 2003-04-23 at 11:29, Raymond Dijkxhoorn wrote: > > > Hi! > > > > > > > 1) What am I doing wrong with exchange that I get such a message? > > > > 2) How do I test the f-prot set up to see if it is working for > > outgoing > > > > messages or is this something one doesn't see unless there are > > virii? > > > > > > > > Finally, I haven't set up the incoming bit yet until I get the smart > > > > host feature working. Do I need an SMTP connector setup???? in > > exchange? > > > > > > Most likely you didnt configure the linux box to relay properly, can > > it be > > > that one is giving the faults ? Have a look in your mail log on the > > linux > > > box, i think its going wrong there. > > > > > > Bye, > > > Raymond. > > -- > > Steve Hickel > > > -- > Mariano Absatz > El Baby > ---------------------------------------------------------- > Bug? That's not a bug, that's a feature. > -- T. John Wendel -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/415a3d1d/attachment.bin From smhickel at CHARTERMI.NET Wed Apr 23 17:45:45 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <5.2.0.9.2.20030423171527.103a1610@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030423085006.044039f8@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030423171527.103a1610@imap.ecs.soton.ac.uk> Message-ID: <1051116343.11551.37.camel@steve.hickel.info> Julian, Even though I do get the relay message with your test below, I added the local W2K domain name of our windows domain and it has not stopped sending mail as of yet and it has been 10 minutes whereas before I added that domain into the sendmail relay files, I would get errors pretty much right away. So, it seems it was sendmail giving the relay error and I may have nipped it in the bud now. Thanks, Steve ps. I can see in the log that it is checking for viruses too. On Wed, 2003-04-23 at 12:21, Julian Field wrote: > At 16:25 23/04/2003, you wrote: > >I have RH 8.0 with latest Mailscanner set up on it. It is located inside a > >local NT domain subnet. I am attempting to get mail to go from the > >exchange cluster via > >a smarthost setup under Virtual SMTP server SMTP properties delivery > >advanced and I have my smart host in left right brackets so it won't do a > >domain lookup. It seems > >to send the first couple of messages fine but then I get this weird error > >on a system admin message in outlook that tells me that I don't have > >permission to send to that receipient > >Relaying denied. I made sure I had added the mailscanner address into the > >relay allowed list on the exchange relay section, but that doesn't seem to > >resolve it. > > As your later-posted error message reads, it tends to imply your mail > relaying on the Linux box isn't right. Try testing it by hand like this: > > telnet your.linux.box 25 > HELO yourdomain.com > MAIL from: steve@korehicom.com > RCPT to: me@jules.fm > DATA > Subject: This is a test > From: you > To: me > > This is a test message. > . > QUIT > > and see if it accepts the from and the to addresses. I suspect it will > complain. > > >In addition, the messages I get don't have any indication that I have > >virus checked them with f-prot on the way out of the mailscanner box to my > >test email account outside the local email system. > > MailScanner will add an X-MailScanner-Information header if it passes > through MailScanner at all, assuming you have that configuration option > switched on. Look for "Information" in MailScanner.conf and you'll find it. > > >1) What am I doing wrong with exchange that I get such a message? > >2) How do I test the f-prot set up to see if it is working for outgoing > >messages or is this something one doesn't see unless there are virii? > > > >Finally, I haven't set up the incoming bit yet until I get the smart host > >feature working. Do I need an SMTP connector setup???? in exchange? > > In many Exchange setups, you don't actually need an SMTP Connector at all. > The properties of the Virtual SMTP server are flexible enough that you > should be able to specify a smarthost there. Lots of people add SMTP > Connectors when they don't need to. > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/0dab9283/attachment.bin From mailscanner at ecs.soton.ac.uk Wed Apr 23 17:41:57 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) In-Reply-To: <3EA69081.1157.2A24104D@localhost> References: Message-ID: <5.2.0.9.2.20030423174042.1031ba00@imap.ecs.soton.ac.uk> At 17:09 23/04/2003, you wrote: >chkconfig --del spamassassin >(so it doesn't start next time you reboot). chkconfig spamassassin off is sufficient to stop it running at boot-time, as is slightly more polite :-) > > startup in ntsysv. I just removed that. > > > > MailScanner.conf > > Delivery Method = queue >This is probably the culprit... if you use "Delivery Method = queue", >MailScanner just leaves the messages in the sendmail queue, which, usually is >processed every 15 minutes (you can change that in the MailScanner startup >script at /etc/rc.d/init.d/MailScanner). I would prefer you edited /etc/sysconfig/MailScanner as changes to that file won't get over-written the next time you upgrade MailScanner. >If you use "Delivery Method = batch", MailScanner directly invokes sendmail >to immediately deliver your messages after it has processed them -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From jgoggan at DCG.COM Wed Apr 23 18:02:36 2003 From: jgoggan at DCG.COM (John Goggan) Date: Thu Jan 12 21:17:50 2006 Subject: "report_header 1" invalid for SA? References: <5.2.0.9.2.20030423173900.02a6b488@imap.ecs.soton.ac.uk> Message-ID: <3EA6C72C.3B31175B@dcg.com> Julian Field wrote: > > The "report_header" option in SpamAssassin has no effect on MailScanner, as > it does not use the standard SpamAssassin reports but constructs its own > instead. So, then, is the command invalid for both MA and SA then? I mean, if MS isn't using it -- and SA's check says it isn't valid -- then what's it there for? Maybe it is no longer a SA keyword and the MS default spam.assassin.prefs.conf file should just no longer have it (it currently has it commented out, but says it can be used)? Or did you mean something else? - John... From jgoggan at DCG.COM Wed Apr 23 18:09:34 2003 From: jgoggan at DCG.COM (John Goggan) Date: Thu Jan 12 21:17:50 2006 Subject: Incoming Work Dir not hidden? References: <5C0296D26910694BB9A9BBFC577E7AB001175040@pascal.priv.bmrb.co.uk> <1051117353.18140.4.camel@bach.kevinspicer.co.uk> Message-ID: <3EA6C8CE.39838195@dcg.com> Doh! Of course! I just got mixed up for a moment there. Thanks much! - John... Kevin Spicer wrote: > I think what you're missing is that /var/spool/MailScanner/quarantine is > the quarantine directory, not the incoming work directory. This is why > Hide Incoming Work Dir doens't hide it. If you want to hide the path in > the 'Note to help desk' you'll need to edit the reports it appears in > [stored.filename.message.txt and stored.virus.message.txt] and remove > $quarantinedir From kevins at BMRB.CO.UK Wed Apr 23 18:02:30 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:50 2006 Subject: Incoming Work Dir not hidden? In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175040@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175040@pascal.priv.bmrb.co.uk> Message-ID: <1051117353.18140.4.camel@bach.kevinspicer.co.uk> Note to Help Desk: Look on DCG's MailScanner in /var/spool/MailScanner/quarantine/20030423 (message h3NFd5nR026403). ...obviously showing the current work directory. Any thoughts on what I'm doing wrong and/or missing? I think what you're missing is that /var/spool/MailScanner/quarantine is the quarantine directory, not the incoming work directory. This is why Hide Incoming Work Dir doens't hide it. If you want to hide the path in the 'Note to help desk' you'll need to edit the reports it appears in [stored.filename.message.txt and stored.virus.message.txt] and remove $quarantinedir BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From smhickel at CHARTERMI.NET Wed Apr 23 18:14:01 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange (user unknown) In-Reply-To: <1051112154.11554.17.camel@steve.hickel.info> References: <1051112154.11554.17.camel@steve.hickel.info> Message-ID: <1051118036.11551.45.camel@steve.hickel.info> All, Thanks for the help. Now, the next problem. When I set my firewall to the new mail server, the maillog said that the user was unknown and rejected the email and I got an error from my sending email server, not the receiving one. I went back into the mailscan setup and put forward unknown users to the IP of the exchange server. I will test that in a few minutes but wanted to know if anyway had a way to get the mailscanner to trap these emails and hold them until the exchange server was available for them without having to enter names into the sendmail or linux box? Thoughts? Thanks, Steve On Wed, 2003-04-23 at 11:35, Steve Hickel wrote: > Here is the exact message I get from sysadmin on the exchange box. I > will check into the relay thing on the linux box though. It does seem > the message is coming from the exchange box though. > > STeve > > The following recipient(s) could not be reached: > > > > 'steve@korehicom.com' on 4/23/2003 11:09 AM > > You do not have permission to send to this recipient. For > assistance, contact your system administrator. > > ... Relaying denied> > > > > On Wed, 2003-04-23 at 11:29, Raymond Dijkxhoorn wrote: > > Hi! > > > > > 1) What am I doing wrong with exchange that I get such a message? > > > 2) How do I test the f-prot set up to see if it is working for outgoing > > > messages or is this something one doesn't see unless there are virii? > > > > > > Finally, I haven't set up the incoming bit yet until I get the smart > > > host feature working. Do I need an SMTP connector setup???? in exchange? > > > > Most likely you didnt configure the linux box to relay properly, can it be > > that one is giving the faults ? Have a look in your mail log on the linux > > box, i think its going wrong there. > > > > Bye, > > Raymond. -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/0fdd946c/attachment.bin From mkettler at EVI-INC.COM Wed Apr 23 18:21:40 2003 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:17:50 2006 Subject: "report_header 1" invalid for SA? In-Reply-To: <3EA6C72C.3B31175B@dcg.com> References: <5.2.0.9.2.20030423173900.02a6b488@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.0.20030423131730.0218b718@xanadu.evi-inc.com> At 01:02 PM 4/23/2003 -0400, John Goggan wrote: >So, then, is the command invalid for both MA and SA then? I mean, if MS isn't >using it -- and SA's check says it isn't valid -- then what's it there for? >Maybe it is no longer a SA keyword and the MS default spam.assassin.prefs.conf >file should just no longer have it (it currently has it commented out, but >says it can be used)? > >Or did you mean something else? > > - John... report_header is deprecated in SA 2.5x and is an invalid option now. Please read the top of the README in the SA 2.5x tarball. report_safe 0 is the new option that is equivalent to report_header 1. It also doesn't matter what SpamAssassin tagging style is set to when running SA under MailScanner. MailScanner generates the spam-tag headers itself and does not use the ones generated by SA. Thus, changing tagging options in your SpamAssassin configuration files is futile. Configure the mailscanner options in mailscanner.conf instead. Note that these options are _NOT_ the same syntax as the SA ones, so read mailscanner.conf closely. From jgoggan at DCG.COM Wed Apr 23 18:28:32 2003 From: jgoggan at DCG.COM (John Goggan) Date: Thu Jan 12 21:17:50 2006 Subject: "report_header 1" invalid for SA? References: <5.2.0.9.2.20030423173900.02a6b488@imap.ecs.soton.ac.uk> <5.2.0.9.0.20030423131730.0218b718@xanadu.evi-inc.com> Message-ID: <3EA6CD40.B983DED1@dcg.com> Matt Kettler wrote: > report_header is deprecated in SA 2.5x and is an invalid option now. That is what I was figuring -- and trying to pass along and/or suggest to Julian -- so that it could be removed from the default spamassassin config file. > Please read the top of the README in the SA 2.5x tarball. report_safe > 0 is the new option that is equivalent to report_header 1. Indeed. I have no plans to use the option with SA actually -- I just wanted the MS distribution corrected really if it was no longer valid. > MailScanner generates the spam-tag headers itself and does not use the ones > generated by SA. Thus, changing tagging options in your SpamAssassin > configuration files is futile. Configure the mailscanner options in > mailscanner.conf instead. Note that these options are _NOT_ the same syntax > as the SA ones, so read mailscanner.conf closely. As I said, MailScanner is already doing it exactly as I want it. It was just that, when I upgraded, I noticed that that option was different than my old one -- so when I put it back to match my old one and got the error from SA, I figured something was up. Again, mainly just wanted to make sure that it was no longer valid for SA (which is the case) and therefore pass that along to Julian so that it wouldn't be included in the default spamassassin config file in future releases (even if it is commented out by default). Either it should be removed -- or changed to the report_safe keyword. Thanks. - John... From raymond at PROLOCATION.NET Wed Apr 23 18:31:42 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <1051112154.11554.17.camel@steve.hickel.info> Message-ID: Hi! > Here is the exact message I get from sysadmin on the exchange box. I > will check into the relay thing on the linux box though. It does seem > the message is coming from the exchange box though. > The following recipient(s) could not be reached: > > ... Relaying denied> Please check the Linux box, sure you get a error 550 back from the Exchange server, but thats most likely since it cant relay on the linuix box :) What messages get through ? Messages on your local domain ? Bye, Raymond. From raymond at PROLOCATION.NET Wed Apr 23 18:35:59 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <3EA68E05.6640.2A1A5936@localhost> Message-ID: Hi! > I only know how you do this in zmailer, but I guess some sendmail guru out > there will gladly help you with that. Nice to see people still running zmailer. We have been running it when i was working for SoneraPlaza, zmailer is a Sonera internal project :) In sendmail you simple edit /etc/mail/access and put in the Exchange box there with a RELAY entry. Or put in the domain, if more machines have to relay there in for example /etc/mail/relay-hosts Bye, Raymond. From raymond at PROLOCATION.NET Wed Apr 23 18:52:53 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange (user unknown) In-Reply-To: <1051118036.11551.45.camel@steve.hickel.info> Message-ID: Steve, > Now, the next problem. When I set my firewall to the new mail server, > the maillog said that the user was unknown and rejected the email and I > got an error from my sending email server, not the receiving one. I went > back into the mailscan setup and put forward unknown users to the IP of > the exchange server. I will test that in a few minutes but wanted to > know if anyway had a way to get the mailscanner to trap these emails and > hold them until the exchange server was available for them without > having to enter names into the sendmail or linux box? Thoughts? Could you perhaps send a mail AFTER you test next time, saves peoples time reading and trying to help out with a problem. Its not IRC or something, its a mailinglist :) Thanks, Raymond. From raymond at PROLOCATION.NET Wed Apr 23 18:55:51 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: "report_header 1" invalid for SA? In-Reply-To: <5.2.0.9.0.20030423131730.0218b718@xanadu.evi-inc.com> Message-ID: Julian, > >Or did you mean something else? > > > > - John... > > report_header is deprecated in SA 2.5x and is an invalid option now. Please > read the top of the README in the SA 2.5x tarball. report_safe 0 is the new > option that is equivalent to report_header 1. Could you add a line about that in the next version of spam.assassin.pref.conf ? Or perhaps put in thje new option or something, it now comes with the basic configs of MailScanner... =) It for sure will cause confusion as it is now. Bye, Raymond. From mailscanner at ecs.soton.ac.uk Wed Apr 23 19:25:51 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: Incoming Work Dir not hidden? In-Reply-To: <1051117353.18140.4.camel@bach.kevinspicer.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175040@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB001175040@pascal.priv.bmrb.co.uk> Message-ID: <5.2.1.1.2.20030423192508.02623b50@imap.ecs.soton.ac.uk> At 18:02 23/04/2003, you wrote: >I think what you're missing is that /var/spool/MailScanner/quarantine is >the quarantine directory, not the incoming work directory. This is why >Hide Incoming Work Dir doens't hide it. If you want to hide the path in >the 'Note to help desk' you'll need to edit the reports it appears in >[stored.filename.message.txt and stored.virus.message.txt] and remove >$quarantinedir You guys are too good. I didn't think of that at all... -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 23 19:26:32 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: "report_header 1" invalid for SA? In-Reply-To: <3EA6C72C.3B31175B@dcg.com> References: <5.2.0.9.2.20030423173900.02a6b488@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030423192617.025fbc18@imap.ecs.soton.ac.uk> At 18:02 23/04/2003, you wrote: >Julian Field wrote: > > > > The "report_header" option in SpamAssassin has no effect on MailScanner, as > > it does not use the standard SpamAssassin reports but constructs its own > > instead. > >So, then, is the command invalid for both MA and SA then? I mean, if MS isn't >using it -- and SA's check says it isn't valid -- then what's it there for? >Maybe it is no longer a SA keyword and the MS default spam.assassin.prefs.conf >file should just no longer have it (it currently has it commented out, but >says it can be used)? Yes, I should remove it. Will do. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 23 19:33:01 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: References: <3EA68E05.6640.2A1A5936@localhost> Message-ID: <5.2.1.1.2.20030423193228.025d9e78@imap.ecs.soton.ac.uk> At 18:35 23/04/2003, you wrote: >Hi! > > > I only know how you do this in zmailer, but I guess some sendmail guru out > > there will gladly help you with that. > >Nice to see people still running zmailer. We have been running it when >i was working for SoneraPlaza, zmailer is a Sonera internal project :) > >In sendmail you simple edit /etc/mail/access and put in the Exchange box >there with a RELAY entry. Or put in the domain, if more machines have to >relay there in for example /etc/mail/relay-hosts Have you tested the MailScanner support for ZMailer? -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Wed Apr 23 19:40:47 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <5.2.1.1.2.20030423193228.025d9e78@imap.ecs.soton.ac.uk> Message-ID: Hi! > >Nice to see people still running zmailer. We have been running it when > >i was working for SoneraPlaza, zmailer is a Sonera internal project :) > Have you tested the MailScanner support for ZMailer? No, currently i am not working with any ZMailer system. Its a very nice mailer however, with all the queue mechanism inside. I really would recommend it to _large_ volume mailers. Bye, Raymond. From mailscanner at LISTS.COM.AR Wed Apr 23 19:40:19 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) In-Reply-To: <5.2.0.9.2.20030423171226.02ba9e68@imap.ecs.soton.ac.uk> References: Message-ID: <3EA6B3E3.25093.2AAE4664@localhost> El 23 Apr 2003 a las 17:14, Julian Field escribi?: > In version 4, I haven't yet seen a server which required "Delivery Method = > queue". I was actually thinking of removing that option altogether. Just > set it to > Delivery Method = batch Funny thing... I use Delivery Method = queue with zmailer since the router processes (there can be multiple running at the same time) are constantly monitoring the queue directory so there's no need to ask it to process them... the only thing you _must_ do is make sure that no file gets into that directory not being completely written (which the zmailer module ensures by creating it in a different directory, closing it and moving it there with "rename"). If you decide to drop the option altogether, just drop me a line so I modify the KickMessage routine to do nothing (which, in fact, I could do right now, making "queue" the only deliverymethod for zmailer)... -- Mariano Absatz El Baby ---------------------------------------------------------- Why should I care about posterity? What's posterity ever done for me? -- Groucho Marx From mailscanner at LISTS.COM.AR Wed Apr 23 19:54:29 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: References: <5.2.1.1.2.20030423193228.025d9e78@imap.ecs.soton.ac.uk> Message-ID: <3EA6B735.5821.2ABB40DD@localhost> El 23 Apr 2003 a las 20:40, Raymond Dijkxhoorn escribi?: > Hi! > > > >Nice to see people still running zmailer. We have been running it when > > >i was working for SoneraPlaza, zmailer is a Sonera internal project :) > > > Have you tested the MailScanner support for ZMailer? > > No, currently i am not working with any ZMailer system. Its a very nice > mailer however, with all the queue mechanism inside. I really would > recommend it to _large_ volume mailers. Yup... that's why my announce of ZMailer support in MailScanner got such a cold ?welcome?... people running ZMailer are really speed freaks and all the MailScanner/SpamAssassin stuff is orders of magnitude slower than that... Eugene Crosser said: Granted, spamassassin is waaaaay too slow to handle any real traffic... Anyway, I'm just doing our first production environment installation of zmailer+mailscanner... when I put that into production I'll give actual figures for performance. -- Mariano Absatz El Baby ---------------------------------------------------------- Why was I with her? She reminds me of you. In fact, she reminds me more of you than you do! -- Groucho Marx From smhickel at CHARTERMI.NET Wed Apr 23 20:11:44 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: References: Message-ID: <1051125101.11437.68.camel@steve.hickel.info> Ray, My apologies in making it seem like chat. You are so good at figuring this stuff out that in my zeal I launched a bunch of emails and things got crossed. I got the sending of email resolved. I did what you suggested with the access file. But since I am not a linux guru I use webmin to do a lot of setup of configs.Currently I was using a slave zone on bind to the W2K dns server box, but I noted that the linux server named service wasn't started, even though it had the slave entries from the W2K box populated. The service just wasn't coming up even though it was told to on startup. My linux box dns record points to the W2K dns servers that have two mx records for mail. The pref 10 record points to the exchange box. The pref 20 record points to the linux box. I changed the firewall to static nat to the linux box all port 25 traffic. (the exchange box was originally getting the port 25 traffic). When I do that my maillog in /var/log/mailllog says that my email users are unknow users and it appears not to deliver email to the exchange box through the linux sendmail/mailscanner box that has been part of the earlier discussion. I am at a loss where to look for an answer at this point as I tested per your suggestion the setting that told unknown users to be forwarded to the exchange box, but I would think this would be redundant as the mx thing is supposed to take care of the forwarding automatically.I need to resolve why the mailscanner box isn't forwarding email to the exchange box when it comes in (I can see that it is getting the mail in the mail log, it just says unknown user). I currently turned off named and am relying on the dns entry on the machine to point to the W2K DNS server that has the two mx records for the domain. It is possible that I need another set of mx records for the W2K domain that the exchange server thinks it is sending mail from. Anyway, that is where I am at now. Thanks, Steve -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/3d128bbd/attachment.bin From mailscanner at ecs.soton.ac.uk Wed Apr 23 19:59:03 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: "report_header 1" invalid for SA? In-Reply-To: References: <5.2.0.9.0.20030423131730.0218b718@xanadu.evi-inc.com> Message-ID: <5.2.1.1.2.20030423195745.0220aff0@imap.ecs.soton.ac.uk> At 18:55 23/04/2003, you wrote: >Julian, > > > >Or did you mean something else? > > > > > > - John... > > > > report_header is deprecated in SA 2.5x and is an invalid option now. Please > > read the top of the README in the SA 2.5x tarball. report_safe 0 is the new > > option that is equivalent to report_header 1. > >Could you add a line about that in the next version of >spam.assassin.pref.conf ? > >Or perhaps put in thje new option or something, it now comes with the >basic configs of MailScanner... =) > >It for sure will cause confusion as it is now. Agreed :) I have removed all the options that have no effect under MailScanner. The file is somewhat shorter now. But if you have modified it, your next upgrade will place a .rpmnew file in the dir. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Wed Apr 23 20:18:31 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: <1051125101.11437.68.camel@steve.hickel.info> Message-ID: Hi! > was originally getting the port 25 traffic). When I do that my maillog > in /var/log/mailllog says that my email users are unknow users and it > appears not to deliver email to the exchange box through the linux > sendmail/mailscanner box that has been part of the earlier discussion. Its asuming its local users, you could do this in a different way. Put in a entry in the mailertable. (/etc/mail/mailertable) Like this: bgp-expert.com smtp:[mail.bgp-expert.com] If you put in your domain, and the hostname of your exchange box it should go a little better i think. The linux box forwards all mail for the mentioned domain to mail. > thing is supposed to take care of the forwarding automatically.I need to > resolve why the mailscanner box isn't forwarding email to the exchange > box when it comes in (I can see that it is getting the mail in the mail > log, it just says unknown user). I currently turned off named and am > relying on the dns entry on the machine to point to the W2K DNS server Thats depending on some other settings. Did you accidently add for example the domain you relay for in the /etc/mail/local-hostnames ? Bye, Raymond. From copper_shotgun at hotmail.com Wed Apr 23 20:22:29 2003 From: copper_shotgun at hotmail.com (Richard Alexander) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) Message-ID: Thanks.....Batch seemed to fix it. I guess i just read the description wrong in the mailscanner.conf file. I though batch was going to wait until a certain number of messages were queued and then send them through at once. From kevins at BMRB.CO.UK Wed Apr 23 20:32:42 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB00117505D@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB00117505D@pascal.priv.bmrb.co.uk> Message-ID: <1051126365.20787.2.camel@bach.kevinspicer.co.uk> > I am at a loss where to look for an answer at this point as I tested per > your suggestion the setting that told unknown users to be forwarded to > the exchange box, but I would think this would be redundant as the mx > thing is supposed to take care of the forwarding automatically.I need to > resolve why the mailscanner box isn't forwarding email to the exchange > box when it comes in (I can see that it is getting the mail in the mail > log, it just says unknown user). I currently turned off named and am > relying on the dns entry on the machine to point to the W2K DNS server > that has the two mx records for the domain. It is possible that I need > another set of mx records for the W2K domain that the exchange server > thinks it is sending mail from. Anyway, that is where I am at now. You may need to add (if you've not done so already...) yourdomain.com RELAY to /etc/mail/access (note that the field separator is Then do... makemap hash /etc/mail/access < /etc/mail/access and then a... service MailScanner restart BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mailscanner at ecs.soton.ac.uk Wed Apr 23 20:46:45 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <3EA6B735.5821.2ABB40DD@localhost> References: <5.2.1.1.2.20030423193228.025d9e78@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030423204510.0263eee8@imap.ecs.soton.ac.uk> At 19:54 23/04/2003, you wrote: >El 23 Apr 2003 a las 20:40, Raymond Dijkxhoorn escribi?: > > > Hi! > > > > > >Nice to see people still running zmailer. We have been running it when > > > >i was working for SoneraPlaza, zmailer is a Sonera internal project :) > > > > > Have you tested the MailScanner support for ZMailer? > > > > No, currently i am not working with any ZMailer system. Its a very nice > > mailer however, with all the queue mechanism inside. I really would > > recommend it to _large_ volume mailers. >Yup... that's why my announce of ZMailer support in MailScanner got such a >cold ?welcome?... people running ZMailer are really speed freaks and all the >MailScanner/SpamAssassin stuff is orders of magnitude slower than that... > >Eugene Crosser said: >Granted, spamassassin is waaaaay too slow to handle any real traffic... > > >Anyway, I'm just doing our first production environment installation of >zmailer+mailscanner... when I put that into production I'll give actual >figures for performance. If you can beat 1.5 million messages per day (including 3 RBL's and SpamAssassin) on a PC, I would like to know. I did that using Exim. I will have to install ZMailer and have a play. Are there any up to date RedHat rpm's of it, or do I need to install it from source? -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 23 20:40:38 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) In-Reply-To: <3EA6B3E3.25093.2AAE4664@localhost> References: <5.2.0.9.2.20030423171226.02ba9e68@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030423203956.0266dee8@imap.ecs.soton.ac.uk> At 19:40 23/04/2003, you wrote: >El 23 Apr 2003 a las 17:14, Julian Field escribi?: > > > In version 4, I haven't yet seen a server which required "Delivery Method = > > queue". I was actually thinking of removing that option altogether. Just > > set it to > > Delivery Method = batch >Funny thing... I use > Delivery Method = queue >with zmailer since the router processes (there can be multiple running at the >same time) are constantly monitoring the queue directory so there's no need >to ask it to process them... the only thing you _must_ do is make sure that >no file gets into that directory not being completely written (which the >zmailer module ensures by creating it in a different directory, closing it >and moving it there with "rename"). > >If you decide to drop the option altogether, just drop me a line so I modify >the KickMessage routine to do nothing (which, in fact, I could do right now, >making "queue" the only deliverymethod for zmailer)... Don't worry, it's staying. Someone else has already contacted me saying they want it. It's easier to leave it in that it is to remove it anyway, so laziness wins the day :-) -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Wed Apr 23 20:54:45 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <5.2.1.1.2.20030423204510.0263eee8@imap.ecs.soton.ac.uk> Message-ID: Hi! > >Anyway, I'm just doing our first production environment installation of > >zmailer+mailscanner... when I put that into production I'll give actual > >figures for performance. > If you can beat 1.5 million messages per day (including 3 RBL's and > SpamAssassin) on a PC, I would like to know. I did that using Exim. What machine was that ? I am currently testing MailScanner on a Dual Xeon 2.6, lets see if we can push those limits up :) > I will have to install ZMailer and have a play. Are there any up to date > RedHat rpm's of it, or do I need to install it from source? I think zmailer could do more, but basicly, the spamassassin will be the bottleneck i think. At first Zmailer looks pretty complicated, but once you get to know the basics its cool. http://www.zmailer.org/ I didnt try RPMs, most Zmailer setup i have seen were running on big fat SUN clusters :) But have a look on rpmfind, there are a couple available: http://www.rpmfind.net/linux/rpm2html/search.php?query=zmailer Bye, Raymond. From raymond at PROLOCATION.NET Wed Apr 23 21:02:42 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: <1051127818.11551.133.camel@steve.hickel.info> Message-ID: Hi! > the email address could not be found, check the address again. > localhost.localdomain #5.1.2. > > I had entries in the local-hostnames and removed them. I add the > mailertable entry you suggested. And you also restarted MAilScanner to let sendmail pick up the changes? If you could paste some entrys from your linux box mail logs that would help a little more i guess. Bye, Raymond. From smhickel at CHARTERMI.NET Wed Apr 23 20:57:00 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: References: Message-ID: <1051127818.11551.133.camel@steve.hickel.info> Ray, What we have is the exchange box with users on there. No users other than the normal users you get when you config a linux box exist on linux. When I sent an email from outside the network and domain to the local domain known to the internet as the our domain I can see the following: from steve@korehicom.com proto esmtp daemon=mta relay=ip number of my router at the sent-from site The next line says to the email on my local server had its connection reset by the exchange server at the w2K domain exchange box. On my remote email the rejection message says: the email address could not be found, check the address again. localhost.localdomain #5.1.2. I had entries in the local-hostnames and removed them. I add the mailertable entry you suggested. Steve ps. I still have the dns 10 and 10 pref's set up as well. On Wed, 2003-04-23 at 15:18, Raymond Dijkxhoorn wrote: > Hi! > > > was originally getting the port 25 traffic). When I do that my maillog > > in /var/log/mailllog says that my email users are unknow users and it > > appears not to deliver email to the exchange box through the linux > > sendmail/mailscanner box that has been part of the earlier discussion. > > Its asuming its local users, you could do this in a different way. Put in > a entry in the mailertable. (/etc/mail/mailertable) > > Like this: > > bgp-expert.com smtp:[mail.bgp-expert.com] > > If you put in your domain, and the hostname of your exchange box it should > go a little better i think. The linux box forwards all mail for the > mentioned domain to mail. > > > thing is supposed to take care of the forwarding automatically.I need to > > resolve why the mailscanner box isn't forwarding email to the exchange > > box when it comes in (I can see that it is getting the mail in the mail > > log, it just says unknown user). I currently turned off named and am > > relying on the dns entry on the machine to point to the W2K DNS server > > Thats depending on some other settings. Did you accidently add for > example the domain you relay for in the /etc/mail/local-hostnames ? > > Bye, > Raymond. -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/86d67aa6/attachment.bin From copper_shotgun at hotmail.com Wed Apr 23 21:11:16 2003 From: copper_shotgun at hotmail.com (Richard Alexander) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) Message-ID: Last question, is there a default MailScanner.conf setup that could be used for reference? I'm really just looking for the most commonly used config to block Spam, HTML porn messages, etc. Kudos to everyone on the list who helped. From smhickel at CHARTERMI.NET Wed Apr 23 21:23:42 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: References: Message-ID: <1051129420.11437.163.camel@steve.hickel.info> Ray, Here are a few lines of text and I did do the restart thing with mailscanner. I will reboot the machine as well, just in case: message accepted for delivery) Apr 23 16:00:38 fetch MailScanner[760]: MailScanner child caught a SIGHUP Apr 23 16:00:39 fetch MailScanner[751]: MailScanner child caught a SIGHUP Apr 23 16:00:39 fetch MailScanner[644]: MailScanner child caught a SIGHUP Apr 23 16:00:39 fetch MailScanner[759]: MailScanner child caught a SIGHUP Apr 23 16:00:40 fetch MailScanner[758]: MailScanner child caught a SIGHUP Apr 23 16:00:44 fetch sendmail[3097]: alias database /etc/aliases rebuilt by root Apr 23 16:00:44 fetch sendmail[3097]: /etc/aliases: 64 aliases, longest 10 bytes, 636 bytes total Apr 23 16:00:45 fetch sendmail[3106]: starting daemon (8.12.8): SMTP Apr 23 16:00:45 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:00:45 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:00:45 fetch sendmail[3111]: starting daemon (8.12.8): queueing@00:15:00 Apr 23 16:00:45 fetch sendmail[3114]: h3NJgNU0002970: to=, delay=00:18:05, xdelay=00:00:00, mailer=smtp, pri=120821, relay=phs-exc01.pps.local. [10.10.8.62], dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. Apr 23 16:00:50 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:00:50 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:00:55 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:00:55 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:00 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:01:00 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:05 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:01:05 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:10 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:01:10 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:15 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:01:15 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:16 fetch update.virus.scanners: Found f-prot installed Apr 23 16:01:16 fetch update.virus.scanners: Updating f-prot Apr 23 16:01:20 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:01:20 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:22 fetch F-Prot autoupdate[3167]: F-Prot did not need updating. Apr 23 16:01:25 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:01:25 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:30 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:01:30 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:35 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use Apr 23 16:01:35 fetch sendmail[3106]: daemon MTA: problem creating SMTP socket Apr 23 16:01:35 fetch sendmail[3106]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: server SMTP socket wedged: exiting Apr 23 16:05:10 fetch sendmail[3225]: h3NK51U0003225: from=, size=998, class=0, nrcpts=1, msgid=<792B741CF2C0154599608BC5F7505AC11CCBD5@luna.korehicom.com>, proto=ESMTP, daemon=MTA, relay=ip006.korehicom.com [216.109.198.30] Apr 23 16:05:10 fetch sendmail[3238]: h3NK51U0003225: to=, delay=00:00:01, xdelay=00:00:00, mailer=smtp, pri=30821, relay=phs-exc01.pps.local. [10.10.8.62], dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. Apr 23 16:10:41 fetch sendmail[3279]: h3NKAcU0003279: from=, size=997, class=0, nrcpts=1, msgid=<792B741CF2C0154599608BC5F7505AC11CCBD6@luna.korehicom.com>, proto=ESMTP, daemon=MTA, relay=ip006.korehicom.com [216.109.198.30] Apr 23 16:10:41 fetch sendmail[3281]: h3NKAcU0003279: to=, delay=00:00:01, xdelay=00:00:00, mailer=smtp, pri=30823, relay=phs-exc01.pps.local. [10.10.8.62], dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. Apr 23 16:13:14 fetch sendmail[3388]: h3NKD8U0003388: from=, size=12915, class=0, nrcpts=1, msgid=<7E855C06DB514649993DE7500AE49A230E0419@PPS-EXCH1.PPS.Local>, proto=ESMTP, daemon=MTA, relay=phs-exc01.pps.local [10.10.8.62] Apr 23 16:13:15 fetch sendmail[3390]: h3NKD8U0003388: to=, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, pri=30564, relay=cutter.edzone.net. [198.111.152.212], dsn=2.0.0, stat=Sent (Message accepted for delivery) On Wed, 2003-04-23 at 16:02, Raymond Dijkxhoorn wrote: > Hi! > > > the email address could not be found, check the address again. > > localhost.localdomain #5.1.2. > > > > I had entries in the local-hostnames and removed them. I add the > > mailertable entry you suggested. > > And you also restarted MAilScanner to let sendmail pick up the changes? > > If you could paste some entrys from your linux box mail logs that would > help a little more i guess. > > Bye, > Raymond. -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/2f2f089b/attachment.bin From mailscanner at ecs.soton.ac.uk Wed Apr 23 21:44:13 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MAILSCANNER Digest - 21 Apr 2003 to 22 Apr 2003 (#2003-113) In-Reply-To: Message-ID: <5.2.1.1.2.20030423214103.023dccb8@imap.ecs.soton.ac.uk> At 21:11 23/04/2003, you wrote: >Last question, is there a default MailScanner.conf setup that could be >used for reference? Yes, the one I supply. Most people only actually need to touch the "Virus Scanners" setting to get up and running with sensible defaults for everything else. If you want to use SpamAssassin as well, set "Use SpamAssassin = yes". Leave the rest of it alone to start with and then just tweak as necessary. > I'm really just looking for the most commonly used >config to block Spam, HTML porn messages, etc. If you want to strip HTML out of spam (good for killing porn spam) then set Spam Actions = deliver striphtml High Scoring Spam Actions = deliver striphtml Please feel free to start a section in the FAQ and add some "if you want to do this, then set these" items to it. The FAQ could really do with some more content, but that's up to you folks... -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From kevins at BMRB.CO.UK Wed Apr 23 21:34:23 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175068@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175068@pascal.priv.bmrb.co.uk> Message-ID: <1051130064.20787.5.camel@bach.kevinspicer.co.uk> > Apr 23 16:00:45 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use It looks like maybe you have another sendmail process running? service MailScanner stop service sendmail stop pkill -9 sendmail chkconfig sendmail off service MailScanner start should sort you out BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From smhickel at CHARTERMI.NET Wed Apr 23 22:02:51 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: <1051129420.11437.163.camel@steve.hickel.info> References: <1051129420.11437.163.camel@steve.hickel.info> Message-ID: <1051131770.15650.210.camel@steve.hickel.info> Looks like you folks did it. It is now working. It was a second sendmail process running messing with whatever. I did go back and clean up the host... and mailertable issues mentioned earlier, but I did receive my first scanned message. You all are great .Thanks so much. I will have a few more questions tomorrow, but will let others get their email through too. Thanks again all. Steve On Wed, 2003-04-23 at 16:23, Steve Hickel wrote: > Ray, > > Here are a few lines of text and I did do the restart thing with > mailscanner. I will reboot the machine as well, just in case: > > message accepted for delivery) > Apr 23 16:00:38 fetch MailScanner[760]: MailScanner child caught a > SIGHUP > Apr 23 16:00:39 fetch MailScanner[751]: MailScanner child caught a > SIGHUP > Apr 23 16:00:39 fetch MailScanner[644]: MailScanner child caught a > SIGHUP > Apr 23 16:00:39 fetch MailScanner[759]: MailScanner child caught a > SIGHUP > Apr 23 16:00:40 fetch MailScanner[758]: MailScanner child caught a > SIGHUP > Apr 23 16:00:44 fetch sendmail[3097]: alias database /etc/aliases > rebuilt by root > Apr 23 16:00:44 fetch sendmail[3097]: /etc/aliases: 64 aliases, longest > 10 bytes, 636 bytes total > Apr 23 16:00:45 fetch sendmail[3106]: starting daemon (8.12.8): SMTP > Apr 23 16:00:45 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:00:45 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:00:45 fetch sendmail[3111]: starting daemon (8.12.8): > queueing@00:15:00 > Apr 23 16:00:45 fetch sendmail[3114]: h3NJgNU0002970: > to=, delay=00:18:05, xdelay=00:00:00, > mailer=smtp, pri=120821, relay=phs-exc01.pps.local. [10.10.8.62], > dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. > Apr 23 16:00:50 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:00:50 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:00:55 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:00:55 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:00 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:01:00 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:05 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:01:05 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:10 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:01:10 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:15 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:01:15 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:16 fetch update.virus.scanners: Found f-prot installed > Apr 23 16:01:16 fetch update.virus.scanners: Updating f-prot > Apr 23 16:01:20 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:01:20 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:22 fetch F-Prot autoupdate[3167]: F-Prot did not need > updating. > Apr 23 16:01:25 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:01:25 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:30 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:01:30 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:35 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > Apr 23 16:01:35 fetch sendmail[3106]: daemon MTA: problem creating SMTP > socket > Apr 23 16:01:35 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: server SMTP socket wedged: exiting > Apr 23 16:05:10 fetch sendmail[3225]: h3NK51U0003225: > from=, size=998, class=0, nrcpts=1, > msgid=<792B741CF2C0154599608BC5F7505AC11CCBD5@luna.korehicom.com>, > proto=ESMTP, daemon=MTA, relay=ip006.korehicom.com [216.109.198.30] > Apr 23 16:05:10 fetch sendmail[3238]: h3NK51U0003225: > to=, delay=00:00:01, xdelay=00:00:00, > mailer=smtp, pri=30821, relay=phs-exc01.pps.local. [10.10.8.62], > dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. > Apr 23 16:10:41 fetch sendmail[3279]: h3NKAcU0003279: > from=, size=997, class=0, nrcpts=1, > msgid=<792B741CF2C0154599608BC5F7505AC11CCBD6@luna.korehicom.com>, > proto=ESMTP, daemon=MTA, relay=ip006.korehicom.com [216.109.198.30] > Apr 23 16:10:41 fetch sendmail[3281]: h3NKAcU0003279: > to=, delay=00:00:01, xdelay=00:00:00, > mailer=smtp, pri=30823, relay=phs-exc01.pps.local. [10.10.8.62], > dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. > Apr 23 16:13:14 fetch sendmail[3388]: h3NKD8U0003388: > from=, size=12915, class=0, nrcpts=1, > msgid=<7E855C06DB514649993DE7500AE49A230E0419@PPS-EXCH1.PPS.Local>, > proto=ESMTP, daemon=MTA, relay=phs-exc01.pps.local [10.10.8.62] > Apr 23 16:13:15 fetch sendmail[3390]: h3NKD8U0003388: > to=, delay=00:00:01, xdelay=00:00:01, > mailer=esmtp, pri=30564, relay=cutter.edzone.net. [198.111.152.212], > dsn=2.0.0, stat=Sent (Message accepted for delivery) > > On Wed, 2003-04-23 at 16:02, Raymond Dijkxhoorn wrote: > > Hi! > > > > > the email address could not be found, check the address again. > > > localhost.localdomain #5.1.2. > > > > > > I had entries in the local-hostnames and removed them. I add the > > > mailertable entry you suggested. > > > > And you also restarted MAilScanner to let sendmail pick up the changes? > > > > If you could paste some entrys from your linux box mail logs that would > > help a little more i guess. > > > > Bye, > > Raymond. -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030423/17a57da9/attachment.bin From mailscanner at ecs.soton.ac.uk Wed Apr 23 21:58:18 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: References: <5.2.1.1.2.20030423204510.0263eee8@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030423215258.025c3dd0@imap.ecs.soton.ac.uk> At 20:54 23/04/2003, you wrote: >Hi! > > > >Anyway, I'm just doing our first production environment installation of > > >zmailer+mailscanner... when I put that into production I'll give actual > > >figures for performance. > > > If you can beat 1.5 million messages per day (including 3 RBL's and > > SpamAssassin) on a PC, I would like to know. I did that using Exim. > >What machine was that ? I am currently testing MailScanner on a Dual Xeon >2.6, lets see if we can push those limits up :) Dual Xeon 2.4 kindly donated by those kind people at Transtec. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From jase at SENSIS.COM Wed Apr 23 22:10:33 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:50 2006 Subject: Archive Mail, Exim and Locking Bug? (was RE: [MAILSCANNER] Locki ng failing?) Message-ID: I am testing out my new MailScanner server and I think I see a problem with message locking when I have Archive Mail set. To test, I send an email with a large attachment which will take several seconds to scan. When I have Archive Mail = /var/spool/MailScanner/archive it seems that all 3 of my MailScanner processes scan the same single email and 2 of them (as would be expected) have problems moving the email to the out queue (see logs below). But if I comment out Archive Mail and send the same email again, only one MailScanner process scans the email and moves it to the out queue with no problem. I also tried setting Lock Type = flock (just as a test) and sent the same email again. With this, only one MailScanner process scanned the mail and moved it to the out queue fine. But I don't think I should keep it this way because I am using Exim. Is this a bug? Is anyone else using Exim and Archive Mail? Can anyone else duplicate this? from mail.log: Apr 23 16:51:56 dimstar2 MailScanner[7941]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 23 16:51:57 dimstar2 MailScanner[7941]: Using locktype = posix Apr 23 16:51:57 dimstar2 MailScanner[7941]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 23 16:52:06 dimstar2 MailScanner[7946]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 23 16:52:07 dimstar2 MailScanner[7946]: Using locktype = posix Apr 23 16:52:07 dimstar2 MailScanner[7946]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 23 16:52:16 dimstar2 MailScanner[7951]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 23 16:52:22 dimstar2 MailScanner[7951]: Using locktype = posix Apr 23 16:52:22 dimstar2 MailScanner[7951]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 23 16:52:57 dimstar2 MailScanner[7951]: New Batch: Scanning 1 messages, 137787 bytes Apr 23 16:52:57 dimstar2 MailScanner[7951]: Saved archive copies of 198REc-00024N-00 Apr 23 16:52:57 dimstar2 MailScanner[7951]: Spam Checks: Starting Apr 23 16:52:57 dimstar2 MailScanner[7941]: New Batch: Scanning 1 messages, 137787 bytes Apr 23 16:52:57 dimstar2 MailScanner[7941]: Saved archive copies of 198REc-00024N-00 Apr 23 16:52:57 dimstar2 MailScanner[7941]: Spam Checks: Starting Apr 23 16:52:57 dimstar2 MailScanner[7951]: Virus and Content Scanning: Starting Apr 23 16:52:57 dimstar2 MailScanner[7941]: Virus and Content Scanning: Starting Apr 23 16:52:58 dimstar2 MailScanner[7946]: New Batch: Scanning 1 messages, 137787 bytes Apr 23 16:52:58 dimstar2 MailScanner[7946]: Saved archive copies of 198REc-00024N-00 Apr 23 16:52:58 dimstar2 MailScanner[7946]: Spam Checks: Starting Apr 23 16:52:59 dimstar2 MailScanner[7946]: Virus and Content Scanning: Starting Apr 23 16:53:00 dimstar2 MailScanner[7941]: Autodetected 4 CPUs. Starting 4 threads. Apr 23 16:53:02 dimstar2 MailScanner[7951]: Autodetected 4 CPUs. Starting 4 threads. Apr 23 16:53:02 dimstar2 MailScanner[7946]: Autodetected 4 CPUs. Starting 4 threads. Apr 23 16:53:11 dimstar2 MailScanner[7941]: Uninfected: Delivered 1 messages Apr 23 16:53:15 dimstar2 MailScanner[7951]: Failed to link message body between queues (/var/spool/exim.out/input/198REc-00024N-00-D --> /var/spool/exim.in/input/198REc-00024N-00-D) Apr 23 16:53:15 dimstar2 MailScanner[7951]: Uninfected: Delivered 1 messages Apr 23 16:53:15 dimstar2 MailScanner[7946]: Failed to link message body between queues (/var/spool/exim.out/input/198REc-00024N-00-D --> /var/spool/exim.in/input/198REc-00024N-00-D) Apr 23 16:53:15 dimstar2 MailScanner[7946]: Uninfected: Delivered 1 messages Thanks for any help / info. Jason From raymond at PROLOCATION.NET Wed Apr 23 22:16:37 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:50 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: <5.2.1.1.2.20030423215258.025c3dd0@imap.ecs.soton.ac.uk> Message-ID: Hi! > > > If you can beat 1.5 million messages per day (including 3 RBL's and > > > SpamAssassin) on a PC, I would like to know. I did that using Exim. > >What machine was that ? I am currently testing MailScanner on a Dual Xeon > >2.6, lets see if we can push those limits up :) > Dual Xeon 2.4 kindly donated by those kind people at Transtec. ROFL :) Okay, neat! I guess the 2.6 will do about the same. What did you get with sendmail instead of Exim btw? Just curious, or didnt you test that on the same machine ? Bye, Raymond. From mailscanner at ecs.soton.ac.uk Wed Apr 23 22:14:05 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner on Red Hat 8.0 w/Exch (USER Unknown problem) In-Reply-To: <1051129420.11437.163.camel@steve.hickel.info> References: Message-ID: <5.2.1.1.2.20030423221221.0261fdf0@imap.ecs.soton.ac.uk> You are still running an old sendmail process. Do service sendmail stop chkconfig sendmail off Then do a "ps ax" and check there really aren't any sendmail processes left running. Kill any sendmail processes you find, then service MailScanner restart At 21:23 23/04/2003, you wrote: >Ray, > >Here are a few lines of text and I did do the restart thing with >mailscanner. I will reboot the machine as well, just in case: > > message accepted for delivery) >Apr 23 16:00:38 fetch MailScanner[760]: MailScanner child caught a >SIGHUP >Apr 23 16:00:39 fetch MailScanner[751]: MailScanner child caught a >SIGHUP >Apr 23 16:00:39 fetch MailScanner[644]: MailScanner child caught a >SIGHUP >Apr 23 16:00:39 fetch MailScanner[759]: MailScanner child caught a >SIGHUP >Apr 23 16:00:40 fetch MailScanner[758]: MailScanner child caught a >SIGHUP >Apr 23 16:00:44 fetch sendmail[3097]: alias database /etc/aliases >rebuilt by root >Apr 23 16:00:44 fetch sendmail[3097]: /etc/aliases: 64 aliases, longest >10 bytes, 636 bytes total >Apr 23 16:00:45 fetch sendmail[3106]: starting daemon (8.12.8): SMTP >Apr 23 16:00:45 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:00:45 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:00:45 fetch sendmail[3111]: starting daemon (8.12.8): >queueing@00:15:00 >Apr 23 16:00:45 fetch sendmail[3114]: h3NJgNU0002970: >to=, delay=00:18:05, xdelay=00:00:00, >mailer=smtp, pri=120821, relay=phs-exc01.pps.local. [10.10.8.62], >dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. >Apr 23 16:00:50 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:00:50 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:00:55 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:00:55 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:00 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:01:00 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:05 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:01:05 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:10 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:01:10 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:15 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:01:15 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:16 fetch update.virus.scanners: Found f-prot installed >Apr 23 16:01:16 fetch update.virus.scanners: Updating f-prot >Apr 23 16:01:20 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:01:20 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:22 fetch F-Prot autoupdate[3167]: F-Prot did not need >updating. >Apr 23 16:01:25 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:01:25 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:30 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:01:30 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:35 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: cannot bind: Address already in use >Apr 23 16:01:35 fetch sendmail[3106]: daemon MTA: problem creating SMTP >socket >Apr 23 16:01:35 fetch sendmail[3106]: NOQUEUE: SYSERR(root): >opendaemonsocket: daemon MTA: server SMTP socket wedged: exiting >Apr 23 16:05:10 fetch sendmail[3225]: h3NK51U0003225: >from=, size=998, class=0, nrcpts=1, >msgid=<792B741CF2C0154599608BC5F7505AC11CCBD5@luna.korehicom.com>, >proto=ESMTP, daemon=MTA, relay=ip006.korehicom.com [216.109.198.30] >Apr 23 16:05:10 fetch sendmail[3238]: h3NK51U0003225: >to=, delay=00:00:01, xdelay=00:00:00, >mailer=smtp, pri=30821, relay=phs-exc01.pps.local. [10.10.8.62], >dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. >Apr 23 16:10:41 fetch sendmail[3279]: h3NKAcU0003279: >from=, size=997, class=0, nrcpts=1, >msgid=<792B741CF2C0154599608BC5F7505AC11CCBD6@luna.korehicom.com>, >proto=ESMTP, daemon=MTA, relay=ip006.korehicom.com [216.109.198.30] >Apr 23 16:10:41 fetch sendmail[3281]: h3NKAcU0003279: >to=, delay=00:00:01, xdelay=00:00:00, >mailer=smtp, pri=30823, relay=phs-exc01.pps.local. [10.10.8.62], >dsn=4.0.0, stat=Deferred: Connection reset by phs-exc01.pps.local. >Apr 23 16:13:14 fetch sendmail[3388]: h3NKD8U0003388: >from=, size=12915, class=0, nrcpts=1, >msgid=<7E855C06DB514649993DE7500AE49A230E0419@PPS-EXCH1.PPS.Local>, >proto=ESMTP, daemon=MTA, relay=phs-exc01.pps.local [10.10.8.62] >Apr 23 16:13:15 fetch sendmail[3390]: h3NKD8U0003388: >to=, delay=00:00:01, xdelay=00:00:01, >mailer=esmtp, pri=30564, relay=cutter.edzone.net. [198.111.152.212], >dsn=2.0.0, stat=Sent (Message accepted for delivery) > >On Wed, 2003-04-23 at 16:02, Raymond Dijkxhoorn wrote: > > Hi! > > > > > the email address could not be found, check the address again. > > > localhost.localdomain #5.1.2. > > > > > > I had entries in the local-hostnames and removed them. I add the > > > mailertable entry you suggested. > > > > And you also restarted MAilScanner to let sendmail pick up the changes? > > > > If you could paste some entrys from your linux box mail logs that would > > help a little more i guess. > > > > Bye, > > Raymond. >-- >Steve Hickel -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Thu Apr 24 09:17:14 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Speed tests (Was Re: MS on RH8 + Exchange) In-Reply-To: References: <5.2.1.1.2.20030423215258.025c3dd0@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030424091509.031e0e50@imap.ecs.soton.ac.uk> At 22:16 23/04/2003, you wrote: > > > > If you can beat 1.5 million messages per day (including 3 RBL's and > > > > SpamAssassin) on a PC, I would like to know. I did that using Exim. > > > >What machine was that ? I am currently testing MailScanner on a Dual Xeon > > >2.6, lets see if we can push those limits up :) > > > Dual Xeon 2.4 kindly donated by those kind people at > Transtec. > >ROFL :) Okay, neat! I guess the 2.6 will do about the same. What did you >get with sendmail instead of Exim btw? Just curious, or didnt you test >that on the same machine ? An "out of the box" sendmail config behaved very badly, as it limited itself to 1 queue runner at a time and silly things like that. I would be happy to test a "tuned" sendmail config. I use a 60,000 message test set, which is our incoming mail feed which I captured for a while. The tests also include the load caused by the incoming and outgoing SMTP traffic (the test involves 3 machines). -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Richard.Lush at HP.COM Thu Apr 24 09:39:55 2003 From: Richard.Lush at HP.COM (Lush, Richard) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner.conf options missing Message-ID: Hi All, I've just noticed that my MailScanner.conf doesn't have the latest options in it. The upgrade_mailscanner_conf utility does not seem to copy over new options that have been added. Anyone else seen this? Richard Richard Lush Consulting and Integration Security Practice Reading UK Email richard.lush@hp.com Mobile +44 (0) 7788 916941 Office +44 (0) 118 920 2349 Fax +44 (0) 118 920 4612 D I S C L A I M E R The information contained in this communication is intended solely for use by the individual or entity to whom it is addressed. Use of this communication by others is prohibited. HP is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt nor for any special, incidental or consequential damages of any nature whatsoever resulting from receipt or use of this communication. If you are not the intended recipient, you may not peruse, use, disseminate, distribute or copy this message. If you have received this message in error, please notify the sender immediately by email, facsimile or telephone and return or destroy the original message. Thank you. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030424/d840fa3c/attachment.html From raymond at PROLOCATION.NET Thu Apr 24 09:42:53 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner.conf options missing In-Reply-To: Message-ID: Hi! > I've just noticed that my MailScanner.conf doesn't have the latest > options in it. The upgrade_mailscanner_conf utility does not seem to > copy over new options that have been added. > > Anyone else seen this? What options are you missing ? Please be a more specific when reporting on the list. Thanks, Raymond. From Richard.Lush at HP.COM Thu Apr 24 10:48:56 2003 From: Richard.Lush at HP.COM (Lush, Richard) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner.conf options missing Message-ID: Don't mind me. I having one of those days! It does work ok. Richard _____ From: Lush, Richard Sent: 24 April 2003 09:40 To: MAILSCANNER@JISCMAIL.AC.UK Hi All, I've just noticed that my MailScanner.conf doesn't have the latest options in it. The upgrade_mailscanner_conf utility does not seem to copy over new options that have been added. Anyone else seen this? Richard Richard Lush Consulting and Integration Security Practice Reading UK Email richard.lush@hp.com Mobile +44 (0) 7788 916941 Office +44 (0) 118 920 2349 Fax +44 (0) 118 920 4612 D I S C L A I M E R The information contained in this communication is intended solely for use by the individual or entity to whom it is addressed. Use of this communication by others is prohibited. HP is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt nor for any special, incidental or consequential damages of any nature whatsoever resulting from receipt or use of this communication. If you are not the intended recipient, you may not peruse, use, disseminate, distribute or copy this message. If you have received this message in error, please notify the sender immediately by email, facsimile or telephone and return or destroy the original message. Thank you. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030424/0ea1e49a/attachment.html From smhickel at CHARTERMI.NET Thu Apr 24 11:17:35 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner. and Exchange (Does Linux hold mail?) In-Reply-To: <1051130064.20787.5.camel@bach.kevinspicer.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175068@pascal.priv.bmrb.co.uk> <1051130064.20787.5.camel@bach.kevinspicer.co.uk> Message-ID: <1051179455.2727.2.camel@steve.hickel.info> All, Thanks again for the help. Correct me if I am wrong but doesn't the Linux box as I have it implemented from yesterday's discussion hold the mail in the mqueue subdirectory until the exchange box is available to receive it? In other words, if the exchange box should go down as it did the other day for a morning due to a hardware issue, will the Linux box hold the mail and not reject it and then deliver it when the exchange box is back up or do I need to tweak something to make that happen? Steve On Wed, 2003-04-23 at 16:34, Kevin Spicer wrote: > > Apr 23 16:00:45 fetch sendmail[3106]: NOQUEUE: SYSERR(root): > > opendaemonsocket: daemon MTA: cannot bind: Address already in use > > It looks like maybe you have another sendmail process running? > > service MailScanner stop > > service sendmail stop > > pkill -9 sendmail > > chkconfig sendmail off > > service MailScanner start > > should sort you out > > > > > BMRB International > http://www.bmrb.co.uk > +44 (0)20 8566 5000 > _________________________________________________________________ > This message (and any attachment) is intended only for the > recipient and may contain confidential and/or privileged > material. If you have received this in error, please contact the > sender and delete this message immediately. Disclosure, copying > or other action taken in respect of this email or in > reliance on it is prohibited. BMRB International Limited > accepts no liability in relation to any personal emails, or > content of any email which does not directly relate to our > business. -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030424/c1aac1ff/attachment.bin From raymond at PROLOCATION.NET Thu Apr 24 11:21:33 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner. and Exchange (Does Linux hold mail?) In-Reply-To: <1051179455.2727.2.camel@steve.hickel.info> Message-ID: Hi! > receive it? In other words, if the exchange box should go down as it did > the other day for a morning due to a hardware issue, will the Linux box > hold the mail and not reject it and then deliver it when the exchange > box is back up or do I need to tweak something to make that happen? Thats default for sendmail yes, it hold mail 3 or 4 days, depending on your configs... Bye, Raymond. From dh at UPTIME.AT Thu Apr 24 11:45:20 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:51 2006 Subject: catching files with a different filename ending than they should have. Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 I was wondeirng if this is a job for a custom function. Is there a way to somehow check a file's mimetype (or file output) rather than rely on the extension to allow or reject it. Some people tend to send myMP3File.doc which is in reality an mp3 file. Any pointers how to solve this? Thank you - -d -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+p8BEiW/Ta/pxHPQRA29JAJ4k6UB9UyGgPw9Z7hevx7kU2UfkKgCfeQNn Ow3u+f054nLiHltoaQwk1go= =fiZP -----END PGP SIGNATURE----- From patricksteiner at BLUEWIN.CH Thu Apr 24 13:47:43 2003 From: patricksteiner at BLUEWIN.CH (Patrick Steiner) Date: Thu Jan 12 21:17:51 2006 Subject: catching files with a different filename ending than they should have. In-Reply-To: References: Message-ID: <3EA7DCEF.9090902@bluewin.ch> Julian can you add a function to check the file with the program "/usr/bin/file". then mailscanner can detect the right type of the programm and block or allow the file. David wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: RIPEMD160 > > I was wondeirng if this is a job for a custom function. > > Is there a way to somehow check a file's mimetype (or file output) > rather than rely on the extension to allow or reject it. Some people > tend to send myMP3File.doc which is in reality an mp3 file. > > Any pointers how to solve this? > > Thank you > > - -d > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (Darwin) > > iD8DBQE+p8BEiW/Ta/pxHPQRA29JAJ4k6UB9UyGgPw9Z7hevx7kU2UfkKgCfeQNn > Ow3u+f054nLiHltoaQwk1go= > =fiZP > -----END PGP SIGNATURE----- > > From henrik at LEWANDER.COM Thu Apr 24 13:53:50 2003 From: henrik at LEWANDER.COM (Henrik Lewander) Date: Thu Jan 12 21:17:51 2006 Subject: MS, SA, Bayes, locking(?) Message-ID: <030201c30a60$8dcbaea0$05c6a8c0@europe.ad.flextronics.com> I get a lot of these messages (on the console): Cannot open bayes_path /var/mail/.spamassassin/bayes R/W: File exists Somebody know what's happening? I also have two running mailscanners, is that normal? If I stop and restart it I only get one for a while. mail 11680 1 2 14:02 ? 00:00:44 /usr/bin/perl /usr/sbin/mailscanner /etc/mailscanner/mailscanner.conf mail 13567 11680 15 14:38 ? 00:00:03 /usr/bin/perl /usr/sbin/mailscanner /etc/mailscanner/mailscanner.conf Also a last question: I still get these header lines sometimes: X-MailScanner-SpamCheck: not spam, SpamAssassin () Is this when SA times out? I'm running 3.27.1 on Debian. Regards, Henrik From Q.G.Campbell at NEWCASTLE.AC.UK Thu Apr 24 14:17:33 2003 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner/SpamAssassin VS spamassasin -t gives different scores (sometimes) Message-ID: <52E50E4D595DDE4D861117A1FB62E79D221343@bond.ncl.ac.uk> Am running MS 4.10-1 and SA 2.43 with sendmail under RedHat 7.3. Found that some spam is getting through because MailScanner/SpamAssassin does not always apply all the rules that "spamassassin -t" does. In two messages I am testing, a rule from /usr/share/spamassassin/* (the standard SA rules) and a rule from /etc/mail/spamassassin/local.cf (our local rules) are not applied when the messages are posted but the two rules _are_ applied when the messages are run through "spamassassin -t". Note that other rules from both these sets are applied when these same messages are posted; just some of the rules are being ignored. Doing "spamassassin -D -t" indicates that the "spamassassin" command is using the same rule set files that MS/SA should be using. I run "sendmail/MS/SA" as root and am also running "spamassassin -t" as root. I have /usr/local/MailScanner/etc/spam.assassin.prefs.conf empty and set everything I need in /etc/mail/spamassassin/local.cf. Is there a known bug in the above MS/SA combination? I am not in a position to upgrade yet to a later MS & SA setup. Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From mailscanner at ecs.soton.ac.uk Thu Apr 24 14:16:22 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: catching files with a different filename ending than they should have. In-Reply-To: <3EA7DCEF.9090902@bluewin.ch> References: Message-ID: <5.2.0.9.2.20030424140726.04c19c18@imap.ecs.soton.ac.uk> This really needs to become part of a generic content filter system I was thinking about writing. An external program would be called. It would be passed MIME information about each attachment, and the filename where that attachment is stored. At that point the external program can do what it likes with the file. Quite how it might replace MIME information is another matter, I haven't got that sorted yet. Then all I need is some time to write it :-) One of my demo applications for this was an English --> Geordie translator for text messages. But you may also want to throw away attachments whose content doesn't match their filename, remove all content from images with lots of skin tones in them, all sorts of stuff. I need to make it general enough that it will do what 99% of people want to do without making it impossible to write (or use). Perhaps the filter doesn't need the ability to replace MIME information at all, just the actual content? At 13:47 24/04/2003, you wrote: >Julian can you add a function to check the file with the program >"/usr/bin/file". then mailscanner >can detect the right type of the programm and block or allow the file. > >David wrote: > >>-----BEGIN PGP SIGNED MESSAGE----- >>Hash: RIPEMD160 >> >>I was wondeirng if this is a job for a custom function. >> >>Is there a way to somehow check a file's mimetype (or file output) >>rather than rely on the extension to allow or reject it. Some people >>tend to send myMP3File.doc which is in reality an mp3 file. >> >>Any pointers how to solve this? >> >>Thank you >> >>- -d >>-----BEGIN PGP SIGNATURE----- >>Version: GnuPG v1.2.1 (Darwin) >> >>iD8DBQE+p8BEiW/Ta/pxHPQRA29JAJ4k6UB9UyGgPw9Z7hevx7kU2UfkKgCfeQNn >>Ow3u+f054nLiHltoaQwk1go= >>=fiZP >>-----END PGP SIGNATURE----- >> -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Thu Apr 24 14:19:08 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: MS, SA, Bayes, locking(?) In-Reply-To: <030201c30a60$8dcbaea0$05c6a8c0@europe.ad.flextronics.com> Message-ID: <5.2.0.9.2.20030424141646.04c83fa8@imap.ecs.soton.ac.uk> At 13:53 24/04/2003, you wrote: >I get a lot of these messages (on the console): >Cannot open bayes_path /var/mail/.spamassassin/bayes R/W: File exists > >Somebody know what's happening? With something as old as 3.27, this is probably caused by SpamAssassin timing out. >I also have two running mailscanners, is that normal? If I stop and restart >it I only get one for a while. >mail 11680 1 2 14:02 ? 00:00:44 /usr/bin/perl >/usr/sbin/mailscanner /etc/mailscanner/mailscanner.conf >mail 13567 11680 15 14:38 ? 00:00:03 /usr/bin/perl >/usr/sbin/mailscanner /etc/mailscanner/mailscanner.conf If you notice, one is owned by the other. So it's just another process it has forked off to do scanning or SpamAssassin. >Also a last question: I still get these header lines sometimes: >X-MailScanner-SpamCheck: not spam, SpamAssassin () >Is this when SA times out? Almost certainly, yes. >I'm running 3.27.1 on Debian. Anyone fancy getting a *slightly* more recent version packaged for Debian please? I stopped supporting/fixing/improving 3.27 a long time ago. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Thu Apr 24 14:38:33 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner/SpamAssassin VS spamassasin -t gives different scores (sometimes) In-Reply-To: <52E50E4D595DDE4D861117A1FB62E79D221343@bond.ncl.ac.uk> Message-ID: <5.2.0.9.2.20030424143751.04c80498@imap.ecs.soton.ac.uk> At 14:17 24/04/2003, you wrote: >Am running MS 4.10-1 and SA 2.43 with sendmail under RedHat 7.3. > >Found that some spam is getting through because MailScanner/SpamAssassin >does not always apply all the rules that "spamassassin -t" does. > >In two messages I am testing, a rule from /usr/share/spamassassin/* (the >standard SA rules) and a rule from /etc/mail/spamassassin/local.cf (our >local rules) are not applied when the messages are posted but the two >rules _are_ applied when the messages are run through "spamassassin -t". >Note that other rules from both these sets are applied when these same >messages are posted; just some of the rules are being ignored. > >Doing "spamassassin -D -t" indicates that the "spamassassin" command is >using the same rule set files that MS/SA should be using. I run >"sendmail/MS/SA" as root and am also running "spamassassin -t" as root. > >I have /usr/local/MailScanner/etc/spam.assassin.prefs.conf empty and set >everything I need in /etc/mail/spamassassin/local.cf. > >Is there a known bug in the above MS/SA combination? I am not in a >position to upgrade yet to a later MS & SA setup. The only help I can give you is that these options have been added in the latest beta release: # The per-user files (bayes, auto-whitelist, user_prefs) are looked # for here and in ~/.spamassassin/. Note the files are mutable. # If this is unset then no extra places are searched for. # If using Postfix, you probably want to set this as shown in the example # line at the end of this comment, and do # mkdir /var/spool/MailScanner/spamassassin # chown postfix.postfix /var/spool/MailScanner/spamassassin #SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin SpamAssassin User State Dir = # This setting is useful if SpamAssassin is installed in an unusual place, # e.g. /opt/MailScanner. The install prefix is used to find some fallback # directories if neither of the following two settings work. # If this is set then it adds to the list of places that are searched; # otherwise it has no effect. #SpamAssassin Install Prefix = /opt/MailScanner SpamAssassin Install Prefix = # The site-local rules are searched for here, and in prefix/etc/spamassassin, # prefix/etc/mail/spamassassin, /usr/local/etc/spamassassin, /etc/spamassassin, # /etc/mail/spamassassin, and maybe others. # If this is set then it adds to the list of places that are searched; # otherwise it has no effect. #SpamAssassin Local Rules Dir = /opt/MailScanner/etc/mail/spamassassin SpamAssassin Local Rules Dir = # The default rules are searched for here, and in prefix/share/spamassassin, # /usr/local/share/spamassassin, /usr/share/spamassassin, and maybe others. # If this is set then it adds to the list of places that are searched; # otherwise it has no effect. #SpamAssassin Default Rules Dir = /opt/MailScanner/share/spamassassin SpamAssassin Default Rules Dir = -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From dot at DOTAT.AT Thu Apr 24 15:09:11 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner/SpamAssassin VS spamassasin -t gives different scores (sometimes) In-Reply-To: Message-ID: Quentin Campbell wrote: > >In two messages I am testing, a rule from /usr/share/spamassassin/* (the >standard SA rules) and a rule from /etc/mail/spamassassin/local.cf (our >local rules) are not applied when the messages are posted but the two >rules _are_ applied when the messages are run through "spamassassin -t". Which rules? If you run it in debug mode, what does it say about auto- whitelists and bayesian analysis? Tony. -- f.a.n.finch http://dotat.at/ LANDS END TO ST DAVIDS HEAD INCLUDING THE BRISTOL CHANNEL: SOUTH OR SOUTHEAST 4 OR 5, LOCALLY 6 IN NORTHWEST FOR A WHILE, BECOMING 4 IN THE AFTERNOON, BUT INCREASING EAST OR SOUTHEAST 5 TO 7 LOCALLY GALE 8 OVERNIGHT. RAIN CLEARING TO SCATTERED SHOWERS, BUT RAIN AGAIN EVENING AND NIGHT. MODERATE OR GOOD, LOCALLY POOR OVERNIGHT. ROUGH OPEN WATERS AT FIRST AND AGAIN LATER, OTHERWISE MODERATE LOCALLY SLIGHT. From Peter.Bates at LSHTM.AC.UK Thu Apr 24 15:30:31 2003 From: Peter.Bates at LSHTM.AC.UK (Peter Bates) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner/SpamAssassin VS spamassasin -t gives different scores (sometimes) Message-ID: Hello all... > dot@DOTAT.AT 24/04/03 15:09:11 >>> >Which rules? If you run it in debug mode, what does it say about auto- >whitelists and bayesian analysis? Also see my message from yesterday (23rd) entitled 'SpamAssassin Weirdness' that got entirely lost in other discussions ... basically I'm seeing something similar with SA 2.53, and the latest beta of MS, using Postfix support (but I don't think the MTA has much to do with it)... I'd appreciate a bit more insight... also 'Debug SpamAssassin = yes' dumping some stuff when MS is actually running as a daemon would be quite nice. Playing devil's advocate, amavisd has some really nice timing statistics as to time spent processing each message, and how much time (and percentage of time) is spent on certain elements, e.g. SA took 79% of the whatever milliseconds the complete mail took. On another note, Bayes starting working for me with the above combination yesterday, and I haven't a clue why, as I hadn't changed anything... suddenly bayes_msgcount started incrementing, when it hadn't been before... crazy! ---------------------------------------------------------------------------------------------------> Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-958 8353 / Fax: 0207- 636 9838 From dot at DOTAT.AT Thu Apr 24 15:59:44 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner/SpamAssassin VS spamassasin -t gives different scores (sometimes) In-Reply-To: Message-ID: Peter Bates wrote: > >I'd appreciate a bit more insight... also 'Debug SpamAssassin = yes' >dumping some stuff when MS is actually running as a daemon would be quite >nice. Comment out the standard filehandle stuff around line 555 of bin/MailScanner in order to see the output. >Playing devil's advocate, amavisd has some really nice timing >statistics as to time spent processing each message, and how much time >(and percentage of time) is spent on certain elements, e.g. SA took 79% of >the whatever milliseconds the complete mail took. MailScanner can't quite do that because it runs the virus scanner over the whole batch rather than each message; but it would be possible to do for just the spam checks. Adding some extra logging to Message::IsSpam would be worthwhile. >On another note, Bayes starting working for me with the above combination >yesterday, and I haven't a clue why, as I hadn't changed anything... >suddenly bayes_msgcount started incrementing, when it hadn't been >before... crazy! SpamAssassin will auto-train on messages that score above 25 or below -2 by default. Tony. -- f.a.n.finch http://dotat.at/ VIKING: VARIABLE 3 BECOMING SOUTHEAST 5 OR 6, OCCASIONALLY 7. RAIN LATER. MODERATE WITH FOG PATCHES, BECOMING GOOD. From raymond at PROLOCATION.NET Thu Apr 24 16:17:28 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:51 2006 Subject: Exim In-Reply-To: Message-ID: Hi! Today i started playing with Exim, i am stuck with some parts, the rest is running fine it seems. In sendmail is user mailertable to forward mail for a domain (after scanning) to a different machine. Is this possible withing Exim, and if so, how :) This is for exampe a entry in the sendmail mailertable: prolocation.net smtp:[mailstore.prolocation.net] Is this also do-able in Exim ? Anyone ? Thanks, Raymond. From mailscanner at ecs.soton.ac.uk Thu Apr 24 16:28:18 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Exim In-Reply-To: References: Message-ID: <5.2.0.9.2.20030424162618.04c22fe0@imap.ecs.soton.ac.uk> At 16:17 24/04/2003, you wrote: >Hi! > >Today i started playing with Exim, i am stuck with some parts, the rest >is running fine it seems. > >In sendmail is user mailertable to forward mail for a domain (after >scanning) to a different machine. > >Is this possible withing Exim, and if so, how :) > >This is for exampe a entry in the sendmail mailertable: > >prolocation.net smtp:[mailstore.prolocation.net] I have a >begin routers > >manualroute: > driver = manualroute > transport = remote_smtp > domains = * > route_list = * foobar.ecs.soton.ac.uk in my exim_send.conf and it just delivers all mail for all domains onto foobar.ecs.soton.ac.uk. I guess you can put in a domain name in the "domains" line. Tony can probably help you better than me, I never use this stuff in production, I just know how its internals work and what its queues look like :-) -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From jase at SENSIS.COM Thu Apr 24 16:32:40 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:51 2006 Subject: Exim Message-ID: Yes, Exim can do this. You will need to create an entry in your Routers section something like the following: prolocation_router: driver = domainlist transport = remote_smtp domains = prolocation.net route_list = "* mailstore.prolocation.net byname" You'll probably want this to be the first entry in your Routers section, since the order matters. You can test your setup by running the following: exim -C -bt emailaddress@prolocation.net and make sure exim tells you it would use the prolocation_router and deliver the mail via smtp to mailstore.prolocation.net. Jason > -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET] > Sent: Thursday, April 24, 2003 11:17 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [MAILSCANNER] Exim > > > Hi! > > Today i started playing with Exim, i am stuck with some > parts, the rest > is running fine it seems. > > In sendmail is user mailertable to forward mail for a domain (after > scanning) to a different machine. > > Is this possible withing Exim, and if so, how :) > > This is for exampe a entry in the sendmail mailertable: > > prolocation.net smtp:[mailstore.prolocation.net] > > Is this also do-able in Exim ? > Anyone ? > > Thanks, > Raymond. > From raymond at PROLOCATION.NET Thu Apr 24 16:45:34 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:51 2006 Subject: Exim In-Reply-To: Message-ID: Hi! > Yes, Exim can do this. You will need to create an entry in your Routers > section something like the following: Ok. > prolocation_router: > driver = domainlist > transport = remote_smtp > domains = prolocation.net > route_list = "* mailstore.prolocation.net byname" > > You'll probably want this to be the first entry in your Routers section, > since the order matters. > > You can test your setup by running the following: > > exim -C -bt emailaddress@prolocation.net Can Exim also take external files ? Since i have a couple of hundred entry's in my sendmail mailertable at the moment, would be nice to have that in a seperate file, same goed for the domains i relay mail for... Thanks so far :) Bye, Raymond. From dot at DOTAT.AT Thu Apr 24 16:45:25 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:51 2006 Subject: Exim In-Reply-To: References: Message-ID: Raymond Dijkxhoorn wrote: > >In sendmail is user mailertable to forward mail for a domain (after >scanning) to a different machine. > >Is this possible withing Exim, and if so, how :) On our mail hub we have a router like this: special_routes: driver = manualroute domains = ! +local_domains route_data = ${lookup{$domain}cdb{/usr/local/exim/tables/db/special_routes.cdb}} transport = smtp You can change the lookup type according to the format of the table that you want. For Exim-specific questions you should go to the exim-users list which is where all the helpful experts hang out. http://www.exim.org/maillist.html Tony. -- f.a.n.finch http://dotat.at/ PLYMOUTH BISCAY: SOUTH OR SOUTHEAST 4 OR 5 INCREASING 5 TO 7, PERHAPS GALE 8 LATER. THUNDERY SHOWERS THEN RAIN. MODERATE OR GOOD, OCCASIONALLY POOR LATER. From jase at SENSIS.COM Thu Apr 24 17:05:48 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:51 2006 Subject: Exim Message-ID: > > Yes, Exim can do this. You will need to create an entry in > your Routers > > section something like the following: > > Ok. > > > prolocation_router: > > driver = domainlist > > transport = remote_smtp > > domains = prolocation.net > > route_list = "* mailstore.prolocation.net byname" > > > > You'll probably want this to be the first entry in your > Routers section, > > since the order matters. > > > > You can test your setup by running the following: > > > > exim -C -bt emailaddress@prolocation.net > > Can Exim also take external files ? Since i have a couple of hundred > entry's in my sendmail mailertable at the moment, would be > nice to have > that in a seperate file, same goed for the domains i relay mail for... > > Thanks so far :) > > Bye, > Raymond. I think Tony's suggestion can allow for an external file, but I have not done that before. But the test above will still work to make sure mail will go where you want it to. Jason From smhickel at CHARTERMI.NET Thu Apr 24 17:45:19 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner. and Exchange (Does Linux hold mail?) In-Reply-To: References: Message-ID: <1051202589.1548.7.camel@steve.hickel.info> That will be great. Thanks again Ray and the other gentleman too! Steve On Thu, 2003-04-24 at 06:21, Raymond Dijkxhoorn wrote: > Hi! > > > receive it? In other words, if the exchange box should go down as it did > > the other day for a morning due to a hardware issue, will the Linux box > > hold the mail and not reject it and then deliver it when the exchange > > box is back up or do I need to tweak something to make that happen? > > Thats default for sendmail yes, it hold mail 3 or 4 days, depending on > your configs... > > Bye, > Raymond. -- Steve Hickel -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030424/9e5dd519/attachment.bin From raymond at PROLOCATION.NET Thu Apr 24 18:02:12 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:51 2006 Subject: Exim In-Reply-To: Message-ID: Hi! > >In sendmail is user mailertable to forward mail for a domain (after > >scanning) to a different machine. > > > >Is this possible withing Exim, and if so, how :) > special_routes: > driver = manualroute > domains = ! +local_domains > route_data = ${lookup{$domain}cdb{/usr/local/exim/tables/db/cdb}} > transport = smtp > > You can change the lookup type according to the format of the table that > you want. Ok. > For Exim-specific questions you should go to the exim-users list > which is where all the helpful experts hang out. > http://www.exim.org/maillist.html I'll subscribe there tonight, thanks. Raymond. From brian at UNEARTHED.ORG Thu Apr 24 19:30:47 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:51 2006 Subject: Nod32 Message-ID: <008801c30a8f$a66b8050$bc01020a@brianmay> Julian, How did you find Nod32-1.99? their site only has 1.57 listed for linux.. and no 1.99 listed for any version... Also, it seems like nod32 isn't scanning at all.. Using the latest MailScanner release.. I checked the nod32 scripts, along with the rest of the mailscanner files, and checked them against the files on mailscanner.info and they match.. relevant line in MailScanner.conf: Virus Scanners = nod32 clamav f-secure Log files: Apr 24 11:13:32 athena MailScanner[12143]: New Batch: Scanning 1 messages, 2357 bytes Apr 24 11:13:33 athena MailScanner[12143]: Virus and Content Scanning: Starting Apr 24 11:13:35 athena MailScanner[12143]: /var/spool/MailScanner/incoming/12143/./h3OIDW617829/eicar_com.zip: Eicar-Test-Signature FOUND Apr 24 11:13:35 athena MailScanner[12143]: Virus Scanning: ClamAV found 1 infections Apr 24 11:13:39 athena MailScanner[12143]: [./h3OIDW617829/eicar_com.zip] eicar.com: Infected: EICAR_Test_File [F-Prot] Apr 24 11:13:40 athena MailScanner[12143]: Virus Scanning: F-Secure found virus EICAR_Test_File Apr 24 11:13:40 athena MailScanner[12143]: [./h3OIDW617829/eicar_com.zip] eicar.com: Infected: EICAR-Test-File [AVP] Apr 24 11:13:40 athena MailScanner[12143]: Virus Scanning: F-Secure found virus EICAR-Test-File Apr 24 11:13:40 athena MailScanner[12143]: Virus Scanning: F-Secure found 1 infections Apr 24 11:13:40 athena MailScanner[12143]: Virus Scanning: Found 1 viruses Apr 24 11:13:40 athena MailScanner[12143]: Saved entire message to /var/spool/MailScanner/quarantine/20030424/h3OIDW617829 Apr 24 11:13:40 athena MailScanner[12143]: Saved infected "ClamAV: eicar_com.zip" to /var/spool/MailScanner/quarantine/20030424/h3OIDW617829 Apr 24 11:13:40 athena MailScanner[12143]: Saved infected "eicar_com.zip" to /var/spool/MailScanner/quarantine/20030424/h3OIDW617829 Apr 24 11:13:40 athena MailScanner[12143]: Cleaned: Delivered 1 cleaned messages Apr 24 11:13:40 athena MailScanner[12143]: Sender Warnings: Delivered 1 warnings to virus senders Apr 24 11:13:40 athena MailScanner[12143]: Notices: Warned about 1 messages Brian May UnEarthed.Com - Supporting the Local Scene http://www.unearthed.com http://www.rockforrelief.org -- UnEarthed.Com 27023 McBean Parkway #409 Valencia, CA 91355 From mailscanner at ecs.soton.ac.uk Thu Apr 24 20:00:25 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Nod32 In-Reply-To: <008801c30a8f$a66b8050$bc01020a@brianmay> Message-ID: <5.2.1.1.2.20030424195920.02761ca0@imap.ecs.soton.ac.uk> They promised to give me 1.99 but I haven't heard anything more from them. Will have to chase them. At 19:30 24/04/2003, you wrote: >Julian, > > How did you find Nod32-1.99? their site only has 1.57 listed for >linux.. and no 1.99 listed for any version... -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From kevins at BMRB.CO.UK Thu Apr 24 20:00:47 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:51 2006 Subject: Nod32 In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175088@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175088@pascal.priv.bmrb.co.uk> Message-ID: <1051210851.20711.2.camel@bach.kevinspicer.co.uk> Virus Scanners = nod32 clamav f-secure Have you checked that there is an entry for nod32 in /etc/MailScanner/virus.scanners.conf its missing in my 4.10 installation, but present in my 4.14 box - maybe you have an old version of the file? BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dot at DOTAT.AT Thu Apr 24 19:57:05 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:51 2006 Subject: Archive Mail, Exim and Locking Bug? (was RE: [MAILSCANNER] Locki ng failing?) In-Reply-To: Message-ID: "Desai, Jason" wrote: > >I am testing out my new MailScanner server and I think I see a problem with >message locking when I have Archive Mail set. To test, I send an email with >a large attachment which will take several seconds to scan. When I have > >Archive Mail = /var/spool/MailScanner/archive > >it seems that all 3 of my MailScanner processes scan the same single email >and 2 of them (as would be expected) have problems moving the email to the >out queue (see logs below). But if I comment out Archive Mail and send the >same email again, only one MailScanner process scans the email and moves it >to the out queue with no problem. > >I also tried setting Lock Type = flock (just as a test) and sent the same >email again. With this, only one MailScanner process scanned the mail and >moved it to the out queue fine. But I don't think I should keep it this way >because I am using Exim. Is this a bug? Is anyone else using Exim and >Archive Mail? Can anyone else duplicate this? I think I've worked out where the problem comes from, and I caused it :-( The FreeBSD fcntl manual page says: This interface follows the completely stupid semantics of System V and IEEE Std 1003.1-1988 (``POSIX.1'') that require that all locks associated with a file for a given process are removed when any file descriptor for that file is closed by that process. which has implications for MailScanner when it copies messages around :-( I'll be back at some point with a patch. Tony. -- f.a.n.finch http://dotat.at/ HEBRIDES BAILEY: EAST OR NORTHEAST 4 OR 5, OCCASIONALLY 6. OCCASIONAL RAIN. MODERATE OR GOOD. From jase at SENSIS.COM Thu Apr 24 20:11:14 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:51 2006 Subject: Archive Mail, Exim and Locking Bug? (was RE: [ MAILSCANNER] Locki ng failing?) Message-ID: > "Desai, Jason" wrote: > > > >I am testing out my new MailScanner server and I think I see > a problem with > >message locking when I have Archive Mail set. To test, I > send an email with > >a large attachment which will take several seconds to scan. > When I have > > > >Archive Mail = /var/spool/MailScanner/archive > > > >it seems that all 3 of my MailScanner processes scan the > same single email > >and 2 of them (as would be expected) have problems moving > the email to the > >out queue (see logs below). But if I comment out Archive > Mail and send the > >same email again, only one MailScanner process scans the > email and moves it > >to the out queue with no problem. > > > >I also tried setting Lock Type = flock (just as a test) and > sent the same > >email again. With this, only one MailScanner process > scanned the mail and > >moved it to the out queue fine. But I don't think I should > keep it this way > >because I am using Exim. Is this a bug? Is anyone else > using Exim and > >Archive Mail? Can anyone else duplicate this? > > I think I've worked out where the problem comes from, and I > caused it :-( > The FreeBSD fcntl manual page says: > > This interface follows the completely stupid semantics > of System V and > IEEE Std 1003.1-1988 (``POSIX.1'') that require that all > locks associated > with a file for a given process are removed when any > file descriptor for > that file is closed by that process. > > which has implications for MailScanner when it copies > messages around :-( > > I'll be back at some point with a patch. > Thanks Tony. I had just narrowed it down to losing the lock when copying the -D file. If you want me to test any patches just let me know. Thanks again! Jason From dh at UPTIME.AT Thu Apr 24 20:14:11 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:51 2006 Subject: catching files with a different filename ending than they should have. In-Reply-To: <5.2.0.9.2.20030424140726.04c19c18@imap.ecs.soton.ac.uk> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 - -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 On Donnerstag, April 24, 2003, at 03:16 Uhr, Julian Field wrote: > > I need to make it general enough that it will do what 99% of people > want to > do without making it impossible to write (or use). Perhaps the filter > doesn't need the ability to replace MIME information at all, just the > actual content? > Well I was thinking about it because a client requires for his project that the spam filter recognizes Porno images and automatically removes them. I have worked a bit on Content-based Image Retrieval (CBIR) a running system using GiFT can be seen here: http://viper.unige.ch/ What would basically happen is this. A Database with X thousand Porno Pics will be built. The jpeg or whatever attachment is then compared to the database and if enough typical parameters match, it shall be classified as "porn". Of course I was thinking about munching something like that through some sort of strange Bayen database. The other thing, of course, was to just find out who is trying to be smart, sending out mp3 as doc or so. - - -d - - - ? Fantasie ist wichtiger als Wissen.? - Albert Einstein - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+qDbFiW/Ta/pxHPQRA8xcAKCsOKc5A7SOcOb/lXSqvLXJ0DP40wCfZNx7 8tFJsOQkuUrqWwaRHXlgvxs= =5dVR - -----END PGP SIGNATURE----- - -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GCC d+ s: a-- C+ UB++++ P+ L++ E--- W N+ o+++ K w-- O M+ V++ PS PE Y++ PGP++++ t+ 5 X- R+ tv-- b++++ DI D+ G e++++ h+ r++ y++ - ------END GEEK CODE BLOCK------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+qDeIiW/Ta/pxHPQRA7t8AJ0bz3HIAQ511VuGWJujUw+OPUH2HwCg3Lia U2IxONUrdlQg3Dj94z6SqDs= =WexG -----END PGP SIGNATURE----- From nathan at TCPNETWORKS.NET Thu Apr 24 21:03:57 2003 From: nathan at TCPNETWORKS.NET (Nathan Johanson) Date: Thu Jan 12 21:17:51 2006 Subject: SA Bayes Questoin Message-ID: OT, but people in this list are so good and responsive (cheap compliments aside). I set up a test box with SpamAssassin 2.53 and the latest MailScanner build. (I wanted to make sure I get all of the potential wrinkles worked out before going live). I fired some spam messages through the test system. They do get scored as spam by Spam Assassin, but the bayes databases have not been created yet (bayes_msgcount, bayes_seen, and bayes_toks). At this point, I'm just sticking with the default location of /root/.spamassassin/. Am I falsely assuming that these databases should be created immediately with the auto-learning functionality, after only processing a few spam messages? Or does it take a much larger mass of email before these databases are created and subsequently populated with information? I assumed that the first processed spam message would be enough to at least trigger the creation of the db files. If I manually run the sa-learn tool against a mailbox... sa-learn --spam --mbox /mbox_location it creates the database files and populates them appropriately. A subsequent run of check_bayes_db does indeed return the expected information. I'm just curious how long it takes the auto-learning bayes functionality to kick in. Sincerely, Nathan Johanson Email: nathan@tcpnetworks.net From brian at UNEARTHED.ORG Thu Apr 24 21:11:55 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:51 2006 Subject: Nod32 References: <5C0296D26910694BB9A9BBFC577E7AB001175088@pascal.priv.bmrb.co.uk> <1051210851.20711.2.camel@bach.kevinspicer.co.uk> Message-ID: <001b01c30a9d$c5f18970$bc01020a@brianmay> Yup.. it's there... ----- Original Message ----- From: "Kevin Spicer" To: Sent: Thursday, April 24, 2003 12:00 PM Subject: Re: Nod32 Virus Scanners = nod32 clamav f-secure Have you checked that there is an entry for nod32 in /etc/MailScanner/virus.scanners.conf its missing in my 4.10 installation, but present in my 4.14 box - maybe you have an old version of the file? BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mailscanner at ecs.soton.ac.uk Thu Apr 24 21:21:28 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: SA Bayes Questoin In-Reply-To: Message-ID: <5.2.1.1.2.20030424211602.022eee78@imap.ecs.soton.ac.uk> At 21:03 24/04/2003, you wrote: >I set up a test box with SpamAssassin 2.53 and the latest MailScanner >build. (I wanted to make sure I get all of the potential wrinkles worked >out before going live). > >I fired some spam messages through the test system. They do get scored >as spam by Spam Assassin, but the bayes databases have not been created >yet (bayes_msgcount, bayes_seen, and bayes_toks). You won't see the databases created until the first message is auto-learned. The auto-learning thresholds are (I think) -2 and +25. A message has to score outside that range in order to be auto-learned. Send it a message that is extremely spammy (scoring > 25) and all the files should spring into existence. It can take a while before your mail system gets one that spammy. > At this point, I'm >just sticking with the default location of /root/.spamassassin/. That's fine. Keep an occasional eye on the free space in your root filesystem. > Am I >falsely assuming that these databases should be created immediately with >the auto-learning functionality, after only processing a few spam >messages? Or does it take a much larger mass of email before these >databases are created and subsequently populated with information? I >assumed that the first processed spam message would be enough to at >least trigger the creation of the db files. The other fact to know is that the bayes databases won't actually be used to help score a message until 200 messages have been auto-learned. Basically, set it up, leave it chewing mail for a few days and come back to it, when you should find all the files have been created and it is merrily scoring messages. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From heber at AJODER.COM Thu Apr 24 21:34:14 2003 From: heber at AJODER.COM (Heber Soto) Date: Thu Jan 12 21:17:51 2006 Subject: Spamassassin apperantly no scanning email Message-ID: Some of the messages I received are spam but no being tag as one, it looks like spam assassin is not checking those messages. I have included one of those messages also part of my conf files and mail log file. Any comments or Idea a very much welcome. Thanks HEber *** /var/log/mail/warnings Apr 24 11:46:55 mx1 MailScanner[12832]: SpamAssassin timed out and was killed, consecutive failure 1 of 20 Apr 24 11:49:06 mx1 MailScanner[12778]: SpamAssassin timed out and was killed, consecutive failure 1 of 20 Apr 24 12:45:14 mx1 MailScanner[12778]: SpamAssassin timed out and was killed, consecutive failure 1 of 20 Apr 24 13:16:54 mx1 MailScanner[12870]: SpamAssassin timed out and was killed, consecutive failure 1 of 20 *** MailScanner.conf Use SpamAssassin = yes Max SpamAssassin Size = 90000 # "skip_rbl_checks = 1" SpamAssassin Timeout = 30 *** spam.assassin.prefs.conf # skip_rbl_checks 1 Mail headers Received: from mx1.XXXXXXXX.com ([200.50.999.999]) by mail.XXXXXXXX.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2656.59) id D3N643J9; Thu, 24 Apr 2003 15:56:18 -0400 Received: from mailagent1.ientrymail.com (mailagent1.ientrymail.com [66.28.139.16]) by mx1.XXXXXXXX.com (8.12.6/8.12.6) with ESMTP id h3OHx51R014170 for ; Thu, 24 Apr 2003 13:59:05 -0400 Received: from img1.ientry.net (66.28.139.44) by mailagent1.ientrymail.com (PowerMTA(TM) v1.5); Thu, 24 Apr 2003 16:18:21 -0400 (envelope-from <1.11812.39353031313935.1.b@ientrymail.com>) Message-ID: <14107510.1051214006186.JavaMail.root@img1.ientry.net> Date: Thu, 24 Apr 2003 15:53:26 -0400 (EDT) From: WebProNews <1.11812.39353031313935.1@ientrymail.com> To: jortiz@XXXXXXXX.com Subject: Customer Service Emails: How Do Yours Measure Up? Mime-Version: 1.0 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Mailer: Accucast (http://www.accucast.com) X-Mailer-Version: 2.8.6-4 X-MailScanner-Information: Please contact the MIS for more information X-MailScanner: Found to be clean X-MailScanner-SpamScore: s From mailscanner at ecs.soton.ac.uk Thu Apr 24 21:56:09 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Spamassassin apperantly no scanning email In-Reply-To: Message-ID: <5.2.1.1.2.20030424215448.03e85850@imap.ecs.soton.ac.uk> At 21:34 24/04/2003, you wrote: >Some of the messages I received are spam but no being tag as one, it looks >like spam assassin is not checking those messages. I have included one of >those messages also part of my conf files and mail log file. There is an option Always Include SpamAssassin Report = no in your MailScanner.conf file. Please set this to "yes" and try again. This time it should always give you the spam report, which may include more of a clue as to what is happening. Also, try setting the SpamAssassin timeout to 40 seconds instead of 30, again in MailScanner.conf. >Any comments or Idea a very much welcome. > >Thanks > >HEber > > >*** /var/log/mail/warnings > >Apr 24 11:46:55 mx1 MailScanner[12832]: SpamAssassin timed out and was >killed, consecutive failure 1 of 20 >Apr 24 11:49:06 mx1 MailScanner[12778]: SpamAssassin timed out and was >killed, consecutive failure 1 of 20 >Apr 24 12:45:14 mx1 MailScanner[12778]: SpamAssassin timed out and was >killed, consecutive failure 1 of 20 >Apr 24 13:16:54 mx1 MailScanner[12870]: SpamAssassin timed out and was >killed, consecutive failure 1 of 20 > > >*** MailScanner.conf > >Use SpamAssassin = yes >Max SpamAssassin Size = 90000 ># "skip_rbl_checks = 1" >SpamAssassin Timeout = 30 > > >*** spam.assassin.prefs.conf > ># skip_rbl_checks 1 > > >Mail headers > >Received: from mx1.XXXXXXXX.com ([200.50.999.999]) by mail.XXXXXXXX.com >with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2656.59) > id D3N643J9; Thu, 24 Apr 2003 15:56:18 -0400 >Received: from mailagent1.ientrymail.com (mailagent1.ientrymail.com >[66.28.139.16]) > by mx1.XXXXXXXX.com (8.12.6/8.12.6) with ESMTP id h3OHx51R014170 > for ; Thu, 24 Apr 2003 13:59:05 -0400 >Received: from img1.ientry.net (66.28.139.44) by mailagent1.ientrymail.com >(PowerMTA(TM) v1.5); Thu, 24 Apr 2003 16:18:21 -0400 (envelope-from ><1.11812.39353031313935.1.b@ientrymail.com>) >Message-ID: <14107510.1051214006186.JavaMail.root@img1.ientry.net> >Date: Thu, 24 Apr 2003 15:53:26 -0400 (EDT) >From: WebProNews <1.11812.39353031313935.1@ientrymail.com> >To: jortiz@XXXXXXXX.com >Subject: Customer Service Emails: How Do Yours Measure Up? >Mime-Version: 1.0 >Content-Type: text/html; charset=ISO-8859-1 >Content-Transfer-Encoding: quoted-printable >X-Mailer: Accucast (http://www.accucast.com) >X-Mailer-Version: 2.8.6-4 >X-MailScanner-Information: Please contact the MIS for more information >X-MailScanner: Found to be clean >X-MailScanner-SpamScore: s -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Thu Apr 24 22:58:28 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:51 2006 Subject: MailScanner on Red Hat 8.0 and Exchange In-Reply-To: References: <5.2.1.1.2.20030423204510.0263eee8@imap.ecs.soton.ac.uk> Message-ID: <3EA833D4.25881.308A24F5@localhost> El 23 Apr 2003 a las 21:54, Raymond Dijkxhoorn escribi?: > Hi! > > > >Anyway, I'm just doing our first production environment installation of > > >zmailer+mailscanner... when I put that into production I'll give actual > > >figures for performance. > > > If you can beat 1.5 million messages per day (including 3 RBL's and > > SpamAssassin) on a PC, I would like to know. I did that using Exim. > > What machine was that ? I am currently testing MailScanner on a Dual Xeon > 2.6, lets see if we can push those limits up :) > > > I will have to install ZMailer and have a play. Are there any up to date > > RedHat rpm's of it, or do I need to install it from source? > > I think zmailer could do more, but basicly, the spamassassin will be the > bottleneck i think. At first Zmailer looks pretty complicated, but once > you get to know the basics its cool. > > http://www.zmailer.org/ > > I didnt try RPMs, most Zmailer setup i have seen were running on big fat > SUN clusters :) > > But have a look on rpmfind, there are a couple available: > http://www.rpmfind.net/linux/rpm2html/search.php?query=zmailer The rpm's there seems to be 2.99.55... it's not clear wether a patch that appeared soon after is applied... Current version is not yet released, I'm working with 2.99.56-pre4 and CVS has gone further these last days, but I'm staying with the pre4 tarball just in case... Anyway, in a reasonable linux you should be able to: wget ftp://ftp.funet.fi/pub/unix/mail/zmailer/src/zmailer-2.99.56-pre4.tar.gz tar xvzf zmailer-2.99.56-pre4.tar.gz cd zmailer-2.99.56-pre4 ./configure --prefix=/usr/local/zmailer make make install /usr/local/zmailer/bin/post-install -MD5 make install MANDIR=/usr/share/man and be somehow up and running. To start it: zmailer To stop it: zmailer stop You will actually see a bunch of processes: smtpserver router (I think the default is 4 router processes) scheduler I'm enclosing a /etc/rc.d/init.d/zmailer that I use... I'm also enclosing an adapted /etc/rc.d/init.d/MailScanner that only takes care of MailScanner and avoids starting more than one copy... this one I don't think will work in anything but a redhat > 7.1, but should be trivial to adapt it to other linuxes.. HTH -- Mariano Absatz El Baby ---------------------------------------------------------- Error, no keyboard - press F1 to continue. -------------- next part -------------- A non-text attachment was scrubbed... Name: zmailer Type: application/octet-stream Size: 1643 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030424/ef6fab33/zmailer.obj -------------- next part -------------- A non-text attachment was scrubbed... Name: MailScanner Type: application/octet-stream Size: 5093 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030424/ef6fab33/MailScanner.obj From brian at UNEARTHED.ORG Thu Apr 24 23:23:28 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:51 2006 Subject: Fw: Nod32 Message-ID: <001a01c30ab0$27b856e0$bc01020a@brianmay> to add to the mystery... Apr 24 15:01:08 athena update.virus.scanners: Found nod32 installed Apr 24 15:01:08 athena update.virus.scanners: Updating nod32 but it never scans... ----- Original Message ----- From: "Julian Field" To: Sent: Thursday, April 24, 2003 12:00 PM Subject: Re: Nod32 They promised to give me 1.99 but I haven't heard anything more from them. Will have to chase them. At 19:30 24/04/2003, you wrote: >Julian, > > How did you find Nod32-1.99? their site only has 1.57 listed for >linux.. and no 1.99 listed for any version... -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From hciss at HCIWS.COM Fri Apr 25 03:07:33 2003 From: hciss at HCIWS.COM (Matt) Date: Thu Jan 12 21:17:51 2006 Subject: ignoring bounce messages from bounced emails Message-ID: <000501c30acf$6f92b720$6400a8c0@matthewmpqowmc> I have changed: "From: "MailScanner" <$localpostmaster>" to "From: "MailScanner" <>" and I still get all the bounces in my postmaster account. Is there anyway to keep these from coming in the admin account? This is on a Raq4i. This flood of bounce messages makes the admin account nearly worthless. Matt For what the MailScanner.conf doc says: # Set where to find the messages that are delivered to the sender, # when they have sent a message that was detected as spam and caused the # "bounce" action to happen. This message is sent with its envelope # constructed so that the message cannot bounce. it is creating the messages with an envelope from of <> to prevent bouncing back... nonetheless, there are brain dead MTAs out there that insist on bouncing to the RFC822 From: header address (thus violating RFC821)... Maybe you can edit these files: /opt/MailScanner/etc/reports/en/sender.spam.report.txt /opt/MailScanner/etc/reports/en/sender.spam.rbl.report.txt /opt/MailScanner/etc/reports/en/sender.spam.sa.report.txt (or whichever you are using) and change the line that says: From: "MailScanner" <$localpostmaster> to something like From: "MailScanner" <> or From: "if you are a human being and want to report something do it to $localpostmaster" <> El 22 Apr 2003 a las 21:04, Dene Ulmschneider escribi?: > Hey all- > > sorry for the confusing subject of my email - but it's the most accurate > way to state what I am looking to do. > > I am running RHL 7.3 with the latest MailScanner and SA 2.53. I am > currently forwarding regular spam but I am bouncing high scoring spam. > Obviously - there are lots of spam messages that come form forged addresses > and bouncing those messages is in turn causing me to get a bounce message > back. This is due to the fact that I am bouncing the spam from an address > that does not and probably never will really exist. > > My question is this: > Is there a way to ignore the bounces that I get back form forged addresses? > What would be the best way to discard and ignore those particular messages. > Is there a setting in SA or MS that will allow that? > > > Thank You > > Dene Ulmschneider > Data Techie Inc. > ------------------------------------------------------------------------- > office: 718.738.8859 > cell: 646.996.2976 > email: dene@datatechie.com > pager mail: denenow@datatechie.com > website: www.datatechie.com > ------------------------------------------------------------------------- > "Life is too short...-...you should have dessert first" -- Mariano Absatz El Baby ---------------------------------------------------------- Justify my text? I'm sorry but it has no excuse. From mike at CAMAROSS.NET Fri Apr 25 06:47:37 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:51 2006 Subject: ignoring bounce messages from bounced emails In-Reply-To: <5.1.0.14.2.20030422210409.02883870@192.168.1.112> Message-ID: <009e01c30aee$2df597f0$af01a8c0@home.middlefinger.net> Why bother attempting to bounce spam in the first place. Even if you were to get a spammer stupid enough to use his valid email address, one grain of sand in a desert is quite insignificant. Spammers could care less about bounces. Just delete the crap you would bounce and never see it again. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dene Ulmschneider Sent: Tuesday, April 22, 2003 8:04 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: ignoring bounce messages from bounced emails Hey all- sorry for the confusing subject of my email - but it's the most accurate way to state what I am looking to do. I am running RHL 7.3 with the latest MailScanner and SA 2.53. I am currently forwarding regular spam but I am bouncing high scoring spam. Obviously - there are lots of spam messages that come form forged addresses and bouncing those messages is in turn causing me to get a bounce message back. This is due to the fact that I am bouncing the spam from an address that does not and probably never will really exist. My question is this: Is there a way to ignore the bounces that I get back form forged addresses? What would be the best way to discard and ignore those particular messages. Is there a setting in SA or MS that will allow that? Thank You Dene Ulmschneider Data Techie Inc. ------------------------------------------------------------------------- office: 718.738.8859 cell: 646.996.2976 email: dene@datatechie.com pager mail: denenow@datatechie.com website: www.datatechie.com ------------------------------------------------------------------------- "Life is too short...-...you should have dessert first" From hciss at HCIWS.COM Fri Apr 25 06:12:08 2003 From: hciss at HCIWS.COM (Matt) Date: Thu Jan 12 21:17:51 2006 Subject: Spam WhiteList Message-ID: <00e901c30ae9$38827f80$6400a8c0@matthewmpqowmc> In "spam.whitelist.rules" file. # This is where you can build a Spam WhiteList # Addresses matching in here, with the value # "yes" will never be marked as spam. From: 65.18.15. yes From: 65.13.11. yes From: *@internic.net yes To: postmaster@mydomain.net yes To: abuse@mydomain.net yes To: *@second-domain.net yes Am I doing this right? No messages going to my @second-domain.net as an example will ever be blacklisted? Or do I need the "*"? Matt From mailscanner at ecs.soton.ac.uk Fri Apr 25 09:19:09 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Spam WhiteList In-Reply-To: <00e901c30ae9$38827f80$6400a8c0@matthewmpqowmc> Message-ID: <5.2.0.9.2.20030425091837.04398e58@imap.ecs.soton.ac.uk> At 06:12 25/04/2003, you wrote: >In "spam.whitelist.rules" file. > ># This is where you can build a Spam WhiteList ># Addresses matching in here, with the value ># "yes" will never be marked as spam. >From: 65.18.15. yes >From: 65.13.11. yes >From: *@internic.net yes >To: postmaster@mydomain.net yes >To: abuse@mydomain.net yes >To: *@second-domain.net yes > >Am I doing this right? No messages going to my @second-domain.net as an >example will ever be blacklisted? Or do I need the "*"? Always best to have a "default" rules as well: FromOrTo: default no -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 25 09:17:52 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Fw: Nod32 In-Reply-To: <001a01c30ab0$27b856e0$bc01020a@brianmay> Message-ID: <5.2.0.9.2.20030425091738.043c2830@imap.ecs.soton.ac.uk> They have replied and promised me a copy of 1.99 today some time. At 23:23 24/04/2003, you wrote: >to add to the mystery... > >Apr 24 15:01:08 athena update.virus.scanners: Found nod32 installed >Apr 24 15:01:08 athena update.virus.scanners: Updating nod32 > >but it never scans... > > >----- Original Message ----- >From: "Julian Field" >To: >Sent: Thursday, April 24, 2003 12:00 PM >Subject: Re: Nod32 > > >They promised to give me 1.99 but I haven't heard anything more from them. >Will have to chase them. > >At 19:30 24/04/2003, you wrote: > >Julian, > > > > How did you find Nod32-1.99? their site only has 1.57 listed for > >linux.. and no 1.99 listed for any version... > >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From Peter.Bates at LSHTM.AC.UK Fri Apr 25 10:19:46 2003 From: Peter.Bates at LSHTM.AC.UK (Peter Bates) Date: Thu Jan 12 21:17:51 2006 Subject: 'Include Scanner Name In Reports' query... Message-ID: Hello all... I've got 'Include Scanner Name In Reports = yes' set in MailScanner.conf. In the 'admin' message (i.e. message generated when virus is intercepted) I see: The following e-mail messages were found to have viruses in them: MessageID: 2F18414A13B Report: SophosSAVI:TMA FORM- Hsm(e) HS203.doc was infected by WM97/Ethan F-Prot: /var/spool/MailScanner/incoming/27430/./2F18414A13B/TMA FORM- Hsm(e) HS203.doc Infection: W97M/Ethan.A McAfee: /2F18414A13B/TMA FORM- Hsm(e) HS203.doc Found the W97M/Ethan.a virus !!! ... which I like. However, in the message to the sender to warn them of their possible infection, I also see: Our virus detector has just been triggered by a message you sent:- Report: SophosSAVI:TMA FORM- Hsm(e) HS203.doc was infected by WM97/Ethan F-Prot: TMA FORM- Hsm(e) HS203.doc Infection: W97M/Ethan.A McAfee: TMA FORM- Hsm(e) HS203.doc Found the W97M/Ethan.a virus !!! It's just a pedantic point, and one that has been mentioned before, but is there a way of avoiding revealing the names of the AV scanners going out the senders? I think it was mentioned in the past with respect to people identifying which AV scanners are being used at a site... it always pays to be paranoid ;) Is this possible, does it involve major Perl brain surgery, or is it not a feature people are particularly using? Thanks... ---------------------------------------------------------------------------------------------------> Peter Bates, Systems Support Officer, Network Support Team. London School of Hygiene & Tropical Medicine. Telephone:0207-958 8353 / Fax: 0207- 636 9838 From mailscanner at ecs.soton.ac.uk Fri Apr 25 10:35:11 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: 'Include Scanner Name In Reports' query... In-Reply-To: Message-ID: <5.2.0.9.2.20030425103409.02c8d6a0@imap.ecs.soton.ac.uk> At 10:19 25/04/2003, you wrote: >Hello all... > >I've got 'Include Scanner Name In Reports = yes' set in MailScanner.conf. > >In the 'admin' message (i.e. message generated when virus is intercepted) >I see: > >The following e-mail messages were found to have viruses in them: > > > MessageID: 2F18414A13B > Report: SophosSAVI:TMA FORM- Hsm(e) HS203.doc was infected by WM97/Ethan > F-Prot: > /var/spool/MailScanner/incoming/27430/./2F18414A13B/TMA FORM- Hsm(e) > HS203.doc Infection: W97M/Ethan.A > McAfee: /2F18414A13B/TMA FORM- Hsm(e) HS203.doc Found > the W97M/Ethan.a virus !!! > >... which I like. > >However, in the message to the sender to warn them of their possible >infection, I also see: > >Our virus detector has just been triggered by a message you sent:- > >Report: SophosSAVI:TMA FORM- Hsm(e) HS203.doc was infected by WM97/Ethan >F-Prot: TMA FORM- Hsm(e) HS203.doc Infection: W97M/Ethan.A >McAfee: TMA FORM- Hsm(e) HS203.doc Found the W97M/Ethan.a virus !!! > >It's just a pedantic point, and one that has been mentioned before, but is >there a way of avoiding revealing the names of the AV scanners going out >the senders? I think it was mentioned in the past with respect to people >identifying which AV scanners are being used at a site... it always pays >to be paranoid ;) > >Is this possible, does it involve major Perl brain surgery, or is it not a >feature people are particularly using? It's a real pain to do it, as currently the user reports and sysadmin notices are built from the same array of strings. So you either get them always or not at all. Sorry about that. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From paul.hamilton at sme-ecom.co.uk Fri Apr 25 10:33:21 2003 From: paul.hamilton at sme-ecom.co.uk (Paul Hamilton) Date: Thu Jan 12 21:17:51 2006 Subject: Mailscanner restarting every 15 minutes Message-ID: <000001c30b0d$b6967560$fc32000a@4> Hi All, We recently upgraded to MS4.14-9 & 2.53 on a Raq4i and though the MS.conf is set for MS to restart every 14400 secs it is actually restarting every 15 mins. Has anybody else experienced this problem if so any help to return to 14400 would be appreciated. Regards Paul H From mailscanner at BARENDSE.TO Fri Apr 25 13:01:59 2003 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:17:51 2006 Subject: Wildcards in To/From mail addresses for spam blacklists? Message-ID: Would it be possible to use wildcards in the address lists for black/white listing? For example I want to block mail from: superoffers@spam.com superdeals@spam2.com supercars@spam3.com superwheels@spam3.com could I just catch all of this crap by using wildcards in the mail address? like super*@spam?.com -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. From mailscanner at ecs.soton.ac.uk Fri Apr 25 13:52:53 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Wildcards in To/From mail addresses for spam blacklists? In-Reply-To: Message-ID: <5.2.0.9.2.20030425135141.04b18780@imap.ecs.soton.ac.uk> At 13:01 25/04/2003, you wrote: >Would it be possible to use wildcards in the address lists for black/white >listing? Yes. >For example I want to block mail from: >superoffers@spam.com >superdeals@spam2.com >supercars@spam3.com >superwheels@spam3.com > >could I just catch all of this crap by using wildcards in the mail >address? > >like super*@spam?.com super*@spam*.com should work, as would /super.*@spam.?\.com/ -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From jaearick at COLBY.EDU Fri Apr 25 14:06:14 2003 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:17:51 2006 Subject: a test for false positives with high spam score Message-ID: Gang, My setup: Solaris 8, MS 4.14-9, SA 2.53, using Infinite-Monkeys and bayes learning in SA. My MS high spam score is 10 instead of the default of 20, and my high spam action is "delete". I wondered if I was deleting any legit email, so I changed the high spam subject label to "{HIGH SPAM}", set the mechanism to forward to me, then set up my .procmailrc to deliver this stuff to an alternate mailbox. After three days of testing and more than 400 captured spams, I can report **zero** legit emails captured. So I am reverting to the delete action with a high score of 10. The way MailScanner is designed, it made setting up this test really easy! Thanks Julian. --- Jeff Earickson From dot at DOTAT.AT Fri Apr 25 18:16:59 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:51 2006 Subject: Archive Mail, Exim and Locking Bug? (was RE: [ MAILSCANNER] Locki ng failing?) In-Reply-To: Message-ID: "Desai, Jason" wrote: > >Thanks Tony. I had just narrowed it down to losing the lock when copying >the -D file. If you want me to test any patches just let me know. I'm testing this at the moment. --- EximDiskStore.pm 27 Mar 2003 17:28:47 -0000 1.7 +++ EximDiskStore.pm 25 Apr 2003 16:33:27 -0000 1.8 @@ -358,14 +358,22 @@ # Copy a dfile and hfile to a directory +# This has to be done in a subprocess in order to avoid breaking POSIX locks. sub CopyToDir { my($this,$dir) = @_; + my $pid = fork; + MailScanner::Log::DieLog("fork: $!") if not defined $pid; + if ($pid) { + waitpid $pid, 0; + return; + } my $hpath = $this->{hpath}; my $dpath = $this->{dpath}; my $hfile = basename($hpath); my $dfile = basename($dpath); copy($hpath, "$dir/$hfile"); copy($dpath, "$dir/$dfile"); + exit; } @@ -415,8 +423,18 @@ if (MailScanner::Config::Value('storeentireasdfqf')) { $this->CopyToDir($targetdir); } else { + # Do this in a subprocess in order to avoid breaking POSIX locks. + my $pid = fork; + MailScanner::Log::DieLog("fork: $!") if not defined $pid; + if ($pid) { + waitpid $pid, 0; + return; + } my $target = new IO::File "$targetdir/$targetfile", "w"; + MailScanner::Log::DieLog("writing to $targetdir/$targetfile: $!") + if not defined $target; $this->WriteEntireMessage($message, $target); + return; } return 1; @@ -447,9 +465,9 @@ my $pipe = new IO::Pipe; my $pid; - + if (not defined $pipe or not defined ($pid = fork)) { - MailScanner::Log::WarnLog("Cannot build message from $this->{dpath} " . + MailScanner::Log::DieLog("Cannot build message from $this->{dpath} " . "and $message->{headerspath}, %s", $!); } elsif ($pid) { # Parent $pipe->reader(); Tony. -- f.a.n.finch http://dotat.at/ MALIN HEBRIDES: EAST OR SOUTHEAST 5 OR 6. RAIN AT TIMES. MODERATE OR GOOD. From mailscanner at ecs.soton.ac.uk Fri Apr 25 18:55:44 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: a test for false positives with high spam score In-Reply-To: Message-ID: <5.2.1.1.2.20030425185528.027544c0@imap.ecs.soton.ac.uk> Thanks Jeff. It's much appreciated :-) At 14:06 25/04/2003, you wrote: >Gang, > > My setup: Solaris 8, MS 4.14-9, SA 2.53, using Infinite-Monkeys >and bayes learning in SA. My MS high spam score is 10 instead of >the default of 20, and my high spam action is "delete". I wondered >if I was deleting any legit email, so I changed the high spam subject >label to "{HIGH SPAM}", set the mechanism to forward to me, then >set up my .procmailrc to deliver this stuff to an alternate mailbox. > > After three days of testing and more than 400 captured spams, >I can report **zero** legit emails captured. So I am reverting to >the delete action with a high score of 10. The way MailScanner is >designed, it made setting up this test really easy! Thanks Julian. > >--- Jeff Earickson -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 25 18:59:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Archive Mail, Exim and Locking Bug? (was RE: [ MAILSCANNER] Locki ng failing?) In-Reply-To: References: Message-ID: <5.2.1.1.2.20030425185637.02755cc0@imap.ecs.soton.ac.uk> If you can get this thoroughly tested before 1st May, then it can go in the new stable release. Otherwise it will have to wait a month or so. I can put it out as an "unstable" release though, so don't worry too much. The next release will probably be on the first Friday (or possibly the weekend) after 1st May. I like releasing at awkward times, it means a few people test it before Monday morning, which gives me a chance to fix any cock-ups. At 18:16 25/04/2003, you wrote: >"Desai, Jason" wrote: > > > >Thanks Tony. I had just narrowed it down to losing the lock when copying > >the -D file. If you want me to test any patches just let me know. > >I'm testing this at the moment. > >--- EximDiskStore.pm 27 Mar 2003 17:28:47 -0000 1.7 >+++ EximDiskStore.pm 25 Apr 2003 16:33:27 -0000 1.8 >@@ -358,14 +358,22 @@ > > > # Copy a dfile and hfile to a directory >+# This has to be done in a subprocess in order to avoid breaking POSIX locks. > sub CopyToDir { > my($this,$dir) = @_; >+ my $pid = fork; >+ MailScanner::Log::DieLog("fork: $!") if not defined $pid; >+ if ($pid) { >+ waitpid $pid, 0; >+ return; >+ } > my $hpath = $this->{hpath}; > my $dpath = $this->{dpath}; > my $hfile = basename($hpath); > my $dfile = basename($dpath); > copy($hpath, "$dir/$hfile"); > copy($dpath, "$dir/$dfile"); >+ exit; > } > > >@@ -415,8 +423,18 @@ > if (MailScanner::Config::Value('storeentireasdfqf')) { > $this->CopyToDir($targetdir); > } else { >+ # Do this in a subprocess in order to avoid breaking POSIX locks. >+ my $pid = fork; >+ MailScanner::Log::DieLog("fork: $!") if not defined $pid; >+ if ($pid) { >+ waitpid $pid, 0; >+ return; >+ } > my $target = new IO::File "$targetdir/$targetfile", "w"; >+ MailScanner::Log::DieLog("writing to $targetdir/$targetfile: $!") >+ if not defined $target; > $this->WriteEntireMessage($message, $target); >+ return; > } > > return 1; >@@ -447,9 +465,9 @@ > > my $pipe = new IO::Pipe; > my $pid; >- >+ > if (not defined $pipe or not defined ($pid = fork)) { >- MailScanner::Log::WarnLog("Cannot build message from $this->{dpath} " . >+ MailScanner::Log::DieLog("Cannot build message from $this->{dpath} " . > "and $message->{headerspath}, %s", $!); > } elsif ($pid) { # Parent > $pipe->reader(); > > >Tony. >-- >f.a.n.finch http://dotat.at/ >MALIN HEBRIDES: EAST OR SOUTHEAST 5 OR 6. RAIN AT TIMES. MODERATE OR GOOD. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From brian at UNEARTHED.ORG Fri Apr 25 19:43:22 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:51 2006 Subject: 'Include Scanner Name In Reports' query... References: <5.2.0.9.2.20030425103409.02c8d6a0@imap.ecs.soton.ac.uk> Message-ID: <004701c30b5a$96360270$bc01020a@brianmay> Would something like this do the job? Replace the "Scanner Name" with Scanner Also, for some reason, ClamAV likes to add "ClamAV: " infront of infected files... couldn't remove the scanner name from that.. I dunno... --[start]------------------------- *** /usr/lib/MailScanner/MailScanner/Message.pm-orig Fri Apr 25 09:46:22 2003 --- /usr/lib/MailScanner/MailScanner/Message.pm Fri Apr 25 11:25:06 2003 *************** *** 1845,1850 **** --- 1845,1857 ---- $entityreports = $this->{entityreports}; push @everyreport, values %$allreports; push @everyreport, values %$entityreports; + foreach my $rep (@everyreport) { + if ($rep =~ m/^([A-Za-z0-9-]+)\: /) { + $rep =~ s/$1/Scanner/ig; + } + } $report = join('Report: ', @everyreport); $alltypes = $this->{alltypes}; --[end]--------------------------- ----- Original Message ----- From: "Julian Field" To: Sent: Friday, April 25, 2003 2:35 AM Subject: Re: 'Include Scanner Name In Reports' query... At 10:19 25/04/2003, you wrote: >Hello all... > >I've got 'Include Scanner Name In Reports = yes' set in MailScanner.conf. > >In the 'admin' message (i.e. message generated when virus is intercepted) >I see: > >The following e-mail messages were found to have viruses in them: > > > MessageID: 2F18414A13B > Report: SophosSAVI:TMA FORM- Hsm(e) HS203.doc was infected by WM97/Ethan > F-Prot: > /var/spool/MailScanner/incoming/27430/./2F18414A13B/TMA FORM- Hsm(e) > HS203.doc Infection: W97M/Ethan.A > McAfee: /2F18414A13B/TMA FORM- Hsm(e) HS203.doc Found > the W97M/Ethan.a virus !!! > >... which I like. > >However, in the message to the sender to warn them of their possible >infection, I also see: > >Our virus detector has just been triggered by a message you sent:- > >Report: SophosSAVI:TMA FORM- Hsm(e) HS203.doc was infected by WM97/Ethan >F-Prot: TMA FORM- Hsm(e) HS203.doc Infection: W97M/Ethan.A >McAfee: TMA FORM- Hsm(e) HS203.doc Found the W97M/Ethan.a virus !!! > >It's just a pedantic point, and one that has been mentioned before, but is >there a way of avoiding revealing the names of the AV scanners going out >the senders? I think it was mentioned in the past with respect to people >identifying which AV scanners are being used at a site... it always pays >to be paranoid ;) > >Is this possible, does it involve major Perl brain surgery, or is it not a >feature people are particularly using? It's a real pain to do it, as currently the user reports and sysadmin notices are built from the same array of strings. So you either get them always or not at all. Sorry about that. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 25 20:00:27 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: 'Include Scanner Name In Reports' query... In-Reply-To: <004701c30b5a$96360270$bc01020a@brianmay> References: <5.2.0.9.2.20030425103409.02c8d6a0@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030425195530.0229bce8@imap.ecs.soton.ac.uk> At 19:43 25/04/2003, you wrote: >Would something like this do the job? > >Replace the "Scanner Name" with Scanner > >Also, for some reason, ClamAV likes to add "ClamAV: " infront of infected >files... couldn't remove the scanner name from that.. I dunno... Don't understand why, it's pretty much the same code in all the parsers. >--[start]------------------------- >*** /usr/lib/MailScanner/MailScanner/Message.pm-orig Fri Apr 25 09:46:22 >2003 >--- /usr/lib/MailScanner/MailScanner/Message.pm Fri Apr 25 11:25:06 2003 >*************** >*** 1845,1850 **** >--- 1845,1857 ---- > $entityreports = $this->{entityreports}; > push @everyreport, values %$allreports; > push @everyreport, values %$entityreports; >+ foreach my $rep (@everyreport) { >+ if ($rep =~ m/^([A-Za-z0-9-]+)\: /) { >+ $rep =~ s/$1/Scanner/ig; >+ } >+ } > $report = join('Report: ', @everyreport); > > $alltypes = $this->{alltypes}; That would have to test 2 config options for every message to work properly, as it needs to check that they already have the scanner name on the front, and that they want to delete it. Quite an overhead. >--[end]--------------------------- >----- Original Message ----- >From: "Julian Field" >To: >Sent: Friday, April 25, 2003 2:35 AM >Subject: Re: 'Include Scanner Name In Reports' query... > > >At 10:19 25/04/2003, you wrote: > >Hello all... > > > >I've got 'Include Scanner Name In Reports = yes' set in MailScanner.conf. > > > >In the 'admin' message (i.e. message generated when virus is intercepted) > >I see: > > > >The following e-mail messages were found to have viruses in them: > > > > > > MessageID: 2F18414A13B > > Report: SophosSAVI:TMA FORM- Hsm(e) HS203.doc was infected by >WM97/Ethan > > F-Prot: > > /var/spool/MailScanner/incoming/27430/./2F18414A13B/TMA FORM- Hsm(e) > > HS203.doc Infection: W97M/Ethan.A > > McAfee: /2F18414A13B/TMA FORM- Hsm(e) HS203.doc Found > > the W97M/Ethan.a virus !!! > > > >... which I like. > > > >However, in the message to the sender to warn them of their possible > >infection, I also see: > > > >Our virus detector has just been triggered by a message you sent:- > > > >Report: SophosSAVI:TMA FORM- Hsm(e) HS203.doc was infected by WM97/Ethan > >F-Prot: TMA FORM- Hsm(e) HS203.doc Infection: W97M/Ethan.A > >McAfee: TMA FORM- Hsm(e) HS203.doc Found the W97M/Ethan.a virus !!! > > > >It's just a pedantic point, and one that has been mentioned before, but is > >there a way of avoiding revealing the names of the AV scanners going out > >the senders? I think it was mentioned in the past with respect to people > >identifying which AV scanners are being used at a site... it always pays > >to be paranoid ;) > > > >Is this possible, does it involve major Perl brain surgery, or is it not a > >feature people are particularly using? > >It's a real pain to do it, as currently the user reports and sysadmin >notices are built from the same array of strings. So you either get them >always or not at all. Sorry about that. >-- >Julian Field >www.MailScanner.info >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From jase at SENSIS.COM Fri Apr 25 21:09:44 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:51 2006 Subject: Archive Mail, Exim and Locking Bug? (was RE: [ MAILSCANNER] Locki ng failing?) Message-ID: Tony, Some minor changes to your patch - I think you need to change the last added "return" to "exit" in the second hunk or your patch. When messages got quarantined as a whole messages instead of queue files, extra mailscanner processes started hanging around and not exiting. I changed "return" to "exit" and it seemed to fix the problem. Also, should you change the first added "return" to "return 1" in the second hunk to match the "return 1" at the end of the function? I've attached an updated patch to this message in case I'm not communicating clearly. I'm no perl guru, but that's what I came up with. Thanks for your help! Jason > -----Original Message----- > From: Tony Finch [mailto:dot@DOTAT.AT] > Sent: Friday, April 25, 2003 1:17 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Archive Mail, Exim and Locking > Bug? (was RE: > [ MAILSCANNER] Locki ng failing?) > > > "Desai, Jason" wrote: > > > >Thanks Tony. I had just narrowed it down to losing the lock > when copying > >the -D file. If you want me to test any patches just let me know. > > I'm testing this at the moment. > > --- EximDiskStore.pm 27 Mar 2003 17:28:47 -0000 1.7 > +++ EximDiskStore.pm 25 Apr 2003 16:33:27 -0000 1.8 > @@ -358,14 +358,22 @@ > > > # Copy a dfile and hfile to a directory > +# This has to be done in a subprocess in order to avoid > breaking POSIX locks. > sub CopyToDir { > my($this,$dir) = @_; > + my $pid = fork; > + MailScanner::Log::DieLog("fork: $!") if not defined $pid; > + if ($pid) { > + waitpid $pid, 0; > + return; > + } > my $hpath = $this->{hpath}; > my $dpath = $this->{dpath}; > my $hfile = basename($hpath); > my $dfile = basename($dpath); > copy($hpath, "$dir/$hfile"); > copy($dpath, "$dir/$dfile"); > + exit; > } > > > @@ -415,8 +423,18 @@ > if (MailScanner::Config::Value('storeentireasdfqf')) { > $this->CopyToDir($targetdir); > } else { > + # Do this in a subprocess in order to avoid breaking POSIX locks. > + my $pid = fork; > + MailScanner::Log::DieLog("fork: $!") if not defined $pid; > + if ($pid) { > + waitpid $pid, 0; > + return; > + } > my $target = new IO::File "$targetdir/$targetfile", "w"; > + MailScanner::Log::DieLog("writing to $targetdir/$targetfile: $!") > + if not defined $target; > $this->WriteEntireMessage($message, $target); > + return; > } > > return 1; > @@ -447,9 +465,9 @@ > > my $pipe = new IO::Pipe; > my $pid; > - > + > if (not defined $pipe or not defined ($pid = fork)) { > - MailScanner::Log::WarnLog("Cannot build message from > $this->{dpath} " . > + MailScanner::Log::DieLog("Cannot build message from > $this->{dpath} " . > "and $message->{headerspath}, %s", $!); > } elsif ($pid) { # Parent > $pipe->reader(); > > > Tony. > -- > f.a.n.finch http://dotat.at/ > MALIN HEBRIDES: EAST OR SOUTHEAST 5 OR 6. RAIN AT TIMES. > MODERATE OR GOOD. > -------------- next part -------------- A non-text attachment was scrubbed... Name: myMailScannerPatch.diff Type: application/octet-stream Size: 1611 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030425/926d5b83/myMailScannerPatch.obj From nathan at TCPNETWORKS.NET Fri Apr 25 21:22:22 2003 From: nathan at TCPNETWORKS.NET (Nathan Johanson) Date: Thu Jan 12 21:17:51 2006 Subject: SA Bayes Questoin Message-ID: Thanks so much for the quick response. -Nathan -----Original Message----- From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] Sent: Thursday, April 24, 2003 1:21 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: SA Bayes Questoin At 21:03 24/04/2003, you wrote: >I set up a test box with SpamAssassin 2.53 and the latest MailScanner >build. (I wanted to make sure I get all of the potential wrinkles worked >out before going live). > >I fired some spam messages through the test system. They do get scored >as spam by Spam Assassin, but the bayes databases have not been created >yet (bayes_msgcount, bayes_seen, and bayes_toks). You won't see the databases created until the first message is auto-learned. The auto-learning thresholds are (I think) -2 and +25. A message has to score outside that range in order to be auto-learned. Send it a message that is extremely spammy (scoring > 25) and all the files should spring into existence. It can take a while before your mail system gets one that spammy. > At this point, I'm >just sticking with the default location of /root/.spamassassin/. That's fine. Keep an occasional eye on the free space in your root filesystem. > Am I >falsely assuming that these databases should be created immediately with >the auto-learning functionality, after only processing a few spam >messages? Or does it take a much larger mass of email before these >databases are created and subsequently populated with information? I >assumed that the first processed spam message would be enough to at >least trigger the creation of the db files. The other fact to know is that the bayes databases won't actually be used to help score a message until 200 messages have been auto-learned. Basically, set it up, leave it chewing mail for a few days and come back to it, when you should find all the files have been created and it is merrily scoring messages. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Fri Apr 25 21:30:25 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: SA Bayes Questoin In-Reply-To: Message-ID: <5.2.1.1.2.20030425212937.046c0778@imap.ecs.soton.ac.uk> All additional comments to the "guest book" most welcome. And you might want to add this to the FAQ as well. It needs lots more content, people... At 21:22 25/04/2003, you wrote: >Thanks so much for the quick response. >-Nathan > >-----Original Message----- >From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] >Sent: Thursday, April 24, 2003 1:21 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: SA Bayes Questoin > > >At 21:03 24/04/2003, you wrote: > >I set up a test box with SpamAssassin 2.53 and the latest MailScanner > >build. (I wanted to make sure I get all of the potential wrinkles >worked > >out before going live). > > > >I fired some spam messages through the test system. They do get scored > >as spam by Spam Assassin, but the bayes databases have not been created > >yet (bayes_msgcount, bayes_seen, and bayes_toks). > >You won't see the databases created until the first message is >auto-learned. The auto-learning thresholds are (I think) -2 and +25. A >message has to score outside that range in order to be auto-learned. >Send >it a message that is extremely spammy (scoring > 25) and all the files >should spring into existence. It can take a while before your mail >system >gets one that spammy. > > > At this point, I'm > >just sticking with the default location of /root/.spamassassin/. > >That's fine. Keep an occasional eye on the free space in your root >filesystem. > > > Am I > >falsely assuming that these databases should be created immediately >with > >the auto-learning functionality, after only processing a few spam > >messages? Or does it take a much larger mass of email before these > >databases are created and subsequently populated with information? I > >assumed that the first processed spam message would be enough to at > >least trigger the creation of the db files. > >The other fact to know is that the bayes databases won't actually be >used >to help score a message until 200 messages have been auto-learned. > >Basically, set it up, leave it chewing mail for a few days and come back >to >it, when you should find all the files have been created and it is >merrily >scoring messages. >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mkettler at EVI-INC.COM Fri Apr 25 23:09:56 2003 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:17:51 2006 Subject: Mailscanner restarting every 15 minutes In-Reply-To: <000001c30b0d$b6967560$fc32000a@4> Message-ID: <5.2.0.9.0.20030425175425.016f6890@xanadu.evi-inc.com> An interesting observation on this: 14400 seconds = 0x3840 15mins = 900 = 0x384 Bit-shifted by 4??? At 10:33 AM 4/25/2003 +0100, you wrote: >Hi All, > >We recently upgraded to MS4.14-9 & 2.53 on a Raq4i >and though the MS.conf is set for MS to restart every >14400 secs it is actually restarting every 15 mins. > >Has anybody else experienced this problem if so >any help to return to 14400 would be appreciated. > >Regards > >Paul H From mailscanner at ecs.soton.ac.uk Fri Apr 25 23:57:20 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:51 2006 Subject: Mailscanner restarting every 15 minutes In-Reply-To: <5.2.0.9.0.20030425175425.016f6890@xanadu.evi-inc.com> References: <000001c30b0d$b6967560$fc32000a@4> Message-ID: <5.2.1.1.2.20030425235607.046df0f8@imap.ecs.soton.ac.uk> At 23:09 25/04/2003, you wrote: >An interesting observation on this: > >14400 seconds = 0x3840 >15mins = 900 = 0x384 > >Bit-shifted by 4??? 15 mins x 4 x 4 = 4 hours, correct. But seeing how I do it all in Perl integers, I don't think there's anything like that going on :-) Has anyone else had this problem? >At 10:33 AM 4/25/2003 +0100, you wrote: >>Hi All, >> >>We recently upgraded to MS4.14-9 & 2.53 on a Raq4i >>and though the MS.conf is set for MS to restart every >>14400 secs it is actually restarting every 15 mins. >> >>Has anybody else experienced this problem if so >>any help to return to 14400 would be appreciated. >> >>Regards >> >>Paul H -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From danielk at AVALONPUB.COM Sat Apr 26 02:01:28 2003 From: danielk at AVALONPUB.COM (Daniel Kleinsinger) Date: Thu Jan 12 21:17:52 2006 Subject: Sophos SAVI problems Message-ID: <3EA9DA68.7020903@avalonpub.com> I've been trying to follow the instructions to install Sophos SAVI to take advantage of the performance boost, but have run into some problems. I'm running MailScanner 4.14-9 w/ SA 2.53 on RH 8.0 w/ perl 5.8.0. I installed everything following the RPM instructions on mailscanner.info. MailScanner has been working great, by the way. Before I go further, understand that I'm not too good at this whole Linux thing (I'm sure that's pretty obvious). The problem I'm having is that when I change Virus Scanners = sophos to sophossavi and restart MailScanner something funky happens and mail stops going through. The only part of the SAVI installation I had trouble with is the edit the Makefile.PL part. There's no /opt/local/lib directory on my computer. My solution was to replace both /opt/local/lib references with /usr/local/Sophos/lib instead of just the first one. Probably not the right thing to do... I then maked and tested and installed without error. Below are (what I think are) the relevant sections of my maillog showing the funkiness. Thanks for your help. Daniel Apr 25 17:52:03 nts-2 MailScanner[4739]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 25 17:52:05 nts-2 MailScanner[4739]: SophosSAVI 3.68 (engine 2.14) recognizing 80979 viruses Apr 25 17:52:05 nts-2 MailScanner[4739]: SophosSAVI using 15 IDE files Apr 25 17:52:05 nts-2 MailScanner[4739]: Using locktype = flock Apr 25 17:52:05 nts-2 MailScanner[4739]: New Batch: Scanning 2 messages, 13643 bytes Apr 25 17:52:05 nts-2 MailScanner[4739]: Sophos update detected, resetting SAVI library Apr 25 17:52:05 nts-2 MailScanner[4739]: Sophos SAVI library has been updated, killing this child Apr 25 17:52:05 nts-2 MailScanner[4739]: MailScanner child dying of old age Apr 25 17:52:13 nts-2 MailScanner[4741]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 25 17:52:15 nts-2 MailScanner[4741]: SophosSAVI 3.68 (engine 2.14) recognizing 80979 viruses Apr 25 17:52:15 nts-2 MailScanner[4741]: SophosSAVI using 15 IDE files Apr 25 17:52:15 nts-2 MailScanner[4741]: Using locktype = flock Apr 25 17:52:15 nts-2 MailScanner[4741]: New Batch: Scanning 2 messages, 13643 bytes Apr 25 17:52:15 nts-2 MailScanner[4741]: Sophos update detected, resetting SAVI library Apr 25 17:52:15 nts-2 MailScanner[4741]: Sophos SAVI library has been updated, killing this child Apr 25 17:52:15 nts-2 MailScanner[4741]: MailScanner child dying of old age Apr 25 17:52:23 nts-2 MailScanner[4744]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 25 17:52:25 nts-2 MailScanner[4744]: SophosSAVI 3.68 (engine 2.14) recognizing 80979 viruses Apr 25 17:52:25 nts-2 MailScanner[4744]: SophosSAVI using 15 IDE files Apr 25 17:52:25 nts-2 MailScanner[4744]: Using locktype = flock Apr 25 17:52:25 nts-2 MailScanner[4744]: New Batch: Scanning 2 messages, 13643 bytes Apr 25 17:52:25 nts-2 MailScanner[4744]: Sophos update detected, resetting SAVI library Apr 25 17:52:25 nts-2 MailScanner[4744]: Sophos SAVI library has been updated, killing this child Apr 25 17:52:25 nts-2 MailScanner[4744]: MailScanner child dying of old age Apr 25 17:52:33 nts-2 MailScanner[4750]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 25 17:52:35 nts-2 MailScanner[4750]: SophosSAVI 3.68 (engine 2.14) recognizing 80979 viruses Apr 25 17:52:35 nts-2 MailScanner[4750]: SophosSAVI using 15 IDE files Apr 25 17:52:35 nts-2 MailScanner[4750]: Using locktype = flock Apr 25 17:52:35 nts-2 MailScanner[4750]: New Batch: Scanning 2 messages, 13643 bytes Apr 25 17:52:35 nts-2 MailScanner[4750]: Sophos update detected, resetting SAVI library Apr 25 17:52:35 nts-2 MailScanner[4750]: Sophos SAVI library has been updated, killing this child Apr 25 17:52:35 nts-2 MailScanner[4750]: MailScanner child dying of old age Apr 25 17:52:43 nts-2 MailScanner[4751]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 25 17:52:45 nts-2 MailScanner[4751]: SophosSAVI 3.68 (engine 2.14) recognizing 80979 viruses Apr 25 17:52:45 nts-2 MailScanner[4751]: SophosSAVI using 15 IDE files Apr 25 17:52:45 nts-2 MailScanner[4751]: Using locktype = flock Apr 25 17:52:45 nts-2 MailScanner[4751]: New Batch: Scanning 2 messages, 13643 bytes Apr 25 17:52:45 nts-2 MailScanner[4751]: Sophos update detected, resetting SAVI library Apr 25 17:52:45 nts-2 MailScanner[4751]: Sophos SAVI library has been updated, killing this child Apr 25 17:52:45 nts-2 MailScanner[4751]: MailScanner child dying of old age From David.While at UCE.AC.UK Sat Apr 26 09:15:52 2003 From: David.While at UCE.AC.UK (David While) Date: Thu Jan 12 21:17:52 2006 Subject: Mailscanner restarting every 15 minutes Message-ID: mailstats doesn't restart mailscanner - do you mean mailscanner-mrtg?? ----------------------------------------------------------------- David While Technical Development Manager Faculty of Computing, Information & English University of Central England Tel: 0121 331 6211 Nick Phillips cc: Sent by: Subject: Re: Mailscanner restarting every 15 minutes MailScanner mailing list 26/04/2003 00:16 Please respond to MailScanner mailing list On Fri, Apr 25, 2003 at 11:57:20PM +0100, Julian Field wrote: > At 23:09 25/04/2003, you wrote: > >An interesting observation on this: > > > >14400 seconds = 0x3840 > >15mins = 900 = 0x384 > > > >Bit-shifted by 4??? > > 15 mins x 4 x 4 = 4 hours, correct. > But seeing how I do it all in Perl integers, I don't think there's anything > like that going on :-) > > Has anyone else had this problem? Not being restarted by that mailstats script is it? -- Nick Phillips -- nwp@lemon-computing.com You can create your own opportunities this week. Blackmail a senior executive. From hden at KCBBS.GEN.NZ Sat Apr 26 05:49:28 2003 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:17:52 2006 Subject: SpamAssassin - Version In-Reply-To: <3EA9DA68.7020903@avalonpub.com> References: <3EA9DA68.7020903@avalonpub.com> Message-ID: <20030426044928.GA15721@mew.kcbbs.gen.nz> Hello A while back, when the probs with spamassassin hogging CPU usage was a problem, I upgraded to SA 2.60 - but see that current versions are still in the 2.5x's. Is it still OK to stay with 2.60? or is it recommended to drop back [how?] to the 2.5x's Cheers! Hendrik From mailscanner at ecs.soton.ac.uk Sat Apr 26 11:21:50 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Sophos SAVI problems In-Reply-To: <3EA9DA68.7020903@avalonpub.com> Message-ID: <5.2.1.1.2.20030426103835.022ca388@imap.ecs.soton.ac.uk> At 02:01 26/04/2003, you wrote: >The problem I'm having is that when I change Virus Scanners = sophos to >sophossavi and restart MailScanner something funky happens and mail >stops going through. The only part of the SAVI installation I had >trouble with is the edit the Makefile.PL part. There's no >/opt/local/lib directory on my computer. My solution was to replace >both /opt/local/lib references with /usr/local/Sophos/lib instead of >just the first one. Probably not the right thing to do... I then maked >and tested and installed without error. It looks as if your build of the Perl module worked fine. It doesn't matter about setting both /opt/local/lib references as only 1 is ever used by MailScanner, the other is irrelevant for us. > Below are (what I think are) >the relevant sections of my maillog showing the funkiness. Thanks for >your help. It watches the modification dates of the Sophos ide directory and the Sophos lib directory. I have just added some more error-checking to the code that does all this, so it should log slightly better what is going on. Try applying this patch to /usr/lib/MailScanner/MailScanner/SweepViruses.pm: ---- PATCH STARTS ---- --- SweepViruses.pm.orig 2003-04-26 11:00:01.000000000 +0100 +++ SweepViruses.pm 2003-04-26 11:00:49.000000000 +0100 @@ -291,6 +291,9 @@ my $SAVIidedir = MailScanner::Config::Value('sophoside'); $SAVIidedir = '/usr/local/Sophos/ide' unless $SAVIidedir; + my $SAVIlibdir = MailScanner::Config::Value('sophoslib'); + $SAVIlibdir = '/usr/local/Sophos/lib' unless $SAVIlibdir; + $ENV{'SAV_IDE'} = $SAVIidedir; $SAVI = new SAVI(); MailScanner::Log::DieLog("SophosSAVI ERROR:: initializing savi: %s (%s)", @@ -342,10 +345,14 @@ # Store the last modified time of the SAVI lib directory, so we can check # for major upgrades my(@statresults); - @statresults = stat(MailScanner::Config::Value('sophoside')); - $SAVIidedirmtime = $statresults[9]; - @statresults = stat(MailScanner::Config::Value('sophoslib')); - $SAVIlibdirmtime = $statresults[9]; + @statresults = stat($SAVIidedir); + $SAVIidedirmtime = $statresults[9] or + MailScanner::Log::WarnLog("Failed to read mtime of IDE dir %s",$SAVIidedir); + @statresults = stat($SAVIlibdir); + $SAVIlibdirmtime = $statresults[9] or + MailScanner::Log::WarnLog("Failed to read mtime of lib dir %s",$SAVIlibdir); + MailScanner::Log::InfoLog("Watching modification date of %s and %s", + $SAVIidedir, $SAVIlibdir); } # Are there new Sophos IDE files? ---- PATCH ENDS ---- Let us know what it says. >Daniel > >Apr 25 17:52:03 nts-2 MailScanner[4739]: MailScanner E-Mail Virus >Scanner version 4.14-9 starting... >Apr 25 17:52:05 nts-2 MailScanner[4739]: SophosSAVI 3.68 (engine 2.14) >recognizing 80979 viruses >Apr 25 17:52:05 nts-2 MailScanner[4739]: SophosSAVI using 15 IDE files >Apr 25 17:52:05 nts-2 MailScanner[4739]: Using locktype = flock >Apr 25 17:52:05 nts-2 MailScanner[4739]: New Batch: Scanning 2 messages, >13643 bytes >Apr 25 17:52:05 nts-2 MailScanner[4739]: Sophos update detected, >resetting SAVI library >Apr 25 17:52:05 nts-2 MailScanner[4739]: Sophos SAVI library has been >updated, killing this child >Apr 25 17:52:05 nts-2 MailScanner[4739]: MailScanner child dying of old age >Apr 25 17:52:13 nts-2 MailScanner[4741]: MailScanner E-Mail Virus >Scanner version 4.14-9 starting... >Apr 25 17:52:15 nts-2 MailScanner[4741]: SophosSAVI 3.68 (engine 2.14) >recognizing 80979 viruses >Apr 25 17:52:15 nts-2 MailScanner[4741]: SophosSAVI using 15 IDE files >Apr 25 17:52:15 nts-2 MailScanner[4741]: Using locktype = flock >Apr 25 17:52:15 nts-2 MailScanner[4741]: New Batch: Scanning 2 messages, >13643 bytes >Apr 25 17:52:15 nts-2 MailScanner[4741]: Sophos update detected, >resetting SAVI library >Apr 25 17:52:15 nts-2 MailScanner[4741]: Sophos SAVI library has been >updated, killing this child >Apr 25 17:52:15 nts-2 MailScanner[4741]: MailScanner child dying of old age >Apr 25 17:52:23 nts-2 MailScanner[4744]: MailScanner E-Mail Virus >Scanner version 4.14-9 starting... >Apr 25 17:52:25 nts-2 MailScanner[4744]: SophosSAVI 3.68 (engine 2.14) >recognizing 80979 viruses >Apr 25 17:52:25 nts-2 MailScanner[4744]: SophosSAVI using 15 IDE files >Apr 25 17:52:25 nts-2 MailScanner[4744]: Using locktype = flock >Apr 25 17:52:25 nts-2 MailScanner[4744]: New Batch: Scanning 2 messages, >13643 bytes >Apr 25 17:52:25 nts-2 MailScanner[4744]: Sophos update detected, >resetting SAVI library >Apr 25 17:52:25 nts-2 MailScanner[4744]: Sophos SAVI library has been >updated, killing this child >Apr 25 17:52:25 nts-2 MailScanner[4744]: MailScanner child dying of old age >Apr 25 17:52:33 nts-2 MailScanner[4750]: MailScanner E-Mail Virus >Scanner version 4.14-9 starting... >Apr 25 17:52:35 nts-2 MailScanner[4750]: SophosSAVI 3.68 (engine 2.14) >recognizing 80979 viruses >Apr 25 17:52:35 nts-2 MailScanner[4750]: SophosSAVI using 15 IDE files >Apr 25 17:52:35 nts-2 MailScanner[4750]: Using locktype = flock >Apr 25 17:52:35 nts-2 MailScanner[4750]: New Batch: Scanning 2 messages, >13643 bytes >Apr 25 17:52:35 nts-2 MailScanner[4750]: Sophos update detected, >resetting SAVI library >Apr 25 17:52:35 nts-2 MailScanner[4750]: Sophos SAVI library has been >updated, killing this child >Apr 25 17:52:35 nts-2 MailScanner[4750]: MailScanner child dying of old age >Apr 25 17:52:43 nts-2 MailScanner[4751]: MailScanner E-Mail Virus >Scanner version 4.14-9 starting... >Apr 25 17:52:45 nts-2 MailScanner[4751]: SophosSAVI 3.68 (engine 2.14) >recognizing 80979 viruses >Apr 25 17:52:45 nts-2 MailScanner[4751]: SophosSAVI using 15 IDE files >Apr 25 17:52:45 nts-2 MailScanner[4751]: Using locktype = flock >Apr 25 17:52:45 nts-2 MailScanner[4751]: New Batch: Scanning 2 messages, >13643 bytes >Apr 25 17:52:45 nts-2 MailScanner[4751]: Sophos update detected, >resetting SAVI library >Apr 25 17:52:45 nts-2 MailScanner[4751]: Sophos SAVI library has been >updated, killing this child >Apr 25 17:52:45 nts-2 MailScanner[4751]: MailScanner child dying of old age -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mikew at CRUCIS.NET Sat Apr 26 02:12:09 2003 From: mikew at CRUCIS.NET (Mike W) Date: Thu Jan 12 21:17:52 2006 Subject: Spam WhiteList In-Reply-To: <5.2.0.9.2.20030425091837.04398e58@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030425091837.04398e58@imap.ecs.soton.ac.uk> Message-ID: <200304252012.12418.mikew@crucis.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Friday 25 April 2003 03:19 am, you wrote: > At 06:12 25/04/2003, you wrote: > >In "spam.whitelist.rules" file. > > > ># This is where you can build a Spam WhiteList > ># Addresses matching in here, with the value > ># "yes" will never be marked as spam. > > From: 65.18.15. yes > From: 65.13.11. yes > From: *@internic.net yes > > >To: postmaster@mydomain.net yes > >To: abuse@mydomain.net yes > >To: *@second-domain.net yes > > > >Am I doing this right? No messages going to my @second-domain.net > > as an example will ever be blacklisted? Or do I need the "*"? > > Always best to have a "default" rules as well: > FromOrTo: default no My whitelist uses "FromTo; " is the "FromOrTo:" above any different fpr version 4.12-2? Mike W - -- Registered Linux - 256979 NRA Life ARS: W0TMW -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE+qdzs5fq6h2uDDlQRAruFAJ9Rz++5FqGQtpyizTWv6DAzoOIGFwCg1g4Q QWZ3ylF8bDN4rHvaowv5rgM= =3D46 -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by F-Prot and MailScanner, and is believed to be clean. From mailscanner at ecs.soton.ac.uk Sat Apr 26 17:45:20 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Spam WhiteList In-Reply-To: <200304252012.12418.mikew@crucis.net> References: <5.2.0.9.2.20030425091837.04398e58@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030425091837.04398e58@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030426174417.023e1990@imap.ecs.soton.ac.uk> At 02:12 26/04/2003, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On Friday 25 April 2003 03:19 am, you wrote: > > At 06:12 25/04/2003, you wrote: > > >In "spam.whitelist.rules" file. > > > > > ># This is where you can build a Spam WhiteList > > ># Addresses matching in here, with the value > > ># "yes" will never be marked as spam. > > > > From: 65.18.15. yes > > From: 65.13.11. yes > > From: *@internic.net yes > > > > >To: postmaster@mydomain.net yes > > >To: abuse@mydomain.net yes > > >To: *@second-domain.net yes > > > > > >Am I doing this right? No messages going to my @second-domain.net > > > as an example will ever be blacklisted? Or do I need the "*"? > > > > Always best to have a "default" rules as well: > > FromOrTo: default no > >My whitelist uses "FromTo; " is the "FromOrTo:" above any different fpr >version 4.12-2? FromTo: and FromOrTo: work equally well. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sat Apr 26 18:10:02 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Final beta release 4.15-9 Message-ID: <5.2.1.1.2.20030426180341.02776148@imap.ecs.soton.ac.uk> I have just put up 4.15-9. This is intended to be the final beta release before the start of May, which should see the next stable release. Various Postfix issues sorted out (mostly fairly minor). RedHat init.d script much improved so that it now handles Postfix, sendmail and Exim systems. "Archive Mail" feature can now write directly to mbox-style mailboxes. New SQL Logging code (your installation won't be affected if you have altered CustomConfig.pm at all). Better error reporting in several areas to speed up misconfiguration diagnosis. Download as usual from www.mailscanner.info. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From danielk at AVALONPUB.COM Sun Apr 27 07:50:49 2003 From: danielk at AVALONPUB.COM (Daniel Kleinsinger) Date: Thu Jan 12 21:17:52 2006 Subject: Sophos SAVI problems In-Reply-To: <5.2.1.1.2.20030426103835.022ca388@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030426103835.022ca388@imap.ecs.soton.ac.uk> Message-ID: <3EAB7DC9.7030609@avalonpub.com> I applied the patch and the error message changed to: Apr 26 23:11:07 nts-2 MailScanner[13286]: Virus and Content Scanning: Starting Apr 26 23:11:07 nts-2 MailScanner[13286]: FATAL: Encountered code that does not meet configured acceptable stability Apr 26 23:11:07 nts-2 MailScanner[13286]: FATAL: *Please go and READ* http://www.sng.ecs.soton.ac.uk/mailscanner/install/codestatus.shtml as it will tell you what to do. So I then changed Minimum Code Status from supported to beta and, surprise surprise, it started working. I then reverted to the unpatched SweepViruses.pm, leaving MCS at beta, and the old error came back. So it would seem that the new code fixed some problem with identifying new IDEs. Thanks for fixing it so quickly. Daniel Julian Field wrote: > It watches the modification dates of the Sophos ide directory and the > Sophos lib directory. I have just added some more error-checking to the > code that does all this, so it should log slightly better what is > going on. > > Try applying this patch to > /usr/lib/MailScanner/MailScanner/SweepViruses.pm: > > ---- PATCH STARTS ---- > --- SweepViruses.pm.orig 2003-04-26 11:00:01.000000000 +0100 > +++ SweepViruses.pm 2003-04-26 11:00:49.000000000 +0100 > @@ -291,6 +291,9 @@ > > my $SAVIidedir = MailScanner::Config::Value('sophoside'); > $SAVIidedir = '/usr/local/Sophos/ide' unless $SAVIidedir; > + my $SAVIlibdir = MailScanner::Config::Value('sophoslib'); > + $SAVIlibdir = '/usr/local/Sophos/lib' unless $SAVIlibdir; > + > $ENV{'SAV_IDE'} = $SAVIidedir; > $SAVI = new SAVI(); > MailScanner::Log::DieLog("SophosSAVI ERROR:: initializing savi: %s > (%s)", > @@ -342,10 +345,14 @@ > # Store the last modified time of the SAVI lib directory, so we can > check > # for major upgrades > my(@statresults); > - @statresults = stat(MailScanner::Config::Value('sophoside')); > - $SAVIidedirmtime = $statresults[9]; > - @statresults = stat(MailScanner::Config::Value('sophoslib')); > - $SAVIlibdirmtime = $statresults[9]; > + @statresults = stat($SAVIidedir); > + $SAVIidedirmtime = $statresults[9] or > + MailScanner::Log::WarnLog("Failed to read mtime of IDE dir > %s",$SAVIidedir); > + @statresults = stat($SAVIlibdir); > + $SAVIlibdirmtime = $statresults[9] or > + MailScanner::Log::WarnLog("Failed to read mtime of lib dir > %s",$SAVIlibdir); > + MailScanner::Log::InfoLog("Watching modification date of %s and %s", > + $SAVIidedir, $SAVIlibdir); > } > > # Are there new Sophos IDE files? > ---- PATCH ENDS ---- > > Let us know what it says. > > >> Apr 25 17:52:03 nts-2 MailScanner[4739]: MailScanner E-Mail Virus >> Scanner version 4.14-9 starting... >> Apr 25 17:52:05 nts-2 MailScanner[4739]: SophosSAVI 3.68 (engine >> 2.14) recognizing 80979 viruses >> Apr 25 17:52:05 nts-2 MailScanner[4739]: SophosSAVI using 15 IDE files >> Apr 25 17:52:05 nts-2 MailScanner[4739]: Using locktype = flock >> Apr 25 17:52:05 nts-2 MailScanner[4739]: New Batch: Scanning 2 >> messages, 13643 bytes >> Apr 25 17:52:05 nts-2 MailScanner[4739]: Sophos update detected, >> resetting SAVI library >> Apr 25 17:52:05 nts-2 MailScanner[4739]: Sophos SAVI library has been >> updated, killing this child >> Apr 25 17:52:05 nts-2 MailScanner[4739]: MailScanner child dying of >> old age > From isp-list at TULSACONNECT.COM Sun Apr 27 14:30:27 2003 From: isp-list at TULSACONNECT.COM (ISP List) Date: Thu Jan 12 21:17:52 2006 Subject: Kaspersky Support In-Reply-To: <5.2.0.9.2.20030122113104.02718cd8@imap.ecs.soton.ac.uk> References: <5.1.1.6.1.20030122195854.00b1dc50@mail.tell.net.au> Message-ID: <5.2.1.1.2.20030427082350.04f55e60@securemail.tulsaconnect.com> >F-Prot has a good reputation too. Kaspersky is a bizarre piece of software >(see some of my previous postings about Kaspersky for more info). F-Secure >is a broken clone of F-Prot, the original is far better. > >Take a look at >http://www.sng.ecs.soton.ac.uk/mailscanner/install/codestatus.shtml to see >what level of support I nominally give them. Don't read too much into that, >but it might help you. Hiya. I've just added Kaspersky 4.0.3.0 to my MailScanner system (have McAfee, F-Prot already) on FreeBSD 4.6.2. I noted that the above page still lists Kaspersky as beta scanning/alpha disinfect status, but the actual code in SweepViruses.pm has: kaspersky => { Name => 'Kaspersky', Lock => 'KasperskyBusy.lock', CommonOptions => '', DisinfectOptions => '-- -I2', ScanOptions => '-I0', InitParser => \&InitKasperskyParser, ProcessOutput => \&ProcessKasperskyOutput, SupportScanning => $S_BETA, SupportDisinfect => $S_BETA, }, Which leads me to believe the codestatus.shtml page is out of date. I've read every thread I can find on Kaspersky, which I see comments about how bizarre it is, etc (including the comments by Nick in the Kaspersky parsing code itself). So far, it seems to be working fine for me. What does it take to get Kaspersky bumped up to supported status? Also, if I have 3 virus scanners, I assume the first one that detects the virus does the disinfection? ------------------------------------- Mike Bacher / mike@sparklogic.com Use OptiGold ISP? Check out OptiSkin! http://www.sparklogic.com/optiskin/ ------------------------------------- From mailscanner at ecs.soton.ac.uk Sun Apr 27 14:40:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Kaspersky Support In-Reply-To: <5.2.1.1.2.20030427082350.04f55e60@securemail.tulsaconnect. com> References: <5.2.0.9.2.20030122113104.02718cd8@imap.ecs.soton.ac.uk> <5.1.1.6.1.20030122195854.00b1dc50@mail.tell.net.au> Message-ID: <5.2.1.1.2.20030427143611.023d7b60@imap.ecs.soton.ac.uk> I will update the codestatus.shtml page when I publish the new version. The new version has everything "supported" except Panda and Trend. Both are those are not at "supported" level because hardly anyone uses them, so I get no feedback about them. BTW The new version of F-Secure (4.50?) is a *great* improvement on its predecessors. It includes both the F-Prot engine and the Kaspersky engine, so you get 2 for the price of 1. I haven't got a clue how much it costs but it looks like a strong competitor now. At 14:30 27/04/2003, you wrote: >>F-Prot has a good reputation too. Kaspersky is a bizarre piece of software >>(see some of my previous postings about Kaspersky for more info). F-Secure >>is a broken clone of F-Prot, the original is far better. >> >>Take a look at >>http://www.sng.ecs.soton.ac.uk/mailscanner/install/codestatus.shtml to see >>what level of support I nominally give them. Don't read too much into that, >>but it might help you. > >Hiya. I've just added Kaspersky 4.0.3.0 to my MailScanner system (have >McAfee, F-Prot already) on FreeBSD 4.6.2. I noted that the above page >still lists Kaspersky as beta scanning/alpha disinfect status, but the >actual code in SweepViruses.pm has: > > kaspersky => { > Name => 'Kaspersky', > Lock => 'KasperskyBusy.lock', > CommonOptions => '', > DisinfectOptions => '-- -I2', > ScanOptions => '-I0', > InitParser => \&InitKasperskyParser, > ProcessOutput => \&ProcessKasperskyOutput, > SupportScanning => $S_BETA, > SupportDisinfect => $S_BETA, > }, > >Which leads me to believe the codestatus.shtml page is out of date. I've >read every thread I can find on Kaspersky, which I see comments about how >bizarre it is, etc (including the comments by Nick in the Kaspersky parsing >code itself). So far, it seems to be working fine for me. What does it >take to get Kaspersky bumped up to supported status? Also, if I have 3 >virus scanners, I assume the first one that detects the virus does the >disinfection? > > >------------------------------------- >Mike Bacher / mike@sparklogic.com >Use OptiGold ISP? Check out OptiSkin! >http://www.sparklogic.com/optiskin/ >------------------------------------- -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From isp-list at TULSACONNECT.COM Sun Apr 27 15:18:13 2003 From: isp-list at TULSACONNECT.COM (ISP List) Date: Thu Jan 12 21:17:52 2006 Subject: Kaspersky Support In-Reply-To: <5.2.1.1.2.20030427143611.023d7b60@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030427082350.04f55e60@securemail.tulsaconnect. com> <5.2.0.9.2.20030122113104.02718cd8@imap.ecs.soton.ac.uk> <5.1.1.6.1.20030122195854.00b1dc50@mail.tell.net.au> Message-ID: <5.2.1.1.2.20030427091717.05080048@securemail.tulsaconnect.com> At 02:40 PM 4/27/2003 +0100, you wrote: >I will update the codestatus.shtml page when I publish the new version. Thanks. >BTW The new version of F-Secure (4.50?) is a *great* improvement on its >predecessors. It includes both the F-Prot engine and the Kaspersky engine, >so you get 2 for the price of 1. I haven't got a clue how much it costs but >it looks like a strong competitor now. Sounds cool. Doesn't look like they have a FreeBSD version, though :( ------------------------------------- Mike Bacher / mike@sparklogic.com Use OptiGold ISP? Check out OptiSkin! http://www.sparklogic.com/optiskin/ ------------------------------------- From hciss at HCIWS.COM Sun Apr 27 22:00:11 2003 From: hciss at HCIWS.COM (Matt) Date: Thu Jan 12 21:17:52 2006 Subject: Spam Tagging Message Body Message-ID: <005501c30cff$fe66a740$7801a8c0@matthew> I thought there was a way to have Mailscanner add a tag to the body of messages beleived to be Spam. I cannot seem to find any such setting in mailscanner.cf. Is this possible? Matt From mike at CAMAROSS.NET Sun Apr 27 22:25:24 2003 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:17:52 2006 Subject: Spam Tagging Message Body In-Reply-To: <005501c30cff$fe66a740$7801a8c0@matthew> Message-ID: <012901c30d03$84cd5ce0$af01a8c0@home.middlefinger.net> Do you mean MailScanner.conf? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Matt Sent: Sunday, April 27, 2003 4:00 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Spam Tagging Message Body I thought there was a way to have Mailscanner add a tag to the body of messages beleived to be Spam. I cannot seem to find any such setting in mailscanner.cf. Is this possible? Matt From danielk at AVALONPUB.COM Sun Apr 27 22:59:48 2003 From: danielk at AVALONPUB.COM (Daniel Kleinsinger) Date: Thu Jan 12 21:17:52 2006 Subject: MailScanner restarting w/ virus updates when using SAVI Message-ID: <3EAC52D4.9010309@avalonpub.com> I just started using SAVI and I've noticed that MailScanner is now restarting hourly instead of every 4 hours. It seems that MailScanner is restarting when it notices new virus definitions and since the Sophos update script runs every hour MailScanner is restarting that frequently. Is this normal? Something to do with SAVI being a perl module and not a standalone program? Sorry if this is a stupid question, I guess I'm just curious... Daniel From mailscanner at ecs.soton.ac.uk Sun Apr 27 23:12:13 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Spam Tagging Message Body In-Reply-To: <005501c30cff$fe66a740$7801a8c0@matthew> Message-ID: <5.2.1.1.2.20030427231112.0225f4d0@imap.ecs.soton.ac.uk> At 22:00 27/04/2003, you wrote: >I thought there was a way to have Mailscanner add a tag to the body of >messages beleived to be Spam. I cannot seem to find any such setting in >mailscanner.cf. Is this possible? I'm afraid not. Not at the moment, anyway. What sort of tag did you have in mind? -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sun Apr 27 23:19:22 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: MailScanner restarting w/ virus updates when using SAVI In-Reply-To: <3EAC52D4.9010309@avalonpub.com> Message-ID: <5.2.1.1.2.20030427231226.023083e0@imap.ecs.soton.ac.uk> At 22:59 27/04/2003, you wrote: >I just started using SAVI and I've noticed that MailScanner is now >restarting hourly instead of every 4 hours. It seems that MailScanner >is restarting when it notices new virus definitions and since the Sophos >update script runs every hour MailScanner is restarting that >frequently. Is this normal? Something to do with SAVI being a perl >module and not a standalone program? Sorry if this is a stupid >question, I guess I'm just curious... When MailScanner starts communicating with the SAVI library, it has to bind to the SAVI shared library ".so" file. In order for it to take advantage of every update, and not just carry on using old code, it has to rebind to the library whenever updates are installed. The only way for this to happen is for the child processes to commit suicide when they see the installation updated. Then they are re-spawned by the parent process, and it all carries on processing mail. It hits the logs a bit every time this happens, but it shouldn't cause any great problem. Scanning will be slowed down a bit for 30 seconds or so while the children are re-spawned, but hopefully that is the only side-effect. The increase in speed provided by using the SAVI library should easily outweigh the overhead of restarting when Sophos updates are applied. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Sun Apr 27 23:28:34 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Mugshots Message-ID: <5.2.1.1.2.20030427232149.022630b0@imap.ecs.soton.ac.uk> In case you are deranged enough to be curious, I've just added some more mugshots to http://www.sng.ecs.soton.ac.uk/mailscanner/press.html Credit to my next-door neighbour Simon Phipps (of Sun, you might have heard of him) for taking the photos for me. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From hciss at HCIWS.COM Mon Apr 28 05:55:53 2003 From: hciss at HCIWS.COM (Matt) Date: Thu Jan 12 21:17:52 2006 Subject: Spam Tagging Message Body Message-ID: <000901c30d42$729759b0$6400a8c0@matthewmpqowmc> >I'm afraid not. Not at the moment, anyway. What sort of tag did you have in >mind? X-SpamCheck-Listed bl.spamcop.net Appended to the very end so as not to be noticeable. Outlook Express can only filter on from, too, subject and body. It cannot look at the extra header. Tagging subject annoys some users. I keep thinking a tag on the bottom of the text portion of an email message would not be all that noticeable but could be used as a filter. Similiar to the way some people have there email signed that it was virus scanned. Just a thought. Matt >>I thought there was a way to have Mailscanner add a tag to the body of >>messages beleived to be Spam. I cannot seem to find any such setting in >>mailscanner.cf. Is this possible? From mike at ZANKER.ORG Mon Apr 28 06:03:23 2003 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:17:52 2006 Subject: Spam Tagging Message Body In-Reply-To: <000901c30d42$729759b0$6400a8c0@matthewmpqowmc> References: <000901c30d42$729759b0$6400a8c0@matthewmpqowmc> Message-ID: <161024203.1051509803@jemima.zanker.org> On 27 April 2003 23:55 -0500 Matt wrote: > X-SpamCheck-Listed bl.spamcop.net > > Appended to the very end so as not to be noticeable. No thanks. How would this affect PGP-signed e-mails, out of interest? Mike. From carl.boberg at NRM.SE Mon Apr 28 10:33:43 2003 From: carl.boberg at NRM.SE (Carl Boberg) Date: Thu Jan 12 21:17:52 2006 Subject: Bayes header tag? In-Reply-To: <161024203.1051509803@jemima.zanker.org> Message-ID: Hi, Is there any way to get a X-MailScanner-SpamCheck type header tag for the bayes db.? It would be nice to be able to see if the spam marked email was marked due to the bayes db. or not. / Cheers --------------------------------- Carl Boberg System & Network Administrator Dept. of Information Technology Swedish Museum of Natural History Frescativ. 40 104 05 Stockholm carl.boberg@nrm.se Phone: 08-519 551 16 Mobile: 0701-82 40 55 --------------------------------- From mailscanner at ecs.soton.ac.uk Mon Apr 28 11:25:03 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Bayes header tag? In-Reply-To: References: <161024203.1051509803@jemima.zanker.org> Message-ID: <5.2.1.1.2.20030428112349.04079ca0@imap.ecs.soton.ac.uk> At 10:33 28/04/2003, you wrote: >Hi, >Is there any way to get a X-MailScanner-SpamCheck type header tag for the >bayes db.? You already get it in the list of SpamAssassin rules that hit. They start with "BAYES_". If you want that report on all messages, just set the Always Include SpamAssassin Report = yes option. >It would be nice to be able to see if the spam marked email was marked due >to the bayes db. or not. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From P.G.M.Peters at civ.utwente.nl Mon Apr 28 12:25:56 2003 From: P.G.M.Peters at civ.utwente.nl (Peter Peters) Date: Thu Jan 12 21:17:52 2006 Subject: something else but SpamAssassin Message-ID: Julian, I didn't know whether to write to you directly instead of through the list but I decided the question (and any anwswer) would also be of benifit for the rest of the readers. I am in contact with an organization (active in computer security) who are writing a replacement for SpamAssassin. The replacement should be completely written in C to get a performance over perl-based SA. They know I use SpamAssassin and they would like to cooperate with me. I have told them that I would be willing to test when and if it could be used with MS instead of (or next to) SA. Are there special precautions that should be considered when writing a SA replacement vor MS? -- Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ From raymond at PROLOCATION.NET Mon Apr 28 12:34:52 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: something else but SpamAssassin In-Reply-To: Message-ID: Hi! > They know I use SpamAssassin and they would like to cooperate with me. I > have told them that I would be willing to test when and if it could be > used with MS instead of (or next to) SA. Are there special precautions > that should be considered when writing a SA replacement vor MS? If Julian also likes the idea, supporting it withing MS, i would be more then willing to test also beta's. Perhaps they can use the same interfacing commands SA uses to have a smooth switch over from SA. Some kind of Exim / Sendmail story... bye, Raymond. k From dene at DATATECHIE.COM Mon Apr 28 13:46:14 2003 From: dene at DATATECHIE.COM (Dene Ulmschneider) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries Message-ID: <5.1.0.14.2.20030428084551.0290deb8@192.168.1.112> Hey all- Ever since I installed MailScanner I have been getting many entries every in my LogWatch that are similar to this: h3R8Hrq03418: forward /home/xxxxx/.forward.neo: Group writable directory h3R8Hrq03418: forward /home/xxxxx/.forward: Group writable directory (xxxxx - my username on the system) Each entry has a different first part to it which is the message ID. I have a few questions, if anyone can answer them - please do so I can satisfy my curiosity. Is this normal? What do they mean? Why are all of the entries referencing my username? Why aren't there entries for any other usernames on the system? Does this mean that all of the other users are not getting the benefits of MS, SA, Bayes, or Razor? Initially - I has my preferences set to forward all HIGH SCORING SPAM to me as well as bounce it. This was letting me verify the accuracy of high scoring spam, and I was certain that this was the cause of the entries in the system LogWatch. Once I was confident that MS & SA were accurate - I changed the rules to just bounce the high scoring spam - but I am still seeing the entries in the LogWatch. Any info would be greatly appreciated. Thank You Dene Ulmschneider Data Techie Inc. ------------------------------------------------------------------------- office: 718.738.8859 email: dene@datatechie.com website: www.datatechie.com ------------------------------------------------------------------------- "Life is too short...-...you should have dessert first" From raymond at PROLOCATION.NET Mon Apr 28 13:56:59 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries In-Reply-To: <5.1.0.14.2.20030428084551.0290deb8@192.168.1.112> Message-ID: Hi! > h3R8Hrq03418: forward /home/xxxxx/.forward.neo: Group writable directory > h3R8Hrq03418: forward /home/xxxxx/.forward: Group writable directory > > (xxxxx - my username on the system) These are warnings from your mailer, not from MailScanner. You have to fix the (unix) permissions of the .forwards in those dirs. They should not be group writable. Bye, Raymond. From mailscanner at ecs.soton.ac.uk Mon Apr 28 14:40:03 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: something else but SpamAssassin In-Reply-To: Message-ID: <5.2.0.9.2.20030428143753.02d1d870@imap.ecs.soton.ac.uk> At 12:25 28/04/2003, you wrote: >Julian, > >I didn't know whether to write to you directly instead of through the >list but I decided the question (and any anwswer) would also be of >benifit for the rest of the readers. > >I am in contact with an organization (active in computer security) who >are writing a replacement for SpamAssassin. The replacement should be >completely written in C to get a performance over perl-based SA. > >They know I use SpamAssassin and they would like to cooperate with me. I >have told them that I would be willing to test when and if it could be >used with MS instead of (or next to) SA. Are there special precautions >that should be considered when writing a SA replacement vor MS? I would like it to be callable as a shared library, so that they can write a Perl front-end to it. A fine example of this is the Perl-SAVI module, which gives a Perl front-end to Sophos's SAVI shared library. If possible, I would like to be able to avoid calling another executable and piping a message into it. But if they have to go down that route, there must at the very least be a means of giving it multiple messages. Starting up a program for every single message will be very slow. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From dene at DATATECHIE.COM Mon Apr 28 14:47:40 2003 From: dene at DATATECHIE.COM (Dene Ulmschneider) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries In-Reply-To: References: <5.1.0.14.2.20030428084551.0290deb8@192.168.1.112> Message-ID: <5.1.0.14.2.20030428094614.00b97690@192.168.1.112> >These are warnings from your mailer, not from MailScanner. You have to fix >the (unix) permissions of the .forwards in those dirs. > >They should not be group writable. I did not have any .forward files in my home directory. Should I create them and if so - what are the proper file permissions? Thank You Dene Ulmschneider Data Techie Inc. ------------------------------------------------------------------------- office: 718.738.8859 email: dene@datatechie.com website: www.datatechie.com ------------------------------------------------------------------------- "Life is too short...-...you should have dessert first" From carl.boberg at NRM.SE Mon Apr 28 14:53:54 2003 From: carl.boberg at NRM.SE (Carl Boberg) Date: Thu Jan 12 21:17:52 2006 Subject: RO header tag anyone? ignore this In-Reply-To: Message-ID: Sorry My bad Im being stupid! / Carl >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On >Behalf Of Carl Boberg >Sent: Monday, April 28, 2003 15:46 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: RO header tag anyone? > > >Hi, >Im starting to get an increased amount of mail that ought to be >marked as spam but is not. >They seem to have a last header tag of: > >Status: RO > >Thats after the X-MailScanner tags... > >Am I being stupid here or what? > >MVH >--------------------------------- >Carl Boberg >System & Network Administrator >Dept. of Information Technology >Swedish Museum of Natural History >Frescativ. 40 >104 05 Stockholm >carl.boberg@nrm.se >Phone: 08-519 551 16 >Mobile: 0701-82 40 55 >--------------------------------- > From mk at quadstone.com Mon Apr 28 14:54:12 2003 From: mk at quadstone.com (Michael Keightley) Date: Thu Jan 12 21:17:52 2006 Subject: MailScanner and SA 2.60-cvs Message-ID: <20030428135412.GA21469@quadstone.com> I'm having a lot of problems with SA 2.53. It is giving some Spam low or even negative hit scores, so about 20% of spam is getting through MailScanner (4.14-9). One solution is to use SA 2.60-cvs, as this works correctly. Has anyone tried this with MailScanner? Are there any problems? Michael -- Michael Keightley Tel: +44 131 220 4491 Systems Manager, Quadstone Limited, Fax: +44 131 220 4492 16 Chester Street, Edinburgh EH3 7RA, Scotland http://www.quadstone.com From carl.boberg at NRM.SE Mon Apr 28 14:46:20 2003 From: carl.boberg at NRM.SE (Carl Boberg) Date: Thu Jan 12 21:17:52 2006 Subject: RO header tag anyone? Message-ID: Hi, Im starting to get an increased amount of mail that ought to be marked as spam but is not. They seem to have a last header tag of: Status: RO Thats after the X-MailScanner tags... Am I being stupid here or what? MVH --------------------------------- Carl Boberg System & Network Administrator Dept. of Information Technology Swedish Museum of Natural History Frescativ. 40 104 05 Stockholm carl.boberg@nrm.se Phone: 08-519 551 16 Mobile: 0701-82 40 55 --------------------------------- From raymond at PROLOCATION.NET Mon Apr 28 15:05:37 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries In-Reply-To: <5.1.0.14.2.20030428094614.00b97690@192.168.1.112> Message-ID: Hi! > >They should not be group writable. > I did not have any .forward files in my home directory. Should I create > them and if so - what are the proper file permissions? Look in the homedirectory's of those users. Not in your own homedirectory. Bye, Raymond. From dene at DATATECHIE.COM Mon Apr 28 15:06:55 2003 From: dene at DATATECHIE.COM (Dene Ulmschneider) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries In-Reply-To: References: <5.1.0.14.2.20030428094614.00b97690@192.168.1.112> Message-ID: <5.1.0.14.2.20030428100610.030800f8@192.168.1.112> > > I did not have any .forward files in my home directory. Should I create > > them and if so - what are the proper file permissions? > >Look in the homedirectory's of those users. Not in your own homedirectory. > I searched my entire file system and did not find any .forward files. Dene Ulmschneider From t.d.lee at DURHAM.AC.UK Mon Apr 28 15:22:37 2003 From: t.d.lee at DURHAM.AC.UK (David Lee) Date: Thu Jan 12 21:17:52 2006 Subject: SpamAssassin/MS: coordinating several installations Message-ID: A request for hints and tips... At our site (university) we run SpamAssassin, under MailScanner, across several machines (resilience, load-balancing etc.) on the campus boundary. The default SA ruleset has proved reasonably effective, but we would like to start tailoring this. This means letting a small number of our department (university I.T. Service) staff be able to specify SA rules, and having these rules applied to, and maintained on, the set of machines, in a consistent way. The salient points here are: 1. The staff maintaining the SA ruleset won't be those who install and maintain the systems and software (they'll be "User Services" rather than "Systems Group"). 2. Maintenance of a consistent SA ruleset across several machines (change one, change all). 3. Sanity checking of data-entry for ruleset: suppose badly formatted data (SA rule spec.) is attempted. My initial thoughts are to expand our local "Makefile" mechanism that already handles other email-related table-maintenance across these machines. Any "best practice"? Or "custom and practice"? -- : David Lee I.T. Service : : Systems Programmer Computer Centre : : University of Durham : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham : : Phone: +44 191 334 2752 U.K. : From mbowman at UDCOM.COM Mon Apr 28 15:17:16 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries Message-ID: Dene, If you used the ls command did you remember to use the -a flag to show all file attributes? . files will not show up with the -a flag. Matthew K Bowman Dene Ulmschneider Sent by: MailScanner mailing list 04/28/2003 10:06 AM Please respond to MailScanner mailing list To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: Re: LogWatch entries > > I did not have any .forward files in my home directory. Should I create > > them and if so - what are the proper file permissions? > >Look in the homedirectory's of those users. Not in your own homedirectory. > I searched my entire file system and did not find any .forward files. Dene Ulmschneider From dene at DATATECHIE.COM Mon Apr 28 15:33:03 2003 From: dene at DATATECHIE.COM (Dene Ulmschneider) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries In-Reply-To: Message-ID: <5.1.0.14.2.20030428103204.02b0e188@192.168.1.112> >If you used the ls command did you remember to use the -a flag to show all >file attributes? . files will not show up with the -a flag. Yes is did. There were no files found. There are not many users on the system (maybe 20 or so). Thank You Dene Ulmschneider From mbowman at UDCOM.COM Mon Apr 28 15:38:56 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries Message-ID: Dene, Under the /home directory are any of your users directories group writeable. If so you need to take off the group writeable permission for example chmod g-w username. The logwatch is complaining about the permissions on the directories not the fact that the .forward files are not there. Matthew. Dene Ulmschneider Sent by: MailScanner mailing list 04/28/2003 10:33 AM Please respond to MailScanner mailing list To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: Re: LogWatch entries >If you used the ls command did you remember to use the -a flag to show all >file attributes? . files will not show up with the -a flag. Yes is did. There were no files found. There are not many users on the system (maybe 20 or so). Thank You Dene Ulmschneider From dene at DATATECHIE.COM Mon Apr 28 15:45:45 2003 From: dene at DATATECHIE.COM (Dene Ulmschneider) Date: Thu Jan 12 21:17:52 2006 Subject: LogWatch entries In-Reply-To: Message-ID: <5.1.0.14.2.20030428104357.0303f770@192.168.1.112> >Dene, > >Under the /home directory are any of your users directories group >writeable. If so you need to take off the group writeable permission for >example >chmod g-w username. The logwatch is complaining about the permissions on >the directories not the fact that the .forward files are not there. > >Matthew. Yes - mine was (which is the one that was referenced in the logwatch.) I thought it was complaining about the .forward files. It never crossed my mind to check the directory itself. Thanks for the help and I would like to apologize to everyone on this list for this whole thread since it was not even a MailScanner issue. Thanks again. Dene From AndreaC at GOTECH.IT Mon Apr 28 15:42:35 2003 From: AndreaC at GOTECH.IT (Andrea Cogliati) Date: Thu Jan 12 21:17:52 2006 Subject: Getting rid of Postmaster Notify Message-ID: <463F0AFA3E2CEA4E807EC569C019E739140B70@atlantis.gtub.corp> Guys, Sorry to bother you with something that could really be completely off topic (sendmail configuration, probably) but I cannot figure out the solution myself. I recently deployed MailScanner 4.14 on a Cobalt RaQ3 acting as a mail gateway for an Exchange 2K server. Everything went really fine, even if I'm kinda Linux newbie (thanks Julian and all you guys!!!!) and now my installation has been working smoothly for a couple of weeks. The only annoying issue is that the root mailbox on the gateway is filling up with Postmaster Notify messages: usually they are User unknown errors due to returning Invalid recipient messages to non existing spammers. As far as I understand from Sendmail documentation, I should get these messages only with PostmasterCopy option set (am I missing something here?) and I checked my sendmail.cf file and I don't have this option set. The questions are: Who is sending me those Postmaster Notify messages? How can I get rid of them? Thank you in advance for any help. Ciao, Andrea From raymond at PROLOCATION.NET Mon Apr 28 16:01:48 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: Getting rid of Postmaster Notify In-Reply-To: <463F0AFA3E2CEA4E807EC569C019E739140B70@atlantis.gtub.corp> Message-ID: Hi! > annoying issue is that the root mailbox on the gateway is filling up > with Postmaster Notify messages: usually they are User unknown errors > due to returning Invalid recipient messages to non existing spammers. As > far as I understand from Sendmail documentation, I should get these > messages only with PostmasterCopy option set (am I missing something > here?) and I checked my sendmail.cf file and I don't have this option > set. > > The questions are: > > Who is sending me those Postmaster Notify messages? > How can I get rid of them? This is your mailer doing this, not MailScanner. Default behaviour. You _could_ link it to /dev/null but please be aware that its also the mailbox used for example when you get abuse mail normally. You could setup a rule to shift those out, or for example edit the alias file on your system and let those come in a seperate 'dev/null' box. Then you dont loose regular postmaster mail. Bye, Raymond. From mbowman at UDCOM.COM Mon Apr 28 15:55:33 2003 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:17:52 2006 Subject: Getting rid of Postmaster Notify Message-ID: Hi 1. sendmail is sending them to you 2. I actually have the entry postmaster:/dev/null line in /etc/mail/aliases. As my mailscanner implementation e-mails an alternate alias. That might be over zealous for some but for me being a Sys Admin for an ISP i'd rather not get copies of thousands of user unknown errors - since they are already in maillog anyway. Matthew Andrea Cogliati Sent by: MailScanner mailing list 04/28/2003 10:42 AM Please respond to MailScanner mailing list To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: Getting rid of Postmaster Notify Guys, Sorry to bother you with something that could really be completely off topic (sendmail configuration, probably) but I cannot figure out the solution myself. I recently deployed MailScanner 4.14 on a Cobalt RaQ3 acting as a mail gateway for an Exchange 2K server. Everything went really fine, even if I'm kinda Linux newbie (thanks Julian and all you guys!!!!) and now my installation has been working smoothly for a couple of weeks. The only annoying issue is that the root mailbox on the gateway is filling up with Postmaster Notify messages: usually they are User unknown errors due to returning Invalid recipient messages to non existing spammers. As far as I understand from Sendmail documentation, I should get these messages only with PostmasterCopy option set (am I missing something here?) and I checked my sendmail.cf file and I don't have this option set. The questions are: Who is sending me those Postmaster Notify messages? How can I get rid of them? Thank you in advance for any help. Ciao, Andrea From nerijus at users.sourceforge.net Mon Apr 28 17:31:00 2003 From: nerijus at users.sourceforge.net (Nerijus Baliunas) Date: Thu Jan 12 21:17:52 2006 Subject: F-Secure 4.50 not supported... In-Reply-To: <006f01c2f886$495839a0$8801020a@brianmay> References: <006f01c2f886$495839a0$8801020a@brianmay> Message-ID: <1051547460.18172.58.camel@nerijus> An, 2003-04-01 22:38, Brian May wrote: > If you are using F-Secure with MailScanner, version 4.5 will not work as the > output has changed, and the location to fsav has changed as well.. > > Also, the command line for the scan is similar, MailScanner doesn't seem to > pass the full path, just '.' and fsav seems to scan the computer, and not > the working directory... Kavdaemon client has the same problem, i.e. it wants full path and not just '.'. MailScanner 4.14 seems to fix such problem for F-Secure. How is it done? The same should be done for kavdaemonclient. Regards, Nerijus From mailscanner at ecs.soton.ac.uk Mon Apr 28 17:36:20 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: F-Secure 4.50 not supported... In-Reply-To: <1051547460.18172.58.camel@nerijus> References: <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> Message-ID: <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> At 17:31 28/04/2003, you wrote: >An, 2003-04-01 22:38, Brian May wrote: > > If you are using F-Secure with MailScanner, version 4.5 will not work > as the > > output has changed, and the location to fsav has changed as well.. > > > > Also, the command line for the scan is similar, MailScanner doesn't seem to > > pass the full path, just '.' and fsav seems to scan the computer, and not > > the working directory... > >Kavdaemon client has the same problem, i.e. it wants full path and >not just '.'. MailScanner 4.14 seems to fix such problem for F-Secure. >How is it done? The same should be done for kavdaemonclient. Any chance you can send me an up-to-date copy of the kavdaemon stuff? I've got a copy of Kaspersky, but I'm not convinced it's up to date. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From nerijus at USERS.SOURCEFORGE.NET Mon Apr 28 18:06:23 2003 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:17:52 2006 Subject: F-Secure 4.50 not supported... In-Reply-To: <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> References: <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> Message-ID: <1051549583.18172.67.camel@nerijus> Pr, 2003-04-28 19:36, Julian Field wrote: > >Kavdaemon client has the same problem, i.e. it wants full path and > >not just '.'. MailScanner 4.14 seems to fix such problem for F-Secure. > >How is it done? The same should be done for kavdaemonclient. > > Any chance you can send me an up-to-date copy of the kavdaemon stuff? > I've got a copy of Kaspersky, but I'm not convinced it's up to date. ftp://ftp.kaspersky.com/products/release/4.0/English/BusinessOptimal/Workstations/KAVLinuxWorkstation/kavwselinux.tgz Nerijus From brian at UNEARTHED.ORG Mon Apr 28 18:14:35 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:52 2006 Subject: Kaspersky Support Message-ID: <007001c30da9$aa81e720$bc01020a@brianmay> F-Secure 4.50 has a small problem of taking 100% of the CPU time every few days... last Saturday, Sunday and Monday of the week prior then 10 days prior to that.. it's great when it works... I;ve emailed their support staff, but I haven't heard anything back.. Brian ----- Original Message ----- From: "ISP List" To: Sent: Sunday, April 27, 2003 7:18 AM Subject: Re: Kaspersky Support At 02:40 PM 4/27/2003 +0100, you wrote: >I will update the codestatus.shtml page when I publish the new version. Thanks. >BTW The new version of F-Secure (4.50?) is a *great* improvement on its >predecessors. It includes both the F-Prot engine and the Kaspersky engine, >so you get 2 for the price of 1. I haven't got a clue how much it costs but >it looks like a strong competitor now. Sounds cool. Doesn't look like they have a FreeBSD version, though :( ------------------------------------- Mike Bacher / mike@sparklogic.com Use OptiGold ISP? Check out OptiSkin! http://www.sparklogic.com/optiskin/ ------------------------------------- From mailscanner at ecs.soton.ac.uk Mon Apr 28 18:44:13 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <1051549583.18172.67.camel@nerijus> References: <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> At 18:06 28/04/2003, you wrote: >Pr, 2003-04-28 19:36, Julian Field wrote: > > > >Kavdaemon client has the same problem, i.e. it wants full path and > > >not just '.'. MailScanner 4.14 seems to fix such problem for F-Secure. > > >How is it done? The same should be done for kavdaemonclient. > > > > Any chance you can send me an up-to-date copy of the kavdaemon stuff? > > I've got a copy of Kaspersky, but I'm not convinced it's up to date. > >ftp://ftp.kaspersky.com/products/release/4.0/English/BusinessOptimal/Workstations/KAVLinuxWorkstation/kavwselinux.tgz Thanks for the pointer. I have just downloaded it, installed it, and built the Sample1/AvpDaemonClient. cd /usr/lib/MailScanner /usr/local/bin/AvpDaemonClient . seemed to work just fine. It scanned all the files in the current directory and sub-directories of it. What do you see when you try the same commands? -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From gerry at dorfam.ca Mon Apr 28 19:11:29 2003 From: gerry at dorfam.ca (Gerry Doris) Date: Thu Jan 12 21:17:52 2006 Subject: Infinite Monkeys Timing Out Message-ID: <46246.129.80.22.133.1051553489.squirrel@tiger.dorfam.ca> I've been running SpamAssassin outside of MailScanner trying to find out why I've been getting sendmail errors (Draining Input etc). I finally gave up and started calling SpamAssassin directly from MailScanner. Voila! Now my logs are filling up with messages about the Infinite Monkeys RBL timing out regularly and MailScanner killing the associated SpamAssassin processes. It looks like this RBL has been the cause of my problems. Is anyone else having problems with Infinite Monkeys??? Gerry From dot at DOTAT.AT Mon Apr 28 19:07:44 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:52 2006 Subject: Archive Mail, Exim and Locking Bug? (was RE: [ MAILSCANNER] Locki ng failing?) In-Reply-To: Message-ID: "Desai, Jason" wrote: > >Some minor changes to your patch - I think you need to change the last added >"return" to "exit" in the second hunk or your patch. When messages got >quarantined as a whole messages instead of queue files, extra mailscanner >processes started hanging around and not exiting. I changed "return" to >"exit" and it seemed to fix the problem. Aargh yes, thanks. Friday code :-) >Also, should you change the first added "return" to "return 1" in the second >hunk to match the "return 1" at the end of the function? That matters less since the return value isn't actually checked (cf. SMDiskStore.pm). Tony. -- f.a.n.finch http://dotat.at/ BERWICK ON TWEED TO WHITBY: SOUTH 4, SOON SOUTHWEST 5 OR 6. EASING SOUTHWEST 4 AGAIN LATER. MAINLY FAIR. GOOD. MODERATE. From raymond at PROLOCATION.NET Mon Apr 28 19:37:16 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: Infinite Monkeys Timing Out In-Reply-To: <46246.129.80.22.133.1051553489.squirrel@tiger.dorfam.ca> Message-ID: Hi! > Voila! Now my logs are filling up with messages about the Infinite > Monkeys RBL timing out regularly and MailScanner killing the associated > SpamAssassin processes. It looks like this RBL has been the cause of my > problems. > > Is anyone else having problems with Infinite Monkeys??? Can be network problems towards their nameservers from within your network. I dont get errors and are also using them. If it slows down your delivery just take out the RBL temporary. MS will also take it out if it errors a lot, but will test again and again, meaning slow down. The only ones that timed out today on my box were: Apr 28 11:47:18 vmx01 MailScanner[17186]: RBL Check ORDB-RBL timed out and was killed, consecutive failure 1 of 7 Apr 28 14:47:14 vmx01 MailScanner[31873]: RBL Check ORDB-RBL timed out and was killed, consecutive failure 1 of 7 Thats all. Bye, Raymond. From steve.freegard at LBSLTD.CO.UK Mon Apr 28 19:55:58 2003 From: steve.freegard at LBSLTD.CO.UK (Steve Freegard) Date: Thu Jan 12 21:17:52 2006 Subject: SAVI-Perl problems Message-ID: <67D9E7698329D411936E00508B6590B902773891@neelix.lbsltd.co.uk> Hi All, I thought I'd give the sophossavi interface a try - after doing so, I was tailing the maillog and noticed that MailScanner was spawning a new child process every 10-20 seconds or so, and that I had several defunct processes showing up when doing a 'ps axww'. I put MailScanner into debug mode and ran it by hand and realised that it was segfaulting. Here is the last few lines of an strace: [root@hoshi root]# strace /usr/sbin/MailScanner /etc/MailScanner/MailScanner.con f <> mprotect(0x40618000, 978944, PROT_READ|PROT_EXEC) = 0 open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 5 fstat64(5, {st_mode=S_IFREG|0644, st_size=21040, ...}) = 0 mmap2(NULL, 21040, PROT_READ, MAP_SHARED, 5, 0) = 0x40428000 close(5) = 0 futex(0x42130d84, FUTEX_WAKE, 2147483647, NULL) = 0 brk(0) = 0x92fa000 brk(0x92fb000) = 0x92fb000 open("/etc/sav.conf", O_RDONLY) = 5 fstat64(5, {st_mode=S_IFREG|0644, st_size=49, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40 145000 read(5, "SAV virus data directory = /usr/"..., 4096) = 49 read(5, "", 4096) = 0 close(5) = 0 munmap(0x40145000, 4096) = 0 time(NULL) = 1051555427 open("/tmp/76630000.$$$", O_RDWR|O_CREAT|O_EXCL, 0600) = 5 close(5) = 0 open("/tmp/76630000.$$$", O_RDWR) = 5 write(5, "\0", 1) = 1 close(5) = 0 rmdir("/tmp/76630000.$$$") = -1 ENOTDIR (Not a directory) unlink("/tmp/76630000.$$$") = 0 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ <> I confirmed that it is SAVI-Perl causing it by changing back to regular sophos scanning which then stops the segfault. I'm running this on a Compaq Proliant DL360 1x933Mhz 512Mb RAM running RedHat 9, MailScanner 4.14-9, Sophos 3.67 and ClamAV 0.54 Anyone else had a similar problem or know how to fix this?? Kind regards, Steve -- Steve Freegard Systems Manager Littlehampton Book Services Ltd. ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.lbsltd.co.uk ********************************************************************** From raymond at PROLOCATION.NET Mon Apr 28 20:23:49 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: Spamassassin config Message-ID: Hi! In the spam.assassin.prefs.conf i saw some confusing stuff: # # JKF 26/03/2003 # If your root filesystem is filling up because SpamAssassin is putting # large databases in /.spamassassin or /root/.spamassassin, you can move # them using the following lines to point to their new locations # auto_whitelist_path /var/spool/spamassassin/auto-whitelist auto_whitelist_file_mode 0644 bayes_path /var/spool/spamassassin/bayes bayes_file_mode 0644 The last part is a part of the filenames that will be generated. So the payed path isnt actually the path, its more, its also the prefix of the files... =) Perhaps add a line to explain that. As i read it in the config i created two dirs, bayed and auto-whitelist :) -rw------- 1 root root 318004 Apr 28 21:17 bayes_journal -rw------- 1 root root 2663 Apr 28 21:17 bayes_msgcount -rw------- 1 root root 417792 Apr 28 21:09 bayes_seen -rw------- 1 root root 7909376 Apr 28 21:09 bayes_toks If you leave out the last part it will create (bayes_path /var/spool/spamassassin/) -rw------- 1 root root 318004 Apr 28 21:17 _journal -rw------- 1 root root 2663 Apr 28 21:17 _msgcount -rw------- 1 root root 417792 Apr 28 21:09 _seen -rw------- 1 root root 7909376 Apr 28 21:09 _toks Also the default filemode in the config are listed 644, the ones in my old dir had 600, why not stick to 600 ? Its only cosmetical, but we'd rather make the config fool proof to avoid questions on the list in a later stage :) Thanks, Raymond. From radislav.vrnata at PORCELA.CZ Mon Apr 28 20:44:48 2003 From: radislav.vrnata at PORCELA.CZ (Radislav Vrnata) Date: Thu Jan 12 21:17:52 2006 Subject: unknown string noticeheading, Time::tm=ARRAY(0x8fed788) In-Reply-To: <5.2.1.1.2.20030427231112.0225f4d0@imap.ecs.soton.ac.uk> References: <005501c30cff$fe66a740$7801a8c0@matthew> Message-ID: <3EADA0D0.15161.114790B@localhost> Hi, I have two problems on RH 8.0, MailScanner 4.15-9 : 1. My maillog contains this line, Apr 28 20:23:06 bubo MailScanner[29831]: Looked up unknown string noticeheading in language translation file /etc/MailScanner/reports/en/languages.conf but my ../en/languages.conf contains this line NoticeHeading = The following e-mail messages were found to have viruses in them and ../cz/languages.conf contains czech equivalent of this line... and MailScanner.conf contains Language Strings = /etc/MailScanner/rules/languages.rules and languages.rules contains, FromOrTo: *@*.cz /etc/MailScanner/reports/cz/languages.conf FromOrTo: *@* /etc/MailScanner/reports/en/languages.conf and e-mail is sending to name@domain.cz ... Where is the problem ? Why MailScanner search ../en/languages.conf instead of ../cz/languages.conf ... ? 2. VirusWarning.txt show : At Time::tm=ARRAY(0x8fed788) ..... instead of real date/time ... Where is the problem ? --- Radislav Vrnata. From mailscanner at ecs.soton.ac.uk Mon Apr 28 20:56:27 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Spamassassin config In-Reply-To: Message-ID: <5.2.1.1.2.20030428205552.02665510@imap.ecs.soton.ac.uk> Done. I've also added a comment saying that this has pretty much been superceded by the "Advanced SpamAssassin Settings" in MailScanner.conf. At 20:23 28/04/2003, you wrote: >Hi! > >In the spam.assassin.prefs.conf i saw some confusing stuff: > ># ># JKF 26/03/2003 ># If your root filesystem is filling up because SpamAssassin is putting ># large databases in /.spamassassin or /root/.spamassassin, you can move ># them using the following lines to point to their new locations ># > >auto_whitelist_path /var/spool/spamassassin/auto-whitelist >auto_whitelist_file_mode 0644 >bayes_path /var/spool/spamassassin/bayes >bayes_file_mode 0644 > >The last part is a part of the filenames that will be generated. >So the payed path isnt actually the path, its more, its also the >prefix of the files... =) Perhaps add a line to explain that. > >As i read it in the config i created two dirs, bayed and auto-whitelist :) > >-rw------- 1 root root 318004 Apr 28 21:17 bayes_journal >-rw------- 1 root root 2663 Apr 28 21:17 bayes_msgcount >-rw------- 1 root root 417792 Apr 28 21:09 bayes_seen >-rw------- 1 root root 7909376 Apr 28 21:09 bayes_toks > >If you leave out the last part it will create >(bayes_path /var/spool/spamassassin/) > >-rw------- 1 root root 318004 Apr 28 21:17 _journal >-rw------- 1 root root 2663 Apr 28 21:17 _msgcount >-rw------- 1 root root 417792 Apr 28 21:09 _seen >-rw------- 1 root root 7909376 Apr 28 21:09 _toks > > >Also the default filemode in the config are listed 644, the ones >in my old dir had 600, why not stick to 600 ? > >Its only cosmetical, but we'd rather make the config fool proof to avoid >questions on the list in a later stage :) > >Thanks, >Raymond. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Mon Apr 28 21:00:06 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: Spamassassin config In-Reply-To: <5.2.1.1.2.20030428205552.02665510@imap.ecs.soton.ac.uk> Message-ID: Hi! > Done. > I've also added a comment saying that this has pretty much been superceded > by the "Advanced SpamAssassin Settings" in MailScanner.conf. > >In the spam.assassin.prefs.conf i saw some confusing stuff: Thanks! Bye, Raymond. From marco at MUW.EDU Mon Apr 28 22:01:05 2003 From: marco at MUW.EDU (Marco Obaid) Date: Thu Jan 12 21:17:52 2006 Subject: Spamassassin config In-Reply-To: <5.2.1.1.2.20030428205552.02665510@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030428205552.02665510@imap.ecs.soton.ac.uk> Message-ID: <1051563665.3ead96919eaff@webmail.MUW.Edu> Hi, > Done. > I've also added a comment saying that this has pretty much been superceded > by the "Advanced SpamAssassin Settings" in MailScanner.conf. Is it possible to update this FAQ page: http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/102.html Following it, I have this setup now: /var/spool/spamassassin/baspam.assassin.prefs.confyes_journal /var/spool/spamassassin/baspam.assassin.prefs.confyes_msgcount /var/spool/spamassassin/baspam.assassin.prefs.confyes_seen /var/spool/spamassassin/baspam.assassin.prefs.confyes_toks Thank you Marco _________________________________________________________________ This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail For the latest MUW Events, visit http://www.MUW.Edu/calendar From mailscanner at ecs.soton.ac.uk Mon Apr 28 21:26:42 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: unknown string noticeheading, Time::tm=ARRAY(0x8fed788) In-Reply-To: <3EADA0D0.15161.114790B@localhost> References: <5.2.1.1.2.20030427231112.0225f4d0@imap.ecs.soton.ac.uk> <005501c30cff$fe66a740$7801a8c0@matthew> Message-ID: <5.2.1.1.2.20030428212609.02826ec8@imap.ecs.soton.ac.uk> At 20:44 28/04/2003, you wrote: >Hi, > >I have two problems on RH 8.0, MailScanner 4.15-9 : > >1. >My maillog contains this line, > >Apr 28 20:23:06 bubo MailScanner[29831]: Looked up unknown string >noticeheading in language translation file >/etc/MailScanner/reports/en/languages.conf > >but my ../en/languages.conf contains this line > >NoticeHeading = The following e-mail messages were found to have >viruses in them > >and ../cz/languages.conf contains >czech equivalent of this line... > >and MailScanner.conf contains >Language Strings = /etc/MailScanner/rules/languages.rules > >and languages.rules contains, >FromOrTo: *@*.cz /etc/MailScanner/reports/cz/languages.conf >FromOrTo: *@* /etc/MailScanner/reports/en/languages.conf > >and e-mail is sending to name@domain.cz ... > >Where is the problem ? >Why MailScanner search ../en/languages.conf instead of >../cz/languages.conf ... ? Fixed. >2. >VirusWarning.txt show : > >At Time::tm=ARRAY(0x8fed788) ..... instead of real date/time ... > >Where is the problem ? Fixed. Thankyou for pointing out these 2 bugs. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Mon Apr 28 21:45:13 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: Spamassassin config In-Reply-To: <1051563665.3ead96919eaff@webmail.MUW.Edu> References: <5.2.1.1.2.20030428205552.02665510@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428205552.02665510@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030428214436.027b05a8@imap.ecs.soton.ac.uk> Fixed. Whoever wrote that page might want to improve it by adding a mention of the "Advanced SpamAssassin Settings" parameters in MailScanner.conf. At 22:01 28/04/2003, you wrote: >Hi, > > > Done. > > I've also added a comment saying that this has pretty much been superceded > > by the "Advanced SpamAssassin Settings" in MailScanner.conf. > >Is it possible to update this FAQ page: > >http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/102.html > >Following it, I have this setup now: > >/var/spool/spamassassin/baspam.assassin.prefs.confyes_journal >/var/spool/spamassassin/baspam.assassin.prefs.confyes_msgcount >/var/spool/spamassassin/baspam.assassin.prefs.confyes_seen >/var/spool/spamassassin/baspam.assassin.prefs.confyes_toks > >Thank you >Marco > >_________________________________________________________________ >This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail >For the latest MUW Events, visit http://www.MUW.Edu/calendar -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From nerijus at USERS.SOURCEFORGE.NET Mon Apr 28 22:33:03 2003 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:17:52 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> Message-ID: <1051565583.18171.82.camel@nerijus> Pr, 2003-04-28 20:44, Julian Field wrote: > Thanks for the pointer. I have just downloaded it, installed it, and built > the Sample1/AvpDaemonClient. > cd /usr/lib/MailScanner > /usr/local/bin/AvpDaemonClient . > seemed to work just fine. It scanned all the files in the current directory > and sub-directories of it. > > What do you see when you try the same commands? I see: # /usr/local/bin/AvpDaemonClient . Test result: 0 Test result: 0x30, flags: 0x100 No viruses were found Found viruses: Return code: 0 But I see in /var/log/kavscan.rpt: Query for the tests: <0>Apr 28 21:10:20:. Directory . wasn't included in enabled paths. I run kavdaemon as: /opt/AVP/kavdaemon -I0 -Y /var/spool/ From mailscanner at ecs.soton.ac.uk Mon Apr 28 22:36:25 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:52 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <1051565583.18171.82.camel@nerijus> References: <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> Try using the AvpDaemonClient from the Sample1 directory rather than the Sample directory. At 22:33 28/04/2003, you wrote: >Pr, 2003-04-28 20:44, Julian Field wrote: > > > Thanks for the pointer. I have just downloaded it, installed it, and built > > the Sample1/AvpDaemonClient. > > cd /usr/lib/MailScanner > > /usr/local/bin/AvpDaemonClient . > > seemed to work just fine. It scanned all the files in the current directory > > and sub-directories of it. > > > > What do you see when you try the same commands? > >I see: > ># /usr/local/bin/AvpDaemonClient . >Test result: 0 >Test result: 0x30, flags: 0x100 >No viruses were found >Found viruses: >Return code: 0 > >But I see in /var/log/kavscan.rpt: > >Query for the tests: <0>Apr 28 21:10:20:. > >Directory . wasn't included in enabled paths. > >I run kavdaemon as: > >/opt/AVP/kavdaemon -I0 -Y /var/spool/ -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From nerijus at USERS.SOURCEFORGE.NET Mon Apr 28 23:53:47 2003 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:17:52 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> Message-ID: <1051570427.18171.100.camel@nerijus> An, 2003-04-29 00:36, Julian Field wrote: > Try using the AvpDaemonClient from the Sample1 directory rather than the > Sample directory. It doesn't find viruses at all, while the ones from Sample or Sample2 do. Nerijus From raymond at PROLOCATION.NET Tue Apr 29 00:39:26 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: CLAMAV In-Reply-To: <1051549583.18172.67.camel@nerijus> Message-ID: Hi! Just a short note, i installed clamav to do some testing and i was a little surprised on its behaviour... Nothing on MS, just something for user running clam ... :) See: Apr 29 01:34:41 vmx01 MailScanner[8197]: New Batch: Scanning 1 messages, 331018 bytes Apr 29 01:34:41 vmx01 MailScanner[8197]: Spam Checks: Starting Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus and Content Scanning: Starting Apr 29 01:34:42 vmx01 MailScanner[8197]: /var/spool/MailScanner/incoming/8197/./h3SNYekp008205/test.zip->Gaq.scr Infection: W32/Klez.H@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus Scanning: F-Prot found virus W32/Klez.H@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: /var/spool/MailScanner/incoming/8197/./h3SNYekp008205/test.zip->Hacker.scr Infection: W32/Lentin.H@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus Scanning: F-Prot found virus W32/Lentin.H@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: /var/spool/MailScanner/incoming/8197/./h3SNYekp008205/test.zip->Movie_0074.mpeg.pif Infection: W32/Sobig.A@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus Scanning: F-Prot found virus W32/Sobig.A@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: /var/spool/MailScanner/incoming/8197/./h3SNYekp008205/test.zip->picacu.exe Infection: W32/Klez.H@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus Scanning: F-Prot found virus W32/Klez.H@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: /var/spool/MailScanner/incoming/8197/./h3SNYekp008205/test.zip->xx.scr Infection: W32/Ganda.A@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus Scanning: F-Prot found virus W32/Ganda.A@mm Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus Scanning: F-Prot found 5 infections Apr 29 01:34:42 vmx01 MailScanner[8197]: Autodetected 2 CPUs. Starting 2 threads. Apr 29 01:34:42 vmx01 MailScanner[8197]: /var/spool/MailScanner/incoming/8197/./h3SNYekp008205/test.zip: Worm/Klez.H FOUND Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus Scanning: ClamAV found 1 infections Apr 29 01:34:42 vmx01 MailScanner[8197]: Virus Scanning: Found 1 viruses Apr 29 01:34:42 vmx01 MailScanner[8197]: Saved infected "ClamAV: test.zip" to /var/spool/MailScanner/quarantine/20030429/h3SNYekp008205 Apr 29 01:34:43 vmx01 MailScanner[8197]: Saved infected "test.zip" to /var/spool/MailScanner/quarantine/20030429/h3SNYekp00820 It looks like it only scans the first virus and then stops. F-prot found 5, Clan found 1, and that one was present twice in the same zip, looks really weird to me :) Bye, Raymond. From hden at KCBBS.GEN.NZ Tue Apr 29 04:06:04 2003 From: hden at KCBBS.GEN.NZ (hden Hartog) Date: Thu Jan 12 21:17:52 2006 Subject: Sophos SAVI problems Message-ID: On Sat, 26 Apr 2003 23:50:49 -0700, Daniel Kleinsinger wrote: >>> Apr 25 17:52:05 nts-2 MailScanner[4739]: MailScanner child dying of >>> old age >So I then changed Minimum Code Status from supported to beta and, >surprise surprise, it started working. I then reverted to the unpatched >SweepViruses.pm, leaving MCS at beta, and the old error came back. So >it would seem that the new code fixed some problem with identifying new >IDEs. Thanks for fixing it so quickly. I followed the same path, changing to using sophossavi (RH8/MS4.14-9/May- SophosUpdate), and ended up with what seems to me to be the same problem! I have no idea how to apply patches, nor how to change Code status..Are the changes made by the patch incorperated into the latest BETA or next release by any chance? Cheers! Hendrik From raymond at PROLOCATION.NET Tue Apr 29 07:14:16 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: Reporting quirqs Message-ID: Hi! I got a virus mailed myself, and noticed this: Warning: This message has had one or more attachments removed Warning: (LGKJPCLG.EXE, ClamAV: LGKJPCLG.EXE). Warning: Please read the "VirusWarning.txt" attachment(s) for more information. This is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "LGKJPCLG.EXE" was believed to be infected by a virus and has been replaced by this warning message. If you wish to receive a copy of the *infected* attachment, please e-mail helpdesk and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. At Time::tm=ARRAY(0x90952b4) the virus scanner said: F-Prot: LGKJPCLG.EXE Infection: W32/Hybris.worm.B Executable DOS/Windows programs are dangerous in email (LGKJPCLG.EXE) The 'At Time::' isnt right it seems :) Its with MailScanner-4.15-9, f-prot and clamav. It also looks strange that the inline warning tells ClamAV: and the attachment only tells about f-prot ... Bye, Raymond. From raymond at PROLOCATION.NET Tue Apr 29 07:40:54 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: Clam ... Message-ID: Julian, Is it possible to also detect if clam is updated ? Currently i get in the logs: Apr 29 03:01:01 vmx01 update.virus.scanners: Found clamav installed Apr 29 03:01:01 vmx01 update.virus.scanners: Updating clamav Apr 29 03:01:01 vmx01 ClamAV-autoupdate[11488]: ClamAV updated Apr 29 03:01:01 vmx01 update.virus.scanners: Found f-prot installed Apr 29 03:01:01 vmx01 update.virus.scanners: Updating f-prot Apr 29 03:01:02 vmx01 F-Prot autoupdate[11496]: F-Prot did not need updating. But in fact Clam isnt updated...Its telling this hourly: Apr 29 04:01:01 vmx01 update.virus.scanners: Found clamav installed Apr 29 04:01:01 vmx01 update.virus.scanners: Updating clamav Apr 29 04:01:01 vmx01 ClamAV-autoupdate[13518]: ClamAV updated Apr 29 04:01:01 vmx01 update.virus.scanners: Found f-prot installed Apr 29 04:01:01 vmx01 update.virus.scanners: Updating f-prot Apr 29 04:01:02 vmx01 F-Prot autoupdate[13526]: F-Prot did not need updating. Is the script reporting this ok ? Since i think its defaulting to the 'ClamAV updated' all the time, even when its not updated. I saw in the auto update script of f-prot some checking, but not in the one for Clam, is it posible to do the same there ? Bye, Raymond. From P.G.M.Peters at civ.utwente.nl Tue Apr 29 08:43:15 2003 From: P.G.M.Peters at civ.utwente.nl (Peter Peters) Date: Thu Jan 12 21:17:52 2006 Subject: something else but SpamAssassin In-Reply-To: <5.2.0.9.2.20030428143753.02d1d870@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030428143753.02d1d870@imap.ecs.soton.ac.uk> Message-ID: On Mon, 28 Apr 2003 14:40:03 +0100, you wrote: >If possible, I would like to be able to avoid calling another executable >and piping a message into it. But if they have to go down that route, there >must at the very least be a means of giving it multiple messages. Starting >up a program for every single message will be very slow. Would it be possible to put the messages in a separate directory and have the scanner process that directory? A bit like virusscanners. P.S. I will discuss al ideas you give me with the other people. -- Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ From P.G.M.Peters at civ.utwente.nl Tue Apr 29 08:46:16 2003 From: P.G.M.Peters at civ.utwente.nl (Peter Peters) Date: Thu Jan 12 21:17:52 2006 Subject: SpamAssassin/MS: coordinating several installations In-Reply-To: References: Message-ID: On Mon, 28 Apr 2003 15:22:37 +0100, you wrote: >My initial thoughts are to expand our local "Makefile" mechanism that >already handles other email-related table-maintenance across these >machines. I would go with that. We did something like that when we had identical systems running our incoming and outgoing e-mail. But we have it limited to MS conf-files. We don't offer "external" persons the possiblity to update other conf-files. We only allow them to update the aliases for their department. -- Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ From danieltan at shopnsave.com.sg Tue Apr 29 09:23:17 2003 From: danieltan at shopnsave.com.sg (Daniel Tan) Date: Thu Jan 12 21:17:52 2006 Subject: defunct mailscanner Message-ID: <02c801c30e28$97c29ba0$3900a8c0@Daniel> how come when i do a top on my server..i can see mailscanner beside it.... another qn....do i need to specify this ( -ODeliveryMode=queueonly -OQueueDirectory= /var/spool/mqueue.in) in the latest version of mailscanner in /etc/rc.d/init.d/sendmail? Regards, Daniel Tan 67469188 Ext.665 DID: 68430665 MIS Department Shop N Save Pte Ltd : danieltan@shopnsave.com.sg [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.] From steve.freegard at LBSLTD.CO.UK Tue Apr 29 10:18:09 2003 From: steve.freegard at LBSLTD.CO.UK (Steve Freegard) Date: Thu Jan 12 21:17:52 2006 Subject: SAVI-Perl problems Message-ID: <67D9E7698329D411936E00508B6590B9027935CA@neelix.lbsltd.co.uk> Hi All, Further to my eariler posting - this seems like a RH9 issue, if I set LD_ASSUME_KERNEL=2.2.5 in /etc/rc.d/init.d/MailScanner this cures the problem. Also - is it still a good idea to set LANG=en_GB in /etc/rc.d/init.d/MailScanner to speed up SpamAssassin under RH8/9 due to the UTF-8 issues??? Regards, Steve. -----Original Message----- From: Steve Freegard [mailto:steve.freegard@lbsltd.co.uk] Sent: 28 April 2003 19:56 To: MAILSCANNER@jiscmail.ac.uk Hi All, I thought I'd give the sophossavi interface a try - after doing so, I was tailing the maillog and noticed that MailScanner was spawning a new child process every 10-20 seconds or so, and that I had several defunct processes showing up when doing a 'ps axww'. I put MailScanner into debug mode and ran it by hand and realised that it was segfaulting. Here is the last few lines of an strace: [root@hoshi root]# strace /usr/sbin/MailScanner /etc/MailScanner/MailScanner.con f <> mprotect(0x40618000, 978944, PROT_READ|PROT_EXEC) = 0 open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 5 fstat64(5, {st_mode=S_IFREG|0644, st_size=21040, ...}) = 0 mmap2(NULL, 21040, PROT_READ, MAP_SHARED, 5, 0) = 0x40428000 close(5) = 0 futex(0x42130d84, FUTEX_WAKE, 2147483647, NULL) = 0 brk(0) = 0x92fa000 brk(0x92fb000) = 0x92fb000 open("/etc/sav.conf", O_RDONLY) = 5 fstat64(5, {st_mode=S_IFREG|0644, st_size=49, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40 145000 read(5, "SAV virus data directory = /usr/"..., 4096) = 49 read(5, "", 4096) = 0 close(5) = 0 munmap(0x40145000, 4096) = 0 time(NULL) = 1051555427 open("/tmp/76630000.$$$", O_RDWR|O_CREAT|O_EXCL, 0600) = 5 close(5) = 0 open("/tmp/76630000.$$$", O_RDWR) = 5 write(5, "\0", 1) = 1 close(5) = 0 rmdir("/tmp/76630000.$$$") = -1 ENOTDIR (Not a directory) unlink("/tmp/76630000.$$$") = 0 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ <> I confirmed that it is SAVI-Perl causing it by changing back to regular sophos scanning which then stops the segfault. I'm running this on a Compaq Proliant DL360 1x933Mhz 512Mb RAM running RedHat 9, MailScanner 4.14-9, Sophos 3.67 and ClamAV 0.54 Anyone else had a similar problem or know how to fix this?? Kind regards, Steve -- Steve Freegard Systems Manager Littlehampton Book Services Ltd. ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.lbsltd.co.uk ********************************************************************** From steve.freegard at LBSLTD.CO.UK Tue Apr 29 11:42:55 2003 From: steve.freegard at LBSLTD.CO.UK (Steve Freegard) Date: Thu Jan 12 21:17:52 2006 Subject: Reporting quirqs Message-ID: <67D9E7698329D411936E00508B6590B9027935D3@neelix.lbsltd.co.uk> Raymond/Julian, I can confirm a similar reporting error with SophosSAVI and Clam with 'Include Scanner Name In Reports = yes' > Warning: This message has had one or more attachments removed > Warning: (ClamAV: eicar_com.zip, eicar_com.zip). > Warning: Please read the "VirusWarning.txt" attachment(s) for more information. <--SNIP--> > At Tue Apr 29 11:33:20 2003 the virus scanner said: > SophosSAVI: eicar_com.zip was infected by EICAR-AV-Test <--SNIP--> The ClamAV report is shown in the warning header, and the SAVI report is shown in the attachment. Regards, Steve. -----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET] Sent: 29 April 2003 07:14 To: MAILSCANNER@jiscmail.ac.uk Hi! I got a virus mailed myself, and noticed this: Warning: This message has had one or more attachments removed Warning: (LGKJPCLG.EXE, ClamAV: LGKJPCLG.EXE). Warning: Please read the "VirusWarning.txt" attachment(s) for more information. This is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "LGKJPCLG.EXE" was believed to be infected by a virus and has been replaced by this warning message. If you wish to receive a copy of the *infected* attachment, please e-mail helpdesk and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. At Time::tm=ARRAY(0x90952b4) the virus scanner said: F-Prot: LGKJPCLG.EXE Infection: W32/Hybris.worm.B Executable DOS/Windows programs are dangerous in email (LGKJPCLG.EXE) The 'At Time::' isnt right it seems :) Its with MailScanner-4.15-9, f-prot and clamav. It also looks strange that the inline warning tells ClamAV: and the attachment only tells about f-prot ... Bye, Raymond. ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.lbsltd.co.uk ********************************************************************** From raymond at PROLOCATION.NET Tue Apr 29 12:06:08 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: defunct mailscanner In-Reply-To: <02c801c30e28$97c29ba0$3900a8c0@Daniel> Message-ID: Hi! > how come when i do a top on my server..i can see mailscanner > beside it.... > another qn....do i need to specify this > ( -ODeliveryMode=queueonly -OQueueDirectory= > /var/spool/mqueue.in) in the latest version of mailscanner in > /etc/rc.d/init.d/sendmail? Most likely due to misconfigurations. I had this for example when i enabled spamassassin and sa wasnt working like it should. Do you have sa installed, and enabled in mailscanner ? If so, please disable it and see if its running afterwards. Bye, Raymond. From mk at quadstone.com Tue Apr 29 12:27:22 2003 From: mk at quadstone.com (Michael Keightley) Date: Thu Jan 12 21:17:52 2006 Subject: whitelist Message-ID: <20030429112722.GA28801@quadstone.com> If I add an entry to the whitelist file, do I need to restart MailScanner before it sees this change? Michael -- Michael Keightley Tel: +44 131 220 4491 Systems Manager, Quadstone Limited, Fax: +44 131 220 4492 16 Chester Street, Edinburgh EH3 7RA, Scotland http://www.quadstone.com From jase at SENSIS.COM Tue Apr 29 13:48:44 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:52 2006 Subject: Reporting quirqs Message-ID: And I can confirm this too with Clam and McAfee. Maybe Clam is the cause? Jason > -----Original Message----- > From: Steve Freegard [mailto:steve.freegard@LBSLTD.CO.UK] > Sent: Tuesday, April 29, 2003 6:43 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Reporting quirqs > > > Raymond/Julian, > > I can confirm a similar reporting error with SophosSAVI and Clam with > 'Include Scanner Name In Reports = yes' > > > Warning: This message has had one or more attachments removed > > Warning: (ClamAV: eicar_com.zip, eicar_com.zip). > > Warning: Please read the "VirusWarning.txt" attachment(s) for more > information. > > <--SNIP--> > > At Tue Apr 29 11:33:20 2003 the virus scanner said: > > SophosSAVI: eicar_com.zip was infected by EICAR-AV-Test > <--SNIP--> > > The ClamAV report is shown in the warning header, and the > SAVI report is > shown in the attachment. > > Regards, > Steve. > > -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET] > Sent: 29 April 2003 07:14 > To: MAILSCANNER@jiscmail.ac.uk > > Hi! > > I got a virus mailed myself, and noticed this: > > Warning: This message has had one or more attachments removed > Warning: (LGKJPCLG.EXE, ClamAV: LGKJPCLG.EXE). > Warning: Please read the "VirusWarning.txt" attachment(s) for more > information. > > > This is a message from the MailScanner E-Mail Virus Protection Service > ---------------------------------------------------------------------- > The original e-mail attachment "LGKJPCLG.EXE" > was believed to be infected by a virus and has been replaced by this > warning > message. > > If you wish to receive a copy of the *infected* attachment, please > e-mail helpdesk and include the whole of this message > in your request. Alternatively, you can call them, with > the contents of this message to hand when you call. > > At Time::tm=ARRAY(0x90952b4) the virus scanner said: > F-Prot: LGKJPCLG.EXE Infection: W32/Hybris.worm.B > Executable DOS/Windows programs are dangerous in email > (LGKJPCLG.EXE) > > The 'At Time::' isnt right it seems :) > Its with MailScanner-4.15-9, f-prot and clamav. > > It also looks strange that the inline warning tells ClamAV: and the > attachment only tells about f-prot ... > > Bye, > Raymond. > > > ********************************************************************** > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote also confirms that this email message has been swept by > MIMEsweeper for the presence of computer viruses. > > www.lbsltd.co.uk > ********************************************************************** > From raymond at PROLOCATION.NET Tue Apr 29 14:14:09 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: Reporting quirqs In-Reply-To: Message-ID: Hi! > And I can confirm this too with Clam and McAfee. Maybe Clam is the cause? All i can say is i didnt have this with f-prot only ... :) Bye, Raymond. From nathan at TCPNETWORKS.NET Tue Apr 29 14:25:44 2003 From: nathan at TCPNETWORKS.NET (Nathan Johanson) Date: Thu Jan 12 21:17:52 2006 Subject: Spamassassin config Message-ID: Can you please clarify the "Advanced SpamAssassin Settings" in MailScanner.conf? Perhaps point me to a link or thread that describes it? I did a search in the mailing list archives and didn't find anything but this thread. I don't see any reference to this in the documentation or in my stock MailScanner 414-9 configuration file. I recently moved to 414-9 and have been using the "superceded" options in spam.assassin.prefs.conf to move the bayes database and set the permissions. Nathan -----Original Message----- From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] Sent: Monday, April 28, 2003 1:45 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Spamassassin config Fixed. Whoever wrote that page might want to improve it by adding a mention of the "Advanced SpamAssassin Settings" parameters in MailScanner.conf. At 22:01 28/04/2003, you wrote: >Hi, > > > Done. > > I've also added a comment saying that this has pretty much been superceded > > by the "Advanced SpamAssassin Settings" in MailScanner.conf. > >Is it possible to update this FAQ page: > >http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/102.html > >Following it, I have this setup now: > >/var/spool/spamassassin/baspam.assassin.prefs.confyes_journal >/var/spool/spamassassin/baspam.assassin.prefs.confyes_msgcount >/var/spool/spamassassin/baspam.assassin.prefs.confyes_seen >/var/spool/spamassassin/baspam.assassin.prefs.confyes_toks > >Thank you >Marco > >_________________________________________________________________ >This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail >For the latest MUW Events, visit http://www.MUW.Edu/calendar -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Tue Apr 29 14:30:25 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:52 2006 Subject: Spamassassin config In-Reply-To: Message-ID: Hi! > Can you please clarify the "Advanced SpamAssassin Settings" in > MailScanner.conf? Perhaps point me to a link or thread that describes > it? > > I did a search in the mailing list archives and didn't find anything > but this thread. I don't see any reference to this in the documentation > or in my stock MailScanner 414-9 configuration file. I recently moved to > 414-9 and have been using the "superceded" options in > spam.assassin.prefs.conf to move the bayes database and set the > permissions. In the last beta 4.15-9 there is listed: # # Advanced SpamAssassin Settings # ------------------------------ # # If you are using Postfix you may well need to use some of the settings # below, as the home directory for the "postfix" user cannot be written # to by the "postfix" user. # You may also need to use these if you have installed SpamAssassin # somewhere other than the default location. # # The per-user files (bayes, auto-whitelist, user_prefs) are looked # for here and in ~/.spamassassin/. Note the files are mutable. # If this is unset then no extra places are searched for. # If using Postfix, you probably want to set this as shown in the example # line at the end of this comment, and do # mkdir /var/spool/MailScanner/spamassassin # chown postfix.postfix /var/spool/MailScanner/spamassassin #SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin #SpamAssassin User State Dir = /var/spool/spamassassin/ # This setting is useful if SpamAssassin is installed in an unusual place, # e.g. /opt/MailScanner. The install prefix is used to find some fallback # directories if neither of the following two settings work. # If this is set then it adds to the list of places that are searched; # otherwise it has no effect. #SpamAssassin Install Prefix = /opt/MailScanner #SpamAssassin Install Prefix = # The site-local rules are searched for here, and in prefix/etc/spamassassin, # prefix/etc/mail/spamassassin, /usr/local/etc/spamassassin, /etc/spamassassin, # /etc/mail/spamassassin, and maybe others. # If this is set then it adds to the list of places that are searched; # otherwise it has no effect. #SpamAssassin Local Rules Dir = /etc/MailScanner/mail/spamassassin #SpamAssassin Local Rules Dir = # The default rules are searched for here, and in prefix/share/spamassassin, # /usr/local/share/spamassassin, /usr/share/spamassassin, and maybe others. # If this is set then it adds to the list of places that are searched; # otherwise it has no effect. #SpamAssassin Default Rules Dir = /opt/MailScanner/share/spamassassin #SpamAssassin Default Rules Dir = Bye, Raymond. From mailscanner at LISTS.COM.AR Tue Apr 29 14:42:22 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:53 2006 Subject: Spamassassin config In-Reply-To: References: Message-ID: <3EAE570E.15902.13054FC3@localhost> IIRC, Julian said they were there before... so they should work with 4.14- 9... I guess. El 29 Apr 2003 a las 15:30, Raymond Dijkxhoorn escribi?: > Hi! > > > Can you please clarify the "Advanced SpamAssassin Settings" in > > MailScanner.conf? Perhaps point me to a link or thread that describes > > it? > > > > I did a search in the mailing list archives and didn't find anything > > but this thread. I don't see any reference to this in the documentation > > or in my stock MailScanner 414-9 configuration file. I recently moved to > > 414-9 and have been using the "superceded" options in > > spam.assassin.prefs.conf to move the bayes database and set the > > permissions. > > In the last beta 4.15-9 there is listed: > > # > # Advanced SpamAssassin Settings > # ------------------------------ > # > # If you are using Postfix you may well need to use some of the settings > # below, as the home directory for the "postfix" user cannot be written > # to by the "postfix" user. > # You may also need to use these if you have installed SpamAssassin > # somewhere other than the default location. > # > > # The per-user files (bayes, auto-whitelist, user_prefs) are looked > # for here and in ~/.spamassassin/. Note the files are mutable. > # If this is unset then no extra places are searched for. > # If using Postfix, you probably want to set this as shown in the example > # line at the end of this comment, and do > # mkdir /var/spool/MailScanner/spamassassin > # chown postfix.postfix /var/spool/MailScanner/spamassassin > #SpamAssassin User State Dir = /var/spool/MailScanner/spamassassin > #SpamAssassin User State Dir = /var/spool/spamassassin/ > > # This setting is useful if SpamAssassin is installed in an unusual place, > # e.g. /opt/MailScanner. The install prefix is used to find some fallback > # directories if neither of the following two settings work. > # If this is set then it adds to the list of places that are searched; > # otherwise it has no effect. > #SpamAssassin Install Prefix = /opt/MailScanner > #SpamAssassin Install Prefix = > > # The site-local rules are searched for here, and in prefix/etc/spamassassin, > # prefix/etc/mail/spamassassin, /usr/local/etc/spamassassin, /etc/spamassassin, > # /etc/mail/spamassassin, and maybe others. > # If this is set then it adds to the list of places that are searched; > # otherwise it has no effect. > #SpamAssassin Local Rules Dir = /etc/MailScanner/mail/spamassassin > #SpamAssassin Local Rules Dir = > > # The default rules are searched for here, and in prefix/share/spamassassin, > # /usr/local/share/spamassassin, /usr/share/spamassassin, and maybe others. > # If this is set then it adds to the list of places that are searched; > # otherwise it has no effect. > #SpamAssassin Default Rules Dir = /opt/MailScanner/share/spamassassin > #SpamAssassin Default Rules Dir = > > Bye, > Raymond. -- Mariano Absatz El Baby ---------------------------------------------------------- I don't care to belong to a club that accepts people like me as members. -- Groucho Marx From marco at MUW.EDU Tue Apr 29 15:16:06 2003 From: marco at MUW.EDU (Marco Obaid) Date: Thu Jan 12 21:17:53 2006 Subject: Debugging Spamassassin In-Reply-To: References: Message-ID: <1051625766.3eae8926aa212@webmail.MUW.Edu> Hi, Running "spamassassin -D --lint", one of the output lines looks like this: debug: bayes corpus size: nspam = 14120, nham = 20635 What does "corpus" mean? is nspam means number of spam detected by SA so far? Or, spam learned so far? Finally, can I safely delete *.db files in my /var/spool/spamassassin? The time stamp on those files never changed for 2 months: -rw------- 1 root root 134324224 Feb 10 00:17 auto-whitelist.db -rw-r--r-- 1 root root 103570 Apr 29 09:06 bayes_journal -rw-r--r-- 1 root root 361 Apr 29 09:06 bayes_msgcount -rw------- 1 root root 2613248 Apr 29 09:06 bayes_seen -rw------- 1 root root 327680 Feb 25 08:28 bayes_seen.db -rw-r--r-- 1 root root 3895296 Apr 29 09:06 bayes_toks -rw------- 1 root root 8720384 Feb 25 08:28 bayes_toks.db -rw-r--r-- 1 root root 1218 Apr 27 18:45 user_prefs I believe that I moved them from /root/.spamassassin when I created /var/spool/spamassassin. (I probably shouldn't have) Thanks, Marco _________________________________________________________________ This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail For the latest MUW Events, visit http://www.MUW.Edu/calendar From steve.freegard at LBSLTD.CO.UK Tue Apr 29 15:10:58 2003 From: steve.freegard at LBSLTD.CO.UK (Steve Freegard) Date: Thu Jan 12 21:17:53 2006 Subject: Reporting quirqs Message-ID: <67D9E7698329D411936E00508B6590B9027935E4@neelix.lbsltd.co.uk> Jason, > Maybe Clam is the cause? Looks like you are correct - I've changed my settings to say "Virus Scanners = sophossavi sophos" and now I get: >>> Warning: This message has had one or more attachments removed >>> Warning: (eicar_com.zip). >>> Warning: Please read the "VirusWarning.txt" attachment(s) for more information. >>> At Tue Apr 29 13:59:08 2003 the virus scanner said: >>> SophosSAVI: eicar_com.zip was infected by EICAR-AV-Test >>> Sophos: >>> Virus 'EICAR-AV-Test' found in file eicar_com.zip/eicar.com Regards, Steve. -----Original Message----- From: Desai, Jason [mailto:jase@SENSIS.COM] Sent: 29 April 2003 13:49 To: MAILSCANNER@jiscmail.ac.uk And I can confirm this too with Clam and McAfee. Maybe Clam is the cause? Jason > -----Original Message----- > From: Steve Freegard [mailto:steve.freegard@LBSLTD.CO.UK] > Sent: Tuesday, April 29, 2003 6:43 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Reporting quirqs > > > Raymond/Julian, > > I can confirm a similar reporting error with SophosSAVI and Clam with > 'Include Scanner Name In Reports = yes' > > > Warning: This message has had one or more attachments removed > > Warning: (ClamAV: eicar_com.zip, eicar_com.zip). > > Warning: Please read the "VirusWarning.txt" attachment(s) for more > information. > > <--SNIP--> > > At Tue Apr 29 11:33:20 2003 the virus scanner said: > > SophosSAVI: eicar_com.zip was infected by EICAR-AV-Test > <--SNIP--> > > The ClamAV report is shown in the warning header, and the > SAVI report is > shown in the attachment. > > Regards, > Steve. > > -----Original Message----- > From: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET] > Sent: 29 April 2003 07:14 > To: MAILSCANNER@jiscmail.ac.uk > > Hi! > > I got a virus mailed myself, and noticed this: > > Warning: This message has had one or more attachments removed > Warning: (LGKJPCLG.EXE, ClamAV: LGKJPCLG.EXE). > Warning: Please read the "VirusWarning.txt" attachment(s) for more > information. > > > This is a message from the MailScanner E-Mail Virus Protection Service > ---------------------------------------------------------------------- > The original e-mail attachment "LGKJPCLG.EXE" > was believed to be infected by a virus and has been replaced by this > warning > message. > > If you wish to receive a copy of the *infected* attachment, please > e-mail helpdesk and include the whole of this message > in your request. Alternatively, you can call them, with > the contents of this message to hand when you call. > > At Time::tm=ARRAY(0x90952b4) the virus scanner said: > F-Prot: LGKJPCLG.EXE Infection: W32/Hybris.worm.B > Executable DOS/Windows programs are dangerous in email > (LGKJPCLG.EXE) > > The 'At Time::' isnt right it seems :) > Its with MailScanner-4.15-9, f-prot and clamav. > > It also looks strange that the inline warning tells ClamAV: and the > attachment only tells about f-prot ... > > Bye, > Raymond. > > > ********************************************************************** > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote also confirms that this email message has been swept by > MIMEsweeper for the presence of computer viruses. > > www.lbsltd.co.uk > ********************************************************************** > From mailscanner at ecs.soton.ac.uk Tue Apr 29 15:51:32 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Selling a product based on MailScanner? Message-ID: <5.2.1.1.2.20030429154336.0234e4c8@imap.ecs.soton.ac.uk> A lot of sites are very cautious about having anything other than an "appliance" or a "managed service" for providing email security. So what I would like to do is run a page on the MailScanner.biz site (linked from MailScanner.info) that lists products, systems and services that I know about, which use MailScanner. So if you are commercially providing any service or system based around MailScanner to the general public, please drop me a line (off-list). I will give you at least a link to a web page of your choosing (it doesn't have to be just your home page). Give me a few words that describe your product or service, and I might choose to add them as well. If I don't like what you send me, I'll re-write it. So be nice... Exactly what information gets put on the list, and in what order, is entirely up to me. I retain complete editorial control of the whole list. This is a chance for some free advertising, so make good use of it. I'm not charging anything for listing your product/service, but a suitable donation would be appreciated (how much would a commercial site charge you for this?). -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 15:43:35 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show Message-ID: <5.2.1.1.2.20030429152454.0226b458@imap.ecs.soton.ac.uk> I have just the day (well, quite enough of it!) at the "Info Security" show in London. I decided to do the rounds of the show on the premise that I wanted to buy an email anti-virus, and particularly anti-spam, system. I have had demos from loads of salesmen trying to flog me their systems. And my overwhelming response has to be "What a pathetic bunch of products". That's the version you can tell your mother-in-law, anyway :-) They have really sophisticated traps like "the From: domain doesn't match the envelope sender domain" and make a big thing of it. Useful until one of your users joins a mailing list... The really advanced products have thinly (or sometimes not at all!) disguised copies of DCC. I didn't see one product that could talk to Razor2 and DCC. RBL's are quite popular, probably because they are so easy to use. No-one had a decent response to "what happens to your incoming mail feed speed if one of the RBL's goes down?". The standard line to that was "well, you can't avoid human intervention completely". In other words, your incoming mail feed would slow to a crawl waiting for every DNS timeout for every message. I even got them to admit that was exactly what would happen. No product I was shown implemented any decent set of heuristic rules. One or two had the ability to enter regular expressions and give a simple score to each one. But you had to write all the rules yourself, and they only supported 10 rules at most. 1 had a Bayes engine, but it had to be manually trained with spam. It would auto-learn on the assumption that all your outgoing mail was not spam. Which is better than nothing, until one of your systems inside gets hacked and used as a spam relay, at which point your entire bayes database is destroyed by being given spam it assumed was non-spam. And a couple of them gave me price quotes. These were both "appliances", i.e. PC's in 1U boxes. One company wanted $56,000 plus the cost of an anti-virus engine (they only supported a choice of 2). The other one charged ?20,000 (approx $32,000) for the basic unit, and you then paid them several thousands of ? for each of their "modules" on top of that. I hope there are at least 1 or 2 decent commercial products in this market, but I sure didn't see them today, and all the big players were there. We need to spread the word! Which brings me onto my next posting. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From Kevin at MICA.NET Tue Apr 29 16:03:36 2003 From: Kevin at MICA.NET (Kevin Hanser) Date: Thu Jan 12 21:17:53 2006 Subject: Mailscanner / Spamassassin working, but not adding headers Message-ID: <4E33F38AD14BB4438BA6B970FDAE724C3D7601@mailserver.mica.net> I am experiencing an odd problem with a Mailscanner / Spamassassin install that I just performed. Installed latest versions (not cvs) of MailScanner and Spamassassin on a RH 7.2 box yesterday. Most everything is working as it should. Spam messages are being identified, and the subject line is being changed. The maillog is properly recording the spam messages. However, the headers don't seem to be getting added to the spam messages. I've checked and double checked my configuration, and I can't figure out what's going on. I even have the "Always include spam report" option set to on, but still no headers. Is there a way to tell Mailscanner to write a more detailed log than what it writes in the maillog, so that I might be able to figure out what's going on here? I've done numerous other installations that are all working, but this latest one is determined to give me headaches it seems. Any insight or suggestions are greatly appreciated. k -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030429/954cbfe4/attachment.html From raymond at PROLOCATION.NET Tue Apr 29 16:16:46 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:53 2006 Subject: Mailscanner / Spamassassin working, but not adding headers In-Reply-To: <4E33F38AD14BB4438BA6B970FDAE724C3D7601@mailserver.mica.net> Message-ID: Hi! > However, the headers don't seem to be getting added to the spam messages. > I've checked and double checked my configuration, and I can't figure out > what's going on. I even have the "Always include spam report" option set to > on, but still no headers. Is there a way to tell Mailscanner to write a > more detailed log than what it writes in the maillog, so that I might be > able to figure out what's going on here? I've done numerous other > installations that are all working, but this latest one is determined to > give me headaches it seems. There is # Do you want all spam to be logged? Useful if you want to gather # spam statistics from your logs, but can increase the system load quite # a bit if you get a lot of spam. Log Spam = yes I assume you have this allready turned on? And also: # Do you want to always include the Spam Report in the SpamCheck # header, even if the message wasn't spam? # This can also be the filename of a ruleset. Always Include SpamAssassin Report = no You could switch that one to yes Bye, Raymond. From raymond at PROLOCATION.NET Tue Apr 29 16:18:14 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:53 2006 Subject: CLAMAV In-Reply-To: Message-ID: Hi! > Just a short note, i installed clamav to do some testing and i was a > little surprised on its behaviour... > > Nothing on MS, just something for user running clam ... :) As follow up on this, got a reply from the Clam people: Date: Tue, 29 Apr 2003 16:53:40 +0200 (CEST) From: Tomasz Kojm To: Raymond Dijkxhoorn Subject: Re: CLAMAV test > It looks like it only scans the first virus and then stops. It was a zip > with a couple of test virusses... F-prot found 5, Clan found 1, and that > one was present twice in the same zip, looks really weird to me :) There's a transparent support for archives in libclamav, thus it thinks it's a normal file and prints the first virus found. Best regards, Tomasz Kojm Looks like we have to live with that :) Bye, Raymond. From mailscanner at ecs.soton.ac.uk Tue Apr 29 16:53:56 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: Message-ID: <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> At 04:06 29/04/2003, you wrote: >On Sat, 26 Apr 2003 23:50:49 -0700, Daniel Kleinsinger > wrote: > > >>> Apr 25 17:52:05 nts-2 MailScanner[4739]: MailScanner child dying of > >>> old age > > >So I then changed Minimum Code Status from supported to beta and, > >surprise surprise, it started working. I then reverted to the unpatched > >SweepViruses.pm, leaving MCS at beta, and the old error came back. So > >it would seem that the new code fixed some problem with identifying new > >IDEs. Thanks for fixing it so quickly. > > I followed the same path, changing to using sophossavi (RH8/MS4.14-9/May- >SophosUpdate), and ended up with what seems to me to be the same problem! > > I have no idea how to apply patches, nor how to change Code status.. The "Minimum Code Status" is right at the bottom of MailScanner.conf. >Are >the changes made by the patch incorperated into the latest BETA or next >release by any chance? If you let me know what distribution you are using, I'll point you at the very latest code. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 16:59:00 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: SAVI-Perl problems In-Reply-To: <67D9E7698329D411936E00508B6590B9027935CA@neelix.lbsltd.co. uk> Message-ID: <5.2.1.1.2.20030429165828.0282faa8@imap.ecs.soton.ac.uk> I set en_GB in /etc/sysconfig/i18n to avoid RedHat UTF-8 issues across the whole system. At 10:18 29/04/2003, you wrote: >Hi All, > >Further to my eariler posting - this seems like a RH9 issue, if I set >LD_ASSUME_KERNEL=2.2.5 in /etc/rc.d/init.d/MailScanner this cures the >problem. > >Also - is it still a good idea to set LANG=en_GB in >/etc/rc.d/init.d/MailScanner to speed up SpamAssassin under RH8/9 due to the >UTF-8 issues??? > >Regards, >Steve. > > >-----Original Message----- >From: Steve Freegard [mailto:steve.freegard@lbsltd.co.uk] >Sent: 28 April 2003 19:56 >To: MAILSCANNER@jiscmail.ac.uk > >Hi All, > >I thought I'd give the sophossavi interface a try - after doing so, I was >tailing the maillog and noticed that MailScanner was spawning a new child >process every 10-20 seconds or so, and that I had several defunct processes >showing up when doing a 'ps axww'. > >I put MailScanner into debug mode and ran it by hand and realised that it >was segfaulting. > >Here is the last few lines of an strace: > >[root@hoshi root]# strace /usr/sbin/MailScanner >/etc/MailScanner/MailScanner.con >f ><> >mprotect(0x40618000, 978944, PROT_READ|PROT_EXEC) = 0 >open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 5 >fstat64(5, {st_mode=S_IFREG|0644, st_size=21040, ...}) = 0 >mmap2(NULL, 21040, PROT_READ, MAP_SHARED, 5, 0) = 0x40428000 >close(5) = 0 >futex(0x42130d84, FUTEX_WAKE, 2147483647, NULL) = 0 >brk(0) = 0x92fa000 >brk(0x92fb000) = 0x92fb000 >open("/etc/sav.conf", O_RDONLY) = 5 >fstat64(5, {st_mode=S_IFREG|0644, st_size=49, ...}) = 0 >mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = >0x40 >145000 >read(5, "SAV virus data directory = /usr/"..., 4096) = 49 >read(5, "", 4096) = 0 >close(5) = 0 >munmap(0x40145000, 4096) = 0 >time(NULL) = 1051555427 >open("/tmp/76630000.$$$", O_RDWR|O_CREAT|O_EXCL, 0600) = 5 >close(5) = 0 >open("/tmp/76630000.$$$", O_RDWR) = 5 >write(5, "\0", 1) = 1 >close(5) = 0 >rmdir("/tmp/76630000.$$$") = -1 ENOTDIR (Not a directory) >unlink("/tmp/76630000.$$$") = 0 >--- SIGSEGV (Segmentation fault) @ 0 (0) --- >+++ killed by SIGSEGV +++ ><> > >I confirmed that it is SAVI-Perl causing it by changing back to regular >sophos scanning which then stops the segfault. > >I'm running this on a Compaq Proliant DL360 1x933Mhz 512Mb RAM running >RedHat 9, MailScanner 4.14-9, Sophos 3.67 and ClamAV 0.54 > >Anyone else had a similar problem or know how to fix this?? > >Kind regards, > > >Steve > >-- >Steve Freegard >Systems Manager >Littlehampton Book Services Ltd. > > >********************************************************************** >This email and any files transmitted with it are confidential and >intended solely for the use of the individual or entity to whom they >are addressed. If you have received this email in error please notify >the system manager. > >This footnote also confirms that this email message has been swept by >MIMEsweeper for the presence of computer viruses. > >www.lbsltd.co.uk >********************************************************************** -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 17:03:45 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Debugging Spamassassin In-Reply-To: <1051625766.3eae8926aa212@webmail.MUW.Edu> References: Message-ID: <5.2.1.1.2.20030429170255.0281cc98@imap.ecs.soton.ac.uk> At 15:16 29/04/2003, you wrote: >Hi, > >Running "spamassassin -D --lint", one of the output lines looks like this: >debug: bayes corpus size: nspam = 14120, nham = 20635 >What does "corpus" mean? is nspam means number of spam detected by SA so far? >Or, spam learned so far? Spam (and non-spam) learned so far. >Finally, can I safely delete *.db files in my /var/spool/spamassassin? >The time stamp on those files never changed for 2 months: Yes. You are now using the DB format that doesn't put ".db" on the end of the filenames. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 16:57:21 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: something else but SpamAssassin In-Reply-To: References: <5.2.0.9.2.20030428143753.02d1d870@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428143753.02d1d870@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030429165652.03dfbdd8@imap.ecs.soton.ac.uk> At 08:43 29/04/2003, you wrote: >On Mon, 28 Apr 2003 14:40:03 +0100, you wrote: > > >If possible, I would like to be able to avoid calling another executable > >and piping a message into it. But if they have to go down that route, there > >must at the very least be a means of giving it multiple messages. Starting > >up a program for every single message will be very slow. > >Would it be possible to put the messages in a separate directory and >have the scanner process that directory? A bit like virusscanners. I would like to avoid having to write out all the messages to disk for the spam processing if at all possible. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 17:00:34 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: whitelist In-Reply-To: <20030429112722.GA28801@quadstone.com> Message-ID: <5.2.1.1.2.20030429165951.0282fbe8@imap.ecs.soton.ac.uk> At 12:27 29/04/2003, you wrote: >If I add an entry to the whitelist file, do I need to restart MailScanner >before it sees this change? You need to at least "reload" it. Otherwise it will be read the next time MailScanner restarts itself (see "Restart Every" in MailScanner.conf). -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 16:56:14 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Clam ... In-Reply-To: Message-ID: <5.2.1.1.2.20030429165551.022d7e80@imap.ecs.soton.ac.uk> At 07:40 29/04/2003, you wrote: >Julian, > >Is it possible to also detect if clam is updated ? > >Currently i get in the logs: > >Apr 29 03:01:01 vmx01 update.virus.scanners: Found clamav installed >Apr 29 03:01:01 vmx01 update.virus.scanners: Updating clamav >Apr 29 03:01:01 vmx01 ClamAV-autoupdate[11488]: ClamAV updated >Apr 29 03:01:01 vmx01 update.virus.scanners: Found f-prot installed >Apr 29 03:01:01 vmx01 update.virus.scanners: Updating f-prot >Apr 29 03:01:02 vmx01 F-Prot autoupdate[11496]: F-Prot did not need updating. > >But in fact Clam isnt updated...Its telling this hourly: > >Apr 29 04:01:01 vmx01 update.virus.scanners: Found clamav installed >Apr 29 04:01:01 vmx01 update.virus.scanners: Updating clamav >Apr 29 04:01:01 vmx01 ClamAV-autoupdate[13518]: ClamAV updated >Apr 29 04:01:01 vmx01 update.virus.scanners: Found f-prot installed >Apr 29 04:01:01 vmx01 update.virus.scanners: Updating f-prot >Apr 29 04:01:02 vmx01 F-Prot autoupdate[13526]: F-Prot did not need updating. > >Is the script reporting this ok ? Since i think its defaulting to the >'ClamAV updated' all the time, even when its not updated. > >I saw in the auto update script of f-prot some checking, but not in the >one for Clam, is it posible to do the same there ? Not sure. Take a look at the clam autoupdate script and see what you think. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 16:55:15 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Reporting quirqs In-Reply-To: Message-ID: <5.2.1.1.2.20030429165428.022d7d40@imap.ecs.soton.ac.uk> At 07:14 29/04/2003, you wrote: >Hi! > >I got a virus mailed myself, and noticed this: > >Warning: This message has had one or more attachments removed >Warning: (LGKJPCLG.EXE, ClamAV: LGKJPCLG.EXE). >Warning: Please read the "VirusWarning.txt" attachment(s) for more >information. > > >This is a message from the MailScanner E-Mail Virus Protection Service >---------------------------------------------------------------------- >The original e-mail attachment "LGKJPCLG.EXE" >was believed to be infected by a virus and has been replaced by this >warning >message. > >If you wish to receive a copy of the *infected* attachment, please >e-mail helpdesk and include the whole of this message >in your request. Alternatively, you can call them, with >the contents of this message to hand when you call. > >At Time::tm=ARRAY(0x90952b4) the virus scanner said: > F-Prot: LGKJPCLG.EXE Infection: W32/Hybris.worm.B > Executable DOS/Windows programs are dangerous in email (LGKJPCLG.EXE) > >The 'At Time::' isnt right it seems :) >Its with MailScanner-4.15-9, f-prot and clamav. I've already fixed that. >It also looks strange that the inline warning tells ClamAV: and the >attachment only tells about f-prot ... Now that is curious. Anyone else seen it? -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 17:01:58 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Spamassassin config In-Reply-To: Message-ID: <5.2.1.1.2.20030429170143.0281cde8@imap.ecs.soton.ac.uk> This will be in the next release, due later this week. At 14:25 29/04/2003, you wrote: >Can you please clarify the "Advanced SpamAssassin Settings" in >MailScanner.conf? Perhaps point me to a link or thread that describes >it? > > I did a search in the mailing list archives and didn't find anything >but this thread. I don't see any reference to this in the documentation >or in my stock MailScanner 414-9 configuration file. I recently moved to >414-9 and have been using the "superceded" options in >spam.assassin.prefs.conf to move the bayes database and set the >permissions. > >Nathan > >-----Original Message----- >From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] >Sent: Monday, April 28, 2003 1:45 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Spamassassin config > > >Fixed. > >Whoever wrote that page might want to improve it by adding a mention of >the >"Advanced SpamAssassin Settings" parameters in MailScanner.conf. > >At 22:01 28/04/2003, you wrote: > >Hi, > > > > > Done. > > > I've also added a comment saying that this has pretty much been >superceded > > > by the "Advanced SpamAssassin Settings" in MailScanner.conf. > > > >Is it possible to update this FAQ page: > > > >http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/102.html > > > >Following it, I have this setup now: > > > >/var/spool/spamassassin/baspam.assassin.prefs.confyes_journal > >/var/spool/spamassassin/baspam.assassin.prefs.confyes_msgcount > >/var/spool/spamassassin/baspam.assassin.prefs.confyes_seen > >/var/spool/spamassassin/baspam.assassin.prefs.confyes_toks > > > >Thank you > >Marco > > > >_________________________________________________________________ > >This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail > >For the latest MUW Events, visit http://www.MUW.Edu/calendar > >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mkettler at EVI-INC.COM Tue Apr 29 17:02:22 2003 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:17:53 2006 Subject: Debugging Spamassassin In-Reply-To: <1051625766.3eae8926aa212@webmail.MUW.Edu> References: Message-ID: <5.2.0.9.0.20030429115616.01882dd0@xanadu.evi-inc.com> At 09:16 AM 4/29/2003 -0500, Marco Obaid wrote: >Hi, > >Running "spamassassin -D --lint", one of the output lines looks like this: >debug: bayes corpus size: nspam = 14120, nham = 20635 >What does "corpus" mean? is nspam means number of spam detected by SA so far? >Or, spam learned so far? That's in the context of the bayes engine, so it's strictly the number of spam and nonspam (ham) learned, not the total processed. (SA only auto-learns at more extreme scores than the general spam/nonspam threshold.) >Finally, can I safely delete *.db files in my /var/spool/spamassassin? >The time stamp on those files never changed for 2 months: > >-rw------- 1 root root 134324224 Feb 10 00:17 auto-whitelist.db >-rw-r--r-- 1 root root 103570 Apr 29 09:06 bayes_journal >-rw-r--r-- 1 root root 361 Apr 29 09:06 bayes_msgcount >-rw------- 1 root root 2613248 Apr 29 09:06 bayes_seen >-rw------- 1 root root 327680 Feb 25 08:28 bayes_seen.db >-rw-r--r-- 1 root root 3895296 Apr 29 09:06 bayes_toks >-rw------- 1 root root 8720384 Feb 25 08:28 bayes_toks.db >-rw-r--r-- 1 root root 1218 Apr 27 18:45 user_prefs All of the those files (except user_prefs) can safely be deleted if you make sure to shut down any SA processes first. Those files are really only used to store data about the past trends of email SA has seen, so if they are deleted, it will build new ones from a clean slate. Worst case here is you loose your bayes training. However user_prefs is not dynamically generated. But if you're calling SA via MailScanner it doesn't use a user_prefs and instead uses it's own spam.assassin.prefs.conf. So you might want to look at user_prefs, but the rest of the files are just state data for the auto-whitelist (something you should NOT use with mailscanner without thinking about the implications of score smearing) and the bayes tokenizer. From brian at UNEARTHED.ORG Tue Apr 29 17:25:50 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:53 2006 Subject: Reporting quirqs References: Message-ID: <008101c30e6c$c7936b90$bc01020a@brianmay> It also happens with F-Secure, Nod32, and ClamAV .. so it's definitely ClamAV.. ----- Original Message ----- From: "Raymond Dijkxhoorn" To: Sent: Tuesday, April 29, 2003 6:14 AM Subject: Re: Reporting quirqs Hi! > And I can confirm this too with Clam and McAfee. Maybe Clam is the cause? All i can say is i didnt have this with f-prot only ... :) Bye, Raymond. From brian at UNEARTHED.ORG Tue Apr 29 17:35:29 2003 From: brian at UNEARTHED.ORG (Brian May) Date: Thu Jan 12 21:17:53 2006 Subject: Clam ... References: <5.2.1.1.2.20030429165551.022d7e80@imap.ecs.soton.ac.uk> Message-ID: <008801c30e6d$5cc5b1f0$bc01020a@brianmay> No matter what, it will say that ClamAV has been updated.. if (-x $ClamUpdateCommand) { &LockClamAV(); $Command = "$ClamUpdateCommand --quiet -l $LogFile"; $Command .= " --http-proxy $HTTPproxy" if $HTTPproxy; system($Command); &UnlockClamAV(); Sys::Syslog::syslog('info', "ClamAV updated"); } else { Sys::Syslog::syslog('err', "ClamAV updater $ClamUpdateCommand cannot be run"); } Here is a No update needed output from freshclam.. I'd write something, but I don't have the time at the moment: [root@athena MailScanner]# freshclam Checking for a new database - started at Tue Apr 29 09:34:31 2003 Current working dir is /usr/local/share/clamav Connected to clamav.elektrapro.com. Reading md5 sum (viruses.md5): OK viruses.db is up to date. Reading md5 sum (viruses2.md5): OK viruses.db2 is up to date. ----- Original Message ----- From: "Julian Field" To: Sent: Tuesday, April 29, 2003 8:56 AM Subject: Re: Clam ... At 07:40 29/04/2003, you wrote: >Julian, > >Is it possible to also detect if clam is updated ? > >Currently i get in the logs: > >Apr 29 03:01:01 vmx01 update.virus.scanners: Found clamav installed >Apr 29 03:01:01 vmx01 update.virus.scanners: Updating clamav >Apr 29 03:01:01 vmx01 ClamAV-autoupdate[11488]: ClamAV updated >Apr 29 03:01:01 vmx01 update.virus.scanners: Found f-prot installed >Apr 29 03:01:01 vmx01 update.virus.scanners: Updating f-prot >Apr 29 03:01:02 vmx01 F-Prot autoupdate[11496]: F-Prot did not need updating. > >But in fact Clam isnt updated...Its telling this hourly: > >Apr 29 04:01:01 vmx01 update.virus.scanners: Found clamav installed >Apr 29 04:01:01 vmx01 update.virus.scanners: Updating clamav >Apr 29 04:01:01 vmx01 ClamAV-autoupdate[13518]: ClamAV updated >Apr 29 04:01:01 vmx01 update.virus.scanners: Found f-prot installed >Apr 29 04:01:01 vmx01 update.virus.scanners: Updating f-prot >Apr 29 04:01:02 vmx01 F-Prot autoupdate[13526]: F-Prot did not need updating. > >Is the script reporting this ok ? Since i think its defaulting to the >'ClamAV updated' all the time, even when its not updated. > >I saw in the auto update script of f-prot some checking, but not in the >one for Clam, is it posible to do the same there ? Not sure. Take a look at the clam autoupdate script and see what you think. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 17:48:23 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Clam ... In-Reply-To: <008801c30e6d$5cc5b1f0$bc01020a@brianmay> References: <5.2.1.1.2.20030429165551.022d7e80@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030429174754.03e5bec8@imap.ecs.soton.ac.uk> Can someone quickly take a look at freshclam and see if it returns a different exit code if everything was up to date? At 17:35 29/04/2003, you wrote: >No matter what, it will say that ClamAV has been updated.. > > >if (-x $ClamUpdateCommand) { > &LockClamAV(); > $Command = "$ClamUpdateCommand --quiet -l $LogFile"; > $Command .= " --http-proxy $HTTPproxy" if $HTTPproxy; > system($Command); > &UnlockClamAV(); > Sys::Syslog::syslog('info', "ClamAV updated"); >} else { > Sys::Syslog::syslog('err', > "ClamAV updater $ClamUpdateCommand cannot be run"); >} > > >Here is a No update needed output from freshclam.. I'd write something, but >I don't have the time at the moment: > >[root@athena MailScanner]# freshclam >Checking for a new database - started at Tue Apr 29 09:34:31 2003 >Current working dir is /usr/local/share/clamav >Connected to clamav.elektrapro.com. >Reading md5 sum (viruses.md5): OK >viruses.db is up to date. >Reading md5 sum (viruses2.md5): OK >viruses.db2 is up to date. > >----- Original Message ----- >From: "Julian Field" >To: >Sent: Tuesday, April 29, 2003 8:56 AM >Subject: Re: Clam ... > > >At 07:40 29/04/2003, you wrote: > >Julian, > > > >Is it possible to also detect if clam is updated ? > > > >Currently i get in the logs: > > > >Apr 29 03:01:01 vmx01 update.virus.scanners: Found clamav installed > >Apr 29 03:01:01 vmx01 update.virus.scanners: Updating clamav > >Apr 29 03:01:01 vmx01 ClamAV-autoupdate[11488]: ClamAV updated > >Apr 29 03:01:01 vmx01 update.virus.scanners: Found f-prot installed > >Apr 29 03:01:01 vmx01 update.virus.scanners: Updating f-prot > >Apr 29 03:01:02 vmx01 F-Prot autoupdate[11496]: F-Prot did not need >updating. > > > >But in fact Clam isnt updated...Its telling this hourly: > > > >Apr 29 04:01:01 vmx01 update.virus.scanners: Found clamav installed > >Apr 29 04:01:01 vmx01 update.virus.scanners: Updating clamav > >Apr 29 04:01:01 vmx01 ClamAV-autoupdate[13518]: ClamAV updated > >Apr 29 04:01:01 vmx01 update.virus.scanners: Found f-prot installed > >Apr 29 04:01:01 vmx01 update.virus.scanners: Updating f-prot > >Apr 29 04:01:02 vmx01 F-Prot autoupdate[13526]: F-Prot did not need >updating. > > > >Is the script reporting this ok ? Since i think its defaulting to the > >'ClamAV updated' all the time, even when its not updated. > > > >I saw in the auto update script of f-prot some checking, but not in the > >one for Clam, is it posible to do the same there ? > >Not sure. Take a look at the clam autoupdate script and see what you think. >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From Kevin.Spicer at BMRB.CO.UK Tue Apr 29 17:51:38 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:53 2006 Subject: Clam ... Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF551@pascal.priv.bmrb.co.uk> RETURN CODES 0 : Database succesfully updated. 1 : Database is up-to-date. [then some error codes] according to man freshclam BUT it doesn't seem to actually do that! Seems to return zero whether it updates or not. > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: 29 April 2003 17:48 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Clam ... > > > Can someone quickly take a look at freshclam and see if it returns a > different exit code if everything was up to date? > > At 17:35 29/04/2003, you wrote: > >No matter what, it will say that ClamAV has been updated.. > > > > > >if (-x $ClamUpdateCommand) { > > &LockClamAV(); > > $Command = "$ClamUpdateCommand --quiet -l $LogFile"; > > $Command .= " --http-proxy $HTTPproxy" if $HTTPproxy; > > system($Command); > > &UnlockClamAV(); > > Sys::Syslog::syslog('info', "ClamAV updated"); > >} else { > > Sys::Syslog::syslog('err', > > "ClamAV updater $ClamUpdateCommand > cannot be run"); > >} > > > > > >Here is a No update needed output from freshclam.. I'd > write something, but > >I don't have the time at the moment: > > > >[root@athena MailScanner]# freshclam > >Checking for a new database - started at Tue Apr 29 09:34:31 2003 > >Current working dir is /usr/local/share/clamav > >Connected to clamav.elektrapro.com. > >Reading md5 sum (viruses.md5): OK > >viruses.db is up to date. > >Reading md5 sum (viruses2.md5): OK > >viruses.db2 is up to date. > > > >----- Original Message ----- > >From: "Julian Field" > >To: > >Sent: Tuesday, April 29, 2003 8:56 AM > >Subject: Re: Clam ... > > > > > >At 07:40 29/04/2003, you wrote: > > >Julian, > > > > > >Is it possible to also detect if clam is updated ? > > > > > >Currently i get in the logs: > > > > > >Apr 29 03:01:01 vmx01 update.virus.scanners: Found clamav installed > > >Apr 29 03:01:01 vmx01 update.virus.scanners: Updating clamav > > >Apr 29 03:01:01 vmx01 ClamAV-autoupdate[11488]: ClamAV updated > > >Apr 29 03:01:01 vmx01 update.virus.scanners: Found f-prot installed > > >Apr 29 03:01:01 vmx01 update.virus.scanners: Updating f-prot > > >Apr 29 03:01:02 vmx01 F-Prot autoupdate[11496]: F-Prot did not need > >updating. > > > > > >But in fact Clam isnt updated...Its telling this hourly: > > > > > >Apr 29 04:01:01 vmx01 update.virus.scanners: Found clamav installed > > >Apr 29 04:01:01 vmx01 update.virus.scanners: Updating clamav > > >Apr 29 04:01:01 vmx01 ClamAV-autoupdate[13518]: ClamAV updated > > >Apr 29 04:01:01 vmx01 update.virus.scanners: Found f-prot installed > > >Apr 29 04:01:01 vmx01 update.virus.scanners: Updating f-prot > > >Apr 29 04:01:02 vmx01 F-Prot autoupdate[13526]: F-Prot did not need > >updating. > > > > > >Is the script reporting this ok ? Since i think its > defaulting to the > > >'ClamAV updated' all the time, even when its not updated. > > > > > >I saw in the auto update script of f-prot some checking, > but not in the > > >one for Clam, is it posible to do the same there ? > > > >Not sure. Take a look at the clam autoupdate script and see > what you think. > >-- > >Julian Field > >www.MailScanner.info > >Professional Support Services at www.MailScanner.biz > >MailScanner thanks transtec Computers for their support > > -- > Julian Field > www.MailScanner.info > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From jase at SENSIS.COM Tue Apr 29 17:52:59 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:53 2006 Subject: Reporting quirqs Message-ID: > >It also looks strange that the inline warning tells ClamAV: and the > >attachment only tells about f-prot ... > > Now that is curious. Anyone else seen it? Yes, I'm seeing it with ClamAV and McAfee. I think I mentioned something like this before too. (After searching the archives) http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A2=ind0304&L=mailscanner&T=0&F=&S=& P=12603 Jason From mailscanner at ecs.soton.ac.uk Tue Apr 29 17:52:53 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Reporting quirqs In-Reply-To: <008101c30e6c$c7936b90$bc01020a@brianmay> References: Message-ID: <5.2.1.1.2.20030429175157.023a2a28@imap.ecs.soton.ac.uk> Fixed. Please apply this patch to /usr/lib/MailScanner/MailScanner/SweepViruses.pm : --- SweepViruses.pm Sat Apr 26 10:55:57 2003 +++ SweepViruses.pm.new Tue Apr 29 17:54:29 2003 @@ -1692,7 +1692,7 @@ if (/^(.*?): (.*) FOUND$/) { - my ($file, $subfile, $virus, $report); + my ($file, $subfile, $virus, $report, $ReportStart); $virus = $2; if ($clamav_archive) { @@ -1709,8 +1709,9 @@ $file =~ s/^\.\///; my ($id,$part) = split /\//, $file, 2; - $part = $Name . ': ' . $part if $Name; - $infections->{"$id"}{"$part"} .= "$part contains $virus $report\n"; + $ReportStart = $part; + $ReportStart = $Name . ': ' . $ReportStart if $Name; + $infections->{"$id"}{"$part"} .= "$ReportStart contains $virus $report\n"; $types->{"$id"}{"$part"} .= "v"; return 1; } This patch will obviously be included in the next release. At 17:25 29/04/2003, you wrote: >It also happens with F-Secure, Nod32, and ClamAV .. so it's definitely >ClamAV.. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From rich at MAIL.WVNET.EDU Tue Apr 29 18:10:52 2003 From: rich at MAIL.WVNET.EDU (Richard Lynch) Date: Thu Jan 12 21:17:53 2006 Subject: Clam ... In-Reply-To: <5.2.1.1.2.20030429174754.03e5bec8@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030429165551.022d7e80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429174754.03e5bec8@imap.ecs.soton.ac.uk> Message-ID: <1051636252.1454.30.camel@localhost.localdomain> On Tue, 2003-04-29 at 12:48, Julian Field wrote: > Can someone quickly take a look at freshclam and see if it returns a > different exit code if everything was up to date? > On RH9, I get ... freshclam -V freshclam / ClamAV version 20030320 When an update has been applied... freshclam echo $? 0 When already updated... freshclam echo $? 1 -- Richard Lynch From nerijus at USERS.SOURCEFORGE.NET Tue Apr 29 18:21:30 2003 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:17:53 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <1051570427.18171.100.camel@nerijus> References: <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> Message-ID: <1051636890.18171.169.camel@nerijus> Hello, So I want to ask the same question again - what was done to fix a problem with F-Secure 4.50, which as I understand also needs full path and not just '.'? If workaround was to pass the full path, the same should be done for kavdaemon client, and it should work then. If not, maybe something like a fix for f-prot with tmpfs could be used? It would be nice if it were fixed in the next release. Regards, Nerijus From mailscanner at ecs.soton.ac.uk Tue Apr 29 18:40:14 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <1051636890.18171.169.camel@nerijus> References: <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> Message-ID: <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> What version of the AvpDaemonClient are you using? There appear to be about 3 different versions of it shipped with F-Secure 4.50, some of which actually work. I took a fresh copy of F-Secure 4.50 and built all the AvpDaemonClients. I copied the one from the Sample1 directory to /usr/local/bin, and have run that over a tree of directories, some of which can contain viruses. Run as cd /root/q AvpDaemonClient . works fine. It doesn't need the full pathname. Here is a chunk of the output from it: >Current object: ./eicars/dfh3MENF6X020229 >Test result: 4 >Known viruses were detected >Found viruses: ./eicars/dfh3MENF6X020229 archive: Mail >./eicars/dfh3MENF6X020229/bugbear.zip archive: ZIP >./eicars/dfh3MENF6X020229/bugbear.zip/iframeandbugbear password protected. >./eicars/dfh3MENF6X020229/eicar.com infected: EICAR-Test-File >./eicars/dfh3MENF6X020229/eicar.zip archive: ZIP >./eicars/dfh3MENF6X020229/eicar.zip/eicar.com infected: EICAR-Test-File Please can you work out why yours doesn't work the same way as mine? If you just run the command "AvpDaemonClient ." then please do a "which AvpDaemonClient" to check where it is actually getting it from. At 18:21 29/04/2003, you wrote: >Hello, > >So I want to ask the same question again - what was done to fix a >problem with F-Secure 4.50, which as I understand also needs full path >and not just '.'? If workaround was to pass the full path, the same >should be done for kavdaemon client, and it should work then. If not, >maybe something like a fix for f-prot with tmpfs could be used? It would >be nice if it were fixed in the next release. > >Regards, >Nerijus -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From kevins at BMRB.CO.UK Tue Apr 29 20:36:56 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:53 2006 Subject: Clam ... In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB00117510D@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB00117510D@pascal.priv.bmrb.co.uk> Message-ID: <1051645019.3966.29.camel@bach.kevinspicer.co.uk> When an update has been applied... freshclam echo $? 0 When already updated... freshclam echo $? 1 That isn't the behaviour I saw with 0.54 the current stable version - despite promises to the contrary from the man page. Just to clarify the confusion I've just done a little testing... 0.54 (either the source distribution or the Mandrake rpm) return status doesn't work. snapshot 20030424 (source) works correctly as above. Given that you are using the oldest available snapshot and I the latest I think its fair to assume this is fixed in all the snapshots and should be working in the next version. Attached is a patch which my limited testing suggest works with snapshot versions of freshclam, and preserves the existing behavior with older versions. -- Richard Lynch BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. -------------- next part -------------- A non-text attachment was scrubbed... Name: clamav-autoupdate.diff Type: text/x-diff Size: 768 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030429/48d0e8a6/clamav-autoupdate.bin From mailscanner at ecs.soton.ac.uk Tue Apr 29 20:55:59 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Clam ... In-Reply-To: <1051645019.3966.29.camel@bach.kevinspicer.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB00117510D@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB00117510D@pascal.priv.bmrb.co.uk> Message-ID: <5.2.1.1.2.20030429205537.03e40800@imap.ecs.soton.ac.uk> Thanks for that. Will be in the next release. At 20:36 29/04/2003, you wrote: >When an update has been applied... > >freshclam >echo $? >0 > >When already updated... > >freshclam >echo $? >1 > >That isn't the behaviour I saw with 0.54 the current stable version - >despite promises to the contrary from the man page. >Just to clarify the confusion I've just done a little testing... > >0.54 (either the source distribution or the Mandrake rpm) return status >doesn't work. > >snapshot 20030424 (source) works correctly as above. > >Given that you are using the oldest available snapshot and I the latest >I think its fair to assume this is fixed in all the snapshots and should >be working in the next version. > >Attached is a patch which my limited testing suggest works with snapshot >versions of freshclam, and preserves the existing behavior with older >versions. > >-- >Richard Lynch > > > > > >BMRB International >http://www.bmrb.co.uk >+44 (0)20 8566 5000 >_________________________________________________________________ >This message (and any attachment) is intended only for the >recipient and may contain confidential and/or privileged >material. If you have received this in error, please contact the >sender and delete this message immediately. Disclosure, copying >or other action taken in respect of this email or in >reliance on it is prohibited. BMRB International Limited >accepts no liability in relation to any personal emails, or >content of any email which does not directly relate to our >business. > > -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From hden at KCBBS.GEN.NZ Tue Apr 29 21:09:05 2003 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> Message-ID: <20030429200905.GA17587@mew.kcbbs.gen.nz> On Tue, Apr 29, 2003 at 04:53:56PM +0100, Julian Field wrote: > At 04:06 29/04/2003, you wrote: > >On Sat, 26 Apr 2003 23:50:49 -0700, Daniel Kleinsinger > > wrote: > > > >>>> Apr 25 17:52:05 nts-2 MailScanner[4739]: MailScanner child dying of > >>>> old age [SNIP] > > > >>So I then changed Minimum Code Status from supported to beta and, > >>surprise surprise, it started working. I then reverted to the unpatched > >>SweepViruses.pm, leaving MCS at beta, and the old error came back. > >> [SNIP] > >Are > >the changes made by the patch incorperated into the latest BETA or next > >release by any chance? > > If you let me know what distribution you are using, I'll point you at the > very latest code. RE: sophossavi.. 1st, Thanks for the pointer to the code status setting. I'm using 4:14-9 for Redhat Linus, on RedHat 8, using the latest (May) sophos SW and IDE's Cheers! Hendrik From Richard.Lush at HP.COM Tue Apr 29 21:24:12 2003 From: Richard.Lush at HP.COM (Lush, Richard) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show Message-ID: <13095CFC38D38E418844A18124E8EC77087702@sdcexcea01.emea.cpqcorp.net> I was there today as well. I had one "salesman" tell me mail came in on port 28 :-) I can honestly say that there is only one product there that looked any good and that was MailMarshall. Even then it did fully supply what MailScanner can. I was amazed to see that about 70% of the stands there were to do with spam and email antivirus. A stand for MailScanner next year then Julian??? Richard -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: 29 April 2003 15:44 To: MAILSCANNER@JISCMAIL.AC.UK I have just the day (well, quite enough of it!) at the "Info Security" show in London. I decided to do the rounds of the show on the premise that I wanted to buy an email anti-virus, and particularly anti-spam, system. I have had demos from loads of salesmen trying to flog me their systems. And my overwhelming response has to be "What a pathetic bunch of products". That's the version you can tell your mother-in-law, anyway :-) They have really sophisticated traps like "the From: domain doesn't match the envelope sender domain" and make a big thing of it. Useful until one of your users joins a mailing list... The really advanced products have thinly (or sometimes not at all!) disguised copies of DCC. I didn't see one product that could talk to Razor2 and DCC. RBL's are quite popular, probably because they are so easy to use. No-one had a decent response to "what happens to your incoming mail feed speed if one of the RBL's goes down?". The standard line to that was "well, you can't avoid human intervention completely". In other words, your incoming mail feed would slow to a crawl waiting for every DNS timeout for every message. I even got them to admit that was exactly what would happen. No product I was shown implemented any decent set of heuristic rules. One or two had the ability to enter regular expressions and give a simple score to each one. But you had to write all the rules yourself, and they only supported 10 rules at most. 1 had a Bayes engine, but it had to be manually trained with spam. It would auto-learn on the assumption that all your outgoing mail was not spam. Which is better than nothing, until one of your systems inside gets hacked and used as a spam relay, at which point your entire bayes database is destroyed by being given spam it assumed was non-spam. And a couple of them gave me price quotes. These were both "appliances", i.e. PC's in 1U boxes. One company wanted $56,000 plus the cost of an anti-virus engine (they only supported a choice of 2). The other one charged ?20,000 (approx $32,000) for the basic unit, and you then paid them several thousands of ? for each of their "modules" on top of that. I hope there are at least 1 or 2 decent commercial products in this market, but I sure didn't see them today, and all the big players were there. We need to spread the word! Which brings me onto my next posting. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 21:26:19 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <20030429200905.GA17587@mew.kcbbs.gen.nz> References: <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> At 21:09 29/04/2003, you wrote: >On Tue, Apr 29, 2003 at 04:53:56PM +0100, Julian Field wrote: > > At 04:06 29/04/2003, you wrote: > > >On Sat, 26 Apr 2003 23:50:49 -0700, Daniel Kleinsinger > > > wrote: > > > > > >>>> Apr 25 17:52:05 nts-2 MailScanner[4739]: MailScanner child dying of > > >>>> old age [SNIP] > > > > > >>So I then changed Minimum Code Status from supported to beta and, > > >>surprise surprise, it started working. I then reverted to the unpatched > > >>SweepViruses.pm, leaving MCS at beta, and the old error came back. > > >> [SNIP] > > > >Are > > >the changes made by the patch incorperated into the latest BETA or next > > >release by any chance? > > > > If you let me know what distribution you are using, I'll point you at the > > very latest code. > > RE: sophossavi.. > > 1st, Thanks for the pointer to the code status setting. > > I'm using 4:14-9 for Redhat Linus, on RedHat 8, using the latest (May) > sophos SW and > IDE's You are welcome to try 4.15-10 which is at http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.15-10.rpm.tar If you just upgrade the "mailscanner*rpm" (you don't need to bother with any of the others) and then run the "upgrade_MailScanner_conf" script to do the rest, that should be all that is needed. Then "service MailScanner restart" and you will be running the new code. This should fix the problem. Please let me know how you get on. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 21:36:59 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show In-Reply-To: <13095CFC38D38E418844A18124E8EC77087702@sdcexcea01.emea.cpq corp.net> Message-ID: <5.2.1.1.2.20030429213311.023e88d0@imap.ecs.soton.ac.uk> At 21:24 29/04/2003, you wrote: >I was there today as well. I had one "salesman" tell me mail came in on >port 28 :-) That doesn't surprise me... >I can honestly say that there is only one product there that looked any >good and that was MailMarshall. Even then it did fully supply what >MailScanner can. Did you mean that, or did you skip a word? > I was amazed to see that about 70% of the stands there were to do with > spam and email antivirus. I would have stayed for the demo, but the fake log cabin and the Stetson hats were just too much for me. Worthy of a used-car salesman on a bad day :) >A stand for MailScanner next year then Julian??? Slight snag there: marketing budget ;-) >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: 29 April 2003 15:44 >To: MAILSCANNER@JISCMAIL.AC.UK > >I have just the day (well, quite enough of it!) at the "Info Security" >show in London. >I decided to do the rounds of the show on the premise that I wanted to buy >an email anti-virus, and particularly anti-spam, system. >I have had demos from loads of salesmen trying to flog me their systems. > >And my overwhelming response has to be "What a pathetic bunch of products". >That's the version you can tell your mother-in-law, anyway :-) > >They have really sophisticated traps like "the From: domain doesn't match >the envelope sender domain" and make a big thing of it. Useful until one >of your users joins a mailing list... > >The really advanced products have thinly (or sometimes not at all!) >disguised copies of DCC. I didn't see one product that could talk to >Razor2 and DCC. RBL's are quite popular, probably because they are so easy >to use. >No-one had a decent response to "what happens to your incoming mail feed >speed if one of the RBL's goes down?". The standard line to that was >"well, you can't avoid human intervention completely". In other words, >your incoming mail feed would slow to a crawl waiting for every DNS >timeout for every message. I even got them to admit that was exactly what >would happen. > >No product I was shown implemented any decent set of heuristic rules. One >or two had the ability to enter regular expressions and give a simple >score to each one. But you had to write all the rules yourself, and they >only supported 10 rules at most. > >1 had a Bayes engine, but it had to be manually trained with spam. It >would auto-learn on the assumption that all your outgoing mail was not spam. >Which is better than nothing, until one of your systems inside gets hacked >and used as a spam relay, at which point your entire bayes database is >destroyed by being given spam it assumed was non-spam. > >And a couple of them gave me price quotes. These were both "appliances", >i.e. PC's in 1U boxes. One company wanted $56,000 plus the cost of an >anti-virus engine (they only supported a choice of 2). The other one >charged ?20,000 (approx $32,000) for the basic unit, and you then paid >them several thousands of ? for each of their "modules" on top of that. > >I hope there are at least 1 or 2 decent commercial products in this >market, but I sure didn't see them today, and all the big players were there. > >We need to spread the word! > >Which brings me onto my next posting. >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz MailScanner thanks >transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From kevins at BMRB.CO.UK Tue Apr 29 21:42:06 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0011750F9@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0011750F9@pascal.priv.bmrb.co.uk> Message-ID: <1051648927.3966.42.camel@bach.kevinspicer.co.uk> FWIW The main argument I hear for moving to a commercial product is the 'content filtering' that some of the commercial products claim to do. The main reasons for this being HR & legal related (not just porn but also profanity, and prevention of information leakage - quite how that could be achieved with any degree or certainty). I know all about the striphtml action, but that alone isn't seen as being enough. The other 'essential requirement' of a content filtering is detailed reporting. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From kevins at BMRB.CO.UK Tue Apr 29 21:47:22 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175115@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175115@pascal.priv.bmrb.co.uk> Message-ID: <1051649242.3966.48.camel@bach.kevinspicer.co.uk> >A stand for MailScanner next year then Julian??? Slight snag there: marketing budget ;-) The linux user expo in Birmingham next month seems to have a sizable community presence,, I don't know whether they're offering free space?? http://www.linuxuser.co.uk/expo/index.php?module=ContentExpress&func=display&ceid=11 if you want to check it out;) Bit of a trek from Southampton though. :( BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mailscanner at LISTS.COM.AR Tue Apr 29 21:48:14 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:53 2006 Subject: SpamAssassin Install Prefix Message-ID: <3EAEBADE.6651.148B3AD7@localhost> Hi Julian, I installed SpamAssassin in an unusual place (say... /opt/SpamAssassin), configured it in the options like: SpamAssassin Install Prefix = /opt/SpamAssassin and it didn't work... browsing the log I see repeatedly: Apr 29 17:29:20 alerce2-or Alerce-MX[17638]: MailScanner E-Mail Virus Scanner version 4.15-9 starting... Apr 29 17:29:20 alerce2-or Alerce-MX[17638]: SpamAssassin installation could not be found and looking at SA.pm I see that you don't prepend the possibly modified directory to the @INC array... I did a quick & dirty patch that is perl-version dependent... but maybe you can think of something better (the patch is against 4.15-9): *** SA.pm.old Tue Apr 29 17:33:11 2003 --- SA.pm Tue Apr 29 17:37:34 2003 *************** *** 72,77 **** --- 72,82 ---- unless (MailScanner::Config::IsSimpleValue('usespamassassin') && !MailScanner::Config::Value('usespamassassin')) { + $val = MailScanner::Config::Value('spamassassininstallprefix'); + if ($val ne "") { + $settings{PREFIX} = $val; + push @INC, "$val/lib/perl5/site_perl/5.8.0"; + } MailScanner::Log::DieLog("SpamAssassin installation could not be found") unless eval "require Mail::SpamAssassin"; $settings{dont_copy_prefs} = 1; # Removes need for home directory *************** *** 87,94 **** $settings{LOCAL_RULES_DIR} = $val if $val ne ""; $val = MailScanner::Config::Value('spamassassindefaultrulesdir'); $settings{DEF_RULES_DIR} = $val if $val ne ""; - $val = MailScanner::Config::Value('spamassassininstallprefix'); - $settings{PREFIX} = $val if $val ne ""; $MailScanner::SA::SAspamtest = new Mail::SpamAssassin(\%settings); #if ($prefs ne "") { --- 92,97 ---- -- Mariano Absatz El Baby ---------------------------------------------------------- Violence is the last refuge of the incompetent. -- Isaac Asimov From Richard.Lush at HP.COM Tue Apr 29 21:55:29 2003 From: Richard.Lush at HP.COM (Lush, Richard) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show Message-ID: <13095CFC38D38E418844A18124E8EC77087703@sdcexcea01.emea.cpqcorp.net> >>I can honestly say that there is only one product there that looked any >>good and that was MailMarshall. Even then it did fully supply what >>MailScanner can. >Did you mean that, or did you skip a word? Oopps! You're right there should have been a 'not' in there. Brain still fried from all those sales and marketing types trying to tell me how good there products aren't...err..I mean are. (or was I right the first time?) :-) -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: 29 April 2003 21:37 To: MAILSCANNER@JISCMAIL.AC.UK At 21:24 29/04/2003, you wrote: >I was there today as well. I had one "salesman" tell me mail came in >on port 28 :-) That doesn't surprise me... >I can honestly say that there is only one product there that looked any >good and that was MailMarshall. Even then it did fully supply what >MailScanner can. Did you mean that, or did you skip a word? > I was amazed to see that about 70% of the stands there were to do > with spam and email antivirus. I would have stayed for the demo, but the fake log cabin and the Stetson hats were just too much for me. Worthy of a used-car salesman on a bad day :) >A stand for MailScanner next year then Julian??? Slight snag there: marketing budget ;-) >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: 29 April 2003 15:44 >To: MAILSCANNER@JISCMAIL.AC.UK > >I have just the day (well, quite enough of it!) at the "Info Security" >show in London. >I decided to do the rounds of the show on the premise that I wanted to >buy an email anti-virus, and particularly anti-spam, system. >I have had demos from loads of salesmen trying to flog me their systems. > >And my overwhelming response has to be "What a pathetic bunch of products". >That's the version you can tell your mother-in-law, anyway :-) > >They have really sophisticated traps like "the From: domain doesn't >match the envelope sender domain" and make a big thing of it. Useful >until one of your users joins a mailing list... > >The really advanced products have thinly (or sometimes not at all!) >disguised copies of DCC. I didn't see one product that could talk to >Razor2 and DCC. RBL's are quite popular, probably because they are so >easy to use. >No-one had a decent response to "what happens to your incoming mail >feed speed if one of the RBL's goes down?". The standard line to that >was "well, you can't avoid human intervention completely". In other >words, your incoming mail feed would slow to a crawl waiting for every >DNS timeout for every message. I even got them to admit that was >exactly what would happen. > >No product I was shown implemented any decent set of heuristic rules. >One or two had the ability to enter regular expressions and give a >simple score to each one. But you had to write all the rules yourself, >and they only supported 10 rules at most. > >1 had a Bayes engine, but it had to be manually trained with spam. It >would auto-learn on the assumption that all your outgoing mail was not spam. >Which is better than nothing, until one of your systems inside gets >hacked and used as a spam relay, at which point your entire bayes >database is destroyed by being given spam it assumed was non-spam. > >And a couple of them gave me price quotes. These were both >"appliances", i.e. PC's in 1U boxes. One company wanted $56,000 plus >the cost of an anti-virus engine (they only supported a choice of 2). >The other one charged ?20,000 (approx $32,000) for the basic unit, and >you then paid them several thousands of ? for each of their "modules" on top of that. > >I hope there are at least 1 or 2 decent commercial products in this >market, but I sure didn't see them today, and all the big players were there. > >We need to spread the word! > >Which brings me onto my next posting. >-- >Julian Field >www.MailScanner.info >Professional Support Services at www.MailScanner.biz MailScanner thanks >transtec Computers for their support -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 21:52:47 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show In-Reply-To: <1051648927.3966.42.camel@bach.kevinspicer.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB0011750F9@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB0011750F9@pascal.priv.bmrb.co.uk> Message-ID: <5.2.1.1.2.20030429215120.03e71de8@imap.ecs.soton.ac.uk> At 21:42 29/04/2003, you wrote: >FWIW The main argument I hear for moving to a commercial product is the >'content filtering' that some of the commercial products claim to do. >The main reasons for this being HR & legal related (not just porn but >also profanity, and prevention of information leakage - quite how that >could be achieved with any degree or certainty). I know all about the >striphtml action, but that alone isn't seen as being enough. The other >'essential requirement' of a content filtering is detailed reporting. General content filtering (be it for reporting or replacement) is one of my next big things to implement. Then writing a simple keyword-spotter will be dead easy. As for the detailed reporting, that will come with a keyword-spotting content filter. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From hden at KCBBS.GEN.NZ Tue Apr 29 21:59:49 2003 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> Message-ID: <20030429205949.GA17684@mew.kcbbs.gen.nz> > You are welcome to try 4.15-10 [SNIP] > This should fix the problem. > Please let me know how you get on. Julian, thanks!! That seems to have sorted the problems.. One small issue is the 'language string' warning on startup, but that isn't having any affect that I can see.. Cannot open language-strings file /opt/MailScanner/etc/reports/en/languages.conf, skipping Apr 30 08:50:06 santana MailScanner[5833]: SophosSAVI 3.69 (engine 2.14) recognizing 81439 viruses Apr 30 08:50:06 santana MailScanner[5833]: SophosSAVI using 6 IDE files Apr 30 08:50:06 santana MailScanner[5833]: Watching modification date of /usr/local/Sophos/ide and /us r/local/Sophos/lib Cheers! Hendrik From dh at UPTIME.AT Tue Apr 29 22:02:42 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:53 2006 Subject: Some things with thelatest Mailscanner beta... Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Hello I am testing the latest Mailscanner beta (the 4.10 version? ) I am seeing Apr 29 22:37:48 mail MailScanner[11844]: Cannot open language-strings file /opt/MailScanner/etc/reports/en/languages.conf, skipping in my mail log, while I am seeing MailScanner.conf:Language Strings = /etc/MailScanner/reports/en/languages.conf I am wondering why ? The sophossavi works perfectly now! Thank you - -d - - "Deep into that darkness peering, long I stood there wondering, fearing, - - Doubting, dreaming dreams no mortal ever dared to dream to dream before.." Edgar Allen Poe - The Raven -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+ruh3iW/Ta/pxHPQRA36jAJ4uXfAklfcZnLnkrt1NBgEWqfi92QCgrE+m e35Aq8eCCH1REpSlGCwLLNY= =YjN+ -----END PGP SIGNATURE----- From mailscanner at ecs.soton.ac.uk Tue Apr 29 22:30:10 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Some things with thelatest Mailscanner beta... In-Reply-To: Message-ID: <5.2.1.1.2.20030429222812.03e94d70@imap.ecs.soton.ac.uk> See 4.15-11 in my previous posting. At 22:02 29/04/2003, you wrote: >Hello I am testing the latest Mailscanner beta (the 4.10 version? ) >I am seeing >Apr 29 22:37:48 mail MailScanner[11844]: Cannot open language-strings >file /opt/MailScanner/etc/reports/en/languages.conf, skipping > >in my mail log, while I am seeing > >MailScanner.conf:Language Strings = >/etc/MailScanner/reports/en/languages.conf > >I am wondering why ? >The sophossavi works perfectly now! -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 22:28:06 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <20030429205949.GA17684@mew.kcbbs.gen.nz> References: <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030429222451.03e5e718@imap.ecs.soton.ac.uk> That's the first sign I've ever seen of what is actually a long-standing bug that dates back to the original 4.00 release. It's only the languagestrings that ever showed it, or exercised it. I've just put up 4.15-11 at the same location http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.15-11.rpm.tar The only thing that should have changed is the default locations of files which are left out of the MailScanner.conf file. At 21:59 29/04/2003, you wrote: > > You are welcome to try 4.15-10 [SNIP] > > This should fix the problem. > > Please let me know how you get on. > > Julian, thanks!! > > That seems to have sorted the problems.. > > One small issue is the 'language string' warning on startup, but that > isn't having any affect that I can see.. > > Cannot open language-strings file > /opt/MailScanner/etc/reports/en/languages.conf, skipping >Apr 30 08:50:06 santana MailScanner[5833]: SophosSAVI 3.69 (engine 2.14) >recognizing 81439 viruses >Apr 30 08:50:06 santana MailScanner[5833]: SophosSAVI using 6 IDE files >Apr 30 08:50:06 santana MailScanner[5833]: Watching modification date of >/usr/local/Sophos/ide and /us >r/local/Sophos/lib > > Cheers! > Hendrik -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Tue Apr 29 22:32:28 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> References: <20030429200905.GA17587@mew.kcbbs.gen.nz> Message-ID: <3EAEC53C.26473.14B3B977@localhost> El 29 Apr 2003 a las 21:26, Julian Field escribi?: > You are welcome to try 4.15-10 which is at > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.15-10.rpm.tar > Oh, Man... I checked today and it wasn't still there... OK... gonna try it... BTW, why don't you have the archives compressed? -rw-r--r-- 1 root root 2365440 Apr 29 18:27 MailScanner-4.15-10.tar -rw-r--r-- 1 root root 1219959 Apr 29 18:25 MailScanner-4.15-10.tar.Z -rw-r--r-- 1 root root 818377 Apr 29 18:25 MailScanner-4.15-10.tar.gz -rw-r--r-- 1 root root 732996 Apr 29 18:25 MailScanner-4.15-10.tar.bz2 I don't intend to start a flame war about this (in fact, I more often use gzip rather than bzip2 that appears to be constantly smaller) but it's easier on bandwith to have it compressed (also on disk space, but that is usually cheaper than bw). -- Mariano Absatz El Baby ---------------------------------------------------------- "Common sense is the collection of prejudices acquired by age eighteen." -- Albert Einstein From mailscanner at LISTS.COM.AR Tue Apr 29 22:35:40 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <5.2.1.1.2.20030429222451.03e5e718@imap.ecs.soton.ac.uk> References: <20030429205949.GA17684@mew.kcbbs.gen.nz> Message-ID: <3EAEC5FC.20038.14B6A705@localhost> El 29 Apr 2003 a las 22:28, Julian Field escribi?: > That's the first sign I've ever seen of what is actually a long-standing > bug that dates back to the original 4.00 release. It's only the > languagestrings that ever showed it, or exercised it. > > I've just put up 4.15-11 at the same location > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.15-11.rpm.tar > Keeps going up... :-) but the non-rpm (tar) version is not still there... -- Mariano Absatz El Baby ---------------------------------------------------------- Allow me to introduce my selves. From dh at UPTIME.AT Tue Apr 29 22:43:28 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:53 2006 Subject: One more thing.. Message-ID: <9D174FFE-7A8B-11D7-92E4-000393920D6C@uptime.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 The warning about the languages.conf not found has disappeared after I installed 4-11, yet I am seeing: MailScanner E-Mail Virus Scanner version 4.15-9 starting... so either I have not upgraded properly (but the error message disappeared so I guess I did it correctly using the RPM version) or the string is incorrect ;) - -d - - Face me and you shall surely perish. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+rvIEiW/Ta/pxHPQRA6X/AKCABtWg5+bSmrDGioU985v/8dGjDwCgzozw 7RZVXHry+uPevKvXT0fxQ9E= =vdCu -----END PGP SIGNATURE----- From mailscanner at ecs.soton.ac.uk Tue Apr 29 22:47:11 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <3EAEC5FC.20038.14B6A705@localhost> References: <5.2.1.1.2.20030429222451.03e5e718@imap.ecs.soton.ac.uk> <20030429205949.GA17684@mew.kcbbs.gen.nz> Message-ID: <5.2.1.1.2.20030429224433.02295380@imap.ecs.soton.ac.uk> At 22:35 29/04/2003, you wrote: >El 29 Apr 2003 a las 22:28, Julian Field escribi?: > > > That's the first sign I've ever seen of what is actually a long-standing > > bug that dates back to the original 4.00 release. It's only the > > languagestrings that ever showed it, or exercised it. > > > > I've just put up 4.15-11 at the same location > > > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.15-11.rpm.tar > > >Keeps going up... :-) > >but the non-rpm (tar) version is not still there... I never said it was there, that's why I asked him what distribution he was using :-) But it is there now, just for you... http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-4.15-11.rpm.tar.gz -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Tue Apr 29 22:49:22 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: One more thing.. In-Reply-To: <9D174FFE-7A8B-11D7-92E4-000393920D6C@uptime.at> Message-ID: <5.2.1.1.2.20030429224831.03ea8c68@imap.ecs.soton.ac.uk> Don't worry about the version number. These aren't proper releases so I don't care about cosmetic things like that. It will be correct when the real release goes out the door. At 22:43 29/04/2003, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: RIPEMD160 > >The warning about the languages.conf not found has disappeared after I >installed 4-11, yet I am seeing: > >MailScanner E-Mail Virus Scanner version 4.15-9 starting... > >so either I have not upgraded properly (but the error message >disappeared so I guess I did it correctly using the RPM version) or the >string is incorrect ;) > >- -d > >- - Face me and you shall surely perish. >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.2.1 (Darwin) > >iD8DBQE+rvIEiW/Ta/pxHPQRA6X/AKCABtWg5+bSmrDGioU985v/8dGjDwCgzozw >7RZVXHry+uPevKvXT0fxQ9E= >=vdCu >-----END PGP SIGNATURE----- -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Tue Apr 29 22:52:05 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <5.2.1.1.2.20030429224433.02295380@imap.ecs.soton.ac.uk> References: <3EAEC5FC.20038.14B6A705@localhost> Message-ID: <3EAEC9D5.32406.14C5AFC2@localhost> El 29 Apr 2003 a las 22:47, Julian Field escribi?: > At 22:35 29/04/2003, you wrote: > >El 29 Apr 2003 a las 22:28, Julian Field escribi?: > > > > > That's the first sign I've ever seen of what is actually a long-standing > > > bug that dates back to the original 4.00 release. It's only the > > > languagestrings that ever showed it, or exercised it. > > > > > > I've just put up 4.15-11 at the same location > > > > > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.15-11.rpm.tar > > > > >Keeps going up... :-) > > > >but the non-rpm (tar) version is not still there... > > I never said it was there, that's why I asked him what distribution he was > using :-) > But it is there now, just for you... > http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-4.15-11.rpm.tar.gz This is what I call... "a d..... good service" :-D Thanx Julian -- Mariano Absatz El Baby ---------------------------------------------------------- Make yourself at home! Clean my kitchen. From hden at KCBBS.GEN.NZ Tue Apr 29 22:53:26 2003 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <5.2.1.1.2.20030429222451.03e5e718@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429222451.03e5e718@imap.ecs.soton.ac.uk> Message-ID: <20030429215326.GA17731@mew.kcbbs.gen.nz> On Tue, Apr 29, 2003 at 10:28:06PM +0100, Julian Field wrote: > > I've just put up 4.15-11 at the same location Thanks!! All's well Just for your info, on startup. it reports itself as.. '4.15-9 starting...' Let me join the chorus of appreciation for your support, OutStanding!! and much appreciated!!! Cheers! Hendrik From mailscanner at LISTS.COM.AR Tue Apr 29 23:01:44 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:53 2006 Subject: Delivery Method in ZMailer Message-ID: <3EAECC18.6863.14CE8478@localhost> Hi Julian, Delivery Method = batch is quite useless in ZMailer, since the router is constantly traversing its queue so, by the time you issued the "sendmail" command, the file is probably not there, and if you re-send it it will finally go there also, so there is no gain. Instead of making Delivery method = queue mandatory, I'm just doing nothing in KickMessage. The following patch applies to the latest ZMailer.pm: *** ZMailer.pm.old Tue Apr 22 16:32:32 2003 --- ZMailer.pm Tue Apr 29 18:58:01 2003 *************** *** 557,569 **** sub KickMessage { ! my(@ids) = @_; ! my($idlist); ! $idlist = join(' -qI', @ids); ! $idlist .= ' &' if MailScanner::Config::Value('deliverinbackground'); ! #print STDERR "About to do \"Sendmail2 -qI$idlist\"\n"; ! system(MailScanner::Config::Value('sendmail2') . ' -qI' . $idlist); } #REVISO LEOH --- 557,575 ---- sub KickMessage { ! # BBY 2003-04-29 ! # we do nothing, since ZMailer's router is constantly processing its queue ! # and this is only a waste of time. ! # So "Delivery Method = queue" is the only method that ZMailer uses ! # regardless of what is configured :-) ! #my(@ids) = @_; ! #my($idlist); ! ! #$idlist = join(' -qI', @ids); ! #$idlist .= ' &' if MailScanner::Config::Value('deliverinbackground'); ! ##print STDERR "About to do \"Sendmail2 -qI$idlist\"\n"; ! #system(MailScanner::Config::Value('sendmail2') . ' -qI' . $idlist); } #REVISO LEOH -- Mariano Absatz El Baby ---------------------------------------------------------- God is REAL, unless explicitly declared INTEGER. From dh at UPTIME.AT Tue Apr 29 23:29:56 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:53 2006 Subject: Opps Mailscanner 4-11 + sophossavi just screwed up. Message-ID: <1AFA5532-7A92-11D7-92E4-000393920D6C@uptime.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Log says I am seeing Apr 30 00:15:18 mail MailScanner[2757]: New Batch: Scanning 1 messages, 7193 bytes Apr 30 00:15:18 mail MailScanner[2757]: Sophos update detected, resetting SAVI library Apr 30 00:15:18 mail MailScanner[2757]: Sophos SAVI library has been updated, killing this child Apr 30 00:15:18 mail MailScanner[2757]: MailScanner child dying of old age Apr 30 00:15:18 mail MailScanner[21166]: MailScanner E-Mail Virus Scanner version 4.15-9 starting... Apr 30 00:15:19 mail MailScanner[27328]: New Batch: Scanning 1 messages, 7193 bytes Apr 30 00:15:20 mail MailScanner[27328]: Sophos update detected, resetting SAVI library Apr 30 00:15:20 mail MailScanner[27328]: Sophos SAVI library has been updated, killing this child Apr 30 00:15:20 mail MailScanner[27328]: MailScanner child dying of old age Apr 30 00:15:21 mail MailScanner[21166]: SophosSAVI ERROR:: initializing savi: Unknown error (557) Apr 30 00:15:26 mail sendmail[24754]: h3TMFQxG024754: from=, size=7568, class=0, nrcpts=1, msgid=<200304292215.h3TMFKOj006939@mail.t0.or.at>, proto=ESMTP, daemon=MTA, relay=ns1.t0.or.at [62.116.70.34] Apr 30 00:15:27 mail MailScanner[8845]: New Batch: Scanning 2 messages, 15243 bytes Apr 30 00:15:27 mail MailScanner[8845]: Sophos update detected, resetting SAVI library Apr 30 00:15:27 mail MailScanner[8845]: Sophos SAVI library has been updated, killing this child Apr 30 00:15:27 mail MailScanner[8845]: MailScanner child dying of old age Apr 30 00:15:29 mail MailScanner[19935]: MailScanner E-Mail Virus Scanner version 4.15-9 starting... Apr 30 00:15:31 mail MailScanner[19935]: SophosSAVI ERROR:: initializing savi: Unknown error (557) Apr 30 00:15:38 mail MailScanner[26925]: MailScanner E-Mail Virus Scanner version 4.15-9 starting... Apr 30 00:15:40 mail MailScanner[26925]: SophosSAVI ERROR:: initializing savi: Unknown error (557) Apr 30 00:15:48 mail MailScanner[18318]: MailScanner E-Mail Virus Scanner version 4.15-9 starting... Apr 30 00:15:50 mail MailScanner[18318]: SophosSAVI ERROR:: initializing savi: Unknown error (557) Apr 30 00:15:57 mail sendmail[14468]: h3TMFtxG014468: from=, size=28489, class=0, nrcpts=1, msgid=<200304292215.h3TMFtxG014468@mail.uptime.at>, proto=ESMTP, daemon=MTA, relay=www.wirelesscommunity.at [62.99.211.104] at midnight sophos updated, restarted and I did no have any issues until now (you can see teh timestamp) alpha with latest software for sophos , sophosavi and mailscanner. redhat 7.3 - -d - - Face me and you shall surely perish. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+rvzoiW/Ta/pxHPQRA8HnAKC6V8UZqSLzuDWz0NoQiD8hkAT/cACeJZ8B E+cIR2lttvVj1p+U8ilK0XE= =OQKu -----END PGP SIGNATURE----- From nerijus at USERS.SOURCEFORGE.NET Tue Apr 29 23:43:19 2003 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:17:53 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> References: <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> Message-ID: <1051656198.18171.172.camel@nerijus> An, 2003-04-29 20:40, Julian Field wrote: > What version of the AvpDaemonClient are you using? There appear to be about > 3 different versions of it shipped with F-Secure 4.50, some of which > actually work. Just to clarify - I am talking about kavdaemon with Kaspersky, not F-Secure. Are you? Regards, Nerijus From so-mlist-alias at all-about-shift.com Wed Apr 30 07:57:15 2003 From: so-mlist-alias at all-about-shift.com (Soeren Gerlach) Date: Thu Jan 12 21:17:53 2006 Subject: Kapersky version & license question on Linux Message-ID: <10085.193.194.7.77.1051685835.squirrel@miyako.all-about-shift.com> Hi all, although it seems a little off-topic in this group there're problably some who already know this: For a commercial installation with M.S. I'd like to use the Kapersky antivirus software as they've got an overall good rating in anti-virus tests. They're offering a "personal version" and a "file server" version for linux. Which of these version should I use to work [best] with MailScanner? Although I could not find any hints in their contract about licensing/using this for a multi-domain mail-relay? Does anybody know if there's a special contract (i.e. price ,-)) to pay if I plan to use a single working license for say 10 domains? Thanks & regards, Soeren Gerlach From mailscanner at ecs.soton.ac.uk Wed Apr 30 11:09:56 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Kapersky version & license question on Linux In-Reply-To: <10085.193.194.7.77.1051685835.squirrel@miyako.all-about-sh ift.com> Message-ID: <5.2.1.1.2.20030430110841.023e7908@imap.ecs.soton.ac.uk> It's not an answer to your question, but take a look at F-Secure as well. Their new version includes both the Kaspersky and the F-Prot engines in 1 product, so you get better coverage for just 1 product. Not a clue how much it costs though, but I thought you should be aware of this as it may affect your purchasing decision. At 07:57 30/04/2003, you wrote: >Hi all, >although it seems a little off-topic in this group there're problably some >who already know this: > >For a commercial installation with M.S. I'd like to use the Kapersky >antivirus software as they've got an overall good rating in anti-virus >tests. They're offering a "personal version" and a "file server" version >for linux. Which of these version should I use to work [best] with >MailScanner? > >Although I could not find any hints in their contract about >licensing/using this for a multi-domain mail-relay? Does anybody know if >there's a special contract (i.e. price ,-)) to pay if I plan to use a >single working license for say 10 domains? > > >Thanks & regards, >Soeren Gerlach -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 11:01:18 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Sophos SAVI problems In-Reply-To: <20030429215326.GA17731@mew.kcbbs.gen.nz> References: <5.2.1.1.2.20030429222451.03e5e718@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429165305.027eaec0@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429212339.03e5ed90@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030429222451.03e5e718@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030430110054.022631f8@imap.ecs.soton.ac.uk> At 22:53 29/04/2003, you wrote: >On Tue, Apr 29, 2003 at 10:28:06PM +0100, Julian Field wrote: > > > > I've just put up 4.15-11 at the same location > > Thanks!! All's well > > Just for your info, on startup. it reports itself as.. > '4.15-9 starting...' > > Let me join the chorus of appreciation for your support, > OutStanding!! and much appreciated!!! Thanks. Have you added a comment to the "guest book" on the website yet? -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 11:03:31 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Delivery Method in ZMailer In-Reply-To: <3EAECC18.6863.14CE8478@localhost> Message-ID: <5.2.1.1.2.20030430110326.023e7eb0@imap.ecs.soton.ac.uk> Fixed. At 23:01 29/04/2003, you wrote: >Hi Julian, > >Delivery Method = batch >is quite useless in ZMailer, since the router is constantly traversing its >queue so, by the time you issued the "sendmail" command, the file is probably >not there, and if you re-send it it will finally go there also, so there is >no gain. > >Instead of making >Delivery method = queue >mandatory, I'm just doing nothing in KickMessage. > >The following patch applies to the latest ZMailer.pm: > >*** ZMailer.pm.old Tue Apr 22 16:32:32 2003 >--- ZMailer.pm Tue Apr 29 18:58:01 2003 >*************** >*** 557,569 **** > > > sub KickMessage { >! my(@ids) = @_; >! my($idlist); > >! $idlist = join(' -qI', @ids); >! $idlist .= ' &' if MailScanner::Config::Value('deliverinbackground'); >! #print STDERR "About to do \"Sendmail2 -qI$idlist\"\n"; >! system(MailScanner::Config::Value('sendmail2') . ' -qI' . $idlist); > } > > #REVISO LEOH >--- 557,575 ---- > > > sub KickMessage { >! # BBY 2003-04-29 >! # we do nothing, since ZMailer's router is constantly processing its queue >! # and this is only a waste of time. >! # So "Delivery Method = queue" is the only method that ZMailer uses >! # regardless of what is configured :-) > >! #my(@ids) = @_; >! #my($idlist); >! >! #$idlist = join(' -qI', @ids); >! #$idlist .= ' &' if MailScanner::Config::Value('deliverinbackground'); >! ##print STDERR "About to do \"Sendmail2 -qI$idlist\"\n"; >! #system(MailScanner::Config::Value('sendmail2') . ' -qI' . $idlist); > } > > #REVISO LEOH > > >-- >Mariano Absatz >El Baby >---------------------------------------------------------- >God is REAL, unless explicitly declared INTEGER. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 11:07:23 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: Opps Mailscanner 4-11 + sophossavi just screwed up. In-Reply-To: <1AFA5532-7A92-11D7-92E4-000393920D6C@uptime.at> Message-ID: <5.2.1.1.2.20030430110514.02806360@imap.ecs.soton.ac.uk> Can you start by checking that your midnight update worked okay? It is failing to be able to link to the SAVI library. What does "ls -al /usr/local/Sophos/lib" produce? If you shutdown and restart MailScanner, what happens? Does it work as normal? At 23:29 29/04/2003, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: RIPEMD160 > >Log says > >I am seeing > >Apr 30 00:15:18 mail MailScanner[2757]: New Batch: Scanning 1 messages, >7193 bytes >Apr 30 00:15:18 mail MailScanner[2757]: Sophos update detected, >resetting SAVI library >Apr 30 00:15:18 mail MailScanner[2757]: Sophos SAVI library has been >updated, killing this child >Apr 30 00:15:18 mail MailScanner[2757]: MailScanner child dying of old >age >Apr 30 00:15:18 mail MailScanner[21166]: MailScanner E-Mail Virus >Scanner version 4.15-9 starting... >Apr 30 00:15:19 mail MailScanner[27328]: New Batch: Scanning 1 >messages, 7193 bytes >Apr 30 00:15:20 mail MailScanner[27328]: Sophos update detected, >resetting SAVI library >Apr 30 00:15:20 mail MailScanner[27328]: Sophos SAVI library has been >updated, killing this child >Apr 30 00:15:20 mail MailScanner[27328]: MailScanner child dying of old >age That's all quite normal. No problem there. >Apr 30 00:15:21 mail MailScanner[21166]: SophosSAVI ERROR:: >initializing savi: Unknown error (557) That's the cause of the problems. >Apr 30 00:15:26 mail sendmail[24754]: h3TMFQxG024754: >from=, size=7568, class=0, >nrcpts=1, msgid=<200304292215.h3TMFKOj006939@mail.t0.or.at>, >proto=ESMTP, daemon=MTA, relay=ns1.t0.or.at [62.116.70.34] >Apr 30 00:15:27 mail MailScanner[8845]: New Batch: Scanning 2 messages, >15243 bytes >Apr 30 00:15:27 mail MailScanner[8845]: Sophos update detected, >resetting SAVI library >Apr 30 00:15:27 mail MailScanner[8845]: Sophos SAVI library has been >updated, killing this child >Apr 30 00:15:27 mail MailScanner[8845]: MailScanner child dying of old >age >Apr 30 00:15:29 mail MailScanner[19935]: MailScanner E-Mail Virus >Scanner version 4.15-9 starting... >Apr 30 00:15:31 mail MailScanner[19935]: SophosSAVI ERROR:: >initializing savi: Unknown error (557) >Apr 30 00:15:38 mail MailScanner[26925]: MailScanner E-Mail Virus >Scanner version 4.15-9 starting... >Apr 30 00:15:40 mail MailScanner[26925]: SophosSAVI ERROR:: >initializing savi: Unknown error (557) >Apr 30 00:15:48 mail MailScanner[18318]: MailScanner E-Mail Virus >Scanner version 4.15-9 starting... >Apr 30 00:15:50 mail MailScanner[18318]: SophosSAVI ERROR:: >initializing savi: Unknown error (557) >Apr 30 00:15:57 mail sendmail[14468]: h3TMFtxG014468: >from=, size=28489, class=0, nrcpts=1, >msgid=<200304292215.h3TMFtxG014468@mail.uptime.at>, proto=ESMTP, >daemon=MTA, relay=www.wirelesscommunity.at [62.99.211.104] > > > >at midnight sophos updated, restarted and I did no have any issues >until now (you can see teh timestamp) > >alpha with latest software for sophos , sophosavi and mailscanner. >redhat 7.3 > >- -d > >- - Face me and you shall surely perish. >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.2.1 (Darwin) > >iD8DBQE+rvzoiW/Ta/pxHPQRA8HnAKC6V8UZqSLzuDWz0NoQiD8hkAT/cACeJZ8B >E+cIR2lttvVj1p+U8ilK0XE= >=OQKu >-----END PGP SIGNATURE----- -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 11:08:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:53 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <1051656198.18171.172.camel@nerijus> References: <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030430110744.023faec0@imap.ecs.soton.ac.uk> At 23:43 29/04/2003, you wrote: >An, 2003-04-29 20:40, Julian Field wrote: > > > What version of the AvpDaemonClient are you using? There appear to be about > > 3 different versions of it shipped with F-Secure 4.50, some of which > > actually work. > >Just to clarify - I am talking about kavdaemon with Kaspersky, not >F-Secure. Are you? Sorry, put wrong product name in there. Meant Kaspersky. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From dh at UPTIME.AT Wed Apr 30 11:29:38 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:53 2006 Subject: Opps Mailscanner 4-11 + sophossavi just screwed up. In-Reply-To: <5.2.1.1.2.20030430110514.02806360@imap.ecs.soton.ac.uk> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 On Mittwoch, April 30, 2003, at 12:07 Uhr, Julian Field wrote: > Can you start by checking that your midnight update worked okay? > It is failing to be able to link to the SAVI library. > What does "ls -al /usr/local/Sophos/lib" produce? > The output looks as follows: ls -la /usr/local/Sophos/lib/ total 8644 drwxr-xr-x 2 root root 4096 Apr 29 22:52 . drwxr-xr-x 6 root root 4096 Apr 30 12:01 .. lrwxrwxrwx 1 root root 12 Apr 29 22:52 libsavi.so -> libsavi.so.3 lrwxrwxrwx 1 root root 21 Apr 29 22:52 libsavi.so.2 -> libsavi.so.3.2.05.034 lrwxrwxrwx 1 root root 21 Apr 29 22:52 libsavi.so.3 -> libsavi.so.3.2.05.034 - -r-xr-xr-x 1 root bin 1452280 Feb 25 14:05 libsavi.so.3.2.05.030 - -r-xr-xr-x 1 root bin 1455320 Apr 10 10:37 libsavi.so.3.2.05.033 - -r-xr-xr-x 1 bin bin 1455552 Apr 29 22:52 libsavi.so.3.2.05.034 - -rw-r--r-- 1 bin bin 443637 Apr 29 22:52 vdl01.vdb - -rw-r--r-- 1 bin bin 401446 Apr 29 22:52 vdl02.vdb - -rw-r--r-- 1 bin bin 389383 Apr 29 22:52 vdl03.vdb - -rw-r--r-- 1 bin bin 439542 Apr 29 22:52 vdl04.vdb - -rw-r--r-- 1 bin bin 459468 Apr 29 22:52 vdl05.vdb - -rw-r--r-- 1 bin bin 376402 Apr 29 22:52 vdl06.vdb - -rw-r--r-- 1 bin bin 374881 Apr 29 22:52 vdl07.vdb - -rw-r--r-- 1 bin bin 344925 Apr 29 22:52 vdl08.vdb - -rw-r--r-- 1 bin bin 377505 Apr 29 22:52 vdl09.vdb - -rw-r--r-- 1 bin bin 370090 Apr 29 22:52 vdl10.vdb - -rw-r--r-- 1 bin bin 408714 Apr 29 22:52 vdl-3.69.dat lrwxrwxrwx 1 root root 12 Apr 29 22:52 vdl.dat -> vdl-3.69.dat Which does not look differently to when it worked. I did not create symlinks for libsavi.so.2 to libsavi.so since that is resolved anyways. > If you shutdown and restart MailScanner, what happens? Does it work as > normal? > No, I tried that yesterday night and it simply continues to fail. I have no idea why. When I switch to regular sophos all is well. I might be able to test again this night. > >> Apr 30 00:15:21 mail MailScanner[21166]: SophosSAVI ERROR:: >> initializing savi: Unknown error (557) > > That's the cause of the problems. > What irks me, is the fact that we update at 00:00 and the problem just shows 15 minutes later? IN the meantime messages did pass over the server. - - "Deep into that darkness peering, long I stood there wondering, fearing, - - Doubting, dreaming dreams no mortal ever dared to dream to dream before.." Edgar Allen Poe - The Raven -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+r6WWiW/Ta/pxHPQRA61GAKCBDZMf6Dl5CwVeah0WdJ2I+trpqwCgrwp9 p1VLdGH+7BZ1JRocGCdFn2Q= =KbKP -----END PGP SIGNATURE----- From sftung at INFOCEAN.COM Wed Apr 30 12:07:47 2003 From: sftung at INFOCEAN.COM (Tung Siu Fai) Date: Thu Jan 12 21:17:53 2006 Subject: postfix X-Original-To problem Message-ID: <3EB01F03.13545.1A97976@localhost> I got a problem on MailScanner + Postfix I want every message add a X-Original-To header to each messages. I add the flag "O" at master.cf, everything is ok The email after process by MailScanner and put the email back to incoming queue. The deliver postfix cannot add the X-Original-To, when there are more then one recipient. only 1 email will add X-Original-To header correctly, other email will add " X- Original-To : unknow" the log as following : postfix/pipe[11133]: 485C03823FD: to=, orig_to=, relay=cyrus, delay=11, status=sent (mail.myhost.com) already add local_destination_recipient_limit = 1 I think the problem is the mailscanner write postfix queue file format not corret, anyone can tell me how to fix it ? Thanks From dot at DOTAT.AT Wed Apr 30 12:19:00 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show In-Reply-To: References: <5C0296D26910694BB9A9BBFC577E7AB0011750F9@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB0011750F9@pascal.priv.bmrb.co.uk> Message-ID: Kevin Spicer wrote: > >FWIW The main argument I hear for moving to a commercial product is the >'content filtering' that some of the commercial products claim to do. >The main reasons for this being HR & legal related (not just porn but >also profanity, and prevention of information leakage - quite how that >could be achieved with any degree or certainty). I know all about the >striphtml action, but that alone isn't seen as being enough. The other >'essential requirement' of a content filtering is detailed reporting. What do you need that a custom SpamAssassin rule with a high score doesn't provide? Tony. -- f.a.n.finch http://dotat.at/ LOUGH FOYLE TO CARLINGFORD LOUGH: SOUTH, BECOMING CYCLONIC, 3 OR 4. SHOWERS. MODERATE, LOCALLY POOR. SLIGHT. From Kevin.Spicer at BMRB.CO.UK Wed Apr 30 12:53:25 2003 From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4AD7F@pascal.priv.bmrb.co.uk> > > What do you need that a custom SpamAssassin rule with a high score > doesn't provide? > In a word granularity. The ability to classify incoming/ outgoing email. The ability to reject/ edit (strip images etc.) on the basis of what they are and who they are going to. Detailed reporting (x% of mail is 'adult' y% of mail is 'violence' z% of mail is 'profanity' etc.). Take a look at surf patrol's email filter and the features it offers. When trying to explain why we should stick with MS and not move to surf patrol its difficult to justify keeping MS when it doesn't have these features. It doesn't really matter how well MS works and how badly the competitors work its all to do with the 'features' the marketing presents to those who actually buy the products. Unfortunately I've not seen any objective comparison of both the features and the quality of their implementation (a few on the list - but its difficult to present these as objective, no matter how accurate they may be). Another problem with using spamassassin rules to implement a crude content filter is that this may require changes to spam filtering policies, and would require that outoing mail is filterd for spaminess, which could be embarassing / annoying (depending on what actions you choose) if you get false positives in outgoing mail. It just simply isn't granular enough. It also doesn't help when the commercial products chief way of competing with MS is by spreading FUD about open source in their slick marketing. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From dh at UPTIME.AT Wed Apr 30 12:55:13 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show In-Reply-To: Message-ID: <9A0E53EC-7B02-11D7-92E4-000393920D6C@uptime.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 On Mittwoch, April 30, 2003, at 01:19 Uhr, Tony Finch wrote: > Kevin Spicer wrote: >> >> FWIW The main argument I hear for moving to a commercial product is >> the >> 'content filtering' that some of the commercial products claim to do. >> The main reasons for this being HR & legal related This is a very, very tricky subject. In Austria for example and that would account to any country currently in the EU (to some extent) it is illegal to filter the content of email messages as soon as the employer allows you to receive or send private messages from work. Most places do not make you sign a paper where it is explicitly stated that all mail you send out is work related and all mail you receive is work related. I also doubt that anyone here has ever heard of such a setup where it is legally verified that only work related things are sent and received. In cases where it is not explicitly signed by the employee that he may only send such mails, and there is even the slightest chance that he might send a private mail, the employer may no scan nor watch the content of a message for anything. So technically speaking even spam scanning the body is illegal here in Austria. - - Face me and you shall surely perish. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+r7mliW/Ta/pxHPQRA4AsAJ0Rwr+0bLyQsVe1bw3Ra2+p+nxmJACgkczl zB1HVB3DMh0n/f7eig5V0U0= =qI4u -----END PGP SIGNATURE----- From dh at UPTIME.AT Wed Apr 30 13:01:21 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:53 2006 Subject: InfoSecurity show In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0A4AD7F@pascal.priv.bmrb.co.uk> Message-ID: <7539C11E-7B03-11D7-92E4-000393920D6C@uptime.at> -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 On Mittwoch, April 30, 2003, at 01:53 Uhr, Spicer, Kevin wrote: >> >> What do you need that a custom SpamAssassin rule with a high score >> doesn't provide? >> > In a word granularity. I doubt there is much which can provide more granularity than Perl regular expression... > The ability to classify incoming/ outgoing email. The ability to > reject/ edit (strip images etc.) on the basis of what they are and who > they are going to. Detailed reporting (x% of mail is 'adult' y% of > mail is 'violence' z% of mail is 'profanity' etc.). Take a look at > surf patrol's email filter and the features it offers. While I do not quite grasp what that has to do with a functional system to sanitise mail, I can understand that the Management thrives on such buzz features. I am confrontend with that every day. However in a commercial product you will most likely never have the chance to implement such things just the way you want it to be. However with complete spam logging enabled and a good log analyser you should be able to emulate some of that, even with a stock Mailscanner. > When trying to explain why we should stick with MS and not move to > surf patrol its difficult to justify keeping MS when it doesn't have > these features. Because they are not needed from the technical point of view and in my humble opinion Julian is a very capable, technical person. > It doesn't really matter how well MS works and how badly the > competitors work its all to do with the 'features' the marketing > presents to those who actually buy the products. Because, like 99% of all Open Source projects, Mailscanner lacks proper Public Relations Work. There is no marketing because people tend to come from the technical side and they either know what they are doing or have enough power to simply run mailscanner without having to justify it. I am forced with to work with this marketing dilemma every day when I do my stuff for Fink. > - -d - - we may race and we may run, but we can not undo what has been done. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+r7sViW/Ta/pxHPQRA3jdAJ4ip94bacfyxzom+UXivxcyNFl+6gCfSaQa Rc2ya+OybFi4Bpy0nk8rN34= =AJPP -----END PGP SIGNATURE----- From mailscanner at LISTS.COM.AR Wed Apr 30 13:58:52 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: [O/T] MX vs. MSA (was: Re: InfoSecurity show) In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0A4AD7F@pascal.priv.bmrb.co.uk> Message-ID: <3EAF9E5C.5368.1803E9D5@localhost> El 30 Apr 2003 a las 12:53, Spicer, Kevin escribi?: > Another problem with using spamassassin rules to implement a crude content > filter is that this may require changes to spam filtering policies, and > would require that outoing mail is filterd for spaminess, which could be > embarassing / annoying (depending on what actions you choose) if you get > false positives in outgoing mail. It just simply isn't granular enough. One solution to this is running 2 MailScanners (and 1 and a half sendmail) in the same box... or better yet, on different boxes... This is slightly off-topic and a more SMTP-general, but anyway, here it goes. For ages people has been running two different services with the same peace of software and, this is the bad part, with the same _instance_ of that software. It is important to identify 2 different services and treat them differently or (as most people do) live with the problems of treating them (almost) equally. The two services are: 1) MX (Mail eXchange): accepting mail from wherever for domains you provide incoming mail service. 2) MSA (Message Submission Agent): accepting mail submitted by _your_ users and relaying it to wherever they should go. There's still a third service that is usually added to the bunch: 3) MS (Message Store): the place where usually one or more of the MX's leave the messages for users to access them by whichever means (locally on disk, via POP, IMAP, web or other means) but this one has been lately easily recognized as independent since lots of people like the 'featuritis' in Windows products like Exchange for this. Anyway, will leave this third option outside this analisys since it's not problematic from this point of view. You can do both MX and MSA with an SMTP MTA (sendmail, exim, postfix, zmailer) but you should apply _different_ policies to messages coming from "outside" (MX) than to messages issued by your users (MSA). What's more, you have to clearly identify them in order to avoid being abused for relaying external mail. All modern MTA's provide some kind of policy management that allows you to differentiate MX and MSA traffic, avoid relaying MX mail and the like, but it's usually a PITA when you want to apply fine control. SMTP AUTH is a big help, but then you _do_ have to make everyone use it or anyway be too cautious on how you configure policies on your MTA. The easiest way to differentiate the services is to separate them completely. This is what most large ISPs do: they have a bunch of servers acting only as MX's, another bunch of servers acting only as MSA's for their customers, and then, a third bunch of servers acting as MS's for POP, IMAP, webmail, etc... The configuration in the MX's and the MSA's are completely different. Now, most of us can't afford (or justify to management) the expense of having 2 or 3 servers dedicated to e-mail, but that is actually not a big problem. The only extra item we _do_ need is an extra IP address (not an extra network card, just the IP address). Now you have two IP addresses, you can adjust your DNS accordingly, I'll show you later how, for now, let's just name the old IP "msa" and the new one "mx". You must now configure 2 different instances of your mail server, one listening in the port 25 of mx for incoming mail and the other in the port 25 of msa for outgoing mail. Each with its own configuration files, and its own set of queue and spool directories. You also configure 2 different instances of MailScanner, with different configuration files and, if you want to, SA rules and scores. One works on the mx set of queue directories and the other one in the msa set of queue directories. Depending on your MTA (I only know seriously how to configure zmailer), you might not even need 2 _complete_ MTA's... in the case of zmailer, I only need 1 and 1/3 zmailers and 2 MailScanners to get this going. The dns changes are like this... suppose you currently have something like this: smtp.example.com. IN A 172.20.22.22 example.com. IN MX 5 smtp.example.com. example.net. IN MX 5 smtp.example.com. and all your users know that they must send their mail thru smtp.example.com (i.e. configure their Outlook Express or whatever s..t they use with smtp.example.com as their SMTP server). You now add the 172.20.22.33 address to your server (you can do this with only one network interface card). In order to avoid major headaches (e.g. some use having the 172.20.22.22 hardcoded since once, 2 years ago, dns wasn't working properly and some help desk person made him change the name for the address), you should use the old address for MSA and the new one for MX and configure DNS like this: smtp.example.com. IN A 172.20.22.22 mx.example.com. IN A 172.20.22.23 example.com. IN MX 5 mx.example.com. example.net. IN MX 5 mx.example.com. Better still... if you plan to do this (you _don't_ decide this kind of thing overnight), you should prepare for the change by drastically lowering the TTL's of the dns record that will be changing some days in advance (ideally, at least one week in advance)... so the "preparing" DNS setup should look something like: smtp.example.com. IN A 172.20.22.22 example.com. 300 IN MX 5 smtp.example.com. example.net. 300 IN MX 5 smtp.example.com. A couple of hours before the change, do something like this: smtp.example.com. IN A 172.20.22.22 example.com. 1 IN MX 5 smtp.example.com. example.net. 1 IN MX 5 smtp.example.com. HTH -- Mariano Absatz El Baby ---------------------------------------------------------- I am not afraid of death, I just don't want to be there when it happens. -- Woody Allen From Q.G.Campbell at newcastle.ac.uk Wed Apr 30 14:12:34 2003 From: Q.G.Campbell at newcastle.ac.uk (Quentin Campbell) Date: Thu Jan 12 21:17:54 2006 Subject: InfoSecurity show Message-ID: <52E50E4D595DDE4D861117A1FB62E79D2215F4@bond.ncl.ac.uk> > -----Original Message----- > From: Kevin Spicer [mailto:kevins@BMRB.CO.UK] > Sent: 29 April 2003 21:42 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: InfoSecurity show > > > FWIW The main argument I hear for moving to a commercial > product is the 'content filtering' that some of the > commercial products claim to do. The main reasons for this > being HR & legal related (not just porn but also profanity, > and prevention of information leakage - quite how that could > be achieved with any degree or certainty). I know all about > the striphtml action, but that alone isn't seen as being > enough. The other 'essential requirement' of a content > filtering is detailed reporting. > If you work in the UK, be very, very, careful in what you do with "detailed reporting". Automatic spam filtering, tagging and stripping of HTML is lawful under RIPA in the United Kingdom. However if in addition to that you are also recording and reporting to a third party some of the content that was filtered then that is "interception" under RIPA 2000. See http://www.legislation.hmso.gov.uk/acts/acts2000/20000023.htm. It is a criminal offence (max. 2 years imprisonment) under section 1(2) of RIPA to intercept on a private communications system without lawful authority. You may be excluded from the criminal liability under section 1(2) if you are (a) the person with a right to control operation or use of the system, or (b) you have the express or implied consent of such a person to make the interception (see section 1(6)). However even if you have that express or implied consent to intercept communications on a private network your action may then be actionable in a civil suit by the sender or recipient of a communication if the interception takes place without lawful authority (see section 1(3)). The rules for legitimate interception that provide "lawful authority" can be found in the Telecommunications (Lawful Business Practice)(Interception of Communications) Regulations 2000. See http://www.hmso.gov.uk/si/si2000/20002699.htm. There is also a helpful JISC paper on e-mail monitoring under RIPA at http://www.jisc.ac.uk/index.cfm?name=pub_smbp_ripa. NOTE Sys Admins like me should have any authorities/permissions/requests given expressly in writing; this was the advice from a lawyer. This will protect you from unscupulous employers who may later take disciplinary action against you and try to dismiss you on the grounds that you did not have their "implied consent" to do things. Even a university is not beyond such contemptible conduct against its employees. Quentin --- PHONE: +44 191 222 8209 Computing Service, University of Newcastle FAX: +44 191 222 8765 Newcastle upon Tyne, United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." From so-mlist-alias at all-about-shift.com Wed Apr 30 14:35:35 2003 From: so-mlist-alias at all-about-shift.com (Soeren Gerlach) Date: Thu Jan 12 21:17:54 2006 Subject: Kapersky version & license question on Linux In-Reply-To: <5.2.1.1.2.20030430110841.023e7908@imap.ecs.soton.ac.uk> References: <10085.193.194.7.77.1051685835.squirrel@miyako.all-about-sh <5.2.1.1.2.20030430110841.023e7908@imap.ecs.soton.ac.uk> Message-ID: <62269.193.194.7.77.1051709735.squirrel@miyako.all-about-shift.com> > It's not an answer to your question, but take a look at F-Secure as > well. Their new version includes both the Kaspersky and the F-Prot > engines in 1 product, so you get better coverage for just 1 product. Thanks for that hint. I've just read the headlines from this list the last days and am aware that there was a talk about it - I should keep up with the mail bodies ,-)) > Not a clue how much it costs though, but I thought you should be aware > of this as it may affect your purchasing decision. That's the point ,-)) But as far as I can see their licensing does not say anything about using it on a mailserver for multiple domains, i.e. it doesn't forbid it Regards, Soeren Gerlach From nerijus at USERS.SOURCEFORGE.NET Wed Apr 30 14:58:05 2003 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:17:54 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> References: <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> Message-ID: <1051711085.18172.215.camel@nerijus> An, 2003-04-29 20:40, Julian Field wrote: > Run as > cd /root/q > AvpDaemonClient . > works fine. It doesn't need the full pathname. > > Here is a chunk of the output from it: > > >Current object: ./eicars/dfh3MENF6X020229 > >Test result: 4 > >Known viruses were detected AvpDaemonClient from Sample1 directory does not find viruses at all, even if I run it with full path: # pwd /var/virge/temp # kavscanner -I0 . +-------------------------------------------------------+ | Kaspersky Anti-Virus for Linux | | Copyright(C) Kaspersky Lab. 1998-2002 | | Version 4.0.3.0 | ... Current object: /var/virge/temp/ /var/virge/temp/a infected: EICAR-Test-File ... # AvpDaemonClient1 . Test result: 0 No viruses were found ... # AvpDaemonClient1 /var/virge/temp Test result: 0 No viruses were found ... # AvpDaemonClient1 /var/virge/temp/a Test result: 0 No viruses were found AvpDaemonClient from Sample directory works, but only with full path: # AvpDaemonClient . Test result: 1 Test result: 0x31, flags: 0x100 Virus scan was not complete Found viruses: Return code: 1 # AvpDaemonClient /var/virge/temp Test result: 4 Test result: 0x34, flags: 0x100 Known viruses were detected Found viruses: /var/virge/temp/a infected: EICAR-Test-File > Please can you work out why yours doesn't work the same way as mine? > If you just run the command "AvpDaemonClient ." then please do a "which > AvpDaemonClient" to check where it is actually getting it from. I really don't know why it works for you and doesn't for me. What are your kavdaemon parameters? I run it as /opt/AVP/kavdaemon -I0 -Y /var/virge/temp/ /var/spool/ : # ps axw|grep kav 14755 ? S 0:00 /opt/AVP/kavdaemon(Logger) 14756 ? S 0:00 /opt/AVP/kavdaemon -I0 -Y /var/virge/temp/ /var/spool/ System is RH 7.3. I tried running AvpDaemonClient with full path (/usr/local/bin/AvpDaemonClient), it doesn't change anything. The fact is, that it doesn't work here on 2 different systems, and I asked kaspersky support about this problem, and they told that "." is not supported by kavdaemon for security reasons. So is there any possibility to pass full path to kavdaemon client? IMHO it would solve all the problems. Regards, Nerijus From heber at AJODER.COM Wed Apr 30 15:20:18 2003 From: heber at AJODER.COM (Heber) Date: Thu Jan 12 21:17:54 2006 Subject: Fowarding ham and Spam to specific user in the MX server for sa-learn. Message-ID: <000a01c30f23$a0a55e50$45028f0a@MAM> Hello all; Before anything I have to say that MailScanner running together with SA makes a great product, good work for those developing!!!!!!!! Any help on the following will be great... Two questions; 1. Why is the email forward doesn't work properly in sendmail? What needs to be changed? 2. Can I use the sa-learn from SA 2.53 against an email file created from sendmail for a local user on the MX server i.e.: "sa-learn --spam --file /var/mail/this-is-spam" ? Supporting info for the questions follows (some info concerning ip and domain name have been change for obvious reasons); I am currently using MS with SA 2.53 on two MX boxes forwarding the emails to my exchange box which only receives mail from the two MX Linux boxes. I am in the process of implementing the function where the user receiving the email can report those false positive (spam or ham). I have created two email accounts in my two MX boxes running sendmail, not-spam and this-is-spam where my network users will send their email for the bayes learning function. In the MX1 and MX2 boxes I have created both the same accounts. In the MX1 box I created the following file; /home/not-spam/.forward Content; not-spam@mx2.domain.com, \not-spam this as I have read it's suppose to send a copy of the email to my mx2 box and a copy to the current account (same thing was done for the this-is-spam account) When I send a test message to the address the Result is; The original message was received at Wed, 30 Apr 2003 08:02:31 -0400 from mail.domain.com [200.50.aaa.bbb] ----- The following addresses had permanent fatal errors ----- not-spam@mx2.domain.com (reason: 550 5.0.0 Access denied) (expanded from: ) ----- Transcript of session follows ----- ... while talking to mx2.domain.com.: >>> MAIL From: <<< 550 5.0.0 Access denied 554 5.0.0 Service unavailable My DNS server entries for the above domain; domain.com. IN MX 10 mail.domain.com. domain.com. IN MX 20 mx1.domain.com. domain.com. IN MX 30 mx2.domain.com. SendMail version; Sendmail 8.12.6/8.12.6 with all the latest updates. /etc/mail/access file; localhost.localdomain RELAY localhost RELAY 127.0.0.1 RELAY domain.com RELAY domain.net RELAY otherdomain1.com RELAY otherdomain2.com RELAY -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030430/9ce7645e/attachment.html From mailscanner at LISTS.COM.AR Wed Apr 30 16:03:12 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: SpamAssassin Install Prefix In-Reply-To: <3EAEBADE.6651.148B3AD7@localhost> Message-ID: <3EAFBB80.29576.1875C17F@localhost> Hi Julian, the patch below is a little more general... it can only get confused if there's more than one SpamAssassin with the same "SpamAssassin Install Prefix" for different Perl installations... a relativeley unlikely event that will probably have other side effects besides this one... Anyway, it will complain in the log if this happens, and will show you which version it is using. El 29 Apr 2003 a las 17:48, Mariano Absatz escribi?: > Hi Julian, > > I installed SpamAssassin in an unusual place (say... /opt/SpamAssassin), > configured it in the options like: > SpamAssassin Install Prefix = /opt/SpamAssassin > > and it didn't work... browsing the log I see repeatedly: > Apr 29 17:29:20 alerce2-or Alerce-MX[17638]: MailScanner E-Mail Virus Scanner > version 4.15-9 starting... > Apr 29 17:29:20 alerce2-or Alerce-MX[17638]: SpamAssassin installation could > not be found > > and looking at SA.pm I see that you don't prepend the possibly modified > directory to the @INC array... > *** SA.pm.old Tue Apr 29 17:33:11 2003 --- SA.pm Wed Apr 30 11:58:53 2003 *************** *** 72,77 **** --- 72,101 ---- unless (MailScanner::Config::IsSimpleValue('usespamassassin') && !MailScanner::Config::Value('usespamassassin')) { + # BBY 2003-04-30: this is necessary for the "require Mail::SpamAssassin" + # to work if spamassassininstallprefix is not in the standard @INC or + # is not the in the same place as MailScanner (that was pushed onto @INC + # earlier) + $val = MailScanner::Config::Value('spamassassininstallprefix'); + if ($val ne "") { + $settings{PREFIX} = $val; + $val .= "/lib/perl5/site_perl/5*"; + my $libdir; + my $libsfound=0; + foreach $libdir (glob($val)) { + if ( -f $libdir . "/Mail/SpamAssassin.pm" ) { + unshift @INC, $libdir unless $libsfound; + ++$libsfound; + } + } + if ($libsfound < 1) { + MailScanner::Log::WarnLog("SpamAssassin not found in %s",$val); + } + elsif ($libsfound > 1) { + MailScanner::Log::WarnLog("More than one SpamAssassin found in %s." + . " Using the one at %s",$val,$INC[0]); + } + } MailScanner::Log::DieLog("SpamAssassin installation could not be found") unless eval "require Mail::SpamAssassin"; $settings{dont_copy_prefs} = 1; # Removes need for home directory *************** *** 79,94 **** $settings{userprefs_filename} = $prefs if defined $prefs; $val = MailScanner::Config::Value('debugspamassassin'); $settings{debug} = $val; - # Bunch of extra settings only used by Tony Finch, so not mentioned - # in supplied MailScanner.conf file. $val = MailScanner::Config::Value('spamassassinuserstatedir'); $settings{userstate_dir} = $val if $val ne ""; $val = MailScanner::Config::Value('spamassassinlocalrulesdir'); $settings{LOCAL_RULES_DIR} = $val if $val ne ""; $val = MailScanner::Config::Value('spamassassindefaultrulesdir'); $settings{DEF_RULES_DIR} = $val if $val ne ""; - $val = MailScanner::Config::Value('spamassassininstallprefix'); - $settings{PREFIX} = $val if $val ne ""; $MailScanner::SA::SAspamtest = new Mail::SpamAssassin(\%settings); #if ($prefs ne "") { --- 103,114 ---- -- Mariano Absatz El Baby ---------------------------------------------------------- Ambivalent? Well, yes and no. From AndreaC at GOTECH.IT Wed Apr 30 16:11:48 2003 From: AndreaC at GOTECH.IT (Andrea Cogliati) Date: Thu Jan 12 21:17:54 2006 Subject: [O/T] Scanning Email in EU (Was: InfoSecurity show) Message-ID: <463F0AFA3E2CEA4E807EC569C019E739140B73@atlantis.gtub.corp> David, This is really interesting. Do you mean that even virus-scanning email is not legal in Austria? Can you be more precise about it? I.E. do you have any links to Austrian/European laws regarding this topic? Regarding Italy, the usage of anti-viruses, including scanning emails, is mandatory by law (or, at least, this is the common interpretation of the Information Security Act and also the Privacy Act). Best regards, Andrea -----Original Message----- From: David [mailto:dh@UPTIME.AT] Sent: Wednesday, April 30, 2003 1:55 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: InfoSecurity show [...] >> FWIW The main argument I hear for moving to a commercial product is >> the 'content filtering' that some of the commercial products claim to >> do. The main reasons for this being HR & legal related This is a very, very tricky subject. In Austria for example and that would account to any country currently in the EU (to some extent) it is illegal to filter the content of email messages as soon as the employer allows you to receive or send private messages from work. [...] From dot at DOTAT.AT Wed Apr 30 16:24:26 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:54 2006 Subject: SpamAssassin Install Prefix In-Reply-To: References: <3EAEBADE.6651.148B3AD7@localhost> Message-ID: Mariano Absatz wrote: > >the patch below is a little more general... it can only get confused if >there's more than one SpamAssassin with the same "SpamAssassin Install >Prefix" for different Perl installations... a relativeley unlikely event >that will probably have other side effects besides this one... I suggested to Julian that he use $PERL_VERSION in the path added to @INC which should do the right thing. (This is the "English" version of the variable name which is compatible with perl <= 5.005 and >= 5.6.) Tony. -- f.a.n.finch http://dotat.at/ WHITBY TO THE WASH: SOUTHWEST 4 OR 5, EASING 3 FOR A TIME, LOCALLY INCREASING 6 LATER. SHOWERS OR RAIN. MODERATE OR GOOD. SLIGHT OR MODERATE. From mailscanner at ecs.soton.ac.uk Wed Apr 30 16:43:40 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <1051711085.18172.215.camel@nerijus> References: <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030430164257.04156bc0@imap.ecs.soton.ac.uk> I just ran "kavdaemon.sh" and it started up something which appeared to be capable of recognising viruses :-) At 14:58 30/04/2003, you wrote: >An, 2003-04-29 20:40, Julian Field wrote: > > > Run as > > cd /root/q > > AvpDaemonClient . > > works fine. It doesn't need the full pathname. > > > > Here is a chunk of the output from it: > > > > >Current object: ./eicars/dfh3MENF6X020229 > > >Test result: 4 > > >Known viruses were detected > >AvpDaemonClient from Sample1 directory does not find viruses at all, >even if I run it with full path: > ># pwd >/var/virge/temp > ># kavscanner -I0 . > >+-------------------------------------------------------+ >| Kaspersky Anti-Virus for Linux | >| Copyright(C) Kaspersky Lab. 1998-2002 | >| Version 4.0.3.0 | >... >Current object: /var/virge/temp/ >/var/virge/temp/a infected: EICAR-Test-File >... > ># AvpDaemonClient1 . >Test result: 0 >No viruses were found >... > ># AvpDaemonClient1 /var/virge/temp >Test result: 0 >No viruses were found >... > ># AvpDaemonClient1 /var/virge/temp/a >Test result: 0 >No viruses were found > > >AvpDaemonClient from Sample directory works, but only with full path: > ># AvpDaemonClient . >Test result: 1 >Test result: 0x31, flags: 0x100 >Virus scan was not complete >Found viruses: >Return code: 1 > ># AvpDaemonClient /var/virge/temp >Test result: 4 >Test result: 0x34, flags: 0x100 >Known viruses were detected >Found viruses: /var/virge/temp/a infected: EICAR-Test-File > > > > Please can you work out why yours doesn't work the same way as mine? > > If you just run the command "AvpDaemonClient ." then please do a "which > > AvpDaemonClient" to check where it is actually getting it from. > >I really don't know why it works for you and doesn't for me. What are >your kavdaemon parameters? I run it as >/opt/AVP/kavdaemon -I0 -Y /var/virge/temp/ /var/spool/ : ># ps axw|grep kav >14755 ? S 0:00 >/opt/AVP/kavdaemon(Logger) >14756 ? S 0:00 /opt/AVP/kavdaemon -I0 -Y /var/virge/temp/ >/var/spool/ > >System is RH 7.3. >I tried running AvpDaemonClient with full path >(/usr/local/bin/AvpDaemonClient), it doesn't change anything. > >The fact is, that it doesn't work here on 2 different systems, and I >asked kaspersky support about this problem, and they told that "." is >not supported by kavdaemon for security reasons. So is there any >possibility to pass full path to kavdaemon client? IMHO it would solve >all the problems. > >Regards, >Nerijus -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 16:47:26 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Fowarding ham and Spam to specific user in the MX server for sa-learn. In-Reply-To: <000a01c30f23$a0a55e50$45028f0a@MAM> Message-ID: <5.2.0.9.2.20030430164359.042c08f0@imap.ecs.soton.ac.uk> Skipped content of type multipart/alternative-------------- next part -------------- A non-text attachment was scrubbed... Name: learn.spam Type: application/octet-stream Size: 748 bytes Desc: not available Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030430/03407dd5/learn.obj -------------- next part -------------- -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 16:53:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Opps Mailscanner 4-11 + sophossavi just screwed up. In-Reply-To: References: <5.2.1.1.2.20030430110514.02806360@imap.ecs.soton.ac.uk> Message-ID: <5.2.0.9.2.20030430165150.04239ec0@imap.ecs.soton.ac.uk> At 11:29 30/04/2003, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: RIPEMD160 > > >On Mittwoch, April 30, 2003, at 12:07 Uhr, Julian Field wrote: > >>Can you start by checking that your midnight update worked okay? >>It is failing to be able to link to the SAVI library. >>What does "ls -al /usr/local/Sophos/lib" produce? >The output looks as follows: > >ls -la /usr/local/Sophos/lib/ >total 8644 >drwxr-xr-x 2 root root 4096 Apr 29 22:52 . >drwxr-xr-x 6 root root 4096 Apr 30 12:01 .. >lrwxrwxrwx 1 root root 12 Apr 29 22:52 libsavi.so -> >libsavi.so.3 >lrwxrwxrwx 1 root root 21 Apr 29 22:52 libsavi.so.2 -> >libsavi.so.3.2.05.034 >lrwxrwxrwx 1 root root 21 Apr 29 22:52 libsavi.so.3 -> >libsavi.so.3.2.05.034 >- -r-xr-xr-x 1 root bin 1452280 Feb 25 14:05 >libsavi.so.3.2.05.030 >- -r-xr-xr-x 1 root bin 1455320 Apr 10 10:37 >libsavi.so.3.2.05.033 >- -r-xr-xr-x 1 bin bin 1455552 Apr 29 22:52 >libsavi.so.3.2.05.034 >- -rw-r--r-- 1 bin bin 443637 Apr 29 22:52 vdl01.vdb >- -rw-r--r-- 1 bin bin 401446 Apr 29 22:52 vdl02.vdb >- -rw-r--r-- 1 bin bin 389383 Apr 29 22:52 vdl03.vdb >- -rw-r--r-- 1 bin bin 439542 Apr 29 22:52 vdl04.vdb >- -rw-r--r-- 1 bin bin 459468 Apr 29 22:52 vdl05.vdb >- -rw-r--r-- 1 bin bin 376402 Apr 29 22:52 vdl06.vdb >- -rw-r--r-- 1 bin bin 374881 Apr 29 22:52 vdl07.vdb >- -rw-r--r-- 1 bin bin 344925 Apr 29 22:52 vdl08.vdb >- -rw-r--r-- 1 bin bin 377505 Apr 29 22:52 vdl09.vdb >- -rw-r--r-- 1 bin bin 370090 Apr 29 22:52 vdl10.vdb >- -rw-r--r-- 1 bin bin 408714 Apr 29 22:52 vdl-3.69.dat >lrwxrwxrwx 1 root root 12 Apr 29 22:52 vdl.dat -> >vdl-3.69.dat > >Which does not look differently to when it worked. I did not create >symlinks for libsavi.so.2 to libsavi.so since that is resolved anyways. > > >>If you shutdown and restart MailScanner, what happens? Does it work as >>normal? >No, I tried that yesterday night and it simply continues to fail. I >have no idea why. When I switch to regular sophos all is well. I might >be able to test again this night. > >> >>>Apr 30 00:15:21 mail MailScanner[21166]: SophosSAVI ERROR:: >>>initializing savi: Unknown error (557) >> >>That's the cause of the problems. > >What irks me, is the fact that we update at 00:00 and the problem just >shows 15 minutes later? IN the meantime messages did pass over the >server. What happens if you delete the old versions of the libraries, ie. libsavi.so.2 libsavi.so.3.2.05.030 libsavi.so.3.2.05.033 -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support From nerijus at USERS.SOURCEFORGE.NET Wed Apr 30 17:20:25 2003 From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas) Date: Thu Jan 12 21:17:54 2006 Subject: KavDaemonClient (Was Re: F-Secure 4.50 not supported) In-Reply-To: <5.2.0.9.2.20030430164257.04156bc0@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <006f01c2f886$495839a0$8801020a@brianmay> <006f01c2f886$495839a0$8801020a@brianmay> <5.2.0.9.2.20030428173535.02cc5058@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428184237.02303c80@imap.ecs.soton.ac.uk> <5.2.1.1.2.20030428223600.028269b0@imap.ecs.soton.ac.uk> <1051570427.18171.100.camel@nerijus> <5.2.1.1.2.20030429183541.03e27c68@imap.ecs.soton.ac.uk> <5.2.0.9.2.20030430164257.04156bc0@imap.ecs.soton.ac.uk> Message-ID: <1051719625.18172.226.camel@nerijus> Tr, 2003-04-30 18:43, Julian Field wrote: > I just ran "kavdaemon.sh" and it started up something which appeared to be > capable of recognising viruses :-) OK, I've just tried doing "service kavd stop", making sure no more kavdaemon processes are running, and launching kavdaemon.sh. AvpDaemonClient from Sample1 still does not find viruses. What about my other questions/suggestions? Nerijus From mailscanner at LISTS.COM.AR Wed Apr 30 17:52:15 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: SpamAssassin Install Prefix In-Reply-To: References: Message-ID: <3EAFD50F.28060.18D99B55@localhost> Following your suggestion, this patch is much simpler, then... anyway, if SpamAssassin is _not_ there, the "eval" will catch it and die gracefully. I used $^V (equivalent to $PERL_VERSION) in order to not have to "use English;" (or is it used somewhere and I didn't see it?). El 30 Apr 2003 a las 16:24, Tony Finch escribi?: > Mariano Absatz wrote: > > > >the patch below is a little more general... it can only get confused if > >there's more than one SpamAssassin with the same "SpamAssassin Install > >Prefix" for different Perl installations... a relativeley unlikely event > >that will probably have other side effects besides this one... > > I suggested to Julian that he use $PERL_VERSION in the path added to > @INC which should do the right thing. (This is the "English" version of > the variable name which is compatible with perl <= 5.005 and >= 5.6.) > *** SA.pm.old Tue Apr 29 17:33:11 2003 --- SA.pm Wed Apr 30 13:47:38 2003 *************** *** 72,77 **** --- 72,87 ---- unless (MailScanner::Config::IsSimpleValue('usespamassassin') && !MailScanner::Config::Value('usespamassassin')) { + # BBY 2003-04-30: this is necessary for the "require Mail::SpamAssassin" + # to work if spamassassininstallprefix is not in the standard @INC or + # is not the in the same place as MailScanner (that was pushed onto @INC + # earlier) + $val = MailScanner::Config::Value('spamassassininstallprefix'); + if ($val ne "") { + $settings{PREFIX} = $val; + $val .= "/lib/perl5/site_perl/" . $^V ; + unshift @INC, $val; + } MailScanner::Log::DieLog("SpamAssassin installation could not be found") unless eval "require Mail::SpamAssassin"; $settings{dont_copy_prefs} = 1; # Removes need for home directory *************** *** 79,94 **** $settings{userprefs_filename} = $prefs if defined $prefs; $val = MailScanner::Config::Value('debugspamassassin'); $settings{debug} = $val; - # Bunch of extra settings only used by Tony Finch, so not mentioned - # in supplied MailScanner.conf file. $val = MailScanner::Config::Value('spamassassinuserstatedir'); $settings{userstate_dir} = $val if $val ne ""; $val = MailScanner::Config::Value('spamassassinlocalrulesdir'); $settings{LOCAL_RULES_DIR} = $val if $val ne ""; $val = MailScanner::Config::Value('spamassassindefaultrulesdir'); $settings{DEF_RULES_DIR} = $val if $val ne ""; - $val = MailScanner::Config::Value('spamassassininstallprefix'); - $settings{PREFIX} = $val if $val ne ""; $MailScanner::SA::SAspamtest = new Mail::SpamAssassin(\%settings); #if ($prefs ne "") { --- 89,100 ---- -- Mariano Absatz El Baby ---------------------------------------------------------- If at first you don't succeed, call it version 1.0 From smhickel at CHARTERMI.NET Wed Apr 30 17:55:46 2003 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:17:54 2006 Subject: Mailscanner [defunct] in top In-Reply-To: <5.2.0.9.2.20030430164359.042c08f0@imap.ecs.soton.ac.uk> References: <5.2.0.9.2.20030430164359.042c08f0@imap.ecs.soton.ac.uk> Message-ID: <1051721739.1475.1.camel@steve.hickel.info> All, When I run top, mailscanner has started showing up as defunct. What does that mean? Anything to do? Steve ps. What is a zombie? -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030430/678b7ddd/attachment.bin From dh at UPTIME.AT Wed Apr 30 18:03:38 2003 From: dh at UPTIME.AT (David) Date: Thu Jan 12 21:17:54 2006 Subject: Opps Mailscanner 4-11 + sophossavi just screwed up. In-Reply-To: <5.2.0.9.2.20030430165150.04239ec0@imap.ecs.soton.ac.uk> Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 On Mittwoch, April 30, 2003, at 05:53 Uhr, Julian Field wrote: What happens if you delete the old versions of the libraries, ie. > libsavi.so.2 > libsavi.so.3.2.05.030 > libsavi.so.3.2.05.033 > Strangely enough, now it works. I will be checking if it stays that way the next few hours - -d > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > > - -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GCC d+ s: a-- C+ UB++++ P+ L++ E--- W N+ o+++ K w-- O M+ V++ PS PE Y++ PGP++++ t+ 5 X- R+ tv-- b++++ DI D+ G e++++ h+ r++ y++ - ------END GEEK CODE BLOCK------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (Darwin) iD8DBQE+sAHuiW/Ta/pxHPQRA6edAJ0SQQF7wmvtVDnSYgdJ942Z2NpAQgCcD1xL qfs6mXALbLq7G0T1tzxfWk0= =AmZP -----END PGP SIGNATURE----- From dot at DOTAT.AT Wed Apr 30 17:56:38 2003 From: dot at DOTAT.AT (Tony Finch) Date: Thu Jan 12 21:17:54 2006 Subject: SpamAssassin Install Prefix In-Reply-To: References: Message-ID: Mariano Absatz wrote: > >I used $^V (equivalent to $PERL_VERSION) in order to not have to "use=20 >English;" (or is it used somewhere and I didn't see it?). You have to add the use English command. $^V doesn't work in perl-5.005. Tony. -- f.a.n.finch http://dotat.at/ SELSEY BILL TO LYME REGIS: SOUTHWEST 5 OR 6, GRADUALLY DECREASING 3 OR 4. SQUALLY SHOWERS. GOOD, OCCASIONALLY MODERATE. ROUGH DECREASING MODERATE. From y.huang at UTORONTO.CA Wed Apr 30 18:31:42 2003 From: y.huang at UTORONTO.CA (Bruce Huang) Date: Thu Jan 12 21:17:54 2006 Subject: Too many open files Message-ID: Dear all, I did the entire search from this group and got no real answer about this problem. I upgraded MailScanner from 3.21 to 4.19 with Sun solaris 2.7. All goes well in lite traffic. The problem is this: during the heavy traffic, like announcement, e-mails will be kept in /var/spool/mqueue.in, and logs said: MailScanner[2462]: Could not open file >/var/spool/MailScanner/incoming/2462/h3OIihSp002991.header: Too many open files MailScanner[2462]: Cannot create + lock headers file /var/spool/MailScanner/incoming/2462/h3OIihSp002991.header, The Processing Incoming Mail setting in MailScanner.conf is as following Max Unscanned Bytes Per Scan = 100000000 Max Unsafe Bytes Per Scan = 50000000 Max Unscanned Messages Per Scan = 100 Max Unsafe Messages Per Scan = 100 Thanks for any advise. Regards, Bruce From ivan at NUCCI.COM.BR Wed Apr 30 18:50:19 2003 From: ivan at NUCCI.COM.BR (Ivan Mirisola) Date: Thu Jan 12 21:17:54 2006 Subject: Help with spammers References: <5C0296D26910694BB9A9BBFC577E7AB00117510D@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB00117510D@pascal.priv.bmrb.co.uk> <5.2.1.1.2.20030429205537.03e40800@imap.ecs.soton.ac.uk> Message-ID: <3EB00CDB.1080501@nucci.com.br> Hi all, I have been using MailScanner (without SpamAssassin) for quite a while and I have a question for you guys. What is the best way to block e-mails when they are in the form of [0-9]@mydomain.com I want to block any e-mail that arrive for invalid users on this particular domain where user name consists of just plain numbers like: 9827492364236438623896@mydomain.com Is this a job for MailScanner or for SpamAssassin ? Thanks in advance. Sincerely, Ivan From Kevin at MICA.NET Wed Apr 30 18:59:27 2003 From: Kevin at MICA.NET (Kevin Hanser) Date: Thu Jan 12 21:17:54 2006 Subject: Mailscanner / Spamassassin working, but not adding headers Message-ID: <4E33F38AD14BB4438BA6B970FDAE724C3D760E@mailserver.mica.net> Already got both of those set to yes, actually... That's the weird thing. Everything seems to be working fine, just the extra headers aren't there... thx k -----Original Message----- From: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET] Sent: Tuesday, April 29, 2003 11:17 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Mailscanner / Spamassassin working, but not adding headers Hi! > However, the headers don't seem to be getting added to the spam > messages. I've checked and double checked my configuration, and I > can't figure out what's going on. I even have the "Always include > spam report" option set to on, but still no headers. Is there a way > to tell Mailscanner to write a more detailed log than what it writes > in the maillog, so that I might be able to figure out what's going on > here? I've done numerous other installations that are all working, > but this latest one is determined to give me headaches it seems. There is # Do you want all spam to be logged? Useful if you want to gather # spam statistics from your logs, but can increase the system load quite # a bit if you get a lot of spam. Log Spam = yes I assume you have this allready turned on? And also: # Do you want to always include the Spam Report in the SpamCheck # header, even if the message wasn't spam? # This can also be the filename of a ruleset. Always Include SpamAssassin Report = no You could switch that one to yes From raymond at PROLOCATION.NET Wed Apr 30 19:02:11 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:54 2006 Subject: Too many open files In-Reply-To: Message-ID: Hi! > >/var/spool/MailScanner/incoming/2462/h3OIihSp002991.header: Too many open > files > The Processing Incoming Mail setting in MailScanner.conf is as following > Max Unscanned Bytes Per Scan = 100000000 > Max Unsafe Bytes Per Scan = 50000000 > Max Unscanned Messages Per Scan = 100 > Max Unsafe Messages Per Scan = 100 You have to tune your OS. Not mailscanner :=) Raise the maximum number of open files there. Bye, Raymond. From raymond at PROLOCATION.NET Wed Apr 30 19:03:56 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:54 2006 Subject: Mailscanner / Spamassassin working, but not adding headers In-Reply-To: <4E33F38AD14BB4438BA6B970FDAE724C3D760E@mailserver.mica.net> Message-ID: Hi! > Already got both of those set to yes, actually... That's the weird thing. > Everything seems to be working fine, just the extra headers aren't there... Are you sure your mail is even passing MS ? Not a plain sendmail running that empty's the queue ? Bye, Raymond. From kevins at BMRB.CO.UK Wed Apr 30 19:34:26 2003 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:17:54 2006 Subject: Too many open files In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175145@pascal.priv.bmrb.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175145@pascal.priv.bmrb.co.uk> Message-ID: <1051727669.11621.3.camel@bach.kevinspicer.co.uk> I upgraded MailScanner from 3.21 to 4.19 with Sun solaris 2.7. All goes well in lite traffic. I had a similar problem with some other software on Solaris 2.6 which I fixed by adding... ulimit -n unlimited to that the script that kicks off that process. You could add that to the init script or check_MailScanner script I guess. BMRB International http://www.bmrb.co.uk +44 (0)20 8566 5000 _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. From mailscanner at ecs.soton.ac.uk Wed Apr 30 19:37:09 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 Message-ID: <5.2.1.1.2.20030430193506.02688fa8@imap.ecs.soton.ac.uk> As so much has happened in the last 24 hours or so, here's a new beta release. It's on the downloads page, so go to www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml to get it. I have been pretty careful on what changes have gone in, and what have stayed out, but some testing by you folks would be much appreciated. Thanks! -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 19:44:04 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Too many open files In-Reply-To: Message-ID: <5.2.1.1.2.20030430194258.0272e808@imap.ecs.soton.ac.uk> What operating system are you running on, and what are the "maximum batch size" limits set to near the top of MailScanner.conf? You probably need to either a) increase the number of available file handles in your OS b) decrease the maximum size of a batch. At 18:31 30/04/2003, you wrote: >Dear all, > >I did the entire search from this group and got no real answer about this >problem. > >I upgraded MailScanner from 3.21 to 4.19 with Sun solaris 2.7. All goes >well in lite traffic. > >The problem is this: during the heavy traffic, like announcement, e-mails >will be kept in /var/spool/mqueue.in, and logs said: >MailScanner[2462]: Could not open file > >/var/spool/MailScanner/incoming/2462/h3OIihSp002991.header: Too many open >files >MailScanner[2462]: Cannot create + lock headers >file /var/spool/MailScanner/incoming/2462/h3OIihSp002991.header, > >The Processing Incoming Mail setting in MailScanner.conf is as following >Max Unscanned Bytes Per Scan = 100000000 >Max Unsafe Bytes Per Scan = 50000000 >Max Unscanned Messages Per Scan = 100 >Max Unsafe Messages Per Scan = 100 > > >Thanks for any advise. > >Regards, > >Bruce -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 19:47:41 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Help with spammers In-Reply-To: <3EB00CDB.1080501@nucci.com.br> References: <5C0296D26910694BB9A9BBFC577E7AB00117510D@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB00117510D@pascal.priv.bmrb.co.uk> <5.2.1.1.2.20030429205537.03e40800@imap.ecs.soton.ac.uk> Message-ID: <5.2.1.1.2.20030430194428.022eea68@imap.ecs.soton.ac.uk> At 18:50 30/04/2003, you wrote: >Hi all, > >I have been using MailScanner (without SpamAssassin) for quite a while >and I have a question for you guys. > >What is the best way to block e-mails when they are in the form of > >[0-9]@mydomain.com > >I want to block any e-mail that arrive for invalid users on this >particular domain where user name consists of just plain numbers like: > >9827492364236438623896@mydomain.com > >Is this a job for MailScanner or for SpamAssassin ? Completely blocking mail is a job for your MTA, not MS or SA. You can automatically mark it as spam with a simple ruleset, but it won't block it completely. Just about any MTA can support rejection based on address with a regular expression. In that case, you want to block [0-9]+@mydomain.com -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 19:51:08 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Too many open files In-Reply-To: <1051727669.11621.3.camel@bach.kevinspicer.co.uk> References: <5C0296D26910694BB9A9BBFC577E7AB001175145@pascal.priv.bmrb.co.uk> <5C0296D26910694BB9A9BBFC577E7AB001175145@pascal.priv.bmrb.co.uk> Message-ID: <5.2.1.1.2.20030430194920.0274be90@imap.ecs.soton.ac.uk> At 19:34 30/04/2003, you wrote: >I upgraded MailScanner from 3.21 to 4.19 with Sun solaris 2.7. All goes >well in lite traffic. > >I had a similar problem with some other software on Solaris 2.6 which I >fixed by adding... >ulimit -n unlimited >to that the script that kicks off that process. > >You could add that to the init script or check_MailScanner script I >guess. If you are running Solaris, then add this to /etc/system and then reboot: * rlim_fd_max = system-wide file descriptors limit * rlim_fd_cur = per-user file descriptors limit * Default values are 256 per user and 1024 globally, which is * far too small for MailScanner, which can use 1000 on its own. set rlim_fd_max=16384 set rlim_fd_cur=8192 BTW Make sure you get that change exactly right, or your machine won't boot :-) -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From raymond at PROLOCATION.NET Wed Apr 30 20:04:19 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <5.2.1.1.2.20030430193506.02688fa8@imap.ecs.soton.ac.uk> Message-ID: Hi! > > I have been pretty careful on what changes have gone in, and what have > stayed out, but some testing by you folks would be much appreciated. > I upgraded from 4.15-9 to 4.15-12 and it seems there is a problem. MS keeps looping and scanning the same messages. After scanning it seems its not moving the messages to the outgoing queue dir. Mailscanner 4.15-9/Sendmail combination on that box. Did you touch the part of the delivery code ? Bye, Raymond. From raymond at PROLOCATION.NET Wed Apr 30 20:12:28 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: Message-ID: Hi! > I upgraded from 4.15-9 to 4.15-12 and it seems there is a problem. MS > keeps looping and scanning the same messages. After scanning it seems its > not moving the messages to the outgoing queue dir. > > Mailscanner 4.15-9/Sendmail combination on that box. > > Did you touch the part of the delivery code ? It seems after scanning the MailScanner process just dies. I normally have 10 running but currently only a few active and its restarting all the time. I think i'll move back to the last working one :) Thanks, Raymond. From mailscanner at LISTS.COM.AR Wed Apr 30 20:58:03 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <5.2.1.1.2.20030430193506.02688fa8@imap.ecs.soton.ac.uk> Message-ID: <3EB0009B.2594.1983B707@localhost> El 30 Apr 2003 a las 19:37, Julian Field escribi?: > As so much has happened in the last 24 hours or so, here's a new beta > release. It's on the downloads page, so go to > www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml > to get it. > > I have been pretty careful on what changes have gone in, and what have > stayed out, but some testing by you folks would be much appreciated. OK, you did what Tony said, but kept a bug of mine (I had to versions and sent the wrong patch last time)... As the Camel book says, $PERL_VERSION is _not_ printable, so you must use sprintf("%vd",$PERL_VERSION)... this patch applies to 4.15-12 (sorry for the last one): *** SA.pm.old Wed Apr 30 16:53:20 2003 --- SA.pm Wed Apr 30 16:54:22 2003 *************** *** 92,98 **** # for finding the SpamAssassin libraries # Use unshift rather than push so that their given location is # always searched *first* and not last in the include path. ! unshift @INC, "$val/lib/perl5/site_perl/$PERL_VERSION"; } # Now we have the path built, try to find the SpamAssassin modules MailScanner::Log::DieLog("SpamAssassin installation could not be found") --- 92,98 ---- # for finding the SpamAssassin libraries # Use unshift rather than push so that their given location is # always searched *first* and not last in the include path. ! unshift @INC, "$val/lib/perl5/site_perl/" . sprintf("%vd",$PERL_VERSION); } # Now we have the path built, try to find the SpamAssassin modules MailScanner::Log::DieLog("SpamAssassin installation could not be found") -- Mariano Absatz El Baby ---------------------------------------------------------- The most exciting phrase to hear in science, the one that heralds new discoveries, is not 'Eureka!' but 'That's funny...' -- Isaac Asimov From mailscanner at ecs.soton.ac.uk Wed Apr 30 21:00:11 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: References: Message-ID: <5.2.1.1.2.20030430205943.022d0b18@imap.ecs.soton.ac.uk> Now fixed in 4.15-13. Please can you give it another try? I would really appreciate it if an Exim user could try this too please! At 20:12 30/04/2003, you wrote: >Hi! > > > I upgraded from 4.15-9 to 4.15-12 and it seems there is a problem. MS > > keeps looping and scanning the same messages. After scanning it seems its > > not moving the messages to the outgoing queue dir. > > > > Mailscanner 4.15-9/Sendmail combination on that box. > > > > Did you touch the part of the delivery code ? > >It seems after scanning the MailScanner process just dies. I normally have >10 running but currently only a few active and its restarting all the >time. > >I think i'll move back to the last working one :) > >Thanks, >Raymond. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Wed Apr 30 21:21:41 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <3EB0009B.2594.1983B707@localhost> References: <5.2.1.1.2.20030430193506.02688fa8@imap.ecs.soton.ac.uk> Message-ID: <3EB00625.31272.19995A52@localhost> BTW... I'm not at all sure that this is as backward portable as Tony thinks... can someone with access to a pre 5.6 perl tell me what does this command print: perl -e 'use English; printf "%vd\n",$PERL_VERSION;' TIA El 30 Apr 2003 a las 16:58, Mariano Absatz escribi?: > El 30 Apr 2003 a las 19:37, Julian Field escribi?: > > > As so much has happened in the last 24 hours or so, here's a new beta > > release. It's on the downloads page, so go to > > www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml > > to get it. > > > > I have been pretty careful on what changes have gone in, and what have > > stayed out, but some testing by you folks would be much appreciated. > OK, you did what Tony said, but kept a bug of mine (I had to versions and > sent the wrong patch last time)... > > As the Camel book says, $PERL_VERSION is _not_ printable, so you must use > sprintf("%vd",$PERL_VERSION)... this patch applies to 4.15-12 (sorry for the > last one): > -- Mariano Absatz El Baby ---------------------------------------------------------- Outside of a dog, a book is man's best friend. Inside of a dog, it's too dark to read. -- Groucho Marx From jase at SENSIS.COM Wed Apr 30 21:25:13 2003 From: jase at SENSIS.COM (Desai, Jason) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 Message-ID: Here you go: # perl -e 'use English; printf "%vd\n",$PERL_VERSION;' %vd # perl --version This is perl, version 5.005_03 built for i386-linux Copyright 1987-1999, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5.0 source kit. Complete documentation for Perl, including FAQ lists, should be found on this system using `man perl' or `perldoc perl'. If you have access to the Internet, point your browser at http://www.perl.com/, the Perl Home Page. Jason > -----Original Message----- > From: Mariano Absatz [mailto:mailscanner@LISTS.COM.AR] > Sent: Wednesday, April 30, 2003 4:22 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [MAILSCANNER] Beta 4.15-12 > > > BTW... I'm not at all sure that this is as backward portable as Tony > thinks... > > can someone with access to a pre 5.6 perl tell me what does > this command > print: > > perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > > TIA > > > El 30 Apr 2003 a las 16:58, Mariano Absatz escribi?: > > > El 30 Apr 2003 a las 19:37, Julian Field escribi?: > > > > > As so much has happened in the last 24 hours or so, > here's a new beta > > > release. It's on the downloads page, so go to > > > www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml > > > to get it. > > > > > > I have been pretty careful on what changes have gone in, > and what have > > > stayed out, but some testing by you folks would be much > appreciated. > > OK, you did what Tony said, but kept a bug of mine (I had > to versions and > > sent the wrong patch last time)... > > > > As the Camel book says, $PERL_VERSION is _not_ printable, > so you must use > > sprintf("%vd",$PERL_VERSION)... this patch applies to > 4.15-12 (sorry for the > > last one): > > > > -- > Mariano Absatz > El Baby > ---------------------------------------------------------- > Outside of a dog, a book is man's best friend. > Inside of a dog, it's too dark to read. > -- Groucho Marx > From raymond at PROLOCATION.NET Wed Apr 30 21:27:21 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <5.2.1.1.2.20030430205943.022d0b18@imap.ecs.soton.ac.uk> Message-ID: Hi! > Now fixed in 4.15-13. > Please can you give it another try? Sure. =) Tap tap tap ... Looking good, delivery takes place now! I'll put it on my other box also in a few. So far so good! Bye, Raymond. From Denis.Beauchemin at USHERBROOKE.CA Wed Apr 30 21:27:17 2003 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <3EB00625.31272.19995A52@localhost> References: <5.2.1.1.2.20030430193506.02688fa8@imap.ecs.soton.ac.uk> <3EB00625.31272.19995A52@localhost> Message-ID: <1051734437.1262.62.camel@dbeauchemin.si.usherbrooke.ca> This is what I get on an AIX box: $ perl -e 'use English; printf "%vd\n",$PERL_VERSION;' %vd $ perl --version This is perl, version 5.004_03 ... It works OK on 5.6+. Denis Le mer 30/04/2003 ? 16:21, Mariano Absatz a ?crit : > BTW... I'm not at all sure that this is as backward portable as Tony > thinks... > > can someone with access to a pre 5.6 perl tell me what does this command > print: > > perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > > TIA > > > El 30 Apr 2003 a las 16:58, Mariano Absatz escribi?: > > > El 30 Apr 2003 a las 19:37, Julian Field escribi?: > > > > > As so much has happened in the last 24 hours or so, here's a new beta > > > release. It's on the downloads page, so go to > > > www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml > > > to get it. > > > > > > I have been pretty careful on what changes have gone in, and what have > > > stayed out, but some testing by you folks would be much appreciated. > > OK, you did what Tony said, but kept a bug of mine (I had to versions and > > sent the wrong patch last time)... > > > > As the Camel book says, $PERL_VERSION is _not_ printable, so you must use > > sprintf("%vd",$PERL_VERSION)... this patch applies to 4.15-12 (sorry for the > > last one): > > > > -- > Mariano Absatz > El Baby > ---------------------------------------------------------- > Outside of a dog, a book is man's best friend. > Inside of a dog, it's too dark to read. > -- Groucho Marx -- Denis Beauchemin, analyste Universit? de Sherbrooke, S.T.I. T: 819.821.8000x2252 F: 819.821.8045 From joe.eckard at REDROCKETCORP.COM Wed Apr 30 21:24:47 2003 From: joe.eckard at REDROCKETCORP.COM (Joe Eckard) Date: Thu Jan 12 21:17:54 2006 Subject: MIME::Parser: can't open tmpfile: Invalid argument Message-ID: I have been using MailScanner for quite some time now, and I have to say that it has been working great. However, I recently brought a new mail server online and attempted to install the latest version - I am getting errors that I can't seem to resolve. Has anyone else seen these, or is it obvious what is wrong? I am running FreeBSD 5.0, Perl 5.8.0, sendmail 8.12.8 and the recommended versions of all required perl modules. (My working copy was MS 3.20 on FreeBSD 4.1 with sendmail 8.12.8) here is the maillog output: Apr 30 15:54:42 krusty MailScanner[3088]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 30 15:54:42 krusty MailScanner[3088]: Using locktype = flock Apr 30 15:54:52 krusty MailScanner[3092]: MailScanner E-Mail Virus Scanner version 4.14-9 starting... Apr 30 15:54:52 krusty MailScanner[3092]: Using locktype = flock Apr 30 15:54:57 krusty MailScanner[3092]: New Batch: Scanning 1 messages, 13335 bytes Apr 30 15:54:57 krusty MailScanner[3092]: Cannot parse /var/spool/MailScanner/incoming/3092/h3UJss6F003090.header and , MIME::Parser: can't open tmpfile: Invalid argument Any advice would be greatly appreciated... Thanks, Joe sidenote: on my old system, mailscanner always ran as a single process... however now it starts out as 2, and the number of instances steadily increases until I kill them all off. From mailscanner at LISTS.COM.AR Wed Apr 30 21:35:23 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <1051734437.1262.62.camel@dbeauchemin.si.usherbrooke.ca> References: <3EB00625.31272.19995A52@localhost> Message-ID: <3EB0095B.32245.19A5E4C2@localhost> Got one here also... back to the drawing board... hold on 10 minutes... El 30 Apr 2003 a las 16:27, Denis Beauchemin escribi?: > This is what I get on an AIX box: > $ perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > %vd > $ perl --version > > This is perl, version 5.004_03 > ... > > It works OK on 5.6+. > > Denis > > Le mer 30/04/2003 ? 16:21, Mariano Absatz a ?crit : > > BTW... I'm not at all sure that this is as backward portable as Tony > > thinks... > > > > can someone with access to a pre 5.6 perl tell me what does this command > > print: > > > > perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > > > > TIA > > > > > > El 30 Apr 2003 a las 16:58, Mariano Absatz escribi?: > > > > > El 30 Apr 2003 a las 19:37, Julian Field escribi?: > > > > > > > As so much has happened in the last 24 hours or so, here's a new beta > > > > release. It's on the downloads page, so go to > > > > www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml > > > > to get it. > > > > > > > > I have been pretty careful on what changes have gone in, and what have > > > > stayed out, but some testing by you folks would be much appreciated. > > > OK, you did what Tony said, but kept a bug of mine (I had to versions and > > > sent the wrong patch last time)... > > > > > > As the Camel book says, $PERL_VERSION is _not_ printable, so you must use > > > sprintf("%vd",$PERL_VERSION)... this patch applies to 4.15-12 (sorry for the > > > last one): > > > > > > > -- > > Mariano Absatz > > El Baby > > ---------------------------------------------------------- > > Outside of a dog, a book is man's best friend. > > Inside of a dog, it's too dark to read. > > -- Groucho Marx > -- > Denis Beauchemin, analyste > Universit? de Sherbrooke, S.T.I. > T: 819.821.8000x2252 F: 819.821.8045 -- Mariano Absatz El Baby ---------------------------------------------------------- Friends help you move. Real friends help you move bodies. From mailscanner at ecs.soton.ac.uk Wed Apr 30 21:36:50 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <1051734437.1262.62.camel@dbeauchemin.si.usherbrooke.ca> References: <3EB00625.31272.19995A52@localhost> <5.2.1.1.2.20030430193506.02688fa8@imap.ecs.soton.ac.uk> <3EB00625.31272.19995A52@localhost> Message-ID: <5.2.1.1.2.20030430213548.023b2290@imap.ecs.soton.ac.uk> At 21:27 30/04/2003, you wrote: >This is what I get on an AIX box: >$ perl -e 'use English; printf "%vd\n",$PERL_VERSION;' >%vd >$ perl --version > >This is perl, version 5.004_03 Does the same thing on 5.005 as well :-( So, as it stands, this feature won't work on perl pre 5.6. >Le mer 30/04/2003 ? 16:21, Mariano Absatz a ?crit : > > BTW... I'm not at all sure that this is as backward portable as Tony > > thinks... > > > > can someone with access to a pre 5.6 perl tell me what does this command > > print: > > > > perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > > > > TIA > > > > > > El 30 Apr 2003 a las 16:58, Mariano Absatz escribi?: > > > > > El 30 Apr 2003 a las 19:37, Julian Field escribi?: > > > > > > > As so much has happened in the last 24 hours or so, here's a new beta > > > > release. It's on the downloads page, so go to > > > > www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml > > > > to get it. > > > > > > > > I have been pretty careful on what changes have gone in, and what have > > > > stayed out, but some testing by you folks would be much appreciated. > > > OK, you did what Tony said, but kept a bug of mine (I had to versions > and > > > sent the wrong patch last time)... > > > > > > As the Camel book says, $PERL_VERSION is _not_ printable, so you must > use > > > sprintf("%vd",$PERL_VERSION)... this patch applies to 4.15-12 (sorry > for the > > > last one): > > > > > > > -- > > Mariano Absatz > > El Baby > > ---------------------------------------------------------- > > Outside of a dog, a book is man's best friend. > > Inside of a dog, it's too dark to read. > > -- Groucho Marx >-- >Denis Beauchemin, analyste >Universit? de Sherbrooke, S.T.I. >T: 819.821.8000x2252 F: 819.821.8045 -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Wed Apr 30 21:48:31 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <5.2.1.1.2.20030430213548.023b2290@imap.ecs.soton.ac.uk> References: <1051734437.1262.62.camel@dbeauchemin.si.usherbrooke.ca> Message-ID: <3EB00C6F.13385.19B1E9F4@localhost> This should apply nicely to 4.15-13 and work with any version of Perl5... El 30 Apr 2003 a las 21:36, Julian Field escribi?: > At 21:27 30/04/2003, you wrote: > >This is what I get on an AIX box: > >$ perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > >%vd > >$ perl --version > > > >This is perl, version 5.004_03 > > Does the same thing on 5.005 as well :-( > So, as it stands, this feature won't work on perl pre 5.6. > > >Le mer 30/04/2003 ? 16:21, Mariano Absatz a ?crit : > > > BTW... I'm not at all sure that this is as backward portable as Tony > > > thinks... > > > > > > can someone with access to a pre 5.6 perl tell me what does this command > > > print: > > > > > > perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > > > > > > TIA > > > > > > > > > El 30 Apr 2003 a las 16:58, Mariano Absatz escribi?: > > > > > > > El 30 Apr 2003 a las 19:37, Julian Field escribi?: > > > > > > > > > As so much has happened in the last 24 hours or so, here's a new beta > > > > > release. It's on the downloads page, so go to > > > > > www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml > > > > > to get it. > > > > > > > > > > I have been pretty careful on what changes have gone in, and what have > > > > > stayed out, but some testing by you folks would be much appreciated. > > > > OK, you did what Tony said, but kept a bug of mine (I had to versions > > and > > > > sent the wrong patch last time)... > > > > > > > > As the Camel book says, $PERL_VERSION is _not_ printable, so you must > > use > > > > sprintf("%vd",$PERL_VERSION)... this patch applies to 4.15-12 (sorry > > for the > > > > last one): *** SA.pm.old Wed Apr 30 17:34:05 2003 --- SA.pm Wed Apr 30 17:46:51 2003 *************** *** 92,98 **** # for finding the SpamAssassin libraries # Use unshift rather than push so that their given location is # always searched *first* and not last in the include path. ! unshift @INC, "$val/lib/perl5/site_perl/$PERL_VERSION"; } # Now we have the path built, try to find the SpamAssassin modules MailScanner::Log::DieLog("SpamAssassin installation could not be found") --- 92,99 ---- # for finding the SpamAssassin libraries # Use unshift rather than push so that their given location is # always searched *first* and not last in the include path. ! my $perl_vers = $PERL_VERSION < 5.006 ? $PERL_VERSION : sprintf("%vd",$PERL_VERSION); ! unshift @INC, "$val/lib/perl5/site_perl/$perl_vers"; } # Now we have the path built, try to find the SpamAssassin modules MailScanner::Log::DieLog("SpamAssassin installation could not be found") -- Mariano Absatz El Baby ---------------------------------------------------------- The Internet is mightier than the pen. From mailscanner at LISTS.COM.AR Wed Apr 30 21:59:53 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <3EB00C6F.13385.19B1E9F4@localhost> References: <5.2.1.1.2.20030430213548.023b2290@imap.ecs.soton.ac.uk> Message-ID: <3EB00F19.25321.19BC5291@localhost> Right... now my mailer is doing strange things to the patch... let's see if the patch (for 4.15-3) is now readable as an attachment... -- Mariano Absatz El Baby ---------------------------------------------------------- Did anyone see my lost carrier? -------------- next part -------------- *** SA.pm.old Wed Apr 30 17:34:05 2003 --- SA.pm Wed Apr 30 17:46:51 2003 *************** *** 92,98 **** # for finding the SpamAssassin libraries # Use unshift rather than push so that their given location is # always searched *first* and not last in the include path. ! unshift @INC, "$val/lib/perl5/site_perl/$PERL_VERSION"; } # Now we have the path built, try to find the SpamAssassin modules MailScanner::Log::DieLog("SpamAssassin installation could not be found") --- 92,99 ---- # for finding the SpamAssassin libraries # Use unshift rather than push so that their given location is # always searched *first* and not last in the include path. ! my $perl_vers = $PERL_VERSION < 5.006 ? $PERL_VERSION : sprintf("%vd",$PERL_VERSION); ! unshift @INC, "$val/lib/perl5/site_perl/$perl_vers"; } # Now we have the path built, try to find the SpamAssassin modules MailScanner::Log::DieLog("SpamAssassin installation could not be found") From mailscanner at ecs.soton.ac.uk Wed Apr 30 21:58:40 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: MIME::Parser: can't open tmpfile: Invalid argument In-Reply-To: Message-ID: <5.2.1.1.2.20030430215718.026dae68@imap.ecs.soton.ac.uk> The usual cause of this is having MailScanner 3 and 4 working at the same time. Check you have removed the cron job that checks to ensure 3 is running, and that you have stopped all 3 processes before starting any 4 ones. If you aren't running sendmail, check that the permissions of /var/spool/MailScanner allow the "Run As User" and "Run As Group" to write to it. At 21:24 30/04/2003, you wrote: >I have been using MailScanner for quite some time now, and I have to >say that it has been working great. However, I recently brought a new >mail server online and attempted to install the latest version - I am >getting errors that I can't seem to resolve. Has anyone else seen >these, or is it obvious what is wrong? I am running FreeBSD 5.0, Perl >5.8.0, sendmail 8.12.8 and the recommended versions of all required >perl modules. (My working copy was MS 3.20 on FreeBSD 4.1 with sendmail >8.12.8) > >here is the maillog output: > >Apr 30 15:54:42 krusty MailScanner[3088]: MailScanner E-Mail Virus >Scanner version 4.14-9 starting... >Apr 30 15:54:42 krusty MailScanner[3088]: Using locktype = flock >Apr 30 15:54:52 krusty MailScanner[3092]: MailScanner E-Mail Virus >Scanner version 4.14-9 starting... >Apr 30 15:54:52 krusty MailScanner[3092]: Using locktype = flock >Apr 30 15:54:57 krusty MailScanner[3092]: New Batch: Scanning 1 >messages, 13335 bytes >Apr 30 15:54:57 krusty MailScanner[3092]: Cannot parse >/var/spool/MailScanner/incoming/3092/h3UJss6F003090.header and , >MIME::Parser: can't open tmpfile: Invalid argument > > >Any advice would be greatly appreciated... > >Thanks, > >Joe > >sidenote: on my old system, mailscanner always ran as a single >process... however now it starts out as 2, and the number of instances >steadily increases until I kill them all off. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at ecs.soton.ac.uk Wed Apr 30 22:03:09 2003 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:17:54 2006 Subject: Beta 4.15-12 In-Reply-To: <3EB00C6F.13385.19B1E9F4@localhost> References: <5.2.1.1.2.20030430213548.023b2290@imap.ecs.soton.ac.uk> <1051734437.1262.62.camel@dbeauchemin.si.usherbrooke.ca> Message-ID: <5.2.1.1.2.20030430220235.023205a0@imap.ecs.soton.ac.uk> Thanks for that. Works fine under 5.005. At 21:48 30/04/2003, you wrote: >This should apply nicely to 4.15-13 and work with any version of Perl5... > >El 30 Apr 2003 a las 21:36, Julian Field escribi?: > > > At 21:27 30/04/2003, you wrote: > > >This is what I get on an AIX box: > > >$ perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > > >%vd > > >$ perl --version > > > > > >This is perl, version 5.004_03 > > > > Does the same thing on 5.005 as well :-( > > So, as it stands, this feature won't work on perl pre 5.6. > > > > >Le mer 30/04/2003 ? 16:21, Mariano Absatz a ?crit : > > > > BTW... I'm not at all sure that this is as backward portable as Tony > > > > thinks... > > > > > > > > can someone with access to a pre 5.6 perl tell me what does this > command > > > > print: > > > > > > > > perl -e 'use English; printf "%vd\n",$PERL_VERSION;' > > > > > > > > TIA > > > > > > > > > > > > El 30 Apr 2003 a las 16:58, Mariano Absatz escribi?: > > > > > > > > > El 30 Apr 2003 a las 19:37, Julian Field escribi?: > > > > > > > > > > > As so much has happened in the last 24 hours or so, here's a > new beta > > > > > > release. It's on the downloads page, so go to > > > > > > www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml > > > > > > to get it. > > > > > > > > > > > > I have been pretty careful on what changes have gone in, and > what have > > > > > > stayed out, but some testing by you folks would be much > appreciated. > > > > > OK, you did what Tony said, but kept a bug of mine (I had to > versions > > > and > > > > > sent the wrong patch last time)... > > > > > > > > > > As the Camel book says, $PERL_VERSION is _not_ printable, so you > must > > > use > > > > > sprintf("%vd",$PERL_VERSION)... this patch applies to 4.15-12 (sorry > > > for the > > > > > last one): >*** SA.pm.old Wed Apr 30 17:34:05 2003 >--- SA.pm Wed Apr 30 17:46:51 2003 >*************** >*** 92,98 **** > # for finding the SpamAssassin libraries > # Use unshift rather than push so that their given location is > # always searched *first* and not last in the include path. >! unshift @INC, "$val/lib/perl5/site_perl/$PERL_VERSION"; > } > # Now we have the path built, try to find the SpamAssassin modules > MailScanner::Log::DieLog("SpamAssassin installation could not be > found") >--- 92,99 ---- > # for finding the SpamAssassin libraries > # Use unshift rather than push so that their given location is > # always searched *first* and not last in the include path. >! my $perl_vers = $PERL_VERSION < 5.006 ? $PERL_VERSION : >sprintf("%vd",$PERL_VERSION); >! unshift @INC, "$val/lib/perl5/site_perl/$perl_vers"; > } > # Now we have the path built, try to find the SpamAssassin modules > MailScanner::Log::DieLog("SpamAssassin installation could not be > found") > > > >-- >Mariano Absatz >El Baby >---------------------------------------------------------- >The Internet is mightier than the pen. -- Julian Field www.MailScanner.info Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support From mailscanner at LISTS.COM.AR Wed Apr 30 22:10:20 2003 From: mailscanner at LISTS.COM.AR (Mariano Absatz) Date: Thu Jan 12 21:17:54 2006 Subject: yet another... Message-ID: <3EB0118C.9554.19C5E49D@localhost> This also applies to 4.15-13 and does not need use English; -- Mariano Absatz El Baby ---------------------------------------------------------- C makes it easy to shoot yourself in the foot. C++ makes it harder, but when you do, it blows away your whole leg." -- Bjarne Stroustrup -------------- next part -------------- *** SA.pm.old Wed Apr 30 17:34:05 2003 --- SA.pm Wed Apr 30 18:08:49 2003 *************** *** 34,40 **** use strict 'vars'; use strict 'refs'; no strict 'subs'; # Allow bare words for parameter %'s - use English; # Needed for $PERL_VERSION to work in all versions of Perl use POSIX qw(:signal_h); # For Solaris 9 SIG bug workaround use IO; --- 34,39 ---- *************** *** 92,98 **** # for finding the SpamAssassin libraries # Use unshift rather than push so that their given location is # always searched *first* and not last in the include path. ! unshift @INC, "$val/lib/perl5/site_perl/$PERL_VERSION"; } # Now we have the path built, try to find the SpamAssassin modules MailScanner::Log::DieLog("SpamAssassin installation could not be found") --- 91,98 ---- # for finding the SpamAssassin libraries # Use unshift rather than push so that their given location is # always searched *first* and not last in the include path. ! my $perl_vers = $] < 5.006 ? $] : sprintf("%vd",$^V); ! unshift @INC, "$val/lib/perl5/site_perl/$perl_vers"; } # Now we have the path built, try to find the SpamAssassin modules MailScanner::Log::DieLog("SpamAssassin installation could not be found") From Steve at swaney.com Wed Apr 30 23:32:23 2003 From: Steve at swaney.com (Stephen Swaney) Date: Thu Jan 12 21:17:54 2006 Subject: Version 4.15-13 for RedHat Linux - OK In-Reply-To: <5.2.1.1.2.20030430110514.02806360@imap.ecs.soton.ac.uk> References: <5.2.1.1.2.20030430110514.02806360@imap.ecs.soton.ac.uk> Message-ID: <1051741943.1276.5.camel@speedy> Julian, I can report that MailScanner 4.15-13 Sophos SpamAssassin Redhat 9.0 Postfix All work. Just had to change ownership on /var/spool/MailScanner/incoming back to postfix. Seems it changed on the new installation. New startup script and /etc/sysconfig/MailScanner is excellent. Thanks for the fine work. Steve Steve Swaney Steve@Swaney.com Phone: 202 352-3262 Fax: 202 352-3262 -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030430/0f8e4b8e/attachment.html From raymond at PROLOCATION.NET Wed Apr 30 23:55:21 2003 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:17:54 2006 Subject: Version 4.15-13 for RedHat Linux - OK In-Reply-To: <1051741943.1276.5.camel@speedy> Message-ID: Hi! > All work. > > Just had to change ownership on /var/spool/MailScanner/incoming back to > postfix. Seems it changed on the new installation. > > New startup script and /etc/sysconfig/MailScanner is excellent. Only the file perms of the created file are not right: -rwxr-xr-x 1 root root 959 Apr 30 22:00 MailScanner Should be 644 instead... > Thanks for the fine work. Indeed, Julian, also thanx for the quick bugfix to -13. Bye, Raymond. From chicks at CHICKS.NET Wed Apr 30 23:57:35 2003 From: chicks at CHICKS.NET (Christopher Hicks) Date: Thu Jan 12 21:17:54 2006 Subject: Version 4.15-13 for RedHat Linux - OK In-Reply-To: Message-ID: On Thu, 1 May 2003, Raymond Dijkxhoorn wrote: > Only the file perms of the created file are not right: > -rwxr-xr-x 1 root root 959 Apr 30 22:00 MailScanner > > Should be 644 instead... /etc/sysconfig/* files are usually executable so they can be sourced in shell scripts. -- The death of democracy is not likely to be an assassination from ambush. It will be a slow extinction from apathy, indifference, and undernourishment. -Robert Maynard Hutchins, educator (1899-1977)