From raymond at PROLOCATION.NET  Tue Jul  1 00:22:48 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:45 2006
Subject: reportword bug?
In-Reply-To: <002101c33f5b$8a05b6f0$9701020a@brianmay>
Message-ID: <Pine.LNX.4.44.0307010122330.3171-100000@mailbox.prolocation.net>

Hi!

Read the archives, allready fixed ...

On Mon, 30 Jun 2003, Brian May
wrote:

>     Sender: some lamer
> IP Address: 216.104.160.32
>  Recipient: somelocal user
>    Subject: Footer created at Sat Jun 28 10
>  MessageID: h5UMRor22332
>     Report: ClamAV: msg-18145-23.html contains Exploit.IFrame.HTML
>             Found dangerous IFrame tag in HTML message
>     $reportword: Nod32: ./h5UMRor22332/2003 - Win32/Klez.J worm
>             ClamAV: 2003 contains Worm/Klez.H
>             F-Secure: ./h5UMRor22332/2003: Infected: W32/Klez.H@mm [F-Prot]
>             F-Secure: ./h5UMRor22332/2003: Infected: I-Worm.Klez.h [AVP]
>
> Not sure how the report word got there.. has there been a fix for this?
>

From mikew at CRUCIS.NET  Tue Jul  1 01:39:44 2003
From: mikew at CRUCIS.NET (Mike Watson)
Date: Thu Jan 12 21:18:45 2006
Subject: newby fetchmail question
In-Reply-To: <200306301232.07382.ca@cwissy.co.uk>
References: <200306301232.07382.ca@cwissy.co.uk>
Message-ID: <200306301939.44982.mikew@crucis.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Monday 30 June 2003 06:32 am, you wrote:
> Hi,
>
> If I set up fetchmail on a server running mailscanner will the mails
> that it pulls in go through the mailscanner process or does it start
> a new sendmail process for delivery?

I can answer the first part.  Yes e-mails pulled via fetchmail go 
through MailScanner.

I have a remote e-mail address and use fetchmail to pull the e-mails.  I 
just tested it and the e-mails were processed by both MailScanner, 
Spamassassin and also by my virus scanner.

Mike W
- -- 
Registered Linux - 256979
NRA Life
ARS: W0TMW








-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE/ANhQ5fq6h2uDDlQRAgcSAJ9Sey0Z5OIUou7yR6h/FQX0cOcUHQCfbhVI
P8tcM5FJqpaPPON5ivMyOFw=
=HacD
-----END PGP SIGNATURE-----


-- 
This message has been scanned for viruses and 
dangerous content by F-Prot and MailScanner, 
and is believed to be clean.


From ashley at IMS.TELSTRA.COM.AU  Tue Jul  1 03:25:32 2003
From: ashley at IMS.TELSTRA.COM.AU (Ash)
Date: Thu Jan 12 21:18:45 2006
Subject: Using HTML tags/code to obfuscate "bad" words
In-Reply-To: <5.2.1.1.2.20030630081331.058d7418@securemail.tulsaconnect.com>
References: <5.2.1.1.2.20030630081331.058d7418@securemail.tulsaconnect.com>
Message-ID: <3F00F11C.9000609@ims.telstra.com.au>

fixed at my site by upgrading to SA v2.60 no other config changes applied

ash

ISP List wrote:
> More and more I am seeing spammers use HTML codes to obfuscate 
> notoriously "bad" words so as to confuse/get by SpamAssassin and such.  
> For instance:
> 
> <P align=center><FONT face=verdana><WT>Make your balls and 
> p<WHCI>e<C>n<YB>?s
> <ZUC>la<YNSX>r<ZYMI>g<XFL>er and get more satisfaction.<BR>
> 
> Are others seeing this, and is there a rule in SpamAssassin I can tweak 
> to give situations like this more weight?
> 
> Thanks.
> 
> -------------------------------------
> Mike Bacher / mike@sparklogic.com
> Use OptiGold ISP? Check out OptiSkin!
> http://www.sparklogic.com/optiskin/
> -------------------------------------


From mailscanner at CARLO65.DE  Tue Jul  1 05:15:48 2003
From: mailscanner at CARLO65.DE (Roland Ehle)
Date: Thu Jan 12 21:18:45 2006
Subject: Quick translation request - German
In-Reply-To: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
Message-ID: <3F010AF4.8050403@carlo65.de>

Julian Field schrieb:
> For the max-message-size checking, I need this translating into as many
> languages as possible:
>
>        Message is too large

Nachricht ist zu gross


Regards,
Roland

From aschwalm at WEB.DE  Tue Jul  1 07:22:09 2003
From: aschwalm at WEB.DE (Angela Schwalm)
Date: Thu Jan 12 21:18:45 2006
Subject: MailScanner issue with postfix
Message-ID: <200307010622.h616M5Q20318@mailgate5.cinetic.de>

MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> schrieb am 30.06.03 17:22:47:
>
> But, do you have /var/spool/postfix and /var/spool/postfix.in created ?
> If so, once starting the Postfix processes, all sub-directories inside
> these directories should be created on the fly...
>
> Can you do a
> ls -l /var/spool
> ls -l /var/spool/postfix
> ls -l /var/spool/postfix.in
>
xxxx:/var/log # ls -l /var/spool
total 80
drwxr-xr-x   20 root     root         4096 Jun 30 16:59 .
drwxr-xr-x   18 root     root         4096 Jun  3 12:47 ..
drwxr-xr-x    5 root     root         4096 Jun 25 12:29 MailScanner
drwx------    2 at       at           4096 Sep 20  2002 atjobs
drwx------    2 at       at           4096 Mar 23  2002 atspool
drwxrwx---    2 mail     mail         4096 May 22 10:16 clientmqueue
drwx------    4 root     root         4096 Sep 20  2002 cron
drwx------    3 lp       root         4096 Sep 20  2002 cups
drwxr-xr-x    2 dpbox    localham     4096 Mar 21  2002 dpbox
drwxr-xr-x    2 fax      uucp         4096 Mar 21  2002 fax
drwxr-xr-x    2 fnet     uucp         4096 Mar 21  2002 fnet
lrwxrwxrwx    1 root     root            7 Sep 20  2002 locks -> ../lock
drwxr-xr-x    2 lp       lp           4096 Mar 21  2002 lpd
drwxrwxrwt    2 root     root         4096 Jun 27 09:58 mail
drwx------    3 root     root         4096 May 22 10:16 mqueue
drwx------    3 root     root         4096 Jun 23 15:33 mqueue.in
drwxr-xr-x   15 root     root         4096 Jun 30 17:22 postfix
drwxr-xr-x   14 root     root         4096 Jun 30 16:59 postfix.in
drwxr-x---    2 lp       lp           4096 Mar 25  2002 samba
drwxr-xr-x    3 uucp     uucp         4096 Sep 20  2002 uucp
drwxr-xr-x    4 65       nogroup      4096 Jun 12 17:02 vscan
xxxx:/var/log # ls -l /var/spool/postfix
total 60
drwxr-xr-x   15 root     root         4096 Jun 30 17:22 .
drwxr-xr-x   20 root     root         4096 Jun 30 16:59 ..
drwx------    2 postfix  root         4096 Jun 30 17:00 active
drwx------    2 postfix  root         4096 Jun 30 17:00 bounce
drwx------    2 postfix  root         4096 Jun 30 17:00 corrupt
drwx------    2 postfix  root         4096 Jun 30 17:00 defer
drwx------    2 postfix  root         4096 Jun 30 17:00 deferred
drwxr-xr-x    2 root     root         4096 Jun 30 17:23 etc
drwx------    2 postfix  root         4096 Jun 30 17:00 flush
drwx------    2 postfix  root         4096 Jun 30 17:00 incoming
drwx-wx---    2 postfix  maildrop     4096 Jun 30 17:00 maildrop
drwxr-xr-x    2 root     root         4096 Jun 30 17:00 pid
drwx------    2 postfix  root         4096 Jun 30 17:25 private
drwx--x---    2 postfix  maildrop     4096 Jun 30 17:25 public
drwx------    2 postfix  root         4096 Jun 30 17:00 saved
xxxx:/var/log # ls -l /var/spool/postfix.in
total 56
drwxr-xr-x   14 root     root         4096 Jun 30 16:59 .
drwxr-xr-x   20 root     root         4096 Jun 30 16:59 ..
drwx------    2 postfix  root         4096 Jul  1 08:24 active
drwx------    2 postfix  root         4096 Jun 30 16:59 bounce
drwx------    2 postfix  root         4096 Jun 30 16:59 corrupt
drwx------    2 postfix  root         4096 Jul  1 08:24 defer
drwx------    3 postfix  root         4096 Jun 30 17:04 deferred
drwx------    2 postfix  root         4096 Jun 30 17:04 flush
drwx------    2 postfix  root         4096 Jun 30 17:04 incoming
drwx-wx---    2 postfix  maildrop     4096 Jun 30 16:59 maildrop
drwxr-xr-x    2 root     root         4096 Jun 30 17:04 pid
drwx------    2 postfix  root         4096 Jun 30 17:24 private
drwx--x---    2 postfix  maildrop     4096 Jun 30 17:24 public
drwx------    2 postfix  root         4096 Jun 30 16:59 saved

____________________________________________________________________________
Jetzt bei WEB.DE FreeMail anmelden = 1qm Regenwald schuetzen! Helfen
Sie mit! Nutzen Sie den Serien-Testsieger. http://user.web.de/Regenwald

From john at TRADOC.FR  Tue Jul  1 07:38:47 2003
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:18:45 2006
Subject: Quick translation request - French
In-Reply-To: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
Message-ID: <g2b2gv0d1ko5oa9jtutna45jdf3bum5rcg@tradoc.fr>

On Mon, 30 Jun 2003 21:55:50 +0100, Julian Field wrote:
> For the max-message-size checking, I need this translating into as many
> languages as possible:
> 
>         Message is too large

Taille de message trop grand. 

John.

-- 
-- Over 2000 webcams from ski resorts around the world - http://www.snoweye.com/
-- Translate your technical documents and web pages    - http://www.tradoc.fr/


From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Jul  1 07:40:49 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:18:45 2006
Subject: Sobig.{E,D,EML} not found by Sophos and McAfee
Message-ID: <52E50E4D595DDE4D861117A1FB62E79D82089E@bond.ncl.ac.uk>

I reported yesterday that McAfee was not always recognising the Sobig.E
worm in messages. That problem appeared to fix itself after I restarted
MailScanner.

However further monitoring of logs shows that it is Sophos now that is
not always recognising Sobig variants. I have instances where Sophos has
missed Sobig.E (in both .txt and .pif files), Sobig.EML (.txt file) and
Sobig.D (.pif file). In all these cases McAfee has found the worms and I
have not found a new instance of McAfee missing a virus.

What I cannot tell is whether there have been instances where _both_
scanners have missed a virus/worm at the same time. It is very worrying.

The times at which these exceptions have occured are no where near the
hourly updates of the DAT/IDE files. 

Any suggestions as to how I can more systematiclly investigate what is
going on?

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 


From radislav.vrnata at porcela.cz  Tue Jul  1 08:18:16 2003
From: radislav.vrnata at porcela.cz (Radislav Vrnata)
Date: Thu Jan 12 21:18:45 2006
Subject: Quick translation request
In-Reply-To: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
Message-ID: <3F0151D8.25343.18A0C51C@localhost>

On 30 Jun 2003 at 21:55, Julian Field wrote:

> For the max-message-size checking, I need this translating into as many
> languages as possible:
>
>         Message is too large
Hi,

Here is czech version:

        Zprava je prilis dlouha


Radislav.



>
> Thanks folks!
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>

From rybar at DATALOCK.SK  Tue Jul  1 08:46:08 2003
From: rybar at DATALOCK.SK (Patrik Rybar)
Date: Thu Jan 12 21:18:45 2006
Subject: Quick translation request
In-Reply-To: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
Message-ID: <3F013C40.4020302@datalock.sk>

Julian Field wrote:
> For the max-message-size checking, I need this translating into as many
> languages as possible:
>
>        Message is too large
>
> Thanks folks!
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
Hi,

here is slovak version

        Sprava je prilis dlha



Patrik

From P.G.M.Peters at utwente.nl  Tue Jul  1 08:55:34 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:46 2006
Subject: (Scrubbed) Re: filter by size of attachment
In-Reply-To: <B0064754116@mail.elknet.net>
References: <B0064754116@mail.elknet.net>
Message-ID: <lhf2gvo7krhqmh53ohd7l2u54h5u5cefqh@4ax.com>

On Mon, 30 Jun 2003 14:10:59 -0600, you wrote:

>Yes, but my MTA won't allow me to create a whitelist like MailScanner
>does that will bypass that message size limitation.

For the occasional situation I have put a limit in the definition for
the local-delivery. And for exceptions I use another local delivery
agent.

But that only works on the final delivery host.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From florusb at ASCIO.COM  Tue Jul  1 09:09:39 2003
From: florusb at ASCIO.COM (Florus Both)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - danish
Message-ID: <2F15A97500CFA0469C9BACC2041F8AC7043F7A15@aries.dk.speednames.com>

Beskeden er for stor

florus

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
Sent: 30. juni 2003 22:56
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Quick translation request


For the max-message-size checking, I need this translating into as many
languages as possible:

        Message is too large

Thanks folks!
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 09:28:26 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request
In-Reply-To: <3F013C40.4020302@datalock.sk>
References: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030701092739.041a5748@imap.ecs.soton.ac.uk>

You're doing really well folks.

Just

Welsh
Hungarian
Italian
Brazilian Portuguese
Romanian

left to go.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From florusb at ASCIO.COM  Tue Jul  1 09:54:27 2003
From: florusb at ASCIO.COM (Florus Both)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - Brazilian Portuguese
Message-ID: <2F15A97500CFA0469C9BACC2041F8AC7043F7A19@aries.dk.speednames.com>

A mensagem e muito longa.

Florus (by proxy of a colleague :))

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
Sent: 1. juli 2003 10:28
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Quick translation request


You're doing really well folks.

Just

Welsh
Hungarian
Italian
Brazilian Portuguese
Romanian

left to go.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From f.rotondo at TESEO.IT  Tue Jul  1 10:02:28 2003
From: f.rotondo at TESEO.IT (Francesco Rotondo)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request
References: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
Message-ID: <00de01c33faf$7fdca860$0464a8c0@teseo.info>

> For the max-message-size checking, I need this translating into as many
> languages as possible:
>
>         Message is too large
>
> Thanks folks!

Italian: Il messaggio è troppo grande

Francesco


From m.sapsed at BANGOR.AC.UK  Tue Jul  1 10:21:20 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:46 2006
Subject: Sobig.{E,D,EML} not found by Sophos and McAfee
References: <52E50E4D595DDE4D861117A1FB62E79D82089E@bond.ncl.ac.uk>
Message-ID: <3F015290.2000709@bangor.ac.uk>

Hi Quentin,

Quentin Campbell wrote:
> However further monitoring of logs shows that it is Sophos now that is
> not always recognising Sobig variants. I have instances where Sophos has
> missed Sobig.E (in both .txt and .pif files), Sobig.EML (.txt file) and
> Sobig.D (.pif file). In all these cases McAfee has found the worms and I
> have not found a new instance of McAfee missing a virus.

Assuming you quarantine these nasties, have you sent the ones Sophos has
missed to them? If not, please would you??? They usually respond pretty
quickly if they're missing stuff...

By the way, what's Sobig.EML and what harm can it do in a .txt file?

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From kfliong at WOFS.COM  Tue Jul  1 10:24:25 2003
From: kfliong at WOFS.COM (kfliong)
Date: Thu Jan 12 21:18:46 2006
Subject: whitelist problem
In-Reply-To: <2F15A97500CFA0469C9BACC2041F8AC7043F7A15@aries.dk.speednam
              es.com>
Message-ID: <5.2.1.1.0.20030701172234.025b9668@192.168.10.2>

Hi all,

I added some email account to mark them as definitely not spam. But I don't
know why the mails does not go through. I can see from Mailwatch that it is
shown as whitelisted. So, how come I still don't receive the mail? Anyone
have any idea?

Thanks in advance.

From Kevin.Spicer at BMRB.CO.UK  Tue Jul  1 10:36:16 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:46 2006
Subject: whitelist problem
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6B3@pascal.priv.bmrb.co.uk>

kfliong wrote:
> Hi all,
> 
> I added some email account to mark them as definitely not spam. But I
> don't know why the mails does not go through. I can see from
> Mailwatch that it is shown as whitelisted. So, how come I still don't
> receive the mail? Anyone have any idea?
> 
> Thanks in advance.

It would help if you were to post relevent parts of your configuration (such as your whitelist entries) and perhaps also an extract from your logs showing what happens when a mail is recieved to one of those addresses.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Jul  1 10:39:57 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:18:46 2006
Subject: Sobig.{E,D,EML} not found by Sophos and McAfee
Message-ID: <52E50E4D595DDE4D861117A1FB62E79D8208E7@bond.ncl.ac.uk>

> -----Original Message-----
> From: Martin Sapsed [mailto:m.sapsed@BANGOR.AC.UK] 
> Sent: 01 July 2003 10:21
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Sobig.{E,D,EML} not found by Sophos and McAfee
> 
> 
> Hi Quentin,
> 
> Quentin Campbell wrote:
> > However further monitoring of logs shows that it is Sophos 
> now that is 
> > not always recognising Sobig variants. I have instances 
> where Sophos 
> > has missed Sobig.E (in both .txt and .pif files), Sobig.EML (.txt 
> > file) and Sobig.D (.pif file). In all these cases McAfee 
> has found the 
> > worms and I have not found a new instance of McAfee missing a virus.
> 
> Assuming you quarantine these nasties, have you sent the ones 
> Sophos has missed to them? If not, please would you??? They 
> usually respond pretty quickly if they're missing stuff...

We don't use quarantining at this site. But your suggestion is noted.
:-)

> By the way, what's Sobig.EML and ...

Good question. I cannot find this virus at the NAI site yet it is McAfee
that is recognising it! The notification I got says:

The following e-mail messages were found to have viruses in them:

    Sender: auto.reply@compuserve.com
IP Address: 149.174.40.6
 Recipient: xxx@newcastle.ac.uk
   Subject: Undeliverable Message
 MessageID: h611uKu05157
    Report: /h611uKu05157/msg-32244-1482.txt        Found the
W32/Sobig.eml virus !!!

> ...what harm can it do in a .txt file?

That is not the point unless you are suggesting that is why Sophos does
not recognise it? The issue for me is why one A-V scanner finds it but
another doesn't.

Quentin


From aschwalm at WEB.DE  Tue Jul  1 11:22:26 2003
From: aschwalm at WEB.DE (Angela Schwalm)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner issue with postfix
Message-ID: <200307011022.h61AMQQ26985@mailgate5.cinetic.de>

> After doing
>          mkdir /var/spool/postfix /var/spool/postfix.in
> did you set the ownership correctly?
>          chown postfix /var/spool/postfix /var/spool/postfix.in
>          chgrp postfix /var/spool/postfix /var/spool/postfix.in
> then
>          postfix start
>          postfix -C /etc/postfix.in start
> (it might need to be "-c" instead of "-C", I can't remember)

I did so. Now I got:

Jul  1 12:25:50 xxxx postfix/postfix-script: warning: not owned by root: /var/spool/postfix.in
Jul  1 12:25:54 xxxx postfix/postfix-script: starting the Postfix mail system
Jul  1 12:25:55 xxxx postfix/master[20411]: daemon started
Jul  1 12:26:15 xxxx postfix/postfix-script: warning: not owned by root: /var/spool/postfix.in
Jul  1 12:26:27 xxxx postfix/postfix-script: warning: not owned by root: /var/spool/postfix
Jul  1 12:26:31 xxxx postfix/postfix-script: starting the Postfix mail system
Jul  1 12:26:32 xxxx postfix/master[20507]: daemon started
Jul  1 12:26:38 xxxx postfix/postfix-script: warning: not owned by root: /var/spool/postfix
Jul  1 12:27:32 xxxx MailScanner[20575]: MailScanner E-Mail Virus Scanner version 4.21-9 starting...
Jul  1 12:27:41 xxxx MailScanner[20575]: Using locktype = flock
Jul  1 12:27:42 xxxx MailScanner[20587]: MailScanner E-Mail Virus Scanner version 4.21-9 starting...
Jul  1 12:27:51 xxxx MailScanner[20587]: Using locktype = flock
Jul  1 12:27:52 xxxx MailScanner[20590]: MailScanner E-Mail Virus Scanner version 4.21-9 starting...
Jul  1 12:28:00 xxxx MailScanner[20590]: Using locktype = flock
Jul  1 12:28:02 xxxx MailScanner[20592]: MailScanner E-Mail Virus Scanner version 4.21-9 starting...
Jul  1 12:28:18 xxxx MailScanner[20594]: MailScanner E-Mail Virus Scanner version 4.21-9 starting...
Jul  1 12:28:23 xxxx MailScanner[20592]: Using locktype = flock
Jul  1 12:28:36 xxxx MailScanner[20594]: Using locktype = flock

______________________________________________________________________________
UNICEF bittet um Spenden fur die Kinder im Irak! Hier online an
UNICEF spenden: https://spenden.web.de/unicef/special/?mc=021101

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 11:27:42 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner issue with postfix
In-Reply-To: <200307011022.h61AMQQ26985@mailgate5.cinetic.de>
Message-ID: <5.2.0.9.2.20030701112657.04127850@imap.ecs.soton.ac.uk>

At 11:22 01/07/2003, you wrote:
> > After doing
> >          mkdir /var/spool/postfix /var/spool/postfix.in
> > did you set the ownership correctly?
> >          chown postfix /var/spool/postfix /var/spool/postfix.in
> >          chgrp postfix /var/spool/postfix /var/spool/postfix.in
> > then
> >          postfix start
> >          postfix -C /etc/postfix.in start
> > (it might need to be "-c" instead of "-C", I can't remember)
>
>I did so. Now I got:

Oops, sorry, my mistake. It obviously wants those 2 dirs owned by root and
not postfix. chown and chgrp them back to 0 then restart both Postfixes again.


>Jul  1 12:25:50 xxxx postfix/postfix-script: warning: not owned by root:
>/var/spool/postfix.in
>Jul  1 12:25:54 xxxx postfix/postfix-script: starting the Postfix mail system
>Jul  1 12:25:55 xxxx postfix/master[20411]: daemon started
>Jul  1 12:26:15 xxxx postfix/postfix-script: warning: not owned by root:
>/var/spool/postfix.in
>Jul  1 12:26:27 xxxx postfix/postfix-script: warning: not owned by root:
>/var/spool/postfix
>Jul  1 12:26:31 xxxx postfix/postfix-script: starting the Postfix mail system
>Jul  1 12:26:32 xxxx postfix/master[20507]: daemon started
>Jul  1 12:26:38 xxxx postfix/postfix-script: warning: not owned by root:
>/var/spool/postfix
>Jul  1 12:27:32 xxxx MailScanner[20575]: MailScanner E-Mail Virus Scanner
>version 4.21-9 starting...
>Jul  1 12:27:41 xxxx MailScanner[20575]: Using locktype = flock
>Jul  1 12:27:42 xxxx MailScanner[20587]: MailScanner E-Mail Virus Scanner
>version 4.21-9 starting...
>Jul  1 12:27:51 xxxx MailScanner[20587]: Using locktype = flock
>Jul  1 12:27:52 xxxx MailScanner[20590]: MailScanner E-Mail Virus Scanner
>version 4.21-9 starting...
>Jul  1 12:28:00 xxxx MailScanner[20590]: Using locktype = flock
>Jul  1 12:28:02 xxxx MailScanner[20592]: MailScanner E-Mail Virus Scanner
>version 4.21-9 starting...
>Jul  1 12:28:18 xxxx MailScanner[20594]: MailScanner E-Mail Virus Scanner
>version 4.21-9 starting...
>Jul  1 12:28:23 xxxx MailScanner[20592]: Using locktype = flock
>Jul  1 12:28:36 xxxx MailScanner[20594]: Using locktype = flock
>
>______________________________________________________________________________
>UNICEF bittet um Spenden fur die Kinder im Irak! Hier online an
>UNICEF spenden: https://spenden.web.de/unicef/special/?mc=021101

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 11:34:34 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner issue with postfix -- anyone?
In-Reply-To: <5.2.0.9.2.20030701112657.04127850@imap.ecs.soton.ac.uk>
References: <200307011022.h61AMQQ26985@mailgate5.cinetic.de>
Message-ID: <5.2.0.9.2.20030701113314.041055d8@imap.ecs.soton.ac.uk>

I have run out of ideas. Without remote access to the system there's not
much more I can do for you, sorry.
Maybe someone else has some ideas why you are seeing the strange symptoms
you have.

At 11:27 01/07/2003, you wrote:
>At 11:22 01/07/2003, you wrote:
>> > After doing
>> >          mkdir /var/spool/postfix /var/spool/postfix.in
>> > did you set the ownership correctly?
>> >          chown postfix /var/spool/postfix /var/spool/postfix.in
>> >          chgrp postfix /var/spool/postfix /var/spool/postfix.in
>> > then
>> >          postfix start
>> >          postfix -C /etc/postfix.in start
>> > (it might need to be "-c" instead of "-C", I can't remember)
>>
>>I did so. Now I got:
>
>Oops, sorry, my mistake. It obviously wants those 2 dirs owned by root and
>not postfix. chown and chgrp them back to 0 then restart both Postfixes again.
>
>
>>Jul  1 12:25:50 xxxx postfix/postfix-script: warning: not owned by root:
>>/var/spool/postfix.in
>>Jul  1 12:25:54 xxxx postfix/postfix-script: starting the Postfix mail system
>>Jul  1 12:25:55 xxxx postfix/master[20411]: daemon started
>>Jul  1 12:26:15 xxxx postfix/postfix-script: warning: not owned by root:
>>/var/spool/postfix.in
>>Jul  1 12:26:27 xxxx postfix/postfix-script: warning: not owned by root:
>>/var/spool/postfix
>>Jul  1 12:26:31 xxxx postfix/postfix-script: starting the Postfix mail system
>>Jul  1 12:26:32 xxxx postfix/master[20507]: daemon started
>>Jul  1 12:26:38 xxxx postfix/postfix-script: warning: not owned by root:
>>/var/spool/postfix
>>Jul  1 12:27:32 xxxx MailScanner[20575]: MailScanner E-Mail Virus Scanner
>>version 4.21-9 starting...
>>Jul  1 12:27:41 xxxx MailScanner[20575]: Using locktype = flock
>>Jul  1 12:27:42 xxxx MailScanner[20587]: MailScanner E-Mail Virus Scanner
>>version 4.21-9 starting...
>>Jul  1 12:27:51 xxxx MailScanner[20587]: Using locktype = flock
>>Jul  1 12:27:52 xxxx MailScanner[20590]: MailScanner E-Mail Virus Scanner
>>version 4.21-9 starting...
>>Jul  1 12:28:00 xxxx MailScanner[20590]: Using locktype = flock
>>Jul  1 12:28:02 xxxx MailScanner[20592]: MailScanner E-Mail Virus Scanner
>>version 4.21-9 starting...
>>Jul  1 12:28:18 xxxx MailScanner[20594]: MailScanner E-Mail Virus Scanner
>>version 4.21-9 starting...
>>Jul  1 12:28:23 xxxx MailScanner[20592]: Using locktype = flock
>>Jul  1 12:28:36 xxxx MailScanner[20594]: Using locktype = flock
>>
>>______________________________________________________________________________
>>UNICEF bittet um Spenden fur die Kinder im Irak! Hier online an
>>UNICEF spenden: https://spenden.web.de/unicef/special/?mc=021101
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From maxsec at TOTALISE.CO.UK  Tue Jul  1 11:53:46 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner issue with postfix -- anyone?
In-Reply-To: <5.2.0.9.2.20030701113314.041055d8@imap.ecs.soton.ac.uk>
References: <200307011022.h61AMQQ26985@mailgate5.cinetic.de>
            <5.2.0.9.2.20030701113314.041055d8@imap.ecs.soton.ac.uk>
Message-ID: <3F01683A.2030505@totalise.co.uk>

Julian

yeah I got that well - just warning I ignore with no ill effect as far
as I can see..

--
Martin


Julian Field wrote:

> I have run out of ideas. Without remote access to the system there's not
> much more I can do for you, sorry.
> Maybe someone else has some ideas why you are seeing the strange symptoms
> you have.
>
> At 11:27 01/07/2003, you wrote:
>
>> At 11:22 01/07/2003, you wrote:
>>
>>> > After doing
>>> >          mkdir /var/spool/postfix /var/spool/postfix.in
>>> > did you set the ownership correctly?
>>> >          chown postfix /var/spool/postfix /var/spool/postfix.in
>>> >          chgrp postfix /var/spool/postfix /var/spool/postfix.in
>>> > then
>>> >          postfix start
>>> >          postfix -C /etc/postfix.in start
>>> > (it might need to be "-c" instead of "-C", I can't remember)
>>>
>>> I did so. Now I got:
>>
>>
>> Oops, sorry, my mistake. It obviously wants those 2 dirs owned by root
>> and
>> not postfix. chown and chgrp them back to 0 then restart both
>> Postfixes again.
>>
>>
>>> Jul  1 12:25:50 xxxx postfix/postfix-script: warning: not owned by root:
>>> /var/spool/postfix.in
>>> Jul  1 12:25:54 xxxx postfix/postfix-script: starting the Postfix
>>> mail system
>>> Jul  1 12:25:55 xxxx postfix/master[20411]: daemon started
>>> Jul  1 12:26:15 xxxx postfix/postfix-script: warning: not owned by root:
>>> /var/spool/postfix.in
>>> Jul  1 12:26:27 xxxx postfix/postfix-script: warning: not owned by root:
>>> /var/spool/postfix
>>> Jul  1 12:26:31 xxxx postfix/postfix-script: starting the Postfix
>>> mail system
>>> Jul  1 12:26:32 xxxx postfix/master[20507]: daemon started
>>> Jul  1 12:26:38 xxxx postfix/postfix-script: warning: not owned by root:
>>> /var/spool/postfix
>>> Jul  1 12:27:32 xxxx MailScanner[20575]: MailScanner E-Mail Virus
>>> Scanner
>>> version 4.21-9 starting...
>>> Jul  1 12:27:41 xxxx MailScanner[20575]: Using locktype = flock
>>> Jul  1 12:27:42 xxxx MailScanner[20587]: MailScanner E-Mail Virus
>>> Scanner
>>> version 4.21-9 starting...
>>> Jul  1 12:27:51 xxxx MailScanner[20587]: Using locktype = flock
>>> Jul  1 12:27:52 xxxx MailScanner[20590]: MailScanner E-Mail Virus
>>> Scanner
>>> version 4.21-9 starting...
>>> Jul  1 12:28:00 xxxx MailScanner[20590]: Using locktype = flock
>>> Jul  1 12:28:02 xxxx MailScanner[20592]: MailScanner E-Mail Virus
>>> Scanner
>>> version 4.21-9 starting...
>>> Jul  1 12:28:18 xxxx MailScanner[20594]: MailScanner E-Mail Virus
>>> Scanner
>>> version 4.21-9 starting...
>>> Jul  1 12:28:23 xxxx MailScanner[20592]: Using locktype = flock
>>> Jul  1 12:28:36 xxxx MailScanner[20594]: Using locktype = flock
>>>
>>> ______________________________________________________________________________
>>>
>>> UNICEF bittet um Spenden fur die Kinder im Irak! Hier online an
>>> UNICEF spenden: https://spenden.web.de/unicef/special/?mc=021101
>>
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> MailScanner thanks transtec Computers for their support
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support

From andersan at LTKALMAR.SE  Tue Jul  1 12:15:59 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:46 2006
Subject: SV: eTrust Inoculate
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE637@lkl63.ltkalmar.se>

> -----Ursprungligt meddelande-----
> Fr?n: Tony Johansson [mailto:tony.johansson@SVENSKAKYRKAN.SE] 
> Skickat: den 11 juni 2003 16:26
> Till: MAILSCANNER@JISCMAIL.AC.UK
> ?mne: eTrust Inoculate
> 
> 
> I have problems getting eTrust inoculate to work with MailScanner.

Did you find any solution to this problem?

> 
> Details:
> 
> eTrust version: eTrust Antivirus for Linux (Build 1892) (from 
> the eTrust AntiVirus version 7 CD)
> Os: Red Hat 7.3 with default sendmail
> MailScanner: 4.21-9
> 
> Virus scanner in MailScanner.conf is set to f-prot and 
> inoculate. F-prot finds viruses, inoculate does not and 
> theres nothing in the maillog about inoculate.
> 
> incoulate-wrapper DOES work however, see following output:
> 
> "[root@localhost viruses]# 
> /usr/lib/MailScanner/inoculate-wrapper . File 
> /tmp/viruses/./BUG.0LL is infected by virus: 
> Win32/Bugbear.Worm File /tmp/viruses/./BUGBEAR.0OM is 
> infected by virus: Win32/Bugbear.Worm File 
> /tmp/viruses/./klez.0OM is infected by virus: 
> Win32/Klez.H.Worm File /tmp/viruses/./sircam.0OM is infected 
> by virus: Win32/SirCam.Worm
> 
> Total Files Scanned:             8
> Total Viruses Found:             4
> Total Infected Files Found:      4
> Scan Mode:                       Secure
> 
> *** End Of Summary *** "
> 
> 
> Version info and options of inocmd32:
> 
> [root@localhost MailScanner]# inocmd32
> 
> InoculateIT Engine version:                 23.61.00    2003/04/08
> InoculateIT Signature version:  virsig.da0  23.61.46    2003/06/10
> 
>    Usage:inocmd32 [ -options ] file|directory|drive ...
> -options:
>         : ENG <engine>
>               <engine>  can be one of: Ino or Vet
>         : MOD <mod>  Scan mode
>               <mod>  can be one of: Secure or Reviewer 
> (default Secure)
>         : ACT <action>  Infected file action
>               <action>  can be one of: Cure, Rename, Delete or Move
>         : EXE  Specified files
>                (based on the 'Specified' extension list)
>         : EXC  Exclude files
>                (based on the 'Exclude' extension list)
>         : ARC  Scan archive files
>         : NEX  Detect compressed files by content, not file extension
>         : NOS  No subdirectory traverse
>         : FIL:<pattern>  Only scan files that match <pattern> (shell
> wildcard)
>         : SCA <action>  Special Cure Action (ACT must be set to Cure)
>               <action> can be one of: CB (Copy Before), DT 
> (Delete Trojan),
>                 RF (Rename if cure fails) or MF (Move if cure fails)
>         : MCA <action>  Macro Cure Action
>               <action> can be either: RA (remove all) or RI (remove
> infected)
>         : SPM <mode>  Special Mode
>               <mode> can only be: H (heuristics)
>         : SFI  Stop at first infection in archive
>         : SRF  Skip regular file scanning of archives
>         : LIS:<file>  Create scan report file <file>
>         : APP:<file>  Append scan report to file <file>
>         : UNI  / is directory separator rather than switch introducer
>         : VER  Verbose mode
>         : COU:<n>  Message every <n> scanned files
>         : COU  Message every 1000 scanned files
>         : SIG  Display signature version numbers
>         : SIG:<dir>  Display signature version numbers of
>                      engine located in <dir>
>         : HEL or ?  Display this help
> file|directory|drive ...: Specify at least one file, 
> directory or drive 
> file|directory|to
> scan
> 
> 
> 
> regards, Tony
> 


From m.sapsed at BANGOR.AC.UK  Tue Jul  1 12:25:56 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:46 2006
Subject: Sobig.{E,D,EML} not found by Sophos and McAfee
References: <52E50E4D595DDE4D861117A1FB62E79D8208E7@bond.ncl.ac.uk>
Message-ID: <3F016FC4.1000703@bangor.ac.uk>

Quentin Campbell wrote:
> We don't use quarantining at this site. But your suggestion is noted.
> :-)

Shame. I sent them some files which were quarantined because they had
.pif on the end. Subsequently an ide was released which identified them
as Bugbear-Dam - the broken variants.

> Good question. I cannot find this virus at the NAI site yet it is McAfee
> that is recognising it! The notification I got says:
>
> The following e-mail messages were found to have viruses in them:
>
>     Sender: auto.reply@compuserve.com
> IP Address: 149.174.40.6
>  Recipient: xxx@newcastle.ac.uk
>    Subject: Undeliverable Message
>  MessageID: h611uKu05157
>     Report: /h611uKu05157/msg-32244-1482.txt        Found the
> W32/Sobig.eml virus !!!
>
>>...what harm can it do in a .txt file?
>
> That is not the point unless you are suggesting that is why Sophos does
> not recognise it? The issue for me is why one A-V scanner finds it but
> another doesn't.

I wonder if it is a version of Sobig, in a message packaged up as email
attachment .eml file but then renamed as .txt? I don't know whether
Sophos would find anything in that - haven't got one to hand to try!

I'm more concerned about it missing instances of .D and .E unless
they're like the Bugbear incident - damaged versions that aren't
actually executable. It would still be nice to know though otherwise you
assume the worst.

(Incidentally we've picked up 732 copies of Sobig-E in the 5 days since
the ide was released - 22% of our detections for the whole of June, but
I digress...)

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From m.sapsed at BANGOR.AC.UK  Tue Jul  1 12:30:18 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:46 2006
Subject: Using HTML tags/code to obfuscate "bad" words
References: <5.2.1.1.2.20030630081331.058d7418@securemail.tulsaconnect.com>
            <3F00F11C.9000609@ims.telstra.com.au>
Message-ID: <3F0170CA.5080006@bangor.ac.uk>

Ash wrote:
> ISP List wrote:
> 
>> More and more I am seeing spammers use HTML codes to obfuscate 
>> notoriously "bad" words so as to confuse/get by SpamAssassin and 
>> such.  For instance:
>>
>> <P align=center><FONT face=verdana><WT>Make your balls and 
>> p<WHCI>e<C>n<YB>?s
>> <ZUC>la<YNSX>r<ZYMI>g<XFL>er and get more satisfaction.<BR>
>>
>> Are others seeing this, and is there a rule in SpamAssassin I can 
>> tweak to give situations like this more weight?
 >
 > fixed at my site by upgrading to SA v2.60 no other config changes
 > applied

This is the first time I've noticed 2.60 being mentioned here - it 
sounds like a desirable upgrade. Any other guinea pigs tried it and not 
had problems? (The 2.x0 versions have disagreed with MS before now...!)

Cheers,

Martin

-- 
Martin Sapsed                   	
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth


From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Jul  1 12:33:44 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:18:46 2006
Subject: Sobig.{E,D,EML} not found by Sophos and McAfee - further info
Message-ID: <52E50E4D595DDE4D861117A1FB62E79D820916@bond.ncl.ac.uk>

> -----Original Message-----
> From: Quentin Campbell [mailto:Q.G.Campbell@newcastle.ac.uk] 
> Sent: 01 July 2003 10:40
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Sobig.{E,D,EML} not found by Sophos and McAfee
> 
[snip]
> > By the way, what's Sobig.EML and ...
> 
> Good question. I cannot find this virus at the NAI site yet 
> it is McAfee that is recognising it! The notification I got says:
> 
> The following e-mail messages were found to have viruses in them:
> 
>     Sender: auto.reply@compuserve.com
> IP Address: 149.174.40.6
>  Recipient: xxx@newcastle.ac.uk
>    Subject: Undeliverable Message
>  MessageID: h611uKu05157
>     Report: /h611uKu05157/msg-32244-1482.txt        Found the
> W32/Sobig.eml virus !!!
> 
> > ...what harm can it do in a .txt file?
> 
> That is not the point unless you are suggesting that is why 
> Sophos does not recognise it? The issue for me is why one A-V 
> scanner finds it but another doesn't.

The one thing all these messages have in common are that they are bounce
messages of one sort or another:

 o undeliverable message 
 o failure notice
 o returned mail - nameserver error ...

It appears that they retain some sort of "signature" text, probably
harmless, that the McAfee scanner recognises but not the Sophos scanner.
Does this sound plausible? 

Note that this applies to both "Sobig.e", "Sobig.d" and "Sobig.eml"
(what ever that is).

The latter suggests an alternative theory that it might be MailScanner
wrongly picking up a string from the McAfee scanner or wrongly reporting
a string that it has; that is, it reports as "Sobig.eml" a string that
is something else? 

I will see if I can quarantine some of these messages.

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

 


From aschwalm at WEB.DE  Tue Jul  1 12:38:55 2003
From: aschwalm at WEB.DE (Angela Schwalm)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner issue with postfix
Message-ID: <200307011138.h61BcsQ09846@mailgate5.cinetic.de>

>
> Oops, sorry, my mistake. It obviously wants those 2 dirs owned by root and
> not postfix. chown and chgrp them back to 0 then restart both Postfixes again.
>

When I deleted /var/spool/postfix.in/deferred yesterday I got this message:
Jun 30 16:59:49 xxxx MailScanner[15791]: Cannot cd to dir /var/spool/postfix.in/deferred to read messages, No such file or directory

So that means MailScanner looks into the deferred directory. But why does it not recognize the mails in it?
____________________________________________________________________________
Nur bei WEB.DE Testsieger FreeMail testen und damit 1 qm Regenwald
schuetzen. Jetzt anmelden und mithelfen! http://user.web.de/Regenwald

From tony.johansson at SVENSKAKYRKAN.SE  Tue Jul  1 12:55:20 2003
From: tony.johansson at SVENSKAKYRKAN.SE (Tony Johansson)
Date: Thu Jan 12 21:18:46 2006
Subject: SV: eTrust Inoculate
Message-ID: <LISTSERV%2003070112552087@JISCMAIL.AC.UK>

>Did you find any solution to this problem?
>
No. I've made the eTrust program package available to Julian who will have
a look at it when he finds the time.

Regards, Tony

From HancockS at MORGANCO.COM  Tue Jul  1 13:26:26 2003
From: HancockS at MORGANCO.COM (Hancock, Scott)
Date: Thu Jan 12 21:18:46 2006
Subject: SV: eTrust Inoculate
Message-ID: <3EA1A302A4978A4C970D2C63F327156ED54351@worc-mail2.int.morganco.com>

Just a simple "me too".  I'm also interested in using etrust as an
f-prot replacement.  

CA gave me (via a coworker) the green light to use the workstation
license with mailscanner.  We already have their exchange product
protecting the same mailboxes as mailscanner.  I don't know if that was
a factor in the decision.

-Scott


 >-----Original Message-----
 >From: Tony Johansson [mailto:tony.johansson@SVENSKAKYRKAN.SE]
 >Sent: Tuesday, July 01, 2003 7:55 AM
 >To: MAILSCANNER@JISCMAIL.AC.UK
 >Subject: Re: SV: eTrust Inoculate
 >
 >>Did you find any solution to this problem?
 >>
 >No. I've made the eTrust program package available to Julian who will
have
 >a look at it when he finds the time.
 >
 >Regards, Tony


From slwatts at WINCKWORTHS.CO.UK  Tue Jul  1 13:17:54 2003
From: slwatts at WINCKWORTHS.CO.UK (Samuel Luxford-Watts)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner Postfix and SuSE 8.1
Message-ID: <FB50AA0C8E7D5344A761C40BC7057429053690@exchangeserver.winckworths.co.uk>

Hi,

Can someone help me please?!

I have just installed a clean copy of SuSE 8.1, Postfix (1.1.11-110),
Sophos, and MailScanner. I used the latest stable release from the
Mailscanner website (Version 4.21-9 for SuSE Linux 8.0/8.1).

I ran the installation script and followed through every step in the Using
MailScanner with Postfix installation guide with no real problems except one
- the guide refers to a utility called redhat-switchmail-nox which I do not
have. Anyway When I try to run /etc/init.d/MailScanner start I get the
following errors:
Initializing sendmail and MailScannersendmail: invalid option -- O
sendmail: fatal: usage: sendmail [options]
sendmail: invalid option -- A
sendmail: fatal: usage: sendmail [options]
sendmail: invalid option -- A
sendmail: fatal: usage: sendmail [options]
                                                                     failed
I have had a look through the init.d script and it looks nothing like the
updated one on the Mailscanner website. Also /etc/sysconfig/MailScanner has
no MTA= line in it and I have not added one. It only has a number of
SENDMAIL_*_ARGS options and the workdir directives. Is this right? Or do I
need to add the MTA Line anyway? It doesn't seem to be used by the
init.d/MailScanner script that was installed with the SuSE package.

Has anyone got any ideas on how I can get this working? I guess I just need
to tweak the sendmail options but do not know which ones should be used.

Thanks in advance,

Sam

-----Original Message-----
From: L-Soft list server at JISCMAIL (1.8e) [mailto:LISTSERV@JISCMAIL.AC.UK]

Sent: 01 July 2003 13:00
To: Sam Luxford-Watts
Subject: Welcome to MailScanner


This list is for the discussion of the MailScanner e-mail virus and spam
protector. It is also used for announcements of new releases.

If you *only* want announcements of new releases, then you would do better
to subscribe to the MailScanner project at
http://www.freshmeat.net/projects/mailscanner.

--
Jules
www.mailscanner.info

From m.sapsed at BANGOR.AC.UK  Tue Jul  1 13:46:47 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - welsh
References: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
Message-ID: <3F0182B7.7020109@bangor.ac.uk>

Julian Field wrote:
> For the max-message-size checking, I need this translating into as many
> languages as possible:
>
>        Message is too large

(With apologies for the delay...)

Mae'r neges yn rhy fawr

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From dene at DATATECHIE.COM  Tue Jul  1 14:17:24 2003
From: dene at DATATECHIE.COM (Dene Ulmschneider)
Date: Thu Jan 12 21:18:46 2006
Subject: No subject
Message-ID: <5.1.0.14.2.20030701091719.02bc0eb0@192.168.1.112>

Hello All-

I am not 100% sure that this is a MailScanner issue - but I never this
problem before installing MailScanner.

I am running RHL 7.3 and MS 4.14-9. I am getting the following line in my
logwatch on a daily basis. The most current logwatch form yesterday had
this line in it 47 times.

h5UF1ou22960: timeout waiting for input from hormel.redhat.com during
server cmd read

Does anyone know why it might be timing out so much and how I can stop it
form happening?

Thanks for any help


Thank You

Dene Ulmschneider
Data Techie Inc.
-------------------------------------------------------------------------
office:         718.738.8859
cell:           646.996.2976
email:          dene@datatechie.com
pager mail:     denenow@datatechie.com
website:        www.datatechie.com
-------------------------------------------------------------------------
"Data Techie - Always there to protect you!"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030701/4f274346/attachment.html
From raymond at PROLOCATION.NET  Tue Jul  1 14:32:41 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:46 2006
Subject: your mail
In-Reply-To: <5.1.0.14.2.20030701091719.02bc0eb0@192.168.1.112>
Message-ID: <Pine.LNX.4.44.0307011532100.32721-100000@mailbox.prolocation.net>

Hi!

> h5UF1ou22960: timeout waiting for input from hormel.redhat.com during
> server cmd read
>
> Does anyone know why it might be timing out so much and how I can stop it
> form happening?

Network connection towards that sever. Notmuch you can change on your end
i am afraid.

Bye,
Raymond.

From David.While at UCE.AC.UK  Tue Jul  1 14:32:05 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:18:46 2006
Subject: ANNOUNCE: mailstats V0.20
Message-ID: <107DE25EC0216C45AEF670016024245F6EE3@exchangea.staff.uce.ac.uk>

For those using my script I have just released (finally!) version 0.20

The changes are:

counting messages instead of recipients
support for fsecure virus scanner
support for determining the country from the IP address
reporting when the anti virus database has been updated.

Minor changes such as correcting the name of mcafee have aslo been included.

NOTE: To use this version requires the installation of the GEOIP perl module and database. The details of where to get it from are available at the mailstats web site.

This version can be downloaded from http://staff.cie.uce.ac.uk/~id001869/mailstats/

Note that the config file is called config.pl.new to avoid overwriting your existing file. You should check through to see if anything has changed.

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030701/61dbf4f3/attachment.html
From mailscanner at ecs.soton.ac.uk  Tue Jul  1 14:18:05 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: SV: eTrust Inoculate
In-Reply-To: <3EA1A302A4978A4C970D2C63F327156ED54351@worc-mail2.int.morg
              anco.com>
Message-ID: <5.2.0.9.2.20030701141403.042d2df0@imap.ecs.soton.ac.uk>

Sorry I haven't had a chance to look at this. It's unlikely to happen
before August now as I am going to have to live without bandwidth for most
of July (on "holiday", whatever one of those is...). I guess it's a bit
like being in hospital and hence not having a PC, but there again I had a
laptop then and our local hospital has networked workstation rooms in it.
This "holiday" thing is going to be a very strange experience :-)

At 13:26 01/07/2003, you wrote:
>Just a simple "me too".  I'm also interested in using etrust as an
>f-prot replacement.
>
>CA gave me (via a coworker) the green light to use the workstation
>license with mailscanner.  We already have their exchange product
>protecting the same mailboxes as mailscanner.  I don't know if that was
>a factor in the decision.
>
>-Scott
>
>
>  >-----Original Message-----
>  >From: Tony Johansson [mailto:tony.johansson@SVENSKAKYRKAN.SE]
>  >Sent: Tuesday, July 01, 2003 7:55 AM
>  >To: MAILSCANNER@JISCMAIL.AC.UK
>  >Subject: Re: SV: eTrust Inoculate
>  >
>  >>Did you find any solution to this problem?
>  >>
>  >No. I've made the eTrust program package available to Julian who will
>have
>  >a look at it when he finds the time.
>  >
>  >Regards, Tony

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 14:22:41 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner Postfix and SuSE 8.1
In-Reply-To: <FB50AA0C8E7D5344A761C40BC7057429053690@exchangeserver.winc
              kworths.co.uk>
Message-ID: <5.2.0.9.2.20030701141910.04211df0@imap.ecs.soton.ac.uk>

I need to do some more work on the SuSE init.d script so it is as clever as
my RedHat one.

In the mean time, look in the init.d script for code that starts with a
line saying "startin)" and replace the following 3 sections with this:

     startin)
         echo -n "Initializing incoming Postfix"
         startproc    -p $srvpid postfix -c /etc/postfix.in
         rc_status
         ;;
     startout)
         echo -n "Initializing outgoing Postfix"
         startproc -f -p $srvoutpid postfix -c /etc/postfix
         rc_status
         ;;
     start)
         echo -n "Initializing Postfix and MailScanner"
         startproc    -p $srvpid postfix -c /etc/postfix.in
         rc_status
         startproc -f -p $srvoutpid postfix -c /etc/postfix
         rc_status
         startproc -f -p $mspid /usr/sbin/check_MailScanner >/dev/null
         rc_status -v
         rm -f /var/lock/subsys/MailScanner.off >/dev/null 2>&1
         ;;

At 13:17 01/07/2003, you wrote:
>Hi,
>
>Can someone help me please?!
>
>I have just installed a clean copy of SuSE 8.1, Postfix (1.1.11-110),
>Sophos, and MailScanner. I used the latest stable release from the
>Mailscanner website (Version 4.21-9 for SuSE Linux 8.0/8.1).
>
>I ran the installation script and followed through every step in the Using
>MailScanner with Postfix installation guide with no real problems except one
>- the guide refers to a utility called redhat-switchmail-nox which I do not
>have. Anyway When I try to run /etc/init.d/MailScanner start I get the
>following errors:
>Initializing sendmail and MailScannersendmail: invalid option -- O
>sendmail: fatal: usage: sendmail [options]
>sendmail: invalid option -- A
>sendmail: fatal: usage: sendmail [options]
>sendmail: invalid option -- A
>sendmail: fatal: usage: sendmail [options]
>                                                                      failed
>I have had a look through the init.d script and it looks nothing like the
>updated one on the Mailscanner website. Also /etc/sysconfig/MailScanner has
>no MTA= line in it and I have not added one. It only has a number of
>SENDMAIL_*_ARGS options and the workdir directives. Is this right? Or do I
>need to add the MTA Line anyway? It doesn't seem to be used by the
>init.d/MailScanner script that was installed with the SuSE package.
>
>Has anyone got any ideas on how I can get this working? I guess I just need
>to tweak the sendmail options but do not know which ones should be used.
>
>Thanks in advance,
>
>Sam
>
>-----Original Message-----
>From: L-Soft list server at JISCMAIL (1.8e) [mailto:LISTSERV@JISCMAIL.AC.UK]
>
>Sent: 01 July 2003 13:00
>To: Sam Luxford-Watts
>Subject: Welcome to MailScanner
>
>
>This list is for the discussion of the MailScanner e-mail virus and spam
>protector. It is also used for announcements of new releases.
>
>If you *only* want announcements of new releases, then you would do better
>to subscribe to the MailScanner project at
>http://www.freshmeat.net/projects/mailscanner.
>
>--
>Jules
>www.mailscanner.info

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From andersan at LTKALMAR.SE  Tue Jul  1 14:56:54 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:46 2006
Subject: SV: SV: eTrust Inoculate
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE639@lkl63.ltkalmar.se>

Hey, no rush for my sake... 
I got enough to do since we soon moving to new location.
I just have to be saticfied with 2 scanner and let inoculate wait until you
back on track.
I can use my time to open the perl books and cry  ;)
Have a nice vacation


> -----Ursprungligt meddelande-----
> Fr?n: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
> Skickat: den 1 juli 2003 15:18
> Till: MAILSCANNER@JISCMAIL.AC.UK
> ?mne: Re: SV: eTrust Inoculate
> 
> 
> Sorry I haven't had a chance to look at this. It's unlikely 
> to happen before August now as I am going to have to live 
> without bandwidth for most of July (on "holiday", whatever 
> one of those is...). I guess it's a bit like being in 
> hospital and hence not having a PC, but there again I had a 
> laptop then and our local hospital has networked workstation 
> rooms in it. This "holiday" thing is going to be a very 
> strange experience :-)
> 
> At 13:26 01/07/2003, you wrote:
> >Just a simple "me too".  I'm also interested in using etrust as an 
> >f-prot replacement.
> >
> >CA gave me (via a coworker) the green light to use the workstation 
> >license with mailscanner.  We already have their exchange product 
> >protecting the same mailboxes as mailscanner.  I don't know 
> if that was 
> >a factor in the decision.
> >
> >-Scott
> >
> >
> >  >-----Original Message-----
> >  >From: Tony Johansson [mailto:tony.johansson@SVENSKAKYRKAN.SE]
> >  >Sent: Tuesday, July 01, 2003 7:55 AM
> >  >To: MAILSCANNER@JISCMAIL.AC.UK
> >  >Subject: Re: SV: eTrust Inoculate
> >  >
> >  >>Did you find any solution to this problem?
> >  >>
> >  >No. I've made the eTrust program package available to Julian who 
> >will have
> >  >a look at it when he finds the time.
> >  >
> >  >Regards, Tony
> 
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> 


From slwatts at WINCKWORTHS.CO.UK  Tue Jul  1 15:11:52 2003
From: slwatts at WINCKWORTHS.CO.UK (Samuel Luxford-Watts)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner Postfix and SuSE 8.1
Message-ID: <FB50AA0C8E7D5344A761C40BC7057429053693@exchangeserver.winckworths.co.uk>

Thanks - this works (after I made a few changes - shown below) but it
reports:

Initializing sendmail and MailScanner
failed

Even tho all the services appear to have been started fine.

I did have to change the startproc lines to include the full path to postfix
and use start

Eg.

Startproc -f -p $srvoutpid /usr/sbin/postfix -c /etc/postfix start

I am trying to go through and create a proper init.d script now. I don't
really know much about this but will post it when I get it working fully!

Thanks,

Sam

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
Sent: 01 July 2003 14:23
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Postfix and SuSE 8.1


I need to do some more work on the SuSE init.d script so it is as clever as
my RedHat one.

In the mean time, look in the init.d script for code that starts with a line
saying "startin)" and replace the following 3 sections with this:

     startin)
         echo -n "Initializing incoming Postfix"
         startproc    -p $srvpid postfix -c /etc/postfix.in
         rc_status
         ;;
     startout)
         echo -n "Initializing outgoing Postfix"
         startproc -f -p $srvoutpid postfix -c /etc/postfix
         rc_status
         ;;
     start)
         echo -n "Initializing Postfix and MailScanner"
         startproc    -p $srvpid postfix -c /etc/postfix.in
         rc_status
         startproc -f -p $srvoutpid postfix -c /etc/postfix
         rc_status
         startproc -f -p $mspid /usr/sbin/check_MailScanner >/dev/null
         rc_status -v
         rm -f /var/lock/subsys/MailScanner.off >/dev/null 2>&1
         ;;

At 13:17 01/07/2003, you wrote:
>Hi,
>
>Can someone help me please?!
>
>I have just installed a clean copy of SuSE 8.1, Postfix (1.1.11-110),
>Sophos, and MailScanner. I used the latest stable release from the
>Mailscanner website (Version 4.21-9 for SuSE Linux 8.0/8.1).
>
>I ran the installation script and followed through every step in the
>Using MailScanner with Postfix installation guide with no real problems
>except one
>- the guide refers to a utility called redhat-switchmail-nox which I do not
>have. Anyway When I try to run /etc/init.d/MailScanner start I get the
>following errors:
>Initializing sendmail and MailScannersendmail: invalid option -- O
>sendmail: fatal: usage: sendmail [options]
>sendmail: invalid option -- A
>sendmail: fatal: usage: sendmail [options]
>sendmail: invalid option -- A
>sendmail: fatal: usage: sendmail [options]
>
failed
>I have had a look through the init.d script and it looks nothing like the
>updated one on the Mailscanner website. Also /etc/sysconfig/MailScanner has
>no MTA= line in it and I have not added one. It only has a number of
>SENDMAIL_*_ARGS options and the workdir directives. Is this right? Or do I
>need to add the MTA Line anyway? It doesn't seem to be used by the
>init.d/MailScanner script that was installed with the SuSE package.
>
>Has anyone got any ideas on how I can get this working? I guess I just
>need to tweak the sendmail options but do not know which ones should be
>used.
>
>Thanks in advance,
>
>Sam
>
>-----Original Message-----
>From: L-Soft list server at JISCMAIL (1.8e)
>[mailto:LISTSERV@JISCMAIL.AC.UK]
>
>Sent: 01 July 2003 13:00
>To: Sam Luxford-Watts
>Subject: Welcome to MailScanner
>
>
>This list is for the discussion of the MailScanner e-mail virus and
>spam protector. It is also used for announcements of new releases.
>
>If you *only* want announcements of new releases, then you would do
>better to subscribe to the MailScanner project at
>http://www.freshmeat.net/projects/mailscanner.
>
>--
>Jules
>www.mailscanner.info

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From Kevin.Spicer at BMRB.CO.UK  Tue Jul  1 15:34:14 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:46 2006
Subject: mailscanner timeout on virus updates...?
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6B9@pascal.priv.bmrb.co.uk>

I've just seen this happen too, caused me a big backlog.  I've disabled Clam for the time being (its not my only scanner), but some kind of timeout would be really helpful.

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
Sent: 30 June 2003 19:15
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: mailscanner timeout on virus updates...?


At 19:04 30/06/2003, you wrote:


Is there a way to set mailscanner to timeout when it's waiting on the virus update script(s)?  My installation of MailScanner and ClamAV was stuck and just queueing messages again today, because the ClamAV update program was hung for some reason.  I've sent a message to that list to see if there's a solution, but I was also wondering if there's a way to set a timeout value for MailScanner if the virus update script doesn't complete in a certain amount of time.  Maybe even send an email to root or something to let them know that the script timed out...


It won't make it into the July release, but I could knock up a sample autoupdate script that wraps the update in a timeout. This is probably best placed in the global updater actually.

Let me think on that, and the best way to do it... 

-- 
Julian Field
www.MailScanner.info <http://www.mailscanner.info/> 
Professional Support Services at www.MailScanner.biz <http://www.mailscanner.biz/> 
MailScanner thanks transtec Computers for their support 




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030701/513c9718/attachment.html
From mailscanner at ecs.soton.ac.uk  Tue Jul  1 15:36:46 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner Postfix and SuSE 8.1
In-Reply-To: <FB50AA0C8E7D5344A761C40BC7057429053693@exchangeserver.winc
              kworths.co.uk>
Message-ID: <5.2.0.9.2.20030701153534.040d90d0@imap.ecs.soton.ac.uk>

At 15:11 01/07/2003, you wrote:
>Thanks - this works (after I made a few changes - shown below) but it
>reports:
>
>Initializing sendmail and MailScanner
>failed
>
>Even tho all the services appear to have been started fine.

In which case delete the line that prints the "failed" :-)

>I did have to change the startproc lines to include the full path to postfix
>and use start
>
>Eg.
>
>Startproc -f -p $srvoutpid /usr/sbin/postfix -c /etc/postfix start
>
>I am trying to go through and create a proper init.d script now. I don't
>really know much about this but will post it when I get it working fully!

Yes, it was only a quick and dirty hack. When I get some time alone with my
SuSE box (has dead CPU fan right now) I will do some more work on it. Need
to try with SuSE 8.2 as well (which someone here kindly bought me).


>Thanks,
>
>Sam
>
>-----Original Message-----
>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>Sent: 01 July 2003 14:23
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Postfix and SuSE 8.1
>
>
>I need to do some more work on the SuSE init.d script so it is as clever as
>my RedHat one.
>
>In the mean time, look in the init.d script for code that starts with a line
>saying "startin)" and replace the following 3 sections with this:
>
>      startin)
>          echo -n "Initializing incoming Postfix"
>          startproc    -p $srvpid postfix -c /etc/postfix.in
>          rc_status
>          ;;
>      startout)
>          echo -n "Initializing outgoing Postfix"
>          startproc -f -p $srvoutpid postfix -c /etc/postfix
>          rc_status
>          ;;
>      start)
>          echo -n "Initializing Postfix and MailScanner"
>          startproc    -p $srvpid postfix -c /etc/postfix.in
>          rc_status
>          startproc -f -p $srvoutpid postfix -c /etc/postfix
>          rc_status
>          startproc -f -p $mspid /usr/sbin/check_MailScanner >/dev/null
>          rc_status -v
>          rm -f /var/lock/subsys/MailScanner.off >/dev/null 2>&1
>          ;;
>
>At 13:17 01/07/2003, you wrote:
> >Hi,
> >
> >Can someone help me please?!
> >
> >I have just installed a clean copy of SuSE 8.1, Postfix (1.1.11-110),
> >Sophos, and MailScanner. I used the latest stable release from the
> >Mailscanner website (Version 4.21-9 for SuSE Linux 8.0/8.1).
> >
> >I ran the installation script and followed through every step in the
> >Using MailScanner with Postfix installation guide with no real problems
> >except one
> >- the guide refers to a utility called redhat-switchmail-nox which I do not
> >have. Anyway When I try to run /etc/init.d/MailScanner start I get the
> >following errors:
> >Initializing sendmail and MailScannersendmail: invalid option -- O
> >sendmail: fatal: usage: sendmail [options]
> >sendmail: invalid option -- A
> >sendmail: fatal: usage: sendmail [options]
> >sendmail: invalid option -- A
> >sendmail: fatal: usage: sendmail [options]
> >
>failed
> >I have had a look through the init.d script and it looks nothing like the
> >updated one on the Mailscanner website. Also /etc/sysconfig/MailScanner has
> >no MTA= line in it and I have not added one. It only has a number of
> >SENDMAIL_*_ARGS options and the workdir directives. Is this right? Or do I
> >need to add the MTA Line anyway? It doesn't seem to be used by the
> >init.d/MailScanner script that was installed with the SuSE package.
> >
> >Has anyone got any ideas on how I can get this working? I guess I just
> >need to tweak the sendmail options but do not know which ones should be
> >used.
> >
> >Thanks in advance,
> >
> >Sam
> >
> >-----Original Message-----
> >From: L-Soft list server at JISCMAIL (1.8e)
> >[mailto:LISTSERV@JISCMAIL.AC.UK]
> >
> >Sent: 01 July 2003 13:00
> >To: Sam Luxford-Watts
> >Subject: Welcome to MailScanner
> >
> >
> >This list is for the discussion of the MailScanner e-mail virus and
> >spam protector. It is also used for announcements of new releases.
> >
> >If you *only* want announcements of new releases, then you would do
> >better to subscribe to the MailScanner project at
> >http://www.freshmeat.net/projects/mailscanner.
> >
> >--
> >Jules
> >www.mailscanner.info
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From aschwalm at WEB.DE  Tue Jul  1 16:10:38 2003
From: aschwalm at WEB.DE (Angela Schwalm)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner issue with postfix
Message-ID: <LISTSERV%2003070116103825@JISCMAIL.AC.UK>

here are all configurations. I hope anybody can see, why it does not work.

/etc/postfix.in/main.cf:
soft_bounce = yes
queue_directory = /var/spool/postfix.in
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
sendmail_path = /usr/sbin/sendmail
mailq_path = /usr/bin/mailq
newaliases_path = /usr/sbin/sendmail
mail_owner = postfix
mail_name = Postfix on SuSE Linux 8.0 (i386)
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
sender_canonical_maps = hash:/etc/postfix/sender_canonical
canonical_maps = hash:/etc/postfix/canonical
virtual_maps = hash:/etc/postfix/virtual
relocated_maps = hash:/etc/postfix/relocated
transport_maps = hash:/etc/postfix/transport
local_recipient_maps =
debug_peer_level = 2
debugger_command =
  PATH=/usr/bin:/usr/X11R6/bin
  xxgdb $daemon_directory/$process_name $process_id & sleep 5
setgid_group = maildrop
defer_transports = smtp local virtual relay
disable_dns_lookups = no


/etc/postfix.in/master.cf:
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
#   (yes) (yes) (yes) (never) (50)
# ==========================================================================
smtp   inet n - y - - smtpd
pickup   unix n - y 60 1 pickup
cleanup   unix n - y - 0 cleanup
qmgr   unix n - y 300 1 qmgr
rewrite   unix - - y - - trivial-rewrite
bounce   unix - - y - 0 bounce
defer   unix - - y - 0 bounce
flush   unix n - y 1000? 0 flush
smtp   unix - - y - - smtp
showq     unix n - y - - showq
error     unix - - y - - error
local   unix - n n - - local
virtual   unix - n n - - virtual
lmtp   unix - - y - - lmtp
tlsmgr   fifo - - n 300 1 tlsmgr

cyrus   unix - n n - - pipe
    flags=R user=cyrus argv=/usr/lib/cyrus/bin/deliver -e -m ${extension}
${user}
uucp   unix - n n - - pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
($recipient)
ifmail    unix  -       n       n       -       -       pipe
    flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop
$recipient
procmail  unix  -       n       n       -       -       pipe
    flags=R user=cyrus argv=/usr/bin/procmail -t -m USER=${user}
EXT=${extension} /etc/procmailrc

/etc/postfix/master.cf:
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
#   (yes) (yes) (yes) (never) (50)
# ==========================================================================
#smtp   inet n - n - - smtpd
pickup   unix n - y 60 1 pickup
cleanup   unix n - y - 0 cleanup
qmgr   unix n - y 300 1 qmgr
rewrite   unix - - y - - trivial-rewrite
bounce   unix - - y - 0 bounce
defer   unix - - y - 0 bounce
flush   unix n - y 1000? 0 flush
#smtp   unix - - y - - smtp
showq     unix n - y - - showq
error     unix - - y - - error
local   unix - n n - - local
virtual   unix - n n - - virtual
lmtp   unix - - y - - lmtp
tlsmgr   fifo - - n 300 1 tlsmgr

cyrus   unix - n n - - pipe
    flags=R user=cyrus argv=/usr/lib/cyrus/bin/deliver -e -m ${extension}
${user}
uucp   unix - n n - - pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail
($recipient)
ifmail    unix  -       n       n       -       -       pipe
    flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop
$recipient
procmail  unix  -       n       n       -       -       pipe
    flags=R user=cyrus argv=/usr/bin/procmail -t -m USER=${user}
EXT=${extension} /etc/procmailrc

etc/postfix/main.cf:
soft_bounce = yes
queue_directory = /var/spool/postfix
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
mail_spool_directory = /var/mail
sendmail_path = /usr/sbin/sendmail
mailq_path = /usr/bin/mailq
newaliases_path = /usr/sbin/sendmail
mail_owner = postfix
default_privs = nobody
mail_name = Postfix on SuSE Linux 8.0 (i386)
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
sender_canonical_maps = hash:/etc/postfix/sender_canonical
canonical_maps = hash:/etc/postfix/canonical
virtual_maps = hash:/etc/postfix/virtual
relocated_maps = hash:/etc/postfix/relocated
transport_maps = hash:/etc/postfix/transport
local_recipient_maps =
debug_peer_level = 2
debugger_command =
  PATH=/usr/bin:/usr/X11R6/bin
  xxgdb $daemon_directory/$process_name $process_id & sleep 5
setgid_group = maildrop
masquerade_exceptions = root
masquerade_domains =
defer_transports =
disable_dns_lookups = no
relayhost =


/etc/MailScanner/MailScanner.conf:
Max Children = 5
Run As User = postfix
Run As Group = postfix
Queue Scan Interval = 5
Incoming Queue Dir = /var/spool/postfix.in/deferred
Outgoing Queue Dir = /var/spool/postfix/incoming
Incoming Work Dir = /var/spool/MailScanner/incoming
Quarantine Dir = /var/spool/MailScanner/quarantine
PID file = /var/run/MailScanner.pid
Restart Every = 14400
MTA = postifx
Sendmail = /usr/sbin/sendmail
Sendmail2 = /usr/sbin/sendmail

If this is correct, perhaps it's a owner-problem?

From rgrignon at INPHACT.COM  Tue Jul  1 16:37:35 2003
From: rgrignon at INPHACT.COM (rgrignon@INPHACT.COM)
Date: Thu Jan 12 21:18:46 2006
Subject: Long delay in sending mail
Message-ID: <CFE2AF2B1DB7D4118E9B00508B440852045CE5A0@inphna-mal2-dc.inphact.com>

We are running postfix 2.0.12 and MailScanner 4.21-9

I am noticing for the most part that mail is queued and delivered right
away, however, about 5-6 times a day the queue builds up and does not send.
It looks like it will eventually send within 15min, however, I am curious to
know what is causing MailScanner (or postfix) to eventually send the mail.

Is there some sort of cron job or a setting that I could adjust to force the
mail to be delivered in the event that the system hangs like it is currently
doing?

Thanks,

Rob

From rzewnickie at RFA.ORG  Tue Jul  1 16:45:56 2003
From: rzewnickie at RFA.ORG (Eric Dantan Rzewnicki)
Date: Thu Jan 12 21:18:46 2006
Subject: filter by size of attachment
In-Reply-To: <3F005BBA.A1AE40FC@ihs.com>
References: <B0064739524@mail.elknet.net> <3F005BBA.A1AE40FC@ihs.com>
Message-ID: <20030701154556.GB32558@rfa.org>

On Mon 30/06/2003 09:48:10, Dustin Baer wrote:
> Alan Fiebig wrote:
> >
> > Greetings!
> >
> > I know that MailScanner can block/remove file attachments based upon the name of the attachment, but does anyone know of a method to block/remove an attachment(s) based upon size? Many of my dialup account customers have major problems in downloading emails that are over 2 meg in size; some have their client lockup, other think it locked up due to the time involved in the transfer and just abort.
> >
> > I would therefore like to use MailScanner to also block or remove attachments that are over a given size, say 2 meg.
> >
> > All help is apreciated!
> >
> > -Alan
>
> Doesn't your MTA do this?
>
> Sendmail -
> O MaxMessageSize=[BYTE SIZE]
>
> The MTA won't remove the attachment, but it will most certainly not let
> it in.
>

Or the same in postfix:

message_size_limit = [BYTE SIZE]


> Dustin
>
> --
> Dustin Baer
> Unix Administrator/Postmaster
> Information Handling Services
> 15 Inverness Way East
> Englewood, CO 80112
> 303-397-2836

From cparker at SWATGEAR.COM  Tue Jul  1 17:06:23 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner feature request
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE1AE0ED@ati-ex-01.ati.local>

Julian,

I would like to see a command for MailScanner similar to 'iptables --list'. This command would show you, depending on the option(s) you passed to it, the configurations of the different files MailScanner reads upon load.

For example I could do this:

# mailscanner --lookup f

This would get me a print out of the file extension configuration that MailScanner currently had in memory. Of course I would also be able to pass different flags aside from "f" to get other configurations. i.e. white/blacklist, MailScanner.conf, etc.


My .02

Chris.


From Kevin.Spicer at BMRB.CO.UK  Tue Jul  1 17:12:21 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner feature request
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6BF@pascal.priv.bmrb.co.uk>

> For example I could do this:
> 
> # mailscanner --lookup f
> 
I don't understand why you would need this, isn't cat /etc/MailScanner/filename.rules.conf enough?  Its not like MailScanner can be reconfigured on the command line like iptables is (unless Julian has sneaked in another new feature there too!).



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From mailscanner at ecs.soton.ac.uk  Tue Jul  1 17:40:27 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner feature request
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF6BF@pascal.priv.bmrb.co .uk>
Message-ID: <5.2.1.1.2.20030701173608.02669ec8@imap.ecs.soton.ac.uk>

At 17:12 01/07/2003, you wrote:
> > For example I could do this:
> >
> > # mailscanner --lookup f
> >
>I don't understand why you would need this, isn't cat
>/etc/MailScanner/filename.rules.conf enough?  Its not like MailScanner can
>be reconfigured on the command line like iptables is (unless Julian has
>sneaked in another new feature there too!).

No I haven't.

All the iptables commands are just handy ways of editing the filtering
tables stored in the kernel. So asking the status and current settings is
easy, you just ask the kernel what it thinks.

There is no way in MailScanner of asking the running processes what state
they have stored. To do so I would have to fork off a thread in each
process to sit and listen for status requests, which would probably also
have to listen on a control port.

This opens it up to loads of nasty network attacks, requires a huge amount
of code and doesn't really provide you with much more than you can get from
cat-ing the configuration files. For things like rulesets, you would only
be able to see the compiled version of the rules anyway, which most "normal
people" can't understand anyway.

Hopefully that explains why I'm not overly keen on this idea.
All ideas are very welcome though! Some of the ones I don't like happen
anyway :-)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From cparker at SWATGEAR.COM  Tue Jul  1 17:43:21 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner feature request
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE1AE0EE@ati-ex-01.ati.local>

Spicer, Kevin <mailto:Kevin.Spicer@BMRB.CO.UK> wrote:

> > For example I could do this:
> > 
> > # mailscanner --lookup f
> > 
> I don't understand why you would need this, isn't cat
> /etc/MailScanner/filename.rules.conf enough?

What you see in the file isn't necessarily what MailScanner is actually using.


Let me ammend my post with this:

Julian, if you had a priority list of features to add to MailScanner using a range of 1 to 5, 1 being least important and 5 being most important, make this a 1. ;)


Chris.


From cparker at SWATGEAR.COM  Tue Jul  1 17:47:00 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner feature request
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE2B7CD9@ati-ex-01.ati.local>

Julian Field <mailto:mailscanner@ECS.SOTON.AC.UK> wrote:

> There is no way in MailScanner of asking the running processes what
> state they have stored. To do so I would have to fork off a thread in
> each process to sit and listen for status requests, which would
> probably also have to listen on a control port.

I see. Well that makes perfect sense.

> This opens it up to loads of nasty network attacks, requires a huge
> amount of code and doesn't really provide you with much more than you
> can get from cat-ing the configuration files. For things like
> rulesets, you would only be able to see the compiled version of the
> rules anyway, which most "normal people" can't understand anyway.

I had no idea such effort was involved, I thought it would be as easy as how you describe it with iptables.


Chris.


From mailscanner at ecs.soton.ac.uk  Tue Jul  1 18:01:13 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner feature request
In-Reply-To: <001BD19C96E6E64E8750D72C2EA0ECEE2B7CD9@ati-ex-01.ati.local >
Message-ID: <5.2.1.1.2.20030701175339.03a4b718@imap.ecs.soton.ac.uk>

At 17:47 01/07/2003, you wrote:
>Julian Field <mailto:mailscanner@ECS.SOTON.AC.UK> wrote:
> > This opens it up to loads of nasty network attacks, requires a huge
> > amount of code and doesn't really provide you with much more than you
> > can get from cat-ing the configuration files. For things like
> > rulesets, you would only be able to see the compiled version of the
> > rules anyway, which most "normal people" can't understand anyway.
>
>I had no idea such effort was involved, I thought it would be as easy as
>how you describe it with iptables.

As soon as you listen on a port, you are dealing with the outside world
which is a very nasty place. This is one of the major reasons MailScanner
doesn't get involved with SMTP service or message delivery.

Even iptables has to do some of this, but I bet you could kill it if you
sent it nasty enough instructions. Not many apps are 100% bullet-proof. It
is very easy to do it very badly, and very hard to do it 100% right. Look
at all the vulnerabilities that are discovered in applications everyday.

So far (touch wood) MailScanner has only appeared in Bugtraq twice. Both
occasions were for vulnerabilities that I discovered first (and documented)
and there were never any reports of either of these ever being exploited by
anyone. I let everyone else do the hard stuff :-)

One of the standard tests I do on undergraduate courseworks that process
input from the user is to feed the Linux kernel to it and see if their code
handles it neatly.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From lists at STHOMAS.NET  Tue Jul  1 18:11:05 2003
From: lists at STHOMAS.NET (Steve Thomas)
Date: Thu Jan 12 21:18:46 2006
Subject: your mail
In-Reply-To: <Pine.LNX.4.44.0307011532100.32721-100000@mailbox.prolocation.net>; from raymond@PROLOCATION.NET on Tue,
              Jul 01, 2003 at 03:32:41PM +0200
References: <5.1.0.14.2.20030701091719.02bc0eb0@192.168.1.112>
            <Pine.LNX.4.44.0307011532100.32721-100000@mailbox.prolocation.net>
Message-ID: <20030701101105.A31278@sthomas.net>

On Tue, Jul 01, 2003 at 03:32:41PM +0200, Raymond Dijkxhoorn is rumored to have said:
>
> > h5UF1ou22960: timeout waiting for input from hormel.redhat.com during
> > server cmd read
>
> Network connection towards that sever. Notmuch you can change on your end
> i am afraid.

You can edit the logwatch script so these get filtered out of your reports. I've done that with a couple of them, most notably the sendmail script.

--
Steve Thomas
----------------------------------------------------------
"...subatomic matter in a particle accelerator that exists
for only a few microseconds seems to exhibit more uptime
than the RIAA's website."
                           -- Andrew Orlowski
                              TheRegister.co.uk

From slwatts at WINCKWORTHS.CO.UK  Tue Jul  1 18:18:38 2003
From: slwatts at WINCKWORTHS.CO.UK (Samuel Luxford-Watts)
Date: Thu Jan 12 21:18:46 2006
Subject: MailScanner Postfix and SuSE 8.1
Message-ID: <FB50AA0C8E7D5344A761C40BC7057429053694@exchangeserver.winckworths.co.uk>

Ok - I kinda got a script that works ok. I am fumbling round in the dark a
little as this is beyond my basic scripting abilities. Start startin
startout, stop stopin stopout and status all work. The problem is if you do
a start, then say a stopin and then status it returns the wrong status - all
are up when they are clearly not.

I hope you can get your fan fixed soon!!!

Anyway - hope its of use as a starting point......

Sam


Begin /etc/init.d/MailScanner
-----------------------------
#!/bin/bash
#
# mailscanner   This shell script takes care of starting and stopping
#               MailScanner, and its associated copies of sendmail.
#
### BEGIN INIT INFO
# Provides:          MailScanner
# Required-Start:    $syslog $remote_fs
# X-UnitedLinux-Should-Start: $time $network $named ypbind
# Required-Stop:     $syslog $remote_fs
# X-UnitedLinux-Should-Stop: $time $network $named ypbind
# Default-Start:     3 5
# Default-Stop:      0 1 2 6
# Short-Description: MailScanner and sendmail daemons
# Description:       Start sendmail and MailScanner to provide
#       SMTP service with virus, dangerous contents and spam scanning.
### END INIT INFO

# Check for missing binaries (stale symlinks should not happen)
MAILSCANNER_BIN=/usr/sbin/MailScanner
#srvpid=/var/run/postfix-in.pid
#srvoutpid=/var/run/postfix-out.pid
mspid=/var/run/MailScanner.pid
srvinpid=/var/spool/postfix.in/pid/master.pid
srvoutpid=/var/spool/postfix/pid/master.pid
POSTFIX_BIN=/usr/sbin/postfix
POSTFIX_IN=/etc/postfix.in
POSTFIX_OUT=/etc/postfix
MASTER_BIN=/usr/lib/postfix/master

# Determine the base and follow a runlevel link name.
base=${0##*/}
link=${base#*[SK][0-9][0-9]}

test -x $POSTFIX_BIN || exit 5
test -x $MASTER_BIN || exit 5

. /etc/rc.status
rc_reset
case "$1" in
    startin)
        rc_reset
        echo -n "Initialising incoming mail process (postfix):"
        $POSTFIX_BIN -c $POSTFIX_IN start > /dev/null 2>&1
        # Remember status and be verbose
        rc_status -v

        ( i=60
        # waiting for qmgr
        while [ -z "$(pidof qmgr)" -a $i -gt 0 ]; do
            i=$(( $i - 1 ))
            sleep 1
        done
        $POSTFIX_BIN -c $POSTFIX_IN flush ) > /dev/null 2>&1 &
        ;;
    startout)
        rc_reset
        echo -n "Initialising outgoing mail process (postfix):"
        $POSTFIX_BIN -c $POSTFIX_OUT start > /dev/null 2>&1
        # Remember status and be verbose
        rc_status -v

        ( i=60
        # waiting for qmgr
        while [ -z "$(pidof qmgr)" -a $i -gt 0 ]; do
            i=$(( $i - 1 ))
            sleep 1
        done
        $POSTFIX_BIN -c $POSTFIX_IN flush ) > /dev/null 2>&1 &
        ;;

    start)
        $0 startin
        sleep 5
        $0 startout
        rc_reset
        echo -n "Starting MailScanner:"
        /usr/sbin/check_MailScanner >/dev/null
        rc_status -v
        rm -f /var/lock/subsys/MailScanner.off >/dev/null 2>&1
        ;;
    stopin)
        rc_reset
        echo -n "Shutting down Incoming Mail Process (postfix):"
        /sbin/killproc -p $srvinpid -TERM $MASTER_BIN
        rc_status -v
        ;;
    stopout)
        rc_reset
        echo -n "Shutting down Incoming Mail Process (postfix):"
        /sbin/killproc -p $srvoutpid -TERM $MASTER_BIN
        rc_status -v
        ;;
    stop)
        $0 stopin
        sleep 5
        $0 stopout
        rc_reset
        echo -n "Shutting down MailScanner:"
        killproc -p $mspid -TERM /usr/sbin/MailScanner
        rc_status -v
        # Clear out all the old pid files
        rm -f $mspid
        # Clear out the old incoming dirs
        cd $MAILSCANNER_WORKDIR && ls | egrep '^[0123456789]+$' | xargs
/bin/rm -rf 2>/dev/null
        touch /var/lock/subsys/MailScanner.off >/dev/null 2>&1
        ;;
    try-restart)
        $0 stop && sleep 5 && $0 start
        rc_status
        ;;
    restart)
        $0 stop
        sleep 5
        $0 start
        rc_status
        ;;
    reload|force-reload)
        echo -n "Reload service sendmail"
        killproc -p $mspid -HUP /usr/sbin/MailScanner
        rc_status -v
        ;;
    status)
        echo -n "Checking for incoming Mail process (procmail): "
        checkproc -p $srvinpid $MASTER_BIN
        rc_status -v
        rc_reset
        echo -n "Checking for outgoing Mail process (procmail): "
        checkproc -p $srvoutpid $MASTER_BIN
        rc_status -v
        rc_reset
        echo -n "Checking for MailScanner: "
        checkproc -p $mspid $MAILSCANNER_BIN
        rc_status -v
        ;;
    probe)
        test /etc/sendmail.cf -nt $srvpid -o /etc/mail/submit.cf -nt $msppid
\
        -o /etc/MailScanner/MailScanner.conf -nt $mspid && echo reload
        ;;
    *)
        echo "Usage: $0
{start|stop|status|try-restart|restart|force-reload|reload|probe|startin|sta
rtout}
"
        exit 1
esac
rc_exit
---------------------------
End




-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
Sent: 01 July 2003 14:23
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Postfix and SuSE 8.1


I need to do some more work on the SuSE init.d script so it is as clever as
my RedHat one.

In the mean time, look in the init.d script for code that starts with a line
saying "startin)" and replace the following 3 sections with this:

     startin)
         echo -n "Initializing incoming Postfix"
         startproc    -p $srvpid postfix -c /etc/postfix.in
         rc_status
         ;;
     startout)
         echo -n "Initializing outgoing Postfix"
         startproc -f -p $srvoutpid postfix -c /etc/postfix
         rc_status
         ;;
     start)
         echo -n "Initializing Postfix and MailScanner"
         startproc    -p $srvpid postfix -c /etc/postfix.in
         rc_status
         startproc -f -p $srvoutpid postfix -c /etc/postfix
         rc_status
         startproc -f -p $mspid /usr/sbin/check_MailScanner >/dev/null
         rc_status -v
         rm -f /var/lock/subsys/MailScanner.off >/dev/null 2>&1
         ;;

At 13:17 01/07/2003, you wrote:
>Hi,
>
>Can someone help me please?!
>
>I have just installed a clean copy of SuSE 8.1, Postfix (1.1.11-110),
>Sophos, and MailScanner. I used the latest stable release from the
>Mailscanner website (Version 4.21-9 for SuSE Linux 8.0/8.1).
>
>I ran the installation script and followed through every step in the
>Using MailScanner with Postfix installation guide with no real problems
>except one
>- the guide refers to a utility called redhat-switchmail-nox which I do not
>have. Anyway When I try to run /etc/init.d/MailScanner start I get the
>following errors:
>Initializing sendmail and MailScannersendmail: invalid option -- O
>sendmail: fatal: usage: sendmail [options]
>sendmail: invalid option -- A
>sendmail: fatal: usage: sendmail [options]
>sendmail: invalid option -- A
>sendmail: fatal: usage: sendmail [options]
>
failed
>I have had a look through the init.d script and it looks nothing like the
>updated one on the Mailscanner website. Also /etc/sysconfig/MailScanner has
>no MTA= line in it and I have not added one. It only has a number of
>SENDMAIL_*_ARGS options and the workdir directives. Is this right? Or do I
>need to add the MTA Line anyway? It doesn't seem to be used by the
>init.d/MailScanner script that was installed with the SuSE package.
>
>Has anyone got any ideas on how I can get this working? I guess I just
>need to tweak the sendmail options but do not know which ones should be
>used.
>
>Thanks in advance,
>
>Sam
>
>-----Original Message-----
>From: L-Soft list server at JISCMAIL (1.8e)
>[mailto:LISTSERV@JISCMAIL.AC.UK]
>
>Sent: 01 July 2003 13:00
>To: Sam Luxford-Watts
>Subject: Welcome to MailScanner
>
>
>This list is for the discussion of the MailScanner e-mail virus and
>spam protector. It is also used for announcements of new releases.
>
>If you *only* want announcements of new releases, then you would do
>better to subscribe to the MailScanner project at
>http://www.freshmeat.net/projects/mailscanner.
>
>--
>Jules
>www.mailscanner.info

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From splee at PLEXIO.COM  Tue Jul  1 18:19:31 2003
From: splee at PLEXIO.COM (Stephen Lee)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <2F15A97500CFA0469C9BACC2041F8AC7043F7A19@aries.dk.speednames.com>
References: <2F15A97500CFA0469C9BACC2041F8AC7043F7A19@aries.dk.speednames.com>
Message-ID: <1057079971.24162.142.camel@ralph.plexio.private>

Here's another Brazilian Portuguese version (by proxy as well):

Esta mensagem excede o espa?o dispon?vel.


Stephen

On Tue, 2003-07-01 at 01:54, Florus Both wrote:
> A mensagem e muito longa.
> 
> Florus (by proxy of a colleague :))
> 
> -----Original Message-----
> From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
> Sent: 1. juli 2003 10:28
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Quick translation request
> 
> 
> You're doing really well folks.
> 
> Just
> 
> Welsh
> Hungarian
> Italian
> Brazilian Portuguese
> Romanian
> 
> left to go.
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support


From jim at ENTROPHY-FREE.NET  Tue Jul  1 18:09:25 2003
From: jim at ENTROPHY-FREE.NET (Jim Levie)
Date: Thu Jan 12 21:18:46 2006
Subject: Sobig.{E,D,EML} not found by Sophos and McAfee
In-Reply-To: <52E50E4D595DDE4D861117A1FB62E79D82089E@bond.ncl.ac.uk>
References: <52E50E4D595DDE4D861117A1FB62E79D82089E@bond.ncl.ac.uk>
Message-ID: <1057079365.4524.6.camel@wilowisp.dynetics.com>

On Tue, 2003-07-01 at 01:40, Quentin Campbell wrote:
> I reported yesterday that McAfee was not always recognising the Sobig.E
> worm in messages. That problem appeared to fix itself after I restarted
> MailScanner.
>
> However further monitoring of logs shows that it is Sophos now that is
> not always recognising Sobig variants. I have instances where Sophos has
> missed Sobig.E (in both .txt and .pif files), Sobig.EML (.txt file) and
> Sobig.D (.pif file). In all these cases McAfee has found the worms and I
> have not found a new instance of McAfee missing a virus.
>
I'm seeing something similar in that Sophos with the latest IDE's isn't
catching some variants of SoBig that arrived over the weekend and this
morning. McAfee is detecting them, so far. The virus isn't reaching my
users, at least currently, because they are all in a disguised zip file
and I have a filename rule that disallows '.zi'.
--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
The instructions said to use Windows 98 or better, so I installed RedHat
   Jim Levie                                 email:jim@entrophy-free.net

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 18:34:46 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: ANNOUNCE: Version 4.22-4 released
Message-ID: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>

G'day!

I have just posted the new stable release 4.22-4 on the website.

Major new features this time are
- filetype detection regardless of filename, allowing you to allow/deny
files of different type.
- control over HTML forms in email messages, which have been used recently
to try to extract passwords and credit card details from unwitting users.
- control over the maximum size of any message, so you can limit the size
of messages for dial-up users for example.

Download it from www.mailscanner.info as usual.

All comments to me or the list.

The full ChangeLog is this:
* New Features and Improvements *
- Added support for checking file content types regardless of their filename.
   This uses the "file" command to work out the types of different files.
   New additions to MailScanner.conf are "file command", "file timeout",
   "filetype rules" (which work just like filename rules) and "log permitted
   filetypes".
- Added "Allow Form Tags" configuration option to ban HTML forms from email.
   Requires almost no additional CPU load and is useful protection.
- Added "Maximum Message Size" configuration option to limit the size of
   messages for certain users. Handy for dialup users to save their download
   phone bills. Obviously it works with a ruleset.
- "Spam Actions", "High Scoring Spam Actions" and "Non Spam Actions" are now
   set up so that the first matching rule will be used, rather than the sum of
   all the matching rules. This means you can have 1 setting for a domain, but
   before that have a rule for an individual user that over-rides the domain
   setting.
- MailScanner.conf file can now include "%name% = value" definition lines.
   These "%name%" variables can then be used later in the MailScanner.conf
   file and the rulesets, where they will be substituted with the appropriate
   "value". This greatly eases switching languages.
- Sophos.install script improved to make new versions work with sophossavi.
- f-prot-autoupdate script improved to handle new F-Prot version 4.
- Added bitdefender-autoupdate script from Alessandro Bianchi.
- Added "default" overall black- and white-lists to per-domain black/whitelist
   code in CustomConfig.pm.
- Added code to CustomConfig.pm to implement internal-only accounts that
   cannot send mail to external addresses.
- Improved comments in MailScanner.conf for "Max Children" setting.
- Added (commented out) instruction to not use Bayesian stats engine in
   MailScanner, with a comment about its need.

* Fixes *
- "channel error" detection bug in ZMailer support fixed.
- All sender.* reports now have To: From: and Subject: in English to keep
   sendmail and e-mail applications happy.
- "$reportword" appearing in Postmaster notices fixed.
- Added call to get logging working properly in clamav-autoupdate.
- RBLs are converted to lower-case when read from MailScanner.conf.
- Fix in signing clean messages containing single uuencoded attachments that
   are then read using certain versions of Outlook 97.
- MailScanner does not support Postfix without hashed queues. This situation
   is detected and reported if it is found.
   By default in all recent releases of Postfix (both 1.x and 2.x) hashed
   queues are enabled, so just don't disable them.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From miguelk at KONSULTEX.COM.BR  Tue Jul  1 18:45:57 2003
From: miguelk at KONSULTEX.COM.BR (Miguel Koren O'Brien de Lacy)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - Brazilian Portuguese
References: <2F15A97500CFA0469C9BACC2041F8AC7043F7A19@aries.dk.speednames.com>
            <1057079971.24162.142.camel@ralph.plexio.private>
Message-ID: <3F01C8D5.5090603@konsultex.com.br>

I'm in Brazil and I speak Portuguese but what I don't know is if we're 
translating selected phrases or a whole system (I did not follow the 
translation thread). If it's just this phrase I favor Stephen's 
formulation and if you want to keep it shorter you can use:

A mensagem excede o espa?o dispon?vel

Miguel

Stephen Lee wrote:

>Here's another Brazilian Portuguese version (by proxy as well):
>
>Esta mensagem excede o espa?o dispon?vel.
>
>
>Stephen
>
>On Tue, 2003-07-01 at 01:54, Florus Both wrote:
>  
>
>>A mensagem e muito longa.
>>
>>Florus (by proxy of a colleague :))
>>
>>-----Original Message-----
>>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>>Sent: 1. juli 2003 10:28
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Quick translation request
>>
>>
>>You're doing really well folks.
>>
>>Just
>>
>>Welsh
>>Hungarian
>>Italian
>>Brazilian Portuguese
>>Romanian
>>
>>left to go.
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support
>>    
>>


From rgrignon at INPHACT.COM  Tue Jul  1 18:45:23 2003
From: rgrignon at INPHACT.COM (rgrignon@INPHACT.COM)
Date: Thu Jan 12 21:18:46 2006
Subject: Long delay in sending mail
Message-ID: <CFE2AF2B1DB7D4118E9B00508B440852045CE5A1@inphna-mal2-dc.inphact.com>

I've noticed that the delays consistently happen between the top of the hour
and last for 15minutes other than that the mail is delivered in realtime...

Any ideas?

Thanks,

Rob

-----Original Message-----
From: Grignon, Robert
Sent: Tuesday, July 01, 2003 10:38 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Long delay in sending mail


We are running postfix 2.0.12 and MailScanner 4.21-9

I am noticing for the most part that mail is queued and delivered right
away, however, about 5-6 times a day the queue builds up and does not send.
It looks like it will eventually send within 15min, however, I am curious to
know what is causing MailScanner (or postfix) to eventually send the mail.

Is there some sort of cron job or a setting that I could adjust to force the
mail to be delivered in the event that the system hangs like it is currently
doing?

Thanks,

Rob

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 18:51:16 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <3F01C8D5.5090603@konsultex.com.br>
References: <2F15A97500CFA0469C9BACC2041F8AC7043F7A19@aries.dk.speednames.com>
            <1057079971.24162.142.camel@ralph.plexio.private>
Message-ID: <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>

Why is it always the Spanish and Portuguese who can never agree on the 
translation? I guess it's the difference in dialects between Europe and 
South America.
Maybe I should create a Red-neck and Geordie translation too? :)

Anyone know any Scots Gaelic?

At 18:45 01/07/2003, you wrote:
>I'm in Brazil and I speak Portuguese but what I don't know is if we're 
>translating selected phrases or a whole system (I did not follow the 
>translation thread). If it's just this phrase I favor Stephen's 
>formulation and if you want to keep it shorter you can use:
>
>A mensagem excede o espa?o dispon?vel
>
>Miguel
>
>Stephen Lee wrote:
>
>>Here's another Brazilian Portuguese version (by proxy as well):
>>
>>Esta mensagem excede o espa?o dispon?vel.
>>
>>
>>Stephen
>>
>>On Tue, 2003-07-01 at 01:54, Florus Both wrote:
>>
>>
>>>A mensagem e muito longa.
>>>
>>>Florus (by proxy of a colleague :))
>>>
>>>-----Original Message-----
>>>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>>>Sent: 1. juli 2003 10:28
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Re: Quick translation request
>>>
>>>
>>>You're doing really well folks.
>>>
>>>Just
>>>
>>>Welsh
>>>Hungarian
>>>Italian
>>>Brazilian Portuguese
>>>Romanian
>>>
>>>left to go.
>>>--
>>>Julian Field
>>>www.MailScanner.info
>>>MailScanner thanks transtec Computers for their support
>>>
>

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support


From mailscanner at LISTS.COM.AR  Tue Jul  1 19:20:59 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <3F01C8D5.5090603@konsultex.com.br>
Message-ID: <3F01A6DB.20777.5256507@localhost>

Miguel,

AFAIK, it doesn't refer to a message for which there's no available space, 
but one for whose lenght you have policied that you don't want it...

That is, your current translation, translates back into English like:
"The message exceeds available space"

when we just want:
"The message is too large"
(e.g. 'cause I don't want large messages, regardless of "available space")...

El 1 Jul 2003 a las 14:45, Miguel Koren O'Brien de Lacy escribi?:

> I'm in Brazil and I speak Portuguese but what I don't know is if we're 
> translating selected phrases or a whole system (I did not follow the 
> translation thread). If it's just this phrase I favor Stephen's 
> formulation and if you want to keep it shorter you can use:
> 
> A mensagem excede o espa?o dispon?vel
> 
> Miguel
> 
> Stephen Lee wrote:
> 
> >Here's another Brazilian Portuguese version (by proxy as well):
> >
> >Esta mensagem excede o espa?o dispon?vel.
> >
> >
> >Stephen
> >
> >On Tue, 2003-07-01 at 01:54, Florus Both wrote:
> >  
> >
> >>A mensagem e muito longa.
> >>
> >>Florus (by proxy of a colleague :))
> >>
> >>-----Original Message-----
> >>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
> >>Sent: 1. juli 2003 10:28
> >>To: MAILSCANNER@JISCMAIL.AC.UK
> >>Subject: Re: Quick translation request
> >>
> >>
> >>You're doing really well folks.
> >>
> >>Just
> >>
> >>Welsh
> >>Hungarian
> >>Italian
> >>Brazilian Portuguese
> >>Romanian
> >>
> >>left to go.
> >>--
> >>Julian Field
> >>www.MailScanner.info
> >>MailScanner thanks transtec Computers for their support
> >>    
> >>


--
Mariano Absatz
El Baby
----------------------------------------------------------
When I want your opinion, I'll give it to you.


From mailscanner at LISTS.COM.AR  Tue Jul  1 19:20:57 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>
References: <3F01C8D5.5090603@konsultex.com.br>
Message-ID: <3F01A6D9.313.5255DC1@localhost>

El 1 Jul 2003 a las 18:51, Julian Field escribi?:

> Why is it always the Spanish and Portuguese who can never agree on the 
> translation? I guess it's the difference in dialects between Europe and 
> South America.
In the case of Portuguese (though I don't speak, I understand a lot), I know 
the Brazilian Portuguese is _quite_ different from that spoken in Portugal... 
I don't know about the few places in Africa (former Portuguese colonies).

Regarding Spanish, afaik, the language is spoken in more countries than any 
others (not by more people, I guess that is Chinese), and there are wild 
differences between Spain, southern South America, northern South America, 
Central America and Mexico... even down here (in the South Cone) Chilean 
people speak quite differently from Argentinian and Uruguayan people, not 
only from an accent point of view, but the words themselves...

The first shot at translating MailScanner into Spanish was done by Luis 
Peromarta (from Spain) and myself (from Argentina), after a brief discusion 
about the local-neutrality of it...

> Maybe I should create a Red-neck and Geordie translation too? :)
> 
> Anyone know any Scots Gaelic?
> 
> At 18:45 01/07/2003, you wrote:
> >I'm in Brazil and I speak Portuguese but what I don't know is if we're 
> >translating selected phrases or a whole system (I did not follow the 
> >translation thread). If it's just this phrase I favor Stephen's 
> >formulation and if you want to keep it shorter you can use:
> >
> >A mensagem excede o espa?o dispon?vel
> >
> >Miguel
> >
> >Stephen Lee wrote:
> >
> >>Here's another Brazilian Portuguese version (by proxy as well):
> >>
> >>Esta mensagem excede o espa?o dispon?vel.
> >>
> >>
> >>Stephen
> >>
> >>On Tue, 2003-07-01 at 01:54, Florus Both wrote:
> >>
> >>
> >>>A mensagem e muito longa.
> >>>
> >>>Florus (by proxy of a colleague :))
> >>>
> >>>-----Original Message-----
> >>>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
> >>>Sent: 1. juli 2003 10:28
> >>>To: MAILSCANNER@JISCMAIL.AC.UK
> >>>Subject: Re: Quick translation request
> >>>
> >>>
> >>>You're doing really well folks.
> >>>
> >>>Just
> >>>
> >>>Welsh
> >>>Hungarian
> >>>Italian
> >>>Brazilian Portuguese
> >>>Romanian
> >>>
> >>>left to go.
> >>>--
> >>>Julian Field
> >>>www.MailScanner.info
> >>>MailScanner thanks transtec Computers for their support
> >>>
> >
> 
> -- 
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support


--
Mariano Absatz
El Baby
----------------------------------------------------------
Errors have been made. Others will be blamed.


From benny.butler at nexusitg.com  Tue Jul  1 19:25:19 2003
From: benny.butler at nexusitg.com (Benny Butler)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>
Message-ID: <011d01c33ffe$23c7b700$c805a8c0@maxima>

Let me know if you need any help on that redneck translation... I can
certinaly help since I speak the lower alabama dialect.

_______________
Benny Butler
Nexus ITG
Office: 251-473-4756
Cell: 251-610-4002
www.nexusitg.com 


> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> Sent: Tuesday, July 01, 2003 12:51 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Quick translation request - Brazilian Portuguese
> 
> 
> Why is it always the Spanish and Portuguese who can never 
> agree on the 
> translation? I guess it's the difference in dialects between 
> Europe and 
> South America.
> Maybe I should create a Red-neck and Geordie translation too? :)
> 
> Anyone know any Scots Gaelic?
> 
> At 18:45 01/07/2003, you wrote:
> >I'm in Brazil and I speak Portuguese but what I don't know 
> is if we're 
> >translating selected phrases or a whole system (I did not follow the 
> >translation thread). If it's just this phrase I favor Stephen's 
> >formulation and if you want to keep it shorter you can use:
> >
> >A mensagem excede o espa?o dispon?vel
> >
> >Miguel
> >
> >Stephen Lee wrote:
> >
> >>Here's another Brazilian Portuguese version (by proxy as well):
> >>
> >>Esta mensagem excede o espa?o dispon?vel.
> >>
> >>
> >>Stephen
> >>
> >>On Tue, 2003-07-01 at 01:54, Florus Both wrote:
> >>
> >>
> >>>A mensagem e muito longa.
> >>>
> >>>Florus (by proxy of a colleague :))
> >>>
> >>>-----Original Message-----
> >>>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
> >>>Sent: 1. juli 2003 10:28
> >>>To: MAILSCANNER@JISCMAIL.AC.UK
> >>>Subject: Re: Quick translation request
> >>>
> >>>
> >>>You're doing really well folks.
> >>>
> >>>Just
> >>>
> >>>Welsh
> >>>Hungarian
> >>>Italian
> >>>Brazilian Portuguese
> >>>Romanian
> >>>
> >>>left to go.
> >>>--
> >>>Julian Field
> >>>www.MailScanner.info
> >>>MailScanner thanks transtec Computers for their support
> >>>
> >
> 
> -- 
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> 


From mailscanner at LISTS.COM.AR  Tue Jul  1 19:49:27 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:46 2006
Subject: mcafee-autoupdate patch -- Tony Finch r-u-there?
Message-ID: <3F01AD87.6057.53F7638@localhost>

Hi,

I use a slightly modified mcafee-autoupdate script that, when presented with
a "-v" option in the command line, spits some output (to stdout) including a
timestamp when it starts and when it ends, regardless of the fact that it
found a new .dat file or not.

Although everyone would hate having a mail message from cron every time the
command is run, some of us, like to redirect the output of the command into a
log file and eventually check how's everything going, even when there's
nothing new.

I recall seeing at least someone else asking for this, so I'm enclosing this
patch to current version (from MailScanner 4.22-4).

The patched version modifies (increases) the output when a "-v" option is
presented, but doesn't modify anything if the option is not given.

Tony, would you care to incorporate it (or suggest a modification, maybe
another different command line option)?

Regards.



*** mcafee-autoupdate.ORI       Tue Jul  1 15:36:56 2003
--- mcafee-autoupdate   Tue Jul  1 15:38:54 2003
***************
*** 27,32 ****
--- 27,40 ----
  PATH=$LIBDIR:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  export PATH

+ # keep cron quiet by default
+ case $1 in
+         -v)
+                 echo -n START:
+                 date +"   %Y:%m:%d-%H:%M:%S"
+                 echo $0 starting...
+ esac
+
  # version number pattern
  MATCH="[0-9][0-9][0-9][0-9]"

***************
*** 57,62 ****
--- 65,72 ----
          # keep cron quiet by default
          case $1 in
          -v)     echo Already have "$VERSION"
+                 echo -n END:
+                 date +"     %Y:%m:%d-%H:%M:%S"
          esac
          exit
  fi
***************
*** 128,133 ****

  echo
  echo Completed OK
!
!
  # done
--- 138,147 ----

  echo
  echo Completed OK
! case $1 in
!         -v)
!                 echo -n END:
!                 date +"     %Y:%m:%d-%H:%M:%S"
! esac
!
  # done





--
Mariano Absatz
El Baby
----------------------------------------------------------
Computers are only human.

From evertjan at VANRAMSELAAR.NL  Tue Jul  1 19:53:38 2003
From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar)
Date: Thu Jan 12 21:18:46 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <3F01D8B2.5010700@vanramselaar.nl>

Julian Field wrote:

> G'day!

Howdy! ;p

> I have just posted the new stable release 4.22-4 on the website.

I have just downloaded the RPM version and installed it. No problems so far.

Great job again Julian! Keep up the good work!

--
   Evert Jan van Ramselaar  <evertjan@vanramselaar.nl>
   Van Ramselaar Info Tech  <http://www.vanramselaar.nl>

From mike at ZANKER.ORG  Tue Jul  1 19:53:49 2003
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:18:46 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>
References: <2F15A97500CFA0469C9BACC2041F8AC7043F7A19@aries.dk.speednames .com>
            <1057079971.24162.142.camel@ralph.plexio.private>
            <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>
Message-ID: <82489500.1057089229@jemima.zanker.org>

On 01 July 2003 18:51 +0100 Julian Field <mailscanner@ECS.SOTON.AC.UK>
wrote:

> Why is it always the Spanish and Portuguese who can never agree on
> the translation? I guess it's the difference in dialects between
> Europe and South America. Maybe I should create a Red-neck and
> Geordie translation too? :)

How about Klingon? If it's good enough for Google... :)

Mike.

From marco at MUW.EDU  Tue Jul  1 20:36:27 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:18:46 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <1057088187.3f01e2bb340af@webmail.MUW.Edu>

Great job as usual !!!

Is there an easy way to upgrade MailScanner on FreeBSD?

Marco

_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From james at PCXPERIENCE.COM  Tue Jul  1 20:28:21 2003
From: james at PCXPERIENCE.COM (James A. Pattie)
Date: Thu Jan 12 21:18:47 2006
Subject: ClamAV autoupdate patch
Message-ID: <3F01E0D5.8010901@pcxperience.com>

Skipped content of type multipart/mixed-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 252 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030701/d93e3e97/attachment.bin
From mailscanner at ecs.soton.ac.uk  Tue Jul  1 20:29:36 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <1057088187.3f01e2bb340af@webmail.MUW.Edu>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030701202837.03b41a58@imap.ecs.soton.ac.uk>

At 20:36 01/07/2003, you wrote:
>Great job as usual !!!
>
>Is there an easy way to upgrade MailScanner on FreeBSD?

The hard work can be done by the upgrade_MailScanner_conf script. This will
propagate your customisations and comments, and insert sensible default
values for new features and settings.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 20:03:16 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <82489500.1057089229@jemima.zanker.org>
References: <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>
            <2F15A97500CFA0469C9BACC2041F8AC7043F7A19@aries.dk.speednames .com>
            <1057079971.24162.142.camel@ralph.plexio.private>
            <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030701200249.03b28d90@imap.ecs.soton.ac.uk>

At 19:53 01/07/2003, you wrote:
>On 01 July 2003 18:51 +0100 Julian Field <mailscanner@ECS.SOTON.AC.UK>
>wrote:
>
>>Why is it always the Spanish and Portuguese who can never agree on
>>the translation? I guess it's the difference in dialects between
>>Europe and South America. Maybe I should create a Red-neck and
>>Geordie translation too? :)
>
>How about Klingon? If it's good enough for Google... :)

Absolutely! Anyone know the ISO 2-letter country/planet code for Klingon?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 20:56:45 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <1057088187.3f01e2bb340af@webmail.MUW.Edu>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>

I hate it when the list goes this quiet just after a release....

From kevins at BMRB.CO.UK  Tue Jul  1 21:01:04 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175BF3@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175BF3@pascal.priv.bmrb.co.uk>
Message-ID: <1057089664.11108.46.camel@bach.kevinspicer.co.uk>

>Absolutely! Anyone know the ISO 2-letter country/planet code for
>Klingon?

Thats daft, theres not a two letter code for Klingon.  There is however
a three letter code - well its a three letter code (art) for 'invented
languages' [What! Klingons aren't real?!] which then has the name of the
language appended i.e.   art-klingon.  Theres also art-elvish and
art-newspeak.

( stolen from http://www.helical-library.net/desk/hg_lang.html )







BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From denis at CROOMBS.ORG  Tue Jul  1 21:02:56 2003
From: denis at CROOMBS.ORG (Denis Croombs)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>           
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk> 
            <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
Message-ID: <008801c3400b$c431c5c0$85b8fea9@Laptop>

Well I have now upgraded to the new version from rpm and it works perfect,
great job Julian
Many thanks
www.just-servers.co.uk

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 01, 2003 8:56 PM
Subject: Re: ANNOUNCE: Version 4.22-4 released


> I hate it when the list goes this quiet just after a release....

From marco at MUW.EDU  Tue Jul  1 21:21:01 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>           
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
Message-ID: <1057090861.3f01ed2d50a72@webmail.MUW.Edu>

Hi Julian,

> I hate it when the list goes this quiet just after a release....

Be careful of what you wish for :)
There is enough of us out there that can keep you busy :)

I think most of us are busy updating to the new release ...

Thank you for all you do

Marco

_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 21:15:02 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <1057090861.3f01ed2d50a72@webmail.MUW.Edu>
References: <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030701211339.03d0e008@imap.ecs.soton.ac.uk>

At 21:21 01/07/2003, you wrote:
>Hi Julian,
>
> > I hate it when the list goes this quiet just after a release....
>
>There is enough of us out there that can keep you busy :)

That's why I hate it when you're not. I get used to the normal state of
affairs :)

>Thank you for all you do

My pleasure.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From randyf at SIBERNET.COM  Tue Jul  1 21:12:23 2003
From: randyf at SIBERNET.COM (Randy Fishel)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner feature request
In-Reply-To: <5.2.1.1.2.20030701175339.03a4b718@imap.ecs.soton.ac.uk>
Message-ID: <Pine.GSO.4.44.0307011143200.9005-100000@husky.sibernet.com>

  Pardon me if this has previously been requested, as there is a
significant volume of MailScanner e-mail, and I don't necessarily read it
all (and I didn't search before making this request).

  I would like to se the silent virus list actually go the other way and
provide the equivilent of a non-silent notification list.  Most of the
newer viruses are doing e-mail harvesting and don't really come from the
specified sender.  So every time a new virus pattern defined, I need to
add this to the silent list.

  I personally would prefer that the default action would to have the
message NOT sent to the sender, and have the choice to send it to the
recipient (the latter already exists, but I would need to add the pattern
to the silent list to get the former).

  Maybe a configuration option would be to turn the silent virus list into
a notification white list, or provide a different list (the presence of
which might disable the current mechanism).

  Thoughts/Opinions?


rf

From miguelk at KONSULTEX.COM.BR  Tue Jul  1 21:21:46 2003
From: miguelk at KONSULTEX.COM.BR (Miguel Koren O'Brien de Lacy)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
References: <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>           
            <2F15A97500CFA0469C9BACC2041F8AC7043F7A19@aries.dk.speednames .com>
            <1057079971.24162.142.camel@ralph.plexio.private>           
            <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701200249.03b28d90@imap.ecs.soton.ac.uk>
Message-ID: <3F01ED5A.8060502@konsultex.com.br>

Julian;

It's

"%&.^#"

planet.country code

;-)

Miguel

P.S. Should we stop this thread by now?

Julian Field wrote:

> At 19:53 01/07/2003, you wrote:
>
>> On 01 July 2003 18:51 +0100 Julian Field <mailscanner@ECS.SOTON.AC.UK>
>> wrote:
>>
>>> Why is it always the Spanish and Portuguese who can never agree on
>>> the translation? I guess it's the difference in dialects between
>>> Europe and South America. Maybe I should create a Red-neck and
>>> Geordie translation too? :)
>>
>>
>> How about Klingon? If it's good enough for Google... :)
>
>
> Absolutely! Anyone know the ISO 2-letter country/planet code for Klingon?
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support

From Antony at SOFT-SOLUTIONS.CO.UK  Tue Jul  1 21:54:57 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner feature request
In-Reply-To: <5.2.1.1.2.20030701175339.03a4b718@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701175339.03a4b718@imap.ecs.soton.ac.uk>
Message-ID: <200307012055.h61Kt2709329@Primary.Networker.test>

On Tuesday 01 July 2003 6:01 pm, Julian Field wrote:

> One of the standard tests I do on undergraduate courseworks that process
> input from the user is to feed the Linux kernel to it and see if their code
> handles it neatly.

Is that source code, or compiled !?

Antony.

--

90% of network problems are routing problems.
9 of the remaining 10% are routing problems in the other direction.
The remaining 1% might be something else, but check the routing anyway.

From mailscanner at ecs.soton.ac.uk  Tue Jul  1 21:57:47 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner feature request
In-Reply-To: <200307012055.h61Kt2709329@Primary.Networker.test>
References: <5.2.1.1.2.20030701175339.03a4b718@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701175339.03a4b718@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030701215619.03a5b670@imap.ecs.soton.ac.uk>

At 21:54 01/07/2003, you wrote:
>On Tuesday 01 July 2003 6:01 pm, Julian Field wrote:
>
> > One of the standard tests I do on undergraduate courseworks that process
> > input from the user is to feed the Linux kernel to it and see if their code
> > handles it neatly.
>
>Is that source code, or compiled !?

Oh, compiled. It's effectively a known large amount of /dev/random.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From Antony at SOFT-SOLUTIONS.CO.UK  Tue Jul  1 22:02:24 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner feature request
In-Reply-To: <5.2.1.1.2.20030701215619.03a5b670@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701175339.03a4b718@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701215619.03a5b670@imap.ecs.soton.ac.uk>
Message-ID: <200307012102.h61L2S709988@Primary.Networker.test>

On Tuesday 01 July 2003 9:57 pm, Julian Field wrote:

> At 21:54 01/07/2003, you wrote:
> >On Tuesday 01 July 2003 6:01 pm, Julian Field wrote:
> > > One of the standard tests I do on undergraduate courseworks that
> > > process input from the user is to feed the Linux kernel to it and see
> > > if their code handles it neatly.
> >
> >Is that source code, or compiled !?
>
> Oh, compiled. It's effectively a known large amount of /dev/random.

I'm not sure that Mr Torvalds would like to hear it described like that :)

Antony

--

Behind the counter a boy with a shaven head stared vacantly into space,
a dozen spikes of microsoft protruding from the socket behind his ear.

 - William Gibson, Neuromancer (1984)

From rogerdv at SOFTHOME.NET  Tue Jul  1 19:27:32 2003
From: rogerdv at SOFTHOME.NET (Roger D. Vargas)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <3F01A6D9.313.5255DC1@localhost>
References: <3F01C8D5.5090603@konsultex.com.br> <3F01A6D9.313.5255DC1@localhost>
Message-ID: <200307011427.32787.rogerdv@softhome.net>

El Martes, 1 de Julio de 2003 02:20 PM, escribi?:
> Regarding Spanish, afaik, the language is spoken in more countries than any
> others (not by more people, I guess that is Chinese), and there are wild
chinese mandarin (there are several chinese dialects)
>
> > Maybe I should create a Red-neck and Geordie translation too? :)
> > Anyone know any Scots Gaelic?
Why not quenya? So elven people can use it too.

-- 
Roger D. Vargas
ICQ: 117641572
Linux user: 180787
* Tanto si piensas que puedes, como si piensas que no puedes, tienes raz?n *
Henry Ford


From jaearick at COLBY.EDU  Tue Jul  1 21:56:30 2003
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
Message-ID: <Pine.GSO.4.56.0307011653460.15430@cayuga>

Julian,
   All of us Yanks are getting set to celebrate our Independence from
you guys this week.  We don't want to upgrade software right before the
holiday and break anything (even though we all know that your upgrades
go flawlessly).

--- Jeff

On Tue, 1 Jul 2003, Julian Field wrote:

> Date: Tue, 1 Jul 2003 20:56:45 +0100
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: ANNOUNCE: Version 4.22-4 released
>
> I hate it when the list goes this quiet just after a release....
>

From dh at UPTIME.AT  Tue Jul  1 22:52:44 2003
From: dh at UPTIME.AT (David)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <200307011427.32787.rogerdv@softhome.net>
Message-ID: <5835AAE0-AC0E-11D7-BCA5-000393920D6C@uptime.at>


On Dienstag, Juli 1, 2003, at 08:27  Uhr, Roger D. Vargas wrote:

> El Martes, 1 de Julio de 2003 02:20 PM, escribi?:
>> Regarding Spanish, afaik, the language is spoken in more countries 
>> than any
>> others (not by more people, I guess that is Chinese), and there are 
>> wild
> chinese mandarin (there are several chinese dialects)
(learned Chinese at University)
and just to give you a number, there are over 3500 known Chinese 
dialects.. so imagine that plus the ones not found yet...

-d

- ? Fantasie ist wichtiger als Wissen.? - Albert Einstein
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030701/424ade18/PGP.bin
From oliver at LINUX-KERNEL.AT  Tue Jul  1 22:53:44 2003
From: oliver at LINUX-KERNEL.AT (Oliver Pitzeier)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
Message-ID: <000101c3401b$3ee9cbf0$0f11a8c0@pitzeier.priv.at>

> I hate it when the list goes this quiet just after a release....

You name it!

---

Great Job! For me it works perfect; Even migrating my SQL
black-/whitelist functions in CustomConfig.pm was no problem to
reintegrate...

-Oliver

From mailscanner at LISTS.COM.AR  Tue Jul  1 22:54:35 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <Pine.GSO.4.56.0307011653460.15430@cayuga>
References: <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>
Message-ID: <3F01D8EB.5573.5E8F4F8@localhost>

So all of us Argentinians won't be upgrading next week since on July 9th we 
celebrate _our_ independence from them Spaniards :-)

El 1 Jul 2003 a las 16:56, Jeff A. Earickson escribi?:

> Julian,
>    All of us Yanks are getting set to celebrate our Independence from
> you guys this week.  We don't want to upgrade software right before the
> holiday and break anything (even though we all know that your upgrades
> go flawlessly).
> 
> --- Jeff
> 

--
Mariano Absatz
El Baby
----------------------------------------------------------
Did anyone see my lost carrier?


From mike at ZANKER.ORG  Tue Jul  1 23:16:01 2003
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <94621062.1057101361@jemima.zanker.org>

On 01 July 2003 18:34 +0100 Julian Field <mailscanner@ECS.SOTON.AC.UK>
wrote:

> I have just posted the new stable release 4.22-4 on the website.

Seeing as CustomConfig.pm has changed I guess it's a good idea for
MailWatch users to hold off until Steve comes up with a new patch?

Mike.

From joelc at CTCHOUSTON.COM  Tue Jul  1 23:33:33 2003
From: joelc at CTCHOUSTON.COM (Joel Colvin)
Date: Thu Jan 12 21:18:47 2006
Subject: Silently drop FORM tags
Message-ID: <019a01c34020$ce416830$5703010a@jclaptop>

Can I silently deal with form tags just like IFrame tags by adding it to the
Silent Viruses?

Silent Viruses = HTML-IFrame HTML-Form

Joel

From raymond at PROLOCATION.NET  Tue Jul  1 23:40:50 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:47 2006
Subject: Silently drop FORM tags
In-Reply-To: <019a01c34020$ce416830$5703010a@jclaptop>
Message-ID: <Pine.LNX.4.44.0307020040280.2375-100000@mailbox.prolocation.net>

Hi!

> Can I silently deal with form tags just like IFrame tags by adding it to the
> Silent Viruses?
>
> Silent Viruses = HTML-IFrame HTML-Form

Dont think so, its not a virus ...
Most likely different part of code.

Bye,
Raymond.

From raymond at PROLOCATION.NET  Wed Jul  2 00:11:18 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <Pine.LNX.4.44.0307020108130.5611-100000@mailbox.prolocation.net>

Hi!

> - control over HTML forms in email messages, which have been used recently
> to try to extract passwords and credit card details from unwitting users.

Works fine:

The following e-mail messages were found to have viruses in them:

    Sender: info@managersonline.nl
IP Address: 212.79.242.217
 Recipient: m.xraax@bxaax-it.cox
   Subject: Managersonline.nl Nieuws 2 juli 2003
 MessageID: h61MuJVP031406
    Report: Found a form in HTML message

The only thing is that a LOT of mails contain them, legit ones :) So i
turned it back on on my boxes. ...

> - control over the maximum size of any message, so you can limit the size
> of messages for dial-up users for example.

Nice one!

Sop far running fine on two of my boxes, testing the FILE ruleset now...

Thanks again Julian!

Bye,
Raymond.

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 00:47:23 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <94621062.1057101361@jemima.zanker.org>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030702004637.0240a1d0@imap.ecs.soton.ac.uk>

At 23:16 01/07/2003, you wrote:
>On 01 July 2003 18:34 +0100 Julian Field <mailscanner@ECS.SOTON.AC.UK>
>wrote:
>
>>I have just posted the new stable release 4.22-4 on the website.
>
>Seeing as CustomConfig.pm has changed I guess it's a good idea for
>MailWatch users to hold off until Steve comes up with a new patch?

Out of interest, had you previously edited your CustomConfig.pm?
If so, did it overwrite your CustomConfig.pm or add CustomConfig.pm.rpmnew?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 00:55:24 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: Silently drop FORM tags
In-Reply-To: <019a01c34020$ce416830$5703010a@jclaptop>
Message-ID: <5.2.1.1.2.20030702004923.0263aea8@imap.ecs.soton.ac.uk>

At 23:33 01/07/2003, you wrote:
>Can I silently deal with form tags just like IFrame tags by adding it to the
>Silent Viruses?
>
>Silent Viruses = HTML-IFrame HTML-Form

Yes, that's exactly how to do it.
Sorry, I forgot to add that to the docs for the "Silent Viruses" option.

The wording and functionality of the "Silent Viruses" option needs some work.
1) It needs to be renamed so it clearly includes special keywords like
HTML-IFrame
2) It needs to be turned into a whitelist or a blacklist of some sort, as
there are ever diminishing reasons for actually bothering to warn the
senders of anything.

However, I'm a bit loathed to spend much time on it, as we will soon reach
the situation where no-one warns senders of anything as all the viruses in
circulation fake From addresses.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From raymond at PROLOCATION.NET  Wed Jul  2 01:00:11 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:47 2006
Subject: Silently drop FORM tags
In-Reply-To: <5.2.1.1.2.20030702004923.0263aea8@imap.ecs.soton.ac.uk>
Message-ID: <Pine.LNX.4.44.0307020159001.11062-100000@mailbox.prolocation.net>

Hi!

> >Can I silently deal with form tags just like IFrame tags by adding it to the
> >Silent Viruses?
> >
> >Silent Viruses = HTML-IFrame HTML-Form
>
> Yes, that's exactly how to do it.
> Sorry, I forgot to add that to the docs for the "Silent Viruses" option.

Grin, i just noticed in the config also. :=)

> However, I'm a bit loathed to spend much time on it, as we will soon reach
> the situation where no-one warns senders of anything as all the viruses in
> circulation fake From addresses.

I have some others in my silent list i noticed, perhaps handy for others
to share:

Silent Viruses = Klez Yaha Bugbear Lentin Sobig Hybris Sircam Holar Ganda

Bye,
Raymond.

From newsletters at PCSITES.COM  Wed Jul  2 03:15:25 2003
From: newsletters at PCSITES.COM (Richard Ahlquist)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <5.2.1.1.2.20030701184936.03aba610@imap.ecs.soton.ac.uk>
Message-ID: <01ad01c3403f$cce84fc0$5a01a8c0@rhome>

Being in Georgia I feel free to offer the Red-neck version;

Dat dere email thingy's too beeg!



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: Tuesday, July 01, 2003 1:51 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Quick translation request - Brazilian Portuguese


Why is it always the Spanish and Portuguese who can never agree on the 
translation? I guess it's the difference in dialects between Europe and 
South America.
Maybe I should create a Red-neck and Geordie translation too? :)

Anyone know any Scots Gaelic?

At 18:45 01/07/2003, you wrote:
>I'm in Brazil and I speak Portuguese but what I don't know is if we're
>translating selected phrases or a whole system (I did not follow the 
>translation thread). If it's just this phrase I favor Stephen's 
>formulation and if you want to keep it shorter you can use:
>
>A mensagem excede o espa?o dispon?vel
>
>Miguel
>
>Stephen Lee wrote:
>
>>Here's another Brazilian Portuguese version (by proxy as well):
>>
>>Esta mensagem excede o espa?o dispon?vel.
>>
>>
>>Stephen
>>
>>On Tue, 2003-07-01 at 01:54, Florus Both wrote:
>>
>>
>>>A mensagem e muito longa.
>>>
>>>Florus (by proxy of a colleague :))
>>>
>>>-----Original Message-----
>>>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>>>Sent: 1. juli 2003 10:28
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Re: Quick translation request
>>>
>>>
>>>You're doing really well folks.
>>>
>>>Just
>>>
>>>Welsh
>>>Hungarian
>>>Italian
>>>Brazilian Portuguese
>>>Romanian
>>>
>>>left to go.
>>>--
>>>Julian Field
>>>www.MailScanner.info
>>>MailScanner thanks transtec Computers for their support
>>>
>

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support


From smhickel at CHARTERMI.NET  Wed Jul  2 03:23:20 2003
From: smhickel at CHARTERMI.NET (Steve Hickel)
Date: Thu Jan 12 21:18:47 2006
Subject: User Unknown
Message-ID: <200307020223.h622NKV20510@chartermi.net>

Roland,

Problem turned out to be the domain in the route had two dots in the domain name. Old eyes made it tough to spot.

Thanks,

Steve


teve Hickel <smhickel@chartermi.net> wrote ..
> Roland,
>
> In the SMTP part of IIS MGR I went to access and put in the domain gearresearch.com
> in the allow domain for relays.
>
> It wasn't there before.
>
> Now it is sayingthe following (don't forget it is in descending order):
>
>
> Jun 30 16:37:49 Neptune - Msg h5UKbj43003771: to=scott@gearresearch.com,
> delay=00:00:04, xdelay=00:00:00, mailer=esmtp, pri=121936, relay=192.168.1.15.
> [192.168.1.15], dsn=2.0.0, stat=Sent ( 792B741CF2C0154599608BC5F7505AC11CCD30@luna.korehicom.com
> Queued mail for
> delivery)
> Jun 30 16:37:49 Neptune - Msg Uninfected: Delivered 1 messages
> Jun 30 16:37:48 Neptune - MailScanner Virus and Content Scanning: Starting
> Jun 30 16:37:48 Neptune - Msg h5UJdAEp001067: to=1-659023-gearresearch.com?rick@stderr.emailpartners.com,
> delay=00:58:37, xdelay=00:01:00, mailer=esmtp, pri=753620, relay=stdin-01.emailpartners.com.
> [65.247.177.9], dsn=4.0.0, stat=Deferred: Connection timed out with
> stdin-01.emailpartners.com.
> Jun 30 16:37:46 Neptune - MailScanner New Batch: Scanning 1 messages, 3102
> bytes
> Jun 30 16:37:46 Neptune - Msg h5UKbj43003771: to=scott@gearresearch.com,
> delay=00:00:01, mailer=esmtp, pri=31936, stat=queued
> Jun 30 16:37:46 Neptune 2607 Msg h5UKbj43003771: from=Steve@KoreHiCom.com,
> size=2607, class=0, nrcpts=1, msgid=792B741CF2C0154599608BC5F7505AC11CCD30@luna.korehicom.com,
> proto=ESMTP, daemon=MTA, relay=[192.168.1.15]
> Jun 30 16:37:45 Neptune - Msg h5UKbd43003723: to=scott@gearresearch.com,
> delay=00:00:06, xdelay=00:00:00, mailer=esmtp, pri=121521, relay=192.168.1.15.
> [192.168.1.15], dsn=2.0.0, stat=Sent ( 792B741CF2C0154599608BC5F7505AC11CCD30@luna.korehicom.com
> Queued mail for
> delivery)
>
>
> Roland Ehle <mailscanner@CARLO65.DE> wrote ..
> > Hi Steve,
> >
> > Steve Hickel schrieb:
> > > No matter what I do I can't get my exchange box to accept the below:
> > > Any thoughts?
> > > h5UK7843002574: h5UK7Gao002611: DSN: User unknown
> > > Jun 30 16:07:16 Neptune - Msg h5UK7843002574: to=scott@gearresearch.com,
> > delay=00:00:07, xdelay=00:00:00, mailer=esmtp, pri=120961, relay=192.168.1.15.
> > [192.168.1.15], dsn=5.1.1, stat=User unknown
> > > Jun 30 16:07:16 Neptune - Msg Uninfected: Delivered 1 messages
> >
> > did you configure your exchange-box to accept mails for the domain
> > gearresearch.com? Does the alias scott exist?
> >
> > Regards,
> > Roland
From ryanb at AACRAO.ORG  Wed Jul  2 04:02:28 2003
From: ryanb at AACRAO.ORG (Ryan Bingham)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
References: <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk>           
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>           
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>           
            <5.2.1.1.2.20030701205507.03ab1068@imap.ecs.soton.ac.uk> 
            <5.2.1.1.2.20030701211339.03d0e008@imap.ecs.soton.ac.uk>
Message-ID: <006301c34046$5fadcd20$f8240340@kh06s9>

Hi Julian,

Upgraded here without a hitch.  You are truly amazing!

So far it looks like everything is working great.  Thanks again for the
filetype filter!

Hope you have good trip in Canada (even if you will be without broadband).
We all need to chip in and buy Julian a wireless neural shunt.  :-)

Thanks again!

Ryan

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 01, 2003 4:15 PM
Subject: Re: ANNOUNCE: Version 4.22-4 released


At 21:21 01/07/2003, you wrote:
>Hi Julian,
>
> > I hate it when the list goes this quiet just after a release....
>
>There is enough of us out there that can keep you busy :)

That's why I hate it when you're not. I get used to the normal state of
affairs :)

>Thank you for all you do

My pleasure.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mike at CAMAROSS.NET  Wed Jul  2 04:43:19 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <006301c34046$5fadcd20$f8240340@kh06s9>
Message-ID: <000501c3404c$14e2b5c0$9c01a8c0@home.middlefinger.net>

So we've now graduated from kidneys to neural implants?  I'll throw in a
kid! :)

Mike

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Ryan Bingham
Sent: Tuesday, July 01, 2003 10:02 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: ANNOUNCE: Version 4.22-4 released


Hi Julian,

Upgraded here without a hitch.  You are truly amazing!

So far it looks like everything is working great.  Thanks again for the
filetype filter!

Hope you have good trip in Canada (even if you will be without broadband).
We all need to chip in and buy Julian a wireless neural shunt.  :-)

Thanks again!

Ryan

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 01, 2003 4:15 PM
Subject: Re: ANNOUNCE: Version 4.22-4 released


At 21:21 01/07/2003, you wrote:
>Hi Julian,
>
> > I hate it when the list goes this quiet just after a release....
>
>There is enough of us out there that can keep you busy :)

That's why I hate it when you're not. I get used to the normal state of
affairs :)

>Thank you for all you do

My pleasure.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support


From benny.butler at NEXUSITG.COM  Wed Jul  2 04:48:31 2003
From: benny.butler at NEXUSITG.COM (Benny Butler)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <01ad01c3403f$cce84fc0$5a01a8c0@rhome>
Message-ID: <000b01c3404c$cf30a630$4c3b3f44@bluebird>

Sounds like there's as many versions of redneck is there is Spanish.

Heck, I'm going to feed my language files through the dialectizer so I
can get Swiss Chef, Porky and Jive (Jive is my favorite)

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Richard Ahlquist
Sent: Tuesday, July 01, 2003 9:15 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Quick translation request - Brazilian Portuguese


Being in Georgia I feel free to offer the Red-neck version;

Dat dere email thingy's too beeg!



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: Tuesday, July 01, 2003 1:51 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Quick translation request - Brazilian Portuguese


Why is it always the Spanish and Portuguese who can never agree on the 
translation? I guess it's the difference in dialects between Europe and 
South America.
Maybe I should create a Red-neck and Geordie translation too? :)

Anyone know any Scots Gaelic?

At 18:45 01/07/2003, you wrote:
>I'm in Brazil and I speak Portuguese but what I don't know is if we're 
>translating selected phrases or a whole system (I did not follow the 
>translation thread). If it's just this phrase I favor Stephen's 
>formulation and if you want to keep it shorter you can use:
>
>A mensagem excede o espa?o dispon?vel
>
>Miguel
>
>Stephen Lee wrote:
>
>>Here's another Brazilian Portuguese version (by proxy as well):
>>
>>Esta mensagem excede o espa?o dispon?vel.
>>
>>
>>Stephen
>>
>>On Tue, 2003-07-01 at 01:54, Florus Both wrote:
>>
>>
>>>A mensagem e muito longa.
>>>
>>>Florus (by proxy of a colleague :))
>>>
>>>-----Original Message-----
>>>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>>>Sent: 1. juli 2003 10:28
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Re: Quick translation request
>>>
>>>
>>>You're doing really well folks.
>>>
>>>Just
>>>
>>>Welsh
>>>Hungarian
>>>Italian
>>>Brazilian Portuguese
>>>Romanian
>>>
>>>left to go.
>>>--
>>>Julian Field
>>>www.MailScanner.info
>>>MailScanner thanks transtec Computers for their support
>>>
>

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support


From splee at PLEXIO.COM  Wed Jul  2 06:25:48 2003
From: splee at PLEXIO.COM (Stephen Lee)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <5835AAE0-AC0E-11D7-BCA5-000393920D6C@uptime.at>
References: <5835AAE0-AC0E-11D7-BCA5-000393920D6C@uptime.at>
Message-ID: <1057123547.24159.160.camel@ralph.plexio.private>

On Tue, 2003-07-01 at 14:52, David wrote:
> On Dienstag, Juli 1, 2003, at 08:27  Uhr, Roger D. Vargas wrote:
> 
> > El Martes, 1 de Julio de 2003 02:20 PM, escribi?:
> >> Regarding Spanish, afaik, the language is spoken in more countries 
> >> than any
> >> others (not by more people, I guess that is Chinese), and there are 
> >> wild
> > chinese mandarin (there are several chinese dialects)
> (learned Chinese at University)
> and just to give you a number, there are over 3500 known Chinese 
> dialects.. so imagine that plus the ones not found yet...

Sure there are 3500 spoken dialects but only a few (2-3) written
variations and most Chinese can read the bulk of those written forms. I
presume Julian was looking for written and not phonetic translations ;-)

Stephen


From evertjan at VANRAMSELAAR.NL  Wed Jul  2 06:54:46 2003
From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030702004637.0240a1d0@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030702004637.0240a1d0@imap.ecs.soton.ac.uk>
Message-ID: <30520.194.151.195.222.1057125286.squirrel@mail.vanramselaar.nl>

Julian Field said:
>>>I have just posted the new stable release 4.22-4 on the website.
>>Seeing as CustomConfig.pm has changed I guess it's a good idea for
>>MailWatch users to hold off until Steve comes up with a new patch?

Hehe, good one! I forgot all about the changes I made to this file when
deploying MailWatch. Nothing broken with upgrading MailScanner though,
because:

> Out of interest, had you previously edited your CustomConfig.pm?
> If so, did it overwrite your CustomConfig.pm or add
> CustomConfig.pm.rpmnew?

It did not touch the altered CustomConfig.pm and added a
CustomConfig.pm.rpmnew like I think it should.

I have not diffed the old and new files yet, so I do not know what the
impact of using the "old" MailWatch version of CustomConfig.pm is. So far
so good, because both MailScanner and MailWatch are still working fine.

--
  Evert Jan van Ramselaar  <evertjan@vanramselaar.nl>
  Van Ramselaar Info Tech  <http://www.vanramselaar.nl>

From mike at ZANKER.ORG  Wed Jul  2 07:28:07 2003
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <30520.194.151.195.222.1057125286.squirrel@mail.vanramselaar.nl>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030702004637.0240a1d0@imap.ecs.soton.ac.uk>
            <30520.194.151.195.222.1057125286.squirrel@mail.vanramselaar.nl>
Message-ID: <124146906.1057130887@jemima.zanker.org>

On 02 July 2003 07:54 +0200 Evert Jan van Ramselaar
<evertjan@VANRAMSELAAR.NL> wrote:

> Hehe, good one! I forgot all about the changes I made to this file
> when deploying MailWatch. Nothing broken with upgrading MailScanner
> though, because:
>
> It did not touch the altered CustomConfig.pm and added a
> CustomConfig.pm.rpmnew like I think it should.

Yes, I though it would do this but didn't know what the outcome of
using the older, patched CustomConfig.pm with 4.22 would be.

> I have not diffed the old and new files yet, so I do not know what the
> impact of using the "old" MailWatch version of CustomConfig.pm is. So
> far so good, because both MailScanner and MailWatch are still working
> fine.

Good to know. 4.21-8 is working fine here so I'll hold off a bit
longer, just in case.

Mike.

From JEN at AH.DK  Wed Jul  2 08:30:13 2003
From: JEN at AH.DK (Jan Elmqvist Nielsen)
Date: Thu Jan 12 21:18:47 2006
Subject: Only 1.3 score by spamassassin
Message-ID: <sf02a63b.020@ahpost.ah.dk>

How did this mail only get 1.3 by spamassassin?

I am using mailscanner 4.21-9 and spamassassin 2.55

Jan Elmqvist Nielsen
-------------- next part --------------
An embedded message was scrubbed...
From: "Normand Noble" <noble_xn@mecanica.upm.es>
Subject: =?ISO-8859-1?B?SSBrbm93IGFsbCBh?=bout you
Date: Wed, 02 Jul 2003 03:21:44 -0100
Size: 2818
Url: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030702/7d8d7278/attachment.mht
From Kevin.Spicer at BMRB.CO.UK  Wed Jul  2 08:46:49 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6C1@pascal.priv.bmrb.co.uk>

> - control over HTML forms in email messages, which have been used
>> recently to try to extract passwords and credit card details from
>> unwitting users. 
> 

Am I correct in thinking that setting 

Allow Form Tags = yes

and

Convert Dangerous HTML To Text = yes

will strip the form tags from these emails whilst still allowing the emails to be delivered?



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From evertjan at VANRAMSELAAR.NL  Wed Jul  2 08:54:43 2003
From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar)
Date: Thu Jan 12 21:18:47 2006
Subject: Only 1.3 score by spamassassin
In-Reply-To: <sf02a63b.020@ahpost.ah.dk>
References: <sf02a63b.020@ahpost.ah.dk>
Message-ID: <39872.194.151.195.222.1057132483.squirrel@mail.vanramselaar.nl>

Jan Elmqvist Nielsen said:
> How did this mail only get 1.3 by spamassassin?
> I am using mailscanner 4.21-9 and spamassassin 2.55

MailScanner has nothing to do with SpamAssassin scoring. It just uses the
results. Talk about SA scoring belongs on the SA mailinglist.

--
  Evert Jan van Ramselaar  <evertjan@vanramselaar.nl>
  Van Ramselaar Info Tech  <http://www.vanramselaar.nl>

From JEN at AH.DK  Wed Jul  2 09:04:00 2003
From: JEN at AH.DK (Jan Elmqvist Nielsen)
Date: Thu Jan 12 21:18:47 2006
Subject: Vedr.: Re: Only 1.3 score by spamassassin
Message-ID: <sf02ae2e.063@ahpost.ah.dk>

I have also posted to spamassassin list.

I can see that:
Expand Your Penis up to 20% Thicker

is in html this:
Expand Your Pen<frame><noframes>5t669</noframes></frame>is up to 20% Thicker

A little bit scarey..

>>> evertjan@VANRAMSELAAR.NL 02-07-2003 09:54:43 >>>
Jan Elmqvist Nielsen said:
> How did this mail only get 1.3 by spamassassin?
> I am using mailscanner 4.21-9 and spamassassin 2.55

MailScanner has nothing to do with SpamAssassin scoring. It just uses the
results. Talk about SA scoring belongs on the SA mailinglist.

--
  Evert Jan van Ramselaar  <evertjan@vanramselaar.nl>
  Van Ramselaar Info Tech  <http://www.vanramselaar.nl>

From mailscanner at BARENDSE.TO  Wed Jul  2 09:19:37 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:47 2006
Subject: Feature request X-MailScanner-SpamCheck:
Message-ID: <Pine.LNX.4.44.0307021015150.5375-100000@raveon.barendse.to>

Don't know if this is an easy thing to do but I have a suggestion.

Currently when mail passes several MailScanner servers all the
X-headers are appended.

For debugging reasons I think it would be practical if ever report could
also include the host name or ip addr. of the host that generated the
report.

I would like to know and check why two identical boxes generate different
scores but it's hard to see which header is from which host!

X-MailScanner-SpamCheck: not spam, SpamAssassin (score=3, required 6,
        FAILURE_NOTICE_1 -0.30, FROM_NO_LOWER 2.20, INVALID_DATE 0.59,
        RCVD_IN_UNCONFIRMED_DSBL 0.51), not spam (whitelisted),
SpamAssassin (score=1.6,
        required 5, FAILURE_NOTICE_1 -0.30, INVALID_DATE 0.59,
        NO_REAL_NAME 0.82, RCVD_IN_UNCONFIRMED_DSBL 0.51)

Thanks!

Remco

From mailscanner at BARENDSE.TO  Wed Jul  2 09:31:49 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:47 2006
Subject: SpamAssassin -D??
Message-ID: <Pine.LNX.4.44.0307021030110.7905-100000@raveon.barendse.to>

I would like to see why DCC isn't working with SpamAssassin so I tried
running it in debug mode.

I tried :
spamassassin -D /usr/share/doc/spamassassin-2.55/sample-spam.txt


which just makes spamassassin to hang forever and display no output
whatsoever. This is a RedHat 8.0 box with SpamAssassin 2.55-2

Ideas anyone?

Thanks!
Remco

From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Jul  2 09:58:41 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner + Sophos: a serious bug?
Message-ID: <52E50E4D595DDE4D861117A1FB62E79DBFFBD0@bond.ncl.ac.uk>

Re. my earlier messages about Sophos sometimes missing Sobig variants in
messages.

I switched on quarantining of virus containing messages and believe I
can now see what is going on. In fact the problem is not just limited to
Sobig (the most common infection at present) but to Yaha.G as well and
most probably all other viruses.  

It seems that Sophos will not recognise viruses, including at least
Yaha.G and all variants of Sobig, when the message being scanned is a
bounce/error return message which contains the whole of the original
message, including the zipped attachment with the virus/worm in it.

At this site McAfee but not Sophos recognises the virus in such a
message.

Two questions:

1. Is this a problem with MailScanner's parsing of messages or with the
A-V product it calls and to which it passes the message contents?

2. How serious is it if such a message is delivered intact?  

I would like to understand the problem and its possible consequences a
bit better before I forward some example messages to Sophos.

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

> -----Original Message-----
> From: Quentin Campbell [mailto:Q.G.Campbell@NEWCASTLE.AC.UK] 
> Sent: 01 July 2003 12:34
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Sobig.{E,D,EML} not found by Sophos and McAfee - 
> further info
> 
> 
> > -----Original Message-----
> > From: Quentin Campbell [mailto:Q.G.Campbell@newcastle.ac.uk]
> > Sent: 01 July 2003 10:40
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Sobig.{E,D,EML} not found by Sophos and McAfee
> > 
> [snip]
> > > By the way, what's Sobig.EML and ...
> > 
> > Good question. I cannot find this virus at the NAI site yet
> > it is McAfee that is recognising it! The notification I got says:
> > 
> > The following e-mail messages were found to have viruses in them:
> > 
> >     Sender: auto.reply@compuserve.com
> > IP Address: 149.174.40.6
> >  Recipient: xxx@newcastle.ac.uk
> >    Subject: Undeliverable Message
> >  MessageID: h611uKu05157
> >     Report: /h611uKu05157/msg-32244-1482.txt        Found the
> > W32/Sobig.eml virus !!!
> > 
> > > ...what harm can it do in a .txt file?
> > 
> > That is not the point unless you are suggesting that is why
> > Sophos does not recognise it? The issue for me is why one A-V 
> > scanner finds it but another doesn't.
> 
> The one thing all these messages have in common are that they 
> are bounce messages of one sort or another:
> 
>  o undeliverable message 
>  o failure notice
>  o returned mail - nameserver error ...
> 
> It appears that they retain some sort of "signature" text, 
> probably harmless, that the McAfee scanner recognises but not 
> the Sophos scanner. Does this sound plausible? 
> 
> Note that this applies to both "Sobig.e", "Sobig.d" and 
> "Sobig.eml" (what ever that is).
> 
> The latter suggests an alternative theory that it might be 
> MailScanner wrongly picking up a string from the McAfee 
> scanner or wrongly reporting a string that it has; that is, 
> it reports as "Sobig.eml" a string that is something else? 
> 
> I will see if I can quarantine some of these messages.
> 
> Quentin
> ---
> PHONE: +44 191 222 8209    Computing Service, University of Newcastle
> FAX:   +44 191 222 8765    Newcastle upon Tyne, United 
> Kingdom, NE1 7RU.
> --------------------------------------------------------------
> ----------
> "Any opinion expressed above is mine. The University can get 
> its own." 
> 
>  
> 


From m.sapsed at BANGOR.AC.UK  Wed Jul  2 10:09:25 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner feature request
References: <Pine.GSO.4.44.0307011143200.9005-100000@husky.sibernet.com>
Message-ID: <3F02A145.1030906@bangor.ac.uk>

randyf@sibernet.com wrote:
>   I would like to se the silent virus list actually go the other way and
> provide the equivilent of a non-silent notification list.  Most of the
> newer viruses are doing e-mail harvesting and don't really come from the
> specified sender.  So every time a new virus pattern defined, I need to
> add this to the silent list.
>
>   I personally would prefer that the default action would to have the
> message NOT sent to the sender, and have the choice to send it to the
> recipient (the latter already exists, but I would need to add the pattern
> to the silent list to get the former).
>
>   Maybe a configuration option would be to turn the silent virus list into
> a notification white list, or provide a different list (the presence of
> which might disable the current mechanism).

but (as things stand) my Silent list has 8 entries for worm families but
Sophos detects about 82000 viruses or something. I like the fact that if
someone with old (or no) anti-virus software attaches a word document
with any macro virus in it to an e-mail, they'll get a "heads-up" to get
their act together, or if someone sends in a joke or trojan binary to a
friend, they'll get a warning that we don't want those here. My guess is
that a lot of the "new" worms which appear will just be new variants of
existing ones, and adding an extra entry to the line isn't hard...

I guess an option (off by default) to switch things around for those who
want it wouldn't hurt, but I (personally) wouldn't like to lose the
current facility...

Just my tuppenny worth though...

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From m.sapsed at BANGOR.AC.UK  Wed Jul  2 10:23:08 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:47 2006
Subject: Silently drop FORM tags
References: <Pine.LNX.4.44.0307020159001.11062-100000@mailbox.prolocation.net>
Message-ID: <3F02A47C.1070809@bangor.ac.uk>

Raymond Dijkxhoorn wrote:
>>However, I'm a bit loathed to spend much time on it, as we will soon reach
>>the situation where no-one warns senders of anything as all the viruses in
>>circulation fake From addresses.

See my disagreement on the other thread...

> Silent Viruses = Klez Yaha Bugbear Lentin Sobig Hybris Sircam Holar Ganda

I don't think Sircam forges does it?

Didn't think Hybris gave anything to send a warning to? Julian, what
does MailScanner use - the entry in Sender: in the reports? If that's
blank, does it do anything?

Wasn't aware of Holar or Ganda and what's Lentin?

I currently have (for Sophos)

Silent Viruses = Klez Yaha Bugbear Braid WinEvar Fizzer Palyh Sobig


Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From m.sapsed at BANGOR.AC.UK  Wed Jul  2 10:24:45 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:47 2006
Subject: Sobig.{E,D,EML} not found by Sophos and McAfee
References: <52E50E4D595DDE4D861117A1FB62E79D82089E@bond.ncl.ac.uk>
            <1057079365.4524.6.camel@wilowisp.dynetics.com>
Message-ID: <3F02A4DD.3090504@bangor.ac.uk>

Jim Levie wrote:
> I'm seeing something similar in that Sophos with the latest IDE's isn't
> catching some variants of SoBig that arrived over the weekend and this
> morning. McAfee is detecting them, so far. The virus isn't reaching my
> users, at least currently, because they are all in a disguised zip file
> and I have a filename rule that disallows '.zi'.

Have you quarantined any and if so, have you sent them to Sophos for
analysis?

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From dot at DOTAT.AT  Wed Jul  2 11:01:49 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner feature request
In-Reply-To: <m2n.19XRYt-000tMy@chiark.greenend.org.uk>
References: <5.2.1.1.2.20030701175339.03a4b718@imap.ecs.soton.ac.uk>
Message-ID: <E19XeQv-0001VI-00@chiark.greenend.org.uk>

Randy Fishel <randyf@SIBERNET.COM> wrote:
>
>  I personally would prefer that the default action would to have the
>message NOT sent to the sender, and have the choice to send it to the
>recipient (the latter already exists, but I would need to add the pattern
>to the silent list to get the former).

I also don't think that sender notifications are a good idea. In my
MailScanner.conf I have Notify Senders = no, and in the text of the
recipient virus notifications I tell them to inform the sender of the
problem only if they are sure the message is otherwise legitimate.
I've also altered the sender reports so that they get sent to me, in
case of misconfiguration.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
SELSEY BILL TO LYME REGIS: WEST OR NORTHWEST 3 OR 4. ISOLATED SHOWERS.
MODERATE OR GOOD. SLIGHT.

From Kevin.Spicer at BMRB.CO.UK  Wed Jul  2 11:14:19 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner feature request
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6C5@pascal.priv.bmrb.co.uk>

> I also don't think that sender notifications are a good idea. In my
> MailScanner.conf I have Notify Senders = no, and in the text of the
> recipient virus notifications I tell them to inform the sender of the
> problem only if they are sure the message is otherwise legitimate.
> I've also altered the sender reports so that they get sent to me, in
> case of misconfiguration. 

FWIW I've just configured mine as a ruleset so that only local senders get notified.




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From rogerdv at SOFTHOME.NET  Wed Jul  2 11:54:35 2003
From: rogerdv at SOFTHOME.NET (Roger D. Vargas)
Date: Thu Jan 12 21:18:47 2006
Subject: Quick translation request - Brazilian Portuguese
In-Reply-To: <5835AAE0-AC0E-11D7-BCA5-000393920D6C@uptime.at>
References: <5835AAE0-AC0E-11D7-BCA5-000393920D6C@uptime.at>
Message-ID: <200307020654.35500.rogerdv@softhome.net>

El Martes, 1 de Julio de 2003 05:52 PM, escribi?:
> On Dienstag, Juli 1, 2003, at 08:27  Uhr, Roger D. Vargas wrote:
> > El Martes, 1 de Julio de 2003 02:20 PM, escribi??:
> >> Regarding Spanish, afaik, the language is spoken in more countries
> >> than any
> >> others (not by more people, I guess that is Chinese), and there are
> >> wild
> >
> > chinese mandarin (there are several chinese dialects)
>
> (learned Chinese at University)
> and just to give you a number, there are over 3500 known Chinese
> dialects.. so imagine that plus the ones not found yet...
>
That is an awesome number. I had to deal with 2-3 (mandarin, cantonese) in my 
kung fu training, never imagined there were so many chinese languages.

-- 
Roger D. Vargas
ICQ: 117641572
Linux user: 180787
* Tanto si piensas que puedes, como si piensas que no puedes, tienes raz?n *
Henry Ford


From mailscanner at ecs.soton.ac.uk  Wed Jul  2 11:37:30 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: SpamAssassin -D??
In-Reply-To: <Pine.LNX.4.44.0307021030110.7905-100000@raveon.barendse.to >
Message-ID: <5.2.0.9.2.20030702113649.05c34b18@imap.ecs.soton.ac.uk>

Check you have told SpamAssassin where to find dccproc (read
Mail::SpamAssassin::conf man page).
Also have you got iptables or anything like that potentially blocking the
replies from dcc?

At 09:31 02/07/2003, you wrote:
>I would like to see why DCC isn't working with SpamAssassin so I tried
>running it in debug mode.
>
>I tried :
>spamassassin -D /usr/share/doc/spamassassin-2.55/sample-spam.txt
>
>
>which just makes spamassassin to hang forever and display no output
>whatsoever. This is a RedHat 8.0 box with SpamAssassin 2.55-2
>
>Ideas anyone?
>
>Thanks!
>Remco

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 11:26:44 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF6C1@pascal.priv.bmrb.co .uk>
Message-ID: <5.2.0.9.2.20030702112313.03f64918@imap.ecs.soton.ac.uk>

At 08:46 02/07/2003, you wrote:
> > - control over HTML forms in email messages, which have been used
> >> recently to try to extract passwords and credit card details from
> >> unwitting users.
> >
>
>Am I correct in thinking that setting
>
>Allow Form Tags = yes
>
>and
>
>Convert Dangerous HTML To Text = yes
>
>will strip the form tags from these emails whilst still allowing the
>emails to be delivered?

Should do, yes.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 11:41:28 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: Silently drop FORM tags
In-Reply-To: <3F02A47C.1070809@bangor.ac.uk>
References: <Pine.LNX.4.44.0307020159001.11062-100000@mailbox.prolocation.net>
Message-ID: <5.2.0.9.2.20030702113817.03ff8110@imap.ecs.soton.ac.uk>

At 10:23 02/07/2003, you wrote:
>Didn't think Hybris gave anything to send a warning to? Julian, what
>does MailScanner use - the entry in Sender: in the reports? If that's
>blank, does it do anything?

It uses the envelope sender address which is not always shown in the
message headers. If the envelope sender is blank, then I seem to remember
it throws away the sender warning.

>Silent Viruses = Klez Yaha Bugbear Braid WinEvar Fizzer Palyh Sobig

Raymond and I are working out a system whereby you can automatically keep
this list up to date as new viruses of this type appear, but you will still
be able to customise the list as well. Watch this space...
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 11:34:26 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: Vedr.: Re: Only 1.3 score by spamassassin
In-Reply-To: <sf02ae2e.063@ahpost.ah.dk>
Message-ID: <5.2.0.9.2.20030702113412.041b6bd8@imap.ecs.soton.ac.uk>

At 09:04 02/07/2003, you wrote:
>I have also posted to spamassassin list.
>
>I can see that:
>Expand Your Penis up to 20% Thicker
>
>is in html this:
>Expand Your Pen<frame><noframes>5t669</noframes></frame>is up to 20% Thicker

I believe SpamAssassin 2.60 will address this problem.


>A little bit scarey..
>
> >>> evertjan@VANRAMSELAAR.NL 02-07-2003 09:54:43 >>>
>Jan Elmqvist Nielsen said:
> > How did this mail only get 1.3 by spamassassin?
> > I am using mailscanner 4.21-9 and spamassassin 2.55
>
>MailScanner has nothing to do with SpamAssassin scoring. It just uses the
>results. Talk about SA scoring belongs on the SA mailinglist.
>
>--
>   Evert Jan van Ramselaar  <evertjan@vanramselaar.nl>
>   Van Ramselaar Info Tech  <http://www.vanramselaar.nl>

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 11:36:22 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: Feature request X-MailScanner-SpamCheck:
In-Reply-To: <Pine.LNX.4.44.0307021015150.5375-100000@raveon.barendse.to >
Message-ID: <5.2.0.9.2.20030702113509.05c386a8@imap.ecs.soton.ac.uk>

At 09:19 02/07/2003, you wrote:
>Don't know if this is an easy thing to do but I have a suggestion.
>
>Currently when mail passes several MailScanner servers all the
>X-headers are appended.
>
>For debugging reasons I think it would be practical if ever report could
>also include the host name or ip addr. of the host that generated the
>report.

If you customise the headers in the MailScanner.conf then this isn't a
problem. Put an acronym of your site name in the header name.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 11:29:42 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner + Sophos: a serious bug?
In-Reply-To: <52E50E4D595DDE4D861117A1FB62E79DBFFBD0@bond.ncl.ac.uk>
Message-ID: <5.2.0.9.2.20030702112915.03d1fc68@imap.ecs.soton.ac.uk>

Can you (in a password-protected zip) send me an example or two so I can
see exactly what you mean.

At 09:58 02/07/2003, you wrote:
>Re. my earlier messages about Sophos sometimes missing Sobig variants in
>messages.
>
>I switched on quarantining of virus containing messages and believe I
>can now see what is going on. In fact the problem is not just limited to
>Sobig (the most common infection at present) but to Yaha.G as well and
>most probably all other viruses.
>
>It seems that Sophos will not recognise viruses, including at least
>Yaha.G and all variants of Sobig, when the message being scanned is a
>bounce/error return message which contains the whole of the original
>message, including the zipped attachment with the virus/worm in it.
>
>At this site McAfee but not Sophos recognises the virus in such a
>message.
>
>Two questions:
>
>1. Is this a problem with MailScanner's parsing of messages or with the
>A-V product it calls and to which it passes the message contents?
>
>2. How serious is it if such a message is delivered intact?
>
>I would like to understand the problem and its possible consequences a
>bit better before I forward some example messages to Sophos.
>
>Quentin
>---
>PHONE: +44 191 222 8209    Computing Service, University of Newcastle
>FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
>------------------------------------------------------------------------
>"Any opinion expressed above is mine. The University can get its own."
>
> > -----Original Message-----
> > From: Quentin Campbell [mailto:Q.G.Campbell@NEWCASTLE.AC.UK]
> > Sent: 01 July 2003 12:34
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Sobig.{E,D,EML} not found by Sophos and McAfee -
> > further info
> >
> >
> > > -----Original Message-----
> > > From: Quentin Campbell [mailto:Q.G.Campbell@newcastle.ac.uk]
> > > Sent: 01 July 2003 10:40
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: Sobig.{E,D,EML} not found by Sophos and McAfee
> > >
> > [snip]
> > > > By the way, what's Sobig.EML and ...
> > >
> > > Good question. I cannot find this virus at the NAI site yet
> > > it is McAfee that is recognising it! The notification I got says:
> > >
> > > The following e-mail messages were found to have viruses in them:
> > >
> > >     Sender: auto.reply@compuserve.com
> > > IP Address: 149.174.40.6
> > >  Recipient: xxx@newcastle.ac.uk
> > >    Subject: Undeliverable Message
> > >  MessageID: h611uKu05157
> > >     Report: /h611uKu05157/msg-32244-1482.txt        Found the
> > > W32/Sobig.eml virus !!!
> > >
> > > > ...what harm can it do in a .txt file?
> > >
> > > That is not the point unless you are suggesting that is why
> > > Sophos does not recognise it? The issue for me is why one A-V
> > > scanner finds it but another doesn't.
> >
> > The one thing all these messages have in common are that they
> > are bounce messages of one sort or another:
> >
> >  o undeliverable message
> >  o failure notice
> >  o returned mail - nameserver error ...
> >
> > It appears that they retain some sort of "signature" text,
> > probably harmless, that the McAfee scanner recognises but not
> > the Sophos scanner. Does this sound plausible?
> >
> > Note that this applies to both "Sobig.e", "Sobig.d" and
> > "Sobig.eml" (what ever that is).
> >
> > The latter suggests an alternative theory that it might be
> > MailScanner wrongly picking up a string from the McAfee
> > scanner or wrongly reporting a string that it has; that is,
> > it reports as "Sobig.eml" a string that is something else?
> >
> > I will see if I can quarantine some of these messages.
> >
> > Quentin
> > ---
> > PHONE: +44 191 222 8209    Computing Service, University of Newcastle
> > FAX:   +44 191 222 8765    Newcastle upon Tyne, United
> > Kingdom, NE1 7RU.
> > --------------------------------------------------------------
> > ----------
> > "Any opinion expressed above is mine. The University can get
> > its own."
> >
> >
> >

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From David.While at UCE.AC.UK  Wed Jul  2 12:09:12 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:18:47 2006
Subject: Bayes learning
Message-ID: <107DE25EC0216C45AEF670016024245F6EE8@exchangea.staff.uce.ac.uk>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: bayes-learn.pl
Type: application/octet-stream
Size: 1606 bytes
Desc: bayes-learn.pl
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030702/eb9f0d5c/bayes-learn.obj
From mailscanner at ecs.soton.ac.uk  Wed Jul  2 11:33:53 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:47 2006
Subject: Only 1.3 score by spamassassin
In-Reply-To: <sf02a63b.020@ahpost.ah.dk>
Message-ID: <5.2.0.9.2.20030702113147.03fde370@imap.ecs.soton.ac.uk>

Enquiries of this sort and suggestions for extra traps in SpamAssassin 
really belong on the SAtalk mailing list run by the SpamAssassin developers.

We can't really help you here, except to say that it is obviously a very 
well constructed spam message.

At 08:30 02/07/2003, you wrote:
>How did this mail only get 1.3 by spamassassin?
>
>I am using mailscanner 4.21-9 and spamassassin 2.55
>
>Jan Elmqvist Nielsen
>Received: from ns.ah.dk
>         (ns2.ah.dk [80.209.17.32])
>         by ahpost.ah.dk; Wed, 02 Jul 2003 06:23:02 +0200
>Received: from ns3.ah.dk (ns3.ah.dk [80.209.17.33])
>         by ns.ah.dk (8.11.6/8.11.6) with ESMTP id h624UiD31893
>         for <dof@sofi.ah.dk>; Wed, 2 Jul 2003 06:30:44 +0200
>Received: (from root@localhost)
>         by ns3.ah.dk (8.11.6/8.11.6) id h624YFR00858
>         for dof@sofi.ah.dk.KAV; Wed, 2 Jul 2003 06:34:15 +0200
>Received: (from root@localhost)
>         by ns3.ah.dk (8.11.6/8.11.6) id h624YEj00848
>         for dof@ah.dk.KAV; Wed, 2 Jul 2003 06:34:14 +0200
>Received: from openconnect.ch (h0010a40e4183.ne.client2.attbi.com 
>[66.31.163.55])
>         by ns3.ah.dk (8.11.6/8.11.6) with ESMTP id h624YDp00840
>         for <dof@ah.dk>; Wed, 2 Jul 2003 06:34:13 +0200
>Subject: I know all about you
>User-Agent: Mozilla/5.048 (X11; U; FreeBSD i386; U; NT4.0; en-us) 
>Gecko/25250101
>X-Accept-Language: en
>MIME-Version: 1.0
>Message-ID: <3F025DD8.0EC9CBA8@mecanica.upm.es>
>Date: Wed, 02 Jul 2003 03:21:44 -0100
>From: "Normand Noble" <noble_xn@mecanica.upm.es>
>To: dof@ah.dk
>Content-Type: text/html
>X-MailScanner-Information: Please contact the ISP for more information
>X-MailScanner: Found to be clean
>X-MailScanner-SpamCheck: ikke spam, SpamAssassin (bed?mmelse=1.3, p?kr?vet 3,
>         HTML_50_60 0.55, HTML_FONT_BIG 0.27, HTML_FONT_COLOR_RED 0.10,
>         HTML_MESSAGE 0.10, HTML_RELAYING_FRAME 0.27, MIME_HTML_ONLY 0.10,
>         USER_AGENT_MOZILLA_UA 0.00, X_ACCEPT_LANG -0.10)
>X-MailScanner-SpamScore: s
>Content-Transfer-Encoding: 8bit
>
>NEVER AGAIN BE EMBARRASSED ABOUT YOUR SIZE
>
>VPlb2mr-RX has helped over 700,000 men worldwide
>Some benefits include:
>* Gain up to 3 Full Inches in Length
>* Expand Your Pen5t669is up to 20% Thicker
>* Stop Premature Ejacuvhfi7lation!
>* Produce Stronger, Rock Hard Eretdxcrctions
>* 100% Safe To Take, With NO Side Effxgjshects
>* Fast Priority Shipping Worldwide
>* Doctor Approved and Recomoy7tymended
>* No Pumps! No Surgery! No Exnylrrercises!
>
>
><http://www.cheaponnet1.com/mka/m2c.php?man=bnkj4s>Don't wait another day, 
>More Info here!
>* 100% Money Back Guaranw725hteed
>
><http://www.cheaponnet1.com/bek/>Remove me from the list

-- 
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030702/7c92817a/attachment.html
From raymond at PROLOCATION.NET  Wed Jul  2 11:44:24 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:47 2006
Subject: Silently drop FORM tags
In-Reply-To: <3F02A47C.1070809@bangor.ac.uk>
Message-ID: <Pine.LNX.4.44.0307021243410.2109-100000@mailbox.prolocation.net>

Hi!

> Didn't think Hybris gave anything to send a warning to? Julian, what
> does MailScanner use - the entry in Sender: in the reports? If that's
> blank, does it do anything?
>
> Wasn't aware of Holar or Ganda and what's Lentin?

Lentin is a different name for Klez. I am scanning with both F-prot and
ClamAV so i need the two names ...

Bye,
Raymond.

From howard at harper-adams.ac.uk  Wed Jul  2 12:38:56 2003
From: howard at harper-adams.ac.uk (Howard Robinson)
Date: Thu Jan 12 21:18:47 2006
Subject: Re installing Spamassassin.
In-Reply-To: <5.2.0.9.2.20030411095712.0293a500@imap.ecs.soton.ac.uk>
References: <041601c30007$00714460$3900a8c0@Daniel>
Message-ID: <200307021137.h62Bbb3l005433@blackhole.harper-adams.ac.uk>

On 11 Apr 03, at 9:58, Julian Field wrote:
Hello List
I am installing SpamAssassin 2.55 using the instructions mailed to
the list some time ago (see below).
I got as far as Makefile.PL and that ran with no errors.
Its the next bit that is confusing me - the make make test make
install. What does this mean?
Is it literally running make
then make test
then make install?
If so do these commands have to be run directly after running
Makefile.PL ?

Thanks.

> rpm -e perl-Mail-SpamAssassin
> Then download the .tar.gz file
> tar xzf Mail-SpamAssassin-2.53.tar.gz
> cd Mail-SpamAssassin-2.53
> perl Makefile.PL
> Then make sure you have the pre-requisites installed (the previous command
> will warn you if you don't) make make test make install
>




Regards

Howard Robinson
(Senior Technical Development Officer)
Harper Adams University College
Edgmond
Newport
Shropshire
TF10 8NB UK

E-mail: hrobinson@harper-adams.ac.uk
Tel.  : +44(0)1952 820280 Via switchboard
      : +44(0)1952 815253 Direct line
Fax.  : +44(0)1952 814783
College Web site http://www.harper-adams.ac.uk

From Kevin.Spicer at BMRB.CO.UK  Wed Jul  2 12:44:29 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:47 2006
Subject: Re installing Spamassassin.
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6C9@pascal.priv.bmrb.co.uk>

Howard Robinson wrote:
> On 11 Apr 03, at 9:58, Julian Field wrote:
> Hello List
> I am installing SpamAssassin 2.55 using the instructions mailed to
> the list some time ago (see below).
> I got as far as Makefile.PL and that ran with no errors.
> Its the next bit that is confusing me - the make make test make
> install. What does this mean? Is it literally running make
> then make test
> then make install?

Yes and in that order






BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Jul  2 12:49:17 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:18:47 2006
Subject: MailScanner + Sophos: a serious bug?
Message-ID: <52E50E4D595DDE4D861117A1FB62E79DBFFC20@bond.ncl.ac.uk>

> -----Original Message-----
> From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
> Sent: 02 July 2003 11:30
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner + Sophos: a serious bug?
> 
> 
> Can you (in a password-protected zip) send me an example or 
> two so I can see exactly what you mean.
> 

Julian

Done. Three example messages have been sent to your
mailscanner@ecs.soton.ac.uk address. 

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 


From Denis.Beauchemin at USHERBROOKE.CA  Wed Jul  2 14:02:46 2003
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:18:47 2006
Subject: McAfee Auto Update
In-Reply-To: <1057002309.3340.10.camel@dbeauchemin.sti.usherbrooke.ca>
References: <5.2.1.1.2.20030630203049.0259aae8@imap.ecs.soton.ac.uk>
             <1057002309.3340.10.camel@dbeauchemin.sti.usherbrooke.ca>
Message-ID: <1057150966.2835.15.camel@dbeauchemin.sti.usherbrooke.ca>

I keep telling everybody that whenever my McAfee DAT files are updated I
get an email.  It is true but it is because I asked it to...

For people who would be interested, here is how I do it in root's
crontab:
# McAfee update
17,47 * * * * /usr/lib/MailScanner/mcafee-autoupdate 2>&1 | /usr/local/bin/post-cron-results "$(uname -n) : MAJ McAfee" me@USherbrooke.ca

The /usr/local/bin/post-cron-results script looks like this (I just did
a quick translation to English):
#!/bin/bash
#
# Script sending text received on stdin by email to all recipients listed
# on the command line (separated by spaces).  Subject of the message is the
# first parameter on the command line.
#
# Denis Beauchemin, le 20001011.

/bin/cat - > /tmp/poste-resultats.$$

if [[ $# -lt 2 ]]; then
        echo "Error! Wrong number of param?ters for ${0##*/}"
        echo "Use: ${0##*/} \"Subjet of the message\" destination [ destination ]"
        exit
fi

sujet="$1"
shift
if [[ -s /tmp/poste-resultats.$$ ]]; then
   /bin/mail -s "$sujet" "$*" < /tmp/poste-resultats.$$
fi

rm /tmp/poste-resultats.$$

Basically, this script (which works just fine on all my Red Hat boxes)
won't send you any email if the command feeding it input doesn't produce
any.  Useful in cron files because you otherwise always get an email (or
never get any if you redirect everything in /dev/null).

So it looks like I am still paranoid and am still looking for updates
twice every hour! ;-)

Denis

Le lun 30/06/2003 ? 15:45, Denis Beauchemin a ?crit :
> Wouldn't it be risky to not update as soon as an updated DAT file is
> released?
> 
> Maybe I'm paranoid but before your cron.hourly script I used to call my
> own autoupdate script every 30 minutes!
> 
> Denis
> 
> Le lun 30/06/2003 ? 15:31, Julian Field a ?crit :
> > Wouldn't it just be easier to move update_virus_scanners from the
> > cron.hourly directory to the cron.daily directory?
> > 
> > At 20:24 30/06/2003, you wrote:
> > >Hello Julian,
> > >
> > >I have MailScanner installed on may Linux working with McAfee only.
> > >
> > >To avoid auto-update to run every hour, i've disable the script
> > >update_virus_scanners on my cron.hourly and create a call to
> > >mcafee-autoupdate script on may crontab file to run every day at 01:00am.
> > >I've been checked every day and there seems to be no problem on the
> > >mcafee-autoupdate script.
> > >I just want to confirm if you see any problem with that configuration.
> > >
> > >Thanks.
> > >
> > >
> > >
> > >Rodrigo Scarano
> > >Target Sistemas
> > >http://www.targetsis.com.br/
> > >rscarano@targetsis.com.br
> > 
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support
-- 
Denis Beauchemin, analyste
Universit?de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045


From dot at DOTAT.AT  Wed Jul  2 14:24:13 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:18:47 2006
Subject: RES: McAfee Auto Update
In-Reply-To: <m2n.19X5F2-000xWA@chiark.greenend.org.uk>
References: <5.2.1.1.2.20030630203049.0259aae8@imap.ecs.soton.ac.uk>
            <006801c33f42$01280fe0$6900000a@targetsis.com.br>
Message-ID: <E19Xhan-0005IA-00@chiark.greenend.org.uk>

Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>
>The update_virus_scanners script bins all the output as not many people
>want a mail message from cron every hour of every day. It's a fairly simple
>script, so you can always edit it and remove the redirection to /dev/null
>if you like.

The alternate mcafee autoupdate script is silent when it finds out that
no dat file update is needed, otherwise it produces informative output
(or an error message). So if you run it from cron you'll only be emailed
when something interesting happens.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
DOGGER: NORTH OR NORTHWEST 5 TO 7 DECREASING 4 OR 5. RAIN AT TIMES. MODERATE
OR GOOD.

From gerry at dorfam.ca  Wed Jul  2 15:13:48 2003
From: gerry at dorfam.ca (Gerry Doris)
Date: Thu Jan 12 21:18:47 2006
Subject: Mail Delivery Hung
Message-ID: <17834.129.80.22.133.1057155228.squirrel@tiger.dorfam.ca>

Yesterday about 7:00am EST all mail delivery hung.  The mail was being
saved to mqueue.in but not moved out.  I restarted MailScanner serveral
times but that didn't fix it.  When restarted the logs would say that
MailScanner had found 320 messages waiting and was starting to scan
them...then nothing.

I finally just rebooted the system.  That fixed it.  This same thing
happened about 10 days ago.  I've checked all the logs but haven't noticed
anything out of the ordinary.

I thought I noticed comments about checks for ClamAV updates sometimes
hanging the delivery process???  Could this be the cause?  I have both
F-Prot and ClamAV installed.


Gerry

From mailscanner at BARENDSE.TO  Wed Jul  2 15:14:32 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:48 2006
Subject: DSN: Return receipt ??
Message-ID: <Pine.LNX.4.44.0307021559180.18949-100000@raveon.barendse.to>

I noticed something strange, I use the archive feature to archive all
incoming and outgoing e-mail.

In the maillog I noticed a remark about a DSN: Return receipt.

What does the line from maillog mean? Any return receipt did not appear in
the mailbox for archived outgoing mail.

I use sendmail rules to discard read receipt messages but in this case
there is nothing in the maillog that this message or reply was discarded.


Jul  2 15:34:56 linuxgw sendmail[12278]: h62DYuBB012278:
from=<xxx@xxx.nl>, size=14109, class=0, nrcpts=1,
msgid=<0D563AFDB4B9354E90B235773067ADB009BD1B@meidc01.xxx.local>,
proto=ESMTP, daemon=MTA, relay=xxxx [10.1.0.20]
BJul  2 15:34:58 linuxgw sendmail[12285]: h62DYuBB012278: to=jorge,
delay=00:00:02, xdelay=00:00:00, mailer=local, pri=121417, dsn=2.0.0,
stat=Sent
Jul  2 15:34:58 linuxgw sendmail[12285]: h62DYuBB012278: h62DYwMP012285:
DSN: Return receipt

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 14:53:15 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: RES: McAfee Auto Update
In-Reply-To: <E19Xhan-0005IA-00@chiark.greenend.org.uk>
References: <m2n.19X5F2-000xWA@chiark.greenend.org.uk>
            <5.2.1.1.2.20030630203049.0259aae8@imap.ecs.soton.ac.uk>
            <006801c33f42$01280fe0$6900000a@targetsis.com.br>
Message-ID: <5.2.0.9.2.20030702145235.04531fa0@imap.ecs.soton.ac.uk>

At 14:24 02/07/2003, you wrote:
>Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
> >
> >The update_virus_scanners script bins all the output as not many people
> >want a mail message from cron every hour of every day. It's a fairly simple
> >script, so you can always edit it and remove the redirection to /dev/null
> >if you like.
>
>The alternate mcafee autoupdate script is silent when it finds out that
>no dat file update is needed, otherwise it produces informative output
>(or an error message). So if you run it from cron you'll only be emailed
>when something interesting happens.

Note that Tony's "alternate" script is now the standard one you get in the
distribution. It was much cleverer than mine, so I dropped my version.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From Denis.Beauchemin at USHERBROOKE.CA  Wed Jul  2 15:25:13 2003
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:18:48 2006
Subject: Quick translation request - French
In-Reply-To: <g2b2gv0d1ko5oa9jtutna45jdf3bum5rcg@tradoc.fr>
References: <5.2.1.1.2.20030630215510.02533e60@imap.ecs.soton.ac.uk>
            <g2b2gv0d1ko5oa9jtutna45jdf3bum5rcg@tradoc.fr>
Message-ID: <1057155913.2835.20.camel@dbeauchemin.sti.usherbrooke.ca>

Julian,

I guess not only Brazilians disagree on translations... 8-)

I would rather say:
Taille du message trop grande

I know it must be too late for the current release but yesterday was our
national Holiday and I only read your request this morning.

Denis
Le mar 01/07/2003 ? 02:38, John Wilcock a ?crit :
> On Mon, 30 Jun 2003 21:55:50 +0100, Julian Field wrote:
> > For the max-message-size checking, I need this translating into as many
> > languages as possible:
> > 
> >         Message is too large
> 
> Taille de message trop grand. 
> 
> John.
-- 
Denis Beauchemin, analyste
Universit?de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045


From jim at ENTROPHY-FREE.NET  Wed Jul  2 15:13:11 2003
From: jim at ENTROPHY-FREE.NET (Jim Levie)
Date: Thu Jan 12 21:18:48 2006
Subject: Sobig.{E,D,EML} not found by Sophos and McAfee
In-Reply-To: <3F02A4DD.3090504@bangor.ac.uk>
References: <52E50E4D595DDE4D861117A1FB62E79D82089E@bond.ncl.ac.uk>
            <1057079365.4524.6.camel@wilowisp.dynetics.com>
            <3F02A4DD.3090504@bangor.ac.uk>
Message-ID: <1057155191.30546.5.camel@chaos.entrophy-free.net>

On Wed, 2003-07-02 at 04:24, Martin Sapsed wrote:
> Jim Levie wrote:
> > I'm seeing something similar in that Sophos with the latest IDE's isn't
> > catching some variants of SoBig that arrived over the weekend and this
> > morning. McAfee is detecting them, so far. The virus isn't reaching my
> > users, at least currently, because they are all in a disguised zip file
> > and I have a filename rule that disallows '.zi'.
>
> Have you quarantined any and if so, have you sent them to Sophos for
> analysis?
>
Yes I have sent them to Sophos.
--
The instructions said to use Windows 98 or better, so I installed
RedHat.

From jim at ENTROPHY-FREE.NET  Wed Jul  2 15:12:26 2003
From: jim at ENTROPHY-FREE.NET (Jim Levie)
Date: Thu Jan 12 21:18:48 2006
Subject: MailScanner + Sophos: a serious bug?
In-Reply-To: <52E50E4D595DDE4D861117A1FB62E79DBFFBD0@bond.ncl.ac.uk>
References: <52E50E4D595DDE4D861117A1FB62E79DBFFBD0@bond.ncl.ac.uk>
Message-ID: <1057155146.30546.3.camel@chaos.entrophy-free.net>

On Wed, 2003-07-02 at 03:58, Quentin Campbell wrote:
> Re. my earlier messages about Sophos sometimes missing Sobig variants in
> messages.
>
> I switched on quarantining of virus containing messages and believe I
> can now see what is going on. In fact the problem is not just limited to
> Sobig (the most common infection at present) but to Yaha.G as well and
> most probably all other viruses.
>
> It seems that Sophos will not recognise viruses, including at least
> Yaha.G and all variants of Sobig, when the message being scanned is a
> bounce/error return message which contains the whole of the original
> message, including the zipped attachment with the virus/worm in it.
>
> At this site McAfee but not Sophos recognises the virus in such a
> message.
>
Have you tried scanning the zip file or its contents with Sophos? I'm
finding that Sophos, with the latest IDE's, isn't detecting the virus
when scanning the zip file or the pif file that contains Sobig.
--
The instructions said to use Windows 98 or better, so I installed
RedHat.

From andersan at LTKALMAR.SE  Wed Jul  2 15:27:04 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:48 2006
Subject: OT: RH9 updated perl-TimeDate.....
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE63D@lkl63.ltkalmar.se>

HI
probably not something to wurry about but how will mailscanner handle
updates from RH. Guess I could exclude perl* in config but thought that
someone prolly could tell me what to do or just not wurry
Up2date upgraded perl-TimeDate to 1.1301-5

/Anders

From m.sapsed at BANGOR.AC.UK  Wed Jul  2 16:19:02 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-4 released
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <3F02F7E6.1000003@bangor.ac.uk>

Julian Field wrote:
> G'day!
>
> I have just posted the new stable release 4.22-4 on the website.

Somewhere between 4.14 and the new version the report of viruses found
by Sophos changed from stuff like

Report: >>> Virus 'W32/Yaha-E' found in file
./h62FAd4X004564/goldfish.gif.pif

to stuff like

Adroddiad/Report: q216309.exe was infected by W32/Gibe-A

Can someone remind me why this was please? (Means I've got to hack my
script that works out my stats! :-( )

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From steve.freegard at LBSLTD.CO.UK  Wed Jul  2 16:29:20 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-4 released
Message-ID: <67D9E7698329D411936E00508B6590B9027739E0@neelix.lbsltd.co.uk>

Martin,

Have you switched to Sophos-SAVI?? - if so, the output is different.

Regards,
Steve

-----Original Message-----
From: Martin Sapsed [mailto:m.sapsed@BANGOR.AC.UK]
Sent: 02 July 2003 16:19
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: ANNOUNCE: Version 4.22-4 released


Julian Field wrote:
> G'day!
>
> I have just posted the new stable release 4.22-4 on the website.

Somewhere between 4.14 and the new version the report of viruses found by
Sophos changed from stuff like

Report: >>> Virus 'W32/Yaha-E' found in file
./h62FAd4X004564/goldfish.gif.pif

to stuff like

Adroddiad/Report: q216309.exe was infected by W32/Gibe-A

Can someone remind me why this was please? (Means I've got to hack my script
that works out my stats! :-( )

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From Antony at SOFT-SOLUTIONS.CO.UK  Wed Jul  2 16:33:22 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:48 2006
Subject: Silent viruses are silent in logs as well?
Message-ID: <200307021534.h62FYTf14221@Beryl.Rockstone.co.uk>

Hi all (and Julian in particular :)  )

Looking through my syslog files today I found something I think is strange,
and I'm not sure whether it qualifies as a bug or a feature of MailScanner :)

I use Clam (+ others) for antivirus scanning, and it says "FOUND" whenever a
virus is detected.

I grepped my syslog messages file for "FOUND" and got 27 entries for today.

Then I grepped for the MailScanner message "Virus Scanning: Found" and got 2
responses (both found only 1 virus).

It turns out the 2 occurrences of "Virus Scanning: Found 1 viruses" were for
viruses which aren't in my "Silent" list - all the other Clam messages were
for Sobig, which is listed as silent.

Is it correct that a silent virus isn't even reported as Found in the syslogs?

I think I'd prefer it if my syslogs told me everything my server had found,
even if it doesn't try to bounce back to the (false) sender...

Regards,

Antony.

--

Perfection in design is achieved not when there is nothing left to add,
but rather when there is nothing left to take away.

 - Antoine de Saint-Exupery

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 16:10:03 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: OT: RH9 updated perl-TimeDate.....
In-Reply-To: <9F18B7DDBA88E544AB1F1995148916661CE63D@lkl63.ltkalmar.se>
Message-ID: <5.2.0.9.2.20030702160932.0416dc58@imap.ecs.soton.ac.uk>

I haven't come across any nasty happening there except for the glibc
upgrade a couple of months ago which stopped various bits of the init.d
script from shutting down the processes properly.

At 15:27 02/07/2003, you wrote:
>HI
>probably not something to wurry about but how will mailscanner handle
>updates from RH. Guess I could exclude perl* in config but thought that
>someone prolly could tell me what to do or just not wurry
>Up2date upgraded perl-TimeDate to 1.1301-5
>
>/Anders

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 16:36:02 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <3F02F7E6.1000003@bangor.ac.uk>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030702163456.063864d8@imap.ecs.soton.ac.uk>

At 16:19 02/07/2003, you wrote:
>Julian Field wrote:
>>G'day!
>>
>>I have just posted the new stable release 4.22-4 on the website.
>
>Somewhere between 4.14 and the new version the report of viruses found
>by Sophos changed from stuff like
>
>Report: >>> Virus 'W32/Yaha-E' found in file
>./h62FAd4X004564/goldfish.gif.pif
>
>to stuff like
>
>Adroddiad/Report: q216309.exe was infected by W32/Gibe-A
>
>Can someone remind me why this was please? (Means I've got to hack my
>script that works out my stats! :-( )

Are you using sophossavi instead of sophos now? In which case, it's
effectively a different scanner.
I wrote the output format of sophossavi to be as simple as possible and
easy to understand.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From raymond at PROLOCATION.NET  Wed Jul  2 16:39:33 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:48 2006
Subject: Silent viruses are silent in logs as well?
In-Reply-To: <200307021534.h62FYTf14221@Beryl.Rockstone.co.uk>
Message-ID: <Pine.LNX.4.44.0307021738370.17512-100000@mailbox.prolocation.net>

Hi!

> Is it correct that a silent virus isn't even reported as Found in the syslogs?
>
> I think I'd prefer it if my syslogs told me everything my server had found,
> even if it doesn't try to bounce back to the (false) sender...

I have this:

Jul  2 17:37:49 vmx10 MailScanner[12118]:
/var/spool/MailScanner/incoming/12118/h62FbA90013905/your_details.zip->details.pif
 Infection: W32/Sobig.E@mm
Jul  2 17:37:49 vmx10 MailScanner[12118]: Virus Scanning: F-Prot found
virus W32/Sobig.E@mm

And as you know, i posted my silent list yesterday, this is in my silent
list also. So no, i dont think its not reporting those. In my case it
certainly is....

Bye,
Raymond.

From andersan at LTKALMAR.SE  Wed Jul  2 16:44:03 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:48 2006
Subject: SV: OT: RH9 updated perl-TimeDate.....
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE63F@lkl63.ltkalmar.se>

> -----Ursprungligt meddelande-----
> Fr?n: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
> I haven't come across any nasty happening there except for 
> the glibc upgrade a couple of months ago which stopped 
> various bits of the init.d script from shutting down the 
> processes properly.

Oki, I wont bother unless anything brakes then  :)

> 
> At 15:27 02/07/2003, you wrote:
> >HI
> >probably not something to wurry about but how will 
> mailscanner handle 
> >updates from RH. Guess I could exclude perl* in config but 
> thought that 
> >someone prolly could tell me what to do or just not wurry Up2date 
> >upgraded perl-TimeDate to 1.1301-5
> >
> >/Anders
> 
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> 


From Antony at SOFT-SOLUTIONS.CO.UK  Wed Jul  2 16:47:23 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:48 2006
Subject: Silent viruses are silent in logs as well?
In-Reply-To: <Pine.LNX.4.44.0307021738370.17512-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307021738370.17512-100000@mailbox.prolocation.net>
Message-ID: <200307021548.h62FmVf16169@Beryl.Rockstone.co.uk>

On Wednesday 02 July 2003 4:39 pm, Raymond Dijkxhoorn wrote:

> Hi!
>
> > Is it correct that a silent virus isn't even reported as Found in the
> > syslogs?
> >
> > I think I'd prefer it if my syslogs told me everything my server had
> > found, even if it doesn't try to bounce back to the (false) sender...
>
> I have this:
>
> Jul  2 17:37:49 vmx10 MailScanner[12118]:
> /var/spool/MailScanner/incoming/12118/h62FbA90013905/your_details.zip->deta
>ils.pif Infection: W32/Sobig.E@mm
> Jul  2 17:37:49 vmx10 MailScanner[12118]: Virus Scanning: F-Prot found
> virus W32/Sobig.E@mm
>
> And as you know, i posted my silent list yesterday, this is in my silent
> list also. So no, i dont think its not reporting those. In my case it
> certainly is....

Well, almost...

I think if you look for a virus which isn't on your silent list, you will
*also* find in the syslog file an entry, after all the antivirus engines have
said they found something, saying:

Virus Scanning: Found 1 viruses

The reason I'm interested in this is that this message only appears once for
each mail which is scanned and found to contain a virus - the others (naming
the particular antivirus engine which identified the infection) can appear
multiple times per message, depending on how many antivirus engines you use,
and also vary a bit in syntax between the different engines.

I'm trying to get a consistent way to track the effectiveness of the
antivirus checking system, which will work across several servers which use
different vendors' antivirus engines (but which all use MailScanner).

Antony.

--

How I want a drink, alcoholic of course, after the heavy chapters
involving quantum mechanics.

 - 3.14159265358979

From sw at INTERNETX.DE  Wed Jul  2 16:38:04 2003
From: sw at INTERNETX.DE (Sebastian Wiesinger)
Date: Thu Jan 12 21:18:48 2006
Subject: DSN: Return receipt ??
In-Reply-To: <Pine.LNX.4.44.0307021559180.18949-100000@raveon.barendse.to>
References: <Pine.LNX.4.44.0307021559180.18949-100000@raveon.barendse.to>
Message-ID: <20030702153804.GA15524@internetx.de>

* Remco Barendse <mailscanner@BARENDSE.TO> [2003-07-02 16:15]:
> In the maillog I noticed a remark about a DSN: Return receipt.
>
> What does the line from maillog mean? Any return receipt did not appear in
> the mailbox for archived outgoing mail.

If a user adds a "Return-Receipt-To: <mail@address>" header to his/her
mail, sendmail will deliver an receipt upon successful delivery of the
mail. You can deactivate this feature with the following option in
your sendmail.mc:

define(`confPRIVACY_FLAGS', `noreceipts')dnl

>From the sendmail operation guide:
#v+
public         Allow open access
needmailhelo   Insist on HELO or EHLO command before MAIL
needexpnhelo   Insist on HELO or EHLO command before EXPN
noexpn         Disallow EXPN entirely, implies noverb.
needvrfyhelo   Insist on HELO or EHLO command before VRFY
novrfy         Disallow VRFY entirely
noetrn         Disallow ETRN entirely
noverb         Disallow VERB entirely
restrictmailq  Restrict mailq command
restrictqrun   Restrict -q command line flag
restrictexpand Restrict -bv and -v command line flags
noreceipts     Don't return success DSNs20
nobodyreturn   Don't return the body of a message with DSNs
goaway         Disallow essentially all SMTP status queries
authwarnings   Put X-Authentication-Warning: headers in messages
               and log warnings
#v-

I prefer the following line:

define(`confPRIVACY_FLAGS', `goaway,noreceipts,restrictqrun,restrictexpand')dnl

> I use sendmail rules to discard read receipt messages but in this case
> there is nothing in the maillog that this message or reply was discarded.

I don't know what rules you use for discarding, but the configuration
option above is the right way to deactivate the DSN2.x.x messages.

For more info about the privacy options, see the sendmail installation
and operation guide (op/op.txt.gz).

--
InterNetX GmbH
Sebastian Wiesinger
System Administration

eMail: sw@internetx.de

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 17:27:00 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: Silent viruses are silent in logs as well?
In-Reply-To: <200307021548.h62FmVf16169@Beryl.Rockstone.co.uk>
References: <Pine.LNX.4.44.0307021738370.17512-100000@mailbox.prolocation.net>
            <Pine.LNX.4.44.0307021738370.17512-100000@mailbox.prolocation.net>
Message-ID: <5.2.0.9.2.20030702172611.03ffb2f8@imap.ecs.soton.ac.uk>

At 16:47 02/07/2003, you wrote:
>I'm trying to get a consistent way to track the effectiveness of the
>antivirus checking system, which will work across several servers which use
>different vendors' antivirus engines (but which all use MailScanner).

Look for the syslog entries that are actually the output from each virus
scanner. They are usually easy to find. Don't rely on any other stats, the
actual virus scanner reports will tell you everything that it finds.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From jase at SENSIS.COM  Wed Jul  2 17:31:34 2003
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:18:48 2006
Subject: SpamAssassin -D??
Message-ID: <ADF6087CA978A4418AF7F76DDCF2F7210275721B@europa.ats.sensis.com>

I think you need to use sample-spam.txt as input with a "<" like this:

spamassassin -D < /usr/share/doc/spamassassin-2.55/sample-spam.txt

Jason

> -----Original Message-----
> From: Remco Barendse [mailto:mailscanner@BARENDSE.TO]
> Sent: Wednesday, July 02, 2003 4:32 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: [MAILSCANNER] SpamAssassin -D??
>
>
> I would like to see why DCC isn't working with SpamAssassin so I tried
> running it in debug mode.
>
> I tried :
> spamassassin -D /usr/share/doc/spamassassin-2.55/sample-spam.txt
>
>
> which just makes spamassassin to hang forever and display no output
> whatsoever. This is a RedHat 8.0 box with SpamAssassin 2.55-2
>
> Ideas anyone?
>
> Thanks!
> Remco
>

From Antony at SOFT-SOLUTIONS.CO.UK  Wed Jul  2 17:40:14 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:48 2006
Subject: Silent viruses are silent in logs as well?
In-Reply-To: <5.2.0.9.2.20030702172611.03ffb2f8@imap.ecs.soton.ac.uk>
References: <Pine.LNX.4.44.0307021738370.17512-100000@mailbox.prolocation.net>
            <5.2.0.9.2.20030702172611.03ffb2f8@imap.ecs.soton.ac.uk>
Message-ID: <200307021641.h62GfMf23116@Beryl.Rockstone.co.uk>

On Wednesday 02 July 2003 5:27 pm, Julian Field wrote:

> At 16:47 02/07/2003, you wrote:
> >I'm trying to get a consistent way to track the effectiveness of the
> >antivirus checking system, which will work across several servers which
> > use different vendors' antivirus engines (but which all use MailScanner).
>
> Look for the syslog entries that are actually the output from each virus
> scanner. They are usually easy to find. Don't rely on any other stats, the
> actual virus scanner reports will tell you everything that it finds.

Unfortunately that means a variable number of reports per infected email (eg
one virus might be picked up by one antivirus engine, another might be picked
up by another, or by both, etc).   This makes it difficult to get a reliable
number of "how many emails containing viruses did we block today?"

Just out of interest, have I made an accurate diagnosis that viruses which
are not on the Silent list will result in the "Virus Scanning: Found n
viruses", and viruses which are on the list will not, or is the rule more
complicated than this?

Antony.

--

In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac

From m.sapsed at BANGOR.AC.UK  Wed Jul  2 18:02:26 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-4 released
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
            <5.2.0.9.2.20030702163456.063864d8@imap.ecs.soton.ac.uk>
Message-ID: <3F031022.2090909@bangor.ac.uk>

Julian Field wrote:
> At 16:19 02/07/2003, you wrote:
>> Somewhere between 4.14 and the new version the report of viruses found
>> by Sophos changed from stuff like
>>
>> Report: >>> Virus 'W32/Yaha-E' found in file
>> ./h62FAd4X004564/goldfish.gif.pif
>>
>> to stuff like
>>
>> Adroddiad/Report: q216309.exe was infected by W32/Gibe-A
>>
>> Can someone remind me why this was please? (Means I've got to hack my
>> script that works out my stats! :-( )
>
> Are you using sophossavi instead of sophos now? In which case, it's
> effectively a different scanner.
> I wrote the output format of sophossavi to be as simple as possible and
> easy to understand.

DOH! Thanks to Steve F and Julian (Steve first with a reply by a short
head!)

I am using sophossavi on the box I test things out on but still using
ordinary Sophos on the production mail hubs, from which I get most of
the reports.

Is the concensus still that SophosSAVI is sound (on Solaris) and worth
switching to?

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From nicholas_esborn at AFFYMETRIX.COM  Wed Jul  2 18:07:44 2003
From: nicholas_esborn at AFFYMETRIX.COM (Nicholas Esborn)
Date: Thu Jan 12 21:18:48 2006
Subject: Collection of all MailScanner contrib software?
Message-ID: <20030702170744.GA1587@affymetrix.com>

Hello,

I was wondering if there was any definitive location to find all the
various contributed monitoring and log analysis tools?  I looked on
the MailScanner page, but only found mailscanner-mrtg.

Thanks

-nick

-- 
Nicholas Esborn
Affymetrix, Inc.

510/428.8505

Every message PGP signed

Include the word URGENT in your Subject to page me
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030702/a39a3282/attachment.bin
From dh at UPTIME.AT  Wed Jul  2 18:11:52 2003
From: dh at UPTIME.AT (David)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <3F031022.2090909@bangor.ac.uk>
Message-ID: <467569AB-ACB0-11D7-94B4-000393920D6C@uptime.at>


On Mittwoch, Juli 2, 2003, at 07:02  Uhr, Martin Sapsed wrote:
> <snip>
> I am using sophossavi on the box I test things out on but still using
> ordinary Sophos on the production mail hubs, from which I get most of
> the reports.
>
> Is the concensus still that SophosSAVI is sound (on Solaris) and worth
> switching to?
>
Well I can only speak for Alphas + Linux. Then it sometimes bombs out 
and shows rather weird behaviour. I have not had time yet to track it 
down ;)

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCC d+ s: a-- C+ UB++++ P+ L++ E--- W N+ o+++ K w--
O M+ V++ PS PE Y++ PGP++++ t+ 5 X- R+ tv-- b++++ DI D+
G e++++ h+ r++ y++
------END GEEK CODE BLOCK------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030702/9d011430/PGP.bin
From nwp at LEMON-COMPUTING.COM  Wed Jul  2 12:23:51 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:18:48 2006
Subject: Long delay in sending mail
In-Reply-To: <CFE2AF2B1DB7D4118E9B00508B440852045CE5A1@inphna-mal2-dc.inphact.com>
References: <CFE2AF2B1DB7D4118E9B00508B440852045CE5A1@inphna-mal2-dc.inphact.com>
Message-ID: <20030702112351.GJ29971@hoiho.nz.lemon-computing.com>

On Tue, Jul 01, 2003 at 12:45:23PM -0500, rgrignon@INPHACT.COM wrote:
> I've noticed that the delays consistently happen between the top of the hour
> and last for 15minutes other than that the mail is delivered in realtime...

Hmmm... if you change the update cron job to run at quarter past the hour,
does the delay move with it?

15 minutes sounds like about the right amount of time for a TCP connection
to time out. If that's happening during the update, mailscanner will not
be processing for 15 minutes while the update is waiting to time out.


Cheers,


Nick
--
Nick Phillips -- nwp@lemon-computing.com
What happened last night can happen again.

From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Jul  2 18:16:16 2003
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-4 released
Message-ID: <B9D9BD71E387E24AB1D619FE4B748CC703CA3A@ERWIN.intern.seceidos.de>

 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Marco,

> Is there an easy way to upgrade MailScanner on FreeBSD?

I hope I will have the new port ready tomorrow evening. The port will
use Julians config-file upgrade-script automaticall.

Regards,
  JP

PS: I have no clue how long it will take the FreeBSD port maintainers
to commit the port. It will be downloadable at the usual place
though. 

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2

iQA/AwUBPwMTVcljry2L+pqYEQLcMwCfSuNQxByoxVdFnZ2UCzlG6rZ46gsAoNv6
OYtoFdGSJvYjUlZlGUkdXKck
=wEEp
-----END PGP SIGNATURE-----


From mailscanner at BARENDSE.TO  Wed Jul  2 18:35:05 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:48 2006
Subject: DSN: Return receipt ??
In-Reply-To: <20030702153804.GA15524@internetx.de>
Message-ID: <Pine.LNX.4.44.0307021930490.18949-100000@raveon.barendse.to>

This is great, this is what I've been looking for for a long time :) :)

Will this also block the read/not read messages?

The problem I had was that I'm using Exchange as the mail server, this
linux box is only relaying mail to/from the internet <-> exchange server.

Will the sendmail setting also work in this case where M$ Exchange is
gererating these annoying status messages that can't be disabled?

On Wed, 2 Jul 2003, Sebastian Wiesinger wrote:

> * Remco Barendse <mailscanner@BARENDSE.TO> [2003-07-02 16:15]:
> > In the maillog I noticed a remark about a DSN: Return receipt.
> >
> > What does the line from maillog mean? Any return receipt did not appear in
> > the mailbox for archived outgoing mail.
>
> If a user adds a "Return-Receipt-To: <mail@address>" header to his/her
> mail, sendmail will deliver an receipt upon successful delivery of the
> mail. You can deactivate this feature with the following option in
> your sendmail.mc:
>
> define(`confPRIVACY_FLAGS', `noreceipts')dnl
>
> >From the sendmail operation guide:
> #v+
> public         Allow open access
> needmailhelo   Insist on HELO or EHLO command before MAIL
> needexpnhelo   Insist on HELO or EHLO command before EXPN
> noexpn         Disallow EXPN entirely, implies noverb.
> needvrfyhelo   Insist on HELO or EHLO command before VRFY
> novrfy         Disallow VRFY entirely
> noetrn         Disallow ETRN entirely
> noverb         Disallow VERB entirely
> restrictmailq  Restrict mailq command
> restrictqrun   Restrict -q command line flag
> restrictexpand Restrict -bv and -v command line flags
> noreceipts     Don't return success DSNs20
> nobodyreturn   Don't return the body of a message with DSNs
> goaway         Disallow essentially all SMTP status queries
> authwarnings   Put X-Authentication-Warning: headers in messages
>                and log warnings
> #v-
>
> I prefer the following line:
>
> define(`confPRIVACY_FLAGS', `goaway,noreceipts,restrictqrun,restrictexpand')dnl
>
> > I use sendmail rules to discard read receipt messages but in this case
> > there is nothing in the maillog that this message or reply was discarded.
>
> I don't know what rules you use for discarding, but the configuration
> option above is the right way to deactivate the DSN2.x.x messages.
>
> For more info about the privacy options, see the sendmail installation
> and operation guide (op/op.txt.gz).
>
> --
> InterNetX GmbH
> Sebastian Wiesinger
> System Administration
>
> eMail: sw@internetx.de
>

From mailscanner at ecs.soton.ac.uk  Wed Jul  2 19:19:16 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: Collection of all MailScanner contrib software?
In-Reply-To: <20030702170744.GA1587@affymetrix.com>
Message-ID: <5.2.1.1.2.20030702191810.02402cc0@imap.ecs.soton.ac.uk>

If everyone who has developed or is developing contrib software for it
contacts me with a brief description and a link, I will build a web page
listing them all.

At 18:07 02/07/2003, you wrote:
>Hello,
>
>I was wondering if there was any definitive location to find all the
>various contributed monitoring and log analysis tools?  I looked on
>the MailScanner page, but only found mailscanner-mrtg.
>
>Thanks
>
>-nick
>
>--
>Nicholas Esborn
>Affymetrix, Inc.
>
>510/428.8505
>
>Every message PGP signed
>
>Include the word URGENT in your Subject to page me

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at BARENDSE.TO  Wed Jul  2 19:38:30 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:48 2006
Subject: SpamAssassin -D??
In-Reply-To: <ADF6087CA978A4418AF7F76DDCF2F7210275721B@europa.ats.sensis.com>
Message-ID: <Pine.LNX.4.44.0307022037360.18949-100000@raveon.barendse.to>

Oops! That's a *VERY* dumb mistake I made, thanks for your input :)

Works like a charm now.

On Wed, 2 Jul 2003, Desai, Jason wrote:

> I think you need to use sample-spam.txt as input with a "<" like this:
>
> spamassassin -D < /usr/share/doc/spamassassin-2.55/sample-spam.txt
>
> Jason
>
> > -----Original Message-----
> > From: Remco Barendse [mailto:mailscanner@BARENDSE.TO]
> > Sent: Wednesday, July 02, 2003 4:32 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: [MAILSCANNER] SpamAssassin -D??
> >
> >
> > I would like to see why DCC isn't working with SpamAssassin so I tried
> > running it in debug mode.
> >
> > I tried :
> > spamassassin -D /usr/share/doc/spamassassin-2.55/sample-spam.txt
> >
> >
> > which just makes spamassassin to hang forever and display no output
> > whatsoever. This is a RedHat 8.0 box with SpamAssassin 2.55-2
> >
> > Ideas anyone?
> >
> > Thanks!
> > Remco
> >
>

From mbowman at UDCOM.COM  Wed Jul  2 19:38:19 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:48 2006
Subject: Error in maillog after upgrade
Message-ID: <OFD72E98C9.9038E961-ON85256D57.0066453C-85256D57.006699FA@udcomm.net>

Hello

Just upgraded MailScanner to 4.22-4 and SpamAssassin to 2.55 on a RH 7.3
box

My /var/log/maillog reports

Jul  2 14:35:35 smithers MailScanner[28385]: Looked up unknown string
spamassassin in language translation file
/etc/MailScanner/reports/en/languages.conf

Any ideas why?

Thanks

---
Matthew K Bowman Systems Administrator, UDCom

From dot at DOTAT.AT  Wed Jul  2 19:32:30 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:18:48 2006
Subject: mcafee-autoupdate patch -- Tony Finch r-u-there?
In-Reply-To: <m2n.19XQCd-000tDh@chiark.greenend.org.uk>
Message-ID: <E19XmP8-0002dD-00@chiark.greenend.org.uk>

Mariano Absatz <mailscanner@LISTS.COM.AR> wrote:
>
>Tony, would you care to incorporate it (or suggest a modification, maybe
>another different command line option)?

I wasn't particularly keen on the feature since it can be implemented
with a trivial shell script -- you could even fit it in the crontab
itself. But anyway, I was bored this afternoon, so I did some polishing
of my script...

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
FAIR ISLE FAEROES: NORTHERLY 4 OR 5, OCCASIONALLY 6 IN EAST FAIR ISLE.
OCCASIONAL DRIZZLE. MODERATE OR GOOD.


#!/bin/sh -e
#
# Update the McAfee data files.
#
# $Cambridge: hermes/build/bin/uvscan-update,v 1.24 2003/07/02 18:25:47 fanf2 Exp $

# This is the directory where the uvscan binary is (NOT a symlink to
# the binary), which is where it looks for its dat files. You may run
# uvscan via a symlink to this place (e.g. from /usr/local/bin/uvscan)
# and it will still look for the dat files here. If uvscan's library
# dependencies can be found in a standard place (e.g. /usr/local/lib)
# then you don't need a wrapper script to set LD_LIBRARY_PATH before
# running it.
#
# The dat files are installed in a subdirectory named according to
# their version number, with symlinks from this directory into the
# subdirectory. The links are updated without locking on the
# assumption that this is sufficiently unlikely to cause a problem.
#
LIBDIR=/opt/uvscan

FTPDIR=ftp://ftp.csx.cam.ac.uk/pub/software/antivirus/datfiles/4.x
#FTPDIR=ftp://ftpeur.nai.com/pub/antivirus/datfiles/4.x

# ensure the path is plausible
PATH=$LIBDIR:/usr/local/bin:/usr/bin:/bin
export PATH

# handle the command line
OPTS="$*"
option () {
        case $OPTS in
        -*$1*)  eval $2=yes
        esac
}
case $OPTS in
[!-]*|*[!-frtv]*)
        echo "usage: $0 [-frtv]"
        echo "  -f      force update"
        echo "  -r      show README"
        echo "  -t      timestamp output"
        echo "  -v      verbose"
        exit 1
        ;;
esac
option f FORCE
option r README
option t TIME
option v VERBOSE
case $FORCE in
yes)    VERBOSE=yes
esac

# wrapper functions for echo etc.
timestamp () {
        case $TIME in
        yes)    date "+%Y-%m-%d %H:%M:%S "
        esac
}
say () {
        case $VERBOSE in
        yes)    echo "`timestamp`$*"
        esac
}
run () {
        say "> $*"
        "$@"
}
say Starting $0

# version number pattern
MATCH="[0-9][0-9][0-9][0-9]"

# work out latest dat version
cd $LIBDIR
CMD="wget --passive-ftp $FTPDIR/update.ini 2>update.err"
say "> $CMD"
if eval "$CMD"
then
        VERSION=`cat update.ini | sed "/^DATVersion=\($MATCH\).$/!d;s//\1/;q"`
else
        cat update.err
        VERSION=UNKNOWN
fi
run rm -f update.*

DATDIR=$LIBDIR/$VERSION
FILE=dat-$VERSION.tar

badversion () {
        VERBOSE=yes
        say "Failed to get McAfee datfile update from $FTPDIR"
        say "FTP version number \"$VERSION\" $*"
        run exit 1
}

# check the format of the version number
case $VERSION in
$MATCH) : ok
        ;;
*)      badversion does not match "$MATCH"
        ;;
esac

# already got it?
if [ -d $DATDIR ]
then
        case $FORCE in
        yes)    say Forced removal of $DATDIR
                run rm -rf $DATDIR
                ;;
        *)      say Already have "$VERSION"
                run exit 0
                ;;
        esac
fi

# work out installed dat version
run cd $LIBDIR
if ls -d $MATCH >/dev/null 2>&1
then
        INSTALLED=`ls -d $MATCH | tail -1`
else
        # no installed version so get whatever is available
        INSTALLED=0000
fi

# check new version is actually newer
if [ $VERSION -lt $INSTALLED ]
then
        badversion older than installed "$INSTALLED"
fi

VERBOSE=yes

say Installed dat file is "$INSTALLED"
say Latest dat file is "$VERSION"

# fetch and extract dat files
run mkdir $DATDIR
run cd $DATDIR
run wget --passive-ftp --progress=dot:mega $FTPDIR/$FILE
run tar xvf $FILE

# verify the contents
fail () {
        trap EXIT
        echo "$OUT"
        say Test run failed -- removing bad McAfee data files
        run rm -rf $DATDIR
        run exit 1
}
trap fail EXIT
CMD="uvscan --dat $DATDIR --version 2>&1"
say "> $CMD"
OUT=`$CMD`
case "$OUT" in
*"Missing or invalid DAT"* | \
*"Data file not found"* | \
*"Removal datafile clean.dat not found"* | \
*"Unable to remove viruses"* )
        fail
        ;;
esac
trap EXIT

echo "$OUT"
say Update OK

run cd $DATDIR
# show information on this update?
case $README in
yes)    run sed 's/[[:cntrl:]]//g
                1,/^NEW VIRUSES DETECTED/d
                /^UNDERSTANDING VIRUS NAMES/,$d
                s/^/# /' readme.txt
esac
# remove some crap
run rm -f *.diz *.exe *.ini *.lst *.tar *.txt
# change the current dat file links
for file in *.dat
do
        run rm -f ../$file
        run ln -s $VERSION/$file ..
done

say Completed OK
run exit 0

# done

From Cleveland at MAIL.WINNEFOX.ORG  Wed Jul  2 19:47:32 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:48 2006
Subject: Announce:  MailWatch for MailScanner 0.2 (was MailScanner-Con sole )
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB4B@mail.winnefox.org>

Hello,

I'm just finishing up the installation of this, and in your install
file, I noticed:
I only use SophosSAVI and ClamAV as virus scanners, so if you have a
different set-up, you will need to change the VIRUS_REGEX constant to
match the output of your scanner.

I use f-prot. Anyone know what I need to change?


--
Jody Cleveland
(cleveland@mail.winnefox.org)


-----Original Message-----
From: Steve Freegard [mailto:steve.freegard@LBSLTD.CO.UK]
Sent: Monday, June 16, 2003 12:10 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Announce: MailWatch for MailScanner 0.2 (was
MailScanner-Console )


Hi All,

I've just uploaded a new version to http://www.smf.f2s.com/mailscanner/
- see the Change Log for the details.

From raymond at PROLOCATION.NET  Wed Jul  2 19:57:09 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:48 2006
Subject: Error in maillog after upgrade
In-Reply-To: <OFD72E98C9.9038E961-ON85256D57.0066453C-85256D57.006699FA@udcomm.net>
Message-ID: <Pine.LNX.4.44.0307022056480.9762-100000@mailbox.prolocation.net>

Hi!

> Jul  2 14:35:35 smithers MailScanner[28385]: Looked up unknown string
> spamassassin in language translation file
> /etc/MailScanner/reports/en/languages.conf

Do you have a .rpmnew version in that dir also perhaps ?

Bye,
Raymond.

From kevins at BMRB.CO.UK  Wed Jul  2 19:58:27 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:48 2006
Subject: Error in maillog after upgrade
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C4A@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C4A@pascal.priv.bmrb.co.uk>
Message-ID: <1057172311.29590.8.camel@bach.kevinspicer.co.uk>

>Jul  2 14:35:35 smithers MailScanner[28385]: Looked up unknown string
>spamassassin in language translation file
>/etc/MailScanner/reports/en/languages.conf

>Any ideas why?

You don't happen to have a languages.conf.rpmnew file kicking about do
you?




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mbowman at UDCOM.COM  Wed Jul  2 19:57:14 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:48 2006
Subject: Error in maillog after upgrade
Message-ID: <OF58814393.C714B87E-ON85256D57.0067F8F9-85256D57.0068553C@udcomm.net>

No, I renamed the .rpmnew to languages.conf before I restarted MailScanner

However having stopped MailScanner again and did a killall on any rogue
processes and restarted MailScanner cleanly (again) it is now working.

Thanks anyway.

Matthew





Raymond Dijkxhoorn <raymond@PROLOCATION.NET>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
07/02/2003 02:57 PM
Please respond to MailScanner mailing list


        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Error in maillog after upgrade


Hi!

> Jul  2 14:35:35 smithers MailScanner[28385]: Looked up unknown string
> spamassassin in language translation file
> /etc/MailScanner/reports/en/languages.conf

Do you have a .rpmnew version in that dir also perhaps ?

Bye,
Raymond.

From mailscanner at LISTS.COM.AR  Wed Jul  2 22:08:23 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:48 2006
Subject: mcafee-autoupdate patch -- Tony Finch r-u-there?
In-Reply-To: <E19XmP8-0002dD-00@chiark.greenend.org.uk>
References: <m2n.19XQCd-000tDh@chiark.greenend.org.uk>
Message-ID: <3F031F97.28102.AE51868@localhost>

COOL, TONY!!!

It is like asking if you could add a cassette player to my car-stereo and 
getting a full CD-Changer :-D

I love "-r"... I think I'm going "-vtr", and I'll be able to report since 
when a customer is protected from worm X.

BTW, I see you use 
ftp://ftp.csx.cam.ac.uk/pub/software/antivirus/datfiles/4.x and Julian seems 
to prefer ftp://ftpeur.nai.com/pub/antivirus/datfiles/4.x 

The former seems to be more British, whereas the latter looks more European 
:-)

Now, being in SouthAmerica and topologicaly much closer from the USA than 
from Europe or the UK, which site do you recommend for updates?

Thanx a lot!


El 2 Jul 2003 a las 19:32, Tony Finch escribi?:

> Mariano Absatz <mailscanner@LISTS.COM.AR> wrote:
> >
> >Tony, would you care to incorporate it (or suggest a modification, maybe
> >another different command line option)?
> 
> I wasn't particularly keen on the feature since it can be implemented
> with a trivial shell script -- you could even fit it in the crontab
> itself. But anyway, I was bored this afternoon, so I did some polishing
> of my script...
> 
> Tony.

--
Mariano Absatz
El Baby
----------------------------------------------------------
Sarcasm is just one more service we offer.


From Kevin_Miller at CI.JUNEAU.AK.US  Wed Jul  2 22:14:56 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:48 2006
Subject: DSN: Return receipt ??
Message-ID: <08146035CA49D6119A36009027AC822A0264E464@CITY-EXCH-NTS>

>-----Original Message-----
>From: Remco Barendse [mailto:mailscanner@BARENDSE.TO]
>
>This is great, this is what I've been looking for for a long time :) :)
>
>Will this also block the read/not read messages?
>
>The problem I had was that I'm using Exchange as the mail server, this
>linux box is only relaying mail to/from the internet <->
>exchange server.
>
>Will the sendmail setting also work in this case where M$ Exchange is
>gererating these annoying status messages that can't be disabled?

Go into the IMS configuration area in Exchange Administrator, select the
Internet Mail tab, then Advanced Options.  You can disable Out of Office
responses and Automatic Responses to the Internet.  Hopefull the latter will
put the kiebosh on what you're looking to kiebosh.  I squelch the out of
office replies, but not the Automatic responses.  I'll be interested to see
how that works for you.  Might want to turn those off myself...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

From dot at DOTAT.AT  Wed Jul  2 23:04:43 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:18:48 2006
Subject: mcafee-autoupdate patch -- Tony Finch r-u-there?
In-Reply-To: <m2n.19Xoqj-0001F8@chiark.greenend.org.uk>
References: <m2n.19XQCd-000tDh@chiark.greenend.org.uk>
            <E19XmP8-0002dD-00@chiark.greenend.org.uk>
Message-ID: <E19XpiV-000528-00@chiark.greenend.org.uk>

Mariano Absatz <mailscanner@LISTS.COM.AR> wrote:
>
>BTW, I see you use
>ftp://ftp.csx.cam.ac.uk/pub/software/antivirus/datfiles/4.x and Julian seems
>to prefer ftp://ftpeur.nai.com/pub/antivirus/datfiles/4.x
>
>The former seems to be more British, whereas the latter looks more European :-)

Well, I use the former because it's about 10 feet away from my servers.
The latter URL is more official -- I should perhaps have done a little
editing before sending the script out.

>Now, being in SouthAmerica and topologicaly much closer from the USA than
>from Europe or the UK, which site do you recommend for updates?

Probably ftp.nai.com or ftpeur.nai.com, depending on how busy the servers
are and the state of the network between them and you.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
CROMARTY: NORTHWEST 5 OR 6, OCCASIONALLY 4 IN WEST. OCCASIONAL RAIN. MODERATE
OR GOOD.

From Kevin_Miller at CI.JUNEAU.AK.US  Wed Jul  2 23:33:58 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:48 2006
Subject: MailScanner 101, take two.
Message-ID: <08146035CA49D6119A36009027AC822A0264E468@CITY-EXCH-NTS>

A couple months ago, I set up MailScanner and we're currently using it quite
successfully.  In the process however, I did a lot of headscratching and
typically (for me anyway) with new projects I can't see the forest for the
trees when I begin.  Consequently, I don't think I have the critter
installed as optimally as I might.  Since it's in production, I can't really
tinker too much.  But all's not lost.  I grabbed a currently unused Dell
450, and am building a secondary mail server with it.  I've also been
reading the mailing list for the past month and a half or so, which has been
an eye opener!

Last time I had a time constraint to get something up and running.  This
time I can relax, take a deep breath, and go about the process in an orderly
manner.  So, here's the particulars:  I'm running on SuSE 8.0 with sendmail.
The SuSE updates have been applied, but it's basically a vanilla box at the
moment.  I'll be loading the current stable versions of:

MailScanner
Spamassassin
Webmin
MailScanner-mrtg or mailstats (or both)  Probably go to mailstats.
Antivirus

Starting with MailScanner, which is the better way to go, rpm or tar?  I'm
usually a bit leery of rpms on SuSE as they're often written for Redhat, and
do things a bit differently on SuSE (or is it SuSE does things a bit
differently <g>), thus I end up doing a tarball anyway.  But they're great
when they work.  So, how does the rpm pan out on SuSE 8.0/sendmail?

If rpm is the way to go, I presume the perl patches are included (previous
emails to this list indicated that was the case).

Does the rpm load spamassassin as part of it's processing or do I have to
load that after the fact (or before)?

I don't see it referenced in the instructions for either the tarball or the
rpm though I see there's a page about it at
http://www.sng.ecs.soton.ac.uk/mailscanner/install/spamassassin.shtml.  This
references 2.6 - I'll be going with 2.55 and leave the bleeding edge to
others.  Are there any significant differences if I follow those
instructions with the 2.55 version?

If it's not loaded/installed by the MailScanner scripts, should I install it
before or after MailScanner?

The last go-round, I think I did the tarballs, including installing
spamassassin from a tarball.  When I was trying to get Razor2 going, I
downloaded some perl stuff from CPAN which either the spamassassin site or
the Razor site said I needed, which made my system sort of grumpy.  Said
modules weren't installed that were, or version errors or some such.  It's
been several weeks since I've been able to play w/it, so I can't remember
the specifics.  Instead, I just wiped the machine, and reinstalled and
figured it was better to do it right rather than try to fix what I probably
hosed last time.  Thus this tome.

For the antivirus I got a copy of F-Prot, but then they changed the license.
Aargh.  A grand more to do the same thing.  So I'm looking at a different
antivirus solution now, probably RAV.  I don't mind paying for
support/updates and I thought the original $300 F-prot cost was quite
reasonable, but the new scheme isn't exactly competitive.  Does RAV auto
update both the signatures and the program?  I want something I can put in
and ignore until it's time to send 'em another check in a year.  A friend is
using Sophos, and he says he has to put in a new user license quarterly or
some such.  Life's too short for that.  All the docs seem to refer to
installing Sophos as a step however.  Can I presume that I can substitute
whatever flavor of antivirus there and *not* have to install Sophos?

Some of these probably seem like dumb questions to a bunch of you, but
they're not particularly clear to us folks that are a bit newer to the joys
of Linux.  Your patience and indulgence are appreciated.  I'll probably have
more a couple of steps into the process.

TIA.  I don't usually reply to replies for past requests for help, as I
don't want to clutter the list so I'll say in advance that I appreciate the
help...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

From raymond at PROLOCATION.NET  Wed Jul  2 23:39:31 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:48 2006
Subject: MailScanner 101, take two.
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E468@CITY-EXCH-NTS>
Message-ID: <Pine.LNX.4.44.0307030037320.3296-100000@mailbox.prolocation.net>

Hi!

> For the antivirus I got a copy of F-Prot, but then they changed the license.
> Aargh.  A grand more to do the same thing.  So I'm looking at a different
> antivirus solution now, probably RAV.  I don't mind paying for
> support/updates and I thought the original $300 F-prot cost was quite
> reasonable, but the new scheme isn't exactly competitive.  Does RAV auto
> update both the signatures and the program?  I want something I can put in

RAV is bought by Micro$oft and development is stopped on that one, i am
not sure if you even can buy new ones, i think not (*nix)

You could also try kasperski ...

Bye,
Raymond.

From Kevin_Miller at CI.JUNEAU.AK.US  Wed Jul  2 23:53:23 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:48 2006
Subject: MailScanner 101, take two.
Message-ID: <08146035CA49D6119A36009027AC822A0264E469@CITY-EXCH-NTS>

Doh - you're right.  Was just reading that a week or two ago and spaced it
right out.  Thanks.  I'll take a look at Kasperski, et. al...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500


>-----Original Message-----
>From: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET]
>Sent: Wednesday, July 02, 2003 2:40 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner 101, take two.
>
>
>Hi!
>
>> For the antivirus I got a copy of F-Prot, but then they
>changed the license.
>> Aargh.  A grand more to do the same thing.  So I'm looking
>at a different
>> antivirus solution now, probably RAV.  I don't mind paying for
>> support/updates and I thought the original $300 F-prot cost was quite
>> reasonable, but the new scheme isn't exactly competitive.
>Does RAV auto
>> update both the signatures and the program?  I want
>something I can put in
>
>RAV is bought by Micro$oft and development is stopped on that one, i am
>not sure if you even can buy new ones, i think not (*nix)
>
>You could also try kasperski ...
>
>Bye,
>Raymond.
>

From rscarano at targetsis.com.br  Wed Jul  2 23:54:47 2003
From: rscarano at targetsis.com.br (Rodrigo Scarano)
Date: Thu Jan 12 21:18:48 2006
Subject: Cron e-mail
Message-ID: <000401c340ec$f19f14e0$6900000a@targetsis.com.br>

Hello all
I've added a command on my update_virus_scanners script (called on the
cron.hourly directory) to redirect the output of the ${UPDATER} to a file:
....
  #echo Updating $NAME
  logger -p mail.info -t update.virus.scanners Updating $NAME
  ${UPDATER} >>/usr/local/uvscan/updnai.log 2>&1
...

Today I had a dat update (McAfee - 4275) and I didn't receive a mail (root)
of cron telling me that the update was done ( and I know it was because I've
see it on my updnai.log file).

Anybody knows what I have to do to receive this e-mail ???

Tks for any help.


Rodrigo Scarano
Target Sistemas
http://www.targetsis.com.br/
rscarano@targetsis.com.br

From sanjay.patel at REXWIRE.COM  Thu Jul  3 00:09:59 2003
From: sanjay.patel at REXWIRE.COM (Sanjay Patel)
Date: Thu Jan 12 21:18:48 2006
Subject: MailScanner 101, take two.
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E469@CITY-EXCH-NTS>
Message-ID: <007901c340ef$101726e0$6f01a8c0@Laptop1>

Panda is cheap very cheap. Config can be a bitch but you get what you pay
for. As a product it updates well and they are always astep ahead.


-SKP

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Kevin Miller
Sent: Wednesday, July 02, 2003 6:53 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner 101, take two.


Doh - you're right.  Was just reading that a week or two ago and spaced it
right out.  Thanks.  I'll take a look at Kasperski, et. al...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500


>-----Original Message-----
>From: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET]
>Sent: Wednesday, July 02, 2003 2:40 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner 101, take two.
>
>
>Hi!
>
>> For the antivirus I got a copy of F-Prot, but then they
>changed the license.
>> Aargh.  A grand more to do the same thing.  So I'm looking
>at a different
>> antivirus solution now, probably RAV.  I don't mind paying for
>> support/updates and I thought the original $300 F-prot cost was quite
>> reasonable, but the new scheme isn't exactly competitive.
>Does RAV auto
>> update both the signatures and the program?  I want
>something I can put in
>
>RAV is bought by Micro$oft and development is stopped on that one, i am
>not sure if you even can buy new ones, i think not (*nix)
>
>You could also try kasperski ...
>
>Bye,
>Raymond.
>


From newsletters at PCSITES.COM  Thu Jul  3 03:33:37 2003
From: newsletters at PCSITES.COM (Richard Ahlquist)
Date: Thu Jan 12 21:18:48 2006
Subject: Announce:  MailWatch for MailScanner 0.2 (was MailScanner-Con sole )
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB4B@mail.winnefox.org>
Message-ID: <009a01c3410b$87a99730$5f01a8c0@MINE>

This is what I use with f-prot;

define(VIRUS_REGEX, '/(.+) Infection: (\S+)/');

Works well.

Good Luck!
Richard

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Jody Cleveland
Sent: Wednesday, July 02, 2003 2:48 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Announce: MailWatch for MailScanner 0.2 (was MailScanner-Con
sole )

Hello,

I'm just finishing up the installation of this, and in your install
file, I noticed:
I only use SophosSAVI and ClamAV as virus scanners, so if you have a
different set-up, you will need to change the VIRUS_REGEX constant to
match the output of your scanner.

I use f-prot. Anyone know what I need to change?


--
Jody Cleveland
(cleveland@mail.winnefox.org)


-----Original Message-----
From: Steve Freegard [mailto:steve.freegard@LBSLTD.CO.UK]
Sent: Monday, June 16, 2003 12:10 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Announce: MailWatch for MailScanner 0.2 (was
MailScanner-Console )


Hi All,

I've just uploaded a new version to http://www.smf.f2s.com/mailscanner/
- see the Change Log for the details.


From kevins at BMRB.CO.UK  Thu Jul  3 08:11:21 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:48 2006
Subject: MailScanner 101, take two.
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C53@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C53@pascal.priv.bmrb.co.uk>
Message-ID: <1057216282.18491.9.camel@bach.kevinspicer.co.uk>

>Does the rpm load spamassassin as part of it's processing or do I have
>to
>load that after the fact (or before)?

You have to do it yourself later

>Are there any significant differences if I follow those
>instructions with the 2.55 version?

No

>If it's not loaded/installed by the MailScanner scripts, should I
>install it
>before or after MailScanner?

Doesn't matter just set Use SpamAssassin = yes once you've got it.


>The last go-round, I think I did the tarballs, including installing
>spamassassin from a tarball.  When I was trying to get Razor2 going, I
>downloaded some perl stuff from CPAN which either the spamassassin site
>or
>the Razor site said I needed, which made my system sort of grumpy.

Don't use CPAN on an rpm based machine - its a bad idea.  The razor2-sdk
package (from razor's site) should provide what you need.

This worked fine for me on Mandrake
MailScanner rpm
SpamAssassin tar.gz
razor2 & razor2sdk rpms
pyzor (tar I think)
dcc (tar)





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mailscanner at BARENDSE.TO  Thu Jul  3 09:06:42 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:48 2006
Subject: DSN: Return receipt ??
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E464@CITY-EXCH-NTS>
Message-ID: <Pine.LNX.4.44.0307030958510.18949-100000@raveon.barendse.to>

Tried that already, i think (suspect!) that the only thing that that tab
kills are the messages : "Your message has been successfully delivered to"
for most (certainly not all, see the status reply because of which I
started this thread) messages.

There is absolutely no way to disable read/not read messages, at least not
when your clients on Exchange are running Outlook 2000. Outlook XP
supposedly has an option to disable this 'feature'. I even tried
installing Microgarden Outlook Tools for Outlook 2000 but this only helped
for about half of the messages received, for the other half Outlook was
still happily reporting which e-mail went where and who read it.

This is why I chose to kill the messages of based on subject headers. Even
if the client could disable it I don't want to rely on my users to disable
this feature to prevent leaking any information. I don't want anybody to
know when my users read their e-mail, it's kind of embarrasing if a
scretary says someone is out of office but they get a read receipt message
a couple of minutes later on an e-mail they sent.

I just checked my maillog after setting the options
define(`confPRIVACY_FLAGS',
`authwarnings,goaway,noreceipts,restrictqrun,restrictexpand')dnl

in my sendmail.mc but I still see read/not read messages being discarded.

I hope that this line in sendmail.mc does kill the last of the annoying
successfully delivered/could not be delivered to messages.



On Wed, 2 Jul 2003, Kevin Miller wrote:

> >-----Original Message-----
> >From: Remco Barendse [mailto:mailscanner@BARENDSE.TO]
> >
> >This is great, this is what I've been looking for for a long time :) :)
> >
> >Will this also block the read/not read messages?
> >
> >The problem I had was that I'm using Exchange as the mail server, this
> >linux box is only relaying mail to/from the internet <->
> >exchange server.
> >
> >Will the sendmail setting also work in this case where M$ Exchange is
> >gererating these annoying status messages that can't be disabled?
>
> Go into the IMS configuration area in Exchange Administrator, select the
> Internet Mail tab, then Advanced Options.  You can disable Out of Office
> responses and Automatic Responses to the Internet.  Hopefull the latter will
> put the kiebosh on what you're looking to kiebosh.  I squelch the out of
> office replies, but not the Automatic responses.  I'll be interested to see
> how that works for you.  Might want to turn those off myself...
>
> ...Kevin
> -------------------
> Kevin Miller                Registered Linux User No: 307357
> CBJ MIS Dept.               Network Systems Administrator, Mail
> Administrator
> 155 South Seward Street     ph: (907) 586-0242
> Juneau, Alaska 99801        fax: (907 586-4500
>

From howard at harper-adams.ac.uk  Thu Jul  3 10:37:17 2003
From: howard at harper-adams.ac.uk (Howard Robinson)
Date: Thu Jan 12 21:18:48 2006
Subject: Doh! Question
Message-ID: <200307030936.h639a38M002508@blackhole.harper-adams.ac.uk>

Dear list
Thanks for the help over the last couple of days.
I now have SpamAssassin running.
So a Doh Question.
What command do I use to find out the version of SpamAssassin
running? (Okay I know its 2.55 now but I have a short memory!)
I was installed the 'approved' way.
Thanks




Regards

Howard Robinson
(Senior Technical Development Officer)
Harper Adams University College
Edgmond
Newport
Shropshire
TF10 8NB UK

E-mail: hrobinson@harper-adams.ac.uk
Tel.  : +44(0)1952 820280 Via switchboard
      : +44(0)1952 815253 Direct line
Fax.  : +44(0)1952 814783
College Web site http://www.harper-adams.ac.uk

From raymond at PROLOCATION.NET  Thu Jul  3 10:57:10 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:48 2006
Subject: Doh! Question
In-Reply-To: <200307030936.h639a38M002508@blackhole.harper-adams.ac.uk>
Message-ID: <Pine.LNX.4.44.0307031156460.17750-100000@mailbox.prolocation.net>

hi!

> What command do I use to find out the version of SpamAssassin
> running? (Okay I know its 2.55 now but I have a short memory!)
> I was installed the 'approved' way.
> Thanks

spamassassin -v

Bye,
Raymond.

From ron at SPAWAR.NAVY.MIL  Thu Jul  3 11:01:32 2003
From: ron at SPAWAR.NAVY.MIL (Ron Broersma)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030701182840.02590538@imap.ecs.soton.ac.uk>
Message-ID: <3F03FEFC.7080106@spawar.navy.mil>

Strange, RBL checks stopped happening.  Turning on some debug revealed
that none of the entries in the Spam Lists file (spam.lists.conf) were
being found due to case mismatch.  Changing everything in
spam.lists.conf to lower case fixed the problem and RBL checks are
happening again for me.

My guess is that the following has something to do with this...
 > * Fixes *
 > - RBLs are converted to lower-case when read from MailScanner.conf.

Other than that, the new version looks great.  Thanks for the continued
support of an awesome product.

--Ron

Julian Field wrote:
> G'day!
>
> I have just posted the new stable release 4.22-4 on the website.
>
> Major new features this time are
> - filetype detection regardless of filename, allowing you to allow/deny
> files of different type.
> - control over HTML forms in email messages, which have been used recently
> to try to extract passwords and credit card details from unwitting users.
> - control over the maximum size of any message, so you can limit the size
> of messages for dial-up users for example.
>
> Download it from www.mailscanner.info as usual.
>
> All comments to me or the list.
>
> The full ChangeLog is this:
> * New Features and Improvements *
> - Added support for checking file content types regardless of their
> filename.
>   This uses the "file" command to work out the types of different files.
>   New additions to MailScanner.conf are "file command", "file timeout",
>   "filetype rules" (which work just like filename rules) and "log permitted
>   filetypes".
> - Added "Allow Form Tags" configuration option to ban HTML forms from
> email.
>   Requires almost no additional CPU load and is useful protection.
> - Added "Maximum Message Size" configuration option to limit the size of
>   messages for certain users. Handy for dialup users to save their download
>   phone bills. Obviously it works with a ruleset.
> - "Spam Actions", "High Scoring Spam Actions" and "Non Spam Actions" are
> now
>   set up so that the first matching rule will be used, rather than the
> sum of
>   all the matching rules. This means you can have 1 setting for a
> domain, but
>   before that have a rule for an individual user that over-rides the domain
>   setting.
> - MailScanner.conf file can now include "%name% = value" definition lines.
>   These "%name%" variables can then be used later in the MailScanner.conf
>   file and the rulesets, where they will be substituted with the
> appropriate
>   "value". This greatly eases switching languages.
> - Sophos.install script improved to make new versions work with sophossavi.
> - f-prot-autoupdate script improved to handle new F-Prot version 4.
> - Added bitdefender-autoupdate script from Alessandro Bianchi.
> - Added "default" overall black- and white-lists to per-domain
> black/whitelist
>   code in CustomConfig.pm.
> - Added code to CustomConfig.pm to implement internal-only accounts that
>   cannot send mail to external addresses.
> - Improved comments in MailScanner.conf for "Max Children" setting.
> - Added (commented out) instruction to not use Bayesian stats engine in
>   MailScanner, with a comment about its need.
>
> * Fixes *
> - "channel error" detection bug in ZMailer support fixed.
> - All sender.* reports now have To: From: and Subject: in English to keep
>   sendmail and e-mail applications happy.
> - "$reportword" appearing in Postmaster notices fixed.
> - Added call to get logging working properly in clamav-autoupdate.
> - RBLs are converted to lower-case when read from MailScanner.conf.
> - Fix in signing clean messages containing single uuencoded attachments
> that
>   are then read using certain versions of Outlook 97.
> - MailScanner does not support Postfix without hashed queues. This
> situation
>   is detected and reported if it is found.
>   By default in all recent releases of Postfix (both 1.x and 2.x) hashed
>   queues are enabled, so just don't disable them.
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support

From raymond at PROLOCATION.NET  Thu Jul  3 11:10:05 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-4 released
In-Reply-To: <3F03FEFC.7080106@spawar.navy.mil>
Message-ID: <Pine.LNX.4.44.0307031208480.17750-100000@mailbox.prolocation.net>

Hi!

> Strange, RBL checks stopped happening.  Turning on some debug revealed
> that none of the entries in the Spam Lists file (spam.lists.conf) were
> being found due to case mismatch.  Changing everything in
> spam.lists.conf to lower case fixed the problem and RBL checks are
> happening again for me.
>
> My guess is that the following has something to do with this...
>  > * Fixes *
>  > - RBLs are converted to lower-case when read from MailScanner.conf.
>

Yes, i can confirm this, i upgraded and since that no matches were made on
the Easynet lists i use, after changing to lowercase in the
spam.lists.conf they are comming in again straight away.

Julian, time for a quick fix i guess :))

Bye,
Raymond.

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 11:40:58 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: Cron e-mail
In-Reply-To: <000401c340ec$f19f14e0$6900000a@targetsis.com.br>
Message-ID: <5.2.0.9.2.20030703114014.04721d08@imap.ecs.soton.ac.uk>

If you take a look in the update_virus_scanners script, you will find it 
redirects all output from each -autoupdate script to /dev/null. Just 
uncomment the end of the line that calls the -autoupdate scripts and you 
should start seeing some output.

At 23:54 02/07/2003, you wrote:
>Hello all
>I've added a command on my update_virus_scanners script (called on the
>cron.hourly directory) to redirect the output of the ${UPDATER} to a file:
>....
>   #echo Updating $NAME
>   logger -p mail.info -t update.virus.scanners Updating $NAME
>   ${UPDATER} >>/usr/local/uvscan/updnai.log 2>&1
>...
>
>Today I had a dat update (McAfee - 4275) and I didn't receive a mail (root)
>of cron telling me that the update was done ( and I know it was because I've
>see it on my updnai.log file).
>
>Anybody knows what I have to do to receive this e-mail ???
>
>Tks for any help.
>
>
>Rodrigo Scarano
>Target Sistemas
>http://www.targetsis.com.br/
>rscarano@targetsis.com.br

-- 
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support


From mailscanner at ecs.soton.ac.uk  Thu Jul  3 11:38:09 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: MailScanner 101, take two.
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E468@CITY-EXCH-NTS>
Message-ID: <5.2.0.9.2.20030703113125.0459b7b8@imap.ecs.soton.ac.uk>

At 23:33 02/07/2003, you wrote:
>Last time I had a time constraint to get something up and running.  This
>time I can relax, take a deep breath, and go about the process in an orderly
>manner.  So, here's the particulars:  I'm running on SuSE 8.0 with sendmail.
>The SuSE updates have been applied, but it's basically a vanilla box at the
>moment.  I'll be loading the current stable versions of:
>
>MailScanner
>Spamassassin
>Webmin
>MailScanner-mrtg or mailstats (or both)  Probably go to mailstats.
>Antivirus
>
>Starting with MailScanner, which is the better way to go, rpm or tar?

rpm. The SuSE one, not the RedHat one.

>   I'm
>usually a bit leery of rpms on SuSE as they're often written for Redhat, and
>do things a bit differently on SuSE (or is it SuSE does things a bit
>differently <g>), thus I end up doing a tarball anyway.  But they're great
>when they work.  So, how does the rpm pan out on SuSE 8.0/sendmail?

I haven't tested the RPM on SuSE 8.0, only 8.1. But I've only heard anyone
having any problems with it once, and they were using 7.x which is quite a
lot different from 8.x. So you should be okay.

>If rpm is the way to go, I presume the perl patches are included (previous
>emails to this list indicated that was the case).

Yes.

>Does the rpm load spamassassin as part of it's processing or do I have to
>load that after the fact (or before)?

Do it separately. And don't use the RPM of SpamAssassin. Either download it
and build from source or use CPAN to install it. To build it by hand,
unpack the .tar.gz archive, "cd" into it and do this:
         perl Makefile.PL
         make
         make test
         make install


>I don't see it referenced in the instructions for either the tarball or the
>rpm though I see there's a page about it at
>http://www.sng.ecs.soton.ac.uk/mailscanner/install/spamassassin.shtml.  This
>references 2.6 - I'll be going with 2.55 and leave the bleeding edge to
>others.  Are there any significant differences if I follow those
>instructions with the 2.55 version?

2.55 will be just fine. I don't run 2.60 myself on production systems.

>If it's not loaded/installed by the MailScanner scripts, should I install it
>before or after MailScanner?

Doesn't matter. Just set "Use SpamAssassin = yes" in
/etc/MailScanner/MailScanner.conf.

>The last go-round, I think I did the tarballs, including installing
>spamassassin from a tarball.  When I was trying to get Razor2 going, I
>downloaded some perl stuff from CPAN which either the spamassassin site or
>the Razor site said I needed, which made my system sort of grumpy.  Said
>modules weren't installed that were, or version errors or some such.  It's
>been several weeks since I've been able to play w/it, so I can't remember
>the specifics.  Instead, I just wiped the machine, and reinstalled and
>figured it was better to do it right rather than try to fix what I probably
>hosed last time.  Thus this tome.

Don't install Perl modules from RPM packages, unless they are provided by
SuSE themselves for 8.0.

Different versions of Perl want things installed in different places, and
3rd-party providers of RPM's cannot know what version of Perl you are
running and therefore cannot always install them in the right place.

This is why I distribute MailScanner as a bunch of SRPM's (source RPMs)
which are automatically rebuilt specifically for your system during the
installation process.

>For the antivirus I got a copy of F-Prot, but then they changed the license.
>Aargh.  A grand more to do the same thing.  So I'm looking at a different
>antivirus solution now, probably RAV.  I don't mind paying for
>support/updates and I thought the original $300 F-prot cost was quite
>reasonable, but the new scheme isn't exactly competitive.  Does RAV auto
>update both the signatures and the program?  I want something I can put in
>and ignore until it's time to send 'em another check in a year.  A friend is
>using Sophos, and he says he has to put in a new user license quarterly or
>some such.  Life's too short for that.  All the docs seem to refer to
>installing Sophos as a step however.  Can I presume that I can substitute
>whatever flavor of antivirus there and *not* have to install Sophos?

Yes. Just set "Virus Scanners = f-prot" or whatever is appropriate for your
scanner, in /etc/MailScanner/MailScanner.conf.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 12:16:30 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: ANNOUNCE: Version 4.22-5 released
In-Reply-To: <Pine.LNX.4.44.0307031208480.17750-100000@mailbox.prolocati
              on.net>
References: <3F03FEFC.7080106@spawar.navy.mil>
Message-ID: <5.2.0.9.2.20030703121416.04eca5a0@imap.ecs.soton.ac.uk>

I have fixed the bug below, and I think it warrants another release as this
will have stopped everyone's RBL lists from working unless you convert them
all to lower-case.

The only other changes are
- improve the efficiency of the filetype checking
- add Tony Finch's improved mcafee-autoupdate script

Download from the usual place at www.mailscanner.info

Sorry folks :-(

At 11:10 03/07/2003, you wrote:
>Hi!
>
> > Strange, RBL checks stopped happening.  Turning on some debug revealed
> > that none of the entries in the Spam Lists file (spam.lists.conf) were
> > being found due to case mismatch.  Changing everything in
> > spam.lists.conf to lower case fixed the problem and RBL checks are
> > happening again for me.
> >
> > My guess is that the following has something to do with this...
> >  > * Fixes *
> >  > - RBLs are converted to lower-case when read from MailScanner.conf.
> >
>
>Yes, i can confirm this, i upgraded and since that no matches were made on
>the Easynet lists i use, after changing to lowercase in the
>spam.lists.conf they are comming in again straight away.
>
>Julian, time for a quick fix i guess :))
>
>Bye,
>Raymond.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 11:29:25 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:48 2006
Subject: Doh! Question
In-Reply-To: <Pine.LNX.4.44.0307031156460.17750-100000@mailbox.prolocati
              on.net>
References: <200307030936.h639a38M002508@blackhole.harper-adams.ac.uk>
Message-ID: <5.2.0.9.2.20030703112837.04f16bf8@imap.ecs.soton.ac.uk>

At 10:57 03/07/2003, you wrote:
>hi!
>
> > What command do I use to find out the version of SpamAssassin
> > running? (Okay I know its 2.55 now but I have a short memory!)
> > I was installed the 'approved' way.
> > Thanks
>
>spamassassin -v

Or if you can't find the "spamassassin" script for some reason:

perl -MMail::SpamAssassin -e 'print $Mail::SpamAssassin::VERSION;'

should do it too.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From m.sapsed at BANGOR.AC.UK  Thu Jul  3 12:32:43 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:48 2006
Subject: Doh! Question
References: <200307030936.h639a38M002508@blackhole.harper-adams.ac.uk>
Message-ID: <3F04145B.7090604@bangor.ac.uk>

Howard Robinson wrote:
> What command do I use to find out the version of SpamAssassin
> running? (Okay I know its 2.55 now but I have a short memory!)
> I was installed the 'approved' way.

Rather than spamassassin -v as suggested by Raymond, I prefer the
solution that someone else posted which checks what version perl sees -
it's not inconceivable (depending on paths etc) to get 2 different
answers. Save this

#! /usr/bin/perl
use Mail::SpamAssassin;
print $Mail::SpamAssassin::VERSION . "\n";

to a file, make it executable and run it.

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From howard at harper-adams.ac.uk  Thu Jul  3 12:38:38 2003
From: howard at harper-adams.ac.uk (Howard Robinson)
Date: Thu Jan 12 21:18:48 2006
Subject: Doh! Question
In-Reply-To: <3F04145B.7090604@bangor.ac.uk>
Message-ID: <200307031137.h63BbX29007735@blackhole.harper-adams.ac.uk>

On 3 Jul 03, at 12:32, Martin Sapsed wrote:
I'll try the other option.
For the record it is
spamassassin -V
not -v
on 2.55.
Thanks again Raymond, Matrin,Julian et al.

> Howard Robinson wrote:
> > What command do I use to find out the version of SpamAssassin
> > running? (Okay I know its 2.55 now but I have a short memory!)
> > I was installed the 'approved' way.
>
> Rather than spamassassin -v as suggested by Raymond, I prefer the
> solution that someone else posted which checks what version perl sees -
> it's not inconceivable (depending on paths etc) to get 2 different
> answers. Save this
>
> #! /usr/bin/perl
> use Mail::SpamAssassin;
> print $Mail::SpamAssassin::VERSION . "\n";
>
> to a file, make it executable and run it.
>
> Cheers,
>
> Martin
>
> --
> Martin Sapsed
> Information Services               "Who do you say I am?"
> University of Wales, Bangor             Jesus of Nazareth




Regards

Howard Robinson
(Senior Technical Development Officer)
Harper Adams University College
Edgmond
Newport
Shropshire
TF10 8NB UK

E-mail: hrobinson@harper-adams.ac.uk
Tel.  : +44(0)1952 820280 Via switchboard
      : +44(0)1952 815253 Direct line
Fax.  : +44(0)1952 814783
College Web site http://www.harper-adams.ac.uk

From mailscanner at BARENDSE.TO  Thu Jul  3 13:05:35 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:48 2006
Subject: directory containing all the reports in all the languages
Message-ID: <Pine.LNX.4.44.0307031403330.18949-100000@raveon.barendse.to>

Just noticed this new option in the MailScanner.conf file:

# Set the directory containing all the reports in all the languages
%report-dir% = /etc/MailScanner/reports/en


Shouldn't this be set to :
/etc/MailScanner/reports
as default?

Or is this the option for the defualt language directory if no specific
language is defined for a top level domain??

From ron at SPAWAR.NAVY.MIL  Thu Jul  3 13:10:54 2003
From: ron at SPAWAR.NAVY.MIL (Ron Broersma)
Date: Thu Jan 12 21:18:49 2006
Subject: ANNOUNCE: Version 4.22-5 released
In-Reply-To: <5.2.0.9.2.20030703121416.04eca5a0@imap.ecs.soton.ac.uk>
References: <3F03FEFC.7080106@spawar.navy.mil>
            <5.2.0.9.2.20030703121416.04eca5a0@imap.ecs.soton.ac.uk>
Message-ID: <3F041D4E.1020306@spawar.navy.mil>

Julian,

Thanks for the quick fix.  RBL checking is working again without the
other file hacks.

You might want to check that mcafee-autoupdate script.  I had to remove
all the embedded /r characters (every line) before it would work without
complaint.  Also had to set LIBDIR and FTPDIR back to the defaults where
they were before.

--Ron

Julian Field wrote:
> I have fixed the bug below, and I think it warrants another release as this
> will have stopped everyone's RBL lists from working unless you convert them
> all to lower-case.
>
> The only other changes are
> - improve the efficiency of the filetype checking
> - add Tony Finch's improved mcafee-autoupdate script
>
> Download from the usual place at www.mailscanner.info
>
> Sorry folks :-(
>
> At 11:10 03/07/2003, you wrote:
>
>> Hi!
>>
>> > Strange, RBL checks stopped happening.  Turning on some debug revealed
>> > that none of the entries in the Spam Lists file (spam.lists.conf) were
>> > being found due to case mismatch.  Changing everything in
>> > spam.lists.conf to lower case fixed the problem and RBL checks are
>> > happening again for me.
>> >
>> > My guess is that the following has something to do with this...
>> >  > * Fixes *
>> >  > - RBLs are converted to lower-case when read from MailScanner.conf.
>> >
>>
>> Yes, i can confirm this, i upgraded and since that no matches were
>> made on
>> the Easynet lists i use, after changing to lowercase in the
>> spam.lists.conf they are comming in again straight away.
>>
>> Julian, time for a quick fix i guess :))
>>
>> Bye,
>> Raymond.
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support

From mailscanner at ELKNET.NET  Thu Jul  3 15:15:27 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:18:49 2006
Subject: Spam reports
Message-ID: <200307031316.h63DGdS14689@ori.rl.ac.uk>

I've scanned the list archives, but could not find an answer to my question, so I'll post it here. Thanks in advance to all help provided.

In the two reports:
  sender.spam.report.txt
  sender.spam.sa.report.txt

That get sent to an allegged spammer as a result of a bounce spam action that had a SA score above the threshold, is there any means to include the SA report in the message body? I'd like the emailed report to include a typical report like:
  SpamCheck: spam, SpamAssassin (score=9.4, required 5,
        CLICK_BELOW 0.10, HTML_80_90 0.54, HTML_FONT_BIG 0.27,
        HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_RED 0.10,
        HTML_MESSAGE 0.10, IMPOTENCE 2.90, MIME_HTML_ONLY 0.10,
        MSGID_GOOD_EXCHANGE -0.38, OBFUSCATING_COMMENT 2.60,
        PENIS_ENLARGE 1.39, PENIS_ENLARGE2 1.29, REMOVE_PAGE 0.27)

I thought including the '$spamreport' in the body of the report template would do the trick, but all I'm seeing is:
   "spam, SpamAssassin" in the report where the variable was placed, the actual triggers and scores are missing.

Thanks!

From Denis.Beauchemin at USHERBROOKE.CA  Thu Jul  3 14:30:44 2003
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:18:49 2006
Subject: mcafee-autoupdate patch -- Tony Finch r-u-there?
In-Reply-To: <E19XpiV-000528-00@chiark.greenend.org.uk>
References: <m2n.19XQCd-000tDh@chiark.greenend.org.uk>
            <E19XmP8-0002dD-00@chiark.greenend.org.uk>
            <E19XpiV-000528-00@chiark.greenend.org.uk>
Message-ID: <1057239044.2846.6.camel@dbeauchemin.sti.usherbrooke.ca>

Le mer 02/07/2003 ? 18:04, Tony Finch a ?crit :

> >Now, being in SouthAmerica and topologicaly much closer from the USA than
> >from Europe or the UK, which site do you recommend for updates?
> 
> Probably ftp.nai.com or ftpeur.nai.com, depending on how busy the servers
> are and the state of the network between them and you.
> 

I just checked and...
# host ftp.nai.com
ftp.nai.com has address 216.49.88.143
# host ftpeur.nai.com
ftpeur.nai.com is an alias for ftp.nai.com.
ftp.nai.com has address 216.49.88.143

They're both the same!!!

Denis
-- 
Denis Beauchemin, analyste
Universit?de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045


From slwatts at WINCKWORTHS.CO.UK  Thu Jul  3 15:25:03 2003
From: slwatts at WINCKWORTHS.CO.UK (Samuel Luxford-Watts)
Date: Thu Jan 12 21:18:49 2006
Subject: postfix + Mailscanner probs
Message-ID: <FB50AA0C8E7D5344A761C40BC705742905369F@exchangeserver.winckworths.co.uk>

Hi All,

This is probably a REALLY dumb question, but at the moment I cannot see why
this is happening.....

I followed through all the instructions for getting suse, postfix and
mailscanner running. All seemed to work fine, but I couldnt figure out why
mailscanner wasnt stripping viruses from attachments.

In the end I stopped all the services, then ran

postfix -c /etc/postfix.in start

This to my mind should only start the inbound mail process, so the server
receives emails and stores them in /var/spool/postfix.in. Well on my server
its actually forwarding the mail as well.

I have checked for the defer_transports line and that is present and correct
in /etc/postfix.in/main.cf.

The only thing I can think of is that I have altered /etc/postfix/transports
to read:

dest.test        smtp:[192.168.25.95]

where dest.test is my internal test mail domain and the ip address is of our
test exchange server. my /etc/postfix.in/main.cf file is still pointing to
/etc/postfix various files. I am trying to configure an email gateway which
is listed as a primary MX host for our domain, filters and strips
viruses/spam and forwards those emails to our exchange server. if I do not
add this line to transport then I get a mail loop error because the
mailscanner server thinks its the best MX host for dest.test.

Any help would be great,

Thanks,

Sam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030703/c0795640/attachment.html
From rscarano at targetsis.com.br  Thu Jul  3 15:34:29 2003
From: rscarano at targetsis.com.br (Rodrigo Scarano)
Date: Thu Jan 12 21:18:49 2006
Subject: RES: Cron e-mail
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF6D9@pascal.priv.bmrb.co.uk>
Message-ID: <002f01c34170$36b54da0$6900000a@targetsis.com.br>

Kevin,
Thanks again and sorry to send the reply directly for you...


Rodrigo Scarano
Target Sistemas
http://www.targetsis.com.br/
rscarano@targetsis.com.br


-----Mensagem original-----
De:     Spicer, Kevin [mailto:Kevin.Spicer@bmrb.co.uk]
Enviada em:     Quinta-feira, 3 de Julho de 2003 11:21
Para:   rscarano@targetsis.com.br
Assunto:        RE: Cron e-mail

Rodrigo Scarano wrote:
> Thanks Kevin.
>
> I dont know if I understood. If I use de original update
> update_virus_scanner script with the line:
> ...
> ${UPDATER} >/dev/null 2>&1
> ...
>
> I will receive a e-mail when the update will be done ???
>

No, change it to

${UPDATER}

and you'll get mailed any output whenever it runs (no output=no mail).
Maybe you'll get mail every time, maybe only when something goes wrong
(depends on the specific update script).  Some updaters (like f-prot's for
example) take a flag which makes them silent except on error (check their
docs).

Please email the list in future.

Regards,

Kevin



BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 15:52:18 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:49 2006
Subject: Announce:  MailWatch for MailScanner 0.2 (was MailScanner-Con sole )
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB58@mail.winnefox.org>

> This is what I use with f-prot;
>
> define(VIRUS_REGEX, '/(.+) Infection: (\S+)/');
>
> Works well.

Thanks! Works for me as well.

I noticed on the Other page, there is a link under Tools for Sophos
Status. Do you know of a way to make the same thing for f-prot status?

Jody

From mailscanner at BARENDSE.TO  Thu Jul  3 15:53:29 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:49 2006
Subject: ANNOUNCE: Version 4.22-5 released
In-Reply-To: <3F041D4E.1020306@spawar.navy.mil>
Message-ID: <Pine.LNX.4.44.0307031650500.18949-100000@raveon.barendse.to>

Have just checked but still the spam black whistelists aren't properly
lowered?

I still need to make duplicate entries for some domains because different
servers on the other side display the sender domain in different casing.

I still have to make two entries to whitelist for example:

From:           @domain.com                     yes
From:           @DOMAIN.com                     yes

Thought that the domain part for the black/whitelist would be made case
insensitive?

On Thu, 3 Jul 2003, Ron Broersma wrote:

> Julian,
>
> Thanks for the quick fix.  RBL checking is working again without the
> other file hacks.
>
> You might want to check that mcafee-autoupdate script.  I had to remove
> all the embedded /r characters (every line) before it would work without
> complaint.  Also had to set LIBDIR and FTPDIR back to the defaults where
> they were before.
>
> --Ron
>
> Julian Field wrote:
> > I have fixed the bug below, and I think it warrants another release as this
> > will have stopped everyone's RBL lists from working unless you convert them
> > all to lower-case.
> >
> > The only other changes are
> > - improve the efficiency of the filetype checking
> > - add Tony Finch's improved mcafee-autoupdate script
> >
> > Download from the usual place at www.mailscanner.info
> >
> > Sorry folks :-(
> >
> > At 11:10 03/07/2003, you wrote:
> >
> >> Hi!
> >>
> >> > Strange, RBL checks stopped happening.  Turning on some debug revealed
> >> > that none of the entries in the Spam Lists file (spam.lists.conf) were
> >> > being found due to case mismatch.  Changing everything in
> >> > spam.lists.conf to lower case fixed the problem and RBL checks are
> >> > happening again for me.
> >> >
> >> > My guess is that the following has something to do with this...
> >> >  > * Fixes *
> >> >  > - RBLs are converted to lower-case when read from MailScanner.conf.
> >> >
> >>
> >> Yes, i can confirm this, i upgraded and since that no matches were
> >> made on
> >> the Easynet lists i use, after changing to lowercase in the
> >> spam.lists.conf they are comming in again straight away.
> >>
> >> Julian, time for a quick fix i guess :))
> >>
> >> Bye,
> >> Raymond.
> >
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > MailScanner thanks transtec Computers for their support
>

From slwatts at WINCKWORTHS.CO.UK  Thu Jul  3 16:23:12 2003
From: slwatts at WINCKWORTHS.CO.UK (Samuel Luxford-Watts)
Date: Thu Jan 12 21:18:49 2006
Subject: postfix + Mailscanner probs - sorted
Message-ID: <FB50AA0C8E7D5344A761C40BC70574290536A0@exchangeserver.winckworths.co.uk>

sorry guys - I guess I am getting tyred. I found the problem and cant
believe its taken me so long to spot it.

/etc/postfix.in/main.cf had an extra defer_transports line at the end of the
file which was blank.

All sorted now!

Sam

-----Original Message-----
From: Samuel Luxford-Watts [mailto:slwatts@WINCKWORTHS.CO.UK]
Sent: 03 July 2003 15:25
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: postfix + Mailscanner probs


Hi All,

This is probably a REALLY dumb question, but at the moment I cannot see why
this is happening.....

I followed through all the instructions for getting suse, postfix and
mailscanner running. All seemed to work fine, but I couldnt figure out why
mailscanner wasnt stripping viruses from attachments.

In the end I stopped all the services, then ran

postfix -c /etc/postfix.in start

This to my mind should only start the inbound mail process, so the server
receives emails and stores them in /var/spool/postfix.in. Well on my server
its actually forwarding the mail as well.

I have checked for the defer_transports line and that is present and correct
in /etc/postfix.in/main.cf.

The only thing I can think of is that I have altered /etc/postfix/transports
to read:

dest.test        smtp:[192.168.25.95]

where dest.test is my internal test mail domain and the ip address is of our
test exchange server. my /etc/postfix.in/main.cf file is still pointing to
/etc/postfix various files. I am trying to configure an email gateway which
is listed as a primary MX host for our domain, filters and strips
viruses/spam and forwards those emails to our exchange server. if I do not
add this line to transport then I get a mail loop error because the
mailscanner server thinks its the best MX host for dest.test.

Any help would be great,

Thanks,

Sam

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030703/f8ec6e2e/attachment.html
From mailscanner at ecs.soton.ac.uk  Thu Jul  3 16:32:35 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:49 2006
Subject: Spam reports
In-Reply-To: <200307031316.h63DGdS14689@ori.rl.ac.uk>
Message-ID: <5.2.0.9.2.20030703163133.04484380@imap.ecs.soton.ac.uk>

Currently the short answer is "no".
Drop me a line near the end of July and I'll try to write something for you
for the next release. No point mailing me now about it as I'll forget by
the time I come back from Canada.

At 15:15 03/07/2003, you wrote:
>I've scanned the list archives, but could not find an answer to my
>question, so I'll post it here. Thanks in advance to all help provided.
>
>In the two reports:
>   sender.spam.report.txt
>   sender.spam.sa.report.txt
>
>That get sent to an allegged spammer as a result of a bounce spam action
>that had a SA score above the threshold, is there any means to include the
>SA report in the message body? I'd like the emailed report to include a
>typical report like:
>   SpamCheck: spam, SpamAssassin (score=9.4, required 5,
>         CLICK_BELOW 0.10, HTML_80_90 0.54, HTML_FONT_BIG 0.27,
>         HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_RED 0.10,
>         HTML_MESSAGE 0.10, IMPOTENCE 2.90, MIME_HTML_ONLY 0.10,
>         MSGID_GOOD_EXCHANGE -0.38, OBFUSCATING_COMMENT 2.60,
>         PENIS_ENLARGE 1.39, PENIS_ENLARGE2 1.29, REMOVE_PAGE 0.27)
>
>I thought including the '$spamreport' in the body of the report template
>would do the trick, but all I'm seeing is:
>    "spam, SpamAssassin" in the report where the variable was placed, the
> actual triggers and scores are missing.
>
>Thanks!

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 16:25:19 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:49 2006
Subject: directory containing all the reports in all the languages
In-Reply-To: <Pine.LNX.4.44.0307031403330.18949-100000@raveon.barendse.t o>
Message-ID: <5.2.0.9.2.20030703162442.05147f98@imap.ecs.soton.ac.uk>

No, because the default seting for each of the reports is
         %report-dir%/deleted.filename.message.txt
for example, so the %report-dir% should contain the language code as well.

At 13:05 03/07/2003, you wrote:
>Just noticed this new option in the MailScanner.conf file:
>
># Set the directory containing all the reports in all the languages
>%report-dir% = /etc/MailScanner/reports/en
>
>
>Shouldn't this be set to :
>/etc/MailScanner/reports
>as default?
>
>Or is this the option for the defualt language directory if no specific
>language is defined for a top level domain??

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 16:26:23 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:49 2006
Subject: ANNOUNCE: Version 4.22-5 released
In-Reply-To: <Pine.LNX.4.44.0307031650500.18949-100000@raveon.barendse.t o>
References: <3F041D4E.1020306@spawar.navy.mil>
Message-ID: <5.2.0.9.2.20030703162556.0448de70@imap.ecs.soton.ac.uk>

At 15:53 03/07/2003, you wrote:
>Have just checked but still the spam black whistelists aren't properly
>lowered?
>
>I still need to make duplicate entries for some domains because different
>servers on the other side display the sender domain in different casing.
>
>I still have to make two entries to whitelist for example:
>
>From:           @domain.com                     yes
>From:           @DOMAIN.com                     yes
>
>Thought that the domain part for the black/whitelist would be made case
>insensitive?

I can't figure this one out, as the check is made case-insensitive in at 3
different ways already.
:-(


>On Thu, 3 Jul 2003, Ron Broersma wrote:
>
> > Julian,
> >
> > Thanks for the quick fix.  RBL checking is working again without the
> > other file hacks.
> >
> > You might want to check that mcafee-autoupdate script.  I had to remove
> > all the embedded /r characters (every line) before it would work without
> > complaint.  Also had to set LIBDIR and FTPDIR back to the defaults where
> > they were before.
> >
> > --Ron
> >
> > Julian Field wrote:
> > > I have fixed the bug below, and I think it warrants another release
> as this
> > > will have stopped everyone's RBL lists from working unless you
> convert them
> > > all to lower-case.
> > >
> > > The only other changes are
> > > - improve the efficiency of the filetype checking
> > > - add Tony Finch's improved mcafee-autoupdate script
> > >
> > > Download from the usual place at www.mailscanner.info
> > >
> > > Sorry folks :-(
> > >
> > > At 11:10 03/07/2003, you wrote:
> > >
> > >> Hi!
> > >>
> > >> > Strange, RBL checks stopped happening.  Turning on some debug revealed
> > >> > that none of the entries in the Spam Lists file (spam.lists.conf) were
> > >> > being found due to case mismatch.  Changing everything in
> > >> > spam.lists.conf to lower case fixed the problem and RBL checks are
> > >> > happening again for me.
> > >> >
> > >> > My guess is that the following has something to do with this...
> > >> >  > * Fixes *
> > >> >  > - RBLs are converted to lower-case when read from MailScanner.conf.
> > >> >
> > >>
> > >> Yes, i can confirm this, i upgraded and since that no matches were
> > >> made on
> > >> the Easynet lists i use, after changing to lowercase in the
> > >> spam.lists.conf they are comming in again straight away.
> > >>
> > >> Julian, time for a quick fix i guess :))
> > >>
> > >> Bye,
> > >> Raymond.
> > >
> > >
> > > --
> > > Julian Field
> > > www.MailScanner.info
> > > MailScanner thanks transtec Computers for their support
> >

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From P.G.M.Peters at utwente.nl  Thu Jul  3 16:59:20 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:49 2006
Subject: MailScanner presentation
Message-ID: <1jk8gv4sa2od4mrv1sinhtsjoss0s7eia7@4ax.com>

Julian,

You told you have held a presentation at a JANET meeting. At the end of
September a meeting of European SCIRT's (TF-CSIRT) is held in Amsterdam.

Could you be persuaded to come and have a presentation on that meeting?

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From P.G.M.Peters at utwente.nl  Thu Jul  3 17:01:21 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:49 2006
Subject: MailScanner presentation
In-Reply-To: <1jk8gv4sa2od4mrv1sinhtsjoss0s7eia7@4ax.com>
References: <1jk8gv4sa2od4mrv1sinhtsjoss0s7eia7@4ax.com>
Message-ID: <tnk8gvcrqmgu3qcfthrhn52tamprtsd8ef@4ax.com>

Oops. This should go to Julian directly but I copied the wrong address.
Mailscanner in both local parts is confusing.

On Thu, 3 Jul 2003 17:59:20 +0200, I wrote:

>You told you have held a presentation at a JANET meeting. At the end of
>September a meeting of European SCIRT's (TF-CSIRT) is held in Amsterdam.
                                 CSIRT's

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From raymond at PROLOCATION.NET  Thu Jul  3 17:04:23 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:49 2006
Subject: MailScanner presentation
In-Reply-To: <tnk8gvcrqmgu3qcfthrhn52tamprtsd8ef@4ax.com>
Message-ID: <Pine.LNX.4.44.0307031802160.15519-100000@mailbox.prolocation.net>

Hi!

> Oops. This should go to Julian directly but I copied the wrong address.
> Mailscanner in both local parts is confusing.
>
> On Thu, 3 Jul 2003 17:59:20 +0200, I wrote:
>
> >You told you have held a presentation at a JANET meeting. At the end of
> >September a meeting of European SCIRT's (TF-CSIRT) is held in Amsterdam.

 =)

Julian, if you can come over i will buy you a couple of Beers :)
I most likely will join the TF-CSIRT meeting also.

Bye,
Raymond.

From ka at PACIFIC.NET  Thu Jul  3 17:12:16 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:49 2006
Subject: CustomConfig.pm questions
Message-ID: <3F0455E0.7050003@pacific.net>

Hello,

I am working with CustomConfig.pm, setting up per-user configs, and have
a couple questions.

When I reload MailScanner, I don't see an indication in the log that the
rulesets were reloaded, so I'm assuming they are not?

If not, I'll need to 'restart' rather than 'reload' MailScanner. :-(

Is there a way modify MailScanner to call InitBy.... functions in
CustomConfig.pm upon reload?


Thanks,
Ken A.
Pacific.Net

From Kevin_Miller at CI.JUNEAU.AK.US  Thu Jul  3 16:42:55 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:49 2006
Subject: DSN: Return receipt ??
Message-ID: <08146035CA49D6119A36009027AC822A0264E46E@CITY-EXCH-NTS>

Ah - after chewing on your reply for a couple minutes I think you hit the
nail on the head.  It's the client that's doing it, not Exchange.  We're
using Exange 5.5 & LookOut 2000, so we're a bit behind you version wise, but
I just checked my client and turned off automatic processing of requests &
responses on arrival.  It would make sense that the client is where the
reply would generate from, not the server as the server may not know when
the message is actually read - just when it's retrieved.

So I guess egress filtering on auto-replies is the only practical option
unless you force all users to use a stock client profile where the
auto-replies have been disabled.  Not sure if the best place to filter is in
Sendmail or MailScanner - to new to both to make an intelligent guess, but
maybe others here can chime in...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500


>-----Original Message-----
>From: Remco Barendse [mailto:mailscanner@barendse.to]
>Sent: Thursday, July 03, 2003 12:07 AM
>To: MailScanner mailing list
>Cc: Kevin Miller
>Subject: Re: DSN: Return receipt ??
>
>
>Tried that already, i think (suspect!) that the only thing
>that that tab
>kills are the messages : "Your message has been successfully
>delivered to"
>for most (certainly not all, see the status reply because of which I
>started this thread) messages.
>
>There is absolutely no way to disable read/not read messages,
>at least not
>when your clients on Exchange are running Outlook 2000. Outlook XP
>supposedly has an option to disable this 'feature'. I even tried
>installing Microgarden Outlook Tools for Outlook 2000 but this
>only helped
>for about half of the messages received, for the other half
>Outlook was
>still happily reporting which e-mail went where and who read it.
>
>This is why I chose to kill the messages of based on subject
>headers. Even
>if the client could disable it I don't want to rely on my
>users to disable
>this feature to prevent leaking any information. I don't want
>anybody to
>know when my users read their e-mail, it's kind of embarrasing if a
>scretary says someone is out of office but they get a read
>receipt message
>a couple of minutes later on an e-mail they sent.
>
>I just checked my maillog after setting the options
>define(`confPRIVACY_FLAGS',
>`authwarnings,goaway,noreceipts,restrictqrun,restrictexpand')dnl
>
>in my sendmail.mc but I still see read/not read messages being
>discarded.
>
>I hope that this line in sendmail.mc does kill the last of the
>annoying
>successfully delivered/could not be delivered to messages.

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 17:37:52 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:49 2006
Subject: CustomConfig.pm questions
In-Reply-To: <3F0455E0.7050003@pacific.net>
Message-ID: <5.2.1.1.2.20030703173621.01fad590@imap.ecs.soton.ac.uk>

At 17:12 03/07/2003, you wrote:
>Hello,
>
>I am working with CustomConfig.pm, setting up per-user configs, and have
>a couple questions.
>
>When I reload MailScanner, I don't see an indication in the log that the
>rulesets were reloaded, so I'm assuming they are not?
>
>If not, I'll need to 'restart' rather than 'reload' MailScanner. :-(

You need to "restart" as the changing code in CustomConfig.pm has to be
recompiled.

>Is there a way modify MailScanner to call InitBy.... functions in
>CustomConfig.pm upon reload?

Ok, see your point. Let me take a quick look at this.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 17:40:18 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:49 2006
Subject: CustomConfig.pm questions
In-Reply-To: <3F0455E0.7050003@pacific.net>
Message-ID: <5.2.1.1.2.20030703173951.039a89e8@imap.ecs.soton.ac.uk>

At 17:12 03/07/2003, you wrote:
>Hello,
>
>I am working with CustomConfig.pm, setting up per-user configs, and have
>a couple questions.
>
>When I reload MailScanner, I don't see an indication in the log that the
>rulesets were reloaded, so I'm assuming they are not?
>
>If not, I'll need to 'restart' rather than 'reload' MailScanner. :-(
>
>Is there a way modify MailScanner to call InitBy.... functions in
>CustomConfig.pm upon reload?

According to the code I just looked at, it should call the Init functions
even when you do a "reload".
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From ka at PACIFIC.NET  Thu Jul  3 18:11:37 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:49 2006
Subject: CustomConfig.pm questions
In-Reply-To: <5.2.1.1.2.20030703173951.039a89e8@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030703173951.039a89e8@imap.ecs.soton.ac.uk>
Message-ID: <3F0463C9.7080907@pacific.net>

Ah, yes, I do see the log entries! Not sure how I missed them before,
but they ARE there!


host# /sbin/service MailScanner reload
Reloading MailScanner workers:
          MailScanner:       [  OK  ]

Jul  3 10:05:02 mailfilter MailScanner[23313]: Read blacklist for 1 emails


Thanks,
Ken A.
Pacific.Net


Julian Field wrote:
> At 17:12 03/07/2003, you wrote:
>
>> Hello,
>>
>> I am working with CustomConfig.pm, setting up per-user configs, and have
>> a couple questions.
>>
>> When I reload MailScanner, I don't see an indication in the log that the
>> rulesets were reloaded, so I'm assuming they are not?
>>
>> If not, I'll need to 'restart' rather than 'reload' MailScanner. :-(
>>
>> Is there a way modify MailScanner to call InitBy.... functions in
>> CustomConfig.pm upon reload?
>
>
> According to the code I just looked at, it should call the Init functions
> even when you do a "reload".
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>
>

From peter at UCGBOOK.COM  Thu Jul  3 18:21:10 2003
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:18:49 2006
Subject: MailScanner 101, take two.
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E468@CITY-EXCH-NTS>
References: <08146035CA49D6119A36009027AC822A0264E468@CITY-EXCH-NTS>
Message-ID: <3F046606.3070408@ucgbook.com>

For AV you could always use ClamAV that is completely free. Recent posts
on the list has it that CA eTrust is legit to run with a $28 workstation
license. That might also be interesting.

ClamAV scans faster than F-Prot in my tests. It's also covered by
MailScanners signature-updating script but you should update the program
from time to time. But you can forget about the check instead! :)

Check this for more info:

http://www.sng.ecs.soton.ac.uk/mailscanner/install/OS-virus-scan-web.htm

/Peter Bonivart

--Unix lovers do it in the Sun

Kevin Miller wrote:

> For the antivirus I got a copy of F-Prot, but then they changed the license.
> Aargh.  A grand more to do the same thing.  So I'm looking at a different
> antivirus solution now, probably RAV.  I don't mind paying for
> support/updates and I thought the original $300 F-prot cost was quite
> reasonable, but the new scheme isn't exactly competitive.  Does RAV auto
> update both the signatures and the program?  I want something I can put in
> and ignore until it's time to send 'em another check in a year.  A friend is
> using Sophos, and he says he has to put in a new user license quarterly or
> some such.  Life's too short for that.  All the docs seem to refer to
> installing Sophos as a step however.  Can I presume that I can substitute
> whatever flavor of antivirus there and *not* have to install Sophos?

From paul.hamilton at sme-ecom.co.uk  Thu Jul  3 18:47:54 2003
From: paul.hamilton at sme-ecom.co.uk (Paul Hamilton)
Date: Thu Jan 12 21:18:49 2006
Subject: Banning Character Sets
Message-ID: <000801c3418b$3dce5da0$fc32000a@4>

Hi All,

We have seen a useful feature in GFI's Spam Filter Software.
They provide the client with the ability to ban character sets.
Is it possible to do this with Spamassassin by domain?
or as a feature request could the Blacklist functionality be extended
to ban specific character sets per domain?

As an example a client of ours is able to ban all emails containing any
Chinese characters, they stop in the region of 250 emails a day at their
Exchange server this way. They come from multiple sources so adding to
the SA Blacklist is not desirable to the client.

Thanks in advance

Paul H

From Kevin_Miller at CI.JUNEAU.AK.US  Thu Jul  3 19:09:15 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:49 2006
Subject: MailScanner 101, take two.
Message-ID: <08146035CA49D6119A36009027AC822A0264E472@CITY-EXCH-NTS>

Thanks.  Earlier posts (month or two ago I think) indicated that they
weren't the quickest off the line with updates, but one or two posts isn't a
very big statistical sample!  So, how satisfied have you ClamAV users been
with the pattern updates?  Do they come in in a timely fashion?

TIA...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500


>-----Original Message-----
>From: Peter Bonivart [mailto:peter@UCGBOOK.COM]
>Sent: Thursday, July 03, 2003 9:21 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner 101, take two.
>
>
>For AV you could always use ClamAV that is completely free.
>Recent posts
>on the list has it that CA eTrust is legit to run with a $28
>workstation
>license. That might also be interesting.
>
>ClamAV scans faster than F-Prot in my tests. It's also covered by
>MailScanners signature-updating script but you should update
>the program
>from time to time. But you can forget about the check instead! :)
>
>Check this for more info:
>
>http://www.sng.ecs.soton.ac.uk/mailscanner/install/OS-virus-sca
>n-web.htm
>
>/Peter Bonivart
>
>--Unix lovers do it in the Sun
>
>Kevin Miller wrote:
>
>> For the antivirus I got a copy of F-Prot, but then they
>changed the license.
>> Aargh.  A grand more to do the same thing.  So I'm looking
>at a different
>> antivirus solution now, probably RAV.  I don't mind paying for
>> support/updates and I thought the original $300 F-prot cost was quite
>> reasonable, but the new scheme isn't exactly competitive.
>Does RAV auto
>> update both the signatures and the program?  I want
>something I can put in
>> and ignore until it's time to send 'em another check in a
>year.  A friend is
>> using Sophos, and he says he has to put in a new user
>license quarterly or
>> some such.  Life's too short for that.  All the docs seem to refer to
>> installing Sophos as a step however.  Can I presume that I
>can substitute
>> whatever flavor of antivirus there and *not* have to install Sophos?
>

From kevins at BMRB.CO.UK  Thu Jul  3 19:34:25 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:49 2006
Subject: MailScanner 101, take two.
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C7A@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C7A@pascal.priv.bmrb.co.uk>
Message-ID: <1057257268.26826.16.camel@bach.kevinspicer.co.uk>

>  So, how satisfied have you ClamAV users been
>  with the pattern updates?  Do they come in in a timely fashion?

I'm not sure  you need a big statistical sample to determine that their
updates aren't as timely as they could be (You would ned a big sample to
determine that their updates are good however).

In my experience Clam has some good features but also some serious
limitations...

Can't disinfect files (not such a big problem with the current crop of
viruses which don't actually infect current files)

Updates are not as swift as many commercial vendors.  Most of the recent
fast-spreading viruses I've seen picked up by Sophos hours or even days
before clam (although I did see one varient that was caught by clam
before Sophos). I saw somewhere (their mailing list/ site I think) that
they aim to update their definitions several times a week (I like mine
updated several times a day - whenever a new virus appears)

Their site hasn't been the most reliable, but there are more mirrors now
and the latest versions automatically use the mirrors.

Several of us experienced problems over the last few days with clam
updates failing and completely stopping MailScanner.

I believe I've said this before, and I'll probably say it again, Clam is
useful as a second virus scanner (for insurance should the first pack
up) but at the moment you should still use a commercial solution.

Is an aside its interesting how Clam gets its definitions, their is a
tool in the clam distribution for generating signatures which relies on
it being fed a known infected file, it then feeds portions of the file
into a commercial virus scanner until it finds the exact portion of the
file that generates a hit on the commercial scanner.  The definition is
then generated from this portion.  I don't know if they do any other
virus research, but this did strike me as perhaps a little cheeky
(although I would guess the commercial vendors probably monitor each
others definitions quite closely).




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From kevins at BMRB.CO.UK  Thu Jul  3 19:49:57 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:49 2006
Subject: Banning Character Sets
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C79@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C79@pascal.priv.bmrb.co.uk>
Message-ID: <1057258197.26824.23.camel@bach.kevinspicer.co.uk>

>We have seen a useful feature in GFI's Spam Filter Software.
>They provide the client with the ability to ban character sets.
>Is it possible to do this with Spamassassin by domain?
>or as a feature request could the Blacklist functionality be extended
>to ban specific character sets per domain?

Its possible to configure SA to add a score based on character set and/
or language (ok_locales and ok_languages in spam.assassin.prefs.conf -
check the Spamassassin docs
http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html )
Its not clear from the MailScanner.conf file whether you can make the
setting for SpamAssassin Prefs File a ruleset or not, but if you could
thatb would do what you want.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 19:51:24 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB66@mail.winnefox.org>

Hello,

I'm trying to setup a redhat server that takes all incoming mail and
then forwards it on to an exchange server. I've got sendmail setup,
MailScanner, and spamassassin, and I am able to send mail out. My
problem is, it's not getting mail and forwarding it on. I've got the mx
record setup properly. My question is, does Sendmail automatically
listen on all IP addresses? Is there something else I should be looking
at?


--
Jody Cleveland
(cleveland@mail.winnefox.org)

From mbowman at UDCOM.COM  Thu Jul  3 19:53:25 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
Message-ID: <OFDCFCF48E.C2F7B6A7-ON85256D58.0067A6D1-85256D58.0067F80E@udcomm.net>

Jody,

Have you setup your /etc/mail//mailertable ?

For example

anyolddomain.tld                esmtp:[mail.anynewdomain.tld]

---
Matthew K Bowman Systems Administrator, UDCom





Jody Cleveland <Cleveland@MAIL.WINNEFOX.ORG>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
07/03/2003 02:51 PM
Please respond to MailScanner mailing list


        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Why won't my mail forward?


Hello,

I'm trying to setup a redhat server that takes all incoming mail and
then forwards it on to an exchange server. I've got sendmail setup,
MailScanner, and spamassassin, and I am able to send mail out. My
problem is, it's not getting mail and forwarding it on. I've got the mx
record setup properly. My question is, does Sendmail automatically
listen on all IP addresses? Is there something else I should be looking
at?


--
Jody Cleveland
(cleveland@mail.winnefox.org)

From kevins at BMRB.CO.UK  Thu Jul  3 19:57:05 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C7D@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C7D@pascal.priv.bmrb.co.uk>
Message-ID: <1057258625.26826.28.camel@bach.kevinspicer.co.uk>

> My question is, does Sendmail automatically
> listen on all IP addresses?

netstat -l | grep smtp

should give you this....
tcp        0      0 *:smtp             *:*              LISTEN

Which means its okay, but if you get this...
tcp        0      0 localhost:smtp           *:*                 LISTEN

or something similar then its only listening on the loopback interface




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mbowman at UDCOM.COM  Thu Jul  3 20:01:30 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:49 2006
Subject: Message Size
Message-ID: <OFE75BE2E5.73EC0D8D-ON85256D58.006845F7-85256D58.0068B5C7@udcomm.net>

I also think it would be a better idea to have more specific subjects

E.g. {SPAM? - FORM TAG}, {VIRUS? - REJECTED FILE TYPE), {VIRUS? - INFECTED
E-MAIL}

That sort of thing



Matthew





Alan Fiebig <mailscanner@ELKNET.NET>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
07/03/2003 03:53 PM
Please respond to MailScanner mailing list


        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Message Size


First, I don't want to sound ungrateful, I really do appreciate the new
feature to filter on total message size.

However, when a message is over the set size, MailScanner tags the subject
line with the {Virus} tag, and the report message to the receipient is the
virus removal message. Likewise, the report back to the sender appears to
be the 'Sender Error Report'.

These messages are a bit misleading. If the 'Maximum Message Size' filter
doesn't warrant having its own tag, report to receipient, and report to
sender, could you perhaps have that trigger use the 'Bad filename' report,
'Sender Bad Filename' report, and 'Filename Subject Text' tag instead?
Those make a bit more sense.

Thanks!
-Alan

From mike at CAMAROSS.NET  Thu Jul  3 20:11:54 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
In-Reply-To: <OFDCFCF48E.C2F7B6A7-ON85256D58.0067A6D1-85256D58.0067F80E@udcomm.net>
Message-ID: <00b501c34196$f78a6d50$9c01a8c0@home.middlefinger.net>

Additionally, you need to add your domain to /etc/mail/relay-domains

Make sure you run 'make' in the /etc/mail directory after modifying the
mailertable.

Also, see if you can telnet to port 25 of your redhat box from another
workstation.  By default, sendmail is set to listen on 127.0.0.1 only.  Take
a look at /etc/mail/sendmail.mc

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Matthew Bowman
Sent: Thursday, July 03, 2003 1:53 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Why won't my mail forward?


Jody,

Have you setup your /etc/mail//mailertable ?

For example

anyolddomain.tld                esmtp:[mail.anynewdomain.tld]

---
Matthew K Bowman Systems Administrator, UDCom





Jody Cleveland <Cleveland@MAIL.WINNEFOX.ORG>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK> 07/03/2003
02:51 PM Please respond to MailScanner mailing list


        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Why won't my mail forward?


Hello,

I'm trying to setup a redhat server that takes all incoming mail and then
forwards it on to an exchange server. I've got sendmail setup, MailScanner,
and spamassassin, and I am able to send mail out. My problem is, it's not
getting mail and forwarding it on. I've got the mx record setup properly. My
question is, does Sendmail automatically listen on all IP addresses? Is
there something else I should be looking at?


--
Jody Cleveland
(cleveland@mail.winnefox.org)


From mailscanner at ELKNET.NET  Thu Jul  3 20:53:08 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:18:49 2006
Subject: Message Size
Message-ID: <200307031858.h63IwgS01221@ori.rl.ac.uk>

First, I don't want to sound ungrateful, I really do appreciate the new feature to filter on total message size.

However, when a message is over the set size, MailScanner tags the subject line with the {Virus} tag, and the report message to the receipient is the virus removal message. Likewise, the report back to the sender appears to be the 'Sender Error Report'.

These messages are a bit misleading. If the 'Maximum Message Size' filter doesn't warrant having its own tag, report to receipient, and report to sender, could you perhaps have that trigger use the 'Bad filename' report, 'Sender Bad Filename' report, and 'Filename Subject Text' tag instead? Those make a bit more sense.

Thanks!
-Alan

From kevins at BMRB.CO.UK  Thu Jul  3 20:12:04 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C81@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C81@pascal.priv.bmrb.co.uk>
Message-ID: <1057259525.26824.32.camel@bach.kevinspicer.co.uk>

On Thu, 2003-07-03 at 20:03, Jody Cleveland wrote:

> netstat -l | grep smtp

>I get this:
>tcp        0      0 wals.lib.wi.us:smtp     *:*
>LISTEN

>Which is correct, but mail still isn't going through.

>Jody

Just to double check, do...

netstat -ln | grep 25





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 20:15:06 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB69@mail.winnefox.org>

> Just to double check, do...
>
> netstat -ln | grep 25

tcp        0      0 199.242.176.174:25      0.0.0.0:*
LISTEN
unix  2      [ ACC ]     STREAM     LISTENING     61125
/tmp/orbit-cleveland/linc-17aa-0-3848c04ca4212
unix  2      [ ACC ]     STREAM     LISTENING     61169
/tmp/orbit-cleveland/linc-17ae-0-8d63eec325c8

From mailscanner at BARENDSE.TO  Thu Jul  3 20:14:57 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:49 2006
Subject: DSN: Return receipt ??
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E46E@CITY-EXCH-NTS>
Message-ID: <Pine.LNX.4.44.0307032109050.18949-100000@raveon.barendse.to>

If your users are on Outlook 2000 too there is no way to disable the DSN
messages (both read/unread and successfully delivered etc).

It's only possible to do this in Outlook 2000 if you are using it in
'internet mode' where it is simply popping mail from the exchange server
and sending via smtp. If you are using Workgroup mode (or whatever it's
called) than the option to disable DSN is not available.

This caused me several headaches. MicroGarden Outlook Tools (free app,
google is your friend) was only filtering half the crap.

I think Julian had a look at the annoying, privacy invading, DSN messages
from Exchange/Outlook but it never made it into MailScanner itself.
Anyways the read receipts can be efficiently killed off using sendmail
rules although this also blocks incoming DSN messages if you are using
them.

I can post the sendmail rules to filter the crap if interested.

The successfully delivered stuff can be killed from within Exchange (at
least in 99% of the cases) using the tick box in the earlier mail.


On Thu, 3 Jul 2003, Kevin Miller wrote:

> Ah - after chewing on your reply for a couple minutes I think you hit the
> nail on the head.  It's the client that's doing it, not Exchange.  We're
> using Exange 5.5 & LookOut 2000, so we're a bit behind you version wise, but
> I just checked my client and turned off automatic processing of requests &
> responses on arrival.  It would make sense that the client is where the
> reply would generate from, not the server as the server may not know when
> the message is actually read - just when it's retrieved.
>
> So I guess egress filtering on auto-replies is the only practical option
> unless you force all users to use a stock client profile where the
> auto-replies have been disabled.  Not sure if the best place to filter is in
> Sendmail or MailScanner - to new to both to make an intelligent guess, but
> maybe others here can chime in...
>
> ...Kevin
> -------------------
> Kevin Miller                Registered Linux User No: 307357
> CBJ MIS Dept.               Network Systems Administrator, Mail
> Administrator
> 155 South Seward Street     ph: (907) 586-0242
> Juneau, Alaska 99801        fax: (907 586-4500
>
>
> >-----Original Message-----
> >From: Remco Barendse [mailto:mailscanner@barendse.to]
> >Sent: Thursday, July 03, 2003 12:07 AM
> >To: MailScanner mailing list
> >Cc: Kevin Miller
> >Subject: Re: DSN: Return receipt ??
> >
> >
> >Tried that already, i think (suspect!) that the only thing
> >that that tab
> >kills are the messages : "Your message has been successfully
> >delivered to"
> >for most (certainly not all, see the status reply because of which I
> >started this thread) messages.
> >
> >There is absolutely no way to disable read/not read messages,
> >at least not
> >when your clients on Exchange are running Outlook 2000. Outlook XP
> >supposedly has an option to disable this 'feature'. I even tried
> >installing Microgarden Outlook Tools for Outlook 2000 but this
> >only helped
> >for about half of the messages received, for the other half
> >Outlook was
> >still happily reporting which e-mail went where and who read it.
> >
> >This is why I chose to kill the messages of based on subject
> >headers. Even
> >if the client could disable it I don't want to rely on my
> >users to disable
> >this feature to prevent leaking any information. I don't want
> >anybody to
> >know when my users read their e-mail, it's kind of embarrasing if a
> >scretary says someone is out of office but they get a read
> >receipt message
> >a couple of minutes later on an e-mail they sent.
> >
> >I just checked my maillog after setting the options
> >define(`confPRIVACY_FLAGS',
> >`authwarnings,goaway,noreceipts,restrictqrun,restrictexpand')dnl
> >
> >in my sendmail.mc but I still see read/not read messages being
> >discarded.
> >
> >I hope that this line in sendmail.mc does kill the last of the
> >annoying
> >successfully delivered/could not be delivered to messages.
>

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 20:19:10 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB6A@mail.winnefox.org>

> Additionally, you need to add your domain to /etc/mail/relay-domains
>
> Make sure you run 'make' in the /etc/mail directory after
> modifying the mailertable.

I had done that all ready.

> Also, see if you can telnet to port 25 of your redhat box
> from another workstation.

I did that, and this is what came up:
220 wals.lib.wi.us ESMTP Sendmail 8.12.8/8.12.8; Thu, 3 Jul 2003
14:17:46 -0500

Jody

From kevins at BMRB.CO.UK  Thu Jul  3 20:21:21 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C85@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C85@pascal.priv.bmrb.co.uk>
Message-ID: <1057260081.26826.36.camel@bach.kevinspicer.co.uk>

On Thu, 2003-07-03 at 20:15, Jody Cleveland wrote:

> Just to double check, do...
>
> netstat -ln | grep 25

>tcp        0      0 199.242.176.174:25      0.0.0.0:*
>LISTEN

Yeah, thats correct (assuming thats your public IP).  Is there a
firewall in the way, or have you got iptables misconfigured (see if
theres any iptables logs relating to port 25 in /var/log/messages)

As Mike suggested try connecting to port 25 remotely using telnet.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 20:17:47 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:49 2006
Subject: Message Size
In-Reply-To: <200307031858.h63IwgS01221@ori.rl.ac.uk>
Message-ID: <5.2.1.1.2.20030703201407.03c9f8e0@imap.ecs.soton.ac.uk>

At 20:53 03/07/2003, you wrote:
>First, I don't want to sound ungrateful, I really do appreciate the new
>feature to filter on total message size.
>
>However, when a message is over the set size, MailScanner tags the subject
>line with the {Virus} tag, and the report message to the receipient is the
>virus removal message. Likewise, the report back to the sender appears to
>be the 'Sender Error Report'.
>
>These messages are a bit misleading. If the 'Maximum Message Size' filter
>doesn't warrant having its own tag, report to receipient, and report to
>sender, could you perhaps have that trigger use the 'Bad filename' report,
>'Sender Bad Filename' report, and 'Filename Subject Text' tag instead?
>Those make a bit more sense.

Can you double check that you don't get the bad filename report please? It
adds the same type of report to the message as the filename checks.

To prove the point, the filename checks do this:
             MailScanner::Log::InfoLog("Filename Checks: %s (%s)",
                                       $logtext, $attach);
             $message->{namereports}{$safename} .= "$usertext ($safename)\n";
             $message->{nametypes}{$safename}   .= "f";
             $counter++;
             $message->{nameinfected}++;
while the filetype checks do this:
           MailScanner::Log::InfoLog("Filetype Checks: %s (%s)",
                                     $logtext, $attach);
           $message->{namereports}{$safename} .= "$usertext ($safename)\n";
           $message->{nametypes}{$safename}   .= "f";
           $counter++;
           $message->{nameinfected}++;

You may notice a slight similarity in the code...
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mike at CAMAROSS.NET  Thu Jul  3 20:21:44 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB6A@mail.winnefox.org>
Message-ID: <00b901c34198$5758d5e0$9c01a8c0@home.middlefinger.net>

Looks like there is a firewall in the way as I am not able to connect to
your IP port 25.

What you should do is set the primary MX to be the IP of your sendmail
server and then it will forward all mail (based on the mailertable entry) to
your exchange server.

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Jody Cleveland
Sent: Thursday, July 03, 2003 2:19 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Why won't my mail forward?


> Additionally, you need to add your domain to /etc/mail/relay-domains
>
> Make sure you run 'make' in the /etc/mail directory after modifying 
> the mailertable.

I had done that all ready.

> Also, see if you can telnet to port 25 of your redhat box from another 
> workstation.

I did that, and this is what came up:
220 wals.lib.wi.us ESMTP Sendmail 8.12.8/8.12.8; Thu, 3 Jul 2003 14:17:46
-0500

Jody


From richard.lush at NTLWORLD.COM  Thu Jul  3 20:28:08 2003
From: richard.lush at NTLWORLD.COM (Richard Lush)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
Message-ID: <8C4A83966C27354C928048C4A1620EF88F18@lando.rebel.com>

Jody,

Is the mail getting bounced back from exchange or is it just not getting
there?

Richard 


-----Original Message-----
From: Jody Cleveland [mailto:Cleveland@MAIL.WINNEFOX.ORG] 
Sent: 03 July 2003 19:51
To: MAILSCANNER@JISCMAIL.AC.UK

Hello,

I'm trying to setup a redhat server that takes all incoming mail and
then forwards it on to an exchange server. I've got sendmail setup,
MailScanner, and spamassassin, and I am able to send mail out. My
problem is, it's not getting mail and forwarding it on. I've got the mx
record setup properly. My question is, does Sendmail automatically
listen on all IP addresses? Is there something else I should be looking
at?


--
Jody Cleveland
(cleveland@mail.winnefox.org)


From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 20:30:27 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB6E@mail.winnefox.org>

> Is the mail getting bounced back from exchange or is it just
> not getting there?

It gets lost into oblivion. I don't get any bounced messages back, and
the message never reaches the destination.

Jody

From mike at CAMAROSS.NET  Thu Jul  3 20:37:59 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:49 2006
Subject: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB6E@mail.winnefox.org>
Message-ID: <00bd01c3419a$9c094c90$9c01a8c0@home.middlefinger.net>

What happens if you run 'mailq' on the sendmail server?

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Jody Cleveland
Sent: Thursday, July 03, 2003 2:30 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Why won't my mail forward?


> Is the mail getting bounced back from exchange or is it just not 
> getting there?

It gets lost into oblivion. I don't get any bounced messages back, and the
message never reaches the destination.

Jody


From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 20:42:39 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB70@mail.winnefox.org>

> What happens if you run 'mailq' on the sendmail server?

/var/spool/mqueue is empty
                Total requests: 0

Also, I had the network admin open port 25 on that machine, but still no
go.

Jody

From kevins at BMRB.CO.UK  Thu Jul  3 20:43:03 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C8C@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C8C@pascal.priv.bmrb.co.uk>
Message-ID: <1057261386.29329.1.camel@bach.kevinspicer.co.uk>

>It gets lost into oblivion. I don't get any bounced messages back, and
>the message never reaches the destination.

So it gets accepted?

Is there anything in mqueue.in or mqueue?

What does it say in the maillog?






BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mike at CAMAROSS.NET  Thu Jul  3 20:45:07 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB70@mail.winnefox.org>
Message-ID: <00bf01c3419b$9b74df50$9c01a8c0@home.middlefinger.net>

I am able to connect now, but this doesn't look like a normal sendmail
response:

telnet 199.242.176.174 25
Trying 199.242.176.174...
Connected to 199.242.176.174 (199.242.176.174).
Escape character is '^]'.
220
*********************************2******2***************200************0*00

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Jody Cleveland
Sent: Thursday, July 03, 2003 2:43 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Why won't my mail forward?


> What happens if you run 'mailq' on the sendmail server?

/var/spool/mqueue is empty
                Total requests: 0

Also, I had the network admin open port 25 on that machine, but still no go.

Jody


From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 20:53:00 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB71@mail.winnefox.org>

> So it gets accepted?

Seems to.

> Is there anything in mqueue.in or mqueue?

No.

> What does it say in the maillog?

A lot of mailscanner stuff about starting, and f-prot updating. Also,
this quite a bit:
Jul  3 14:28:43 mystique sendmail[8501]: h63JHkEd008501: [172.30.2.136]
did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Jul  3 14:38:53 mystique sendmail[8518]: h63JciEd008518: [172.30.2.136]
did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Jul  3 14:44:48 mystique sendmail[8526]: h63JgfEd008526: [172.30.2.136]
did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
Jul  3 14:45:04 mystique sendmail[8531]: h63Jj0Ed008531: [172.30.2.136]
did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

172.30.2.136 is my machine's IP address. What exactly does that message
mean?

Jody

From mikea at MIKEA.ATH.CX  Thu Jul  3 20:53:37 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <00bf01c3419b$9b74df50$9c01a8c0@home.middlefinger.net>; from
              mike@CAMAROSS.NET on Thu, Jul 03, 2003 at 02:45:07PM -0500
References: <84CFA712F666B44A94CE6BE116BAF4B0B4EB70@mail.winnefox.org>
            <00bf01c3419b$9b74df50$9c01a8c0@home.middlefinger.net>
Message-ID: <20030703145337.B98124@mikea.ath.cx>

On Thu, Jul 03, 2003 at 02:45:07PM -0500, Mike Kercher wrote:
> I am able to connect now, but this doesn't look like a normal sendmail
> response:
>
> telnet 199.242.176.174 25
> Trying 199.242.176.174...
> Connected to 199.242.176.174 (199.242.176.174).
> Escape character is '^]'.
> 220
> *********************************2******2***************200************0*00

That looks like one of those inexpensive hardware "home firewalls"
that had some firmware bugsdiscussed *VERY* heavily a year or two
back. You might Google on that string.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From kevins at BMRB.CO.UK  Thu Jul  3 20:54:12 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C90@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C90@pascal.priv.bmrb.co.uk>
Message-ID: <1057262053.29328.4.camel@bach.kevinspicer.co.uk>

>telnet 199.242.176.174 25
>Trying 199.242.176.174...
>Connected to 199.242.176.174 (199.242.176.174).
>Escape character is '^]'.
>220
>********************2******2***************200************0*00

Well it speaks SMTP, but if thats an attempt to obfuscate the banner be
aware that breaks an rfc, you must give the hostname.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 20:56:33 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB74@mail.winnefox.org>

> That looks like one of those inexpensive hardware "home
> firewalls" that had some firmware bugsdiscussed *VERY*
> heavily a year or two back. You might Google on that string.

Actually, it's a PIX firewall. And, from what I understand, it was very
expensive. It is about 3 years old though. We're hoping to get a linux
firewall in place soon.

Jody

From mikea at MIKEA.ATH.CX  Thu Jul  3 20:56:28 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB71@mail.winnefox.org>; from
              Cleveland@MAIL.WINNEFOX.ORG on Thu, Jul 03,
              2003 at 02:53:00PM -0500
References: <84CFA712F666B44A94CE6BE116BAF4B0B4EB71@mail.winnefox.org>
Message-ID: <20030703145628.C98124@mikea.ath.cx>

On Thu, Jul 03, 2003 at 02:53:00PM -0500, Jody Cleveland wrote:
> > So it gets accepted?
>
> Seems to.
>
> > Is there anything in mqueue.in or mqueue?
>
> No.
>
> > What does it say in the maillog?
>
> A lot of mailscanner stuff about starting, and f-prot updating. Also,
> this quite a bit:
> Jul  3 14:28:43 mystique sendmail[8501]: h63JHkEd008501: [172.30.2.136]
> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
> Jul  3 14:38:53 mystique sendmail[8518]: h63JciEd008518: [172.30.2.136]
> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
> Jul  3 14:44:48 mystique sendmail[8526]: h63JgfEd008526: [172.30.2.136]
> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
> Jul  3 14:45:04 mystique sendmail[8531]: h63Jj0Ed008531: [172.30.2.136]
> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
>
> 172.30.2.136 is my machine's IP address. What exactly does that message
> mean?

That something connected, and disconnected without issuing any of
the MAIL, EXPN, VRFY, or ETRN commands.

That, coupled with my (too vague, darn it!) memories of problems with
a firewall that responded like that, make me wonder if the hardware or
firmware is getting in the way.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From mikea at MIKEA.ATH.CX  Thu Jul  3 20:57:27 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB74@mail.winnefox.org>; from
              Cleveland@MAIL.WINNEFOX.ORG on Thu, Jul 03,
              2003 at 02:56:33PM -0500
References: <84CFA712F666B44A94CE6BE116BAF4B0B4EB74@mail.winnefox.org>
Message-ID: <20030703145727.D98124@mikea.ath.cx>

On Thu, Jul 03, 2003 at 02:56:33PM -0500, Jody Cleveland wrote:
> > That looks like one of those inexpensive hardware "home
> > firewalls" that had some firmware bugsdiscussed *VERY*
> > heavily a year or two back. You might Google on that string.
>
> Actually, it's a PIX firewall. And, from what I understand, it was very
> expensive. It is about 3 years old though. We're hoping to get a linux
> firewall in place soon.

That's It! THAT'S **IT**!

Check for firmware upgrades, and google for problems with PIX
firewalls.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 21:00:36 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB77@mail.winnefox.org>

> That's It! THAT'S **IT**!
>
> Check for firmware upgrades, and google for problems with PIX
> firewalls.

See, the thing is, I've got another redhat 8 box right next to this one,
and it's working fine. I've mirrored all the settings with sendmail and
mailscanner and the firewall, but there must be something else I'm
missing...


--
Jody Cleveland
(cleveland@mail.winnefox.org)

From richard.lush at NTLWORLD.COM  Thu Jul  3 21:00:21 2003
From: richard.lush at NTLWORLD.COM (Richard Lush)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <8C4A83966C27354C928048C4A1620EF88F19@lando.rebel.com>

Is the firewall between the sendmail box and the Exchange server?
(sorry if that has already been answered).

Richard

-----Original Message-----
From: mikea [mailto:mikea@MIKEA.ATH.CX] 
Sent: 03 July 2003 20:57
To: MAILSCANNER@JISCMAIL.AC.UK

On Thu, Jul 03, 2003 at 02:56:33PM -0500, Jody Cleveland wrote:
> > That looks like one of those inexpensive hardware "home firewalls" 
> > that had some firmware bugsdiscussed *VERY* heavily a year or two 
> > back. You might Google on that string.
>
> Actually, it's a PIX firewall. And, from what I understand, it was 
> very expensive. It is about 3 years old though. We're hoping to get a 
> linux firewall in place soon.

That's It! THAT'S **IT**!

Check for firmware upgrades, and google for problems with PIX firewalls.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964


From richard.lush at NTLWORLD.COM  Thu Jul  3 21:01:09 2003
From: richard.lush at NTLWORLD.COM (Richard Lush)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <8C4A83966C27354C928048C4A1620EF8C074@lando.rebel.com>

Check the following:

1. SMTP Configuration on the exchange server - i.e. The Recipients
Policy is configure for all external SMTP addresses which it handles.
2. DNS MX records
3. I've setup /etc/mail/access with the internal SMTP domains (not sure
if this is needed though)
4. check the mailertable 
5. Check that you can telnet the the exchange servers SMTP connection

Short of those things not sure what else to check.

Richard


-----Original Message-----
From: Jody Cleveland [mailto:Cleveland@MAIL.WINNEFOX.ORG] 
Sent: 03 July 2003 20:30
To: MAILSCANNER@JISCMAIL.AC.UK

> Is the mail getting bounced back from exchange or is it just not 
> getting there?

It gets lost into oblivion. I don't get any bounced messages back, and
the message never reaches the destination.

Jody


From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 21:01:38 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB78@mail.winnefox.org>

> Well it speaks SMTP, but if thats an attempt to obfuscate the
> banner be aware that breaks an rfc, you must give the hostname.

I'm afraid I don't understand.

Jody

From mike at CAMAROSS.NET  Thu Jul  3 20:58:56 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB77@mail.winnefox.org>
Message-ID: <00c501c3419d$892d63b0$9c01a8c0@home.middlefinger.net>

What is the IP of that other RH box?

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Jody Cleveland
Sent: Thursday, July 03, 2003 3:01 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Why won't my mail forward?


> That's It! THAT'S **IT**!
>
> Check for firmware upgrades, and google for problems with PIX 
> firewalls.

See, the thing is, I've got another redhat 8 box right next to this one, and
it's working fine. I've mirrored all the settings with sendmail and
mailscanner and the firewall, but there must be something else I'm
missing...


--
Jody Cleveland
(cleveland@mail.winnefox.org)


From kevins at BMRB.CO.UK  Thu Jul  3 21:02:18 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C91@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C91@pascal.priv.bmrb.co.uk>
Message-ID: <1057262538.29329.6.camel@bach.kevinspicer.co.uk>

>Jul  3 14:45:04 mystique sendmail[8531]: h63Jj0Ed008531: [172.30.2.136]
>did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

>172.30.2.136 is my machine's IP address. What exactly does that message
>mean?

Thats probably you connecting with telnet, then aborting





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 21:02:50 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB79@mail.winnefox.org>

> Is the firewall between the sendmail box and the Exchange
> server? (sorry if that has already been answered).

I'm great with pc's, but not as much when it comes to the networking
side of it. That said, all internal pc's, including servers, are inside
the firewall.

Jody

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 21:03:35 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB7A@mail.winnefox.org>

> What is the IP of that other RH box?

199.242.176.169

Jody

From mike at CAMAROSS.NET  Thu Jul  3 21:03:03 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB7A@mail.winnefox.org>
Message-ID: <00c601c3419e$1c9cc460$9c01a8c0@home.middlefinger.net>

I'm getting the same banner:

 telnet 199.242.176.169 25
Trying 199.242.176.169...
Connected to 199.242.176.169 (199.242.176.169).
Escape character is '^]'.
220
*************************************2******2***************200*****0******0
*00

Here's what I get when I connect to one of mine:

telnet 207.189.28.75 25
Trying 207.189.28.75...
Connected to 207.189.28.75.
Escape character is '^]'.
220 redline.camaross.net ESMTP Sendmail 8.11.6/8.11.6; Thu, 3 Jul 2003
15:17:41 -0500

I'd look at the firewall as suggested earlier.

Mike



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Jody Cleveland
Sent: Thursday, July 03, 2003 3:04 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Why won't my mail forward?


> What is the IP of that other RH box?

199.242.176.169

Jody


From kevins at BMRB.CO.UK  Thu Jul  3 21:09:44 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175C9E@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175C9E@pascal.priv.bmrb.co.uk>
Message-ID: <1057262985.29327.11.camel@bach.kevinspicer.co.uk>

Jody,

I've just sent a mail to you at that machine using telnet (speaking
smtp) heres the transaction (my IP obscured)  apart form the odd banner
all seemed well, perhaps you could grep your mail log for h63K3HEd008666
and post the result...


Trying 199.242.176.174...
Connected to 199.242.176.174 (199.242.176.174).
Escape character is '^]'.
220
*********************************2******2***************200*****0******0*00
helo bach.kevinspicer.co.uk
250 wals.lib.wi.us Hello 213-152-53-60.dsl.eclipse.net.uk
[213.152.53.60], pleased to meet you
mail from:kevin@kevinspicer.co.uk
250 2.1.0 kevin@kevinspicer.co.uk... Sender ok
rcpt to:cleveland@mail.winnefox.org
250 2.1.5 cleveland@mail.winnefox.org... Recipient ok
data
354 Enter mail, end with "." on a line by itself
Hello Jody, Kevin from the MailScanner list here, sending you a test
message
.
250 2.0.0 h63K3HEd008666 Message accepted for delivery
quit
221 2.0.0 wals.lib.wi.us closing connection
Connection closed by foreign host.







BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mailscanner at ELKNET.NET  Thu Jul  3 22:04:19 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:18:50 2006
Subject: Message Size
Message-ID: <200307032009.h63K9rS14552@ori.rl.ac.uk>

Julian,

The sender of the oversized message is receiving the 'sender.error.report.txt' message, not the 'sender.filename.report.txt'.

Here is a copy of one I received when I tested the feature. Note that its the report about not being able to fully analyse the message, yet the '$report' variable at the bottom clearly shows it was the size filter that snagged it.

##################################################################
Subject: Warning: Your E-mail to training@elknet.net was rejected
X-ElkNetMailScrubber: generated

Our virus detector failed to completely analyse a message you sent:-
  To: training@elknet.net
  Subject: second large test
  Date: Thu Jul  3 13:40:45 2003
Any parts of the message that could not be analysed will not have been
delivered.

If you are using Microsoft Outlook, we strongly recommend you change your
outgoing message format from "Rich Text" to "HTML" or "Plain Text".

The virus detector said this about the message:
Report: Message is too large


--
ElkNet Postmaster
ElkNet E-Mail Scrubbing Service
##################################################################

MailScanner then removes the entire message, and sends the 'deleted.virus.message.txt' to the receipient, with a new attachment that contains an explaination regarding the removal of the attachment. The subject of this message has been modified with the {virus} tag.

Hope that helps!
-Alan


>Can you double check that you don't get the bad filename report please? It
>adds the same type of report to the message as the filename checks.
>
>To prove the point, the filename checks do this:
>             MailScanner::Log::InfoLog("Filename Checks: %s (%s)",
>                                       $logtext, $attach);
>             $message->{namereports}{$safename} .= "$usertext ($safename)\n";
>             $message->{nametypes}{$safename}   .= "f";
>             $counter++;
>             $message->{nameinfected}++;
>while the filetype checks do this:
>           MailScanner::Log::InfoLog("Filetype Checks: %s (%s)",
>                                     $logtext, $attach);
>           $message->{namereports}{$safename} .= "$usertext ($safename)\n";
>           $message->{nametypes}{$safename}   .= "f";
>           $counter++;
>           $message->{nameinfected}++;
>
>You may notice a slight similarity in the code...
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 21:10:38 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:50 2006
Subject: OT Re: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB7A@mail.winnefox.org>
Message-ID: <5.2.1.1.2.20030703210915.03cd73f8@imap.ecs.soton.ac.uk>

This is really rather OT, and there have been 30 messages I have seen in
this thread so far.

Any chance a few of you could take the investigation off-list please, and
just post to the list once you've got it sorted or you all run out of ideas
and need some extra input from others?

At 21:03 03/07/2003, you wrote:
> > What is the IP of that other RH box?
>
>199.242.176.169
>
>Jody

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From Cleveland at MAIL.WINNEFOX.ORG  Thu Jul  3 21:13:15 2003
From: Cleveland at MAIL.WINNEFOX.ORG (Jody Cleveland)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <84CFA712F666B44A94CE6BE116BAF4B0B4EB7D@mail.winnefox.org>

> perhaps you could grep your mail log for h63K3HEd008666 and post the
result...

Jul  3 15:05:12 mystique MailScanner[8392]: Spam Checks: Starting
Jul  3 15:05:12 mystique MailScanner[8392]: Virus and Content Scanning:
Starting
Jul  3 15:05:12 mystique MailScanner[8392]: Uninfected: Delivered 1
messages
Jul  3 15:05:13 mystique sendmail[8683]: h63K3HEd008666:
to=cleveland@mail.winnefox.org, delay=00:00:53, xdelay=00:00:01,
mailer=esmtp, pri=120077, relay=mail.winnefox.org. [199.242.176.171],
dsn=2.0.0, stat=Sent (OK)

After you sent that, I tried with my yahoo account. I noticed it sent
right after yours. So, they are now being caught by MailScanner.
However, they are not being forwarded to the exchange server. Well,
yours did, but the two I did, did not.

Jody

From mike at CAMAROSS.NET  Thu Jul  3 21:10:55 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:50 2006
Subject: OT Re: Why won't my mail forward?
In-Reply-To: <5.2.1.1.2.20030703210915.03cd73f8@imap.ecs.soton.ac.uk>
Message-ID: <00c701c3419f$3620f180$9c01a8c0@home.middlefinger.net>

Julian,

Seems like we run into this from time to time.  What would be the odds you
could setup an OT mailing list?  I can do it on one of my servers if you
want.  Then people that want to subscribe and assist people with OT issues
can stay in the loop and lend a hand where needed.

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Thursday, July 03, 2003 3:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: OT Re: Why won't my mail forward?


This is really rather OT, and there have been 30 messages I have seen in
this thread so far.

Any chance a few of you could take the investigation off-list please, and
just post to the list once you've got it sorted or you all run out of ideas
and need some extra input from others?

At 21:03 03/07/2003, you wrote:
> > What is the IP of that other RH box?
>
>199.242.176.169
>
>Jody

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support


From chicks at CHICKS.NET  Thu Jul  3 20:16:12 2003
From: chicks at CHICKS.NET (Christopher Hicks)
Date: Thu Jan 12 21:18:50 2006
Subject: mailing list for OT stuff
In-Reply-To: <00c701c3419f$3620f180$9c01a8c0@home.middlefinger.net>
Message-ID: <Pine.LNX.4.44.0307031515300.3396-100000@yakko.chicks.net>

On Thu, 3 Jul 2003, Mike Kercher wrote:
> Seems like we run into this from time to time.  What would be the odds
> you could setup an OT mailing list?  I can do it on one of my servers if
> you want.  Then people that want to subscribe and assist people with OT
> issues can stay in the loop and lend a hand where needed.

Oh please call it mailscanner-wizards!

--
</chris>

The death of democracy is not likely to be an assassination from ambush. It
will be a slow extinction from apathy, indifference, and undernourishment.
-Robert Maynard Hutchins, educator (1899-1977)

From JFalgout at CO.JEFFERSON.CO.US  Thu Jul  3 21:17:04 2003
From: JFalgout at CO.JEFFERSON.CO.US (Jeff Falgout)
Date: Thu Jan 12 21:18:50 2006
Subject: How can I exclude exe attachment from single email address
Message-ID: <sf043ae5.009@gc6.jefferson.co.us>

Just moved MailScanner into production today * WOOHOO!!

But ...

I'm blocking .exe's using filename.rules.conf, but we have to deal with another company that insists on sending an *IMPORTANT* file as an exe attachment.

Is there a way to allow .exe only from that email address?

Thanks.

Jeff


From mailscanner at ELKNET.NET  Thu Jul  3 22:14:38 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:18:50 2006
Subject: MailScanner log entries
Message-ID: <200307032020.h63KKCS16235@ori.rl.ac.uk>

What can I look for in the maillog to see if MailScanner is rejecting messages based on rbl scores?

I have disabled rbl checking in spamassassin and enabled them in MailScanner, but don't see any evidence that they are working.

All mail coming into my network is received by a qmail server. This qmail server then forwards the mail on to my MailScanner server.

Normally, I run rblsmtpd on the qmail server which checks 6 or 7 different rbl sites. This works perfectly, and I can see many rejections per minute in the qmail logs, so I know I'm receiving mail from sites that should be rejected.

So, on MailScanner, I entered the same list of rbl sites into 'spam.lists.conf' file:

############################################################
dorkslayers                     orbs.dorkslayers.com.
reynolds                        rmst.bl.reynolds.net.au.
spamsites                       spamsites.relays.osirusoft.com.
dnsrbl                          spam.dnsrbl.net.
flowgoaway                      flowgoaway.com.
njabl                           dnsbl.njabl.org.
spamhaus                        sbl.spamhaus.org.
spamcop                         bl.spamcop.net.
############################################################

and then I entered them into the 'spam list' space seperated:

  dorkslayers reynolds spamsites dnsrbl flowgoaway njabl spamhaus spamcop


I set the 'Spam Lists To Reach High Score' to '1' so it should work just like my qmail server for testing purposes.

Then I shut down the rbl checking on the qmail server so that it would accept all messages, but in examining the MailScanner logs, I don't see any evidence that its rejecting anything based on rbl checks.

a) What text should I be looking for in the logs to see rbl rejections
b) Is there a way to see if MailScanner has experienced timeouts on any of the rbl sites I entered?
c) Is there a way to see if MailScanner has disabled any of my rbl checks due to hitting the max number of timeouts?

Thanks!

From peter at UCGBOOK.COM  Thu Jul  3 21:20:13 2003
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:18:50 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <sf043ae5.009@gc6.jefferson.co.us>
References: <sf043ae5.009@gc6.jefferson.co.us>
Message-ID: <3F048FFD.9040605@ucgbook.com>

You should look into rulesets but you could also tell them to send it in
a zip :)

/Peter Bonivart

--Unix lovers do it in the Sun

Jeff Falgout wrote:
> Just moved MailScanner into production today * WOOHOO!!
>
> But ...
>
> I'm blocking .exe's using filename.rules.conf, but we have to deal with another company that insists on sending an *IMPORTANT* file as an exe attachment.
>
> Is there a way to allow .exe only from that email address?
>
> Thanks.
>
> Jeff
>

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 21:23:55 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:50 2006
Subject: OT Re: Why won't my mail forward?
In-Reply-To: <00c701c3419f$3620f180$9c01a8c0@home.middlefinger.net>
References: <5.2.1.1.2.20030703210915.03cd73f8@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030703211902.03cc99d0@imap.ecs.soton.ac.uk>

It's only ever happened 3 or 4 times. I'm not convinced many people would
read a list which doesn't have an aim except for being about everything
except MailScanner.

I believe this is still the right place for occasional OT discussions, and
I don't think anyone minds (they don't complain to me anyway). Between us
we have collected together a large number of very experienced and helpful
mail admins, and I don't want to break that up at all as it is a major part
of MailScanner's success. The list just needs the odd nudge once in a
while, which is part of my job as list owner.

At 21:10 03/07/2003, you wrote:
>Seems like we run into this from time to time.  What would be the odds you
>could setup an OT mailing list?  I can do it on one of my servers if you
>want.  Then people that want to subscribe and assist people with OT issues
>can stay in the loop and lend a hand where needed.
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Thursday, July 03, 2003 3:11 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: OT Re: Why won't my mail forward?
>
>
>This is really rather OT, and there have been 30 messages I have seen in
>this thread so far.
>
>Any chance a few of you could take the investigation off-list please, and
>just post to the list once you've got it sorted or you all run out of ideas
>and need some extra input from others?
>
>At 21:03 03/07/2003, you wrote:
> > > What is the IP of that other RH box?
> >
> >199.242.176.169
> >
> >Jody
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks
>transtec Computers for their support

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 21:26:47 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:50 2006
Subject: MailScanner log entries
In-Reply-To: <200307032020.h63KKCS16235@ori.rl.ac.uk>
Message-ID: <5.2.1.1.2.20030703212519.03c7bce8@imap.ecs.soton.ac.uk>

Think about what you are doing.

Outside world ---> qmail server ---> MailScanner server

Qmail is getting messages from all over the world, including places that
are listed in various RBLs.
But your MailScanner server is only getting mail from your qmail server,
which presumably isn't in any RBLs. So it won't report any.

At 22:14 03/07/2003, you wrote:
>What can I look for in the maillog to see if MailScanner is rejecting
>messages based on rbl scores?
>
>I have disabled rbl checking in spamassassin and enabled them in
>MailScanner, but don't see any evidence that they are working.
>
>All mail coming into my network is received by a qmail server. This qmail
>server then forwards the mail on to my MailScanner server.
>
>Normally, I run rblsmtpd on the qmail server which checks 6 or 7 different
>rbl sites. This works perfectly, and I can see many rejections per minute
>in the qmail logs, so I know I'm receiving mail from sites that should be
>rejected.
>
>So, on MailScanner, I entered the same list of rbl sites into
>'spam.lists.conf' file:
>
>############################################################
>dorkslayers                     orbs.dorkslayers.com.
>reynolds                        rmst.bl.reynolds.net.au.
>spamsites                       spamsites.relays.osirusoft.com.
>dnsrbl                          spam.dnsrbl.net.
>flowgoaway                      flowgoaway.com.
>njabl                           dnsbl.njabl.org.
>spamhaus                        sbl.spamhaus.org.
>spamcop                         bl.spamcop.net.
>############################################################
>
>and then I entered them into the 'spam list' space seperated:
>
>   dorkslayers reynolds spamsites dnsrbl flowgoaway njabl spamhaus spamcop
>
>
>I set the 'Spam Lists To Reach High Score' to '1' so it should work just
>like my qmail server for testing purposes.
>
>Then I shut down the rbl checking on the qmail server so that it would
>accept all messages, but in examining the MailScanner logs, I don't see
>any evidence that its rejecting anything based on rbl checks.
>
>a) What text should I be looking for in the logs to see rbl rejections
>b) Is there a way to see if MailScanner has experienced timeouts on any of
>the rbl sites I entered?
>c) Is there a way to see if MailScanner has disabled any of my rbl checks
>due to hitting the max number of timeouts?
>
>Thanks!

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From richard.lush at NTLWORLD.COM  Thu Jul  3 21:29:41 2003
From: richard.lush at NTLWORLD.COM (Richard Lush)
Date: Thu Jan 12 21:18:50 2006
Subject: Why won't my mail forward?
Message-ID: <8C4A83966C27354C928048C4A1620EF88F1C@lando.rebel.com>

Can you telnet from the redhat box to the SMTP port on the Exchange
Server ok? 


-----Original Message-----
From: Jody Cleveland [mailto:Cleveland@MAIL.WINNEFOX.ORG] 
Sent: 03 July 2003 21:03
To: MAILSCANNER@JISCMAIL.AC.UK

> Is the firewall between the sendmail box and the Exchange server? 
> (sorry if that has already been answered).

I'm great with pc's, but not as much when it comes to the networking
side of it. That said, all internal pc's, including servers, are inside
the firewall.

Jody


From zen23003 at ZEN.CO.UK  Thu Jul  3 21:49:52 2003
From: zen23003 at ZEN.CO.UK (Paul)
Date: Thu Jan 12 21:18:50 2006
Subject: MailScanner log entries
References: <5.2.1.1.2.20030703212519.03c7bce8@imap.ecs.soton.ac.uk>
Message-ID: <005801c341a4$a754cb60$0100000a@lan>

Worth adding too that SpamAssassin, however, digs deeper and checks (I
believe) all the hosts that have handled the incoming messages, so
disabling it has a big effect.

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: 03 July 2003 21:26
Subject: Re: MailScanner log entries


> Think about what you are doing.
>
> Outside world ---> qmail server ---> MailScanner server
>
> Qmail is getting messages from all over the world, including places
that
> are listed in various RBLs.
> But your MailScanner server is only getting mail from your qmail
server,
> which presumably isn't in any RBLs. So it won't report any.
>
> At 22:14 03/07/2003, you wrote:
> >What can I look for in the maillog to see if MailScanner is rejecting
> >messages based on rbl scores?
> >
> >I have disabled rbl checking in spamassassin and enabled them in
> >MailScanner, but don't see any evidence that they are working.
> >
> >All mail coming into my network is received by a qmail server. This
qmail
> >server then forwards the mail on to my MailScanner server.
> >

From JFalgout at CO.JEFFERSON.CO.US  Thu Jul  3 21:50:10 2003
From: JFalgout at CO.JEFFERSON.CO.US (Jeff Falgout)
Date: Thu Jan 12 21:18:50 2006
Subject: How can I exclude exe attachment from single email address
Message-ID: <sf0442a8.013@gc6.jefferson.co.us>

Been down that road  . . .lost that argument.

Yes, rule sets. . .

Can you allow only a single type of attachment, or do you just turn off
virus scanning for that email address?


Amazing how frustration impairs your vision.


>>> peter@UCGBOOK.COM 7/3/2003 2:20:13 PM >>>
You should look into rulesets but you could also tell them to send it
in
a zip :)

/Peter Bonivart

--Unix lovers do it in the Sun

Jeff Falgout wrote:
> Just moved MailScanner into production today * WOOHOO!!
>
> But ...
>
> I'm blocking .exe's using filename.rules.conf, but we have to deal
with another company that insists on sending an *IMPORTANT* file as an
exe attachment.
>
> Is there a way to allow .exe only from that email address?
>
> Thanks.
>
> Jeff
>

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 21:57:41 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:50 2006
Subject: MailScanner log entries
In-Reply-To: <005801c341a4$a754cb60$0100000a@lan>
References: <5.2.1.1.2.20030703212519.03c7bce8@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030703215714.020b05b8@imap.ecs.soton.ac.uk>

I don't believe the headers as much as SpamAssassin does :-)

At 21:49 03/07/2003, you wrote:
>Worth adding too that SpamAssassin, however, digs deeper and checks (I
>believe) all the hosts that have handled the incoming messages, so
>disabling it has a big effect.
>
>----- Original Message -----
>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: 03 July 2003 21:26
>Subject: Re: MailScanner log entries
>
>
> > Think about what you are doing.
> >
> > Outside world ---> qmail server ---> MailScanner server
> >
> > Qmail is getting messages from all over the world, including places
>that
> > are listed in various RBLs.
> > But your MailScanner server is only getting mail from your qmail
>server,
> > which presumably isn't in any RBLs. So it won't report any.
> >
> > At 22:14 03/07/2003, you wrote:
> > >What can I look for in the maillog to see if MailScanner is rejecting
> > >messages based on rbl scores?
> > >
> > >I have disabled rbl checking in spamassassin and enabled them in
> > >MailScanner, but don't see any evidence that they are working.
> > >
> > >All mail coming into my network is received by a qmail server. This
>qmail
> > >server then forwards the mail on to my MailScanner server.
> > >

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From kevins at BMRB.CO.UK  Thu Jul  3 22:01:03 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:50 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175CAD@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175CAD@pascal.priv.bmrb.co.uk>
Message-ID: <1057266064.29327.39.camel@bach.kevinspicer.co.uk>

On Thu, 2003-07-03 at 21:50, Jeff Falgout wrote:

Been down that road  . . .lost that argument.

Yes, rule sets. . .

Can you allow only a single type of attachment, or do you just turn off
virus scanning for that email address?

Filename Rules=/etc/MailScanner/rules/filename.rules.rules

in that file

From: fussy@ss.who.must.send.exes /etc/MailScanner/filename.rules.exeok
From: default /etc/MailScanner/filename.rules.conf


Copy filename.rules.conf to filename.rules.exeok and change the deny
next to exe to allow.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 22:06:07 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:50 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <sf043ae5.009@gc6.jefferson.co.us>
Message-ID: <5.2.1.1.2.20030703220014.03c87eb0@imap.ecs.soton.ac.uk>

At 21:17 03/07/2003, you wrote:
>Just moved MailScanner into production today * WOOHOO!!
>
>But ...
>
>I'm blocking .exe's using filename.rules.conf, but we have to deal with
>another company that insists on sending an *IMPORTANT* file as an exe
>attachment.
>
>Is there a way to allow .exe only from that email address?

Copy filename.rules.conf to filename.special.rules.conf.
Edit filename.special.rules.conf and add a rule to the top of it along the
lines of
allow   \.exe$  -       -
(separate those 4 sections with tab characters, not spaces).

Then construct a ruleset in /etc/MailScanner/rules/filename.rules that
looks like this:
From:   awkward@bugger.com      /etc/MailScanner/filename.special.rules.conf
FromOrTo:       default         /etc/MailScanner/filename.rules.conf

Edit /etc/MailScanner/MailScanner.conf so it uses it
Filename Rules = /etc/MailScanner/rules/filename.rules

Then reload or restart MailScanner.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From JFalgout at CO.JEFFERSON.CO.US  Thu Jul  3 22:10:31 2003
From: JFalgout at CO.JEFFERSON.CO.US (Jeff Falgout)
Date: Thu Jan 12 21:18:50 2006
Subject: How can I exclude exe attachment from single email address
Message-ID: <sf044771.017@gc6.jefferson.co.us>

Beautiful * Thank you very  much!!

>>> mailscanner@ECS.SOTON.AC.UK 7/3/2003 3:06:07 PM >>>
At 21:17 03/07/2003, you wrote:
>Just moved MailScanner into production today * WOOHOO!!
>
>But ...
>
>I'm blocking .exe's using filename.rules.conf, but we have to deal with
>another company that insists on sending an *IMPORTANT* file as an exe
>attachment.
>
>Is there a way to allow .exe only from that email address?

Copy filename.rules.conf to filename.special.rules.conf.
Edit filename.special.rules.conf and add a rule to the top of it along the
lines of
allow   \.exe$  -       -
(separate those 4 sections with tab characters, not spaces).

Then construct a ruleset in /etc/MailScanner/rules/filename.rules that
looks like this:
From:   awkward@bugger.com      /etc/MailScanner/filename.special.rules.conf
FromOrTo:       default         /etc/MailScanner/filename.rules.conf

Edit /etc/MailScanner/MailScanner.conf so it uses it
Filename Rules = /etc/MailScanner/rules/filename.rules

Then reload or restart MailScanner.
--
Julian Field
www.MailScanner.info 
Professional Support Services at www.MailScanner.biz 
MailScanner thanks transtec Computers for their support


From mailscanner at ecs.soton.ac.uk  Thu Jul  3 22:14:45 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:50 2006
Subject: OT Re: Why won't my mail forward?
In-Reply-To: <00d001c341a4$ee5e5f30$9c01a8c0@home.middlefinger.net>
References: <5.2.1.1.2.20030703211902.03cc99d0@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030703220721.020dbeb8@imap.ecs.soton.ac.uk>

What I think would be the best idea (and may well be what you are already
thinking) is to announce, when needed, that a thread is being moved to the
OT list until it is resolved or further assistance from the main list is
required, at which point it is moved back to the main list. So it becomes
an ad hoc discussion forum that is used when needed, but questions still
start life on the main list. They are only moved when it is obvious there
is going to need to be a lot of OT discussion to resolve the issues. That
way no-one needs to regularly read the OT list unless they want to partake
in a particular discussion that has been moved there.

I mostly want to avoid people having to regularly read anything other than
the main list.

It would be really good if you could set up the mailing list software with
a filter that recognised messages whose subject doesn't start with "Re:"
(or any reasonable translations of that). It could then reply to the sender
that new discussions should not start there, as no-one may be reading it at
the time.

At 21:51 03/07/2003, you wrote:
>Would you be opposed to me creating a list for OT discussions and announcing
>it to the list?  The reason is that people like this Jody Cleveland could
>benefit from input from many people and we could keep it from cluttering the
>mail list.
>
>Mike
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Thursday, July 03, 2003 3:24 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: OT Re: Why won't my mail forward?
>
>
>It's only ever happened 3 or 4 times. I'm not convinced many people would
>read a list which doesn't have an aim except for being about everything
>except MailScanner.
>
>I believe this is still the right place for occasional OT discussions, and I
>don't think anyone minds (they don't complain to me anyway). Between us we
>have collected together a large number of very experienced and helpful mail
>admins, and I don't want to break that up at all as it is a major part of
>MailScanner's success. The list just needs the odd nudge once in a while,
>which is part of my job as list owner.
>
>At 21:10 03/07/2003, you wrote:
> >Seems like we run into this from time to time.  What would be the odds
> >you could setup an OT mailing list?  I can do it on one of my servers
> >if you want.  Then people that want to subscribe and assist people with
> >OT issues can stay in the loop and lend a hand where needed.
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >Behalf Of Julian Field
> >Sent: Thursday, July 03, 2003 3:11 PM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: OT Re: Why won't my mail forward?
> >
> >
> >This is really rather OT, and there have been 30 messages I have seen
> >in this thread so far.
> >
> >Any chance a few of you could take the investigation off-list please,
> >and just post to the list once you've got it sorted or you all run out
> >of ideas and need some extra input from others?
> >
> >At 21:03 03/07/2003, you wrote:
> > > > What is the IP of that other RH box?
> > >
> > >199.242.176.169
> > >
> > >Jody
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >Professional Support Services at www.MailScanner.biz MailScanner thanks
> >transtec Computers for their support
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks
>transtec Computers for their support

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From andersan at LTKALMAR.SE  Thu Jul  3 22:19:33 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:50 2006
Subject: SV: Why won't my mail forward?
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE643@lkl63.ltkalmar.se>

Hmm, did a fiast read so I might have missed it.... 2 short questions....
Can you telnet from RH to exchange and exchange to RH? 
You said you can recieve mail from internet but not send from exchange....
Have you changed where exchange sends outgoing mail?

-----Ursprungligt meddelande-----
Fr?n: Jody Cleveland [mailto:Cleveland@MAIL.WINNEFOX.ORG] 
Skickat: den 3 juli 2003 22:01
Till: MAILSCANNER@JISCMAIL.AC.UK
?mne: Re: Why won't my mail forward?


> That's It! THAT'S **IT**!
>
> Check for firmware upgrades, and google for problems with PIX 
> firewalls.

See, the thing is, I've got another redhat 8 box right next to this one, and
it's working fine. I've mirrored all the settings with sendmail and
mailscanner and the firewall, but there must be something else I'm
missing...


--
Jody Cleveland
(cleveland@mail.winnefox.org)


From ka at PACIFIC.NET  Thu Jul  3 22:24:01 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:50 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <1057266064.29327.39.camel@bach.kevinspicer.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175CAD@pascal.priv.bmrb.co.uk>
            <1057266064.29327.39.camel@bach.kevinspicer.co.uk>
Message-ID: <3F049EF1.1040404@pacific.net>

I didn't know you could nest rulesets like that!
So instead of something like this:
Required SpamAssassin Score = 5

I could use this:
Required SpamAssassin Score = /etc/MailScanner/spam.threshold.rules

Then in spam.threshold.rules:

# a custom function that talks to mysql for some users,
# letting users tweak their settings to their hearts content.
To: boss@somedomain_that_pays_more.com  &ByLowSAScore
To: peon@somedomain_that_pays_more.com  &ByLowSAScore
To: lacky@somedomain_that_pays_more.com &ByLowSAScore
To: *@somedomain_that_pays_more.com     &ByLowSAScore

# a normal user
To: default /etc/MailScanner/spam.defaultthreshold.rules

I like it!

Ken
Pacific.Net


Kevin Spicer wrote:

> On Thu, 2003-07-03 at 21:50, Jeff Falgout wrote:
>
> Been down that road  . . .lost that argument.
>
> Yes, rule sets. . .
>
> Can you allow only a single type of attachment, or do you just turn off
> virus scanning for that email address?
>
> Filename Rules=/etc/MailScanner/rules/filename.rules.rules
>
> in that file
>
> From: fussy@ss.who.must.send.exes /etc/MailScanner/filename.rules.exeok
> From: default /etc/MailScanner/filename.rules.conf
>
>
> Copy filename.rules.conf to filename.rules.exeok and change the deny
> next to exe to allow.
>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact the
> sender and delete this message immediately.  Disclosure, copying
> or other action taken in respect of this email or in
> reliance on it is prohibited.  BMRB International Limited
> accepts no liability in relation to any personal emails, or
> content of any email which does not directly relate to our
> business.
>
>

From kevins at BMRB.CO.UK  Thu Jul  3 22:31:54 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:50 2006
Subject: SV: Why won't my mail forward?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175CB3@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175CB3@pascal.priv.bmrb.co.uk>
Message-ID: <1057267914.29329.52.camel@bach.kevinspicer.co.uk>

>On Thu, 2003-07-03 at 22:19, Anders Andersson, IT wrote:

>Have you changed where exchange sends outgoing mail?

I think we can close this thread now, we've taken the discussion off
list and, I think, found the problem  [the machine thinks its name is
the same as the domain name, and so was treating mail for the domain as
local and passing to procmail, rather than forwarding to the exchange
box]






BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From forrie at FORRIE.COM  Thu Jul  3 22:34:05 2003
From: forrie at FORRIE.COM (Forrest Aldrich)
Date: Thu Jan 12 21:18:51 2006
Subject: BogoFilter, SpamBayes, etc...
In-Reply-To: <3F049EF1.1040404@pacific.net>
References: <1057266064.29327.39.camel@bach.kevinspicer.co.uk>
            <5C0296D26910694BB9A9BBFC577E7AB001175CAD@pascal.priv.bmrb.co.uk>
            <1057266064.29327.39.camel@bach.kevinspicer.co.uk>
Message-ID: <5.2.1.1.2.20030703173321.02f1a8d0@192.168.1.1>

Has anyone experience using BogoFilter or SpamBayes with MailFilter...

I'm curious about performance comparisons to SpamAssassin, etc.


Forrest

From mailscanner at ecs.soton.ac.uk  Thu Jul  3 22:43:45 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <3F049EF1.1040404@pacific.net>
References: <1057266064.29327.39.camel@bach.kevinspicer.co.uk>
            <5C0296D26910694BB9A9BBFC577E7AB001175CAD@pascal.priv.bmrb.co.uk>
            <1057266064.29327.39.camel@bach.kevinspicer.co.uk>
Message-ID: <5.2.1.1.2.20030703223538.020ddbb0@imap.ecs.soton.ac.uk>

At 22:24 03/07/2003, you wrote:
>I didn't know you could nest rulesets like that!

No, you can't. In the filename.rules.conf example, you are using a ruleset
to create a list of allow/deny patterns for the filename. You aren't using
a ruleset to create a ruleset.

By the way, an alternative to my previous solution is to create a
filename.allowexe.conf just containing a single rule
allow   \.exe$  -       -
and then make the filename.rules ruleset concatenate
filename.allowexec.conf and the original filename.rules.conf file using 2
rules like this:
From:   awkward@bugger.com      /etc/MailScanner/filename.allowexe.conf
/etc/MailScanner/filename.rules.conf
FromOrTo:       default         /etc/MailScanner/filename.rules.conf

In the resulting filename allow/deny patterns applied to
awkward@bugger.com, the first rule will allow *.exe which will over-ride
the "deny \.exe$" restriction later in the supplied filename.rules.conf.

>So instead of something like this:
>Required SpamAssassin Score = 5
>
>I could use this:
>Required SpamAssassin Score = /etc/MailScanner/spam.threshold.rules
>
>Then in spam.threshold.rules:
>
># a custom function that talks to mysql for some users,
># letting users tweak their settings to their hearts content.
>To: boss@somedomain_that_pays_more.com  &ByLowSAScore
>To: peon@somedomain_that_pays_more.com  &ByLowSAScore
>To: lacky@somedomain_that_pays_more.com &ByLowSAScore
>To: *@somedomain_that_pays_more.com     &ByLowSAScore
>
># a normal user
>To: default /etc/MailScanner/spam.defaultthreshold.rules
>
>I like it!
>
>Ken
>Pacific.Net
>
>
>Kevin Spicer wrote:
>
>>On Thu, 2003-07-03 at 21:50, Jeff Falgout wrote:
>>
>>Been down that road  . . .lost that argument.
>>
>>Yes, rule sets. . .
>>
>>Can you allow only a single type of attachment, or do you just turn off
>>virus scanning for that email address?
>>
>>Filename Rules=/etc/MailScanner/rules/filename.rules.rules
>>
>>in that file
>>
>>From: fussy@ss.who.must.send.exes /etc/MailScanner/filename.rules.exeok
>>From: default /etc/MailScanner/filename.rules.conf
>>
>>
>>Copy filename.rules.conf to filename.rules.exeok and change the deny
>>next to exe to allow.
>>
>>
>>
>>
>>BMRB International
>>http://www.bmrb.co.uk
>>+44 (0)20 8566 5000
>>_________________________________________________________________
>>This message (and any attachment) is intended only for the
>>recipient and may contain confidential and/or privileged
>>material.  If you have received this in error, please contact the
>>sender and delete this message immediately.  Disclosure, copying
>>or other action taken in respect of this email or in
>>reliance on it is prohibited.  BMRB International Limited
>>accepts no liability in relation to any personal emails, or
>>content of any email which does not directly relate to our
>>business.
>>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From raymond at PROLOCATION.NET  Thu Jul  3 22:54:58 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: Why won't my mail forward?
In-Reply-To: <84CFA712F666B44A94CE6BE116BAF4B0B4EB66@mail.winnefox.org>
Message-ID: <Pine.LNX.4.44.0307032354260.23456-100000@mailbox.prolocation.net>

Hi!

> MailScanner, and spamassassin, and I am able to send mail out. My
> problem is, it's not getting mail and forwarding it on. I've got the mx
> record setup properly. My question is, does Sendmail automatically
> listen on all IP addresses? Is there something else I should be looking
> at?

Use the mailertable for that. Point the MXes to your sendmail box and use
the mailertable to forward it to your exchange machine.

Bye,
Raymond.

From raymond at PROLOCATION.NET  Thu Jul  3 22:55:55 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: Message Size
In-Reply-To: <200307031858.h63IwgS01221@ori.rl.ac.uk>
Message-ID: <Pine.LNX.4.44.0307032355310.23456-100000@mailbox.prolocation.net>

Hi!

> First, I don't want to sound ungrateful, I really do appreciate the new
> feature to filter on total message size.
>
> However, when a message is over the set size, MailScanner tags the
> subject line with the {Virus} tag, and the report message to the
> receipient is the virus removal message. Likewise, the report back to
> the sender appears to be the 'Sender Error Report'.

Sounds like we need a new template there :)

Bye,
Raymond.

From steve.douglas at SBIINCORPORATED.COM  Thu Jul  3 22:53:46 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:18:51 2006
Subject: Unsolicited commercial email rejected
Message-ID: <3963522F0E71474CB14C0FF54A6914F701115118@mail.gardenbotanika.com>

Maybe I missing something, but I can not seem to find where I can turn this
feature off.  I thought I did, but guess I was not to successful.  Any
suggestions is appreciated.  Thanx.







-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030703/107875df/attachment.html
From mike at CAMAROSS.NET  Thu Jul  3 22:56:10 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:51 2006
Subject: Unsolicited commercial email rejected
In-Reply-To: <3963522F0E71474CB14C0FF54A6914F701115118@mail.gardenbotanika.com>
Message-ID: <00e101c341ad$e9dcdfa0$9c01a8c0@home.middlefinger.net>

That looks like you have a Spam Action = bounce in your MailScanner.conf
 
Mike
 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Steve Douglas
Sent: Thursday, July 03, 2003 4:54 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Unsolicited commercial email rejected



Maybe I missing something, but I can not seem to find where I can turn this
feature off.  I thought I did, but guess I was not to successful.  Any
suggestions is appreciated.  Thanx.

 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030703/e6e08e60/attachment.html
From raymond at PROLOCATION.NET  Thu Jul  3 23:01:15 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: Why won't my mail forward?
In-Reply-To: <20030703145727.D98124@mikea.ath.cx>
Message-ID: <Pine.LNX.4.44.0307040000360.23456-100000@mailbox.prolocation.net>

Hi!

> > Actually, it's a PIX firewall. And, from what I understand, it was very
> > expensive. It is about 3 years old though. We're hoping to get a linux
> > firewall in place soon.
>
> That's It! THAT'S **IT**!
>
> Check for firmware upgrades, and google for problems with PIX
> firewalls.

What OS is that PIX running ? (version) i might have some leads there. I
am used to admin PIXes :)

Bye,
Raymond.

From raymond at PROLOCATION.NET  Thu Jul  3 23:05:32 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <sf043ae5.009@gc6.jefferson.co.us>
Message-ID: <Pine.LNX.4.44.0307040005080.23456-100000@mailbox.prolocation.net>

Hi!

> I'm blocking .exe's using filename.rules.conf, but we have to deal with another company that insists on sending an *IMPORTANT* file as an exe attachment.
>
> Is there a way to allow .exe only from that email address?

Rulesets ... create a different ruleset and point to ANOTHER
filename.rules conf...

Bye,
Raymond.

From raymond at PROLOCATION.NET  Thu Jul  3 23:11:46 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <5.2.1.1.2.20030703220014.03c87eb0@imap.ecs.soton.ac.uk>
Message-ID: <Pine.LNX.4.44.0307040010310.25180-100000@mailbox.prolocation.net>

Hi!

> Then construct a ruleset in /etc/MailScanner/rules/filename.rules that
> looks like this:
> From:   awkward@bugger.com      /etc/MailScanner/filename.special.rules.conf
> FromOrTo:       default         /etc/MailScanner/filename.rules.conf
>
> Edit /etc/MailScanner/MailScanner.conf so it uses it
> Filename Rules = /etc/MailScanner/rules/filename.rules

Is there a simple way to DISABLE filename rules for a domain or sender ?
I tried to set it empty for some domains, or to 'no' but that didnt work

 :)

Any way how to do that, besides a 'empty' filename.empty.rules or
something?

Bye,
Raymond.

From mailscanner at ELKNET.NET  Thu Jul  3 23:31:14 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner log entries
Message-ID: <200307032136.h63LamS01639@ori.rl.ac.uk>

I've been at this too long...

8-10 hous a day for the last 4 days, installing, learning, tweaking, customizing, testing, updating a mail filtering system...

has caused my brain to melt down. Sorry about that WAY STUPID question. I really am not normally that brain dead.

-Alan

>Think about what you are doing.
>
>Outside world ---> qmail server ---> MailScanner server
>
>Qmail is getting messages from all over the world, including places that
>are listed in various RBLs.
>But your MailScanner server is only getting mail from your qmail server,
>which presumably isn't in any RBLs. So it won't report any.

From ryanb at AACRAO.ORG  Thu Jul  3 23:16:36 2003
From: ryanb at AACRAO.ORG (Ryan Bingham)
Date: Thu Jan 12 21:18:51 2006
Subject: Why won't my mail forward?
References: <Pine.LNX.4.44.0307040000360.23456-100000@mailbox.prolocation.net>
Message-ID: <003901c341b0$c4f22940$f8240340@kh06s9>

My goodness!  I stepped away from my email for a couple hours and this
thread went crazy!!

:-)

Ryan

----- Original Message -----
From: "Raymond Dijkxhoorn" <raymond@PROLOCATION.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 03, 2003 6:01 PM
Subject: Re: Why won't my mail forward?


Hi!

> > Actually, it's a PIX firewall. And, from what I understand, it was very
> > expensive. It is about 3 years old though. We're hoping to get a linux
> > firewall in place soon.
>
> That's It! THAT'S **IT**!
>
> Check for firmware upgrades, and google for problems with PIX
> firewalls.

What OS is that PIX running ? (version) i might have some leads there. I
am used to admin PIXes :)

Bye,
Raymond.

From ryanb at AACRAO.ORG  Thu Jul  3 23:22:17 2003
From: ryanb at AACRAO.ORG (Ryan Bingham)
Date: Thu Jan 12 21:18:51 2006
Subject: OT Re: Why won't my mail forward?
References: <00c701c3419f$3620f180$9c01a8c0@home.middlefinger.net>
Message-ID: <007801c341b1$906cc490$f8240340@kh06s9>

I would also be willing to host such a list.  I think it's great that people
on here are so willing to help.  Definitely something to encourage.

Ryan

----- Original Message -----
From: "Mike Kercher" <mike@CAMAROSS.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 03, 2003 4:10 PM
Subject: Re: OT Re: Why won't my mail forward?


Julian,

Seems like we run into this from time to time.  What would be the odds you
could setup an OT mailing list?  I can do it on one of my servers if you
want.  Then people that want to subscribe and assist people with OT issues
can stay in the loop and lend a hand where needed.

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Thursday, July 03, 2003 3:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: OT Re: Why won't my mail forward?


This is really rather OT, and there have been 30 messages I have seen in
this thread so far.

Any chance a few of you could take the investigation off-list please, and
just post to the list once you've got it sorted or you all run out of ideas
and need some extra input from others?

At 21:03 03/07/2003, you wrote:
> > What is the IP of that other RH box?
>
>199.242.176.169
>
>Jody

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support

From mike at CAMAROSS.NET  Thu Jul  3 23:30:01 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:51 2006
Subject: OT Re: Why won't my mail forward?
In-Reply-To: <007801c341b1$906cc490$f8240340@kh06s9>
Message-ID: <000001c341b2$a467dc40$9c01a8c0@home.middlefinger.net>

I've created such a list.  Waiting on Julian to bless it now :)

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Ryan Bingham
Sent: Thursday, July 03, 2003 5:22 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: OT Re: Why won't my mail forward?


I would also be willing to host such a list.  I think it's great that people
on here are so willing to help.  Definitely something to encourage.

Ryan

----- Original Message -----
From: "Mike Kercher" <mike@CAMAROSS.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 03, 2003 4:10 PM
Subject: Re: OT Re: Why won't my mail forward?


Julian,

Seems like we run into this from time to time.  What would be the odds you
could setup an OT mailing list?  I can do it on one of my servers if you
want.  Then people that want to subscribe and assist people with OT issues
can stay in the loop and lend a hand where needed.

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Thursday, July 03, 2003 3:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: OT Re: Why won't my mail forward?


This is really rather OT, and there have been 30 messages I have seen in
this thread so far.

Any chance a few of you could take the investigation off-list please, and
just post to the list once you've got it sorted or you all run out of ideas
and need some extra input from others?

At 21:03 03/07/2003, you wrote:
> > What is the IP of that other RH box?
>
>199.242.176.169
>
>Jody

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support


From JeremyE at BSA.CA.GOV  Fri Jul  4 00:04:41 2003
From: JeremyE at BSA.CA.GOV (Jeremy Evans)
Date: Thu Jan 12 21:18:51 2006
Subject: Rulesets: Match first or match last?
Message-ID: <1A91F0B5CDA2D7119000080009DCFDBC1BCD83@pebble.bsa.ca.gov>

I thought rulesets were supposed to use the first entry that matches, but
I'm doing some testing now and that doesn't seem to be the case.  If I use
this ruleset:

   # filename.rules
   # This file lists which e-mails are scanned for nasty filenames
   From:        jeremye@bsa.ca.gov
/opt/MailScanner/etc/filename.rules.conf
   From:        *@bsa.ca.gov
/opt/MailScanner/etc/filename.allowall.conf
   FromTo:      default
/opt/MailScanner/etc/filename.rules.conf

and send an e-mail from jeremye@bsa.ca.gov with an attached file blocked in
filename.rules.conf, it comes through without any problems.  If I use this
ruleset:

   # filename.rules
   # This file lists which e-mails are scanned for nasty filenames
   From:        *@bsa.ca.gov
/opt/MailScanner/etc/filename.allowall.conf
   From:        jeremye@bsa.ca.gov
/opt/MailScanner/etc/filename.rules.conf
   FromTo:      default
/opt/MailScanner/etc/filename.rules.conf

the attachment is stripped from the file.  Are the rulesets supposed to use
the first entry that matches, or the last one?

Jeremy Evans
Information Systems Analyst
California State Auditor
916-445-0255 phone
916-322-7801 fax

From symedeot at YAHOO.FR  Fri Jul  4 08:31:21 2003
From: symedeot at YAHOO.FR (Sylvain MEDEOT)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner issue with postfix
Message-ID: <LISTSERV%2003070408312135@JISCMAIL.AC.UK>

Hi,

You don't mention which Postfix version you are using. From my experience,
versions of Postfix prior to postfix-1.1.11 won't work with MailScanner.

One thing that should be missing in your files is :

hash_queue_depth = 1
hash_queue_names = incoming deferred active bounce flush

in both /etc/postfix/main.cf and /etc/postfix.in/main.cf

Then you have to stop Postfix and run :

postfix -c /etc/postfix.in check
postfix -c /etc/postfix check

On my system, before running postfix, I drop these two directories then I
did a mkdir /var/spool/postfix /var/spool/postfix.in

By doing so, you made to have not flat directories (they are not
compatibles with MailScanner, recent versions of Postfix are OK).

After doing this on my server, MailScanner starts working fine for some
minutes then I had some mails lost (they were going into postfix/corrupted)
and finally the server crashes with the following logs :

Jun 30 15:32:20 intranet postfix/qmgr[4599]: warning: 1081F5B855: envelope
records out of order
Jun 30 15:32:20 intranet postfix/qmgr[4599]: warning: corrupt file queue
active id 1081F5B855
Jun 30 15:32:25 intranet postfix/qmgr[4599]: warning: 927DA5B859: envelope
records out of order
Jun 30 15:32:25 intranet postfix/qmgr[4599]: warning: corrupt file queue
active id 927DA5B859
Jun 30 15:33:20 intranet MailScanner[4636]: Corrupt queue output file
Jun 30 15:33:20 intranet postfix/qmgr[4599]: warning: BEF445B861: envelope
records out of order
Jun 30 15:33:20 intranet postfix/qmgr[4599]: warning: corrupt file queue
active id BEF445B861
Jun 30 15:35:34 intranet postfix/qmgr[4599]: warning: 2B65C5B871: envelope
records out of order
Jun 30 15:35:34 intranet postfix/qmgr[4599]: warning: corrupt file queue
active id 2B65C5B871

Following Julian's suggestion, I decide to upgrade my current postfix to
one of the versions he tested (postfix-1.1.11).

I got the sources and compile it. Very easy...
I then did a copy of my postfix cf files and run a make upgrade.

After doing this, I had to make some minor changes to main.cf since some
keywords changed between the two versions.

Before running postfix, I drop /var/spool/postfix /var/spool/postfix.in
and then I did a mkdir /var/spool/postfix /var/spool/postfix.in

Then I run postfix alone to see if everything was fine. It was. Finally, I
did again the whole process of copying /etc/postfix to /etc/postfix.in and
all process described in MainScanner installation guide.

And, now, everything is fine and reliable... Most problems can be solved by
having a look to /var/log/mail

Hope that can help somebody...

From David.While at UCE.AC.UK  Fri Jul  4 08:51:55 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner 101, take two.
Message-ID: <107DE25EC0216C45AEF670016024245F64416F@exchangea.staff.uce.ac.uk>

They updated the DB twice yesterday (3 July). I guess the update frequency is determined by the virus writers - you only update the signatures when a new virus outbreak occurs.
 
David While

	-----Original Message----- 
	From: Kevin Miller [mailto:Kevin_Miller@CI.JUNEAU.AK.US] 
	Sent: Thu 03/07/2003 19:09 
	To: MAILSCANNER@JISCMAIL.AC.UK 
	Cc: 
	Subject: Re: MailScanner 101, take two.
	
	

	Thanks.  Earlier posts (month or two ago I think) indicated that they
	weren't the quickest off the line with updates, but one or two posts isn't a
	very big statistical sample!  So, how satisfied have you ClamAV users been
	with the pattern updates?  Do they come in in a timely fashion?
	
	TIA...
	
	...Kevin
	-------------------
	Kevin Miller                Registered Linux User No: 307357
	CBJ MIS Dept.               Network Systems Administrator, Mail
	Administrator
	155 South Seward Street     ph: (907) 586-0242
	Juneau, Alaska 99801        fax: (907 586-4500
	
	
	>-----Original Message-----
	>From: Peter Bonivart [mailto:peter@UCGBOOK.COM]
	>Sent: Thursday, July 03, 2003 9:21 AM
	>To: MAILSCANNER@JISCMAIL.AC.UK
	>Subject: Re: MailScanner 101, take two.
	>
	>
	>For AV you could always use ClamAV that is completely free.
	>Recent posts
	>on the list has it that CA eTrust is legit to run with a $28
	>workstation
	>license. That might also be interesting.
	>
	>ClamAV scans faster than F-Prot in my tests. It's also covered by
	>MailScanners signature-updating script but you should update
	>the program
	>from time to time. But you can forget about the check instead! :)
	>
	>Check this for more info:
	>
	>http://www.sng.ecs.soton.ac.uk/mailscanner/install/OS-virus-sca
	>n-web.htm
	>
	>/Peter Bonivart
	>
	>--Unix lovers do it in the Sun
	>
	>Kevin Miller wrote:
	>
	>> For the antivirus I got a copy of F-Prot, but then they
	>changed the license.
	>> Aargh.  A grand more to do the same thing.  So I'm looking
	>at a different
	>> antivirus solution now, probably RAV.  I don't mind paying for
	>> support/updates and I thought the original $300 F-prot cost was quite
	>> reasonable, but the new scheme isn't exactly competitive.
	>Does RAV auto
	>> update both the signatures and the program?  I want
	>something I can put in
	>> and ignore until it's time to send 'em another check in a
	>year.  A friend is
	>> using Sophos, and he says he has to put in a new user
	>license quarterly or
	>> some such.  Life's too short for that.  All the docs seem to refer to
	>> installing Sophos as a step however.  Can I presume that I
	>can substitute
	>> whatever flavor of antivirus there and *not* have to install Sophos?
	>
	



From P.G.M.Peters at utwente.nl  Fri Jul  4 08:59:39 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner replacements
Message-ID: <7qcagv8e61u2a143eggps35fe26q9r917f@4ax.com>

Sometimes other (not as good as) MailScanner replacements pop up. A few
days ago (yes, I'm behind on my e-mail) my boss forwarded me an e-mail
from/about Vircom/Sieve. Anybody any experience with this?

It looks as if it does the same as MailScanner only they claim the have
something called Sieve that is something "new". And it is update trough
information gathered at 15 ISP's.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From mailscanner at ecs.soton.ac.uk  Fri Jul  4 09:28:14 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <Pine.LNX.4.44.0307040010310.25180-100000@mailbox.prolocati
              on.net>
References: <5.2.1.1.2.20030703220014.03c87eb0@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030704092730.0452fbc8@imap.ecs.soton.ac.uk>

At 23:11 03/07/2003, you wrote:
>Hi!
>
> > Then construct a ruleset in /etc/MailScanner/rules/filename.rules that
> > looks like this:
> >
> From:   awkward@bugger.com      /etc/MailScanner/filename.special.rules.conf
> > FromOrTo:       default         /etc/MailScanner/filename.rules.conf
> >
> > Edit /etc/MailScanner/MailScanner.conf so it uses it
> > Filename Rules = /etc/MailScanner/rules/filename.rules
>
>Is there a simple way to DISABLE filename rules for a domain or sender ?
>I tried to set it empty for some domains, or to 'no' but that didnt work

Use a filename.special.rules.conf that starts with
allow   .       -       -

That rule will match every filename and allow it.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Fri Jul  4 09:31:38 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: Rulesets: Match first or match last?
In-Reply-To: <1A91F0B5CDA2D7119000080009DCFDBC1BCD83@pebble.bsa.ca.gov>
Message-ID: <5.2.0.9.2.20030704093001.044ea140@imap.ecs.soton.ac.uk>

The Filename Rules option concatenates all the matching rule results
together, then uses that as the set of allow/deny rules for the attachment
filenames.

It only uses the "default" setting if none of the other rules match.


At 00:04 04/07/2003, you wrote:
>I thought rulesets were supposed to use the first entry that matches, but
>I'm doing some testing now and that doesn't seem to be the case.  If I use
>this ruleset:
>
>    # filename.rules
>    # This file lists which e-mails are scanned for nasty filenames
>    From:        jeremye@bsa.ca.gov
>/opt/MailScanner/etc/filename.rules.conf
>    From:        *@bsa.ca.gov
>/opt/MailScanner/etc/filename.allowall.conf
>    FromTo:      default
>/opt/MailScanner/etc/filename.rules.conf
>
>and send an e-mail from jeremye@bsa.ca.gov with an attached file blocked in
>filename.rules.conf, it comes through without any problems.  If I use this
>ruleset:
>
>    # filename.rules
>    # This file lists which e-mails are scanned for nasty filenames
>    From:        *@bsa.ca.gov
>/opt/MailScanner/etc/filename.allowall.conf
>    From:        jeremye@bsa.ca.gov
>/opt/MailScanner/etc/filename.rules.conf
>    FromTo:      default
>/opt/MailScanner/etc/filename.rules.conf
>
>the attachment is stripped from the file.  Are the rulesets supposed to use
>the first entry that matches, or the last one?
>
>Jeremy Evans
>Information Systems Analyst
>California State Auditor
>916-445-0255 phone
>916-322-7801 fax

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Fri Jul  4 09:29:30 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: OT Re: Why won't my mail forward?
In-Reply-To: <000001c341b2$a467dc40$9c01a8c0@home.middlefinger.net>
References: <007801c341b1$906cc490$f8240340@kh06s9>
Message-ID: <5.2.0.9.2.20030704092832.045554c8@imap.ecs.soton.ac.uk>

Consider it blessed :-)

I suggest that whenever a thread is moved to the OT list then a single
"Going OT" posting goes to the main list, with subscription and posting
details about the OT list so that people can follow it.

At 23:30 03/07/2003, you wrote:
>I've created such a list.  Waiting on Julian to bless it now :)
>
>Mike
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Ryan Bingham
>Sent: Thursday, July 03, 2003 5:22 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: OT Re: Why won't my mail forward?
>
>
>I would also be willing to host such a list.  I think it's great that people
>on here are so willing to help.  Definitely something to encourage.
>
>Ryan
>
>----- Original Message -----
>From: "Mike Kercher" <mike@CAMAROSS.NET>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Thursday, July 03, 2003 4:10 PM
>Subject: Re: OT Re: Why won't my mail forward?
>
>
>Julian,
>
>Seems like we run into this from time to time.  What would be the odds you
>could setup an OT mailing list?  I can do it on one of my servers if you
>want.  Then people that want to subscribe and assist people with OT issues
>can stay in the loop and lend a hand where needed.
>
>Mike
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Thursday, July 03, 2003 3:11 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: OT Re: Why won't my mail forward?
>
>
>This is really rather OT, and there have been 30 messages I have seen in
>this thread so far.
>
>Any chance a few of you could take the investigation off-list please, and
>just post to the list once you've got it sorted or you all run out of ideas
>and need some extra input from others?
>
>At 21:03 03/07/2003, you wrote:
> > > What is the IP of that other RH box?
> >
> >199.242.176.169
> >
> >Jody
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks
>transtec Computers for their support

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From dean.plant at ROKE.CO.UK  Fri Jul  4 10:16:10 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:18:51 2006
Subject: Using sa-learn to add ham mail to the spamassassin database
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A702366CC@rsys004a.roke.co.uk>

I am using MailScanner 4.21-9 on Redhat 8 with spamassassin 2.55, dcc and razor2. MailScanner is used as our external relay with all internal mail handled by exchange/outlook.

For low scoring spam I am using the "attachment deliver" spam actions.

My question is regarding false positives of low scoring spam and the best way to teach spamassassin with sa-learn.

I had asked users to drag and drop incorrectly identified spam mail into a public folder but after the spam is delivered the spam mail is changed to have the subject line {spam?} with the original header information and the original mail is the attachment but the header info has been removed. So using this mail with sa-learn will not give the correct results.

Can anyone advise the best way to get the original mail with all the header info back onto the MailScanner server.

Thanks in advance.

Dean Plant.

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

From Antony at SOFT-SOLUTIONS.CO.UK  Fri Jul  4 10:33:02 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:51 2006
Subject: Using sa-learn to add ham mail to the spamassassin database
In-Reply-To: <EA943CD30BCB104E9D38F5B5DC2D9A702366CC@rsys004a.roke.co.uk>
References: <EA943CD30BCB104E9D38F5B5DC2D9A702366CC@rsys004a.roke.co.uk>
Message-ID: <200307040934.h649Yfg19989@agate.rockstone.co.uk>

On Friday 04 July 2003 10:16 am, Plant, Dean wrote:

> I am using MailScanner 4.21-9 on Redhat 8 with spamassassin 2.55, dcc and
> razor2. MailScanner is used as our external relay with all internal mail
> handled by exchange/outlook.
>
> For low scoring spam I am using the "attachment deliver" spam actions.
>
> My question is regarding false positives of low scoring spam and the best
> way to teach spamassassin with sa-learn.
>
> I had asked users to drag and drop incorrectly identified spam mail into a
> public folder but after the spam is delivered the spam mail is changed to
> have the subject line {spam?} with the original header information and the
> original mail is the attachment but the header info has been removed. So
> using this mail with sa-learn will not give the correct results.
>
> Can anyone advise the best way to get the original mail with all the header
> info back onto the MailScanner server.

You could change the actions for low-scoring spam to include 'quarantine',
and then use a script to pick the message ID out of the false-positives which
users drag and drop into the public folder, match that with the filenames of
the quarantined messages, and there you have the original false-positive
message with no changes?

Regards,

Antony.

--

What is this talk of software 'release' ?
Our software evolves and matures until it becomes capable of escape,
leaving a bloody trail of designers and quality assurance people in its wake.

From mailscanner at BARENDSE.TO  Fri Jul  4 10:33:16 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:51 2006
Subject: Allow Form Tags ??
Message-ID: <Pine.LNX.4.44.0307041129510.18949-100000@raveon.barendse.to>

Since the upgrade to the latest version of MailScanner I seem to be
getting some legitimate messages from customers that use HTML Form Tags
which are now being blocked.

Rather than opening up everything to these form tags wouldn't it be
possible to convert the form tags to a 'normal' html message
thereby 'cleaning' the message of any unwanted crap?

From raymond at PROLOCATION.NET  Fri Jul  4 10:41:59 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <5.2.0.9.2.20030704092730.0452fbc8@imap.ecs.soton.ac.uk>
Message-ID: <Pine.LNX.4.44.0307041141070.10205-100000@mailbox.prolocation.net>

Hi!

> >Is there a simple way to DISABLE filename rules for a domain or sender ?
> >I tried to set it empty for some domains, or to 'no' but that didnt work

> Use a filename.special.rules.conf that starts with
> allow   .       -       -
>
> That rule will match every filename and allow it.

That i have now, but would it be possible to just let that empty in the
config ? Or a switch to disable filename rules ? I would prefer that.

Bye,
Raymond.

From mailscanner at ecs.soton.ac.uk  Fri Jul  4 11:00:27 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: Allow Form Tags ??
In-Reply-To: <Pine.LNX.4.44.0307041129510.18949-100000@raveon.barendse.t o>
Message-ID: <5.2.0.9.2.20030704110012.05114138@imap.ecs.soton.ac.uk>

At 10:33 04/07/2003, you wrote:
>Since the upgrade to the latest version of MailScanner I seem to be
>getting some legitimate messages from customers that use HTML Form Tags
>which are now being blocked.
>
>Rather than opening up everything to these form tags wouldn't it be
>possible to convert the form tags to a 'normal' html message
>thereby 'cleaning' the message of any unwanted crap?

Allow the Form tags but set "Strip Dangerous HTML".
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Fri Jul  4 11:01:29 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <Pine.LNX.4.44.0307041141070.10205-100000@mailbox.prolocati
              on.net>
References: <5.2.0.9.2.20030704092730.0452fbc8@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030704110054.03d926e0@imap.ecs.soton.ac.uk>

At 10:41 04/07/2003, you wrote:
>Hi!
>
> > >Is there a simple way to DISABLE filename rules for a domain or sender ?
> > >I tried to set it empty for some domains, or to 'no' but that didnt work
>
> > Use a filename.special.rules.conf that starts with
> > allow   .       -       -
> >
> > That rule will match every filename and allow it.
>
>That i have now, but would it be possible to just let that empty in the
>config ?

Probably, yes. It allows filenames by default. I haven't tried it myself
but I think it should work.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From raymond at PROLOCATION.NET  Fri Jul  4 11:10:06 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: How can I exclude exe attachment from single email address
In-Reply-To: <5.2.0.9.2.20030704110054.03d926e0@imap.ecs.soton.ac.uk>
Message-ID: <Pine.LNX.4.44.0307041209001.12874-100000@mailbox.prolocation.net>

Hi!

> >That i have now, but would it be possible to just let that empty in the
> >config ?

> Probably, yes. It allows filenames by default. I haven't tried it myself
> but I think it should work.

Wont work, i tried that allready :) But would be nice to have that as an
addition. Or a config option where you simply, same as for spam and virus
scanning tell: Use filename rules = no

Bye,
Raymond.

From m.sapsed at BANGOR.AC.UK  Fri Jul  4 12:07:52 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:51 2006
Subject: directory containing all the reports in all the languages
References: <5.2.0.9.2.20030703162442.05147f98@imap.ecs.soton.ac.uk>
Message-ID: <3F056008.2030708@bangor.ac.uk>

Julian Field wrote:
> No, because the default seting for each of the reports is
>         %report-dir%/deleted.filename.message.txt
> for example, so the %report-dir% should contain the language code as well.
>
> At 13:05 03/07/2003, you wrote:
>
>> Just noticed this new option in the MailScanner.conf file:
>>
>> # Set the directory containing all the reports in all the languages
>> %report-dir% = /etc/MailScanner/reports/en
>>
>>
>> Shouldn't this be set to :
>> /etc/MailScanner/reports
>> as default?
>>
>> Or is this the option for the defualt language directory if no specific
>> language is defined for a top level domain??
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support



--
Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From m.sapsed at BANGOR.AC.UK  Fri Jul  4 12:09:59 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:51 2006
Subject: directory containing all the reports in all the languages
References: <5.2.0.9.2.20030703162442.05147f98@imap.ecs.soton.ac.uk>
Message-ID: <3F056087.8090609@bangor.ac.uk>

Apologies for the previous unhelpful message - keyboard playing up!

Julian Field wrote:
> No, because the default seting for each of the reports is
>         %report-dir%/deleted.filename.message.txt
> for example, so the %report-dir% should contain the language code as well.

Would

# Set the directory containing all the reports in the required language

be better wording then?

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From mailscanner at ecs.soton.ac.uk  Fri Jul  4 12:13:05 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: directory containing all the reports in all the languages
In-Reply-To: <3F056087.8090609@bangor.ac.uk>
References: <5.2.0.9.2.20030703162442.05147f98@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030704121301.03d643f8@imap.ecs.soton.ac.uk>

Fixed.

At 12:09 04/07/2003, you wrote:
>Apologies for the previous unhelpful message - keyboard playing up!
>
>Julian Field wrote:
>>No, because the default seting for each of the reports is
>>         %report-dir%/deleted.filename.message.txt
>>for example, so the %report-dir% should contain the language code as well.
>
>Would
>
># Set the directory containing all the reports in the required language
>
>be better wording then?
>
>Cheers,
>
>Martin
>
>--
>Martin Sapsed
>Information Services               "Who do you say I am?"
>University of Wales, Bangor             Jesus of Nazareth

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From hb at dfs.dk  Fri Jul  4 14:09:09 2003
From: hb at dfs.dk (Henrik Bro)
Date: Thu Jan 12 21:18:51 2006
Subject: Antivirus License?
In-Reply-To: <5.2.0.9.2.20030704121301.03d643f8@imap.ecs.soton.ac.uk>
Message-ID: <001b01c3422d$74f942c0$2f11a550@henrik>

Does anyone know if any of the commercial AV products have a free solution
for non-commercial / non-profit use? (I know Trend Micro has vscan)

Or have a license where I buy a server-license and do not have to pay per.
Mailbox?

Best regards,
Henrik

From mailscanner at LISTS.COM.AR  Fri Jul  4 14:23:29 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner replacements
In-Reply-To: <7qcagv8e61u2a143eggps35fe26q9r917f@4ax.com>
Message-ID: <3F0555A1.9166.13885315@localhost>

I just browsed over vircom's site... they have something called Anti-SPAM 
Gate (http://www.vircom.com/Enterprise/Solutions/antispamgate/) without a lot 
of info about it...

AFAICS, it uses Sieve for filtering... Sieve is a relatively new standard 
language for mail filtering... it is being incorporated on some mail clients 
and server as a filtering language so users can write scripts based on 
message properties or contents and filter every incoming message... IIRC, you 
can accept, bounce, drop, copy/move to a certain folder based on things 
inside the message.

The only open source server I recall using it is CMU's cyrus imap server... 
incidentally, I think the language was developed by people at CMU :-)

I also recall a couple of mail clients using it... I think recent versions of 
Cyrusoft Mulberry (payware) use it for locally filtering.

Now, Sieve is a fine language for filtering, but, in itself, it's nothing 
else... It is interesting that, being standard, once you learn to filter in 
Sieve, you can carry your scripts from client to server, or test in the 
client, then copy to server, etc...

I don't recall it can do fancy things as scoring, de-html, etc... For what I 
see in vircom site, the advantage of Sieve is that you, as a paying customer 
can contribute to vircom so other paying customers take advantage of your 
experience... I don't think it is nowhere near what spamassassin, razor, dcc 
do... openly and for free :-)

El 4 Jul 2003 a las 9:59, Peter Peters escribi?:

> Sometimes other (not as good as) MailScanner replacements pop up. A few
> days ago (yes, I'm behind on my e-mail) my boss forwarded me an e-mail
> from/about Vircom/Sieve. Anybody any experience with this?
> 
> It looks as if it does the same as MailScanner only they claim the have
> something called Sieve that is something "new". And it is update trough
> information gathered at 15 ISP's.
> 
> --
> Peter Peters, senior netwerkbeheerder
> Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
> Universiteit Twente,  Postbus 217,  7500 AE  Enschede
> telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ


--
Mariano Absatz
El Baby
----------------------------------------------------------
The use of COBOL cripples the mind; its teaching should,
therefore, be regarded as a criminal offense.
              -- E. W. Dijkstra


From mailscanner at ecs.soton.ac.uk  Fri Jul  4 14:43:31 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner replacements
In-Reply-To: <3F0555A1.9166.13885315@localhost>
References: <7qcagv8e61u2a143eggps35fe26q9r917f@4ax.com>
Message-ID: <5.2.0.9.2.20030704143536.04680650@imap.ecs.soton.ac.uk>

Let's all play "spot the snake oil".

"Its unique multi-layered approach stops all spammer attacks".
Yeah, right.

"24/7 Sieve script auto-updates"
Ooh, great, all your spam are belong to us.
I wonder how long it will be before the spammers start polluting their 
database of scripts. You have to submit 50 lines of script, which they 
claim they will check, before you get to be a "member of the coalition". 
Must be a bit like finding weapons of mass destruction :-)

People like Razor use far more sophisticated anti-pollution mechanisms 
based on dynamic evaluations of the history of your spam submissions 
compared against other people's submissions.

Call a cynical old git if you like...

At 14:23 04/07/2003, you wrote:
>I just browsed over vircom's site... they have something called Anti-SPAM
>Gate (http://www.vircom.com/Enterprise/Solutions/antispamgate/) without a lot
>of info about it...
>
>AFAICS, it uses Sieve for filtering... Sieve is a relatively new standard
>language for mail filtering... it is being incorporated on some mail clients
>and server as a filtering language so users can write scripts based on
>message properties or contents and filter every incoming message... IIRC, you
>can accept, bounce, drop, copy/move to a certain folder based on things
>inside the message.
>
>The only open source server I recall using it is CMU's cyrus imap server...
>incidentally, I think the language was developed by people at CMU :-)
>
>I also recall a couple of mail clients using it... I think recent versions of
>Cyrusoft Mulberry (payware) use it for locally filtering.
>
>Now, Sieve is a fine language for filtering, but, in itself, it's nothing
>else... It is interesting that, being standard, once you learn to filter in
>Sieve, you can carry your scripts from client to server, or test in the
>client, then copy to server, etc...
>
>I don't recall it can do fancy things as scoring, de-html, etc... For what I
>see in vircom site, the advantage of Sieve is that you, as a paying customer
>can contribute to vircom so other paying customers take advantage of your
>experience... I don't think it is nowhere near what spamassassin, razor, dcc
>do... openly and for free :-)
>
>El 4 Jul 2003 a las 9:59, Peter Peters escribi?:
>
> > Sometimes other (not as good as) MailScanner replacements pop up. A few
> > days ago (yes, I'm behind on my e-mail) my boss forwarded me an e-mail
> > from/about Vircom/Sieve. Anybody any experience with this?
> >
> > It looks as if it does the same as MailScanner only they claim the have
> > something called Sieve that is something "new". And it is update trough
> > information gathered at 15 ISP's.
> >
> > --
> > Peter Peters, senior netwerkbeheerder
> > Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
> > Universiteit Twente,  Postbus 217,  7500 AE  Enschede
> > telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ
>
>
>--
>Mariano Absatz
>El Baby
>----------------------------------------------------------
>The use of COBOL cripples the mind; its teaching should,
>therefore, be regarded as a criminal offense.
>               -- E. W. Dijkstra

-- 
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support


From sevans at FOUNDATION.SDSU.EDU  Fri Jul  4 15:09:50 2003
From: sevans at FOUNDATION.SDSU.EDU (Steve Evans)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner replacements
Message-ID: <95B481BA6D181A4685081D263BF9A13A45B2@mail.foundation.sdsu.edu>

>> Must be a bit like finding weapons of mass destruction :-) 

Easy, you saw what happened to the Dixie Chicks ;-)


Steve Evans
SDSU Foundation
(619) 594-0653

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
Sent: Friday, July 04, 2003 6:44 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner replacements

Let's all play "spot the snake oil".

"Its unique multi-layered approach stops all spammer attacks".
Yeah, right.

"24/7 Sieve script auto-updates"
Ooh, great, all your spam are belong to us.
I wonder how long it will be before the spammers start polluting their database of scripts. You have to submit 50 lines of script, which they claim they will check, before you get to be a "member of the coalition". 
Must be a bit like finding weapons of mass destruction :-)

People like Razor use far more sophisticated anti-pollution mechanisms based on dynamic evaluations of the history of your spam submissions compared against other people's submissions.

Call a cynical old git if you like...

At 14:23 04/07/2003, you wrote:
>I just browsed over vircom's site... they have something called 
>Anti-SPAM Gate 
>(http://www.vircom.com/Enterprise/Solutions/antispamgate/) without a lot of info about it...
>
>AFAICS, it uses Sieve for filtering... Sieve is a relatively new 
>standard language for mail filtering... it is being incorporated on 
>some mail clients and server as a filtering language so users can write 
>scripts based on message properties or contents and filter every 
>incoming message... IIRC, you can accept, bounce, drop, copy/move to a 
>certain folder based on things inside the message.
>
>The only open source server I recall using it is CMU's cyrus imap server...
>incidentally, I think the language was developed by people at CMU :-)
>
>I also recall a couple of mail clients using it... I think recent 
>versions of Cyrusoft Mulberry (payware) use it for locally filtering.
>
>Now, Sieve is a fine language for filtering, but, in itself, it's 
>nothing else... It is interesting that, being standard, once you learn 
>to filter in Sieve, you can carry your scripts from client to server, 
>or test in the client, then copy to server, etc...
>
>I don't recall it can do fancy things as scoring, de-html, etc... For 
>what I see in vircom site, the advantage of Sieve is that you, as a 
>paying customer can contribute to vircom so other paying customers take 
>advantage of your experience... I don't think it is nowhere near what 
>spamassassin, razor, dcc do... openly and for free :-)
>
>El 4 Jul 2003 a las 9:59, Peter Peters escribi?:
>
> > Sometimes other (not as good as) MailScanner replacements pop up. A 
> > few days ago (yes, I'm behind on my e-mail) my boss forwarded me an 
> > e-mail from/about Vircom/Sieve. Anybody any experience with this?
> >
> > It looks as if it does the same as MailScanner only they claim the 
> > have something called Sieve that is something "new". And it is 
> > update trough information gathered at 15 ISP's.
> >
> > --
> > Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, 
> > Bibliotheek en Educatie (ITBE) Universiteit Twente,  Postbus 217,  
> > 7500 AE  Enschede
> > telefoon: 053 - 489 2301, fax: 053 - 489 2383, 
> > http://www.utwente.nl/civ
>
>
>--
>Mariano Absatz
>El Baby
>----------------------------------------------------------
>The use of COBOL cripples the mind; its teaching should, therefore, be 
>regarded as a criminal offense.
>               -- E. W. Dijkstra

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support


From miguelk at KONSULTEX.COM.BR  Fri Jul  4 15:29:21 2003
From: miguelk at KONSULTEX.COM.BR (Miguel Koren O'Brien de Lacy)
Date: Thu Jan 12 21:18:51 2006
Subject: Antivirus License?
References: <001b01c3422d$74f942c0$2f11a550@henrik>
Message-ID: <3F058F41.8080900@konsultex.com.br>

Henrik;

As far as I know this is free for private use:

http://www.hbedv.com/download/download.htm

You can also check out:

http://www.openantivirus.org/

To see if you can come up with some more inspiration about 'per server'.

[]s

Miguel

Henrik Bro wrote:

>Does anyone know if any of the commercial AV products have a free solution
>for non-commercial / non-profit use? (I know Trend Micro has vscan)
>
>Or have a license where I buy a server-license and do not have to pay per.
>Mailbox?
>
>Best regards,
>Henrik
>
>

From mailscanner at LISTS.COM.AR  Fri Jul  4 15:30:11 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:51 2006
Subject: Rulesets: Match first or match last?
In-Reply-To: <5.2.0.9.2.20030704093001.044ea140@imap.ecs.soton.ac.uk>
References: <1A91F0B5CDA2D7119000080009DCFDBC1BCD83@pebble.bsa.ca.gov>
Message-ID: <3F056543.12872.13C56412@localhost>

Yes,
but what Jeremy shows is that in the first example the first (non-default) 
rule should have applied but the second one did (supposedly both matched)...

Now that I see that the actual From: in Jeremy's message is 
JeremyE@BSA.CA.GOV I wonder... are you upcasing or lowcasing e-mail addresses 
before matching rules?...

This is kind of PITA, since domain names are case insensitive by definition, 
but the case sensitivity of the local part is a harder issue...

RFC 2821 (SMTP) says (sect.2.4, page 14):

                                   [...] The local-part of a mailbox
   MUST BE treated as case sensitive.  Therefore, SMTP implementations
   MUST take care to preserve the case of mailbox local-parts.  Mailbox
   domains are not case sensitive.  In particular, for some hosts the
   user "smith" is different from the user "Smith".  However, exploiting
   the case sensitivity of mailbox local-parts impedes interoperability
   and is discouraged.

So we shouldn't change the localpart (the part before the "@"), but then, 
most mail servers treat it as case-insensitive.

In any case, if we decide that we should lowcase the addresses before doing 
any comparisons inside MailScanner, we should preserve the _original_ 
envelope SMTP from and to addresses and use that whenever delivering/copying 
the message for delivering it... I think this is what is being done today, 
but I don't remember...


El 4 Jul 2003 a las 9:31, Julian Field escribi?:

> The Filename Rules option concatenates all the matching rule results
> together, then uses that as the set of allow/deny rules for the attachment
> filenames.
> 
> It only uses the "default" setting if none of the other rules match.
> 
> 
> At 00:04 04/07/2003, you wrote:
> >I thought rulesets were supposed to use the first entry that matches, but
> >I'm doing some testing now and that doesn't seem to be the case.  If I use
> >this ruleset:
> >
> >    # filename.rules
> >    # This file lists which e-mails are scanned for nasty filenames
> >    From:        jeremye@bsa.ca.gov
> >/opt/MailScanner/etc/filename.rules.conf
> >    From:        *@bsa.ca.gov
> >/opt/MailScanner/etc/filename.allowall.conf
> >    FromTo:      default
> >/opt/MailScanner/etc/filename.rules.conf
> >
> >and send an e-mail from jeremye@bsa.ca.gov with an attached file blocked in
> >filename.rules.conf, it comes through without any problems.  If I use this
> >ruleset:
> >
> >    # filename.rules
> >    # This file lists which e-mails are scanned for nasty filenames
> >    From:        *@bsa.ca.gov
> >/opt/MailScanner/etc/filename.allowall.conf
> >    From:        jeremye@bsa.ca.gov
> >/opt/MailScanner/etc/filename.rules.conf
> >    FromTo:      default
> >/opt/MailScanner/etc/filename.rules.conf
> >
> >the attachment is stripped from the file.  Are the rulesets supposed to use
> >the first entry that matches, or the last one?
> >
> >Jeremy Evans
> >Information Systems Analyst
> >California State Auditor
> >916-445-0255 phone
> >916-322-7801 fax
> 
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support


--
Mariano Absatz
El Baby
----------------------------------------------------------
I started out with nothing & still have most of it left.


From mike at CAMAROSS.NET  Fri Jul  4 15:34:19 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner replacements
In-Reply-To: <7qcagv8e61u2a143eggps35fe26q9r917f@4ax.com>
Message-ID: <002d01c34239$5b7047c0$9c01a8c0@home.middlefinger.net>

Sieve is not new to my knowledge.  I have a server running SuSE Openexchange
4 in my office.  This box uses postfix and Cyrus-IMAP (among other
packages).  Sieve is part of Cyrus and is a filtering tool.  On the SuSE
box, it is used to organize mail upon arrival into specific folders based on
rules configured by the users.  Much like procmail.  SuSE also puts
SpamAssassin on these systems, but I disable it and still use MS/SA on
another MX and forward using mailertable.

Mike

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Peter Peters
Sent: Friday, July 04, 2003 3:00 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner replacements


Sometimes other (not as good as) MailScanner replacements pop up. A few days
ago (yes, I'm behind on my e-mail) my boss forwarded me an e-mail from/about
Vircom/Sieve. Anybody any experience with this?

It looks as if it does the same as MailScanner only they claim the have
something called Sieve that is something "new". And it is update trough
information gathered at 15 ISP's.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit
Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ


From mike at CAMAROSS.NET  Fri Jul  4 15:47:48 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:51 2006
Subject: ANNOUNCE:  OT Mailing List
Message-ID: <002e01c3423b$3d8313d0$9c01a8c0@home.middlefinger.net>

I have created a mailing list for OT discussions.  Per Julian's
recommendation, new threads should not be created on this list.  This is
where threads deems OT for the main list should be moved for further group
discussion and assistance.  Once a resolution is found, it is requested that
the solution be posted back to the main MailScanner mailing list so it will
show up in the archives and everyone will share the knowledge.

Per Christopher Hicks' request, the list has been aptly names
MailScanner-Wizards.

You can subscribe/manage here:

http://CamaroSS.net/mailman/admin/mailscanner-wizards

Please contact me with any questions, suggestions or concerns.

Mike


From Kevin.Spicer at BMRB.CO.UK  Fri Jul  4 15:54:57 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:51 2006
Subject: ANNOUNCE:  OT Mailing List
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6E2@pascal.priv.bmrb.co.uk>

> Per Christopher Hicks' request, the list has been aptly names
> MailScanner-Wizards. 
> 
> You can subscribe/manage here:
> 
> http://CamaroSS.net/mailman/admin/mailscanner-wizards
> 
> Please contact me with any questions, suggestions or concerns.

Mike, that link points to an admin login only.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From David.While at UCE.AC.UK  Fri Jul  4 16:00:40 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:18:51 2006
Subject: ANNOUNCE:  OT Mailing List
Message-ID: <107DE25EC0216C45AEF670016024245F6EEC@exchangea.staff.uce.ac.uk>

Think it should be:

http://CamaroSS.net/mailman/listinfo/mailscanner-wizards

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------


-----Original Message-----
From: Spicer, Kevin [mailto:Kevin.Spicer@BMRB.CO.UK]
Sent: 04 July 2003 15:55
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: ANNOUNCE: OT Mailing List


> Per Christopher Hicks' request, the list has been aptly names
> MailScanner-Wizards. 
> 
> You can subscribe/manage here:
> 
> http://CamaroSS.net/mailman/admin/mailscanner-wizards
> 
> Please contact me with any questions, suggestions or concerns.

Mike, that link points to an admin login only.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From marco at MUW.EDU  Fri Jul  4 16:48:43 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner replacements
In-Reply-To: <5.2.0.9.2.20030704143536.04680650@imap.ecs.soton.ac.uk>
References: <7qcagv8e61u2a143eggps35fe26q9r917f@4ax.com>
            <5.2.0.9.2.20030704143536.04680650@imap.ecs.soton.ac.uk>
Message-ID: <1057333723.3f05a1db017f7@webmail.MUW.Edu>

Hi,

> Let's all play "spot the snake oil".
> Call a cynical old git if you like...

I second that Julian !!!

For years I have played around with different technologies to combat the rising
problem with spam/viruses. I can truely testify that MailScanner is far more
superior to any product out there, commercial or not.

I love the fact that it is flexible and not dependent *only* on one method or
technology. I love the fact that it is relatively easy to install. I love the
fact that it supports a wide variety of Antivirus products and Antispam
technologies and techniques.

Most importantly, the type of support we get from Julian and all the people on
this list is far superior than any commericial support, period. I remember an
incident when SA 2.50 had issues with locking. At the same time, I had an issue
with a commercial product that we use here, we pay this company thousands of
dollars annually for "support". I posted a message on the MailScanner mailing
list and it took Julian less time to fix the problem with SA than me getting
through the annoying recorded messages to talk to a support engineer to fix my
other issue with the product that we pay lots of $$$ for support.

Facotors like the above are crucial when evaluating and comparing products.
Julian provides a world-class consulting for all of us that to me is
unmatchable. Great job Julian !!!

Marco

_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From mailscanner at ecs.soton.ac.uk  Fri Jul  4 16:54:19 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:18:51 2006
Subject: MailScanner replacements
In-Reply-To: <1057333723.3f05a1db017f7@webmail.MUW.Edu>
References: <5.2.0.9.2.20030704143536.04680650@imap.ecs.soton.ac.uk>
            <7qcagv8e61u2a143eggps35fe26q9r917f@4ax.com>
            <5.2.0.9.2.20030704143536.04680650@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030704165402.04471960@imap.ecs.soton.ac.uk>

At 16:48 04/07/2003, you wrote:
>Hi,
>
> > Let's all play "spot the snake oil".
> > Call a cynical old git if you like...
>
>I second that Julian !!!
>
>For years I have played around with different technologies to combat the
>rising
>problem with spam/viruses. I can truely testify that MailScanner is far more
>superior to any product out there, commercial or not.
>
>I love the fact that it is flexible and not dependent *only* on one method or
>technology. I love the fact that it is relatively easy to install. I love the
>fact that it supports a wide variety of Antivirus products and Antispam
>technologies and techniques.
>
>Most importantly, the type of support we get from Julian and all the people on
>this list is far superior than any commericial support, period. I remember an
>incident when SA 2.50 had issues with locking. At the same time, I had an
>issue
>with a commercial product that we use here, we pay this company thousands of
>dollars annually for "support". I posted a message on the MailScanner mailing
>list and it took Julian less time to fix the problem with SA than me getting
>through the annoying recorded messages to talk to a support engineer to fix my
>other issue with the product that we pay lots of $$$ for support.
>
>Facotors like the above are crucial when evaluating and comparing products.
>Julian provides a world-class consulting for all of us that to me is
>unmatchable. Great job Julian !!!

Aw, shucks.... :)
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mike at CAMAROSS.NET  Fri Jul  4 17:19:00 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:51 2006
Subject: ANNOUNCE:  OT Mailing List
In-Reply-To: <107DE25EC0216C45AEF670016024245F6EEC@exchangea.staff.uce.ac.uk>
Message-ID: <002f01c34247$fb465e70$9c01a8c0@home.middlefinger.net>

Yep...my bad :)  I'll go get some coffee now!


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of David While
Sent: Friday, July 04, 2003 10:01 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: ANNOUNCE: OT Mailing List


Think it should be:

http://CamaroSS.net/mailman/listinfo/mailscanner-wizards

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------


-----Original Message-----
From: Spicer, Kevin [mailto:Kevin.Spicer@BMRB.CO.UK]
Sent: 04 July 2003 15:55
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: ANNOUNCE: OT Mailing List


> Per Christopher Hicks' request, the list has been aptly names 
> MailScanner-Wizards.
> 
> You can subscribe/manage here:
> 
> http://CamaroSS.net/mailman/admin/mailscanner-wizards
> 
> Please contact me with any questions, suggestions or concerns.

Mike, that link points to an admin login only.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From gerry at DORFAM.CA  Fri Jul  4 20:22:07 2003
From: gerry at DORFAM.CA (Gerry Doris)
Date: Thu Jan 12 21:18:51 2006
Subject: Modified ClamAV Updater
Message-ID: <Pine.LNX.4.44.0307041506160.8222-200000@tiger.dorfam.ca>

I and some others have experienced MailScanner freezes as a result of
hangs when ClamAV virus files are being updated.  The latest one for me
occurrd on June 29 at 7:00am EST.

>From my log files it appears that when the clamav-autoupdate script is
called and the ClamAV site doesn't respond then a lock file is left open
preventing MailScanner from performing any virus scans.  In any case, mail
continues to roll into mqueue.in but is not processed by MailScanner.
MailScanner knows how many messages are in the queue and says that it's
starting virus scanning...and that's all!

I've modified the existing clamav-autoupdate script to include a timeout
that hopefully will correct this.

I am not by any means a programmer so please have a look at this and see
if it does what I think it should!  I don't believe there's been any
further hangs at the ClamAV site so I don't know if it fixes the problem
or not?

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer
-------------- next part --------------
#!/usr/bin/perl

use Sys::Syslog;

# If you have a web proxy or cache server, put its value in the next line
# in the syntax "full.host.name:port".
$HTTPproxy = "";

$LogFile = "/tmp/ClamAV.update.log";

$ClamUpdateCommand = "/usr/local/bin/freshclam";

$LockFile = "/tmp/ClamAVBusy.lock";

$TIMEOUT = 10;                             #Timeout in sec's

$LOCK_SH = 1;
$LOCK_EX = 2;
$LOCK_NB = 4;
$LOCK_UN = 8;

eval { Sys::Syslog::setlogsock('unix'); }; # This may fail!

Sys::Syslog::openlog("ClamAV-autoupdate", 'pid, nowait', 'mail');

$SIG{ALRM} = sub { die "timeout" };        # Setup alarm

eval {
   alarm("$TIMEOUT");                      #Update timeout in $TIMEOUT sec's

   if (-x $ClamUpdateCommand) {
      &LockClamAV();
      $Command = "$ClamUpdateCommand --quiet -l $LogFile";
      $Command .= " --http-proxy $HTTPproxy" if $HTTPproxy;
      $retval=system($Command)>>8;
   }
   alarm(0);                                #Turn off alarm
};

if ($@) {
   if ($@ =~ /timeout/) {
   &UnlockClamAV();         
   Sys::Syslog::syslog('err', "ClamAV updater timed out");
   Sys::Syslog::closelog();
   exit 0;
   } else {
     die;
          }
}	

&UnlockClamAV();
if ($retval == 0 ) {
   Sys::Syslog::syslog('info', "ClamAV updated");
   }
  elsif ($retval == 1 ) {
   Sys::Syslog::syslog('info', "ClamAV did not need updating");
  } else {
   Sys::Syslog::syslog('err', "ClamAV updater failed");
}

Sys::Syslog::closelog();
exit 0;


sub LockClamAV {
	open(LOCK, ">$LockFile") or return;
	flock(LOCK, $LOCK_EX);
	print LOCK "Locked for updating ClamAV definitions by $$\n";
}

sub UnlockClamAV {
	print LOCK "Unlocked after updating ClamAV definitions by $$\n";
	unlink $LockFile;
	flock(LOCK, $LOCK_UN);
	close LOCK;
}
From nathan at TCPNETWORKS.NET  Fri Jul  4 20:26:06 2003
From: nathan at TCPNETWORKS.NET (Nathan Johanson)
Date: Thu Jan 12 21:18:51 2006
Subject: Advanced SpamAssassin Settings
Message-ID: <CC6008BDBF458A4DB8456380C1BAB38001BEEA@server1.in.tcpnetworks.com>

Hello,

I'm getting ready to upgrade to 4.22-5 from 4.14-9 and I had a few
questions about the "new" Advanced SpamAssassin Settings. Before these
options were implemented, I added the following lines to
spam.assassin.prefs.conf in order to change the location of the bayes
database.

bayes_path      /var/spool/spamassassin/bayes
bayes_file_mode 0644

It looks like this setting is now deprecated in favor of

SpamAssassin User State Dir =

I'm assuming I can safely comment out the former settings in
spam.assassin.prefs.conf and define the following in MailScanner.conf to
get the same effect?

SpamAssassin User State Dir = /var/spool/spamassassin/bayes

Correct? Or if I leave the new "SpamAssassin User State Dir" value
empty, will MailScanner continue to use my bayes settings in
spam.assassin.prefs.conf?

If I'm using a vanilla SpamAssassin installation, I'm assuming the rest
of the Advanced SpamAssassin Settings (such as "SpamAssassin Local Rules
Dir" and "SpamAssassin Default Rules Dir") can be left alone. These two
options are used only if you prefer not to use
/etc/MailScanner/spam.assassin.prefs.conf for some reason? Right? I'm
guess I'm a little confused by the difference between these two
configuration options.

Also, the MailScanner FAQ suggested setting the bayes_file_mode to 0644
(my current setting), but other places suggest it should be 0600. Does
it matter? 

Thanks in advance!

Sincerely,

Nathan Johanson
Email: nathan@tcpnetworks.net


From kevins at BMRB.CO.UK  Fri Jul  4 20:40:15 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:51 2006
Subject: Modified ClamAV Updater
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175CE1@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175CE1@pascal.priv.bmrb.co.uk>
Message-ID: <1057347615.29329.64.camel@bach.kevinspicer.co.uk>

>I am not by any means a programmer so please have a look at this and
see
>if it does what I think it should!  I don't believe there's been any
>further hangs at the ClamAV site so I don't know if it fixes the
>problem
>or not?

Gerry, thats a good idea - did you mean to attach the file? ;)

I'd be curious to know which version of Clam others were using when they
had problems.  In was using the snapshot 20030403.  I've since upgraded
to the snapshot from 20030625 (which is a few days after the 0.60
release) because I noticed the following in its changelog...

  * freshclam: fixed a typo - missing 2 in "nodb" in (should be "nodb2")
in
               one clause. That was causing a strange behaviour in some
               situations. Patch by Damien Curtain <damien@pagefault.org>.

Don't know if that was at all relevent to the problems we had.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From hunter at userfriendly.net  Fri Jul  4 20:45:47 2003
From: hunter at userfriendly.net (Michael Weiner)
Date: Thu Jan 12 21:18:51 2006
Subject: Modified ClamAV Updater
In-Reply-To: <Pine.LNX.4.44.0307041506160.8222-200000@tiger.dorfam.ca>
References: <Pine.LNX.4.44.0307041506160.8222-200000@tiger.dorfam.ca>
Message-ID: <1057347946.3603.7.camel@nomad.userfriendly.net>

Thank you Gerry for your most recent post. This issue has been puzzling
me for sometime now, and i unfortunately havent really had the time to
"dig" into it like you have. I for one appreciate your letting the list
know, as i too use clam (and like it) and have been having issues with
MS when it goes to scan for virii. I posted a question to the list
sometime ago, but got no response. Thank you for your answer.

Michael Weiner
--
On Fri, 2003-07-04 at 15:22, Gerry Doris wrote:
> I and some others have experienced MailScanner freezes as a result of
> hangs when ClamAV virus files are being updated.  The latest one for me
> occurrd on June 29 at 7:00am EST.
> 
> >From my log files it appears that when the clamav-autoupdate script is
> called and the ClamAV site doesn't respond then a lock file is left open
> preventing MailScanner from performing any virus scans.  In any case, mail
> continues to roll into mqueue.in but is not processed by MailScanner.
> MailScanner knows how many messages are in the queue and says that it's
> starting virus scanning...and that's all!
> 
> I've modified the existing clamav-autoupdate script to include a timeout
> that hopefully will correct this.
> 
> I am not by any means a programmer so please have a look at this and see
> if it does what I think it should!  I don't believe there's been any
> further hangs at the ClamAV site so I don't know if it fixes the problem
> or not?
> 
> --
> Gerry
> 
> "The lyfe so short, the craft so long to learne"  Chaucer
-- 
Michael B. Weiner, Linux+, Linux+ SME
Systems Administrator/Partner
The UserFriendly Network (UFN)
--
Linux Registered User #94900    Have you been counted?
http://counter.li.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030704/75eeee51/attachment.bin
From gerry at DORFAM.CA  Fri Jul  4 21:27:08 2003
From: gerry at DORFAM.CA (Gerry Doris)
Date: Thu Jan 12 21:18:51 2006
Subject: Modified ClamAV Updater
In-Reply-To: <1057347615.29329.64.camel@bach.kevinspicer.co.uk>
Message-ID: <Pine.LNX.4.44.0307041621000.8222-100000@tiger.dorfam.ca>

On Fri, 4 Jul 2003, Kevin Spicer wrote:

> >I am not by any means a programmer so please have a look at this and
> see
> >if it does what I think it should!  I don't believe there's been any
> >further hangs at the ClamAV site so I don't know if it fixes the
> >problem
> >or not?
>
> Gerry, thats a good idea - did you mean to attach the file? ;)
>
> I'd be curious to know which version of Clam others were using when they
> had problems.  In was using the snapshot 20030403.  I've since upgraded
> to the snapshot from 20030625 (which is a few days after the 0.60
> release) because I noticed the following in its changelog...
>
>   * freshclam: fixed a typo - missing 2 in "nodb" in (should be "nodb2")
> in
>                one clause. That was causing a strange behaviour in some
>                situations. Patch by Damien Curtain <damien@pagefault.org>.
>
> Don't know if that was at all relevent to the problems we had.

Uh, I did attach the file.  At least if showed up on my message back from
the list???

Where did you find the snapshoot number?  I just checked the changelog for
the version I have and the last listed problem was June 21 and it doesn't
mention the problem that you listed as fixed.  I'm going to download and
install whatever version they have now on their system.

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer

From kevins at BMRB.CO.UK  Fri Jul  4 22:28:42 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:51 2006
Subject: Modified ClamAV Updater
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175CE5@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175CE5@pascal.priv.bmrb.co.uk>
Message-ID: <1057354122.29328.77.camel@bach.kevinspicer.co.uk>

>Uh, I did attach the file.  At least if showed up on my message back
>from
>the list???

My sincere apologies, I've just been bitten by the unfathomable
stupidity of exchange again.  [I'm reading mail off an exchange server
using IMAP through Evolution, for reasons best known to itself the
exchange server converted your plain text email to html, but only if
fetched via IMAP, and screwed up the mime type, managing to conceal the
attachement entirely.  Its in the message source but due to the screwy
mime doesn't appear otherwise - weird eh]


>Where did you find the snapshoot number?  I just checked the changelog
>for
>the version I have and the last listed problem was June 21 and it
>doesn't
>mention the problem that you listed as fixed.  I'm going to download
>and
>install whatever version they have now on their system.

from the snapshots link on their home page.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From gerry at DORFAM.CA  Fri Jul  4 22:45:51 2003
From: gerry at DORFAM.CA (Gerry Doris)
Date: Thu Jan 12 21:18:51 2006
Subject: Modified ClamAV Updater
In-Reply-To: <1057354122.29328.77.camel@bach.kevinspicer.co.uk>
Message-ID: <Pine.LNX.4.44.0307041741380.8222-100000@tiger.dorfam.ca>

On Fri, 4 Jul 2003, Kevin Spicer wrote:
> >Where did you find the snapshoot number?  I just checked the changelog
> >for
> >the version I have and the last listed problem was June 21 and it
> >doesn't
> >mention the problem that you listed as fixed.  I'm going to download
> >and
> >install whatever version they have now on their system.
>
> from the snapshots link on their home page.

Ah, yes I see that now.  I was looking through the directory where I had
untared the package.  For what it's worth I was using the stable 0.60
release that came out on 6/21 when I experienced the hang.  I have now
downloaded and install the updated snapshot release 20030625.

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer

From becher at WEB.LU  Sat Jul  5 13:26:55 2003
From: becher at WEB.LU (Schiltz Luc)
Date: Thu Jan 12 21:18:51 2006
Subject: Custom Over quota
Message-ID: <LISTSERV%2003070513265554@JISCMAIL.AC.UK>

Hi,

does anybody know if there is a workaround with MailScanner to
customize "over quota" messages handled by sendmail ? e.g. that
mails which pass MailScanner and where the box is over quota get
a personalized over quota message which is send by MailScanner
or any idea how to customize this directly in sendmail as I?m looking
for days now in order to find an answer

many many thanks

Schiltz Luc


From raymond at PROLOCATION.NET  Sat Jul  5 13:46:49 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: Custom Over quota
In-Reply-To: <LISTSERV%2003070513265554@JISCMAIL.AC.UK>
Message-ID: <Pine.LNX.4.44.0307051444500.30494-100000@mailbox.prolocation.net>

Hi!

> does anybody know if there is a workaround with MailScanner to
> customize "over quota" messages handled by sendmail ? e.g. that
> mails which pass MailScanner and where the box is over quota get
> a personalized over quota message which is send by MailScanner
> or any idea how to customize this directly in sendmail as I?m looking
> for days now in order to find an answer

This is not a mailscanner issue. Mailscanner does not even know when a 
user is over quota. 

Within redhat, and i guess on other ditributions also there is a file 
called warnquota.conf (normally in /etc) that you can use to customise the 
mails that get sended out.

Bye,
Raymond.


From becher at WEB.LU  Sun Jul  6 20:24:18 2003
From: becher at WEB.LU (Schiltz Luc)
Date: Thu Jan 12 21:18:51 2006
Subject: 1. Custom Over quota (2)
In-Reply-To: <200307052301.BAA01398@germaine.webtechnologies.lu>
Message-ID: <OPEHJFOMDKEIACMFPLJAIENNEPAA.becher@web.lu>

Hi,

yes on a standard System but in this case it is a Sun/Cobalt RaQXTR Server
any more idea ?
there is no warnquota.conf

many thanks

Luc

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Automatic digest processor
Sent: 06 July 2003 01:02
To: Recipients of MAILSCANNER digests
Subject: MAILSCANNER Digest - 4 Jul 2003 to 5 Jul 2003 (#2003-187)


There are 2 messages totalling 51 lines in this issue.

Topics of the day:

  1. Custom Over quota (2)

----------------------------------------------------------------------

Date:    Sat, 5 Jul 2003 13:26:55 +0100
From:    Schiltz Luc <becher@WEB.LU>
Subject: Custom Over quota

Hi,

does anybody know if there is a workaround with MailScanner to
customize "over quota" messages handled by sendmail ? e.g. that
mails which pass MailScanner and where the box is over quota get
a personalized over quota message which is send by MailScanner
or any idea how to customize this directly in sendmail as I=B4m looking
for days now in order to find an answer

many many thanks

Schiltz Luc

------------------------------

Date:    Sat, 5 Jul 2003 14:46:49 +0200
From:    Raymond Dijkxhoorn <raymond@PROLOCATION.NET>
Subject: Re: Custom Over quota

Hi!

> does anybody know if there is a workaround with MailScanner to
> customize "over quota" messages handled by sendmail ? e.g. that
> mails which pass MailScanner and where the box is over quota get
> a personalized over quota message which is send by MailScanner
> or any idea how to customize this directly in sendmail as I=B4m looking
> for days now in order to find an answer

This is not a mailscanner issue. Mailscanner does not even know when a=20
user is over quota.=20

Within redhat, and i guess on other ditributions also there is a file=20
called warnquota.conf (normally in /etc) that you can use to customise th=
e=20
mails that get sended out.

Bye,
Raymond.

------------------------------

End of MAILSCANNER Digest - 4 Jul 2003 to 5 Jul 2003 (#2003-187)
****************************************************************

From ryanb at AACRAO.ORG  Mon Jul  7 03:14:03 2003
From: ryanb at AACRAO.ORG (Ryan Bingham)
Date: Thu Jan 12 21:18:51 2006
Subject: 1. Custom Over quota (2)
References: <OPEHJFOMDKEIACMFPLJAIENNEPAA.becher@web.lu>
Message-ID: <001201c3442d$70052bb0$f8240340@kh06s9>

Is something going on with the list?  This is the only message I've received
all day.

Ryan

----- Original Message -----
From: "Schiltz Luc" <becher@WEB.LU>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Sunday, July 06, 2003 3:24 PM
Subject: 1. Custom Over quota (2)


Hi,

yes on a standard System but in this case it is a Sun/Cobalt RaQXTR Server
any more idea ?
there is no warnquota.conf

many thanks

Luc

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Automatic digest processor
Sent: 06 July 2003 01:02
To: Recipients of MAILSCANNER digests
Subject: MAILSCANNER Digest - 4 Jul 2003 to 5 Jul 2003 (#2003-187)


There are 2 messages totalling 51 lines in this issue.

Topics of the day:

  1. Custom Over quota (2)

----------------------------------------------------------------------

Date:    Sat, 5 Jul 2003 13:26:55 +0100
From:    Schiltz Luc <becher@WEB.LU>
Subject: Custom Over quota

Hi,

does anybody know if there is a workaround with MailScanner to
customize "over quota" messages handled by sendmail ? e.g. that
mails which pass MailScanner and where the box is over quota get
a personalized over quota message which is send by MailScanner
or any idea how to customize this directly in sendmail as I=B4m looking
for days now in order to find an answer

many many thanks

Schiltz Luc

------------------------------

Date:    Sat, 5 Jul 2003 14:46:49 +0200
From:    Raymond Dijkxhoorn <raymond@PROLOCATION.NET>
Subject: Re: Custom Over quota

Hi!

> does anybody know if there is a workaround with MailScanner to
> customize "over quota" messages handled by sendmail ? e.g. that
> mails which pass MailScanner and where the box is over quota get
> a personalized over quota message which is send by MailScanner
> or any idea how to customize this directly in sendmail as I=B4m looking
> for days now in order to find an answer

This is not a mailscanner issue. Mailscanner does not even know when a=20
user is over quota.=20

Within redhat, and i guess on other ditributions also there is a file=20
called warnquota.conf (normally in /etc) that you can use to customise th=
e=20
mails that get sended out.

Bye,
Raymond.

------------------------------

End of MAILSCANNER Digest - 4 Jul 2003 to 5 Jul 2003 (#2003-187)
****************************************************************

From danieltan at shopnsave.com.sg  Mon Jul  7 04:12:47 2003
From: danieltan at shopnsave.com.sg (Daniel Tan)
Date: Thu Jan 12 21:18:51 2006
Subject: long file names and virus
Message-ID: <002d01c34435$a57b9100$3900a8c0@Daniel>

Hi,
    how do i prevent mailscanner from blocking emails with long file names?
i need certain emails to pass through according to their long file names or
subject names.... another thing...i have f-prot scanning my emails...it was
able to detect an email with the fortnight virus but certain emails with
that virus is still passing through to other users? why is this so? is there
a leak somewhere?

Regards,
Daniel Tan
67469188 Ext.665
DID: 68430665
MIS Department
Shop N Save Pte Ltd
: danieltan@shopnsave.com.sg

[This e-mail is confidential and may also be privileged. If you are not the
intended recipient, please delete it and notify us immediately; you should
not copy or use it for any purpose, nor disclose its contents to any other
person. Thank you.]

From raymond at PROLOCATION.NET  Mon Jul  7 07:33:51 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:51 2006
Subject: long file names and virus
In-Reply-To: <002d01c34435$a57b9100$3900a8c0@Daniel>
Message-ID: <Pine.LNX.4.44.0307070833130.14393-100000@mailbox.prolocation.net>

Hi!

>     how do i prevent mailscanner from blocking emails with long file names?
> i need certain emails to pass through according to their long file names or
> subject names.... another thing...i have f-prot scanning my emails...it was

Look in the filename.rules

> able to detect an email with the fortnight virus but certain emails with
> that virus is still passing through to other users? why is this so? is there
> a leak somewhere?

Contact your vendor.

Bye,
Raymond.

From manearter at YAHOO.COM  Mon Jul  7 10:53:38 2003
From: manearter at YAHOO.COM (Goga Lee)
Date: Thu Jan 12 21:18:52 2006
Subject: Which Filter To Use
Message-ID: <20030707095338.39002.qmail@web80602.mail.yahoo.com>

All mail filters:

1) MailScanner
2) SpamAssassin &
3) Procmail

Seems to be good enough, can anyone advise and suggest the best spam/virus filter of all?

Thanks.

GogaLee




---------------------------------
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030707/9bc9bf4f/attachment.html
From Kevin.Spicer at BMRB.CO.UK  Mon Jul  7 11:23:53 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:52 2006
Subject: Which Filter To Use
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4ADB8@pascal.priv.bmrb.co.uk>

err. MaiScanner.   Did you really expect any other answer on this list?  ;)
 
Seriously they all do different things.
 
Procmail provides a means of calling external programs, and of filtering mail into different folders etc. based on regular expressions.  It doesn't do any virus/ spam filtering but can call external programs (like SpamAssassin & virus scanners).
 
SpamAssassin provides very good spam filtering based on known spam characteristics and statistical filtering (Bayes) - but doesn't have any anti-virus capability.
 
MailScanner provides an interface to an external virus scanner (or scanners), can integrate spamassassin (very easily!), has its own filename and filetype filters, can filter out certain known exploits, can query RBL lists, etc, etc (RTFWP!)  Its also easy to install, and works out the box (i.e. sensible defaults).  If you're a tweaker theres an almost limitless number of tweaks you can do, especially given the flexibilty of rulesets and the 'custom config' functions.
 
In short, MailScanner rocks.

-----Original Message-----
From: Goga Lee [mailto:manearter@YAHOO.COM]
Sent: 07 July 2003 10:54
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Which Filter To Use


All mail filters:
 
1) MailScanner
2) SpamAssassin &
3) Procmail 
 
Seems to be good enough, can anyone advise and suggest the best spam/virus filter of all?
 
Thanks.
 
GogaLee 





  _____  

Do you Yahoo!?
SBC  <http://pa.yahoo.com/*http://rd.yahoo.com/evt=1207/*http://promo.yahoo.com/sbc/> Yahoo! DSL - Now only $29.95 per month!




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030707/024a3c32/attachment.html
From Heinz.Knutzen at DZSH.DE  Mon Jul  7 12:01:27 2003
From: Heinz.Knutzen at DZSH.DE (Knutzen, Heinz (DZ-SH))
Date: Thu Jan 12 21:18:52 2006
Subject: enhanced /etc/init.d/MailScanner for SuSE rpm
Message-ID: <6C645222B0A8BC4FBFACD7606D4306A822FF21@dzrz-ex-1.dzsh>

I successfully use MailScanner-4.22-5.suse.tar.gz
on a system running SuSE 8.2.
There is a small problem with the 
"reload" option of the
/etc/init.d/MailScanner script:

Currently it calls
        killproc -p $mspid -HUP /usr/sbin/MailScanner
This sends a HUP to the parent process which is silently ignored,
i.e. "reload" currently does NOTHING.

This should be changed to send HUP signals to all children:
        killproc -G -p $mspid -HUP /usr/sbin/MailScanner

>From 'man killproc':
-G     Sends the signal to all session  followers  (children)  of the identified process.

Viele Gr??e

-- Heinz


From donovan at HUFFDATASYSTEMS.COM  Mon Jul  7 12:51:33 2003
From: donovan at HUFFDATASYSTEMS.COM (Donovan Huff | HUFF DATA SYSTEMS)
Date: Thu Jan 12 21:18:52 2006
Subject: CPanel: EXIM + SA + MailScanner, anyone?
Message-ID: <00d801c3447e$1d97c6c0$6f109a3f@x27>

I have a box that uses CPanel and am wondering if anyone has configured a CPanel + EXIM + SA + MailScanner setup?  I have
MailScanner working on another box (not CPanel), just would like to chat with someone that has set it up already.  Please reply on
or of list if you like.


Regards,

Donovan Huff
Owner/Operator
HUFF DATA SYSTEMS
donovan@huffdatasystems.com
http://www.huffdatasystems.com/
(361) 781-0631

------------------------------------------------------
Web Hosting Starting at $5.00/mo
http://www.huffdatasystems.com/
------------------------------------------------------
Internet Access Just About Anywhere
http://UnlimitedCheapInternet.com/
------------------------------------------------------

From howard at harper-adams.ac.uk  Mon Jul  7 12:54:15 2003
From: howard at harper-adams.ac.uk (Howard Robinson)
Date: Thu Jan 12 21:18:52 2006
Subject: Maillog entry
Message-ID: <200307071152.h67Bqj7W004374@blackhole.harper-adams.ac.uk>

Hello
The following appears a 527 number of times in a
2mb Maillog file. I appreciate it refers to
sendmail but what is it telling me? Is it a
problem with sendmail or the email its trying to
process. Stuff is coming in and out as normal or
at least looks to be.Number in Brackets changes
each time by the look of it.

Extract from Maillog begins
Jul  6 04:03:31 blackhole sendmail[4864]:
STARTTLS: ClientCertFile missing
Jul  6 04:03:31 blackhole sendmail[4864]:
STARTTLS: ClientKeyFile missing
Jul  6 04:03:31 blackhole sendmail[4864]:
STARTTLS: ClientCACertPath missing
Jul  6 04:03:31 blackhole sendmail[4864]:
STARTTLS: ClientCACertFile missing
Jul  6 04:03:31 blackhole sendmail[4864]:
STARTTLS=client, init=1
extract ends

Thanks



Regards

Howard Robinson
(Senior Technical Development Officer)
Harper Adams University College
Edgmond
Newport
Shropshire
TF10 8NB UK

E-mail: hrobinson@harper-adams.ac.uk
Tel.  : +44(0)1952 820280 Via switchboard
      : +44(0)1952 815253 Direct line
Fax.  : +44(0)1952 814783
College Web site http://www.harper-adams.ac.uk

From john at TRADOC.FR  Mon Jul  7 13:04:14 2003
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:18:52 2006
Subject: razor log in postfix deferred directory?
Message-ID: <jmmigv4mt088he797dvlqte5lo6ufm9366@tradoc.fr>

I've recently added razor2 to my system - seems to be working fine,
headers show that it is being called by spamassassin and is detecting
spam.  

However, I also note that it is creating a log file in
/var/spool/postfix.in/deferred/razor-agent.log (which is flagged every
time the incoming postfix is reloaded). 

I suspect that this is due to razor not reading its config file from
/root/.razor/ when called by spamassassin, but I can't work out where
it wants the config file to be. 
The razor manpages talk about /etc/razor/ which did not exist on my
system, but putting the files there didn't help. 
Postfix is running chrooted (redhat 9 setup) - I've even tried copying
the config files to /var/spool/postfix.in/etc/razor/ to no avail. 
Any ideas, anyone?

John.

-- 
-- Over 2000 webcams from ski resorts around the world - http://www.snoweye.com/
-- Translate your technical documents and web pages    - http://www.tradoc.fr/


From Kevin.Spicer at BMRB.CO.UK  Mon Jul  7 13:06:08 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:52 2006
Subject: Maillog entry
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4ADBA@pascal.priv.bmrb.co.uk>

> Extract from Maillog begins
> Jul  6 04:03:31 blackhole sendmail[4864]:
> STARTTLS: ClientCertFile missing
> Jul  6 04:03:31 blackhole sendmail[4864]:
> STARTTLS: ClientKeyFile missing
> Jul  6 04:03:31 blackhole sendmail[4864]:
> STARTTLS: ClientCACertPath missing
> Jul  6 04:03:31 blackhole sendmail[4864]:
> STARTTLS: ClientCACertFile missing
> Jul  6 04:03:31 blackhole sendmail[4864]:
> STARTTLS=client, init=1
> extract ends
> 
I'd guess its telling you that sendmail has been configured to use support SSL/TLS, but none of the necessary supporting files (i.e. the Certificate, key and Certificate authority certs) are present.  Look for STARTTLS in /usr/share/sendmail-cf/README   (may be elsewhere on your system).  



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From henker at SHCOM.US  Mon Jul  7 13:04:10 2003
From: henker at SHCOM.US (Steffan Henke)
Date: Thu Jan 12 21:18:52 2006
Subject: CPanel: EXIM + SA + MailScanner, anyone?
In-Reply-To: <00d801c3447e$1d97c6c0$6f109a3f@x27>
References: <00d801c3447e$1d97c6c0$6f109a3f@x27>
Message-ID: <Pine.WNT.4.53.0307071359200.628@henker.shcom.biz>

On Mon, 7 Jul 2003, Donovan Huff | HUFF DATA SYSTEMS wrote:

> I have a box that uses CPanel and am wondering if anyone has configured a CPanel + EXIM + SA + MailScanner setup?  I have
> MailScanner working on another box (not CPanel), just would like to chat with someone that has set it up already.  Please reply on
> or of list if you like.

You may want to have a look at this thread:
http://forum.rackshack.net/showthread.php?s=&threadid=23819

Please note that I have absolutely nothing to do with this and am not
involved with it in any way.
So far, I haven't deployed MailScanner on any cpanel box yet.
Nonetheless, cpanel has SpamAssassin integration, users can enable it if
they want to.
I just fear that every time you run a cpanel upgrade, all your exim
modifications will be overwritten.

Regards,

Steffan

From Kevin.Spicer at BMRB.CO.UK  Mon Jul  7 13:12:23 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:52 2006
Subject: razor log in postfix deferred directory?
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6E9@pascal.priv.bmrb.co.uk>

> Postfix is running chrooted (redhat 9 setup) - I've even tried copying
> the config files to /var/spool/postfix.in/etc/razor/ to no avail. Any
> ideas, anyone? 
> 


I'd imagine it would be ~postfix/.razor/
(assuming that postfix is the user MailScanner runs as).  Have you looked in the razor-agents.log file to see if theres any clues in there?




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From john at TRADOC.FR  Mon Jul  7 13:19:55 2003
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:18:52 2006
Subject: razor log in postfix deferred directory?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF6E9@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF6E9@pascal.priv.bmrb.co.uk>
Message-ID: <p8pigvk9ggf7v5gcdiooibcgomcepk7md1@tradoc.fr>

On Mon, 7 Jul 2003 13:12:23 +0100, Spicer, Kevin wrote:
> I'd imagine it would be ~postfix/.razor/
> (assuming that postfix is the user MailScanner runs as).  Have you looked in the razor-agents.log file to see if theres any clues in there?

Yes, MailScanner runs as postfix. I've just tried putting the files in
/var/spool/postfix.in/.razor/ and reloading - still no change. There's
no useful information in the log file unfortunately. 

John.

-- 
-- Over 2000 webcams from ski resorts around the world - http://www.snoweye.com/
-- Translate your technical documents and web pages    - http://www.tradoc.fr/


From Kevin.Spicer at BMRB.CO.UK  Mon Jul  7 13:25:21 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:52 2006
Subject: razor log in postfix deferred directory?
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6EA@pascal.priv.bmrb.co.uk>

John Wilcock wrote:
> On Mon, 7 Jul 2003 13:12:23 +0100, Spicer, Kevin wrote:
>> I'd imagine it would be ~postfix/.razor/
>> (assuming that postfix is the user MailScanner runs as).
> Have you looked in the razor-agents.log file to see if theres any
> clues in there? 
> 
> Yes, MailScanner runs as postfix. I've just tried putting the files in
> /var/spool/postfix.in/.razor/ and reloading - still no change. There's
> no useful information in the log file unfortunately.
> 
> John.

Are you sure that /var/spool/postfix.in is the home directory for the postfix user.  I'm not running mailscanner with postfix but all the postfix systems I can access have /var/spool/postfix as the home.  (maybe grep it out of /etc/passwd).  Maybe razor is fussy about permissions or ownership, did you chown all the files?



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From john at TRADOC.FR  Mon Jul  7 13:38:39 2003
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:18:52 2006
Subject: razor log in postfix deferred directory?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF6EA@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF6EA@pascal.priv.bmrb.co.uk>
Message-ID: <fbqigv8m8iaaff61t9p71sms88g32ohns2@tradoc.fr>

On Mon, 7 Jul 2003 13:25:21 +0100, Spicer, Kevin wrote:
> John Wilcock wrote:
> > Yes, MailScanner runs as postfix. I've just tried putting the files in
> > /var/spool/postfix.in/.razor/ and reloading - still no change. There's
> > no useful information in the log file unfortunately.
> 
> Are you sure that /var/spool/postfix.in is the home directory for the 
> postfix user.  I'm not running mailscanner with postfix but all the 
> postfix systems I can access have /var/spool/postfix as the home.  
> (maybe grep it out of /etc/passwd).  Maybe razor is fussy about 
> permissions or ownership, did you chown all the files?

Thanks - /var/spool/postfix/.razor was indeed what was needed, and
chowning everything helped too. 

John.

-- 
-- Over 2000 webcams from ski resorts around the world - http://www.snoweye.com/
-- Translate your technical documents and web pages    - http://www.tradoc.fr/


From gerry at dorfam.ca  Mon Jul  7 15:16:30 2003
From: gerry at dorfam.ca (Gerry Doris)
Date: Thu Jan 12 21:18:52 2006
Subject: Julain on Vacation?
Message-ID: <63155.129.80.22.133.1057587390.squirrel@tiger.dorfam.ca>

Has Julian left on his vacation yet?  I believe he said he was going to be
gone all month without access to the list...I wonder if he'll survive?


Gerry

From Heinz.Knutzen at DZSH.DE  Mon Jul  7 15:19:51 2003
From: Heinz.Knutzen at DZSH.DE (Knutzen, Heinz (DZ-SH))
Date: Thu Jan 12 21:18:52 2006
Subject: bug in rule handling of filename rules
Message-ID: <6C645222B0A8BC4FBFACD7606D4306A822FF23@dzrz-ex-1.dzsh>

There is a bug / problem in rule handling of filename rules.
When multiple rules apply to a single message,
then ALL filename rule files of all matching rules
are concatenated in a RANDOM order.
I expected that only the FIRST filename rule would be used
or that at least the original order would be preserved 
if all filename rules are used.

This problem occures in 4.05-3 as well as 4.22-5.
You will find a simple patch below.

Example:

MailScanner.conf:
Filename Rules = %rules-dir%/filename.rules

filename.rules:
to      master@test.de  /etc/MailScanner/filename-any.rules.conf
to      *@test.de               /etc/MailScanner/filename-secure.rules.conf

filename-any.rules.conf:
allow   .       -       -

filename-secure.rules.conf:
allow   \.txt$  -       -
allow   \.rtf$  -       -
allow   \.doc$  -       -
allow   \.pdf$  -       -
allow   \.xls$  -       -
allow   \.vcf$  -       -
allow   \.msg$  -       -
allow   \.html?$        -       -
deny    .               forbidden by rule       forbidden by rule

For this example I always thougt, only filename rules from
filename-any.rules.conf would be applied to messages to 
master@test.de.
But MailScanner did reject e.g. *.zip files to master@test.de.
This problem occured in real life with a real customer.

When looking at the source code I found in
1.
ConfigDefs.pl:
[All,File]
#FilenameRules          /etc/MailScanner/filename.rules.conf
FilenameRules

i.e. MailScanner reads ALL values it finds for a given message.

2.
Config.pm:
sub Value {
...
    # It's an all-matches rule
...
              map { $matches{$_} = 1; } (split(" ",$value))
...
    $results = join(" ", keys %matches);
...
}

i.e.
result values are returned in a random order, since they are read 
from a hash whereby the original order is lost.


I solved this problem by simply changing the "category" of
FilenameRules in ConfigDefs.pl from "all-matches" to "first-match".
In fact, I changed this for all "File" rules which are
FilenameRules and FiletypeRules.

To preserve similar problems I would propose to change "sub Value"
in Config.pm such that the original order of values remains unchanged.

Patch
-----
*** ConfigDefs.pl.orig  Thu Jul  3 17:37:02 2003
--- ConfigDefs.pl       Mon Jul  7 15:14:58 2003
***************
*** 316,322 ****
  SpamStars             0       no      0       yes     1
  UseSpamAssassin               0       no      0       yes     1

! [All,File]
  #FilenameRules                /etc/MailScanner/filename.rules.conf
  FilenameRules
  FiletypeRules
--- 316,322 ----
  SpamStars             0       no      0       yes     1
  UseSpamAssassin               0       no      0       yes     1

! [First,File]
  #FilenameRules                /etc/MailScanner/filename.rules.conf
  FilenameRules
  FiletypeRules

Viele Gr??e

-- Heinz Knutzen

Datenzentrale Schleswig-Holstein
Altenholzer Str. 10-14, 24161 Altenholz, Germany
http://www.dzsh.de/
mailto:heinz.knutzen@dzsh.de
Tel: +49.431.3295.6581 Fax: +49.431.3295.410 


From ryanb at AACRAO.ORG  Mon Jul  7 15:30:38 2003
From: ryanb at AACRAO.ORG (Ryan Bingham)
Date: Thu Jan 12 21:18:52 2006
Subject: bug in rule handling of filename rules
In-Reply-To: <6C645222B0A8BC4FBFACD7606D4306A822FF23@dzrz-ex-1.dzsh>
References: <6C645222B0A8BC4FBFACD7606D4306A822FF23@dzrz-ex-1.dzsh>
Message-ID: <3F09840E.7030101@aacrao.org>

Knutzen, Heinz (DZ-SH) wrote:

 > There is a problem in rule handling of filename rules.
 > When multiple rules apply to a single message,
 > then ALL filename rule files of all matching rules
 > are concatenated in a RANDOM order.

I don't think it's a bug.  This topic was brought up on the list last
week and this was Julian's reply:

On July 4, Julian wrote:

 > The Filename Rules option concatenates all the matching rule results
 > together, then uses that as the set of allow/deny rules for the
attachment
 > filenames.
 >
 > It only uses the "default" setting if none of the other rules match

Ryan

From Heinz.Knutzen at DZSH.DE  Mon Jul  7 15:58:57 2003
From: Heinz.Knutzen at DZSH.DE (Knutzen, Heinz (DZ-SH))
Date: Thu Jan 12 21:18:52 2006
Subject: bug in rule handling of filename rules
Message-ID: <6C645222B0A8BC4FBFACD7606D4306A822FF25@dzrz-ex-1.dzsh>

OK, Julian described the current implementation.
But I think a "first-match" behaviour of filename rules would 
be much more useful and less surprising than the current 
"all-matches" behaviour.

If it's not a bug I would request a feature to make this configurable.

Viele Gr??e

-- Heinz


> -----Original Message-----
> From: Ryan Bingham [mailto:ryanb@AACRAO.ORG]
> Sent: Monday, July 07, 2003 4:31 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: bug in rule handling of filename rules
> 
> 
> Knutzen, Heinz (DZ-SH) wrote:
> 
>  > There is a problem in rule handling of filename rules.
>  > When multiple rules apply to a single message,
>  > then ALL filename rule files of all matching rules
>  > are concatenated in a RANDOM order.
> 
> I don't think it's a bug.  This topic was brought up on the list last
> week and this was Julian's reply:
> 
> On July 4, Julian wrote:
> 
>  > The Filename Rules option concatenates all the matching 
> rule results
>  > together, then uses that as the set of allow/deny rules for the
> attachment
>  > filenames.
>  >
>  > It only uses the "default" setting if none of the other rules match
> 
> Ryan
> 
> -- 
> Diese Mail wurde durch die Datenzentrale Schleswig-Holstein
> maschinell auf Viren und gef?hrliche Inhalte untersucht.
> 
> 


From SJCJonker at SJC.NL  Mon Jul  7 16:00:23 2003
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:18:52 2006
Subject: Which Filter To Use
In-Reply-To: <20030707095338.39002.qmail@web80602.mail.yahoo.com>
References: <20030707095338.39002.qmail@web80602.mail.yahoo.com>
Message-ID: <Pine.LNX.4.53.0307071658310.20441@ph-wks-01.sjc.nl>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hmm,

Is this ment to be funny ;-)) What about all three?

First of all MailScanner with SpamAssassin included, with off course
razor2 && dcc.

Secondly a nice long procmailrc, which among other things filters all
medium level spam to a seperate mailbox ;-))...

And if you really want to get a good opinion on the MAILSCANNER
mailinglist what about rephrasing your question a bit more specific.

On Mon, 7 Jul 2003, Goga Lee wrote:

> All mail filters:
>
> 1) MailScanner
> 2) SpamAssassin &
> 3) Procmail


- --
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/CYsMjU9r45tKnOARAmFgAKCxd//dMnpRMS3Keme0cnl26Q+SnwCeI2Z0
6P4qSzTE96PJCnwO+W3V+no=
=9W4t
-----END PGP SIGNATURE-----

From dgeorgiades at POWERENG.COM  Mon Jul  7 16:08:02 2003
From: dgeorgiades at POWERENG.COM (Derrick Georgiades)
Date: Thu Jan 12 21:18:52 2006
Subject: File locking / directory problem
Message-ID: <E0747DCCDD2AD411B865009027347CD20306743D@boisemx.powereng.com>

I am receiving the following messages on all emails in my maillog:

Jul  7 08:01:20 mx.mydomain.com MailScanner[19668]: Cannot create + lock
heade
rs file /queue/MailScanner/incoming/19668/h67E1I79019675.header,

Also I am getting these errors to my system messages log:

Jul  7 06:56:57 mx.mydomain.com  /usr/lib/nfs/lockd[193]: [ID 396295
daemon.error] t_accept(
file descriptor 5/transport tcp) TLI error 7
Jul  7 08:05:16 mx.mydomain.com MailScanner[19986]: Cannot mkdir
/queue/MailSc
anner/incoming/19986/h67E4g7K019935, No such file or directory

I am running MS ver 3.22-14 on Solaris 9.  MS has been running great for
months until now.
The only changes to the server prior to this error was another nic interface
was brought online.
If I su to my smmsp user that sendmail and mailscanner runs as I can create
files and directories in the incoming queue for MS.
It doesn't appear to be a permissions issue.  Does anyone know what an error
7 is for the lockd daemon?  Strangely I can still pass mail, but these
errors seem like it shouldn't.  Any help would be greatly appreciated.

Thanks
Derrick Georgiades
POWER Engineers, Inc.

From Kevin.Spicer at BMRB.CO.UK  Mon Jul  7 16:48:32 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:52 2006
Subject: File locking / directory problem
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4ADBB@pascal.priv.bmrb.co.uk>

> I am running MS ver 3.22-14 on Solaris 9. 

You really should get round to upgrading that, the latest versions are so much better.

I'd hazard a guess that the MailScanner problem may not be related to the lockd problem as they occured over an hour apart.




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From Kevin_Miller at CI.JUNEAU.AK.US  Mon Jul  7 17:29:33 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:52 2006
Subject: Whitelist not working...
Message-ID: <08146035CA49D6119A36009027AC822A0264E485@CITY-EXCH-NTS>

What address does the whitelist use to permit ham through?

This is a snippet from my whitelist:
/etc/MailScanner/rules/spam.whitelist.rules
        From:           *@alaskaair.com         yes
        FromOrTo:       default                 no

so I should be allowing mail from alaskaair.com through, but it's getting
forwarded to the quarantine account.  Here's the headers from one of them:

============================================================================
===========
Received: from mis-mxg-lnx.ci.juneau.ak.us ([199.58.55.24]) by
city-exch-nts.ci.juneau.ak.us with SMTP (Microsoft Exchange Internet Mail
Service Version 5.5.2653.13)
        id 33XHQDJK; Mon, 7 Jul 2003 07:16:57 -0800
Received: from airemote3.aif1.com (airemote3.aif1.com [208.45.250.253])
        by mis-mxg-lnx.ci.juneau.ak.us (8.12.3/8.12.3/SuSE Linux 0.6) with
SMTP id h67FFrwu020123
        for <someone@ci.juneau.ak.us>; Mon, 7 Jul 2003 07:16:50 -0800
Message-Id: <200307071516.h67FFrwu020123@mis-mxg-lnx.ci.juneau.ak.us>
Received: from aiappprd1 (localhost) by aiappprd1.adinfonitum.com (LSMTP for
Windows NT v1.1b) with SMTP id <0.00040C88@aiappprd1.adinfonitum.com>; 6 Jul
2003 20:51:40 -0700
To: someone@ci.juneau.ak.us
From: "alaskaair.com Newsletter" <newsletter@alaskaair.com>
Date: Mon, 07 Jul 2003 08:01:00 -0800
Subject: {Spam?} Fly 3, Get 1 Free and Online Reservations Change
Reply-To: alaskaair@mailserv.directserv.com
Keywords:
JOB_ID=1606|EMAIL_ID=01503413|GUID=17EDCD807EC711D5B66900D0B77540BD
X-JOB_ID: 1606
X-GUID: 17EDCD807EC711D5B66900D0B77540BD
X-PARTY_ID: 00040089
X-EMAIL_ADDRESS_ID: 01503413
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_----=_NextPart_000_001__21409945_61783.93"
X-MailScanner-Information: For more information see www . mailscanner . info
X-CBJ-MailScanner: Found to be clean
X-CBJ-MailScanner-SpamCheck: spam, SpamAssassin (score=7.2, required 5,
        CLICK_BELOW, DEAR_SOMETHING, HTML_40_50, HTML_LINK_CLICK_HERE,
        HTML_WEB_BUGS, MIME_BOUND_NEXTPART, MIME_DEFICIENT_QP,
        MSG_ID_ADDED_BY_MTA_2, NORMAL_HTTP_TO_IP)
X-CBJ-MailScanner-SpamScore: sssssss
============================================================================
===========

The from line says alaskaair.com, but the reply to is
mailserv.directserv.com, and the sending host was actually
aiappprd1.adinfonitum.com (although the sendmail headers indicated it
connected as airemote3.aif1.com) so what domain do I want to whitelist?  I'm
leaning toward airemote3.aif1.com, but am concerned that next month they'll
be routed via airemote2.aif1.com or some other such nonsense.  Can I put an
entry like this in the whitelist:
        From:           *@*.airemote1.com         yes

Other whitelists are working as advertised.

TIA...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

From Antony at SOFT-SOLUTIONS.CO.UK  Mon Jul  7 17:39:29 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:52 2006
Subject: Whitelist not working...
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E485@CITY-EXCH-NTS>
References: <08146035CA49D6119A36009027AC822A0264E485@CITY-EXCH-NTS>
Message-ID: <200307071639.h67GdXK27260@Primary.networker.test>

On Monday 07 July 2003 5:29 pm, Kevin Miller wrote:

> What address does the whitelist use to permit ham through?
>
> This is a snippet from my whitelist:
> /etc/MailScanner/rules/spam.whitelist.rules
>         From:           *@alaskaair.com         yes
>         FromOrTo:       default                 no
>
> so I should be allowing mail from alaskaair.com through, but it's getting
> forwarded to the quarantine account.  Here's the headers from one of them:

(headers snipped)

> The from line says alaskaair.com, but the reply to is
> mailserv.directserv.com, and the sending host was actually
> aiappprd1.adinfonitum.com (although the sendmail headers indicated it
> connected as airemote3.aif1.com) so what domain do I want to whitelist?

MailScanner goes by the envelope addresses in the SMTP connection (MAIL FROM:
and RCPT TO:), not by anything in the headers of the email itself.

You need to find out what the sending server says after MAIL FROM: and then
use that in your whitelist.

Regards,

Antony.

--

How I want a drink, alcoholic of course, after the heavy chapters
involving quantum mechanics.

 - 3.14159265358979

From kevins at BMRB.CO.UK  Mon Jul  7 17:56:28 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:52 2006
Subject: Whitelist not working...
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175D02@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D02@pascal.priv.bmrb.co.uk>
Message-ID: <1057596992.26531.1.camel@bach.kevinspicer.co.uk>

>You need to find out what the sending server says after MAIL FROM: and
>then
>use that in your whitelist.

You may well be able to find this by grepping your mail logs for the
sendmail messageid




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From Kevin_Miller at CI.JUNEAU.AK.US  Mon Jul  7 18:27:30 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:52 2006
Subject: Whitelist not working...
Message-ID: <08146035CA49D6119A36009027AC822A0264E487@CITY-EXCH-NTS>

>-----Original Message-----
>
>MailScanner goes by the envelope addresses in the SMTP
>connection (MAIL FROM:
>and RCPT TO:), not by anything in the headers of the email itself.
>
>You need to find out what the sending server says after MAIL
>FROM: and then use that in your whitelist.

Thanks Anthony, et. al.,

The sendmail log shows it connected as airemote3.aif1.com, so I'll add that
& see what happens.  Still not sure if I can wildcard the domain, but if the
host doesn't change from month to month I guess it doesn't matter...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

From Antony at SOFT-SOLUTIONS.CO.UK  Mon Jul  7 18:37:35 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:52 2006
Subject: Whitelist not working...
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E487@CITY-EXCH-NTS>
References: <08146035CA49D6119A36009027AC822A0264E487@CITY-EXCH-NTS>
Message-ID: <200307071737.h67HbdK00864@Primary.networker.test>

On Monday 07 July 2003 6:27 pm, Kevin Miller wrote:

> Thanks Antony, et. al.,
>
> The sendmail log shows it connected as airemote3.aif1.com, so I'll add that
> & see what happens.  Still not sure if I can wildcard the domain, but if
> the host doesn't change from month to month I guess it doesn't matter...

I would *guess* that if they connected as airemote3.aif1.com this time, you
should expect to get mails from airemote1.aif1.com and airemote2.aif1.com as
well (assuming they're all outgoing mailservers...)   I just did a quick dig
at their nameserver, and they don't have a 0 and they don't have a 4, so
these are the only machines you should need to think about...

I could be completely wrong, and the particular newsletters you're interested
in might always come from the same machine, but a match of airemote?.aif1.com
might be what you want....

Regards,

Antony.

--

In science, one tries to tell people
in such a way as to be understood by everyone
something that no-one ever knew before.

In poetry, it is the exact opposite.

 - Paul Dirac

From webmaster at ORBITEL.COM  Tue Jul  8 07:14:45 2003
From: webmaster at ORBITEL.COM (Orbitel Webmaster)
Date: Thu Jan 12 21:18:52 2006
Subject: Sophos Installation issues w/ mailscanner
Message-ID: <200307071743.MAA31854@mail.int.orbitel.com>

History:  I just installed the current version of mailscanner and 
sophos 3.71.  Sophos was installed by 
running /usr/sbin/Sophos.install.  Sophos installs fine and the 
script does not complain about any errors except an unzipping the 
update files failed bad file descriptor error.

Problem: When I run /usr/lib/MailScanner/sohpos-wrapper test file I 
receive Error initializing detection engine - missing main virus data

Additionally, when I run sophos-update I receive:

Unzipping the new Sophos IDE files failed. This may well be because 
your Sophos installation is too old. Please install the latest 
release of SophosUnzip failed with error return 16777215
, Bad file descriptor at ./sophos-autoupdate line 94.

I can, however, get sophos-wrapper to run by commenting out the 
EXPORT sav_ide line.

The files appear to be linked correctly.  I added the necessary 
library paths to /etc/ld.so.conf and added the paths to /etc/profile 
per the installation scripts instructions.  Sweep runs fine on its 
own.

Thank you!

Hopefully some of the following helps:

[root@webmail MailScanner]# ls -l /usr/local/Sophos/
total 12
drwxr-xr-x    2 root     root         4096 Jul  8 01:00 bin
drwxr-xr-x    2 root     root         4096 Jul  8 01:00 lib
drwxr-xr-x    4 root     root         4096 Jul  7 23:57 man
[root@webmail MailScanner]# ls -l /usr/local/Sophos/bin
total 128
-rwxr-xr-x    1 root     root       123084 Jul  8 01:00 sweep
[root@webmail MailScanner]# ls -l /usr/local/Sophos/lib
total 5676
lrwxrwxrwx    1 root     root           12 Jul  8 01:00 libsavi.so -> 
libsavi.so.3
lrwxrwxrwx    1 root     root           21 Jul  8 01:00 libsavi.so.2
-
> libsavi.so.3.2.05.034
lrwxrwxrwx    1 root     root           21 Jul  8 01:00 libsavi.so.3
-
> libsavi.so.3.2.05.034
-r-xr-xr-x    1 bin      bin       1002996 Jul  8 01:00 
libsavi.so.3.2.05.034
-rw-r--r--    1 bin      bin        443637 Jul  8 01:00 vdl01.vdb
-rw-r--r--    1 bin      bin        401446 Jul  8 01:00 vdl02.vdb
-rw-r--r--    1 bin      bin        389383 Jul  8 01:00 vdl03.vdb
-rw-r--r--    1 bin      bin        439542 Jul  8 01:00 vdl04.vdb
-rw-r--r--    1 bin      bin        459468 Jul  8 01:00 vdl05.vdb
-rw-r--r--    1 bin      bin        376402 Jul  8 01:00 vdl06.vdb
-rw-r--r--    1 bin      bin        374881 Jul  8 01:00 vdl07.vdb
-rw-r--r--    1 bin      bin        344925 Jul  8 01:00 vdl08.vdb
-rw-r--r--    1 bin      bin        258931 Jul  8 01:00 vdl09.vdb
-rw-r--r--    1 bin      bin        370090 Jul  8 01:00 vdl10.vdb
-rw-r--r--    1 bin      bin        474813 Jul  8 01:00 vdl11.vdb
-rw-r--r--    1 bin      bin        392158 Jul  8 01:00 vdl-3.71.dat
lrwxrwxrwx    1 root     root           12 Jul  8 01:00 vdl.dat -> 
vdl-3.71.dat
[root@webmail MailScanner]# ls -l /usr/lib/MailScanner/
total 144
<SNIP>
-rwxr-xr-x    1 root     root         3693 Jul  1 12:14 sophos-
autoupdate
-r-xr-xr-x    1 root     root         1504 Jul  8 01:04
sophos-wrapper
<SNIP>
[root@webmail MailScanner]# cat /usr/lib/MailScanner/sophos-wrapper
# <GPL LICENSE TEXT SNIPPED>
# JKF Wrapper Sophos programs with the correct LD_LIBRARY_PATH
# Modified for solaris by CJG
# Then tweaked for heron by JKF again

PackageDir=/usr/local/Sophos
prog=sweep # `basename $0`

SAV_IDE=$PackageDir/ide
LD_LIBRARY_PATH=$PackageDir/lib
export SAV_IDE
export LD_LIBRARY_PATH

if [ "x$1" = "x-IsItInstalled" ]; then
  [ -x ${PackageDir}/bin/$prog ] && exit 0
  exit 1
fi

exec ${PackageDir}/bin/$prog "$@"


[root@webmail MailScanner]#
[root@webmail MailScanner]# /usr/lib/MailScanner/sophos-wrapper
Error initialising detection engine - missing main virus data
[root@webmail MailScanner]# /usr/lib/MailScanner/sophos-autoupdate
Unzipping the new Sophos IDE files failed. This may well be because 
your Sophos installation is too old. Please install the latest 
release of SophosUnzip failed with error return 16777215
, Bad file descriptor at /usr/lib/MailScanner/sophos-autoupdate line 
94.
[root@webmail MailScanner]# cat /etc/ld.so.conf
/usr/kerberos/lib
/usr/X11R6/lib
/usr/local/Sophos/lib
[root@webmail MailScanner]# cat /etc/profile | grep Soph
PATH=/usr/local/Sophos/bin:$PATH
[root@webmail MailScanner]# It's a redhat linux box.
>


From dh at UPTIME.AT  Mon Jul  7 18:58:24 2003
From: dh at UPTIME.AT (David)
Date: Thu Jan 12 21:18:52 2006
Subject: Sophos Installation issues w/ mailscanner
In-Reply-To: <200307071743.MAA31854@mail.int.orbitel.com>
Message-ID: <9A703FFC-B0A4-11D7-85FE-000393920D6C@uptime.at>


On Dienstag, Juli 8, 2003, at 08:14  Uhr, Orbitel Webmaster wrote:

> History:  I just installed the current version of mailscanner and
> sophos 3.71.  Sophos was installed by
> running /usr/sbin/Sophos.install.  Sophos installs fine and the
> script does not complain about any errors except an unzipping the
> update files failed bad file descriptor error.
>
> Problem: When I run /usr/lib/MailScanner/sohpos-wrapper test file I
> receive Error initializing detection engine - missing main virus data
>
> <snip>

Is unzip installed?

-d

> -- nee amata wo mitsukete soshite midoto wasrezu
    domma mi mumega itakutemo soba mi iru mo
			zutto...zutto...zutto
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030707/faca9f22/PGP.bin
From webmaster at ORBITEL.COM  Tue Jul  8 07:36:50 2003
From: webmaster at ORBITEL.COM (Orbitel Webmaster)
Date: Thu Jan 12 21:18:52 2006
Subject: Sophos Installation issues w/ mailscanner
Message-ID: <200307071805.NAA32396@mail.int.orbitel.com>

Thank you, that was the problem.  Initially unzip wasn't installed so 
I went ahead and installed it but mistakenly placed it 
in /usr/local/bin.  It appears the script calls it from /usr/bin so I 
moved it to that location.  Perhaps a check should be added to the 
Sophos.install script to check for unzip around the same time it 
checks for your path statements.

Thank you David!



-------- Original Message --------

==> From: David <dh@UPTIME.AT>
==> Date: Mon, 7 Jul 2003 19:58:24  0200

 On Dienstag, Juli 8, 2003, at 08:14  Uhr, Orbitel Webmaster wrote:

> History:  I just installed the current version of mailscanner and > 
sophos 3.71.  Sophos was installed by > 
running /usr/sbin/Sophos.install.  Sophos installs fine and the > 
script does not complain about any errors except an unzipping the > 
update files failed bad file descriptor error. > > Problem: When I 
run /usr/lib/MailScanner/sohpos-wrapper test file I > receive Error 
initializing detection engine - missing main virus data > > <snip>

Is unzip installed?

-d

> -- nee amata wo mitsukete soshite midoto wasrezu domma mi mumega 
itakutemo soba mi iru mo    zutto...zutto...zutto


From lance at WARE.NET  Mon Jul  7 20:46:40 2003
From: lance at WARE.NET (Lance Ware)
Date: Thu Jan 12 21:18:52 2006
Subject: Problems with F-Prot and Silent Virus Deletion
Message-ID: <9F214F8D10934845A3664A21425C79FC754CCC@dhcp5.ware.net>

Hi Folks,

My silent virus deletion doesn't seem to be working.

I've tried a variety of config in MailScanner.conf, but still no luck.

Here's what F-Prot is showing the Virus as (I've tried W32/Sobig.E@mm,
Sobig.E, W32/Sobig.E and others in the config).

Jul  7 12:41:06 antispam MailScanner[10971]: Virus Scanning: F-Prot
found virus W32/Sobig.E@mm

Any tips?

Thanks,

Lance

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030707/62f57dac/attachment.html
From lance at WARE.NET  Mon Jul  7 20:48:05 2003
From: lance at WARE.NET (Lance Ware)
Date: Thu Jan 12 21:18:52 2006
Subject: Problems with F-Prot and Silent Virus Deletion
Message-ID: <9F214F8D10934845A3664A21425C79FC754CCD@dhcp5.ware.net>

Disregard - somehow I had still deliver turned on.
 
Sorry for the noise.

-----Original Message-----
From: Lance Ware 
Sent: Monday, July 07, 2003 12:47 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Problems with F-Prot and Silent Virus Deletion



Hi Folks, 

My silent virus deletion doesn't seem to be working. 

I've tried a variety of config in MailScanner.conf, but still no luck. 

Here's what F-Prot is showing the Virus as (I've tried W32/Sobig.E@mm,
Sobig.E, W32/Sobig.E and others in the config). 

Jul  7 12:41:06 antispam MailScanner[10971]: Virus Scanning: F-Prot
found virus W32/Sobig.E@mm 

Any tips? 

Thanks, 

Lance 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030707/d750692f/attachment.html
From raymond at PROLOCATION.NET  Mon Jul  7 20:54:12 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:52 2006
Subject: Problems with F-Prot and Silent Virus Deletion
In-Reply-To: <9F214F8D10934845A3664A21425C79FC754CCC@dhcp5.ware.net>
Message-ID: <Pine.LNX.4.44.0307072152530.20131-100000@mailbox.prolocation.net>

Hi!

> Here's what F-Prot is showing the Virus as (I've tried W32/Sobig.E@mm,
> Sobig.E, W32/Sobig.E and others in the config).
>
> Jul  7 12:41:06 antispam MailScanner[10971]: Virus Scanning: F-Prot
> found virus W32/Sobig.E@mm

F-prot will ALWAYS warn you about the virus, the part thats silent is the
delivery! If you properly add it in your config it will not send the mail
to the rcpt and sen no warning to the sender either.

So what you describe above sounds normal to me.

Check your maillog if theres any delivery ...

Bye,
Raymond.

From raymond at PROLOCATION.NET  Mon Jul  7 20:55:28 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:52 2006
Subject: Problems with F-Prot and Silent Virus Deletion
In-Reply-To: <9F214F8D10934845A3664A21425C79FC754CCD@dhcp5.ware.net>
Message-ID: <Pine.LNX.4.44.0307072154520.20131-100000@mailbox.prolocation.net>

Hi!

> Disregard - somehow I had still deliver turned on.
> Sorry for the noise.

 =)

> Here's what F-Prot is showing the Virus as (I've tried W32/Sobig.E@mm,
> Sobig.E, W32/Sobig.E and others in the config).

This can be matched by just adding: Sobig

Bye,
Raymond.

From jaearick at COLBY.EDU  Mon Jul  7 21:06:08 2003
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:18:52 2006
Subject: Spam Actions attachment mode and bayes learn
Message-ID: <Pine.GSO.4.56.0307071601410.877@cayuga>

Gang,

   I just upgraded from 4.21-9 to 4.22-5, and in the process I changed
from "Spam Actions = deliver" to "Spam Actions = attachment".  Will
this break my bayes learning on collected spam?  It seems like it
would at first thought, or (worse) train the bayes engine to view any
attachment as spam!!  Yikes!  Any thoughts on the interaction between
this spam action and the bayes learning engine?

Has Julian fled the jurisdiction yet?  Time to call the Mounties for
help?

--- Jeff Earickson

From raymond at PROLOCATION.NET  Mon Jul  7 21:10:49 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:52 2006
Subject: Spam Actions attachment mode and bayes learn
In-Reply-To: <Pine.GSO.4.56.0307071601410.877@cayuga>
Message-ID: <Pine.LNX.4.44.0307072209500.23428-100000@mailbox.prolocation.net>

Hi!

>    I just upgraded from 4.21-9 to 4.22-5, and in the process I changed
> from "Spam Actions = deliver" to "Spam Actions = attachment".  Will
> this break my bayes learning on collected spam?  It seems like it
> would at first thought, or (worse) train the bayes engine to view any
> attachment as spam!!  Yikes!  Any thoughts on the interaction between
> this spam action and the bayes learning engine?

Dont think so, its only the method that changed, as far as i can see you
dont change anything in the rest of the process. Or did you use the new
settigns for SA perhaps so your bayesdb is located elsewhere now ?

Bye,
Raymond.

From kevins at BMRB.CO.UK  Mon Jul  7 21:33:36 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:52 2006
Subject: Spam Actions attachment mode and bayes learn
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175D0D@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D0D@pascal.priv.bmrb.co.uk>
Message-ID: <1057610017.26531.20.camel@bach.kevinspicer.co.uk>

>   I just upgraded from 4.21-9 to 4.22-5, and in the process I changed
>from "Spam Actions = deliver" to "Spam Actions = attachment".

You need to set

Spam Actions = attachment deliver

or the message will be turned into an attachment but not delivered (I
found that out the hard way)

>  Will this break my bayes learning on collected spam?

If you're talking about the 'auto' Bayes learning which takes place
during the spamassassin spam the answer is no. MailScanner can't know
the message is spam until its done the spam checks, therefore the
conversion to an attachment must take place later in the processing.

If you're talking about feeding false positives back into the system
(maybe through a falsespam mailbox or something similar) the answer is
maybe.  Problem is that sa-learn uses the messageid to unlearn wrongly
learned spam, Julian has managed to preserve the messageid, so...
If the message was high enough scoring for Bayes to auto-learn it then
it will just relearn the tokens identified previously from the
messageid, but...
If the message was not learned previously (moderate scoring spam, which
most false positives will be) then it will need to tokenise it and may
get mislead by the attachment.

At least thats how I think it works!  (my understanding based on SA docs
rather than the actual code)

The good news is that there is a script to extract an rfc822 attachment
from a message.  I'm using it in a procmail recipe which extracts the
attachment from the mail and stores it in a file ready for my sa-learn
cron job (which has to run as the mailscanner user not the user who owns
the falsespam mailbox).
That script can be found here...
http://jmason.org/software/scripts/extract-rfc822-attachment.txt






BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From webmaster at ORBITEL.COM  Tue Jul  8 10:10:28 2003
From: webmaster at ORBITEL.COM (Orbitel Webmaster)
Date: Thu Jan 12 21:18:52 2006
Subject: Mailscanner server becoming unresponsive, high disk activitity
Message-ID: <200307072038.PAA03432@mail.int.orbitel.com>

If I start mailscanner on my server it freezes the whole box within 2 
hours.  When it freezes disk activity goes non-stop until I hit the 
reset key.

This is without load, or a very small load, going through 
mailscanner.  If I turn off the mailscanner service the problem 
disappears.

Any advice?


From mikea at MIKEA.ATH.CX  Mon Jul  7 21:42:32 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:52 2006
Subject: Mailscanner server becoming unresponsive, high disk activitity
In-Reply-To: <200307072038.PAA03432@mail.int.orbitel.com>; from
              webmaster@ORBITEL.COM on Tue, Jul 08, 2003 at 04:10:28AM -0500
References: <200307072038.PAA03432@mail.int.orbitel.com>
Message-ID: <20030707154232.B16559@mikea.ath.cx>

On Tue, Jul 08, 2003 at 04:10:28AM -0500, Orbitel Webmaster wrote:
> If I start mailscanner on my server it freezes the whole box within 2
> hours.  When it freezes disk activity goes non-stop until I hit the
> reset key.
>
> This is without load, or a very small load, going through
> mailscanner.  If I turn off the mailscanner service the problem
> disappears.
>
> Any advice?

How much Ram? How much swap? What OS? What speed CPU?

It *sounds* as though you're running on a box with about 25% to 50%
of the RAM it needs. I know all about that; that's why I went from
a 200MHz box with 64 MBytes to a 433MHz box with 384 MBytes. Now I
don't see swapping at all.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From raymond at PROLOCATION.NET  Mon Jul  7 21:44:04 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:52 2006
Subject: Mailscanner server becoming unresponsive, high disk activitity
In-Reply-To: <200307072038.PAA03432@mail.int.orbitel.com>
Message-ID: <Pine.LNX.4.44.0307072242570.28995-100000@mailbox.prolocation.net>

Hi!

> If I start mailscanner on my server it freezes the whole box within 2
> hours.  When it freezes disk activity goes non-stop until I hit the
> reset key.
>
> This is without load, or a very small load, going through
> mailscanner.  If I turn off the mailscanner service the problem
> disappears.

What ammount of RAM you have in the box ? Please give us some more
details. If your system using any swap at that moment ? What OS are you
running anyway ?

Type:

free

To show your RAM usage, and paste also the output of 'top'

Bye,
Raymond.

From webmaster at ORBITEL.COM  Tue Jul  8 10:22:48 2003
From: webmaster at ORBITEL.COM (Orbitel Webmaster)
Date: Thu Jan 12 21:18:52 2006
Subject: Mailscanner server becoming unresponsive, high disk activitity
Message-ID: <200307072050.PAA03683@mail.int.orbitel.com>

-------- Original Message --------

==> From: mikea <mikea@MIKEA.ATH.CX>
==> Date: Mon, 7 Jul 2003 15:42:32 -0500

On Tue, Jul 08, 2003 at 04:10:28AM -0500, Orbitel Webmaster wrote: > 
If I start mailscanner on my server it freezes the whole box within 2 
> hours.  When it freezes disk activity goes non-stop until I hit the 
> reset key. > > This is without load, or a very small load, going 
through > mailscanner.  If I turn off the mailscanner service the 
problem > disappears. > > Any advice?

How much Ram?
128
 How much swap?
64 meg partition -- but its not allocated and thats too little.
This most likely the problem.  I'll dump a gig of ram in the machine 
(its pc133 and just laying around anyways) and fix the swap problem.
 What OS? redhat 8.0?  7.2?
What speed CPU?
p-3 700

thank you -- I feel embarassed.


It *sounds* as though you're running on a box with about 25% to 50% 
of the RAM it needs. I know all about that; that's why I went from a 
200MHz box with 64 MBytes to a 433MHz box with 384 MBytes. Now I 
don't see swapping at all.

-- Mike Andrews mikea@mikea.ath.cx Tired old sysadmin since 1964


From mikea at MIKEA.ATH.CX  Mon Jul  7 21:55:34 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:52 2006
Subject: Mailscanner server becoming unresponsive, high disk activitity
In-Reply-To: <200307072050.PAA03683@mail.int.orbitel.com>; from
              webmaster@ORBITEL.COM on Tue, Jul 08, 2003 at 04:22:48AM -0500
References: <200307072050.PAA03683@mail.int.orbitel.com>
Message-ID: <20030707155534.A16673@mikea.ath.cx>

On Tue, Jul 08, 2003 at 04:22:48AM -0500, Orbitel Webmaster wrote:
> -------- Original Message --------
>
> ==> From: mikea <mikea@MIKEA.ATH.CX>
> ==> Date: Mon, 7 Jul 2003 15:42:32 -0500
>
> On Tue, Jul 08, 2003 at 04:10:28AM -0500, Orbitel Webmaster wrote: >
> If I start mailscanner on my server it freezes the whole box within 2
> > hours.  When it freezes disk activity goes non-stop until I hit the
> > reset key. > > This is without load, or a very small load, going
> through > mailscanner.  If I turn off the mailscanner service the
> problem > disappears. > > Any advice?
>
> How much Ram?
> 128
>  How much swap?
> 64 meg partition -- but its not allocated and thats too little.
> This most likely the problem.  I'll dump a gig of ram in the machine
> (its pc133 and just laying around anyways) and fix the swap problem.
>  What OS? redhat 8.0?  7.2?
> What speed CPU?
> p-3 700
>
> thank you -- I feel embarassed.

Well, as I wrote in my initial response, I started off with a really
runty box, which came off the to-surplus pallet. It sort-of-worked
for a while, but then the load just got to be too much. It appears
that I'm not alone.

It's the RAM that's the key here; a 200 MHz or so PeeCee should be
able to keep up with my load (about 5K mails/day inbound), though
not necessarily with any other site's load.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From cparker at SWATGEAR.COM  Mon Jul  7 22:10:48 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:18:52 2006
Subject: Mailscanner server becoming unresponsive, high disk activitity
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE1AE103@ati-ex-01.ati.local>

Orbitel Webmaster <mailto:webmaster@ORBITEL.COM> wrote:

> This is without load, or a very small load, going through
> mailscanner.  If I turn off the mailscanner service the problem
> disappears. 
> 
> Any advice?

Try reducing the child processes from the default of 5 to 1 or 2. I had this same problem (although a little less severe than you describe it) and my problem went away without any hardware mods once I reduced the child processes. The child processes setting can be found in /etc/MailScanner/MailScanner.conf

The child processes is determined by how many mails you receive in one day and how much ram you have. If you receive a low amount of mails like us (700-800 inbound/day) you'd probably do fine with 1 child process (like me). Even if you have lots of ram (I only have 64) there's no need to add child processes since they will never get used. You'll only waste memory because some of the child processes will just be sitting around waiting for mail to process but they'll never get any.

On the other hand if you have a high mail count you'll need more child processes. BUT if you have a low amount of ram with a high amount of mail you'll definitely need to upgrade your ram because the extra child process required to process all the mail will not work properly because of the lack of sufficient ram. (I think the average usage is about 20megs per child process.)

More Mail = More Child Processes
More Ram != More Child Processes

hth,
Chris.

p.s. extra ram is always good though.


From kenny at manjar.freeserve.co.uk  Tue Jul  8 06:56:49 2003
From: kenny at manjar.freeserve.co.uk (Kenny)
Date: Thu Jan 12 21:18:52 2006
Subject: Newbie - rules files
Message-ID: <002301c34515$b9766640$0f7068d5@pc1>

Hi
I am trying to set up a rules files for the inline signatures.
I have separated the three fields by a tab eg.

From:    @mydomain.com    yes

What I am finding is the first line of the file always works but MailScanner appears to be ignoring all other lines.

Any help would be appreciated....
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030708/eaee9ccd/attachment.html
From Kevin.Spicer at BMRB.CO.UK  Tue Jul  8 09:03:55 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:52 2006
Subject: FW: Newbie - rules files
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6F1@pascal.priv.bmrb.co.uk>

Can you post exactly which MailScanner.conf options you're trying to use a ruleset for and a longer example of whats in your ruleset

-----Original Message-----
From: Kenny [mailto:kenny@manjar.freeserve.co.uk]
Sent: 08 July 2003 06:57
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Newbie - rules files


Hi
I am trying to set up a rules files for the inline signatures.
I have separated the three fields by a tab eg.
 
From:    @mydomain.com    yes
 
What I am finding is the first line of the file always works but MailScanner appears to be ignoring all other lines.
 
Any help would be appreciated....




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030708/426022a4/attachment.html
From Kevin.Spicer at BMRB.CO.UK  Tue Jul  8 09:13:43 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:52 2006
Subject: Heads up - serious vulnerability in 'unzip'
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4ADBC@pascal.priv.bmrb.co.uk>

Theres a problem with unzip.  Looks like it could be serious for anyone running MailScanner as root where the virus scanner uses external unzip (such as Clam). Patches are available.

(from http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0282 )

Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence. 





BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From howard at harper-adams.ac.uk  Tue Jul  8 09:40:27 2003
From: howard at harper-adams.ac.uk (Howard Robinson)
Date: Thu Jan 12 21:18:52 2006
Subject: Spam Actions attachment mode and bayes learn
In-Reply-To: <1057610017.26531.20.camel@bach.kevinspicer.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D0D@pascal.priv.bmrb.co.uk>
Message-ID: <200307080838.h688cqJi028477@blackhole.harper-adams.ac.uk>

On 7 Jul 03, at 21:33, Kevin Spicer wrote:
Thanks for this timely correction Kevin.
I had literally just decided to change spam actions as well and had
restarted Mailscanner to send Spam as attachments. A quick
edit,a restart and less head scratching.


> >   I just upgraded from 4.21-9 to 4.22-5, and in the process I changed
> >from "Spam Actions = deliver" to "Spam Actions = attachment".
>
> You need to set
>
> Spam Actions = attachment deliver
>
> or the message will be turned into an attachment but not delivered (I
> found that out the hard way)
>



Regards

Howard Robinson
(Senior Technical Development Officer)
Harper Adams University College
Edgmond
Newport
Shropshire
TF10 8NB UK

E-mail: hrobinson@harper-adams.ac.uk
Tel.  : +44(0)1952 820280 Via switchboard
      : +44(0)1952 815253 Direct line
Fax.  : +44(0)1952 814783
College Web site http://www.harper-adams.ac.uk

From howard at harper-adams.ac.uk  Tue Jul  8 13:00:02 2003
From: howard at harper-adams.ac.uk (Howard Robinson)
Date: Thu Jan 12 21:18:52 2006
Subject: Whitelist/Blacklist
Message-ID: <200307081158.h68BwjJk004209@blackhole.harper-adams.ac.uk>

Hello,
Sorry this is another Doh Question!
I have been reading the archive on Whitelists and blacklists and am
now totally confused.
Looking at the Archive is seems that I could let things through with
out any virus checks or let spam through if it is in a white list and
block it regardless it it is in a blacklist.
I have two staff members - one receives monthly exe attachments
for amendment/updates to software from a known sender. A
second receives an HTML format email, again monthly, from a
database search engine. I have set MailScanner to convert html to
text but in this case it more or less unreadable.
What I need to do is set mailscanner so that it checks everything
but in the first case doesn't stop the exe file from the known
address and in the second case doesn't convert the html to test
again from a known address.

Can this be done?



Regards

Howard Robinson
(Senior Technical Development Officer)
Harper Adams University College
Edgmond
Newport
Shropshire
TF10 8NB UK

E-mail: hrobinson@harper-adams.ac.uk
Tel.  : +44(0)1952 820280 Via switchboard
      : +44(0)1952 815253 Direct line
Fax.  : +44(0)1952 814783
College Web site http://www.harper-adams.ac.uk

From dustin.baer at IHS.COM  Tue Jul  8 13:57:31 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:18:52 2006
Subject: Newbie - rules files
References: <002301c34515$b9766640$0f7068d5@pc1>
Message-ID: <3F0ABFBB.74292B2B@ihs.com>

> Kenny wrote:
>
> Hi
> I am trying to set up a rules files for the inline signatures.
> I have separated the three fields by a tab eg.
>
> From:    @mydomain.com    yes
>
> What I am finding is the first line of the file always works but
> MailScanner appears to be ignoring all other lines.
>
> Any help would be appreciated....

What about:

        From:    *@mydomain.com    yes

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

From andersan at LTKALMAR.SE  Tue Jul  8 15:00:56 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:52 2006
Subject: Noticed missing text in mailscanner.conf after upgrade
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE64D@lkl63.ltkalmar.se>

Hi
Not a big thing but thought I should let you know.
Did an upgrade and ran the upgrade_mailscanner_conf... everything
ran ok accept spam was converted to attachment.
Checked MailScanner.conf but there was nothing about it.
Seems like the upgrade_mailscanner_conf missed to add that text in the conf
file.
The funny thing is that it continues to deliver them as attchment even if
the conf-file just say deliver.... any clues on that?

/Anders

From raymond at PROLOCATION.NET  Tue Jul  8 15:06:50 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:52 2006
Subject: Noticed missing text in mailscanner.conf after upgrade
In-Reply-To: <9F18B7DDBA88E544AB1F1995148916661CE64D@lkl63.ltkalmar.se>
Message-ID: <Pine.LNX.4.44.0307081606230.9739-100000@mailbox.prolocation.net>

Hi!

> Checked MailScanner.conf but there was nothing about it.
> Seems like the upgrade_mailscanner_conf missed to add that text in the conf
> file.

> The funny thing is that it continues to deliver them as attchment even if
> the conf-file just say deliver.... any clues on that?

It only adds new config parts, it doesnt update the text part of
currently existing ones.

Bye,
Raymond.

From andersan at LTKALMAR.SE  Tue Jul  8 15:08:38 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:52 2006
Subject: SV: Noticed missing text in mailscanner.conf after upgrade
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE64E@lkl63.ltkalmar.se>

> Fr?n: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET] 
> Skickat: den 8 juli 2003 16:07

> > Checked MailScanner.conf but there was nothing about it. Seems like 
> > the upgrade_mailscanner_conf missed to add that text in the 
> conf file.
> 
> > The funny thing is that it continues to deliver them as 
> attchment even 
> > if the conf-file just say deliver.... any clues on that?
> 
> It only adds new config parts, it doesnt update the text part 
> of currently existing ones.

But that doesnt explain the that it covert spam to attachment????

> 
> Bye,
> Raymond.
> 


From dgeorgiades at POWERENG.COM  Tue Jul  8 15:37:21 2003
From: dgeorgiades at POWERENG.COM (Derrick Georgiades)
Date: Thu Jan 12 21:18:52 2006
Subject: File locking / directory problem
Message-ID: <E0747DCCDD2AD411B865009027347CD203067445@boisemx.powereng.com>

My queue directories are not NFS mounted.  My server had been running for 90
days without a reboot, during that time I must have changed something.  I
also started to get errors that MIME\body.pm couldn't parse emails.  Luckily
in my case we have redundant servers incase of a problem like this.  I think
I will just blow my MS and SpamAssassin away and start over on that system.
I have older versions of both anyway.
Thanks for the responses.

Derrick Georgiades

-----Original Message-----
From: Nick Phillips [mailto:nwp@LEMON-COMPUTING.COM]
Sent: Tuesday, July 08, 2003 4:17 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: File locking / directory problem


On Mon, Jul 07, 2003 at 09:08:02AM -0600, Derrick Georgiades wrote:

> It doesn't appear to be a permissions issue.  Does anyone know what an
error
> 7 is for the lockd daemon?  Strangely I can still pass mail, but these
> errors seem like it shouldn't.  Any help would be greatly appreciated.

Are your spool dirs NFS-mounted? Sendmail generally uses flock (as does
mailscanner when working with sendmail), which is not NFS-safe...


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
You never know how many friends you have until you rent a house on the
beach.

From Antony at SOFT-SOLUTIONS.CO.UK  Tue Jul  8 16:48:05 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:52 2006
Subject: Newbie - rules files
In-Reply-To: <3F0ABFBB.74292B2B@ihs.com>
References: <002301c34515$b9766640$0f7068d5@pc1> <3F0ABFBB.74292B2B@ihs.com>
Message-ID: <200307081548.h68Fm9K08824@Primary.networker.test>

On Tuesday 08 July 2003 1:57 pm, Dustin Baer wrote:

> > Kenny wrote:
> >
> > Hi
> > I am trying to set up a rules files for the inline signatures.
> > I have separated the three fields by a tab eg.
> >
> > From:    @mydomain.com    yes
> >
> > What I am finding is the first line of the file always works but
> > MailScanner appears to be ignoring all other lines.
> >
> > Any help would be appreciated....
>
> What about:
>
>         From:    *@mydomain.com    yes

I believe the * here is redundant.   The second field is a regular expression
for matching against the sender's address, so unless you put a ^ at the
beginning to anchor the @ as the first character, @mydomain.com will match
exactly the same things as *@mydomain.com.

Admittedly the second version might be a little easier to read and see what
it does, but there is no functional difference for MailScanner.

Antony.

--

What is this talk of software 'release' ?
Our software evolves and matures until it becomes capable of escape,
leaving a bloody trail of designers and quality assurance people in its wake.

From Kevin.Spicer at BMRB.CO.UK  Tue Jul  8 16:53:08 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:52 2006
Subject: How to use spamassassin on a per user basis with a third party e-mail server setup?
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF6FF@pascal.priv.bmrb.co.uk>

> Can someone point me in the right direction -- documentation or
> otherwise?  The closest I have found is spamassassin's userpref's
> file on their website. 
> 
If you're using SA through MailScanner you can achieve this with rulesets, take a read through the MailScanner.conf file and the files in /etc/MailScanner/rules (or the equivalent directory on your system)



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From Antony at SOFT-SOLUTIONS.CO.UK  Tue Jul  8 16:55:39 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:52 2006
Subject: How to use spamassassin on a per user basis with a third party e-mail server setup?
In-Reply-To: <200307081545.KAA27336@mail.int.orbitel.com>
References: <200307081545.KAA27336@mail.int.orbitel.com>
Message-ID: <200307081555.h68FthK09560@Primary.networker.test>

On Wednesday 09 July 2003 5:17 am, Orbitel Webmaster wrote:

> What have you found as the easiest way to enable/disable spamassassin
> for individual e-mail addresses?  Our mailscanner server is being
> utilized in a third party e-mail server enviroment (relay) therefore
> there cannot be individual user accounts and spamassassin preference
> files.
>
> I would like the ability to either disable tagging, enable tagging,
> or enable auto spam deletion on a per e-mail address basis.  I would
> like all settings to default to off.  Additionally, all users will
> receive e-mail virus scanning.
>
> Can someone point me in the right direction -- documentation or
> otherwise?  The closest I have found is spamassassin's userpref's
> file on their website.

Ignore SpamAssassin's internal settings - you'll find MailScanner overrides
most of them anyway (eg it does its own subject line mangling, header
insertions, and body alterations...)

What you need are rulesets for things like:
(High Scoring) Spam Modify Subject
(High Scoring) Spam Subject Text
Use SpamAssassin
Required SpamAssassin Score
High SpamAssassin Score
etc...

Antony

--

I can resist everything but temptation,
I can tolerate everything but intolerance,
and I can survive everything but death.

From slwatts at WINCKWORTHS.CO.UK  Tue Jul  8 16:58:00 2003
From: slwatts at WINCKWORTHS.CO.UK (Samuel Luxford-Watts)
Date: Thu Jan 12 21:18:52 2006
Subject: Mailscanner + Postfix
Message-ID: <FB50AA0C8E7D5344A761C40BC70574290536AE@exchangeserver.winckworths.co.uk>

Hi All,

Just been thinking about my test installation of postfix + MailScanner on
Suse 8.1. At the moment it is all working great after following the
instructions on the mailscanner website. Thanks Guys! However this
configuration is based on having postfix processes - one for receiving and
one sending with Mailscanner sat in the middle moving files (messages) back
and forth.

I am only a new person at this but on the face of it there would appear to
be two ways that my be better at doing this but I am not at all sure if they
would work with MailScanner.

1 is to use the 'content_filter=' directive in /etc/postfix/main.cf. I would
guess that this is a NO but thought I would ask!!

2. Would it be possible to adapt the process used for anomy as detailed on:
http://advosys.ca/papers/postfix-filtering.html ? .....creating a filter
script to move the files/invoke mailscanner and define this script as a new
service in /etc/postfix/master.cf?

Or is the two process solution the best?

Sam

From steve.douglas at SBIINCORPORATED.COM  Tue Jul  8 17:32:18 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:18:52 2006
Subject: HTML in Text Body
Message-ID: <3963522F0E71474CB14C0FF54A6914F70111514A@mail.gardenbotanika.com>

The only options I am using for "SPAM Actions" is store and forward (email
address).  The "high scoring spam actions is set to only store.  Originally
I had the striphtml configured.  Since this time I have gone back to the
removal of the striphtml option, yet it appears a get a few stragglers each
day that are stripped.  Is there another location that I need to turn the
HTML stripping off?



Thanks.









-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030708/4621304e/attachment.html
From steve.douglas at SBIINCORPORATED.COM  Tue Jul  8 17:34:57 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:18:52 2006
Subject: HTML in Text Body
Message-ID: <3963522F0E71474CB14C0FF54A6914F70111514B@mail.gardenbotanika.com>

I found the solution.  Thanks.  

?
?


From harish.amin at DEG.STATE.WI.US  Tue Jul  8 18:10:30 2003
From: harish.amin at DEG.STATE.WI.US (Harish Amin)
Date: Thu Jan 12 21:18:52 2006
Subject: How to disable a mail to a user before scanning
Message-ID: <LISTSERV%2003070818103063@JISCMAIL.AC.UK>

I receive about 50 messages to a unknown user on my SMTP server
and I as a postmaster receive all the messages back
I tried the rules

# more spam.actions.rules
To:     webmaster@www.dpi.state.wi.us    delete


# more spam.blacklist.rules
#To:     /^$/    yes
To:     webmaster@www.dpi.state.wi.us   yes

But I still keep getting it



The original message was received at Tue, 8 Jul 2003 12:08:05 -0500 (CDT)
from doagw01.doa.state.wi.us [165.189.88.161]

   ----- The following addresses had permanent fatal errors -----
<'webmaster@www.dpi.state.wi.us>
    (reason: 553 5.3.5 system config error)

   ----- Transcript of session follows -----
553 5.3.5 www.dpi.state.wi.us. config error: mail loops back to me (MX
problem?)
554 5.3.5 Local configuration error

AM I doing something wrong here...
I am running MailScanner E-Mail Virus Scanner version 4.22-4 on SUn Solaris
running sendmail
Any Help will be appreciated

From mike at CAMAROSS.NET  Tue Jul  8 18:10:18 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:52 2006
Subject: How to disable a mail to a user before scanning
In-Reply-To: <LISTSERV%2003070818103063@JISCMAIL.AC.UK>
Message-ID: <001901c34573$cf261180$9c01a8c0@home.middlefinger.net>

Why not add an entry to /etc/mail/virtusertable and /dev/null it?

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Harish Amin
Sent: Tuesday, July 08, 2003 12:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: How to disable a mail to a user before scanning


I receive about 50 messages to a unknown user on my SMTP server and I as a
postmaster receive all the messages back I tried the rules

# more spam.actions.rules
To:     webmaster@www.dpi.state.wi.us    delete


# more spam.blacklist.rules
#To:     /^$/    yes
To:     webmaster@www.dpi.state.wi.us   yes

But I still keep getting it



The original message was received at Tue, 8 Jul 2003 12:08:05 -0500 (CDT)
from doagw01.doa.state.wi.us [165.189.88.161]

   ----- The following addresses had permanent fatal errors -----
<'webmaster@www.dpi.state.wi.us>
    (reason: 553 5.3.5 system config error)

   ----- Transcript of session follows -----
553 5.3.5 www.dpi.state.wi.us. config error: mail loops back to me (MX
problem?)
554 5.3.5 Local configuration error

AM I doing something wrong here...
I am running MailScanner E-Mail Virus Scanner version 4.22-4 on SUn Solaris
running sendmail Any Help will be appreciated


From Harish.Amin at DEG.STATE.WI.US  Tue Jul  8 18:13:29 2003
From: Harish.Amin at DEG.STATE.WI.US (Amin, Harish)
Date: Thu Jan 12 21:18:52 2006
Subject: R Rulesets( How to disable a mail to a user before scanning)
Message-ID: <47F3EDACE4BC3A4594D0D7B504062BBD03733E70@doamail04.doa.wistate.us>

I receive about 50 messages to a unknown user on my SMTP server
and I as a postmaster receive all the messages back
I tried the rules

# more spam.actions.rules
To:     webmaster@www.dpi.state.wi.us    delete


# more spam.blacklist.rules
#To:     /^$/    yes
To:     webmaster@www.dpi.state.wi.us   yes

But I still keep getting it



The original message was received at Tue, 8 Jul 2003 12:08:05 -0500 (CDT)
from doagw01.doa.state.wi.us [165.189.88.161]

   ----- The following addresses had permanent fatal errors -----
<'webmaster@www.dpi.state.wi.us>
    (reason: 553 5.3.5 system config error)

   ----- Transcript of session follows -----
553 5.3.5 www.dpi.state.wi.us. config error: mail loops back to me (MX
problem?)
554 5.3.5 Local configuration error

AM I doing something wrong here...
I am running MailScanner E-Mail Virus Scanner version 4.22-4 on SUn Solaris
running sendmail
Any Help will be appreciated
Thanx
Harish

From mike at CAMAROSS.NET  Tue Jul  8 18:16:23 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:52 2006
Subject: R Rulesets( How to disable a mail to a user before scanning)
In-Reply-To: <47F3EDACE4BC3A4594D0D7B504062BBD03733E70@doamail04.doa.wistate.us>
Message-ID: <001e01c34574$a8c96680$9c01a8c0@home.middlefinger.net>

Ahhh...your mail server is not configured to accept mail for
www.dpi.state.wi.us  Try adding that FQDN to your local delivery domains.
I'm not sure where this is done on Solaris.

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Amin, Harish
Sent: Tuesday, July 08, 2003 12:13 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: R Rulesets( How to disable a mail to a user before scanning)


I receive about 50 messages to a unknown user on my SMTP server and I as a
postmaster receive all the messages back I tried the rules

# more spam.actions.rules
To:     webmaster@www.dpi.state.wi.us    delete


# more spam.blacklist.rules
#To:     /^$/    yes
To:     webmaster@www.dpi.state.wi.us   yes

But I still keep getting it



The original message was received at Tue, 8 Jul 2003 12:08:05 -0500 (CDT)
from doagw01.doa.state.wi.us [165.189.88.161]

   ----- The following addresses had permanent fatal errors -----
<'webmaster@www.dpi.state.wi.us>
    (reason: 553 5.3.5 system config error)

   ----- Transcript of session follows -----
553 5.3.5 www.dpi.state.wi.us. config error: mail loops back to me (MX
problem?)
554 5.3.5 Local configuration error

AM I doing something wrong here...
I am running MailScanner E-Mail Virus Scanner version 4.22-4 on SUn Solaris
running sendmail Any Help will be appreciated Thanx Harish


From raymond at PROLOCATION.NET  Tue Jul  8 19:00:17 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:52 2006
Subject: How to disable a mail to a user before scanning
In-Reply-To: <LISTSERV%2003070818103063@JISCMAIL.AC.UK>
Message-ID: <Pine.LNX.4.44.0307081958310.3529-100000@mailbox.prolocation.net>

Hi!

> To:     webmaster@www.dpi.state.wi.us   yes

>    ----- The following addresses had permanent fatal errors -----
> <'webmaster@www.dpi.state.wi.us>
>     (reason: 553 5.3.5 system config error)

I noticed a slightly diffrent address, the one in your mail has a

 'webmaster

and you block

  webmaster

Perhaps its just a typo, if not it might be your solution.

You could also let your mailer block *@www.bha in the access files.

Bye,
Raymond.

From forrie at FORRIE.COM  Tue Jul  8 19:15:28 2003
From: forrie at FORRIE.COM (Forrest Aldrich)
Date: Thu Jan 12 21:18:52 2006
Subject: SpamAssassin Milter
In-Reply-To: <Pine.LNX.4.44.0307081958310.3529-100000@mailbox.prolocatio n.net>
References: <LISTSERV%2003070818103063@JISCMAIL.AC.UK>
Message-ID: <5.2.1.1.2.20030708141420.02f7ce90@192.168.1.1>

Hi,

Wondering if others have experience with using MailScanner with
Spamassassin Milter.

I've been testing it (CVS code) and it seems to be working well, but I'm
curious about optimizing how it works with MailScanner (if that's possible,
since MailScanner isn't using Milter).


Thanks..

From raymond at PROLOCATION.NET  Tue Jul  8 19:18:41 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:52 2006
Subject: F-prot auto updates ...
In-Reply-To: <5.2.1.1.2.20030708141420.02f7ce90@192.168.1.1>
Message-ID: <Pine.LNX.4.44.0307082016590.6343-100000@mailbox.prolocation.net>

Hi!

I just noticed the f-prot update sites (both ftp.f-prot.com and
updates.f-prot.com are mega slow. The link towards their network seems
just fine, low responses there. But when logging into their machines all
hangs. If tested this from 4 networks, usa and europe based. It kept my
auto update hanging so i disabled that for now.

Other people experiencing the same ?

bye,
Raymond.

From mbowman at UDCOM.COM  Tue Jul  8 19:19:35 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:52 2006
Subject: F-prot auto updates ...
Message-ID: <OF03A73096.39F23B07-ON85256D5D.0064A16E-85256D5D.0064E035@udcomm.net>

Yes its slow from here too (Mansfield, Ohio)

Matthew





Raymond Dijkxhoorn <raymond@PROLOCATION.NET>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
07/08/2003 02:18 PM
Please respond to MailScanner mailing list


        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        F-prot auto updates ...


Hi!

I just noticed the f-prot update sites (both ftp.f-prot.com and
updates.f-prot.com are mega slow. The link towards their network seems
just fine, low responses there. But when logging into their machines all
hangs. If tested this from 4 networks, usa and europe based. It kept my
auto update hanging so i disabled that for now.

Other people experiencing the same ?

bye,
Raymond.

From raymond at PROLOCATION.NET  Tue Jul  8 19:23:37 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:52 2006
Subject: F-prot auto updates ...
In-Reply-To: <OF03A73096.39F23B07-ON85256D5D.0064A16E-85256D5D.0064E035@udcomm.net>
Message-ID: <Pine.LNX.4.44.0307082022240.6947-100000@mailbox.prolocation.net>

Hi!

> Yes its slow from here too (Mansfield, Ohio)

> Other people experiencing the same ?

Ok, thanks. Then i know its not just me :)

Other people might want to disable the auto update script also, since
during the update mail will crop up and a update took 40 minutes here when
i let it complete. Gives a nice backlog on processing :)

Bye,
Raymond.

From Kevin_Miller at CI.JUNEAU.AK.US  Tue Jul  8 19:01:35 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:53 2006
Subject: Sophos Antivirus...
Message-ID: <08146035CA49D6119A36009027AC822A0264E496@CITY-EXCH-NTS>

I'm still muddling over what antivirus to go with on my secondary server.
(F-prot is on my current server, but got to expensive!) I set up a
spreadsheet and grabbed the AV products web page on the MailScanner site and
am trying to get a "global view" of the diffenent products strengths &
weaknesses.  I'm looking at each one by one, and am on the Sophos web site,
but have a couple questions about it:

Approximate cost?  Didn't see that listed anywhere, though might have missed
it.

It seems that they put out a new "version" monthly, or as needed.  The
MailScanner script (or at least the instructions on the MS web page for a
tarball install) indicate that a daily cron job can be used to update the
critter.  I have the impression though, that I'd still have to do a monthly
install of the new IDE files.  Is that correct?  Can it be set up so that it
takes care of itself for the duration of the license (i.e., a year or more)?
In the event of an outbreak I don't mind doing a manual pull, but I don't
want to make it a habit every month.

As always, thanks much.  More questions sure to follow...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

From zabriskw at ITECH.NET  Tue Jul  8 19:50:21 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:18:53 2006
Subject: Bayesian Scanning
Message-ID: <003c01c34581$c88e69e0$0c02a8c0@itech.dom>

I am having one heck of a time getting Bayesian scanning to work properly.
I am having several problems.  The first problem is with the Bayesian
scanning itself.  I have been using the script below in a cron job, but have
had several problems with it:

#!/bin/sh

SPAM=/var/spool/mail/spam
NOTSPAM=/var/spool/mail/notspam
TOTAL=.cumulative

LOGFILE=/var/log/learn.spam.log
PREFS=/usr/local/MailScanner/etc/spam.assassin.prefs.conf
SALEARN=/usr/local/MailScanner/bin/sa-learn

date >> $LOGFILE
if [ -f $SPAM ]; then
  BOX=${SPAM}.processing
  mv $SPAM $BOX
  sleep 5 # Wait for writing current message to complete
  $SALEARN --prefs-file=$PREFS --spam --mbox $BOX >> $LOGFILE 2>&1
  cat $BOX >> ${SPAM}${TOTAL}
  echo >> ${SPAM}${TOTAL}
  rm -f $BOX
fi

if [ -f $NOTSPAM ]; then
  BOX=${NOTSPAM}.processing
  mv $NOTSPAM $BOX
  sleep 5 # Wait for writing current message to complete
  $SALEARN --prefs-file=$PREFS --ham --mbox $BOX >> $LOGFILE 2>&1
  cat $BOX >> ${NOTSPAM}${TOTAL}
  echo >> ${NOTSPAM}${TOTAL}
  rm -f $BOX
fi

Now.. the problem I see with this is.. it is moving the spam@domain.com and
notspam@domain.com mailboxes, and they are not being recreated. Has anyone
else experienced this problem?  I tried adding these lines and it worked,
but caused the following errors to be reported:

touch $SPAM
chown spam $SPAM

and visa versa for $NOTSPAM

This is causing the processes to be killed however.

The other problem is when I attempt to run the Bayesian clean up script this
is the error I get:

Failed to create default user preference file //.spamassassin/user_prefs

............................................................................
............................................................................
...........................................................bayes
expire_old_tokens: Out of memory during "large" request for 1052672 bytes,
total sbrk() is 133331264 bytes at
/usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/BayesStore.pm line
390.


Has anyone experienced these problems before?  Any help would be greatly
appreciated.  Thanks!

From kevins at BMRB.CO.UK  Tue Jul  8 19:56:33 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:53 2006
Subject: Sophos Antivirus...
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175D32@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D32@pascal.priv.bmrb.co.uk>
Message-ID: <1057690603.23991.3.camel@bach.kevinspicer.co.uk>

>Approximate cost?  Didn't see that listed anywhere, though might have
>missed it.

If you're looking to save money Sophos won't be your choice!

>It seems that they put out a new "version" monthly, or as needed.  The
>MailScanner script (or at least the instructions on the MS web page for
>a
>tarball install) indicate that a daily cron job can be used to update
>the
>critter.  I have the impression though, that I'd still have to do a
>monthly
>install of the new IDE files.  Is that correct?

MailScanner does hourly updates of all definitions, but Sophos release a
new engine every three months, theres a script somewhere on the MS site
to automate this too.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From kevins at BMRB.CO.UK  Tue Jul  8 20:00:13 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:53 2006
Subject: Bayesian Scanning
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175D33@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D33@pascal.priv.bmrb.co.uk>
Message-ID: <1057690814.23991.7.camel@bach.kevinspicer.co.uk>

> Failed to create default user preference file
//.spamassassin/user_prefs

At a guess you're either running the script as a user other than the
mailscanner user, or the mailscanner user is not root and does not have
a proper home directory.

The mailboxes will be recreated when they next recieve any mail.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From zabriskw at ITECH.NET  Tue Jul  8 20:02:37 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:18:53 2006
Subject: Bayesian Scanning
References: <5C0296D26910694BB9A9BBFC577E7AB001175D33@pascal.priv.bmrb.co.uk> 
            <1057690814.23991.7.camel@bach.kevinspicer.co.uk>
Message-ID: <000601c34583$7fba3d50$0c02a8c0@itech.dom>

Bayesian was being run as root as well as MailScanner.

I was not aware that the mailboxes were recreated when new mail was
received.  Thanks!  I really appreciate your help!

----- Original Message -----
From: "Kevin Spicer" <kevins@BMRB.CO.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 08, 2003 3:00 PM
Subject: Re: Bayesian Scanning


> > Failed to create default user preference file
> //.spamassassin/user_prefs
>
> At a guess you're either running the script as a user other than the
> mailscanner user, or the mailscanner user is not root and does not have
> a proper home directory.
>
> The mailboxes will be recreated when they next recieve any mail.
>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact the
> sender and delete this message immediately.  Disclosure, copying
> or other action taken in respect of this email or in
> reliance on it is prohibited.  BMRB International Limited
> accepts no liability in relation to any personal emails, or
> content of any email which does not directly relate to our
> business.
>

From mailscanner at BARENDSE.TO  Tue Jul  8 20:20:25 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:53 2006
Subject: R Rulesets( How to disable a mail to a user before scanning)
In-Reply-To: <47F3EDACE4BC3A4594D0D7B504062BBD03733E70@doamail04.doa.wistate.us>
Message-ID: <Pine.LNX.4.44.0307082117430.11574-100000@raveon.barendse.to>

I have the same problem.

For some reason mail sent to webmaster@ or postmaster@ never ever gets
deleted. It is marked as spam, but a spam action to delete it never works
it seems.

I haven't tried it yet but maybe a solution to that is create an alias in
your /etc/aliases

getlost:          /dev/null

and make the spam action for the webmaster@whatever forward getlost


On Tue, 8 Jul 2003, Amin, Harish wrote:

> I receive about 50 messages to a unknown user on my SMTP server
> and I as a postmaster receive all the messages back
> I tried the rules
>
> # more spam.actions.rules
> To:     webmaster@www.dpi.state.wi.us    delete
>
>
> # more spam.blacklist.rules
> #To:     /^$/    yes
> To:     webmaster@www.dpi.state.wi.us   yes
>
> But I still keep getting it
>
>
>
> The original message was received at Tue, 8 Jul 2003 12:08:05 -0500 (CDT)
> from doagw01.doa.state.wi.us [165.189.88.161]
>
>    ----- The following addresses had permanent fatal errors -----
> <'webmaster@www.dpi.state.wi.us>
>     (reason: 553 5.3.5 system config error)
>
>    ----- Transcript of session follows -----
> 553 5.3.5 www.dpi.state.wi.us. config error: mail loops back to me (MX
> problem?)
> 554 5.3.5 Local configuration error
>
> AM I doing something wrong here...
> I am running MailScanner E-Mail Virus Scanner version 4.22-4 on SUn Solaris
> running sendmail
> Any Help will be appreciated
> Thanx
> Harish
>

From kevins at BMRB.CO.UK  Tue Jul  8 20:38:47 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:53 2006
Subject: R Rulesets( How to disable a mail to a user before scanning)
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175D37@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D37@pascal.priv.bmrb.co.uk>
Message-ID: <1057693128.23991.11.camel@bach.kevinspicer.co.uk>

On Tue, 2003-07-08 at 20:20, Remco Barendse wrote:

>For some reason mail sent to webmaster@ or postmaster@ never ever gets
>deleted. It is marked as spam, but a spam action to delete it never
>works it seems.

Maybe you have aliases for webmaster & postmaster (perhaps onto root) in
/etc/aliases.  Sendmail (IIRC) applies these aliases on receipt, so by
the time the message gets to MailScanner its envelope is
root@yourserver.yourdomain.com  (you'll still get webmaster in the
headers)





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mike at CAMAROSS.NET  Tue Jul  8 20:38:14 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:53 2006
Subject: R Rulesets( How to disable a mail to a user before scanning)
In-Reply-To: <1057693128.23991.11.camel@bach.kevinspicer.co.uk>
Message-ID: <005e01c34588$797d27e0$9c01a8c0@home.middlefinger.net>

I still say this problem needs to be resolved first:

   ----- Transcript of session follows -----
553 5.3.5 www.dpi.state.wi.us. config error: mail loops back to me (MX
problem?)
554 5.3.5 Local configuration error

On Redhat systems, adding www.dpi.state.wi.us to /etc/mail/local-host-names
and a restart of the MailScanner service should fix it.

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Kevin Spicer
Sent: Tuesday, July 08, 2003 2:39 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: R Rulesets( How to disable a mail to a user before scanning)


On Tue, 2003-07-08 at 20:20, Remco Barendse wrote:

>For some reason mail sent to webmaster@ or postmaster@ never ever gets 
>deleted. It is marked as spam, but a spam action to delete it never 
>works it seems.

Maybe you have aliases for webmaster & postmaster (perhaps onto root) in
/etc/aliases.  Sendmail (IIRC) applies these aliases on receipt, so by the
time the message gets to MailScanner its envelope is
root@yourserver.yourdomain.com  (you'll still get webmaster in the
headers)





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the recipient and may
contain confidential and/or privileged material.  If you have received this
in error, please contact the sender and delete this message immediately.
Disclosure, copying or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited accepts no
liability in relation to any personal emails, or content of any email which
does not directly relate to our business.


From nwp at LEMON-COMPUTING.COM  Tue Jul  8 11:18:36 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:18:53 2006
Subject: Whitelist not working...
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E487@CITY-EXCH-NTS>
References: <08146035CA49D6119A36009027AC822A0264E487@CITY-EXCH-NTS>
Message-ID: <20030708101835.GL29047@hoiho.nz.lemon-computing.com>

On Mon, Jul 07, 2003 at 09:27:30AM -0800, Kevin Miller wrote:

> The sendmail log shows it connected as airemote3.aif1.com, so I'll add that
> & see what happens.  Still not sure if I can wildcard the domain, but if the
> host doesn't change from month to month I guess it doesn't matter...

Remember that it's not the host that's connecting that you're after, but the
domain that that host claims the mail is from... I wasn't quite sure which
you were referring to above.


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
You can create your own opportunities this week.  Blackmail a senior executive.

From nwp at LEMON-COMPUTING.COM  Tue Jul  8 11:16:44 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:18:53 2006
Subject: File locking / directory problem
In-Reply-To: <E0747DCCDD2AD411B865009027347CD20306743D@boisemx.powereng.com>
References: <E0747DCCDD2AD411B865009027347CD20306743D@boisemx.powereng.com>
Message-ID: <20030708101644.GK29047@hoiho.nz.lemon-computing.com>

On Mon, Jul 07, 2003 at 09:08:02AM -0600, Derrick Georgiades wrote:

> It doesn't appear to be a permissions issue.  Does anyone know what an error
> 7 is for the lockd daemon?  Strangely I can still pass mail, but these
> errors seem like it shouldn't.  Any help would be greatly appreciated.

Are your spool dirs NFS-mounted? Sendmail generally uses flock (as does
mailscanner when working with sendmail), which is not NFS-safe...


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
You never know how many friends you have until you rent a house on the beach.

From webmaster at ORBITEL.COM  Wed Jul  9 05:17:51 2003
From: webmaster at ORBITEL.COM (Orbitel Webmaster)
Date: Thu Jan 12 21:18:53 2006
Subject: How to use spamassassin on a per user basis with a third party e-mail server setup?
Message-ID: <200307081545.KAA27336@mail.int.orbitel.com>

What have you found as the easiest way to enable/disable spamassassin 
for individual e-mail addresses?  Our mailscanner server is being 
utilized in a third party e-mail server enviroment (relay) therefore 
there cannot be individual user accounts and spamassassin preference 
files.

I would like the ability to either disable tagging, enable tagging, 
or enable auto spam deletion on a per e-mail address basis.  I would 
like all settings to default to off.  Additionally, all users will 
receive e-mail virus scanning.

Can someone point me in the right direction -- documentation or 
otherwise?  The closest I have found is spamassassin's userpref's 
file on their website.

Thanks!


From forrie at FORRIE.COM  Tue Jul  8 21:11:49 2003
From: forrie at FORRIE.COM (Forrest Aldrich)
Date: Thu Jan 12 21:18:53 2006
Subject: Automatic Archiving of attachements......
In-Reply-To: <5.2.1.1.2.20030708141420.02f7ce90@192.168.1.1>
References: <Pine.LNX.4.44.0307081958310.3529-100000@mailbox.prolocatio n.net>
            <LISTSERV%2003070818103063@JISCMAIL.AC.UK>
Message-ID: <5.2.1.1.2.20030708161027.02f84238@192.168.1.1>

Another way one might be able to trick *.pif attachments and the like
(provided they're not outright prohibited) are by automatically placing
attachments into a *.zip file or something similar.

AOL does this with attachments, and I'm not sure how one would do this --
it would certainly be a performance hit.

From adkinss at OHIO.EDU  Tue Jul  8 21:36:10 2003
From: adkinss at OHIO.EDU (Scott Adkins)
Date: Thu Jan 12 21:18:53 2006
Subject: Sophos Antivirus...
In-Reply-To: <1057690603.23991.3.camel@bach.kevinspicer.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D32@pascal.priv.bmrb.co.uk>
            <1057690603.23991.3.camel@bach.kevinspicer.co.uk>
Message-ID: <2181725665.1057682170@Callisto>

--On Tuesday, July 08, 2003 7:56 PM +0100 Kevin Spicer <kevins@BMRB.CO.UK> 
wrote:

>> Approximate cost?  Didn't see that listed anywhere, though might have
>> missed it.
>
> If you're looking to save money Sophos won't be your choice!
>
>> It seems that they put out a new "version" monthly, or as needed.  The
>> MailScanner script (or at least the instructions on the MS web page for
>> a
>> tarball install) indicate that a daily cron job can be used to update
>> the
>> critter.  I have the impression though, that I'd still have to do a
>> monthly
>> install of the new IDE files.  Is that correct?
>
> MailScanner does hourly updates of all definitions, but Sophos release a
> new engine every three months, theres a script somewhere on the MS site
> to automate this too.

Actually, Sophos updates their engine every month (though, they could do
it more often in cases of emergencies, but I haven't seen that happen).
You are only required to update your engine every three months, as the
auto-update process won't work after that.  It is a good idea to update
the engine as often as possible, but realistically, most people do it
on the three month schedule.

As for the auto-update process for the IDEs, we watch the mailbox that
receives their mailings that new IDEs have been put up on the web page.
Basically, when the mailbox file changes, an auto-update process kicks
off.  It has come in handy in a couple instances, such as the Sobig-E
virus.  As soon as the update process downloaded the IDE for it, we
were getting notifications that the virus was being caught... I am sure
a few made it to some user's mailboxes before they made an IDE for it.

Scott
-- 
 +-----------------------------------------------------------------------+
      Scott W. Adkins                http://www.cns.ohiou.edu/~sadkins/
   UNIX Systems Engineer                  mailto:adkinss@ohio.edu
        ICQ 7626282                 Work (740)593-9478 Fax (740)593-1944
 +-----------------------------------------------------------------------+
     PGP Public Key available at http://www.cns.ohiou.edu/~sadkins/pgp/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 231 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030708/c7ddafe6/attachment.bin
From mbowman at UDCOM.COM  Tue Jul  8 21:56:55 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:53 2006
Subject: score=0/spamc errors
Message-ID: <OF9A49771B.6F640F8B-ON85256D5D.0072A76B-85256D5D.00734797@udcomm.net>

Hi

I have had a client call me today about a problem whereby an e-mail
doesn't get scored..

In the headers it says SCORE=0 but I cannot find any trace of this in the
maillog.

However I do see the mail be routed as follows:

Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
from=<1zbygm6VcbmPdijo463wtpZP7mIjEe@5948.bounce.e-i1.com>, size=1568,
class=0, nrcpts=1,
msgid=<1zbygdxMTSdGUZafvxunkgQGyd9a5V@1zbygQk9GFQ3HMNSikhaXTD3lQwNsI>,
proto=SMTP, daemon=MTA, relay=b7.e-i1.com [63.251.54.87]
Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
to=<garyl@gormanrupp.com>, delay=00:00:01, mailer=smtp, pri=31568,
stat=queued
Jul  8 12:42:22 smithers sendmail[21551]: h68GgK621543:
to=<garyl@gormanrupp.com>, delay=00:00:02, xdelay=00:00:00, mailer=smtp,
pri=121568, relay=grcmail1.gormanrupp.com. [63.173.204.4], dsn=2.0.0,
stat=Sent (Message accepted for delivery)

No indication of Spam Checking...

Maillog has also reported this

Jul  8 16:54:53 smithers spamc[1410]: connect() to spamd at 127.0.0.1
failed, retrying (1/3): Connection refused
Jul  8 16:54:54 smithers spamc[1410]: connect() to spamd at 127.0.0.1
failed, retrying (2/3): Connection refused
Jul  8 16:54:55 smithers spamc[1410]: connect() to spamd at 127.0.0.1
failed, retrying (3/3): Connection refused
Jul  8 16:54:56 smithers spamc[1410]: connection attempt to spamd aborted
after 3 retries

Are these linked? or seperate issues?

Problems started to happen after the upgrade to MS 4.22-4 and SA 2.55

Any help would be appreciated

Thank you

Matthew Bowman
UDCom

From lists at STHOMAS.NET  Tue Jul  8 22:04:24 2003
From: lists at STHOMAS.NET (Steve Thomas)
Date: Thu Jan 12 21:18:53 2006
Subject: Sophos Antivirus...
In-Reply-To: <2181725665.1057682170@Callisto>; from adkinss@OHIO.EDU on Tue,
              Jul 08, 2003 at 04:36:10PM -0400
References: <5C0296D26910694BB9A9BBFC577E7AB001175D32@pascal.priv.bmrb.co.uk>
            <1057690603.23991.3.camel@bach.kevinspicer.co.uk>
            <2181725665.1057682170@Callisto>
Message-ID: <20030708140424.A7799@sthomas.net>

On Tue, Jul 08, 2003 at 04:36:10PM -0400, Scott Adkins is rumored to have said:
>
> Basically, when the mailbox file changes, an auto-update process kicks
> off.  It has come in handy in a couple instances, such as the Sobig-E

I have a utility that automates the downloading of the IDEs when the e-mail is received. It extracts the URL out of the message and downloads the IDE file. It's used by setting up an alias in sendmail which feeds the message to the program.

Here's the URL for those interested:

  http://www.sthomas.net/perl/scripts/sidefire.php


--
"One of the symptoms of an approaching nervous breakdown is the belief that one's work is terribly important."
- Bertrand Russell (1872-1970)

From combslm at APPSTATE.EDU  Tue Jul  8 22:08:19 2003
From: combslm at APPSTATE.EDU (Laramie Combs)
Date: Thu Jan 12 21:18:53 2006
Subject: score=0/spamc errors
References: <OF9A49771B.6F640F8B-ON85256D5D.0072A76B-85256D5D.00734797@udcomm.net>
Message-ID: <001c01c34595$0f3374e0$1e140a98@somana>

I have never seen a score of exactly 0 from spamassassin.

Mailscanner should not have to connect to spamd for its scanning - it just
uses the spamassassin program for scanning and scoring.

Spamd probably got started running with your upgrade to the SA 2.55.

Are you seeing other mail messages getting scores from MailScanner?

-Laramie Combs
Network Analyst
Appalachian State


----- Original Message -----
From: "Matthew Bowman" <mbowman@UDCOM.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 08, 2003 4:56 PM
Subject: score=0/spamc errors


> Hi
>
> I have had a client call me today about a problem whereby an e-mail
> doesn't get scored..
>
> In the headers it says SCORE=0 but I cannot find any trace of this in the
> maillog.
>
> However I do see the mail be routed as follows:
>
> Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
> from=<1zbygm6VcbmPdijo463wtpZP7mIjEe@5948.bounce.e-i1.com>, size=1568,
> class=0, nrcpts=1,
> msgid=<1zbygdxMTSdGUZafvxunkgQGyd9a5V@1zbygQk9GFQ3HMNSikhaXTD3lQwNsI>,
> proto=SMTP, daemon=MTA, relay=b7.e-i1.com [63.251.54.87]
> Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
> to=<garyl@gormanrupp.com>, delay=00:00:01, mailer=smtp, pri=31568,
> stat=queued
> Jul  8 12:42:22 smithers sendmail[21551]: h68GgK621543:
> to=<garyl@gormanrupp.com>, delay=00:00:02, xdelay=00:00:00, mailer=smtp,
> pri=121568, relay=grcmail1.gormanrupp.com. [63.173.204.4], dsn=2.0.0,
> stat=Sent (Message accepted for delivery)
>
> No indication of Spam Checking...
>
> Maillog has also reported this
>
> Jul  8 16:54:53 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (1/3): Connection refused
> Jul  8 16:54:54 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (2/3): Connection refused
> Jul  8 16:54:55 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (3/3): Connection refused
> Jul  8 16:54:56 smithers spamc[1410]: connection attempt to spamd aborted
> after 3 retries
>
> Are these linked? or seperate issues?
>
> Problems started to happen after the upgrade to MS 4.22-4 and SA 2.55
>
> Any help would be appreciated
>
> Thank you
>
> Matthew Bowman
> UDCom
>

From mikea at MIKEA.ATH.CX  Tue Jul  8 22:17:02 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:53 2006
Subject: score=0/spamc errors
In-Reply-To: <OF9A49771B.6F640F8B-ON85256D5D.0072A76B-85256D5D.00734797@udcomm.net>; from mbowman@UDCOM.COM on Tue,
              Jul 08, 2003 at 04:56:55PM -0400
References: <OF9A49771B.6F640F8B-ON85256D5D.0072A76B-85256D5D.00734797@udcomm.net>
Message-ID: <20030708161702.A22183@mikea.ath.cx>

On Tue, Jul 08, 2003 at 04:56:55PM -0400, Matthew Bowman wrote:
> Hi
>
> I have had a client call me today about a problem whereby an e-mail
> doesn't get scored..
>
> In the headers it says SCORE=0 but I cannot find any trace of this in the
> maillog.
>
> However I do see the mail be routed as follows:
>
> Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
> from=<1zbygm6VcbmPdijo463wtpZP7mIjEe@5948.bounce.e-i1.com>, size=1568,
> class=0, nrcpts=1,
> msgid=<1zbygdxMTSdGUZafvxunkgQGyd9a5V@1zbygQk9GFQ3HMNSikhaXTD3lQwNsI>,
> proto=SMTP, daemon=MTA, relay=b7.e-i1.com [63.251.54.87]
> Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
> to=<garyl@gormanrupp.com>, delay=00:00:01, mailer=smtp, pri=31568,
> stat=queued
> Jul  8 12:42:22 smithers sendmail[21551]: h68GgK621543:
> to=<garyl@gormanrupp.com>, delay=00:00:02, xdelay=00:00:00, mailer=smtp,
> pri=121568, relay=grcmail1.gormanrupp.com. [63.173.204.4], dsn=2.0.0,
> stat=Sent (Message accepted for delivery)
>
> No indication of Spam Checking...
>
> Maillog has also reported this
>
> Jul  8 16:54:53 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (1/3): Connection refused
> Jul  8 16:54:54 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (2/3): Connection refused
> Jul  8 16:54:55 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (3/3): Connection refused
> Jul  8 16:54:56 smithers spamc[1410]: connection attempt to spamd aborted
> after 3 retries
>
> Are these linked? or seperate issues?
>
> Problems started to happen after the upgrade to MS 4.22-4 and SA 2.55
>
> Any help would be appreciated

If you're running MailScanner, and MailScanner is running SpamAssassin
directly, then I don't understand why spamc and/or spamd would be
involved in any way at all.

Would you mind explaining just how things are installed, and who does
what, and with which, and to whom? Then we'll all have a somewhat
better understanding of what's going on.

Output from `ps awux | grep -i mail`, or its Linux equivalent, would
be useful, too.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From kevins at BMRB.CO.UK  Tue Jul  8 22:28:19 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:53 2006
Subject: Sophos Antivirus...
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175D3B@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D3B@pascal.priv.bmrb.co.uk>
Message-ID: <1057699700.23991.17.camel@bach.kevinspicer.co.uk>

> Actually, Sophos updates their engine every month

Agreed, I meant to say that you only need to upgrade every three months,
doh!

>
> As for the auto-update process for the IDEs, we watch the mailbox that
> receives their mailings that new IDEs have been put up on the web page.
> Basically, when the mailbox file changes, an auto-update process kicks
> off.

I've found that the ides usually appear a while before the email alerts,
whenever I've checked (which to be fair isn't often) I've already got
the ides from the hourly update by the time the email arrives.  I guess
they don't wait to write the analysis and send the email before
publishing the ides.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From moliveri at UTI.COM  Tue Jul  8 22:32:20 2003
From: moliveri at UTI.COM (Mike Oliveri)
Date: Thu Jan 12 21:18:53 2006
Subject: Quick AV question
Message-ID: <5.2.0.9.0.20030708162609.00a7b4e0@mail211.pair.com>

Hi folks,

I'm working on getting MailScanner up and running and have a quick
question. The sysadmin I'm replacing had AMaViS (http://www.amavis.org/)
antivirus running on the mail server in the past. I noticed it's not listed
on the AV chart at
http://www.sng.ecs.soton.ac.uk/mailscanner/install/OS-virus-scan-web.htm.
Has anyone out there used MailScanner with AMaViS, and/or can anyone think
of any reason I shouldn't be able to? Thanks!

Take care,
Mike Oliveri
www.mikeoliveri.com

From mbowman at UDCOM.COM  Tue Jul  8 22:42:31 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:53 2006
Subject: score=0/spamc errors
Message-ID: <OF89036449.E2338FA5-ON85256D5D.0076AB0F@udcomm.net>

Hi

Redhat 7.3 running on a Dell Poweredge with Dual 1Ghz Processors and 1GB of
Ram
sendmail 8.11.6 - fully patched

I upgraded from MailScanner 4-13.3 to 4.22.4 and all I did was update the
.conf and .rule files to what I previously had. I downloaded SA 2.55 and
compiled from source.

I am seeing e-mail getting scored with SpamAssassin but occassionally it
doesn't even check for e-mail to a domain for spam.

An example of the problem I've been looking at

An email is sent from 1zbygm6VcbmPdijo463wtpZP7mIjEe@5948.bounce.e-i1.com
to gary1@gormanrupp.com

MX 5 for gormanrupp.com points to 63.173.207.13 (smithers)

the e-mail is checked by mailscanner and via mailertable is forwarded onto
the client's Lotus mail server

In the 'document properties' under X-MailScanner-SpamCheck it says SCORE=0,
REQUIRED=4

Naturally I am baffled by this problem. The MX 10 server which we provide
does not have MS or SA installed so I'm ruling that out.

Output from ps command

root     24497  0.0  0.3  7264 3596 ?        S    May18   4:59
/usr/bin/perl /us
r/bin/mrtg /etc/mrtg/mailscanner-mrtg.cfg
root     22189  0.0  0.2  5568 2072 ?        S    15:45   0:02 sendmail:
accepti
ng connections
root     22194  0.0  0.1  4696 1760 ?        S    15:45   0:00
/usr/sbin/sendmai
l -q15m
root     22212  0.0  0.8 10200 8780 ?        S    15:45   0:00
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22213  0.5  2.0 22524 20692 ?       S    15:45   0:40
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22232  0.6  2.0 23108 21272 ?       S    15:45   0:43
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22258  0.5  2.0 22436 20612 ?       S    15:45   0:41
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22280  0.6  2.0 22740 20900 ?       S    15:45   0:43
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22292  0.5  2.0 23092 21236 ?       S    15:45   0:37
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     23665  0.0  0.2  5972 2532 ?        S    15:53   0:00 sendmail:
server
[61.173.41.30] child wait
root     23928  0.0  0.2  6316 2628 ?        S    15:54   0:00 sendmail:
./h68Js
Wr23928 [61.173.41.30]: DATA
root     25368  0.0  0.2  5968 2532 ?        S    16:01   0:00 sendmail:
server
madison.punchstock.com [216.165.175.102] (may be for
root     25372  0.0  0.2  6312 2628 ?        S    16:01   0:00 sendmail:
./h68K1
qr25372 madison.punchstock.com [216.165.175.102] (ma
root       814  0.0  0.2  5968 2532 ?        S    16:52   0:00 sendmail:
server
mail10.hollywoodspecials.net [216.39.88.106] cmd rea
root      7307  0.0  0.2  5032 2196 ?        S    17:40   0:00 sendmail:
./h68Le
er07297 xwing.aoltw.net.: user open
root      7432  0.4  0.2  5968 2540 ?        S    17:41   0:00 sendmail:
server
mail.directoptions.com [216.196.234.46] child wait
root      7435  0.0  0.2  5584 2168 ?        S    17:41   0:00 sendmail:
startup
 with bay0-smtp07.bay0.hotmail.com
root      7438  2.0  0.2  6312 2628 ?        S    17:41   0:00 sendmail:
./h68Lf
sr07438 mail.directoptions.com [216.196.234.46]: DAT
root      7448  0.0  0.0  1740  596 pts/2    S


Thanks for the input so far

Matthew




                    mikea
                    <mikea@MIKEA.ATH.C       To:     MAILSCANNER@JISCMAIL.AC.UK
                    X>                       cc:
                    Sent by:                 Subject:     Re: score=0/spamc errors
                    MailScanner
                    mailing list
                    <MAILSCANNER@JISCM
                    AIL.AC.UK>


                    07/08/2003 05:17
                    PM
                    Please respond to
                    MailScanner
                    mailing list






On Tue, Jul 08, 2003 at 04:56:55PM -0400, Matthew Bowman wrote:
> Hi
>
> I have had a client call me today about a problem whereby an e-mail
> doesn't get scored..
>
> In the headers it says SCORE=0 but I cannot find any trace of this in the
> maillog.
>
> However I do see the mail be routed as follows:
>
> Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
> from=<1zbygm6VcbmPdijo463wtpZP7mIjEe@5948.bounce.e-i1.com>, size=1568,
> class=0, nrcpts=1,
> msgid=<1zbygdxMTSdGUZafvxunkgQGyd9a5V@1zbygQk9GFQ3HMNSikhaXTD3lQwNsI>,
> proto=SMTP, daemon=MTA, relay=b7.e-i1.com [63.251.54.87]
> Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
> to=<garyl@gormanrupp.com>, delay=00:00:01, mailer=smtp, pri=31568,
> stat=queued
> Jul  8 12:42:22 smithers sendmail[21551]: h68GgK621543:
> to=<garyl@gormanrupp.com>, delay=00:00:02, xdelay=00:00:00, mailer=smtp,
> pri=121568, relay=grcmail1.gormanrupp.com. [63.173.204.4], dsn=2.0.0,
> stat=Sent (Message accepted for delivery)
>
> No indication of Spam Checking...
>
> Maillog has also reported this
>
> Jul  8 16:54:53 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (1/3): Connection refused
> Jul  8 16:54:54 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (2/3): Connection refused
> Jul  8 16:54:55 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (3/3): Connection refused
> Jul  8 16:54:56 smithers spamc[1410]: connection attempt to spamd aborted
> after 3 retries
>
> Are these linked? or seperate issues?
>
> Problems started to happen after the upgrade to MS 4.22-4 and SA 2.55
>
> Any help would be appreciated

If you're running MailScanner, and MailScanner is running SpamAssassin
directly, then I don't understand why spamc and/or spamd would be
involved in any way at all.

Would you mind explaining just how things are installed, and who does
what, and with which, and to whom? Then we'll all have a somewhat
better understanding of what's going on.

Output from `ps awux | grep -i mail`, or its Linux equivalent, would
be useful, too.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From lists at STHOMAS.NET  Tue Jul  8 22:50:59 2003
From: lists at STHOMAS.NET (Steve Thomas)
Date: Thu Jan 12 21:18:53 2006
Subject: Quick AV question
Message-ID: <20030708145059.B9279@sthomas.net>

On Tue, Jul 08, 2003 at 04:32:20PM -0500, Mike Oliveri is rumored to have said:
>
> Has anyone out there used MailScanner with AMaViS, and/or can anyone think
> of any reason I shouldn't be able to? Thanks!

MailScanner and Amavis perform roughly the same function - both use external virus scanners to check incoming messages, but MS adds antispam capabilities. I used to use amavis, but replaced it with MS some time ago. Better software, antispam and there aren't sixteen zillion branches to try and decide between/keep uptodate.

--
"Knowledge speaks, but wisdom listens."
- Jimi Hendrix

From mikew at CRUCIS.NET  Tue Jul  8 22:45:50 2003
From: mikew at CRUCIS.NET (Mike Watson)
Date: Thu Jan 12 21:18:53 2006
Subject: Heads up - serious vulnerability in 'unzip'
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0A4ADBC@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB0A4ADBC@pascal.priv.bmrb.co.uk>
Message-ID: <200307081645.53709.mikew@crucis.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tuesday 08 July 2003 03:13 am, you wrote:
> Theres a problem with unzip.  Looks like it could be serious for
> anyone running MailScanner as root where the virus scanner uses
> external unzip (such as Clam). Patches are available.
>
> (from http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0282 )
>
> Directory traversal vulnerability in UnZip 5.50 allows attackers to
> overwrite arbitrary files via invalid characters between two . (dot)
> characters, which are filtered and result in a ".." sequence.
>
>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
Snipped

Red Hat has already released a fix for unzip for RH8 & 9.  Earlier 
versions too I think.

Mike W
- -- 
Registered Linux - 256979
NRA Life
ARS: W0TMW








-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE/CzuR5fq6h2uDDlQRAgsDAJ4scKkrGmWGrEbFC1TIbTVa5qq6LwCgoRhO
GxWmORq0if5GEe/XsTqe8/Q=
=KMyp
-----END PGP SIGNATURE-----


-- 
This message has been scanned for viruses and 
dangerous content by F-Prot and MailScanner, 
and is believed to be clean.


From richard_cipher at YAHOO.COM  Tue Jul  8 23:02:56 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:53 2006
Subject: Quick AV question
In-Reply-To: <5.2.0.9.0.20030708162609.00a7b4e0@mail211.pair.com>
Message-ID: <NHBBIDLEJBNNEMOPKJPNOEIIDBAA.richard_cipher@yahoo.com>

Yes.

Amavis is actually, at least to my understand, an e-mail scanner, that calls
an anti-virus piece of software, such as Kapersky, or F-prot, or Sophos.  It
can also be used to scan e-mails for spam.

Sounds just like MailScanner!  In Fact, it fulfills the same role as
MailScanner in the marketplace, only it is much tougher to install and setup
and have working.  MailScanner is more stable and robust.  Once I switched
from Amavis to MailScanner, I've had very few problems.

Evert
Computer Guy
Westone Laboratories.

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From moliveri at UTI.COM  Tue Jul  8 23:05:00 2003
From: moliveri at UTI.COM (Mike Oliveri)
Date: Thu Jan 12 21:18:53 2006
Subject: Quick AV question
In-Reply-To: <20030708145059.B9279@sthomas.net>
Message-ID: <5.2.0.9.0.20030708170416.00a7b4e0@pop3.uti.com>

Ah, wasn't aware of that. This is the first I've run into AMaViS. Guess
I'll dig a little further and see what amavis is really doing...

Thanks!

Take care,
Mike

At 02:50 PM 7/8/2003 -0700, you wrote:
>On Tue, Jul 08, 2003 at 04:32:20PM -0500, Mike Oliveri is rumored to have
>said:
> >
> > Has anyone out there used MailScanner with AMaViS, and/or can anyone think
> > of any reason I shouldn't be able to? Thanks!
>
>MailScanner and Amavis perform roughly the same function - both use
>external virus scanners to check incoming messages, but MS adds antispam
>capabilities. I used to use amavis, but replaced it with MS some time ago.
>Better software, antispam and there aren't sixteen zillion branches to try
>and decide between/keep uptodate.
>
>--
>"Knowledge speaks, but wisdom listens."
>- Jimi Hendrix

From esandquist at IHMS.NET  Tue Jul  8 23:38:34 2003
From: esandquist at IHMS.NET (Eric Sandquist)
Date: Thu Jan 12 21:18:53 2006
Subject: Service in Tarbal??
In-Reply-To: <3EF9E978.12665.15063A9@localhost>
Message-ID: <LAEOJCOHMABIMDAGOHNGMENKJJAB.esandquist@ihms.net>

I have an installation of MailScanner on a Mandrake 8.2 server.  I have
installed from a tarbal and not the rpm.

I am using postfix 2.0.10, clamav, and spamassassin.

All is working well right now...

However, I recently made changes to the filename.rules.conf to stop the
SoBig.E virus and now need to restart the service.

The problem is what files need to be installed to run MailScanner as a
server?  There is no obvious instructions for building the file
/etc/rc.d/init.d/MailScanner or /etc/sysconfig/MailScanner...

I know that these are part of the RPM, but how do I construct them
otherwise?

Eric

From raymond at PROLOCATION.NET  Tue Jul  8 23:48:24 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:53 2006
Subject: Service in Tarbal??
In-Reply-To: <LAEOJCOHMABIMDAGOHNGMENKJJAB.esandquist@ihms.net>
Message-ID: <Pine.LNX.4.44.0307090047430.3711-100000@mailbox.prolocation.net>

Hi!

> The problem is what files need to be installed to run MailScanner as a
> server?  There is no obvious instructions for building the file
> /etc/rc.d/init.d/MailScanner or /etc/sysconfig/MailScanner...
>
> I know that these are part of the RPM, but how do I construct them
> otherwise?

Just grab them from within the RPM, thats really the easiest way to get
them. Or you really want to invent the wheel twice ?

Bye,
Raymond.

From kevins at BMRB.CO.UK  Wed Jul  9 00:05:59 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:53 2006
Subject: Service in Tarbal??
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175D47@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D47@pascal.priv.bmrb.co.uk>
Message-ID: <1057705560.23990.28.camel@bach.kevinspicer.co.uk>

>On Tue, 2003-07-08 at 23:38, Eric Sandquist wrote:

>I have an installation of MailScanner on a Mandrake 8.2 server.  I have
>installed from a tarbal and not the rpm.

I also use MailScanner on Mandrake - you might like to know (for the
future) that the rpm install works just fine, but you have to run it
with the nodeps flag  (i.e. ./install.sh nodeps ).  All the dependencies
are part of the default perl install anyway or installed by the
MailScanner install script.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mark at TIPPINGMAR.COM  Wed Jul  9 01:38:59 2003
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:18:53 2006
Subject: Sophos Antivirus...
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E496@CITY-EXCH-NTS>
Message-ID: <3F0B01B3.5892.4ECC605B@localhost>

On 8 Jul 2003 at 10:01, Kevin Miller wrote:

> It seems that they put out a new "version" monthly, or as needed.  The
> MailScanner script (or at least the instructions on the MS web page for a
> tarball install) indicate that a daily cron job can be used to update the
> critter.  I have the impression though, that I'd still have to do a monthly
> install of the new IDE files.  Is that correct?  Can it be set up so that it
> takes care of itself for the duration of the license (i.e., a year or more)?
> In the event of an outbreak I don't mind doing a manual pull, but I don't
> want to make it a habit every month.
>
The monthly (or at least once every 3 months) update is the
engine, not the IDE files. But Julian's installation script
downloads fresh IDEs after it installs the engine.  A shell
script to automate the monthly update is available here:

http://www.sng.ecs.soton.ac.uk/mailscanner/downloads.shtml

or here:

http://www.tippingmar.com/majorsophos/
--
Mark W. Nienberg, SE
Tipping Mar + associates
1906 Shattuck Ave, Berkeley, CA  94704
visit our website at http://www.tippingmar.com

From shawn at ADVANCEDMANAGED.COM  Wed Jul  9 02:14:08 2003
From: shawn at ADVANCEDMANAGED.COM (shawn)
Date: Thu Jan 12 21:18:53 2006
Subject: locks fcntl flocks
Message-ID: <01d701c345b7$65f01370$3cced7c0@pong>

I installed a new MailScanner(4.22-5) server Friday with SA (2.55), DCC
and Razor. Antivirus is being handled by f-prot and rav.  Everything
seems to be working fine under a light load -about 100 emails have gone
thru since friday.  I decided to stress test by sending 200 emails thru
as fast as possible ? took 1 ? minutes for server to receive them.  I
checked logs and found lots of these errors.  Sendmail is version 8.11.6
on RH 7.1.

 

lots of these 

 

Jul  7 02:12:39 testsystem MailScanner[22304]: Failed to lock

+</var/spool/mqueue.in/dfh677AV620223 with unexpected error: No locks

available

 

 

And then a bunch of these

 

 

Jul  7 03:43:12 testsystem sendmail[3788]: h678cfu00497: SYSERR(root):

cannot flock(/etc/mail/mailertable.db, fd=7, type=1, omode=37777777777,

euid=0): No locks available

Jul  7 03:43:12 testsystem sendmail[3788]: h678cfu00497: SYSERR(root):

cannot flock(/etc/mail/virtusertable.db, fd=8, type=1,

omode=37777777777, euid=0): No locks available

Jul  7 03:43:12 testsystem sendmail[3788]: h678cfu00497: SYSERR(root):

cannot flock(/etc/mail/virtusertable.db, fd=8, type=1,

omode=37777777777, euid=0): No locks available

Jul  7 03:43:12 testsystem sendmail[3788]: h678cfu00497: SYSERR(root):

cannot flock(/etc/aliases.db, fd=9, type=1, omode=37777777777, euid=0):

No locks available

Jul  7 03:43:12 testsystem sendmail[3788]: h678cfu00497: SYSERR(root):

cannot flock(/etc/mail/statistics, fd=10, type=2, omode=37777777777,

euid=0): No locks available

 

 

 

All emails did come thru and all where scored by SA.

 

 

 

I ran the 200 email test a 2nd time and only 176 emails came thru ?

could be tester though, on a 2nd system I lost 4 out 200 but showed no

errors.  Also had 3 errors with DCC on 2nd run.

 

 

 

dccproc[2264]: fcntl(F_SETLKW F_WRLCK DCC-map /var/dcc/map 3): No locks

available

 

 

 

Any ideas?  Googling for answers but not getting anywhere.

 

Thanks

Shawn

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030708/fb8b368c/attachment.html
From lyons at DIGITALVOODOO.ORG  Wed Jul  9 03:22:25 2003
From: lyons at DIGITALVOODOO.ORG (Timothy M. Lyons)
Date: Thu Jan 12 21:18:53 2006
Subject: How to disable a mail to a user before scanning
In-Reply-To: <MMEBKBBDEGGFLDBJHPGEEEOBCAAA.smohan@vsnl.com>
References: <MMEBKBBDEGGFLDBJHPGEEEOBCAAA.smohan@vsnl.com>
Message-ID: <Pine.WNT.4.56.0307082214070.1232@frrxre>

If you use "FEATURE(`blacklist_recipients')" in your "sendmail.mc macro
configuration then you can add entries to the access.db map for local users,
hosts in your domains, or addresses in your domain which should not receive
mail:

 badlocaluser            550 Mailbox disabled for this username
 host.mydomain.com       550 That host does not accept mail
 user@otherhost.mydomain.com     550 Mailbox disabled for this recipient

This would prevent a recipient of badlocaluser@mydomain.com, any user at
host.mydomain.com, and the single address user@otherhost.mydomain.com from
receiving mail.

Hope that helps!

--Tim

---
Timothy M. Lyons, CISSP
lyons at digitalvoodoo.org


--
This message has been scanned for viruses and
dangerous content and is believed to be clean.
--

From mike at CAMAROSS.NET  Wed Jul  9 03:21:28 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:53 2006
Subject: How to disable a mail to a user before scanning
In-Reply-To: <MMEBKBBDEGGFLDBJHPGEEEOBCAAA.smohan@vsnl.com>
Message-ID: <001201c345c0$ce2cb660$9c01a8c0@home.middlefinger.net>

I'll bet if you make your machine accept mail for the FQDN, add the
virtusertable entry to /dev/null and use a ruleset to exclude scanning of
mail to the specified account, you will be happy with the results.  The mail
would be accepted by sendmail, MailScanner would bypass scanning (based on
the ruleset) and the LDA would write the email to /dev/null...never to be
seen again.

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of S Mohan
Sent: Wednesday, July 09, 2003 8:45 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: How to disable a mail to a user before scanning


I thought this happens at delivery and not receipt end - virtusertable
lookup. Am I wrong? If so, the mail will be scanned and then the local
delivery agent would bounce it.

Mohan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Mike Kercher
Sent: Tuesday, July 08, 2003 10:40 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: How to disable a mail to a user before scanning


Why not add an entry to /etc/mail/virtusertable and /dev/null it?

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Harish Amin
Sent: Tuesday, July 08, 2003 12:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: How to disable a mail to a user before scanning


I receive about 50 messages to a unknown user on my SMTP server and I as a
postmaster receive all the messages back I tried the rules

# more spam.actions.rules
To:     webmaster@www.dpi.state.wi.us    delete


# more spam.blacklist.rules
#To:     /^$/    yes
To:     webmaster@www.dpi.state.wi.us   yes

But I still keep getting it



The original message was received at Tue, 8 Jul 2003 12:08:05 -0500 (CDT)
from doagw01.doa.state.wi.us [165.189.88.161]

   ----- The following addresses had permanent fatal errors -----
<'webmaster@www.dpi.state.wi.us>
    (reason: 553 5.3.5 system config error)

   ----- Transcript of session follows -----
553 5.3.5 www.dpi.state.wi.us. config error: mail loops back to me (MX
problem?)
554 5.3.5 Local configuration error

AM I doing something wrong here...
I am running MailScanner E-Mail Virus Scanner version 4.22-4 on SUn Solaris
running sendmail Any Help will be appreciated


From paul at CS.UKY.EDU  Wed Jul  9 03:39:25 2003
From: paul at CS.UKY.EDU (Paul Linton)
Date: Thu Jan 12 21:18:53 2006
Subject: MailScanner not removing virus even though it was found?
Message-ID: <20030709023925.GA12072@bud.cs.uky.edu>

I have a brand new install of MailScanner/Spamassassin/McAfee.  Most
seems to be working fine, with the exception of virus removal.  MailScanner
calls McAfee and sees the virus, but then happily sends the message on, virus
and all, no warning to the recipient, etc.  Did I miss something in the .conf
file?

Here is a snippet of syslog:
Jul  8 22:32:50 xxx MailScanner[22175]: New Batch: Scanning 1 messages, 113172 bytes
Jul  8 22:32:51 xxx MailScanner[22175]: Virus and Content Scanning: Starting
Jul  8 22:32:52 xxx MailScanner[22175]: McAfee said "/xxx/incoming/22175/h692WlJP022178/your_details.zi"
Jul  8 22:32:52 xxx MailScanner[22175]: McAfee said "        Found the W32/Sobig.e@MM virus !!!"
Jul  8 22:32:52 xxx MailScanner[22175]: /xxx/22175/h692WlJP022178/your_details.zi        Found the W32/Sobig.e@MM virus !!!
Jul  8 22:32:52 xxx MailScanner[22175]: Virus Scanning: McAfee found 1 infections
Jul  8 22:32:52 xxx MailScanner[22175]: Virus Scanning: Found 1 viruses
Jul  8 22:32:52 xxx MailScanner[22175]: Uninfected: Delivered 1 messages

Thanks for any pointers.
- Paul
--
Paul Linton      Systems Programmer       paul@cs.uky.edu
UofK Department of Computer Science       (859) 257-3962

From esandquist at IHMS.NET  Wed Jul  9 05:00:30 2003
From: esandquist at IHMS.NET (Eric Sandquist)
Date: Thu Jan 12 21:18:53 2006
Subject: Service in Tarbal??
In-Reply-To: <1057705560.23990.28.camel@bach.kevinspicer.co.uk>
Message-ID: <LAEOJCOHMABIMDAGOHNGAEOOJJAB.esandquist@ihms.net>

Any idea what the effect will be of installing the RPM over the top of the
tarbal?

It is currently residing at /opt/MailScanner...

I have the latest and greatest RPM and would love to ruin, I mean run it...
:)

Eric


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Kevin Spicer
Sent: Tuesday, July 08, 2003 6:06 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Service in Tarbal??


>On Tue, 2003-07-08 at 23:38, Eric Sandquist wrote:

>I have an installation of MailScanner on a Mandrake 8.2 server.  I have
>installed from a tarbal and not the rpm.

I also use MailScanner on Mandrake - you might like to know (for the
future) that the rpm install works just fine, but you have to run it
with the nodeps flag  (i.e. ./install.sh nodeps ).  All the dependencies
are part of the default perl install anyway or installed by the
MailScanner install script.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From raymond at PROLOCATION.NET  Wed Jul  9 07:38:59 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:53 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <20030709023925.GA12072@bud.cs.uky.edu>
Message-ID: <Pine.LNX.4.44.0307090837330.21469-100000@mailbox.prolocation.net>

Hi!

> seems to be working fine, with the exception of virus removal.  MailScanner
> calls McAfee and sees the virus, but then happily sends the message on, virus
> and all, no warning to the recipient, etc.  Did I miss something in the .conf
> file?
>
> Here is a snippet of syslog:
> Jul  8 22:32:50 xxx MailScanner[22175]: New Batch: Scanning 1 messages, 113172 bytes
> Jul  8 22:32:51 xxx MailScanner[22175]: Virus and Content Scanning: Starting
> Jul  8 22:32:52 xxx MailScanner[22175]: McAfee said "/xxx/incoming/22175/h692WlJP022178/your_details.zi"
> Jul  8 22:32:52 xxx MailScanner[22175]: McAfee said "        Found the W32/Sobig.e@MM virus !!!"
> Jul  8 22:32:52 xxx MailScanner[22175]: /xxx/22175/h692WlJP022178/your_details.zi        Found the W32/Sobig.e@MM virus !!!
> Jul  8 22:32:52 xxx MailScanner[22175]: Virus Scanning: McAfee found 1 infections

It might be interesting to see your virus settings.

Deliver Disinfected Files = ?
Silent Viruses =  ?
Still Deliver Silent Viruses = ?

ect ect.

Bye,
Raymond.

From Kevin.Spicer at BMRB.CO.UK  Wed Jul  9 08:37:21 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:53 2006
Subject: How to disable a mail to a user before scanning
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF700@pascal.priv.bmrb.co.uk>

S Mohan wrote:
> I thought this happens at delivery and not receipt end - virtusertable
> lookup. Am I wrong? If so, the mail will be scanned and then the local
> delivery agent would bounce it.

I handle cases like these by adding them to the access database...

To:user@domain.com      REJECT


They never get as far as MailScanner then.  



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From mailscanner at BARENDSE.TO  Wed Jul  9 09:13:51 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:53 2006
Subject: DSN: Return receipt ??
In-Reply-To: <20030702153804.GA15524@internetx.de>
Message-ID: <Pine.LNX.4.44.0307091004070.11574-100000@raveon.barendse.to>

I have something which I can't quite figure out:
I use the following to kill all the read/not read messages with sendmail 
through the following lines in sendmail.mc:

LOCAL_RULESETS
F{SSJunk} /etc/mail/ssjunk.txt
F{DiscardSubs} /etc/mail/discardsubs.txt

HSubject: $>Check_Subject

SCheck_Subject
R$* $={SSJunk} $*       $#error $: NMJUNKSUB
R$* NMJUNKSUB $*        $#error $: "553 Rejected"
R$* $={DiscardSubs} $*  $#discard


This is what's in discardsubs.txt
read:
not.read:
gelezen:
niet.gelezen:
le?do:
no.le?do:


Still some read/not read messages are getting through. When I look at the 
copies in normal view in pine the subject line is this:
Subject: Read: FW: Entrega de

which should comply with the sendmail rule to get discarded (but isn't).

I suspect this maybe because of M$ Exchange doing something funny with the 
read receipt messages (they are generated by Exchange, not Outlook 
according to the signature of the message). When doing full header view 
the subject looks like this:
Subject: =?iso-8859-1?Q?Read=3A_FW=3A_Entrega_de

If the funny subject is indeed the problem is there any way to filter 
these weird messages out too??

The option in the message below (goaway) doesn't do anything in my case, I 
think sendmail will refuse to send out DSN messages but all the users are 
connected to an Exchange server and the behaviour of Exchange is not 
affected by this option (apparently the mails themselves aren't cleaned of 
any DSN parts either).

Any help greatly appreciated!

Remco



On Wed, 2 Jul 2003, Sebastian Wiesinger wrote:

> * Remco Barendse <mailscanner@BARENDSE.TO> [2003-07-02 16:15]:
> > In the maillog I noticed a remark about a DSN: Return receipt.
> >
> > What does the line from maillog mean? Any return receipt did not appear in
> > the mailbox for archived outgoing mail.
> 
> If a user adds a "Return-Receipt-To: <mail@address>" header to his/her
> mail, sendmail will deliver an receipt upon successful delivery of the
> mail. You can deactivate this feature with the following option in
> your sendmail.mc:
> 
> define(`confPRIVACY_FLAGS', `noreceipts')dnl
> 
> >From the sendmail operation guide:
> #v+
> public         Allow open access
> needmailhelo   Insist on HELO or EHLO command before MAIL
> needexpnhelo   Insist on HELO or EHLO command before EXPN
> noexpn         Disallow EXPN entirely, implies noverb.
> needvrfyhelo   Insist on HELO or EHLO command before VRFY
> novrfy         Disallow VRFY entirely
> noetrn         Disallow ETRN entirely
> noverb         Disallow VERB entirely
> restrictmailq  Restrict mailq command
> restrictqrun   Restrict -q command line flag
> restrictexpand Restrict -bv and -v command line flags
> noreceipts     Don't return success DSNs20
> nobodyreturn   Don't return the body of a message with DSNs
> goaway         Disallow essentially all SMTP status queries
> authwarnings   Put X-Authentication-Warning: headers in messages
>                and log warnings
> #v-
> 
> I prefer the following line:
> 
> define(`confPRIVACY_FLAGS', `goaway,noreceipts,restrictqrun,restrictexpand')dnl
> 
> > I use sendmail rules to discard read receipt messages but in this case
> > there is nothing in the maillog that this message or reply was discarded.
> 
> I don't know what rules you use for discarding, but the configuration
> option above is the right way to deactivate the DSN2.x.x messages.
> 
> For more info about the privacy options, see the sendmail installation
> and operation guide (op/op.txt.gz).
> 
> --
> InterNetX GmbH
> Sebastian Wiesinger
> System Administration
> 
> eMail: sw@internetx.de
> 


From P.G.M.Peters at utwente.nl  Wed Jul  9 09:18:37 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:53 2006
Subject: F-prot auto updates ...
In-Reply-To: <Pine.LNX.4.44.0307082022240.6947-100000@mailbox.prolocation.net>
References: <OF03A73096.39F23B07-ON85256D5D.0064A16E-85256D5D.0064E035@udcomm.net>
            <Pine.LNX.4.44.0307082022240.6947-100000@mailbox.prolocation.net>
Message-ID: <7ijngvslb1f6h7m80bvun904v3dqsso1cf@4ax.com>

On Tue, 8 Jul 2003 20:23:37 +0200, you wrote:

>> Yes its slow from here too (Mansfield, Ohio)
>
>> Other people experiencing the same ?
>
>Ok, thanks. Then i know its not just me :)
>
>Other people might want to disable the auto update script also, since
>during the update mail will crop up and a update took 40 minutes here when
>i let it complete. Gives a nice backlog on processing :)

I only noticed a backlog yesterday 20:00 (GMT +2).

Checking my log I can't see anything strange at that time. I do see an
entry "Jul  7 19:02:13 netlx014 F-Prot autoupdate[7265]: F-Prot
successfully updated." So it took just over 2 minutes to update my
systems.

Going back in my logs I noticed it normally takes 10 to 15 seconds to
update F-Prot. But I don't think 2 minutes is that much of a problem
when I update F-Prot.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From Declan.Grady at NUVOTEM.COM  Wed Jul  9 10:33:51 2003
From: Declan.Grady at NUVOTEM.COM (Declan Grady)
Date: Thu Jan 12 21:18:53 2006
Subject: [OT] Bounced rejection notices
Message-ID: <1057743230.1192.10.camel@declan>

Hi,
Most, if not all, of the "UCE Rejected" notices that mailscanner sends
out in response to incoming spam mails are bounced, as undeliverable.

Is there an easy way around this, or is it generally safe to delete the
spam (or even high-scoring spam) instead of rejecting it ?

My only concern is that if I dont reject it to the sender, then ther is
a chance that a false-positive will fall into a blackhole.

My mail volume is quite small, so its more of an annoyance than a
problem really.

Any suggestions ?

Thanks,
Declan

From AndreaC at GOTECH.IT  Wed Jul  9 11:08:53 2003
From: AndreaC at GOTECH.IT (Andrea Cogliati)
Date: Thu Jan 12 21:18:53 2006
Subject: MS Performance
Message-ID: <463F0AFA3E2CEA4E807EC569C019E739140BBD@atlantis.gtub.corp>

Guys,

we did several stress tests on our MS gateway and these are the results.

System description:

Single Intel Pentium 4 1.8 GHz
128 MB RAM
40 GB single IDE disk
MS 4.22-5
SpamAssassin 2.55
AV: McAfee and ClamAV

With this system we are able to process about 100 messages/minute.

We had to lower the number of MS children processes to 3, as with the
default
of 5 we got a lot of swapping (each MS process uses about 20MB of
memory) and
performance severely degraded. Increasing the number of messages per
process
to 75 also improved the overall performance a little bit.

Does this make any sense? Can I improve the performances tuning the
system
configuration?

TIA,

Andrea


From maxsec at TOTALISE.CO.UK  Wed Jul  9 11:28:17 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:18:53 2006
Subject: MS Performance
In-Reply-To: <463F0AFA3E2CEA4E807EC569C019E739140BBD@atlantis.gtub.corp>
References: <463F0AFA3E2CEA4E807EC569C019E739140BBD@atlantis.gtub.corp>
Message-ID: <3F0BEE41.3010301@totalise.co.uk>

Andrea

RAM, add more RAM. 128MB is kinda low, esp a you can get 512MB ram for <
50 UK pounds (~75 Euro I guess)

--
Martin


Andrea Cogliati wrote:

> Guys,
>
> we did several stress tests on our MS gateway and these are the results.
>
> System description:
>
> Single Intel Pentium 4 1.8 GHz
> 128 MB RAM
> 40 GB single IDE disk
> MS 4.22-5
> SpamAssassin 2.55
> AV: McAfee and ClamAV
>
> With this system we are able to process about 100 messages/minute.
>
> We had to lower the number of MS children processes to 3, as with the
> default
> of 5 we got a lot of swapping (each MS process uses about 20MB of
> memory) and
> performance severely degraded. Increasing the number of messages per
> process
> to 75 also improved the overall performance a little bit.
>
> Does this make any sense? Can I improve the performances tuning the
> system
> configuration?
>
> TIA,
>
> Andrea

From raymond at PROLOCATION.NET  Wed Jul  9 12:38:19 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:53 2006
Subject: F-prot auto updates ...
In-Reply-To: <7ijngvslb1f6h7m80bvun904v3dqsso1cf@4ax.com>
Message-ID: <Pine.LNX.4.44.0307091337100.13358-100000@mailbox.prolocation.net>

Hi!

> >Ok, thanks. Then i know its not just me :)

> I only noticed a backlog yesterday 20:00 (GMT +2).
>
> Checking my log I can't see anything strange at that time. I do see an
> entry "Jul  7 19:02:13 netlx014 F-Prot autoupdate[7265]: F-Prot
> successfully updated." So it took just over 2 minutes to update my
> systems.
>
> Going back in my logs I noticed it normally takes 10 to 15 seconds to
> update F-Prot. But I don't think 2 minutes is that much of a problem
> when I update F-Prot.

A little later this was fixed. Most likely due to network or system
problems @f-prot. It was also depending on what machine in their load
balanced cluster you were ending. So i guess one or two boxes that would
not do the right things :)

All seems fixed now indeed btw.

Bye,
Raymond.

From mbowman at UDCOM.COM  Wed Jul  9 13:17:36 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:53 2006
Subject: score=0/spamc errors -- continued
Message-ID: <OFDD00FB78.CC9D2267-ON85256D5E.004366E0-85256D5E.0043B903@udcomm.net>

If a domain was in the auto whitlelist, would the score be set to 0 ?  Is
there any tool that can be used to view the autowhitelist.db file to check
for domains and addresses?

Thanks

Matthew

----- Forwarded by Matthew K Bowman/udc on 07/09/2003 08:18 AM -----


Matthew Bowman <mbowman@UDCOM.COM>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
07/08/2003 05:42 PM
Please respond to MailScanner mailing list


        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: score=0/spamc errors


Hi

Redhat 7.3 running on a Dell Poweredge with Dual 1Ghz Processors and 1GB
of
Ram
sendmail 8.11.6 - fully patched

I upgraded from MailScanner 4-13.3 to 4.22.4 and all I did was update the
.conf and .rule files to what I previously had. I downloaded SA 2.55 and
compiled from source.

I am seeing e-mail getting scored with SpamAssassin but occassionally it
doesn't even check for e-mail to a domain for spam.

An example of the problem I've been looking at

An email is sent from 1zbygm6VcbmPdijo463wtpZP7mIjEe@5948.bounce.e-i1.com
to gary1@gormanrupp.com

MX 5 for gormanrupp.com points to 63.173.207.13 (smithers)

the e-mail is checked by mailscanner and via mailertable is forwarded onto
the client's Lotus mail server

In the 'document properties' under X-MailScanner-SpamCheck it says
SCORE=0,
REQUIRED=4

Naturally I am baffled by this problem. The MX 10 server which we provide
does not have MS or SA installed so I'm ruling that out.

Output from ps command

root     24497  0.0  0.3  7264 3596 ?        S    May18   4:59
/usr/bin/perl /us
r/bin/mrtg /etc/mrtg/mailscanner-mrtg.cfg
root     22189  0.0  0.2  5568 2072 ?        S    15:45   0:02 sendmail:
accepti
ng connections
root     22194  0.0  0.1  4696 1760 ?        S    15:45   0:00
/usr/sbin/sendmai
l -q15m
root     22212  0.0  0.8 10200 8780 ?        S    15:45   0:00
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22213  0.5  2.0 22524 20692 ?       S    15:45   0:40
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22232  0.6  2.0 23108 21272 ?       S    15:45   0:43
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22258  0.5  2.0 22436 20612 ?       S    15:45   0:41
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22280  0.6  2.0 22740 20900 ?       S    15:45   0:43
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     22292  0.5  2.0 23092 21236 ?       S    15:45   0:37
/usr/bin/perl -I/
usr/lib/MailScanner /usr/sbin/MailScanner /etc/MailS
root     23665  0.0  0.2  5972 2532 ?        S    15:53   0:00 sendmail:
server
[61.173.41.30] child wait
root     23928  0.0  0.2  6316 2628 ?        S    15:54   0:00 sendmail:
./h68Js
Wr23928 [61.173.41.30]: DATA
root     25368  0.0  0.2  5968 2532 ?        S    16:01   0:00 sendmail:
server
madison.punchstock.com [216.165.175.102] (may be for
root     25372  0.0  0.2  6312 2628 ?        S    16:01   0:00 sendmail:
./h68K1
qr25372 madison.punchstock.com [216.165.175.102] (ma
root       814  0.0  0.2  5968 2532 ?        S    16:52   0:00 sendmail:
server
mail10.hollywoodspecials.net [216.39.88.106] cmd rea
root      7307  0.0  0.2  5032 2196 ?        S    17:40   0:00 sendmail:
./h68Le
er07297 xwing.aoltw.net.: user open
root      7432  0.4  0.2  5968 2540 ?        S    17:41   0:00 sendmail:
server
mail.directoptions.com [216.196.234.46] child wait
root      7435  0.0  0.2  5584 2168 ?        S    17:41   0:00 sendmail:
startup
 with bay0-smtp07.bay0.hotmail.com
root      7438  2.0  0.2  6312 2628 ?        S    17:41   0:00 sendmail:
./h68Lf
sr07438 mail.directoptions.com [216.196.234.46]: DAT
root      7448  0.0  0.0  1740  596 pts/2    S


Thanks for the input so far

Matthew




                    mikea
                    <mikea@MIKEA.ATH.C       To:
MAILSCANNER@JISCMAIL.AC.UK
                    X>                       cc:
                    Sent by:                 Subject:     Re:
score=0/spamc errors
                    MailScanner
                    mailing list
                    <MAILSCANNER@JISCM
                    AIL.AC.UK>


                    07/08/2003 05:17
                    PM
                    Please respond to
                    MailScanner
                    mailing list






On Tue, Jul 08, 2003 at 04:56:55PM -0400, Matthew Bowman wrote:
> Hi
>
> I have had a client call me today about a problem whereby an e-mail
> doesn't get scored..
>
> In the headers it says SCORE=0 but I cannot find any trace of this in
the
> maillog.
>
> However I do see the mail be routed as follows:
>
> Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
> from=<1zbygm6VcbmPdijo463wtpZP7mIjEe@5948.bounce.e-i1.com>, size=1568,
> class=0, nrcpts=1,
> msgid=<1zbygdxMTSdGUZafvxunkgQGyd9a5V@1zbygQk9GFQ3HMNSikhaXTD3lQwNsI>,
> proto=SMTP, daemon=MTA, relay=b7.e-i1.com [63.251.54.87]
> Jul  8 12:42:21 smithers sendmail[21543]: h68GgK621543:
> to=<garyl@gormanrupp.com>, delay=00:00:01, mailer=smtp, pri=31568,
> stat=queued
> Jul  8 12:42:22 smithers sendmail[21551]: h68GgK621543:
> to=<garyl@gormanrupp.com>, delay=00:00:02, xdelay=00:00:00, mailer=smtp,
> pri=121568, relay=grcmail1.gormanrupp.com. [63.173.204.4], dsn=2.0.0,
> stat=Sent (Message accepted for delivery)
>
> No indication of Spam Checking...
>
> Maillog has also reported this
>
> Jul  8 16:54:53 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (1/3): Connection refused
> Jul  8 16:54:54 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (2/3): Connection refused
> Jul  8 16:54:55 smithers spamc[1410]: connect() to spamd at 127.0.0.1
> failed, retrying (3/3): Connection refused
> Jul  8 16:54:56 smithers spamc[1410]: connection attempt to spamd
aborted
> after 3 retries
>
> Are these linked? or seperate issues?
>
> Problems started to happen after the upgrade to MS 4.22-4 and SA 2.55
>
> Any help would be appreciated

If you're running MailScanner, and MailScanner is running SpamAssassin
directly, then I don't understand why spamc and/or spamd would be
involved in any way at all.

Would you mind explaining just how things are installed, and who does
what, and with which, and to whom? Then we'll all have a somewhat
better understanding of what's going on.

Output from `ps awux | grep -i mail`, or its Linux equivalent, would
be useful, too.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From andersan at LTKALMAR.SE  Wed Jul  9 13:29:50 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:53 2006
Subject: Spam being converted to attachment
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE653@lkl63.ltkalmar.se>

Hi
All spams are being converted to attachment even if setting in
MailScanner.conf is
Spam Actions = striphtml deliver
High Scoring Spam Actions = striphtml deliver
Non Spam Actions = deliver

I cant figure this one out, its not a big deal now, but I think the users
will be confused
when they get back after vacation.... what can I have missed?

/Anders

From dean.plant at ROKE.CO.UK  Wed Jul  9 13:32:43 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:18:53 2006
Subject: F-prot auto updates ...
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A702366DB@rsys004a.roke.co.uk>

Raymond Dijkxhoorn wrote:
> Hi!
>
>>> Ok, thanks. Then i know its not just me :)
>
>> I only noticed a backlog yesterday 20:00 (GMT +2).
>>
>> Checking my log I can't see anything strange at that time. I do see
>> an entry "Jul  7 19:02:13 netlx014 F-Prot autoupdate[7265]: F-Prot
>> successfully updated." So it took just over 2 minutes to update my
>> systems.
>>
>> Going back in my logs I noticed it normally takes 10 to 15 seconds to
>> update F-Prot. But I don't think 2 minutes is that much of a problem
>> when I update F-Prot.
>
> A little later this was fixed. Most likely due to network or system
> problems @f-prot. It was also depending on what machine in their load
> balanced cluster you were ending. So i guess one or two boxes that
> would not do the right things :)
>
> All seems fixed now indeed btw.
>
> Bye,
> Raymond.

Should there not be an timeout built into the update process to ensure this does not happen?

Dean Plant

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

From paul at CS.UKY.EDU  Wed Jul  9 14:05:03 2003
From: paul at CS.UKY.EDU (Paul Linton)
Date: Thu Jan 12 21:18:53 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <Pine.LNX.4.44.0307090837330.21469-100000@mailbox.prolocation.net>
References: <20030709023925.GA12072@bud.cs.uky.edu>
            <Pine.LNX.4.44.0307090837330.21469-100000@mailbox.prolocation.net>
Message-ID: <20030709130503.GA20280@bud.cs.uky.edu>

On Wed, Jul 09, 2003 at 08:38:59AM +0200, Raymond Dijkxhoorn wrote:
> > seems to be working fine, with the exception of virus removal.  MailScanner
> > calls McAfee and sees the virus, but then happily sends the message on, virus
> > and all, no warning to the recipient, etc.  Did I miss something in the .conf
> It might be interesting to see your virus settings.
>
> Deliver Disinfected Files = ?
> Silent Viruses =  ?
> Still Deliver Silent Viruses = ?

Here is some of the configurations, if this helps:

% grep -v "^#" MailScanner.conf | egrep "Virus|Deliver"
Deliver Unparsable TNEF = no
Virus Scanning = yes
Virus Scanners = mcafee
Virus Scanner Timeout = 300
Deliver Disinfected Files = yes
Silent Viruses = HTML-IFrame Klez Yaha-E Bugbear Braid-A WinEvar Palyh Sobig Fizzer
Still Deliver Silent Viruses = yes
Deleted Virus Message Report        = %report-dir%/deleted.virus.message.txt
Stored Virus Message Report        = %report-dir%/stored.virus.message.txt
Sender Virus Report        = %report-dir%/sender.virus.report.txt
Deliver Cleaned Messages = yes
Virus Modify Subject = yes
Virus Subject Text = {Virus?}
Attachment Warning Filename = VirusWarning.txt
Virus Scanner Definitions = %etc-dir%/virus.scanners.conf
Deliver In Background = yes
Delivery Method = batch

Thanks for any help/pointers!

- Paul

--
Paul Linton      Systems Programmer       paul@cs.uky.edu
UofK Department of Computer Science       (859) 257-3962

From miguel.montoya at CALIDAD.TELETULUA.COM.CO  Wed Jul  9 14:12:34 2003
From: miguel.montoya at CALIDAD.TELETULUA.COM.CO (Miguel Fernando Montoya Martinez)
Date: Thu Jan 12 21:18:53 2006
Subject: unsuscribe
Message-ID: <EE5631799A5FB745BAC64BB4ED78AF1D12337D@CALIDAD.teletulua.com.co>

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030709/1b0f3ba2/attachment.html
From mike at CAMAROSS.NET  Wed Jul  9 14:23:43 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:53 2006
Subject: [OT] Bounced rejection notices
In-Reply-To: <1057743230.1192.10.camel@declan>
Message-ID: <000e01c3461d$529d6af0$9c01a8c0@home.middlefinger.net>

Depends on your score thresholds.

I mark spam at 5.8, high scoring spam is 6.9 

Spam gets the striphtml, deliver action

High Scoring Spam is deleted.

It is a rare occasion that a legit email scores a 6.9 and I've had no
complaints from my users.

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Declan Grady
Sent: Wednesday, July 09, 2003 4:34 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [OT] Bounced rejection notices


Hi,
Most, if not all, of the "UCE Rejected" notices that mailscanner sends out
in response to incoming spam mails are bounced, as undeliverable.

Is there an easy way around this, or is it generally safe to delete the spam
(or even high-scoring spam) instead of rejecting it ?

My only concern is that if I dont reject it to the sender, then ther is a
chance that a false-positive will fall into a blackhole.

My mail volume is quite small, so its more of an annoyance than a problem
really.

Any suggestions ?

Thanks,
Declan


From mike at CAMAROSS.NET  Wed Jul  9 14:37:01 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:53 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <20030709130503.GA20280@bud.cs.uky.edu>
Message-ID: <001101c3461f$2d91b480$9c01a8c0@home.middlefinger.net>

The only thing that catches my eye is that you have:

Silent Viruses =

defined twice.  I set my Silent Viruses = none in my config file because I
want to know when a virus is found.  I also have

Still Deliver Silent Viruses = yes

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Paul Linton
Sent: Wednesday, July 09, 2003 8:05 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner not removing virus even though it was found?


On Wed, Jul 09, 2003 at 08:38:59AM +0200, Raymond Dijkxhoorn wrote:
> > seems to be working fine, with the exception of virus removal.  
> > MailScanner calls McAfee and sees the virus, but then happily sends 
> > the message on, virus and all, no warning to the recipient, etc.  
> > Did I miss something in the .conf
> It might be interesting to see your virus settings.
>
> Deliver Disinfected Files = ?
> Silent Viruses =  ?
> Still Deliver Silent Viruses = ?

Here is some of the configurations, if this helps:

% grep -v "^#" MailScanner.conf | egrep "Virus|Deliver"
Deliver Unparsable TNEF = no
Virus Scanning = yes
Virus Scanners = mcafee
Virus Scanner Timeout = 300
Deliver Disinfected Files = yes
Silent Viruses = HTML-IFrame Klez Yaha-E Bugbear Braid-A WinEvar Palyh Sobig
Fizzer Still Deliver Silent Viruses = yes
Deleted Virus Message Report        = %report-dir%/deleted.virus.message.txt
Stored Virus Message Report        = %report-dir%/stored.virus.message.txt
Sender Virus Report        = %report-dir%/sender.virus.report.txt
Deliver Cleaned Messages = yes
Virus Modify Subject = yes
Virus Subject Text = {Virus?}
Attachment Warning Filename = VirusWarning.txt
Virus Scanner Definitions = %etc-dir%/virus.scanners.conf Deliver In
Background = yes Delivery Method = batch

Thanks for any help/pointers!

- Paul

--
Paul Linton      Systems Programmer       paul@cs.uky.edu
UofK Department of Computer Science       (859) 257-3962


From mike at CAMAROSS.NET  Wed Jul  9 14:43:35 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:53 2006
Subject: MS Performance
In-Reply-To: <3F0BEE41.3010301@totalise.co.uk>
Message-ID: <001201c34620$18e34070$9c01a8c0@home.middlefinger.net>

Agreed.  You might also consider moving your incoming to a tmpfs:

/bin/mount -t tmpfs tmpfs /var/spool/MailScanner/incoming

yields

tmpfs on /var/spool/MailScanner/incoming type tmpfs (rw)

Do this only after adding RAM to your system though!

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Martin Hepworth
Sent: Wednesday, July 09, 2003 5:28 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance


Andrea

RAM, add more RAM. 128MB is kinda low, esp a you can get 512MB ram for < 50
UK pounds (~75 Euro I guess)

--
Martin


Andrea Cogliati wrote:

> Guys,
>
> we did several stress tests on our MS gateway and these are the 
> results.
>
> System description:
>
> Single Intel Pentium 4 1.8 GHz
> 128 MB RAM
> 40 GB single IDE disk
> MS 4.22-5
> SpamAssassin 2.55
> AV: McAfee and ClamAV
>
> With this system we are able to process about 100 messages/minute.
>
> We had to lower the number of MS children processes to 3, as with the 
> default of 5 we got a lot of swapping (each MS process uses about 20MB 
> of
> memory) and
> performance severely degraded. Increasing the number of messages per 
> process to 75 also improved the overall performance a little bit.
>
> Does this make any sense? Can I improve the performances tuning the 
> system configuration?
>
> TIA,
>
> Andrea


From paul at CS.UKY.EDU  Wed Jul  9 14:50:47 2003
From: paul at CS.UKY.EDU (Paul Linton)
Date: Thu Jan 12 21:18:53 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <001101c3461f$2d91b480$9c01a8c0@home.middlefinger.net>
References: <20030709130503.GA20280@bud.cs.uky.edu>
            <001101c3461f$2d91b480$9c01a8c0@home.middlefinger.net>
Message-ID: <20030709135047.GA20608@bud.cs.uky.edu>

Hmmm, I doubled checked and did not find it twice.  In the off change that
this was causing a problem, I did change it to 'none':

% grep -v "^#" MailScanner.conf | grep -i virus
Virus Scanning = yes
Virus Scanners = mcafee
Virus Scanner Timeout = 300
Silent Viruses = none
Still Deliver Silent Viruses = yes
Deleted Virus Message Report        = %report-dir%/deleted.virus.message.txt
Stored Virus Message Report        = %report-dir%/stored.virus.message.txt
Sender Virus Report        = %report-dir%/sender.virus.report.txt
Virus Modify Subject = yes
Virus Subject Text = {Virus?}
Attachment Warning Filename = VirusWarning.txt
Virus Scanner Definitions = %etc-dir%/virus.scanners.conf

Same effect.

Thanks - I'll keep looking.  Doing a 'debug' one-time run didn't show
anything else.  I'm hesitant to start adding debug statements in all the
perl modules.

- Paul

On Wed, Jul 09, 2003 at 08:37:01AM -0500, Mike Kercher wrote:
> The only thing that catches my eye is that you have:
>
> Silent Viruses =
>
> defined twice.  I set my Silent Viruses = none in my config file because I
> want to know when a virus is found.  I also have
>
> Still Deliver Silent Viruses = yes
>
> Mike
>
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Paul Linton
> Sent: Wednesday, July 09, 2003 8:05 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner not removing virus even though it was found?
>
>
> On Wed, Jul 09, 2003 at 08:38:59AM +0200, Raymond Dijkxhoorn wrote:
> > > seems to be working fine, with the exception of virus removal.
> > > MailScanner calls McAfee and sees the virus, but then happily sends
> > > the message on, virus and all, no warning to the recipient, etc.
> > > Did I miss something in the .conf
> > It might be interesting to see your virus settings.
> >
> > Deliver Disinfected Files = ?
> > Silent Viruses =  ?
> > Still Deliver Silent Viruses = ?
>
> Here is some of the configurations, if this helps:
>
> % grep -v "^#" MailScanner.conf | egrep "Virus|Deliver"
> Deliver Unparsable TNEF = no
> Virus Scanning = yes
> Virus Scanners = mcafee
> Virus Scanner Timeout = 300
> Deliver Disinfected Files = yes
> Silent Viruses = HTML-IFrame Klez Yaha-E Bugbear Braid-A WinEvar Palyh Sobig
> Fizzer Still Deliver Silent Viruses = yes
> Deleted Virus Message Report        = %report-dir%/deleted.virus.message.txt
> Stored Virus Message Report        = %report-dir%/stored.virus.message.txt
> Sender Virus Report        = %report-dir%/sender.virus.report.txt
> Deliver Cleaned Messages = yes
> Virus Modify Subject = yes
> Virus Subject Text = {Virus?}
> Attachment Warning Filename = VirusWarning.txt
> Virus Scanner Definitions = %etc-dir%/virus.scanners.conf Deliver In
> Background = yes Delivery Method = batch
>
> Thanks for any help/pointers!
>
> - Paul
>
> --
> Paul Linton      Systems Programmer       paul@cs.uky.edu
> UofK Department of Computer Science       (859) 257-3962

--
Paul Linton      Systems Programmer       paul@cs.uky.edu
UofK Department of Computer Science       (859) 257-3962

From dene at DATATECHIE.COM  Wed Jul  9 14:54:30 2003
From: dene at DATATECHIE.COM (Dene Ulmschneider)
Date: Thu Jan 12 21:18:53 2006
Subject: User specific "Spam Actions"
Message-ID: <5.1.0.14.2.20030709094950.00bc1b68@192.168.1.112>

Hello all-

I am running RHL 7.3 and MS version 4.14-9 and Sendmail.

I am trying to setup user specific "Spam Actions" and could use a little
help. I know that the spam action setting can point to a file with rule
sets in it but I am not clear on the format of the file.

Can anyone help me out with the format of the file? If a user wants to
delete spam and high spam - what should the file look like?

Does anyone have a sample file that they can forward to give me a better
idea on how to set this up??


Thank You

Dene Ulmschneider
Data Techie Inc.
-------------------------------------------------------------------------
office:         718.738.8859
cell:           646.996.2976
email:          dene@datatechie.com
pager mail:     denenow@datatechie.com
website:        www.datatechie.com
-------------------------------------------------------------------------
"Data Techie - Always there to protect you!"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030709/9edc1412/attachment.html
From mbowman at UDCOM.COM  Wed Jul  9 14:54:43 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:18:53 2006
Subject: User specific "Spam Actions"
Message-ID: <OF5A7D4DD4.85D7EF3C-ON85256D5E.004C4342-85256D5E.004C9D25@udcomm.net>

Example spam.actions.conf

To:     postmaster@abc.com striphtml forward abc@abc.com
To:     *@abc.com         delete
From:   *@boss.com              delete
From:   *@china.com             delete
From:   *@computingworld.com    delete
From:   *@crucialoffers.com     delete
From:   *@dataillusions.com     delete
From:   *@deal-seeker.com       delete

Although I am wonderng if the  * is necessary ?

Matthew





Dene Ulmschneider <dene@DATATECHIE.COM>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
07/09/2003 09:54 AM
Please respond to MailScanner mailing list


        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        User specific "Spam Actions"


Hello all-

I am running RHL 7.3 and MS version 4.14-9 and Sendmail.

I am trying to setup user specific "Spam Actions" and could use a little
help. I know that the spam action setting can point to a file with rule
sets in it but I am not clear on the format of the file.

Can anyone help me out with the format of the file? If a user wants to
delete spam and high spam - what should the file look like?

Does anyone have a sample file that they can forward to give me a better
idea on how to set this up??

Thank You

Dene Ulmschneider
Data Techie Inc.
-------------------------------------------------------------------------
office:         718.738.8859
cell:           646.996.2976
email:          dene@datatechie.com
pager mail:     denenow@datatechie.com
website:        www.datatechie.com
-------------------------------------------------------------------------
"Data Techie - Always there to protect you!"

From P.G.M.Peters at utwente.nl  Wed Jul  9 15:09:11 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:53 2006
Subject: [OT] Bounced rejection notices
In-Reply-To: <000e01c3461d$529d6af0$9c01a8c0@home.middlefinger.net>
References: <1057743230.1192.10.camel@declan>
            <000e01c3461d$529d6af0$9c01a8c0@home.middlefinger.net>
Message-ID: <2f8ogvs8s8ine9gmte82ib13mk48l0cson@4ax.com>

On Wed, 9 Jul 2003 08:23:43 -0500, you wrote:

>Depends on your score thresholds.
>
>I mark spam at 5.8, high scoring spam is 6.9
>
>Spam gets the striphtml, deliver action
>
>High Scoring Spam is deleted.
>
>It is a rare occasion that a legit email scores a 6.9 and I've had no
>complaints from my users.

I get complaints about spam with the original spam included. And
ofcourse that message is also claimed as beeing spam.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From P.G.M.Peters at utwente.nl  Wed Jul  9 15:07:54 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:53 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <001101c3461f$2d91b480$9c01a8c0@home.middlefinger.net>
References: <20030709130503.GA20280@bud.cs.uky.edu>
            <001101c3461f$2d91b480$9c01a8c0@home.middlefinger.net>
Message-ID: <j78ogvg2anh41ivmsip0d7ffh8sqrsc1pd@4ax.com>

On Wed, 9 Jul 2003 08:37:01 -0500, you wrote:

>The only thing that catches my eye is that you have:
>
>Silent Viruses =
>
>defined twice.  I set my Silent Viruses = none in my config file because I
>want to know when a virus is found.  I also have

I didn't see that line twice.

>Still Deliver Silent Viruses = yes

If you define silent viruses and still deliver them, you will be
notified. But if your don't define silent viruses the (forged) sender
gets the message he sent a virus (which isn't true).

>-----Original Message-----
>Here is some of the configurations, if this helps:
>
>% grep -v "^#" MailScanner.conf | egrep "Virus|Deliver"
>Deliver Unparsable TNEF = no
>Virus Scanning = yes
>Virus Scanners = mcafee
>Virus Scanner Timeout = 300
>Deliver Disinfected Files = yes
>Silent Viruses = HTML-IFrame Klez Yaha-E Bugbear Braid-A WinEvar Palyh Sobig
>Fizzer Still Deliver Silent Viruses = yes

??? something went wrong with your reply?

>Deleted Virus Message Report        = %report-dir%/deleted.virus.message.txt
>Stored Virus Message Report        = %report-dir%/stored.virus.message.txt
>Sender Virus Report        = %report-dir%/sender.virus.report.txt
>Deliver Cleaned Messages = yes
>Virus Modify Subject = yes
>Virus Subject Text = {Virus?}
>Attachment Warning Filename = VirusWarning.txt
>Virus Scanner Definitions = %etc-dir%/virus.scanners.conf Deliver In
>Background = yes Delivery Method = batch

Perhaps your mailclient played tricks on you.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From steve.freegard at LBSLTD.CO.UK  Wed Jul  9 15:24:31 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:18:53 2006
Subject: MS Performance
Message-ID: <67D9E7698329D411936E00508B6590B902773A10@neelix.lbsltd.co.uk>

Mike,

Quick question I've been meaning to ask on the list for a while:

What's a reasonable amount of memory to have on a MailScanner box to take
advantage of tmpfs??, and how much of a difference does it make?? - I've got
two Proliant DL360's, one with 512Mb RAM and the other with 1Gb RAM both
just running MailScanner, Sophos, Clam and MailWatch on RedHat 9.

Obviously 1Gb's probably enough, but what about the machine with 512Mb?? -
what happens if I end up with a queue full of largeish mails - will it just
swap like crazy and is there any chance of loosing mail by doing this if the
server runs out of memory??

Kind regards,
Steve

--
Steve Freegard
Systems Manager
Littlehampton Book Services Ltd.


-----Original Message-----
From: Mike Kercher [mailto:mike@CAMAROSS.NET]
Sent: 09 July 2003 14:44
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance


Agreed.  You might also consider moving your incoming to a tmpfs:

/bin/mount -t tmpfs tmpfs /var/spool/MailScanner/incoming

yields

tmpfs on /var/spool/MailScanner/incoming type tmpfs (rw)

Do this only after adding RAM to your system though!

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Martin Hepworth
Sent: Wednesday, July 09, 2003 5:28 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance


Andrea

RAM, add more RAM. 128MB is kinda low, esp a you can get 512MB ram for < 50
UK pounds (~75 Euro I guess)

--
Martin


Andrea Cogliati wrote:

> Guys,
>
> we did several stress tests on our MS gateway and these are the
> results.
>
> System description:
>
> Single Intel Pentium 4 1.8 GHz
> 128 MB RAM
> 40 GB single IDE disk
> MS 4.22-5
> SpamAssassin 2.55
> AV: McAfee and ClamAV
>
> With this system we are able to process about 100 messages/minute.
>
> We had to lower the number of MS children processes to 3, as with the
> default of 5 we got a lot of swapping (each MS process uses about 20MB
> of
> memory) and
> performance severely degraded. Increasing the number of messages per
> process to 75 also improved the overall performance a little bit.
>
> Does this make any sense? Can I improve the performances tuning the
> system configuration?
>
> TIA,
>
> Andrea

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From raymond at PROLOCATION.NET  Wed Jul  9 15:32:31 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:53 2006
Subject: MS Performance
In-Reply-To: <67D9E7698329D411936E00508B6590B902773A10@neelix.lbsltd.co.uk>
Message-ID: <Pine.LNX.4.44.0307091631400.9922-100000@mailbox.prolocation.net>

Hi!

> Obviously 1Gb's probably enough, but what about the machine with 512Mb?? -
> what happens if I end up with a queue full of largeish mails - will it just
> swap like crazy and is there any chance of loosing mail by doing this if the
> server runs out of memory??

Thats depending on your mail load. I have boxes with 2 gig ram using most
of it for MailScanner ... RAM is cheap anyway so the more the better.

Bye,
Raymond.

From AndreaC at GOTECH.IT  Wed Jul  9 15:56:12 2003
From: AndreaC at GOTECH.IT (Andrea Cogliati)
Date: Thu Jan 12 21:18:53 2006
Subject: MS Performance
Message-ID: <463F0AFA3E2CEA4E807EC569C019E739140BBE@atlantis.gtub.corp>

Mike Kercher wrote:

> Agreed.  You might also consider moving your incoming to a tmpfs:
>
> /bin/mount -t tmpfs tmpfs /var/spool/MailScanner/incoming

[...]

>-----Original Message-----
>From: [...] Martin Hepworth

[...]

> RAM, add more RAM. 128MB is kinda low, esp a you can get 512MB ram for
< 50 UK
> pounds (~75 Euro I guess)

>Andrea Cogliati wrote:

>> Guys,
>>
>> we did several stress tests on our MS gateway and these are the
>> results.
>>
>> System description:
>>
>> Single Intel Pentium 4 1.8 GHz
>> 128 MB RAM
>> 40 GB single IDE disk
>> MS 4.22-5
>> SpamAssassin 2.55
>> AV: McAfee and ClamAV
>>
>> With this system we are able to process about 100 messages/minute.
>>
>> We had to lower the number of MS children processes to 3, as with the
>> default of 5 we got a lot of swapping (each MS process uses about
20MB 
>> of
>> memory) and
>> performance severely degraded. Increasing the number of messages per 
>> process to 75 also improved the overall performance a little bit.
>>
>> Does this make any sense? Can I improve the performances tuning the
>> system configuration?
>>
>> TIA,
>>
>> Andrea

Mike and Martin,

Tried that but it doesn't seem to help. I've put another 128 MB of RAM
to a total
of 256MB. With or without tmpfs I can get a maximum of 1.72 scanned
messages
per second (103 msg/min). It seems to be a limit of the CPU and not of
the RAM.
Could someone confirm or confute this?

Andrea


From dene at DATATECHIE.COM  Wed Jul  9 15:57:00 2003
From: dene at DATATECHIE.COM (Dene Ulmschneider)
Date: Thu Jan 12 21:18:53 2006
Subject: User specific "Spam Actions"
In-Reply-To: <OF5A7D4DD4.85D7EF3C-ON85256D5E.004C4342-85256D5E.004C9D25@
              udcomm.net>
Message-ID: <5.1.0.14.2.20030709105201.00bc1c90@192.168.1.112>

OK - let's say that there are 2 users called joe@domain.com and
jane@domain.com.

What if Joe wants to delete mail form abccorp.com and jane wants to accept
it? Is that possible and if so - how could that be accomplished?

Also, my original questions was more towards setting that spam action rule
for the "SPAM" and "HIGH SPAM" which is determined by the spam count. In
the MailScanner.conf file - there are settings for spam and high spam and
what should be done with them (but it is a site wide setting).

Is it possible for Joe to deliver spam and delete high spam while jane can
delete all emails that are scored and spam and high spam (probable spam and
definite spam)?

>Thank You
>
>Dene Ulmschneider
>Data Techie Inc.
>-------------------------------------------------------------------------
>office:         718.738.8859
>cell:           646.996.2976
>email:          dene@datatechie.com
>pager mail:     denenow@datatechie.com
>website:        www.datatechie.com
>-------------------------------------------------------------------------
>"Data Techie - Always there to protect you!"


At 09:54 AM 7/9/2003 -0400, you wrote:
>Example spam.actions.conf
>
>To:     postmaster@abc.com striphtml forward abc@abc.com
>To:     *@abc.com         delete
>From:   *@boss.com              delete
>From:   *@china.com             delete
>From:   *@computingworld.com    delete
>From:   *@crucialoffers.com     delete
>From:   *@dataillusions.com     delete
>From:   *@deal-seeker.com       delete
>
>Although I am wonderng if the  * is necessary ?
>
>Matthew
>
>
>
>
>
>Dene Ulmschneider <dene@DATATECHIE.COM>
>Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>07/09/2003 09:54 AM
>Please respond to MailScanner mailing list
>
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        User specific "Spam Actions"
>
>
>Hello all-
>
>I am running RHL 7.3 and MS version 4.14-9 and Sendmail.
>
>I am trying to setup user specific "Spam Actions" and could use a little
>help. I know that the spam action setting can point to a file with rule
>sets in it but I am not clear on the format of the file.
>
>Can anyone help me out with the format of the file? If a user wants to
>delete spam and high spam - what should the file look like?
>
>Does anyone have a sample file that they can forward to give me a better
>idea on how to set this up??
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030709/d6ab7a7a/attachment.html
From dean.plant at ROKE.CO.UK  Wed Jul  9 16:11:26 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:18:53 2006
Subject: MS Performance
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A702366DE@rsys004a.roke.co.uk>

Andrea Cogliati wrote:
> Mike Kercher wrote:
>
>> Agreed.  You might also consider moving your incoming to a tmpfs:
>>
>> /bin/mount -t tmpfs tmpfs /var/spool/MailScanner/incoming
>
> [...]
>
>> -----Original Message-----
>> From: [...] Martin Hepworth
>
> [...]
>
>> RAM, add more RAM. 128MB is kinda low, esp a you can get 512MB ram
>> for < 50 UK pounds (~75 Euro I guess)
>
>> Andrea Cogliati wrote:
>
>>> Guys,
>>>
>>> we did several stress tests on our MS gateway and these are the
>>> results.
>>>
>>> System description:
>>>
>>> Single Intel Pentium 4 1.8 GHz
>>> 128 MB RAM
>>> 40 GB single IDE disk
>>> MS 4.22-5
>>> SpamAssassin 2.55
>>> AV: McAfee and ClamAV
>>>
>>> With this system we are able to process about 100 messages/minute.
>>>
>>> We had to lower the number of MS children processes to 3, as with
>>> the default of 5 we got a lot of swapping (each MS process uses
>>> about 20MB of memory) and
>>> performance severely degraded. Increasing the number of messages per
>>> process to 75 also improved the overall performance a little bit.
>>>
>>> Does this make any sense? Can I improve the performances tuning the
>>> system configuration?
>>>
>>> TIA,
>>>
>>> Andrea
>
> Mike and Martin,
>
> Tried that but it doesn't seem to help. I've put another 128 MB of RAM
> to a total
> of 256MB. With or without tmpfs I can get a maximum of 1.72 scanned
> messages
> per second (103 msg/min). It seems to be a limit of the CPU and not of
> the RAM.
> Could someone confirm or confute this?
>
> Andrea

Im running a Pentium 3 700Mhz + 256MB ram on RH 8.0 sendmail/f-prot with
spamassassin 2.55, dcc and razor on a ext3 filesystem. Mailscanner processed
13.1K messages in 1 day. And a significant amount of that was during working
hours. (See pic)


--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: mail-week.png
Type: application/octet-stream
Size: 3003 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030709/20c63a8a/mail-week.obj
From richard_cipher at yahoo.com  Wed Jul  9 16:07:04 2003
From: richard_cipher at yahoo.com (Evert Ford)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <463F0AFA3E2CEA4E807EC569C019E739140BBE@atlantis.gtub.corp>
Message-ID: <NHBBIDLEJBNNEMOPKJPNOEILDBAA.richard_cipher@yahoo.com>

I sometimes have a burst of 300-400 messages on Monday Morning.  It takes
about a minute to process them, but only because of the way I have fetchmail
set to deal with latency on the server I download from.  I have more issues
with latency on the remote server than I do with problems with MailScanner.
Might this be your issue?

I have an Intel Celeron 933Mhz running Redhat Linux 7.2 with 256 Meg of RAM
with MailScanner, F-Prot, Sendmail, and SpamAssassin.  Current versions on
everything except F-prot(just haven't bothered to update).

Evert Ford
Computer Guy
Westone Laboratories

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Andrea Cogliati
Sent: Wednesday, July 09, 2003 8:56 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance


Mike Kercher wrote:

> Agreed.  You might also consider moving your incoming to a tmpfs:
>
> /bin/mount -t tmpfs tmpfs /var/spool/MailScanner/incoming

[...]

>-----Original Message-----
>From: [...] Martin Hepworth

[...]

> RAM, add more RAM. 128MB is kinda low, esp a you can get 512MB ram for
< 50 UK
> pounds (~75 Euro I guess)

>Andrea Cogliati wrote:

>> Guys,
>>
>> we did several stress tests on our MS gateway and these are the
>> results.
>>
>> System description:
>>
>> Single Intel Pentium 4 1.8 GHz
>> 128 MB RAM
>> 40 GB single IDE disk
>> MS 4.22-5
>> SpamAssassin 2.55
>> AV: McAfee and ClamAV
>>
>> With this system we are able to process about 100 messages/minute.
>>
>> We had to lower the number of MS children processes to 3, as with the
>> default of 5 we got a lot of swapping (each MS process uses about
20MB
>> of
>> memory) and
>> performance severely degraded. Increasing the number of messages per
>> process to 75 also improved the overall performance a little bit.
>>
>> Does this make any sense? Can I improve the performances tuning the
>> system configuration?
>>
>> TIA,
>>
>> Andrea

Mike and Martin,

Tried that but it doesn't seem to help. I've put another 128 MB of RAM
to a total
of 256MB. With or without tmpfs I can get a maximum of 1.72 scanned
messages
per second (103 msg/min). It seems to be a limit of the CPU and not of
the RAM.
Could someone confirm or confute this?

Andrea
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From mdlaney at morehouse.edu  Wed Jul  9 16:22:58 2003
From: mdlaney at morehouse.edu (Matt Laney)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <463F0AFA3E2CEA4E807EC569C019E739140BBE@atlantis.gtub.corp> from
              "Andrea Cogliati" at Jul 09, 2003 04:56:12 PM
Message-ID: <200307091522.LAA20603@earl.morehouse.edu>

Andrea,

> Tried that [tmpfs] but it doesn't seem to help. I've put another 128 MB
> of RAM to a total of 256MB. With or without tmpfs I can get a maximum of
> 1.72 scanned messages per second (103 msg/min). It seems to be a limit
> of the CPU and not of the RAM.
>
> Could someone confirm or confute this?


How are you measuring performance?  Is 'top' of any help in showing
whether things are processor bound or memory bound or otherwise?


I get similar performance on a dual Pentium 3 550Mhz with 1G RAM, slow
SCSI disks, no tmpfs, sophos, with spam checks on...or at least I think
I do, if the logs provide a decent measure.  Here's a fragment from mine:

Jul 5 21:38:43 ...: New Batch: Scanning 22 messages, 75339 bytes
Jul 5 21:38:43 ...: Spam Checks: Starting
Jul 5 21:38:57 ...: Virus and Content Scanning: Starting
Jul 5 21:38:58 ...: Uninfected: Delivered 22 messages

It seems that the spam scans are taking roughly forever (with all that
DNS activity, I'm not surprised) while the virus scans are moving very
quickly...if the logs are to be believed on matters of timing.


According to 'top', my load averages are kinda low, like .50 most of
the time.  MailScanner never shows up as eating more than 10% of the
accounted-for CPU time.

Smells like network lag on the RBLs to me...


-Matt


--
Matt Laney, mdlaney@morehouse.edu
Network and Unix Systems Engineer
Morehouse College --- Atlanta, GA

From tsevy at EPX.COM  Wed Jul  9 16:34:41 2003
From: tsevy at EPX.COM (Tom Sevy)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner + Procmail?
Message-ID: <006701c3462f$9d5f1f90$bc0aa8c0@epx.com>

Does anyone have MailScanner + Procmail running on the same system?

I would like, for just one single local user, to run procmail so I can sort
mail into folders.

Will this work?

Any gotchas?  I have never run procmail so I don't yet know anything about
it other than that it is there....

From ka at PACIFIC.NET  Wed Jul  9 16:25:34 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:54 2006
Subject: How to use spamassassin on a per user basis with a third party e-mail server setup?
In-Reply-To: <200307081545.KAA27336@mail.int.orbitel.com>
References: <200307081545.KAA27336@mail.int.orbitel.com>
Message-ID: <3F0C33EE.4060007@pacific.net>

We have a similar relay setup. We've just implemented
whitelist/blacklist per user rules, and per user "spam action" rules
(attachment,deliver or just deliver). We have not exposed the control to
users yet though, since improper rules will cause undesired side
effects. For example, since the mailservers are configured to allow up
to x number of recipients per message and MailScanner only looks at the
TO envelope sender, rules made by one user will affect other users. 99%
of the time it's just a spam dictionary attack that is affected by this.
Anyone know of a way around this issue?

The rules are stored in mysql for easy webifying, and a perl script
generates the rule files for MailScanner if the db is changed.
A simple db with (id, rule_owner, rule_type, rule_operation, rule_value)
works for any rule type, though some fields may be left empty for some
rule types.

See CustomConfig.pm for an example (see 'ByDomain' rules). This can be
easily modified to 'ByEmail..' rules, so that whitelist/blacklist rules
are read from (for example)
"/etc/MailScanner/spam.user/whitelist/user@domain.com" files.
In MS.conf, you specify "Is Definitely Not Spam = &ByEmailWhitelist"

Spam Action rules are handled as a normal ruleset.
Spam Action = /etc/MailScanner/rules/spam.action.rules
In spam.action.rules, you have things like this:
To:     someuser@somedomain.com deliver
To:     domain.net      attachment,deliver
To:     spamdeath@nospam.net    delete

Ken
Pacific.Net


Orbitel Webmaster wrote:

> What have you found as the easiest way to enable/disable spamassassin
> for individual e-mail addresses?  Our mailscanner server is being
> utilized in a third party e-mail server enviroment (relay) therefore
> there cannot be individual user accounts and spamassassin preference
> files.
>
> I would like the ability to either disable tagging, enable tagging,
> or enable auto spam deletion on a per e-mail address basis.  I would
> like all settings to default to off.  Additionally, all users will
> receive e-mail virus scanning.
>
> Can someone point me in the right direction -- documentation or
> otherwise?  The closest I have found is spamassassin's userpref's
> file on their website.
>
> Thanks!
>
>

From ka at PACIFIC.NET  Wed Jul  9 16:42:13 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <200307091522.LAA20603@earl.morehouse.edu>
References: <200307091522.LAA20603@earl.morehouse.edu>
Message-ID: <3F0C37D5.4090108@pacific.net>

You might try turning off the rbl checks in SA.
see /etc/mail/spamassassin/local.cf
Some rbl lookups take too long if dns is slow or connectivity is not
perfect.
Ken


Matt Laney wrote:

> Andrea,
>
>
>>Tried that [tmpfs] but it doesn't seem to help. I've put another 128 MB
>>of RAM to a total of 256MB. With or without tmpfs I can get a maximum of
>>1.72 scanned messages per second (103 msg/min). It seems to be a limit
>>of the CPU and not of the RAM.
>>
>>Could someone confirm or confute this?
>
>
>
> How are you measuring performance?  Is 'top' of any help in showing
> whether things are processor bound or memory bound or otherwise?
>
>
> I get similar performance on a dual Pentium 3 550Mhz with 1G RAM, slow
> SCSI disks, no tmpfs, sophos, with spam checks on...or at least I think
> I do, if the logs provide a decent measure.  Here's a fragment from mine:
>
> Jul 5 21:38:43 ...: New Batch: Scanning 22 messages, 75339 bytes
> Jul 5 21:38:43 ...: Spam Checks: Starting
> Jul 5 21:38:57 ...: Virus and Content Scanning: Starting
> Jul 5 21:38:58 ...: Uninfected: Delivered 22 messages
>
> It seems that the spam scans are taking roughly forever (with all that
> DNS activity, I'm not surprised) while the virus scans are moving very
> quickly...if the logs are to be believed on matters of timing.
>
>
> According to 'top', my load averages are kinda low, like .50 most of
> the time.  MailScanner never shows up as eating more than 10% of the
> accounted-for CPU time.
>
> Smells like network lag on the RBLs to me...
>
>
> -Matt
>
>
> --
> Matt Laney, mdlaney@morehouse.edu
> Network and Unix Systems Engineer
> Morehouse College --- Atlanta, GA
>
>

From Kevin.Spicer at BMRB.CO.UK  Wed Jul  9 16:42:09 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner + Procmail?
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF704@pascal.priv.bmrb.co.uk>

Tom Sevy wrote:
> Does anyone have MailScanner + Procmail running on the same system?
> 
> I would like, for just one single local user, to run procmail so I
> can sort mail into folders.
> 
> Will this work?

Yes, the processes happen in this order.

sendmail recieves incomin mail
MailScanner processes mail
sendmail called by MailScanner to deliver mail
procmail called by sendmail to handle local delivery




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From gerry at dorfam.ca  Wed Jul  9 17:01:59 2003
From: gerry at dorfam.ca (Gerry Doris)
Date: Thu Jan 12 21:18:54 2006
Subject: F-prot auto updates ...
In-Reply-To: <EA943CD30BCB104E9D38F5B5DC2D9A702366DB@rsys004a.roke.co.uk>
References: <EA943CD30BCB104E9D38F5B5DC2D9A702366DB@rsys004a.roke.co.uk>
Message-ID: <61977.129.80.22.143.1057766519.squirrel@tiger.dorfam.ca>

> Raymond Dijkxhoorn wrote:
>> Hi!
>>
>>>> Ok, thanks. Then i know its not just me :)
>>
>>> I only noticed a backlog yesterday 20:00 (GMT +2).
>>>
>>> Checking my log I can't see anything strange at that time. I do see
>>> an entry "Jul  7 19:02:13 netlx014 F-Prot autoupdate[7265]: F-Prot
>>> successfully updated." So it took just over 2 minutes to update my
>>> systems.
>>>
>>> Going back in my logs I noticed it normally takes 10 to 15 seconds to
>>> update F-Prot. But I don't think 2 minutes is that much of a problem
>>> when I update F-Prot.
>>
>> A little later this was fixed. Most likely due to network or system
>> problems @f-prot. It was also depending on what machine in their load
>> balanced cluster you were ending. So i guess one or two boxes that
>> would not do the right things :)
>>
>> All seems fixed now indeed btw.
>>
>> Bye,
>> Raymond.
>
> Should there not be an timeout built into the update process to ensure
> this does not happen?
>
> Dean Plant

I just looked at the /usr/lib/MailScanner/f-prot-autoupdate script and I
believe there is a built in timeout.  Julian is using wget to download the
f-prot files and is allowing 3 tries.  If the download isn't successful he
calls a bailout routine and exits.

If the timeout is too much then I suppose the easiest way to reduce it
would be to lower/remove the retries.

Gerry

From AndreaC at GOTECH.IT  Wed Jul  9 16:48:20 2003
From: AndreaC at GOTECH.IT (Andrea Cogliati)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
Message-ID: <463F0AFA3E2CEA4E807EC569C019E739140BBF@atlantis.gtub.corp>

Matt,

>> Tried that [tmpfs] but it doesn't seem to help. I've put another 128 
>> MB of RAM to a total of 256MB. With or without tmpfs I can get a 
>> maximum of 1.72 scanned messages per second (103 msg/min). It seems
to 
>> be a limit of the CPU and not of the RAM.
>>
>> Could someone confirm or confute this?

> How are you measuring performance?  Is 'top' of any help in showing
> whether things are processor bound or memory bound or otherwise?

I simpy stop MailScanner, put a lot of mail messages (2.000, generated
by postal)
in mqueue.in, then start MailScanner and watch when mqueue.in is empty.

'top' shows high system load (over 7) and CPU usage (roughly 75% user
and 25%
system). Memory used is always below memory available and no swap is
used.
It seems CPU bound to me.

Andrea


From raymond at PROLOCATION.NET  Wed Jul  9 18:15:23 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <EA943CD30BCB104E9D38F5B5DC2D9A702366DE@rsys004a.roke.co.uk>
Message-ID: <Pine.LNX.4.44.0307091913260.30089-100000@mailbox.prolocation.net>

Hi!

> > Tried that but it doesn't seem to help. I've put another 128 MB of RAM
> > of 256MB. With or without tmpfs I can get a maximum of 1.72 scanned
> > per second (103 msg/min). It seems to be a limit of the CPU and not of
> > Could someone confirm or confute this?

> Im running a Pentium 3 700Mhz + 256MB ram on RH 8.0 sendmail/f-prot with
> spamassassin 2.55, dcc and razor on a ext3 filesystem. Mailscanner processed
> 13.1K messages in 1 day. And a significant amount of that was during working
> hours. (See pic)

I am processing around 600.000 messages on two dual xeon machines, daily,
with peaks to 800.000-1.000.000 daily. I think MS is doing just fine :)

Most of the time its a matter of the test setup also that is limiting the
figures. Also some tweaking on the machines wont harm...

Bye,
Raymond.

From raymond at PROLOCATION.NET  Wed Jul  9 18:12:13 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <463F0AFA3E2CEA4E807EC569C019E739140BBE@atlantis.gtub.corp>
Message-ID: <Pine.LNX.4.44.0307091911380.30089-100000@mailbox.prolocation.net>

Hi!

> Tried that but it doesn't seem to help. I've put another 128 MB of RAM
> of 256MB. With or without tmpfs I can get a maximum of 1.72 scanned
> per second (103 msg/min). It seems to be a limit of the CPU and not of
> Could someone confirm or confute this?

May i ask how you test this ?
How many machines you use for sending for example ?

Bye,
Raymond.

From raymond at PROLOCATION.NET  Wed Jul  9 18:45:07 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:54 2006
Subject: F-prot auto updates ...
In-Reply-To: <61977.129.80.22.143.1057766519.squirrel@tiger.dorfam.ca>
Message-ID: <Pine.LNX.4.44.0307091944080.1103-100000@mailbox.prolocation.net>

Hi!

> > Should there not be an timeout built into the update process to ensure
> > this does not happen?

> I just looked at the /usr/lib/MailScanner/f-prot-autoupdate script and I
> believe there is a built in timeout.  Julian is using wget to download the
> f-prot files and is allowing 3 tries.  If the download isn't successful he
> calls a bailout routine and exits.
>
> If the timeout is too much then I suppose the easiest way to reduce it
> would be to lower/remove the retries.

The timout is 3 tries, but there was a 'ok' connection, it was just damn
slow :) So it took some time to complete. Like .001 kbps ...

Bye,
Raymond.

From raymond at PROLOCATION.NET  Wed Jul  9 18:55:15 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <3F0C37D5.4090108@pacific.net>
Message-ID: <Pine.LNX.4.44.0307091954470.2982-100000@mailbox.prolocation.net>

Hi!

> You might try turning off the rbl checks in SA.
> see /etc/mail/spamassassin/local.cf
> Some rbl lookups take too long if dns is slow or connectivity is not
> perfect.

Running a local caching DNS on the box itself might also help in that
case...

Bye,
Raymond.

From smohan at VSNL.COM  Thu Jul 10 02:44:50 2003
From: smohan at VSNL.COM (S Mohan)
Date: Thu Jan 12 21:18:54 2006
Subject: How to disable a mail to a user before scanning
In-Reply-To: <001901c34573$cf261180$9c01a8c0@home.middlefinger.net>
Message-ID: <MMEBKBBDEGGFLDBJHPGEEEOBCAAA.smohan@vsnl.com>

I thought this happens at delivery and not receipt end - virtusertable
lookup. Am I wrong? If so, the mail will be scanned and then the local
delivery agent would bounce it.

Mohan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Mike Kercher
Sent: Tuesday, July 08, 2003 10:40 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: How to disable a mail to a user before scanning


Why not add an entry to /etc/mail/virtusertable and /dev/null it?

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Harish Amin
Sent: Tuesday, July 08, 2003 12:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: How to disable a mail to a user before scanning


I receive about 50 messages to a unknown user on my SMTP server and I as a
postmaster receive all the messages back I tried the rules

# more spam.actions.rules
To:     webmaster@www.dpi.state.wi.us    delete


# more spam.blacklist.rules
#To:     /^$/    yes
To:     webmaster@www.dpi.state.wi.us   yes

But I still keep getting it



The original message was received at Tue, 8 Jul 2003 12:08:05 -0500 (CDT)
from doagw01.doa.state.wi.us [165.189.88.161]

   ----- The following addresses had permanent fatal errors -----
<'webmaster@www.dpi.state.wi.us>
    (reason: 553 5.3.5 system config error)

   ----- Transcript of session follows -----
553 5.3.5 www.dpi.state.wi.us. config error: mail loops back to me (MX
problem?)
554 5.3.5 Local configuration error

AM I doing something wrong here...
I am running MailScanner E-Mail Virus Scanner version 4.22-4 on SUn Solaris
running sendmail Any Help will be appreciated

From smohan at VSNL.COM  Thu Jul 10 02:48:06 2003
From: smohan at VSNL.COM (S Mohan)
Date: Thu Jan 12 21:18:54 2006
Subject: Quick AV question
In-Reply-To: <NHBBIDLEJBNNEMOPKJPNOEIIDBAA.richard_cipher@yahoo.com>
Message-ID: <MMEBKBBDEGGFLDBJHPGEKEOBCAAA.smohan@vsnl.com>

Amavis, as per standard set up, does scanning for inbound and not outbound
too. Further, it lacks the flexibility offered by the rulesets feature of MS
and spamassassin integration.

Mohan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Evert Ford
Sent: Wednesday, July 09, 2003 3:33 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Quick AV question


Yes.

Amavis is actually, at least to my understand, an e-mail scanner, that calls
an anti-virus piece of software, such as Kapersky, or F-prot, or Sophos.  It
can also be used to scan e-mails for spam.

Sounds just like MailScanner!  In Fact, it fulfills the same role as
MailScanner in the marketplace, only it is much tougher to install and setup
and have working.  MailScanner is more stable and robust.  Once I switched
from Amavis to MailScanner, I've had very few problems.

Evert
Computer Guy
Westone Laboratories.

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From raymond at PROLOCATION.NET  Wed Jul  9 18:59:01 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <463F0AFA3E2CEA4E807EC569C019E739140BBF@atlantis.gtub.corp>
Message-ID: <Pine.LNX.4.44.0307091957050.2982-100000@mailbox.prolocation.net>

Hi!

> > How are you measuring performance?  Is 'top' of any help in showing
> > whether things are processor bound or memory bound or otherwise?

> I simpy stop MailScanner, put a lot of mail messages (2.000, generated
> by postal)
> in mqueue.in, then start MailScanner and watch when mqueue.in is empty.

Thats no real test. You mostly measure disk io. A real live server has a
LOT of connections normally (tcp) and also uses your ram as a filecache.
If you just beam in those messages from multiple targets it will most
likely show up different results.

> 'top' shows high system load (over 7) and CPU usage (roughly 75% user
> system). Memory used is always below memory available and no swap is
> used. It seems CPU bound to me.

No, i dont think so, i am allmost sure its io bound, not CPU. But i might
be wrong :)

Bye,
Raymond.

From thomas_duvally at BROWN.EDU  Wed Jul  9 18:57:26 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <463F0AFA3E2CEA4E807EC569C019E739140BBF@atlantis.gtub.corp>
References: <463F0AFA3E2CEA4E807EC569C019E739140BBF@atlantis.gtub.corp>
Message-ID: <1057773445.684.29.camel@croithine>

On Wed, 2003-07-09 at 11:48, Andrea Cogliati wrote:

> I simpy stop MailScanner, put a lot of mail messages (2.000, generated
> by postal)
> in mqueue.in, then start MailScanner and watch when mqueue.in is empty.
>
> 'top' shows high system load (over 7) and CPU usage (roughly 75% user
> and 25%
> system). Memory used is always below memory available and no swap is
> used.
> It seems CPU bound to me.

I've just upgraded one of my servers from 4-10 to 4-20-3.  One of the
things I noticed is that the size in mem of MailScanner has almost
double!  Is this reasonable?

I've got most of the stuff that causes delays off (RBLS) but its slower
and doesn't clear out the queues nearly as fast.  I have a set of
scripts that tell me how many messages are sitting in each area
(incoming, mqueue.in, mqueue, and old queues). 4-10 is MUCH faster.


--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From joelc at CTCHOUSTON.COM  Wed Jul  9 19:49:23 2003
From: joelc at CTCHOUSTON.COM (Joel Colvin)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <463F0AFA3E2CEA4E807EC569C019E739140BBE@atlantis.gtub.corp>
Message-ID: <002001c3464a$d1d928e0$6400a8c0@jclaptop>

I measure performance by watching the sendmail delay field.  If you look at
the final delivery of the message, the delay field shows total time from
first receipt until delivered locally or to another server.  Consequently,
delay time shows total time to process through MS, SA and any Virus checks.
I only look at messages delivered to my own mail server and ignore outbound
mail.  I have several MS servers, some doing virus checks and some not and I
chart the Average Delay time. (See attached .bmp)

I am alerted when the average time to process goes over a threshold.  On the
system with the included chart, I get alerts when the average time exceeds
45 seconds.  From this chart, you can see that I run about 7 seconds per
message.  I size a system based on this number and the peak messages per
second that I anticipate.  My largest system peaks at about 1.5 messages per
second and has an average delay time of 9 seconds.

Watching this time, total memory and CPU performance is how I finally solved
my performance problems of two months ago.  Knowing your peak messages per
second is critical to sizing some of the batch variables in MS.

Joel

P.S. I generate this data with a heavily modified version of David While's
Mailstats.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: delay.bmp
Type: image/bmp
Size: 60478 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030709/34bbf1e2/delay.bmp
From thomas_duvally at BROWN.EDU  Wed Jul  9 20:11:24 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <002001c3464a$d1d928e0$6400a8c0@jclaptop>
References: <002001c3464a$d1d928e0$6400a8c0@jclaptop>
Message-ID: <1057777883.685.32.camel@croithine>

On Wed, 2003-07-09 at 14:49, Joel Colvin wrote:
> P.S. I generate this data with a heavily modified version of David While's
> Mailstats.

Could you send me or post a copy of that?  I'd love to get those kinda
stats for my systems!

--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From mike at CAMAROSS.NET  Wed Jul  9 19:35:58 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <20030709135047.GA20608@bud.cs.uky.edu>
Message-ID: <002d01c34648$f12a59a0$9c01a8c0@home.middlefinger.net>

I am pasting what was in the email I replied to:

Here is some of the configurations, if this helps:

Probably what happened is a line got wrapped and I misread it :)

Mike

% grep -v "^#" MailScanner.conf | egrep "Virus|Deliver"
Deliver Unparsable TNEF = no
Virus Scanning = yes
Virus Scanners = mcafee
Virus Scanner Timeout = 300
Deliver Disinfected Files = yes
Silent Viruses = HTML-IFrame Klez Yaha-E Bugbear Braid-A WinEvar Palyh Sobig
Fizzer Still Deliver 
Silent Viruses = yes
Deleted Virus Message Report        = %report-dir%/deleted.virus.message.txt
Stored Virus Message Report        = %report-dir%/stored.virus.message.txt

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Paul Linton
Sent: Wednesday, July 09, 2003 8:51 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner not removing virus even though it was found?


Hmmm, I doubled checked and did not find it twice.  In the off change that
this was causing a problem, I did change it to 'none':

% grep -v "^#" MailScanner.conf | grep -i virus
Virus Scanning = yes
Virus Scanners = mcafee
Virus Scanner Timeout = 300
Silent Viruses = none
Still Deliver Silent Viruses = yes
Deleted Virus Message Report        = %report-dir%/deleted.virus.message.txt
Stored Virus Message Report        = %report-dir%/stored.virus.message.txt
Sender Virus Report        = %report-dir%/sender.virus.report.txt
Virus Modify Subject = yes
Virus Subject Text = {Virus?}
Attachment Warning Filename = VirusWarning.txt
Virus Scanner Definitions = %etc-dir%/virus.scanners.conf

Same effect.

Thanks - I'll keep looking.  Doing a 'debug' one-time run didn't show
anything else.  I'm hesitant to start adding debug statements in all the
perl modules.

- Paul

On Wed, Jul 09, 2003 at 08:37:01AM -0500, Mike Kercher wrote:
> The only thing that catches my eye is that you have:
>
> Silent Viruses =
>
> defined twice.  I set my Silent Viruses = none in my config file 
> because I want to know when a virus is found.  I also have
>
> Still Deliver Silent Viruses = yes
>
> Mike
>
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On 
> Behalf Of Paul Linton
> Sent: Wednesday, July 09, 2003 8:05 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner not removing virus even though it was found?
>
>
> On Wed, Jul 09, 2003 at 08:38:59AM +0200, Raymond Dijkxhoorn wrote:
> > > seems to be working fine, with the exception of virus removal. 
> > > MailScanner calls McAfee and sees the virus, but then happily 
> > > sends the message on, virus and all, no warning to the recipient, 
> > > etc. Did I miss something in the .conf
> > It might be interesting to see your virus settings.
> >
> > Deliver Disinfected Files = ?
> > Silent Viruses =  ?
> > Still Deliver Silent Viruses = ?
>
> Here is some of the configurations, if this helps:
>
> % grep -v "^#" MailScanner.conf | egrep "Virus|Deliver" Deliver 
> Unparsable TNEF = no Virus Scanning = yes
> Virus Scanners = mcafee
> Virus Scanner Timeout = 300
> Deliver Disinfected Files = yes
> Silent Viruses = HTML-IFrame Klez Yaha-E Bugbear Braid-A WinEvar Palyh
Sobig
> Fizzer Still Deliver Silent Viruses = yes
> Deleted Virus Message Report        =
%report-dir%/deleted.virus.message.txt
> Stored Virus Message Report        = %report-dir%/stored.virus.message.txt
> Sender Virus Report        = %report-dir%/sender.virus.report.txt
> Deliver Cleaned Messages = yes
> Virus Modify Subject = yes
> Virus Subject Text = {Virus?}
> Attachment Warning Filename = VirusWarning.txt
> Virus Scanner Definitions = %etc-dir%/virus.scanners.conf Deliver In
> Background = yes Delivery Method = batch
>
> Thanks for any help/pointers!
>
> - Paul
>
> --
> Paul Linton      Systems Programmer       paul@cs.uky.edu
> UofK Department of Computer Science       (859) 257-3962

--
Paul Linton      Systems Programmer       paul@cs.uky.edu
UofK Department of Computer Science       (859) 257-3962


From Kevin_Miller at CI.JUNEAU.AK.US  Wed Jul  9 22:15:38 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:18:54 2006
Subject: Starting problems on SuSE 8.1
Message-ID: <08146035CA49D6119A36009027AC822A0264E4B2@CITY-EXCH-NTS>

>-----Original Message-----
>From: Roland Ehle [mailto:mailscanner@CARLO65.DE]
>Sent: Sunday, June 15, 2003 1:16 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Starting problems on SuSE 8.1
>
>
>Hi,
>
>since I migrated from SuSE 7.3 to SuSE 8.1 I have problems
>with starting
>MailScanner.
>
>I start MailScanner 4.21-9 with "rcMailScanner start" and I
>get "failed"
>on standard out, but MailScanner seems to be working fine.
>Same is, when
>MailScanner is started at boot.

Sorry for the lack of timeliness of the response - maybe someone else
answered it already or maybe it's a different problem, but I had the same
issue in 8.0.  It turns out that in the script there is a call to a return
code status utility script along the lines of:

. /etc/rc.status
rc_reset

which expand the rc.status script into the current environment, then set the
r.c to (I think) null.

As the script trundles through it's processing, in the start section, it
starts sendmail and MailScanner, then checks the return code.  Sendmail is a
program, so it returns a valid r.c. but check_MailScanner is a script, which
I think has it's own environment and it apparently doesn't know about the
parent environment.  Thus, the program starts just fine, but the return code
fails as it's not passed back to the calling script.  I modified mine as
below - you can see I just remmed out the last rc_status check:

    start)
        echo -n "Initializing Sendmail with In_Args"
        startproc    -p $srvpid /usr/sbin/sendmail $SENDMAIL_IN_ARGS
        rc_status -v
        echo -n "Initializing Sendmail with Client_Args"
        startproc -f -p $msppid /usr/sbin/sendmail $SENDMAIL_CLIENT_ARGS
        rc_status -v
        echo -n "Initializing Sendmail with Out_Args"
        startproc -f -p $srvoutpid /usr/sbin/sendmail $SENDMAIL_OUT_ARGS
        rc_status -v
        echo "Initializing MailScanner via check_MailScanner"
        startproc -f -p $mspid /usr/sbin/check_MailScanner > /dev/null
#        rc_status -v
        ;;

To insure that MailScanner is actually started it's easy enough to run ps
afterwards if in doubt.  It's never failed to start for me though.  I did
spend a few days trying to track this one down - plumb boggled me for a bit,
until I threw it out to my local Linux Users Group...

HTH...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

>

From wpc4 at DODGETHIS.ORG  Wed Jul  9 22:36:28 2003
From: wpc4 at DODGETHIS.ORG (William Curley)
Date: Thu Jan 12 21:18:54 2006
Subject: Stop/Reload MailScanner
Message-ID: <1057786588.c4210b87f1f3d@mail.cynical.us>

I am trying to figure out the process to stop MailScanner and to also reload the
configuration. Looking back through list archives I see references to an init.d
script, I do not see that in the MailScanner-4.22-5.tar.gz package. I have also
looked over the website and have not seen this. Is this available elsewhere or
have to steps to restart MailScanner since changed? Thanks

William Curley
Dodgethis Services
http://www.dodgethis.org

From raymond at PROLOCATION.NET  Wed Jul  9 22:56:22 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:54 2006
Subject: Stop/Reload MailScanner
In-Reply-To: <1057786588.c4210b87f1f3d@mail.cynical.us>
Message-ID: <Pine.LNX.4.44.0307092356010.8926-100000@mailbox.prolocation.net>

Hi!

> I am trying to figure out the process to stop MailScanner and to also reload the
> configuration. Looking back through list archives I see references to an init.d
> script, I do not see that in the MailScanner-4.22-5.tar.gz package. I have also
> looked over the website and have not seen this. Is this available elsewhere or
> have to steps to restart MailScanner since changed? Thanks

This was mentioned a few days ago also. Please look inside the RPM
distro.

Bye,
Raymond.

From Steve at swaney.com  Thu Jul 10 00:54:36 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:54 2006
Subject: Stopping all notifications to users
In-Reply-To: <08146035CA49D6119A36009027AC822A0264E4B2@CITY-EXCH-NTS>
References: <08146035CA49D6119A36009027AC822A0264E4B2@CITY-EXCH-NTS>
Message-ID: <1057794875.14648.2.camel@speedy>

Is there any easy way to stop all virus notifications to recipients but
still send the notifications to postmaster?

Thanks in advance,

Steve

Steve Swaney
Steve@Swaney.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030709/0acbec95/attachment.html
From Antony at SOFT-SOLUTIONS.CO.UK  Thu Jul 10 01:01:06 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:54 2006
Subject: Stopping all notifications to users
In-Reply-To: <1057794875.14648.2.camel@speedy>
References: <08146035CA49D6119A36009027AC822A0264E4B2@CITY-EXCH-NTS>
            <1057794875.14648.2.camel@speedy>
Message-ID: <200307100003.h6A033g23412@agate.rockstone.co.uk>

On Thursday 10 July 2003 12:54 am, Stephen Swaney wrote:

> Is there any easy way to stop all virus notifications to recipients but
> still send the notifications to postmaster?

Send Notices = yes
Notices To = Postmaster@Your.Domain.Com

Deliver Disinfected Files = no

Regards,

Antony

--

Windows: just another pane in the glass.

From danieltan at shopnsave.com.sg  Thu Jul 10 05:06:48 2003
From: danieltan at shopnsave.com.sg (Daniel Tan)
Date: Thu Jan 12 21:18:54 2006
Subject: postmaster not getting any email reports?
Message-ID: <001f01c34698$b06fdc00$3900a8c0@Daniel>

hi,
postmaster not receiving email after virus detected? previously was working
fine...
check mailscanner.conf file and send notices to sys admin is yes

Regards,
Daniel Tan
67469188 Ext.665
DID: 68430665
MIS Department
Shop N Save Pte Ltd
: danieltan@shopnsave.com.sg

[This e-mail is confidential and may also be privileged. If you are not the
intended recipient, please delete it and notify us immediately; you should
not copy or use it for any purpose, nor disclose its contents to any other
person. Thank you.]

From David.While at UCE.AC.UK  Thu Jul 10 08:34:58 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
Message-ID: <107DE25EC0216C45AEF670016024245F6EEE@exchangea.staff.uce.ac.uk>

Could you let me have a copy - I will look at incorporating into the
main version. Seems useful to me.

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------


-----Original Message-----
From: Joel Colvin [mailto:joelc@CTCHOUSTON.COM]
Sent: 09 July 2003 19:49
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance


I measure performance by watching the sendmail delay field.  If you look
at
the final delivery of the message, the delay field shows total time from
first receipt until delivered locally or to another server.
Consequently,
delay time shows total time to process through MS, SA and any Virus
checks.
I only look at messages delivered to my own mail server and ignore
outbound
mail.  I have several MS servers, some doing virus checks and some not
and I
chart the Average Delay time. (See attached .bmp)

I am alerted when the average time to process goes over a threshold.  On
the
system with the included chart, I get alerts when the average time
exceeds
45 seconds.  From this chart, you can see that I run about 7 seconds per
message.  I size a system based on this number and the peak messages per
second that I anticipate.  My largest system peaks at about 1.5 messages
per
second and has an average delay time of 9 seconds.

Watching this time, total memory and CPU performance is how I finally
solved
my performance problems of two months ago.  Knowing your peak messages
per
second is critical to sizing some of the batch variables in MS.

Joel

P.S. I generate this data with a heavily modified version of David
While's
Mailstats.


From giampiero.raschetti at POPSO.IT  Thu Jul 10 13:35:42 2003
From: giampiero.raschetti at POPSO.IT (Giampiero Raschetti)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner not removing virus even though it was found?
Message-ID: <LISTSERV%2003071013354270@JISCMAIL.AC.UK>

I'have just upgraded to the latest mailscan 4.22-5 from 4.13-x and
I'm registering exatly the same problem:

Jul 10 12:40:33 neutrino MailScanner[26052]: New Batch: Scanning 1 messages,
101382 bytes
Jul 10 12:40:34 neutrino MailScanner[26052]: Virus and Content Scanning:
Starting
Jul 10 12:40:34 neutrino MailScanner[26052]: McAfee said
"/home1/spool/MailScanner/incoming/26052/h6AAeWE00411/sirc-virus.zip/SIRC32-VIRUS.EXE"

Jul 10 12:40:34 neutrino MailScanner[26052]: McAfee said "        Found the
W32/SirCam@MM virus !!!"
Jul 10 12:40:34 neutrino MailScanner[26052]:
/home1/spool/MailScanner/incoming/26052/h6AAeWE00411/sirc-virus.zip/SIRC32-VIRUS.EXE
       Found the W32/SirCam@MM virus !!!
Jul 10 12:40:34 neutrino MailScanner[26052]: Virus Scanning: McAfee found 1
infections
Jul 10 12:40:34 neutrino MailScanner[26052]: Virus Scanning: Found 1 viruses
Jul 10 12:40:34 neutrino MailScanner[26052]: Uninfected: Delivered 1 messages

In the configuration file there is absolutely no changes from the default
parameters.
MailScan 4.22-5 has been installed from RPM pakage and it is working using
McAfee antivirus.
Every other functionality works fine.

Need to investigate more deeply on this quest.

GR

From TGFurnish at HERFF-JONES.COM  Thu Jul 10 14:48:08 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner 101, take two.
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C070D@inex1.herffjones.hj-int>

>-----Original Message-----
>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>Sent: Thursday, July 03, 2003 5:38 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner 101, take two.
>
>
>Do it separately. And don't use the RPM of SpamAssassin.
>Either download it
>and build from source or use CPAN to install it. To build it by hand,
>unpack the .tar.gz archive, "cd" into it and do this:
>         perl Makefile.PL
>         make
>         make test
>         make install

Note though that 'make test' for spamassassin will fail if the system's
network ports are sufficiently locked down by iptables/ipchains.  It hangs
for a long time.  If that happens to you, try turning off ipchains/iptables
while you run make test, then turn it on again when you're done.


>Yes. Just set "Virus Scanners = f-prot" or whatever is
>appropriate for your
>scanner, in /etc/MailScanner/MailScanner.conf.

And if, like me, your first thought upon seeing that was "well how do I know
it's 'f-prot' instead of 'F-Prot' or 'fprot'", then it's worth noting that
the list of virus scanners is in the virus.scanners.conf file (which for me
is in /etc/MailScanner).

HTH,
Trever

From David.While at UCE.AC.UK  Thu Jul 10 15:23:57 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance --> mailstats
Message-ID: <107DE25EC0216C45AEF670016024245F6EEF@exchangea.staff.uce.ac.uk>

I think you are refering to the mailstats that comes with sendmail - my
mailstats is actually mailstats.pl a Perl script which does produce
graphs etc.

See http://staff.cie.uce.ac.uk/~id001869/mailstats/

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------


-----Original Message-----
From: Tom Sevy [mailto:tom.sevy@intercept.net]
Sent: 10 July 2003 15:10
To: 'David.While@UCE.AC.UK'
Subject: RE: MS Performance --> mailstats


I found mailstats in my rh9 already installed.

Is there a package or anything available to produce graphs from the
mailstats output?  I am running mrtg-mailscanner now....

-----Original Message-----
From: David While [mailto:David.While@UCE.AC.UK] 
Sent: Thursday, July 10, 2003 3:35 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance


Could you let me have a copy - I will look at incorporating into the
main version. Seems useful to me.

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------


-----Original Message-----
From: Joel Colvin [mailto:joelc@CTCHOUSTON.COM]
Sent: 09 July 2003 19:49
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance


I measure performance by watching the sendmail delay field.  If you look
at
the final delivery of the message, the delay field shows total time from
first receipt until delivered locally or to another server.
Consequently,
delay time shows total time to process through MS, SA and any Virus
checks.
I only look at messages delivered to my own mail server and ignore
outbound
mail.  I have several MS servers, some doing virus checks and some not
and I
chart the Average Delay time. (See attached .bmp)

I am alerted when the average time to process goes over a threshold.  On
the
system with the included chart, I get alerts when the average time
exceeds
45 seconds.  From this chart, you can see that I run about 7 seconds per
message.  I size a system based on this number and the peak messages per
second that I anticipate.  My largest system peaks at about 1.5 messages
per
second and has an average delay time of 9 seconds.

Watching this time, total memory and CPU performance is how I finally
solved
my performance problems of two months ago.  Knowing your peak messages
per
second is critical to sizing some of the batch variables in MS.

Joel

P.S. I generate this data with a heavily modified version of David
While's
Mailstats.


From P.G.M.Peters at utwente.nl  Thu Jul 10 15:25:54 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <LISTSERV%2003071013354270@JISCMAIL.AC.UK>
References: <LISTSERV%2003071013354270@JISCMAIL.AC.UK>
Message-ID: <8otqgvsj3coi6vrle49lgrp61ev4du4a8g@4ax.com>

On Thu, 10 Jul 2003 13:35:42 +0100, you wrote:

>I'have just upgraded to the latest mailscan 4.22-5 from 4.13-x and
>I'm registering exatly the same problem:
>
>Jul 10 12:40:34 neutrino MailScanner[26052]: McAfee said
>"/home1/spool/MailScanner/incoming/26052/h6AAeWE00411/sirc-virus.zip/SIRC32-VIRUS.EXE"
>
>Jul 10 12:40:34 neutrino MailScanner[26052]: McAfee said "        Found the
>W32/SirCam@MM virus !!!"
>Jul 10 12:40:34 neutrino MailScanner[26052]:
>/home1/spool/MailScanner/incoming/26052/h6AAeWE00411/sirc-virus.zip/SIRC32-VIRUS.EXE
>       Found the W32/SirCam@MM virus !!!

As far as I understand it MS starts the virusscanner to check whether a
virus is detected. If at least one message in a batch has a virus MS
starts the virusscanner with the clean option. Perhaps McAfee doesn't
act (anymore) on that option.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From richard at HELPPLC.COM  Thu Jul 10 15:37:06 2003
From: richard at HELPPLC.COM (Richard Sidlin)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
Message-ID: <002d01c346f0$bff13fe0$1a00000a@rich>

I put a message up a couple of weeks ago but I am still having a problem
with emails being received in what looks like Chinese. I added a few
lines on language settings in the spam assassin conf file that someone
suggested but that hasn't cured it. It's really only coming in on one
email address but my customer is getting very agitated about it! Anyone
help please? BTW, it's coming from all sorts of addresses and domains.


Richard Sidlin



--
This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email support@helpinternet.co.uk

From Kevin.Spicer at BMRB.CO.UK  Thu Jul 10 15:43:51 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF709@pascal.priv.bmrb.co.uk>

Richard Sidlin wrote:
> I put a message up a couple of weeks ago but I am still having a
> problem with emails being received in what looks like Chinese. I
> added a few lines on language settings in the spam assassin conf file
> that someone suggested but that hasn't cured it. It's really only
> coming in on one email address but my customer is getting very
> agitated about it! Anyone help please? BTW, it's coming from all
> sorts of addresses and domains. 


I've just checked the archive and the example you posted previously had not been scanned by MailScanner, could you post some example headers where MailScanner has scanned it please.  If MailScanner isn't scanning any of them you need to work out why (maybe you have a mis-configured ruleset somewhere?).  Preferably post headers for a representative message and grep your maillog for the messageid and post the lines you find.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From gerry at dorfam.ca  Thu Jul 10 15:45:15 2003
From: gerry at dorfam.ca (Gerry Doris)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <002d01c346f0$bff13fe0$1a00000a@rich>
References: <002d01c346f0$bff13fe0$1a00000a@rich>
Message-ID: <12913.129.80.22.133.1057848315.squirrel@tiger.dorfam.ca>

> I put a message up a couple of weeks ago but I am still having a problem
> with emails being received in what looks like Chinese. I added a few
> lines on language settings in the spam assassin conf file that someone
> suggested but that hasn't cured it. It's really only coming in on one
> email address but my customer is getting very agitated about it! Anyone
> help please? BTW, it's coming from all sorts of addresses and domains.
>
>
> Richard Sidlin

Have you checked the headers for "charset=some_character_set"?  If they
arrive with Big-5, Korean, etc you can easily screen for them.

Gerry

From joelc at CTCHOUSTON.COM  Thu Jul 10 15:44:53 2003
From: joelc at CTCHOUSTON.COM (Joel Colvin)
Date: Thu Jan 12 21:18:54 2006
Subject: MS Performance
In-Reply-To: <107DE25EC0216C45AEF670016024245F6EEE@exchangea.staff.uce.ac.uk>
Message-ID: <005c01c346f1$d3517720$6400a8c0@jclaptop>

David, I'll send you a copy and explain my changes.  I probably won't have
time for a couple days but I'll send it and you can decide if any of my mods
are worth adding.

Joel

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of David While
Sent: Thursday, July 10, 2003 2:35 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance

Could you let me have a copy - I will look at incorporating into the
main version. Seems useful to me.

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------


-----Original Message-----
From: Joel Colvin [mailto:joelc@CTCHOUSTON.COM]
Sent: 09 July 2003 19:49
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS Performance


I measure performance by watching the sendmail delay field.  If you look
at
the final delivery of the message, the delay field shows total time from
first receipt until delivered locally or to another server.
Consequently,
delay time shows total time to process through MS, SA and any Virus
checks.
I only look at messages delivered to my own mail server and ignore
outbound
mail.  I have several MS servers, some doing virus checks and some not
and I
chart the Average Delay time. (See attached .bmp)

I am alerted when the average time to process goes over a threshold.  On
the
system with the included chart, I get alerts when the average time
exceeds
45 seconds.  From this chart, you can see that I run about 7 seconds per
message.  I size a system based on this number and the peak messages per
second that I anticipate.  My largest system peaks at about 1.5 messages
per
second and has an average delay time of 9 seconds.

Watching this time, total memory and CPU performance is how I finally
solved
my performance problems of two months ago.  Knowing your peak messages
per
second is critical to sizing some of the batch variables in MS.

Joel

P.S. I generate this data with a heavily modified version of David
While's
Mailstats.


From richard at HELPPLC.COM  Thu Jul 10 16:24:29 2003
From: richard at HELPPLC.COM (Richard Sidlin)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF709@pascal.priv.bmrb.co.uk>
Message-ID: <002f01c346f7$5f80f860$1a00000a@rich>

>Subject: Re: Chinese Emails
>
>
>Richard Sidlin wrote:
>> I put a message up a couple of weeks ago but I am still having a 
>> problem with emails being received in what looks like 
>Chinese. I added 
>> a few lines on language settings in the spam assassin conf file that 
>> someone suggested but that hasn't cured it. It's really only 
>coming in 
>> on one email address but my customer is getting very agitated about 
>> it! Anyone help please? BTW, it's coming from all sorts of addresses 
>> and domains.
>
>
>I've just checked the archive and the example you posted 
>previously had not been scanned by MailScanner, could you post 
>some example headers where MailScanner has scanned it please.  
>If MailScanner isn't scanning any of them you need to work out 
>why (maybe you have a mis-configured ruleset somewhere?).  
>Preferably post headers for a representative message and grep 
>your maillog for the messageid and post the lines you find.
>

Headers of an example:

Return-Path: <smjc5n@sina.com>
Received: from hero ([210.21.34.186])
        by hosting.helpplc.co.uk (8.10.2/8.10.2) with SMTP id
h6A2ObS03588
        for <info@xxxxx.co.uk>; Thu, 10 Jul 2003 03:24:38 +0100
Message-Id: <200307100224.h6A2ObS03588@ns.helpplc.co.uk>
Date: Thu, 10 Jul 03 10:25:45 ????????????
From: "??????????????????????????????"<info@gdhlc.com>
Reply-To: "??????????????????????????????"<gdseeyon@seeyon.com>
To: info@xxxxxx.co.uk
Subject: ????????????????????????????????????????????
MIME-Version: 1.0
Content-type: multipart/mixed;
    boundary="----=_NextPart_000_006C_0DF30091.29D901B4"
X-MailScanner-Information: Provided by Help Internet - 01707 897111
X-MailScanner: Found to be clean
X-UIDL: L_G"!e>H!!cRS"!1@I!!



--
This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email support@helpinternet.co.uk


From hzhu at wesleyan.edu  Thu Jul 10 16:17:15 2003
From: hzhu at wesleyan.edu (Hong Zhu)
Date: Thu Jan 12 21:18:54 2006
Subject: Too many open files + Cannot create + lock headers file
Message-ID: <KPECLDMKMPPDAAJBCCLGAEIPHFAA.hzhu@wesleyan.edu>

Hi All,

We installed mailscanner 4.21-9 on a Solaris 8 system,
I updated max file descriptor to be unlimited in
"/opt/MailScanner/bin/check_mailscanner" from:
ulimit -n 2000 >/dev/null 2>&1
to:
ulimit -n unlimited >/dev/null 2>&1

I terminated old MailScanner processes, then ran
"check_mailscanner", but I still saw following errors
in the log:

MailScanner[14033]: Could not open file
>/var/spool/MailScanner/incoming/14033/h6AEnFre013009.header: Too many open
files

MailScanner[14033]: Cannot create + lock headers file
/var/spool/MailScanner/incoming/14033/h6AEnFre013009.header,


Is there anything else that I need to update?

Your quick response is highly appreciated,

many thanks,
hong

From Kevin.Spicer at BMRB.CO.UK  Thu Jul 10 16:33:12 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF70A@pascal.priv.bmrb.co.uk>

> X-MailScanner-Information: Provided by Help Internet - 01707 897111
> X-MailScanner: Found to be clean X-UIDL: L_G"!e>H!!cRS"!1@I!! 

Okays, so it is being scanned - if you change

Always Include SpamAssassin Report = no

to 

Always Include SpamAssassin Report = yes

in MailScanner.conf the headers should then tell you what score SA is giving it and why.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From TGFurnish at HERFF-JONES.COM  Thu Jul 10 16:43:17 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:54 2006
Subject: really easy Q for someone: what is sendmail's -Ac option?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C028C@inex1.herffjones.hj-int>

Ok, I've always just accepted -Ac as an option for sendmail, but for
whatever reason today I wanted to verify that it does what I think it does -
but I can't find it documented. :-(  Then again I've always hated trying to
find documentation for sendmail so maybe it's just me.

Could someone enlighten me as to the meaning of the -Ac option to sendmail?
Is it "aliases check"?

-t.

From mikea at MIKEA.ATH.CX  Thu Jul 10 16:44:58 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:54 2006
Subject: really easy Q for someone: what is sendmail's -Ac option?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C028C@inex1.herffjones.hj-int>;
              from TGFurnish@HERFF-JONES.COM on Thu, Jul 10,
              2003 at 10:43:17AM -0500
References: <8FFC76593085ED4A80D3601BC41EFCDF0C028C@inex1.herffjones.hj-int>
Message-ID: <20030710104458.A32005@mikea.ath.cx>

On Thu, Jul 10, 2003 at 10:43:17AM -0500, Furnish, Trever G wrote:
> Ok, I've always just accepted -Ac as an option for sendmail, but for
> whatever reason today I wanted to verify that it does what I think it does -
> but I can't find it documented. :-(  Then again I've always hated trying to
> find documentation for sendmail so maybe it's just me.
>
> Could someone enlighten me as to the meaning of the -Ac option to sendmail?
> Is it "aliases check"?

: $man sendmail
:
: ...
:       -Ac    Use  submit.cf  even if the operation mode does not
:               indicate an initial mail submission.
: ...

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From Kevin.Spicer at BMRB.CO.UK  Thu Jul 10 16:47:54 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:54 2006
Subject: really easy Q for someone: what is sendmail's -Ac option?
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF70B@pascal.priv.bmrb.co.uk>

Furnish, Trever G wrote:
> Ok, I've always just accepted -Ac as an option for sendmail, but for
> whatever reason today I wanted to verify that it does what I think it
> does - but I can't find it documented. :-(  Then again I've always
> hated trying to find documentation for sendmail so maybe it's just me.

man sendmail

<snip>
 -Ac    Use submit.cf even if the operation mode does  not  indicate  an
              initial mail submission.
</snip>
 



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From richard_cipher at YAHOO.COM  Thu Jul 10 17:11:15 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <002d01c346f0$bff13fe0$1a00000a@rich>
Message-ID: <NHBBIDLEJBNNEMOPKJPNOEJEDBAA.richard_cipher@yahoo.com>

Are you using SpamAssassin with MailScanner?

SpamAssassin has a score for 'MIME_CHARSET_FARAWAY' of 2.45 (at least in my
version).
You might consider upping this value in spam.assassin.prefs.conf
(e.g. 'score MIME_CHARSET_FARAWAY 3' or even higher if that doesn't do it)

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Richard Sidlin
Sent: Thursday, July 10, 2003 8:37 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Chinese Emails


I put a message up a couple of weeks ago but I am still having a problem
with emails being received in what looks like Chinese. I added a few
lines on language settings in the spam assassin conf file that someone
suggested but that hasn't cured it. It's really only coming in on one
email address but my customer is getting very agitated about it! Anyone
help please? BTW, it's coming from all sorts of addresses and domains.


Richard Sidlin



--
This message has been scanned for viruses and dangerous content by the Help
Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email
support@helpinternet.co.uk
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From TGFurnish at HERFF-JONES.COM  Thu Jul 10 17:19:19 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:54 2006
Subject: really easy Q for someone: what is sendmail's -Ac option?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C028E@inex1.herffjones.hj-int>

Thanks, Kevin and Mike.  My sendmail man page is missing that info. :-(
Guess I'll grab the latest version from sendmail.org for comparison.

>-----Original Message-----
>From: Spicer, Kevin [mailto:Kevin.Spicer@BMRB.CO.UK]
>Sent: Thursday, July 10, 2003 10:48 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: really easy Q for someone: what is sendmail's -Ac option?
>
>
>Furnish, Trever G wrote:
>> Ok, I've always just accepted -Ac as an option for sendmail, but for
>> whatever reason today I wanted to verify that it does what I think it
>> does - but I can't find it documented. :-(  Then again I've always
>> hated trying to find documentation for sendmail so maybe
>it's just me.
>
>man sendmail
>
><snip>
> -Ac    Use submit.cf even if the operation mode does  not
>indicate  an
>              initial mail submission.
></snip>
>
>
>
>
>BMRB International
>http://www.bmrb.co.uk
>+44 (0)20 8566 5000
>_________________________________________________________________
>This message (and any attachment) is intended only for the
>recipient and may contain confidential and/or privileged
>material.  If you have received this in error, please contact the
>sender and delete this message immediately.  Disclosure, copying
>or other action taken in respect of this email or in
>reliance on it is prohibited.  BMRB International Limited
>accepts no liability in relation to any personal emails, or
>content of any email which does not directly relate to our
>business.
>

From m.sapsed at BANGOR.AC.UK  Thu Jul 10 17:24:32 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner + Procmail?
References: <006701c3462f$9d5f1f90$bc0aa8c0@epx.com>
Message-ID: <3F0D9340.7010604@bangor.ac.uk>

Tom Sevy wrote:
> Does anyone have MailScanner + Procmail running on the same system?
>
> I would like, for just one single local user, to run procmail so I can sort
> mail into folders.
>
> Will this work?
>
> Any gotchas?  I have never run procmail so I don't yet know anything about
> it other than that it is there....

As Kevin has suggested you can either have sendmail use procmail as a
delivery agent or (I guess?) you could put a call to procmail in a
.forward file if you only want one person using it rather than everyone?

Nothing really to do with MailScanner though.

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From lvargas at CFT.COM.MX  Thu Jul 10 19:17:18 2003
From: lvargas at CFT.COM.MX (Luis Amado Vargas)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner in Raq4
Message-ID: <000001c3470f$85eab960$0402a8c0@ATILVARGAS>

I?ve serious problem with MailScanner, i followed the instalation
instruction line by line for Cobalt Raq4, i first install f-prot, then
MailScanner and then SpamAssasin, and only have a problem with chkconfig
command.
 
I check the status for MailScanner 
 
[root /]# /etc/rc.d/init.d/MailScanner status
Checking MailScanner daemons:
         MailScanner:       ok
         incoming sendmail: ok
         outgoing sendmail: ok
 
In the maillog appears this
 
Jul  9 14:18:34 ns5 MailScanner[18086]: MailScanner E-Mail Virus Scanner
version 4.21-9 starting...
Jul  9 14:18:34 ns5 MailScanner[18086]: SpamAssassin installation could
not be found
If i try to send infected mail  or any mail and   .... the MailScanner
is not working , not send and recive any mail

any commentary on the matter

Please Urgent !!!

 
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030710/4c36b9f5/attachment.html
From michele at BLACKNIGHTSOLUTIONS.COM  Thu Jul 10 17:35:28 2003
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon:: Blacknight Solutions)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner in Raq4
In-Reply-To: <000001c3470f$85eab960$0402a8c0@ATILVARGAS>
Message-ID: <200307101634.h6AGYXA06115@camelot.blacknightsolutions.com>

How did you install Spam Assasin?
RAQs can be a real pain, as their version of Perl (unless you've upgraded
it) is rather old...

Mr. Michele Neylon
Blacknight Solutions
http://www.blacknightsolutions.com <http://www.blacknightsolutions.com/>
Spam and virus scanning available


#########################################################
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance to it is prohibited.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030710/c239d40a/attachment.html
From wpc4 at DODGETHIS.ORG  Thu Jul 10 17:38:27 2003
From: wpc4 at DODGETHIS.ORG (William Curley)
Date: Thu Jan 12 21:18:54 2006
Subject: Postfix & Mailscanner
Message-ID: <1057855107.7a5141f7dba78@mail.cynical.us>

The documentation for configuring postfix with mailscanner appears to be a
little bit sparse. It states that postfix must be chrooted but doesn't explain
which services in master.cf need to be chrooted. I didn't set any of the
services to chroot and it appears to be working fine, I just want to verify it
isn't going to implode by me not doing something correctly.

From damian at WORKGROUPSOLUTIONS.COM  Thu Jul 10 17:40:53 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner delivering SPAM messages
Message-ID: <F6B4162F6771E44ABF0958023547FFC40966FB@w2kserver.workgroupsolutions.com>

Hi,

I'm starting to see messages that are marked as SPAM being delivered by MailScanner - (version 4.12-2.) This only happens occasionally - The majority of SPAM messages are not delivered, just deleted which is defined in spam.actions.rules file.

Any ideas? 

Maillog File = Problem Message ID = h6A04Q9G032454

Jul  9 17:03:59 spamgate MailScanner[25750]: Spam Checks: Starting 
Jul  9 17:04:00 spamgate MailScanner[25750]: Message h6A03u9F032449 from 198.188.250.254 (g.ss01.net) to svusd.k12.ca.us is spam, SpamAssassin (score=4.9, required 4, BAYES_10, DCC_CHECK, EXCUSE_1, REMOVE_PAGE) 
Jul  9 17:04:00 spamgate MailScanner[25750]: Spam Checks: Found 1 spam messages 
Jul  9 17:04:00 spamgate MailScanner[25750]: Spam Actions: message h6A03u9F032449 actions are delete 
Jul  9 17:04:00 spamgate MailScanner[25750]: Virus and Content Scanning: Starting 
Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9F032454: from=<swims-blew@kroc.com>, size=2207, class=0, nrcpts=1, msgid=<2730416505.01380945810856@kroc.com>, proto=ESMTP, daemon=MTA, relay=gateway.svusd.k12.ca.us [198.188.250.254]
Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9F032454: to=<chuw@svusd.k12.ca.us>, delay=00:00:00, mailer=esmtp, pri=30531, stat=queued
Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9G032454: from=<optindeals-yh@para3ds.com>, size=6546, class=0, nrcpts=1, msgid=<1057795388.2242@64.119.200.139.impro6.com>, proto=ESMTP, daemon=MTA, relay=gateway.svusd.k12.ca.us [198.188.250.254]
Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9G032454: to=<garciat@svusd.k12.ca.us>, delay=00:00:00, mailer=esmtp, pri=30487, stat=queued
Jul  9 17:04:29 spamgate MailScanner[26052]: New Batch: Forwarding 2 unscanned messages, 9748 bytes 
Jul  9 17:04:29 spamgate MailScanner[26052]: Spam Checks: Starting 
Jul  9 17:04:30 spamgate MailScanner[26052]: Message h6A04Q9G032454 from 198.188.250.254 (para3ds.com) to svusd.k12.ca.us is spam, SpamAssassin (score=15.8, required 4, BAYES_80, DCC_CHECK, EXCUSE_1, EXCUSE_19, EXCUSE_3, HIDE_WIN_STATUS, HTML_70_80, HTML_IMAGE_ONLY_06, HTML_TAG_EXISTS_TBODY, HTML_WEB_BUGS, MIME_HEADER_CTYPE_ONLY, MIME_HTML_ONLY, NORMAL_HTTP_TO_IP, OFFER, OFFERS_ETC, RECEIVE_OFFER) 
Jul  9 17:04:31 spamgate MailScanner[26052]: Spam Checks: Found 1 spam messages 
Jul  9 17:04:31 spamgate MailScanner[26052]: Spam Actions: message h6A04Q9G032454 actions are delete 
Jul  9 17:04:31 spamgate MailScanner[26052]: Unscanned: Delivered 1 messages 
Jul  9 17:04:31 spamgate MailScanner[26052]: Virus and Content Scanning: Starting 
Jul  9 17:04:32 spamgate sendmail[32466]: h6A04Q9F032454: to=<chuw@svusd.k12.ca.us>, delay=00:00:05, xdelay=00:00:01, mailer=esmtp, pri=120531, relay=[10.1.254.3] [10.1.254.3], dsn=2.0.0, stat=Sent ( <2730416505.01380945810856@kroc.com> Queued mail for delivery)

Header Information = Message ID = h6A04Q9F032454 (No SPAM header information included - not sure why)
Microsoft Mail Internet Headers Version 2.0
Received: from spamgate.spamgate.us ([198.188.250.11]) by doexchange.svusd.net with Microsoft SMTPSVC(5.0.2195.5329);
Wed, 9 Jul 2003 17:04:36 -0700
Received: from svusd.k12.ca.us (gateway.svusd.k12.ca.us [198.188.250.254])
by spamgate.spamgate.us (8.12.5/8.12.5) with ESMTP id h6A04Q9F032454
for <chuw@svusd.k12.ca.us <mailto:chuw@svusd.k12.ca.us>>; Wed, 9 Jul 2003 17:04:27 -0700
Received: from 24.203.227.247 ([24.203.227.247]) by gateway.svusd.k12.ca.us with SMTP id <119056>; Wed, 9 Jul 2003 14:04:29 -1000
Date: Thu, 10 Jul 2003 14:34:01 GMT
From: Vballoons Gballota <swims-blew@kroc.com <mailto:swims-blew@kroc.com>>
To: chuw@svusd.k12.ca.us <mailto:chuw@svusd.k12.ca.us>
X-Priority: 3 (Normal)
Message-ID: <2730416505.01380945810856@kroc.com <mailto:2730416505.01380945810856@kroc.com>>
Subject: Young gays (C76M6ZQUON below)
MIME-Version: 1.0
Content-type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
X-Mailer: Gnus v5.7/Emacs 20.17
X-Priority: 3 (Normal)
Return-Path: swims-blew@kroc.com <mailto:swims-blew@kroc.com>
X-OriginalArrivalTime: 10 Jul 2003 00:04:36.0100 (UTC) FILETIME=[D9394440:01C34676]































Workgroup Solutions
20532 El Toro Rd, Suite 107
Mission Viejo, CA 92692
949 586-2200
Developers of SpamGate - 
MXTreme - Stop SPAM at the Gateway with the MXTreme Appliance Stop SPAM today at the Gateway!

PacketShaper - Bandwidth Management for your network
Centurion Guard - Write protect your desktop computers


From mikea at MIKEA.ATH.CX  Thu Jul 10 17:42:46 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner in Raq4
In-Reply-To: <000001c3470f$85eab960$0402a8c0@ATILVARGAS>; from
              lvargas@CFT.COM.MX on Thu, Jul 10, 2003 at 11:17:18AM -0700
References: <000001c3470f$85eab960$0402a8c0@ATILVARGAS>
Message-ID: <20030710114246.A32318@mikea.ath.cx>

On Thu, Jul 10, 2003 at 11:17:18AM -0700, Luis Amado Vargas wrote:
> I?ve serious problem with MailScanner, i followed the instalation
> instruction line by line for Cobalt Raq4, i first install f-prot, then
> MailScanner and then SpamAssasin, and only have a problem with chkconfig
> command.
>  
> I check the status for MailScanner 
>  
> [root /]# /etc/rc.d/init.d/MailScanner status
> Checking MailScanner daemons:
>          MailScanner:       ok
>          incoming sendmail: ok
>          outgoing sendmail: ok
>  
> In the maillog appears this
>  
> Jul  9 14:18:34 ns5 MailScanner[18086]: MailScanner E-Mail Virus Scanner
> version 4.21-9 starting...
> Jul  9 14:18:34 ns5 MailScanner[18086]: SpamAssassin installation could
> not be found
> If i try to send infected mail  or any mail and   .... the MailScanner
> is not working , not send and recive any mail
> 
> any commentary on the matter
> 
> Please Urgent !!!

I expect it *is*. Probably all your inbound mail is being locked up in 
the Raq. I've been there, and it's unpleasant. 

First, you need to find your SpamAssassin installation. Try 
`locate SpamAssassin` or `find /usr -name "*ssassin*"` -- without 
the quotes, of course. Then you need to tell MailScanner where
to look, in /opt/MailScanner/etc/MailScanner.Conf. The variable
to set is "SpamAssassin Install Prefix". 

If `find /usr -name "*ssassin*"` fails, then try 
`find / -name "*ssassin*"`, but keep in mind that this will search
everything that is currently mounted on that machine, including 
all remotely-mounted (SAMBA, NFS, etc.) filesystems. That can be 
expensive. 

If this still fails and you haven't found the problem, then please 
reply to the list. 

?Buena suerte!

-- 
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964


From lvargas at CFT.COM.MX  Thu Jul 10 19:56:30 2003
From: lvargas at CFT.COM.MX (Luis Amado Vargas)
Date: Thu Jan 12 21:18:54 2006
Subject: MailScanner in Raq4
In-Reply-To: <200307101634.h6AGYXA06115@camelot.blacknightsolutions.com>
Message-ID: <001001c34714$fc7a0900$0402a8c0@ATILVARGAS>

I followed the instruction of this page

http://www.qitc.net/support/mailscanner/#To%20stop/start%20MailScanner

any comment will thank it



Luis Amado Vargas Vargas

Ing. de Soporte Tecnico.

Alta Tecnologia en Internet.

Tel.: (01 442) 2384518

-----Mensaje original-----
De: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] En
nombre de Michele Neylon:: Blacknight Solutions
Enviado el: Jueves, 10 de Julio de 2003 09:35 a.m.
Para: MAILSCANNER@JISCMAIL.AC.UK
Asunto: Re: MailScanner in Raq4


How did you install Spam Assasin?
RAQs can be a real pain, as their version of Perl (unless you've
upgraded it) is rather old...

Mr. Michele Neylon
Blacknight Solutions
http://www.blacknightsolutions.com <http://www.blacknightsolutions.com/>

Spam and virus scanning available

  _____

This message (and any attachment) is intended only for the recipient and
may contain confidential and/or privileged material. If you have
received this in error, please contact the sender and delete this
message immediately. Disclosure, copying or other action taken in
respect of this email or in reliance on it is prohibited.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030710/27a7b641/attachment.html
From richard at HELPPLC.COM  Thu Jul 10 18:11:48 2003
From: richard at HELPPLC.COM (Richard Sidlin)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <NHBBIDLEJBNNEMOPKJPNOEJEDBAA.richard_cipher@yahoo.com>
Message-ID: <000901c34706$5bdb9940$0b01a8c0@rich>

I don't see that at all in that conf file.


Richard
>
>
>Are you using SpamAssassin with MailScanner?
>
>SpamAssassin has a score for 'MIME_CHARSET_FARAWAY' of 2.45
>(at least in my version). You might consider upping this value
>in spam.assassin.prefs.conf (e.g. 'score MIME_CHARSET_FARAWAY
>3' or even higher if that doesn't do it)
>
>Evert Ford
>Information Analyst
>Westone Laboratories
>http://www.westone.com
>
>
>
>
>I put a message up a couple of weeks ago but I am still having
>a problem with emails being received in what looks like
>Chinese. I added a few lines on language settings in the spam
>assassin conf file that someone suggested but that hasn't
>cured it. It's really only coming in on one email address but
>my customer is getting very agitated about it! Anyone help
>please? BTW, it's coming from all sorts of addresses and domains.
>
>
>Richard Sidlin
>
>
>



--
This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email support@helpinternet.co.uk

From moliveri at UTI.COM  Thu Jul 10 18:13:43 2003
From: moliveri at UTI.COM (Mike Oliveri)
Date: Thu Jan 12 21:18:54 2006
Subject: Quick Exim question
Message-ID: <5.2.0.9.0.20030710120657.00a7ab30@mail211.pair.com>

Okay, I've got everything configured and ready to go, and I'm just about
ready to start MailScanner. However, I'm running Exim with a split spool
directory due to our server load.

Because my current config is only running with one config file, I only have
one spool directory: /var/spool/exim/input/*  The new config files will
have an input directory of /var/spool/exim.in/input/*, but of course they
do not exist yet. The MailScanner Exim configure page says I should create
all the subdirectories of ../input before running MailScanner.

Is it possible to just do the following:

mv /var/spool/exim/input /var/spool/exim.in/input
mkdir /var/spool/exim/input

Or will that cause problems? The second line to create the directory refers
to the spool directory for the outgoing Exim config file. I figure this
will also preserve all the mail currently in the queue and the new
processes/config files will still get it all delivered. Make sense? Just
wanted to see if anyone experienced this before I accidentally hose my
system. Thanks!

Take care,
Mike Oliveri
Systems Administrator
UTI Systems, Inc.

From ka at PACIFIC.NET  Thu Jul 10 18:29:26 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:54 2006
Subject: User specific "Spam Actions"
In-Reply-To: <200307101511.KAA30556@mail.int.orbitel.com>
References: <200307101511.KAA30556@mail.int.orbitel.com>
Message-ID: <3F0DA276.4080803@pacific.net>

or, if that doesn't fit your needs, see previous thread:
"How to use spamassassin on a per user basis with a third party e-mail
server setup?"

Ken


Orbitel Webmaster wrote:
> Take a look at the files in /etc/MailScanner/rules
>
> In a nutshelll go to the line to want to vary per user in
> mailscanner.conf.  Instead of putting it's value in put
> in "/etc/MailScanner/rules/rulefilenameyourwant.rules"
>
> Then use emacs/vi/pico to edit that file name.  I do my user specific
> spam actions based on destination e-mail address.  In my case, this
> file is used to determine wether the spam check is enabled or not.
> In this case, if they are user1 or user2 spam checking is enabled.
> Everyone else, default, has it off.  Hope that helps.
>
> #syntax   e-mail      yes/no/or any other option depending on the
> #mailscanner.conf line
> To: user1@domain.com   yes
> To: user2@domain.com   yes
> FromOrTo:   default   no
>
>
>
> -------- Original Message --------
>
> ==> From: Dene Ulmschneider <dene@DATATECHIE.COM>
> ==> Date: Wed, 9 Jul 2003 09:54:30 -0400
>
> Hello all-
>
> I am running RHL 7.3 and MS version 4.14-9 and Sendmail.
>
> I am trying to setup user specific "Spam Actions" and could use a
> little help. I know that the spam action setting can point to a file
> with rule sets in it but I am not clear on the format of the file.
>
> Can anyone help me out with the format of the file? If a user wants
> to delete spam and high spam - what should the file look like?
>
> Does anyone have a sample file that they can forward to give me a
> better idea on how to set this up??
>
>  Thank You
>
> Dene Ulmschneider Data Techie Inc.
> -----------------------------------
> -------------------------------------- office:         718.738.8859
> cell:           646.996.2976 email:          dene@datatechie.com
> pager mail:     denenow@datatechie.com website:
> www.datatechie.com
> ---------------------------------------------------
> ---------------------- "Data Techie - Always there to protect you!"
>
>

From kevins at BMRB.CO.UK  Thu Jul 10 18:29:31 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175D9C@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175D9C@pascal.priv.bmrb.co.uk>
Message-ID: <1057858171.29126.3.camel@bach.kevinspicer.co.uk>

On Thu, 2003-07-10 at 18:11, Richard Sidlin wrote:

I don't see that at all in that conf file.


You'll need to add it, the spam.assassin.prefs.conf file only contains a
subset of the available directives.





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From richard at HELPPLC.COM  Thu Jul 10 18:35:21 2003
From: richard at HELPPLC.COM (Richard Sidlin)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <1057858171.29126.3.camel@bach.kevinspicer.co.uk>
Message-ID: <000a01c34709$a7d6dd20$0b01a8c0@rich>

>Subject: Re: Chinese Emails
>
>
>On Thu, 2003-07-10 at 18:11, Richard Sidlin wrote:
>
>I don't see that at all in that conf file.
>
>
>You'll need to add it, the spam.assassin.prefs.conf file only
>contains a subset of the available directives.
>
So just add this at the end?

score MIME_CHARSET_FARAWAY 3



--
This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email support@helpinternet.co.uk

From richard_cipher at YAHOO.COM  Thu Jul 10 18:34:07 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <000901c34706$5bdb9940$0b01a8c0@rich>
Message-ID: <NHBBIDLEJBNNEMOPKJPNOEJGDBAA.richard_cipher@yahoo.com>

It's not in there until you add it.

spam.assassin.prefs.conf is a file where you can add customized settings
that change the way spamassassin behaves.  If you add custom scores to this
file, SpamAssassin will use the custom scores instead of it's default
scores.

For this to help you
1. You have to have SpamAssassin installed
2. In MailScanner.conf set 'Use SpamAssassin = yes'
3. On some systems, you may have to tell MailScanner where spamassassin is
located.
4. in spam.assassin.prefs.conf add a line to change the default value of
MIME_CHARSET_FARAWAY
for Example
score MIME_CHARSET_FARAWAY 3.45
5. re-start MailScanner
for Example
service MailScanner reload

Setting custom scores too high can trigger false positives in spamassassin.
But in your case, unless you had users expecting and wanting e-mail in
chinese, you probably don't need to worry about that

I don't know that this will help you, but it might.  :-)

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Richard Sidlin
Sent: Thursday, July 10, 2003 11:12 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Chinese Emails


I don't see that at all in that conf file.


Richard
>
>
>Are you using SpamAssassin with MailScanner?
>
>SpamAssassin has a score for 'MIME_CHARSET_FARAWAY' of 2.45
>(at least in my version). You might consider upping this value
>in spam.assassin.prefs.conf (e.g. 'score MIME_CHARSET_FARAWAY
>3' or even higher if that doesn't do it)
>
>Evert Ford
>Information Analyst
>Westone Laboratories
>http://www.westone.com
>
>
>
>
>I put a message up a couple of weeks ago but I am still having
>a problem with emails being received in what looks like
>Chinese. I added a few lines on language settings in the spam
>assassin conf file that someone suggested but that hasn't
>cured it. It's really only coming in on one email address but
>my customer is getting very agitated about it! Anyone help
>please? BTW, it's coming from all sorts of addresses and domains.
>
>
>Richard Sidlin
>
>
>



--
This message has been scanned for viruses and dangerous content by the Help
Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email
support@helpinternet.co.uk
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From kevins at BMRB.CO.UK  Thu Jul 10 18:39:49 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175DA0@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175DA0@pascal.priv.bmrb.co.uk>
Message-ID: <1057858790.29126.7.camel@bach.kevinspicer.co.uk>

So just add this at the end?

score MIME_CHARSET_FARAWAY 3

Yes, but you should first activate

Always Include SpamAssassin Report = yes

so that you can see whether that rule is in fact being triggered by
these emails, and decide what to change the score to.  There may be
other scores you want to tweak too.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From richard at HELPPLC.COM  Thu Jul 10 18:47:28 2003
From: richard at HELPPLC.COM (Richard Sidlin)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <1057858790.29126.7.camel@bach.kevinspicer.co.uk>
Message-ID: <000b01c3470b$57c58280$0b01a8c0@rich>

>So just add this at the end?
>
>score MIME_CHARSET_FARAWAY 3
>
>Yes, but you should first activate
>
>Always Include SpamAssassin Report = yes
>
>so that you can see whether that rule is in fact being
>triggered by these emails, and decide what to change the score
>to.  There may be other scores you want to tweak too.
>
Thanks. Done that. I'll keep an eye on it.



--
This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email support@helpinternet.co.uk

From paul at CS.UKY.EDU  Thu Jul 10 18:54:12 2003
From: paul at CS.UKY.EDU (Paul Linton)
Date: Thu Jan 12 21:18:54 2006
Subject: Symantec AntiVirus Command Line Scanner
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF69E@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF69E@pascal.priv.bmrb.co.uk>
Message-ID: <20030710175412.GA32608@bud.cs.uky.edu>

On Fri, Jun 27, 2003 at 09:59:00AM +0100, Spicer, Kevin wrote:
> I see that symantec now do a command line scanner for linux
> http://enterprisesecurity.symantec.com/products/products.cfm?ProductID=65
> has anyone tried this or got it working with MailScanner?

I am running an older version of the engine, and it seems fine.  I know that
someone else on campus here had issues with shared libraries.

I'm running slackware 9.0/kernel 2.4.21 and slackware 8.0/kernel 2.4.18 with
% uvscan --version
Virus Scan for Linux v4.16.0
Copyright (c) 1992-2001 Networks Associates Technology Inc. All rights reserved.
(408) 988-3832  LICENSED COPY - Nov 13 2001

Scan engine v4.1.60 for Linux.
Virus data file v4276 created Jul 09 2003

% ldd `which uvscan`
        liblnxfv.so.4 => /usr/local/lib/liblnxfv.so.4 (0x40015000)
        libstdc++.so.2.8 => /usr/i386-slackware-linux/lib/libstdc++.so.2.8 (0x401ff000)
        libm.so.6 => /lib/libm.so.6 (0x40240000)
        libc.so.6 => /lib/libc.so.6 (0x40263000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

Our (recently installed) mailserver with Mailscanner is running the Solaris
version.  I have been doing filesystem scans with the linux one though.

- Paul
--
Paul Linton      Systems Programmer       paul@cs.uky.edu
UofK Department of Computer Science       (859) 257-3962

From mike at CAMAROSS.NET  Thu Jul 10 19:01:39 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:54 2006
Subject: Chinese Emails
In-Reply-To: <000b01c3470b$57c58280$0b01a8c0@rich>
Message-ID: <007f01c3470d$5036a010$9c01a8c0@home.middlefinger.net>

Don't forget to reload MailScanner so it will read the new configuration!

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Richard Sidlin
Sent: Thursday, July 10, 2003 12:47 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Chinese Emails


>So just add this at the end?
>
>score MIME_CHARSET_FARAWAY 3
>
>Yes, but you should first activate
>
>Always Include SpamAssassin Report = yes
>
>so that you can see whether that rule is in fact being triggered by 
>these emails, and decide what to change the score to.  There may be 
>other scores you want to tweak too.
>
Thanks. Done that. I'll keep an eye on it.



--
This message has been scanned for viruses and dangerous content by the Help
Internet Virus Spam Defence, and is believed to be clean. For details on
having your email scanned email support@helpinternet.co.uk


From paul at CS.UKY.EDU  Thu Jul 10 19:12:44 2003
From: paul at CS.UKY.EDU (Paul Linton)
Date: Thu Jan 12 21:18:55 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <20030709023925.GA12072@bud.cs.uky.edu>
References: <20030709023925.GA12072@bud.cs.uky.edu>
Message-ID: <20030710181244.GB32608@bud.cs.uky.edu>

Solved.  It was simply a matter of trusting the documentation.  I had
read, and ignored, the note about McAfee and symbolic links.  So my
/var/spool/MailScanner/incoming option was really somewhere else.  Since
McAfee was running fine and seeing viruses I didn't think this was an issue.

After a LOT of debugging I tracked it down to the following line(s):

SweepViruses.pm: lines 976-978

  # McAfee prints the whole path as opposed to
  # ./messages/part so make it the same
  $lastline =~ s/$BaseDir//;

Since I will be trying to keep my .conf files fairly consistent across
domains I would like to change that line to be more forgiving.  If anyone
is interested drop me a line and maybe we can convince someone to incorporate
the change.

- Paul

On Tue, Jul 08, 2003 at 10:39:25PM -0400, Paul Linton wrote:
> I have a brand new install of MailScanner/Spamassassin/McAfee.  Most
> seems to be working fine, with the exception of virus removal.  MailScanner
> calls McAfee and sees the virus, but then happily sends the message on, virus
> and all, no warning to the recipient, etc.  Did I miss something in the .conf
> file?
--
Paul Linton      Systems Programmer       paul@cs.uky.edu
UofK Department of Computer Science       (859) 257-3962

From moliveri at UTI.COM  Thu Jul 10 19:35:41 2003
From: moliveri at UTI.COM (Mike Oliveri)
Date: Thu Jan 12 21:18:55 2006
Subject: One more Exim scanner
Message-ID: <5.2.0.9.0.20030710133226.00a7ab30@mail211.pair.com>

Whoops, one more thing for Exim:

The MailScanner startup options in rc.local on FreeBSD refer to the
MailScanner incoming mail spool as being /var/spool/mqueue.in

Should that actually be the incoming Exim queue at
/var/spool/exim.in/input/*? Or are these supposed to be two separate queues?

Thanks!

Take care,
Mike Oliveri

From TGFurnish at HERFF-JONES.COM  Thu Jul 10 22:00:36 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C0291@inex1.herffjones.hj-int>

:-)  Seriously - I need to test a mailscanner subdomain so I need some spam.
:-)

I've clicked a few unsubscribe links (modified to reflect the filter testing
domain), but now I'm out of spam, so any suggestions (specifics, not general
concepts - got a link?) would be appreciated.

Address that wants spam: tgfurnish@public.herff-jones.com

--
Trever

From kevins at BMRB.CO.UK  Thu Jul 10 22:11:56 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175DA8@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175DA8@pascal.priv.bmrb.co.uk>
Message-ID: <1057871516.29126.12.camel@bach.kevinspicer.co.uk>

On Thu, 2003-07-10 at 22:00, Furnish, Trever G wrote:

Address that wants spam: tgfurnish@public.herff-jones.com

Posting on usenet (Google Groups) worked well for me (unfortunately!)





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From dwinkler at ALGORITHMICS.COM  Thu Jul 10 22:12:24 2003
From: dwinkler at ALGORITHMICS.COM (Derek Winkler)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
Message-ID: <06EE2C86D3DAD5119A6C0060943F3C97055E7088@tormail1.algorithmics.com>

Spamassassin prodvides some test spam on their site.

Just deliver to yourself with sendmail from command line.

-----Original Message-----
From: Furnish, Trever G [mailto:TGFurnish@herff-jones.com]
Sent: Thursday, July 10, 2003 5:01 PM
To: MAILSCANNER@jiscmail.ac.uk
Subject: How can I get some spam?


:-)  Seriously - I need to test a mailscanner subdomain so I need some spam.
:-)

I've clicked a few unsubscribe links (modified to reflect the filter testing
domain), but now I'm out of spam, so any suggestions (specifics, not general
concepts - got a link?) would be appreciated.

Address that wants spam: tgfurnish@public.herff-jones.com

--
Trever
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030710/9bb4f7dd/attachment.html
From mikea at MIKEA.ATH.CX  Thu Jul 10 22:26:52 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <06EE2C86D3DAD5119A6C0060943F3C97055E7088@tormail1.algorithmics.com>; from dwinkler@ALGORITHMICS.COM on
              Thu, Jul 10, 2003 at 05:12:24PM -0400
References: <06EE2C86D3DAD5119A6C0060943F3C97055E7088@tormail1.algorithmics.com>
Message-ID: <20030710162652.A34019@mikea.ath.cx>

On Thu, Jul 10, 2003 at 05:12:24PM -0400, Derek Winkler wrote:
> Spamassassin prodvides some test spam on their site.
>
> Just deliver to yourself with sendmail from command line.
>
> -----Original Message-----
> From: Furnish, Trever G [mailto:TGFurnish@herff-jones.com]
> Sent: Thursday, July 10, 2003 5:01 PM
> To: MAILSCANNER@jiscmail.ac.uk
> Subject: How can I get some spam?
>
>
> :-)  Seriously - I need to test a mailscanner subdomain so I need some spam.
> :-)
>
> I've clicked a few unsubscribe links (modified to reflect the filter testing
> domain), but now I'm out of spam, so any suggestions (specifics, not general
> concepts - got a link?) would be appreciated.
>
> Address that wants spam: tgfurnish@public.herff-jones.com

Want 13506473 bytes (and growing) of guaranteed-to-be-spam? That's
1806 (and counting) separate pieces. I can gzip it up and ship it
to anyone who wants it. Not, mind you, that there's a spam shortage.
It gzips down to a tidy 4193099 bytes.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From michele at BLACKNIGHTSOLUTIONS.COM  Thu Jul 10 22:56:49 2003
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon:: Blacknight Solutions)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <20030710162652.A34019@mikea.ath.cx>
Message-ID: <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>

> Want 13506473 bytes (and growing) of guaranteed-to-be-spam? That's
> 1806 (and counting) separate pieces. I can gzip it up and
> ship it to anyone who wants it. Not, mind you, that there's a
> spam shortage.
> It gzips down to a tidy 4193099 bytes.

ROFL

This must be the only mailing list where people swap spam and virii and
compare they're quality :-)

To test some SPAM and virus logging we used a few junk email addresses with
a dialup ISP and used fetchmail to pass them through the system. The scary
thing was that over 95% of the mail from one account was spam and virii!!

M


#########################################################
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance to it is prohibited.

From TGFurnish at HERFF-JONES.COM  Thu Jul 10 22:57:54 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C0712@inex1.herffjones.hj-int>

>-----Original Message-----
>From: mikea [mailto:mikea@MIKEA.ATH.CX]
>Sent: Thursday, July 10, 2003 4:27 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: How can I get some spam?
>
>Want 13506473 bytes (and growing) of guaranteed-to-be-spam? That's
>1806 (and counting) separate pieces. I can gzip it up and ship it
>to anyone who wants it. Not, mind you, that there's a spam shortage.
>It gzips down to a tidy 4193099 bytes.

Well, yes, thanks, but I'm also hoping to test rbl lookups and I'm thinking
that would be difficult if I'm sending the spam myself.

Still though, if you don't mind sending a gzipped version, then go ahead -
most appreciated. :-)

And thanks to the others who've already passed on spam without mentioning it
on the list as well.

-t.

From wpc4 at DODGETHIS.ORG  Thu Jul 10 23:00:20 2003
From: wpc4 at DODGETHIS.ORG (William Curley)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam? {Scanned}
In-Reply-To: <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>
References: <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>
Message-ID: <1057874420.a529bfbd4624c@mail.cynical.us>

For a test Virus email you can head to
http://www.eicar.org/anti_virus_test_file.htm Industry has organized a fake
virus file that is detected by virus scanners.


Quoting "Michele Neylon:: Blacknight Solutions" <michele@BLACKNIGHTSOLUTIONS.COM>:

> > Want 13506473 bytes (and growing) of guaranteed-to-be-spam? That's
> > 1806 (and counting) separate pieces. I can gzip it up and
> > ship it to anyone who wants it. Not, mind you, that there's a
> > spam shortage.
> > It gzips down to a tidy 4193099 bytes.
>
> ROFL
>
> This must be the only mailing list where people swap spam and virii and
> compare they're quality :-)
>
> To test some SPAM and virus logging we used a few junk email addresses with
> a dialup ISP and used fetchmail to pass them through the system. The scary
> thing was that over 95% of the mail from one account was spam and virii!!
>
> M
>
>
> #########################################################
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact the
> sender and delete this message immediately.  Disclosure, copying
> or other action taken in respect of this email or in
> reliance to it is prohibited.
>

From mikea at MIKEA.ATH.CX  Thu Jul 10 23:26:59 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>; from
              michele@BLACKNIGHTSOLUTIONS.COM on Thu, Jul 10,
              2003 at 11:56:49PM +0200
References: <20030710162652.A34019@mikea.ath.cx>
            <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>
Message-ID: <20030710172659.B34446@mikea.ath.cx>

On Thu, Jul 10, 2003 at 11:56:49PM +0200, Michele Neylon:: Blacknight Solutions wrote:
> > Want 13506473 bytes (and growing) of guaranteed-to-be-spam? That's
> > 1806 (and counting) separate pieces. I can gzip it up and
> > ship it to anyone who wants it. Not, mind you, that there's a
> > spam shortage.
> > It gzips down to a tidy 4193099 bytes.
>
> ROFL
>
> This must be the only mailing list where people swap spam and virii and
> compare they're quality :-)

Erm ... no, actually. But I can't discuss the other list, because it
mostly is composed of mail and system administrators from large
companies and corporations.

For that matter, if I were to send just three days spam from my day
job, it would be close to 50 megabytes unzipped. But I think it's
better not to do that. And I can send something like 20 megabytes of
worm traffic, but again I think it's better not to.

> To test some SPAM and virus logging we used a few junk email addresses with
> a dialup ISP and used fetchmail to pass them through the system. The scary
> thing was that over 95% of the mail from one account was spam and virii!!

No surprise there; there's a vanishingly-small probability that it
was *not* infected by a worm -- probably one of the recent generation,
such as SoBig.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From christopher.albert at MCGILL.CA  Thu Jul 10 22:29:00 2003
From: christopher.albert at MCGILL.CA (Christopher Albert)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <06EE2C86D3DAD5119A6C0060943F3C97055E7088@tormail1.algorithmics.com>
References: <06EE2C86D3DAD5119A6C0060943F3C97055E7088@tormail1.algorithmics.com>
Message-ID: <3F0DDA9C.9080807@mcgill.ca>

> :-)  Seriously - I need to test a mailscanner subdomain so I need some
> spam.
> :-)
>
> I've clicked a few unsubscribe links (modified to reflect the filter
> testing
> domain), but now I'm out of spam, so any suggestions (specifics, not
> general
> concepts - got a link?) would be appreciated.
>
> Address that wants spam: tgfurnish@public.herff-jones.com
>
> --
> Trever
>
There is:
http://www.spamarchive.org/

with 1.3Gs of spam in ftp archives (>225K emails).

Chris

From cparker at SWATGEAR.COM  Thu Jul 10 23:34:08 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE2B7D36@ati-ex-01.ati.local>

Christopher Albert <mailto:christopher.albert@MCGILL.CA> wrote:

> > :-)  Seriously - I need to test a mailscanner subdomain so I need
> > some spam. :-)
>
> There is:
> http://www.spamarchive.org/
> 
> with 1.3Gs of spam in ftp archives (>225K emails).

Hmm.. cool resource.


Chris.

p.s. please trim your email kthxbye!


From mkettler at EVI-INC.COM  Thu Jul 10 23:33:40 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <1057874420.a529bfbd4624c@mail.cynical.us>
References: <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>
            <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>
Message-ID: <5.2.1.1.0.20030710182934.01c1bbf8@xanadu.evi-inc.com>

At 03:00 PM 7/10/2003 -0700, you wrote:
>For a test Virus email you can head to
>http://www.eicar.org/anti_virus_test_file.htm Industry has organized a fake
>virus file that is detected by virus scanners.


On a similar note SpamAssassin has a GTUBE (generic test for unsolicited
bulk email) which is a rule which adds +100 to an email. It's a great way
to do a quick check to ensure that SA is running and will actually tag
email. It's not a comprehensive check, but it certainly answers the
question of "is this thing on?" very quickly.

Simply draft an email with the following string in the body, convert all
the lower-case letters to upper-case, and run it through spamassassin:

xjs*C4JDBQADN1.NSBN3*2IDNEN*gtube-standard-ANTI-UBE-TEST-EMAIL*C.34X

Since I did not want this email to trigger the test rule, I converted the
first 3 characters and the "gtube-standard" part to lower-case. If you want
to make it work, all the letters need to be upper-case as the rule is case
sensitive.

From mikea at MIKEA.ATH.CX  Thu Jul 10 23:39:48 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <5.2.1.1.0.20030710182934.01c1bbf8@xanadu.evi-inc.com>; from
              mkettler@EVI-INC.COM on Thu, Jul 10, 2003 at 06:33:40PM -0400
References: <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>
            <200307102155.h6ALtrA17903@camelot.blacknightsolutions.com>
            <1057874420.a529bfbd4624c@mail.cynical.us>
            <5.2.1.1.0.20030710182934.01c1bbf8@xanadu.evi-inc.com>
Message-ID: <20030710173948.B34631@mikea.ath.cx>

On Thu, Jul 10, 2003 at 06:33:40PM -0400, Matt Kettler wrote:
> At 03:00 PM 7/10/2003 -0700, you wrote:
> >For a test Virus email you can head to
> >http://www.eicar.org/anti_virus_test_file.htm Industry has organized a fake
> >virus file that is detected by virus scanners.
>
>
> On a similar note SpamAssassin has a GTUBE (generic test for unsolicited
> bulk email) which is a rule which adds +100 to an email. It's a great way
> to do a quick check to ensure that SA is running and will actually tag
> email. It's not a comprehensive check, but it certainly answers the
> question of "is this thing on?" very quickly.

Looks like it adds +1000. That's *impressive*!

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From webmaster at ORBITEL.COM  Fri Jul 11 04:44:10 2003
From: webmaster at ORBITEL.COM (Orbitel Webmaster)
Date: Thu Jan 12 21:18:55 2006
Subject: User specific "Spam Actions"
Message-ID: <200307101511.KAA30556@mail.int.orbitel.com>

Take a look at the files in /etc/MailScanner/rules

In a nutshelll go to the line to want to vary per user in 
mailscanner.conf.  Instead of putting it's value in put 
in "/etc/MailScanner/rules/rulefilenameyourwant.rules"

Then use emacs/vi/pico to edit that file name.  I do my user specific 
spam actions based on destination e-mail address.  In my case, this 
file is used to determine wether the spam check is enabled or not.  
In this case, if they are user1 or user2 spam checking is enabled.  
Everyone else, default, has it off.  Hope that helps.

#syntax   e-mail      yes/no/or any other option depending on the 
#mailscanner.conf line
To: user1@domain.com   yes
To: user2@domain.com   yes
FromOrTo:   default   no



-------- Original Message --------

==> From: Dene Ulmschneider <dene@DATATECHIE.COM>
==> Date: Wed, 9 Jul 2003 09:54:30 -0400

Hello all-

I am running RHL 7.3 and MS version 4.14-9 and Sendmail.

I am trying to setup user specific "Spam Actions" and could use a 
little help. I know that the spam action setting can point to a file 
with rule sets in it but I am not clear on the format of the file.

Can anyone help me out with the format of the file? If a user wants 
to delete spam and high spam - what should the file look like?

Does anyone have a sample file that they can forward to give me a 
better idea on how to set this up??

 Thank You

Dene Ulmschneider Data Techie Inc.
-----------------------------------
-------------------------------------- office:         718.738.8859 
cell:           646.996.2976 email:          dene@datatechie.com 
pager mail:     denenow@datatechie.com website:        
www.datatechie.com
---------------------------------------------------
---------------------- "Data Techie - Always there to protect you!"


From webmaster at ORBITEL.COM  Fri Jul 11 10:43:44 2003
From: webmaster at ORBITEL.COM (Orbitel Webmaster)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
Message-ID: <200307102111.QAA00830@mail.int.orbitel.com>

Take a peice of spam off another e-mail account (IE: Hotmail) and 
forward it to the target account.  I've sent you one you can re-use 
and recycle.


-------- Original Message --------

==> From: "Furnish, Trever G" <TGFurnish@HERFF-JONES.COM>
==> Date: Thu, 10 Jul 2003 16:00:36 -0500

:-)  Seriously - I need to test a mailscanner subdomain so I need 
some spam. :-)

I've clicked a few unsubscribe links (modified to reflect the filter 
testing domain), but now I'm out of spam, so any suggestions 
(specifics, not general concepts - got a link?) would be appreciated.

Address that wants spam: tgfurnish@public.herff-jones.com

-- Trever


From mike at CAMAROSS.NET  Thu Jul 10 23:40:02 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C0291@inex1.herffjones.hj-int>
Message-ID: <008f01c34734$337a2420$9c01a8c0@home.middlefinger.net>

I'll make that email address the forward action on my High Scoring Spam on a
couple of machines.  If you want this, tell me when to turn it off :)

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Furnish, Trever G
Sent: Thursday, July 10, 2003 4:01 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: How can I get some spam?


:-)  Seriously - I need to test a mailscanner subdomain so I need some spam.
:-)

I've clicked a few unsubscribe links (modified to reflect the filter testing
domain), but now I'm out of spam, so any suggestions (specifics, not general
concepts - got a link?) would be appreciated.

Address that wants spam: tgfurnish@public.herff-jones.com

--
Trever


From TGFurnish at HERFF-JONES.COM  Fri Jul 11 00:19:49 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:55 2006
Subject: Where do I start debugging?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C0714@inex1.herffjones.hj-int>

Ok, so now I have some spam coming to my filtering domain, but mailscanner
is behaving unexpectedly and I'm not sure where to look in order to figure
out why.

I have Log Spam = yes and logging is showing up in syslog, but I'm hoping
there's more logging going somewhere else I'm not aware of.

I've discovered (by reversing the my work in order till everything worked
again) that these two statements in MailScanner.conf cause it to do bad
things - messages seem to disappear into the void.  Perhaps I should mention
that this is version 4.21-9.

Any suggestions?

Spam Actions = attachment
High Scoring Spam Actions = attachment

If I change those back to the default (deliver), then I successfully get
message subjects tagged as spam, but I'd prefer to have MailScanner
repackage the messages as attachments.

When I have the actions set to 'attachment', sometimes I even get the syslog
message that says "actions are attachment".  Usually I just get "Spam
Checks: Starting" and "Virus and Content Scanning: Starting", followed by
"Uninfected: Delivered" and then sendmail's log entry stating it delivered
the message.

Most troubling is that even though sendmail logs an entry stating it handed
off the message, the message doesn't arrive.  Not even sure how that could
be related to mailscanner...

-t.

From TGFurnish at HERFF-JONES.COM  Fri Jul 11 00:24:45 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C029B@inex1.herffjones.hj-int>

LOL - Turn it off now?

UNCLE!!!

Talk about "ask and ye shall receive"!!!  I've gotten enough. :-)  Thanks,
all.  Now if only I hadn't posted to all those usenet groups already. :-)

>-----Original Message-----
>From: Mike Kercher [mailto:mike@CAMAROSS.NET]
>Sent: Thursday, July 10, 2003 5:40 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: How can I get some spam?
>
>
>I'll make that email address the forward action on my High
>Scoring Spam on a
>couple of machines.  If you want this, tell me when to turn it off :)
>
>Mike
>
>
>-----Original Message-----
>From: MailScanner mailing list
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Furnish, Trever G
>Sent: Thursday, July 10, 2003 4:01 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: How can I get some spam?
>
>
>:-)  Seriously - I need to test a mailscanner subdomain so I
>need some spam.
>:-)
>
>I've clicked a few unsubscribe links (modified to reflect the
>filter testing
>domain), but now I'm out of spam, so any suggestions
>(specifics, not general
>concepts - got a link?) would be appreciated.
>
>Address that wants spam: tgfurnish@public.herff-jones.com
>
>--
>Trever
>

From gerry at DORFAM.CA  Fri Jul 11 00:28:37 2003
From: gerry at DORFAM.CA (Gerry Doris)
Date: Thu Jan 12 21:18:55 2006
Subject: Virus Update Scripts with Timeouts
Message-ID: <Pine.LNX.4.44.0307101859140.5091-300000@tiger.dorfam.ca>

I use both F-Prot and ClamAV with MailScanner.  There are scripts for each
of these virus scanners which by default are run hourly to check for new
virus definition files.  Unfortunately, if the script is unable to
complete then MailScanner will cease processing mail until the problem is
corrected.  Mail still is received but nothing is scanned and processed
for delivery.

I have modified the two update scripts to add a timeout (default=15sec).
If the script has not completed the connection to the download site before
the timeout the script is aborted and MailScanner is given back control.

I posted the ClamAV script about a week ago.  Nothing has really changed
in this version other than I cleaned up my coding (I'm a long ways from
being a programmer!).

I added the timeout code in the F-Prot script and fixed a problem in the
original BailOut sub code that prevented logging status to the syslog.

If you choose to use these scripts they need to be placed in the
/usr/lib/MailScanner directory.  I suggest you backup the original
scripts incase you want to go back to them.

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer
-------------- next part --------------
#!/usr/bin/perl
#
#   MailScanner - SMTP E-Mail Virus Scanner
#   Copyright (C) 2002  Julian Field
#
#   $Id: f-prot-autoupdate,v 1.3.2.5 2003/06/07 17:55:00 jkf Exp $
#
#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 2 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program; if not, write to the Free Software
#   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#
#   The author, Julian Field, can be contacted by email at
#      Jules@JulianField.net
#   or by paper mail at
#      Julian Field
#      Dept of Electronics & Computer Science
#      University of Southampton
#      Southampton
#      SO17 1BJ
#      United Kingdom
#

$SIG{ALRM} = sub { die "timeout" };        # Setup alarm call
use Sys::Syslog;
use IO::File;
# Stop syslogd from needing external access (or -r)
eval { Sys::Syslog::setlogsock('unix'); };

####################################
#
# You can set your HTTP proxy server / web-cache here if you want to,
# otherwise you will have to set it in the environment or wget's
# startup file.
# If you don't want to specify it here, comment out the next line.
#
#$HttpProxy  = 'www-cache.soton.ac.uk:3128';
#$FtpProxy   = '';
#
####################################

$FProtRoot  = "/usr/local/f-prot";

# N.B. TempDir DIRECTORY WILL BE CLEARED so
# you *really* don't want to share it with
# anything else.
$TempDir    = "$FProtRoot/tmp";
$DefDir     = $FProtRoot;
#$FallbackServer = 'http://updates.f-prot.com/files/';
$FallbackServer = 'ftp://ftp.f-prot.com/pub/';

$LockFile = "/tmp/FProtBusy.lock";

$LOCK_SH = 1;
$LOCK_EX = 2;
$LOCK_NB = 4;
$LOCK_UN = 8;

$cron = 0;
$quiet = 0;
$updated = 0;
$FProtIsLocked = 0;
$HaveDownloadedSign = 0;
$TmpFile = "tmp-web";
$HttpReturn = 10;
$TIMEOUT = 10;                             #Default Timeout in sec's

#
# Check command-line parameters
#
foreach (@ARGV) {
  if (/cron/i) {
    $cron = 1;
  } elsif (/quiet/i) {
    $quiet = 1;
  } else {
    BailOut("Invalid command-line option \"$_\"");
  }
}
# If they have specified an http/ftp proxy server / web-cache, then use it
$ENV{'http_proxy'} = $HttpProxy if $HttpProxy;
$ENV{'ftp_proxy'}  = $FtpProxy  if $FtpProxy;

#
# Check if TempDir exists and is a directory
#
stat($TempDir);
if (-e _) {
  BailOut("$TempDir needs to be a directory") if ! -d _;
} else {
  mkdir $TempDir, 0700 or BailOut("Could not create $TempDir directory, $!");
}
# Check file permissions of TempDir are correct
chmod 0700, $TempDir
  or BailOut("Could not set perms of $TempDir. Check you own it");
CleanTempDir(); # Clean up the contents of TempDir

#
# Check we can find all the external programs we need
#
for $program (qw/cp grep head wget unzip/) {
  $result = system("$program --version < /dev/null > /dev/null 2>&1");
  BailOut("Could not find $program on your path. Please install it " .
          "or fix your path") if $result==127;
}

#
# Download update information from the update server
#

eval {
   alarm("$TIMEOUT");                       #Set timeout in $TIMEOUT sec's

   $result = system("wget --output-document=$TempDir/$TmpFile --tries=3 " .
                    "'http://updates.f-prot.com/cgi-bin/check-updates?" .
                    "protocol=1&run_as=check_updates' > /dev/null 2>&1");
   alarm(0);                                #Turn off alarm
};

BailOut("F-Prot updater timed out. ") if $@ =~ /timeout/ ;

BailOut("wget command failed. You need the latest version installed, $!")
  if $result==127;
BailOut("Updates download from http://updates.f-prot.com failed. Suspect server could not be reached, $!")
  if $result!=0;
# Get HTTP return value from checking for updates
open(TEMPFILE, "$TempDir/$TmpFile")
  or BailOut("Could not read temp file $TmpFile, $!");
$HttpReturn = <TEMPFILE>;
chomp $HttpReturn;
$HttpReturn =~ s/\s*$//g;
if ($HttpReturn!=2) {
  BailOut("Invalid parameters used in http URL, exiting, $!") if $HttpReturn==3;
  BailOut("Invalid protocol used in http URL, exiting, $!")   if $HttpReturn==4;
  BailOut("Server error on remote machine, exiting, $!")      if $HttpReturn==5;
  BailOut("Unknown error while downloading update information, " .
          "do you need to specify your HTTP/FTP proxy / web-cache at " .
          "the top of this script? Exiting, $!");
}

#
# Read the file once to pull out the ftp URL of the update server
#
while(<TEMPFILE>) {
  chomp;
  next unless s/^S://;
  # Delete trailing newlines and stuff like that
  s/\s*$//g;
  $Server = $_;
}
close(TEMPFILE);
print STDERR "FTP address for retrieving files is $Server\n"
  unless $quiet || $cron;

#
# Lock out all other users of F-Prot until update is complete.
#
&LockFProt();

#
# Now read and compare checksums of the files on the update server and
# the local def files.
#
open(TEMPFILE, "$TempDir/$TmpFile");
while(<TEMPFILE>) {
  chomp;
  s/\s*$//g; # Delete trailing whitespace (^M and such like)
  next unless /^C/;
  next unless /DEF=/;
  s/^[^:]*://; # Delete everything up to and including ":"
  ($FileToCheck, $RemoteChecksum) = split(/=/, $_, 2);

  $FileChecksum = Checksum("$DefDir/$FileToCheck");

  BailOut("$FProtRoot/checksum was not found. It should be in your " .
          "F-Prot package, $!") if $FileChecksum==127;

  # Current file different from remote file?
  if ($FileChecksum ne $RemoteChecksum) {
    print STDERR "F-Prot signature file update script\n"
      unless $updated || $quiet;
    print STDERR "There is a new version of $FileToCheck, starting download.\n"
      unless $quiet;
    $updated = 1;
    # Download it from the server
    DownloadFile($Server, $FileToCheck);

    # Check we downloaded the file we wanted
    $FileChecksum = Checksum("$TempDir/$FileToCheck");
    if ($FileChecksum eq $RemoteChecksum) {
      # Copy file from temp dir to f-prot dir
      system("cp $TempDir/$FileToCheck $FProtRoot");
      print STDERR "Updated $FileToCheck.\n" unless $quiet;
    } else {
      # If not, then try fallback server instead
      DownloadFile($FallbackServer, $FileToCheck);

      # If that fails too, then error
      $FileChecksum = Checksum("$TempDir/$FileToCheck");
      if ($FileChecksum eq $RemoteChecksum) {
        # Copy file from temp dir to f-prot dir
        system("cp $TempDir/$FileToCheck $FProtRoot");
        print STDERR "Updated $FileToCheck from fallback server.\n"
          unless $quiet;
      } else {
        BailOut("Could not find correct version of $FileToCheck, exiting, $!");
      }
    }
  } else {
    print STDERR "File $FileToCheck is already up to date.\n"
      unless $quiet || $cron;
  }
}

if ($updated) {
  print STDERR "Update completed.\n" unless $quiet;
} else {
  print STDERR "Nothing to be done.\n" unless $cron;
}

# Clean up and exit.
CleanTempDir();
&UnlockFProt();


Sys::Syslog::openlog("F-Prot autoupdate", 'pid, nowait', 'mail');
Sys::Syslog::syslog('info', $updated?"F-Prot successfully updated.":"F-Prot did not need updating.");
Sys::Syslog::closelog();
exit 0;

#########################################################################

#
# Clean up the contents of TempDir
#
sub CleanTempDir {
  opendir(TEMPDIR, $TempDir)
    or BailOut("Could not read directory $TempDir, $!");
  foreach (readdir(TEMPDIR)) {
    next if /^\.\.?$/; # Skip . and ..
    unlink "$TempDir/$_";
  }
  closedir(TEMPDIR);
}

# Find the checksum of a given filename
sub Checksum {
  my($Filename) = @_;
  my($FileChecksum, $Result);

  # Catch case where file does not exist
  return 0 unless -f $Filename;

  if (-x "$FProtRoot/checksum") {
    $FileChecksum = `$FProtRoot/checksum $Filename 0`;
    $Result = $?;
    chomp $FileChecksum;
    $FileChecksum =~ s/^[^=]*=//; # Chop off up to and including "="

    BailOut("$FProtRoot/checksum was not found. It should be in your " .
            "F-Prot package, $!") if $Result==127;
    BailOut("Unknown fatal error calling \"checksum\", exiting, $!") if $Result;

    return $FileChecksum;
  } else {
    return create_compare_string_for_defs($Filename);
  }
}

# Perl code for new version of checksum
sub create_compare_string_for_defs
{
    my ($filename) = @_;

    if (my $file = new IO::File $filename)
    {
        my $buff = '';
        return undef if ($file->read($buff, 32) != 32);

        # Get file size
        my @fstat = $file->stat();
        my $fsize = $fstat[7];

        $file->close();
        return uc( unpack('H*', $buff) . sprintf("%8.8X", $fsize) );
    }
    return undef;
}

sub DownloadFile {
  my($host, $file) = @_;
  my($result);

  if ($file =~ /^SIGN/) {
    if (!$HaveDownloadedSign) {
      $HaveDownloadedSign = 1;
      chdir $TempDir;
      Fetch($host, 'fp-def.zip');
      print STDERR "Download completed.\n" unless $quiet;
      $result = system("unzip -o fp-def.zip </dev/null >/dev/null 2>&1");
      BailOut("Fatal error while unzipping fp-def.zip, $!") if ($result>>8);
    }
  } else {
    chdir $TempDir;
    Fetch($host, 'macrdef2.zip');
    print STDERR "Download completed.\n" unless $quiet;
    $result = system("unzip -o macrdef2.zip </dev/null >/dev/null 2>&1");
    BailOut("Fatal error while unzipping macrdef2.zip, $!") if ($result>>8);
  }
}

sub Fetch {
  my($ip, $filename) = @_;
  my($r);
  
eval {
   alarm("$TIMEOUT");                       #Alarm timeout in $TIMEOUT sec's

   $r = system("wget --passive-ftp --tries=3 $ip$filename > /dev/null 2>&1");
  
   alarm(0);                                #No timeout - turn off alarm
};
   
BailOut("F-Prot updater timed out. ") if $@ =~ /timeout/ ;

  if ($r>>8) {
    # Download failed so try fallback server
    BailOut("Download of $ip$filename failed, exiting, $!")
      if $ip eq $FallbackServer;
    Fetch($FallbackServer, $filename);
  }
}



sub BailOut {
	&UnlockFProt();
	Sys::Syslog::openlog("F-Prot autoupdate", 'pid, nowait', 'mail');
	Sys::Syslog::syslog('err', @_);
	Sys::Syslog::closelog();
	warn "@_\n";
	chdir $FProtRoot or die "Cannot cd $FProtRoot, $!";
	exit 1;
}

sub LockFProt {
	open(LOCK, ">$LockFile") or return;
	flock(LOCK, $LOCK_EX);
	print LOCK "Locked for updating F-Prot virus files by $$\n";
	$FProtIsLocked = 1;
}

sub UnlockFProt {
	return unless $FProtIsLocked;
	print LOCK "Unlocked after updating F-Prot virus files by $$\n";
	unlink $LockFile;
	flock(LOCK, $LOCK_UN);
	close LOCK;
}
-------------- next part --------------
#!/usr/bin/perl

use Sys::Syslog;

# If you have a web proxy or cache server, put its value in the next line
# in the syntax "full.host.name:port".
$HTTPproxy = "";

$LogFile = "/tmp/ClamAV.update.log";

$ClamUpdateCommand = "/usr/local/bin/freshclam";

$LockFile = "/tmp/ClamAVBusy.lock";

$TIMEOUT = 10;                             #Timeout in sec's

$LOCK_SH = 1;
$LOCK_EX = 2;
$LOCK_NB = 4;
$LOCK_UN = 8;

eval { Sys::Syslog::setlogsock('unix'); }; # This may fail!

Sys::Syslog::openlog("ClamAV-autoupdate", 'pid, nowait', 'mail');

$SIG{ALRM} = sub { die "timeout" };        # Setup alarm

eval {
   alarm("$TIMEOUT");                      #Update timeout in $TIMEOUT sec's

   if (-x $ClamUpdateCommand) {
      &LockClamAV();
      $Command = "$ClamUpdateCommand --quiet -l $LogFile";
      $Command .= " --http-proxy $HTTPproxy" if $HTTPproxy;
      $retval=system($Command)>>8;
   }
   alarm(0);                                #Turn off alarm
};

   if ($@ =~ /timeout/) {
   &UnlockClamAV();         
   Sys::Syslog::syslog('err', "ClamAV updater timed out");
   Sys::Syslog::closelog();
   exit 0;
   } 

&UnlockClamAV();
if ($retval == 0 ) {
   Sys::Syslog::syslog('info', "ClamAV updated");
   }
  elsif ($retval == 1 ) {
   Sys::Syslog::syslog('info', "ClamAV did not need updating");
  } else {
   Sys::Syslog::syslog('err', "ClamAV updater failed");
}

Sys::Syslog::closelog();
exit 0;


sub LockClamAV {
	open(LOCK, ">$LockFile") or return;
	flock(LOCK, $LOCK_EX);
	print LOCK "Locked for updating ClamAV definitions by $$\n";
}

sub UnlockClamAV {
	print LOCK "Unlocked after updating ClamAV definitions by $$\n";
	unlink $LockFile;
	flock(LOCK, $LOCK_UN);
	close LOCK;
}
From kevins at BMRB.CO.UK  Fri Jul 11 00:29:44 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:55 2006
Subject: Where do I start debugging?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175DB6@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175DB6@pascal.priv.bmrb.co.uk>
Message-ID: <1057879784.4582.15.camel@bach.kevinspicer.co.uk>

Spam Actions = attachment
High Scoring Spam Actions = attachment

Its not clear in the docs, but you also need to specify the deliver
action, i.e.

Spam Actions = attachment deliver
High Scoring Spam Actions = attachment deliver




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From raymond at PROLOCATION.NET  Fri Jul 11 00:30:30 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:55 2006
Subject: Virus Update Scripts with Timeouts
In-Reply-To: <Pine.LNX.4.44.0307101859140.5091-300000@tiger.dorfam.ca>
Message-ID: <Pine.LNX.4.44.0307110129520.1803-100000@mailbox.prolocation.net>

Julian,

> I use both F-Prot and ClamAV with MailScanner.  There are scripts for each
> of these virus scanners which by default are run hourly to check for new
> virus definition files.  Unfortunately, if the script is unable to
> complete then MailScanner will cease processing mail until the problem is
> corrected.  Mail still is received but nothing is scanned and processed
> for delivery.
>
> I have modified the two update scripts to add a timeout (default=15sec).
> If the script has not completed the connection to the download site before
> the timeout the script is aborted and MailScanner is given back control.

Once you get back, could you adopt this for the other update scripts also ?

Bye,
Raymond.

From TGFurnish at HERFF-JONES.COM  Fri Jul 11 00:31:02 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:55 2006
Subject: Does this mean something's broken?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C029C@inex1.herffjones.hj-int>

Um, can I safely assume that the following headers should not appear
together on a message, especially one that isn't marked as spam?

X-MailScanner: Found to be clean, Found to be clean
X-MailScanner-SpamCheck: spam, spamcop.net, SpamAssassin (score=7.791,
        required 5.8, BAYES_99 3.01[...snip...]

I'm refering to the fact that the X-MailScanner header says "clean, clean"
even though the spamcheck header says "score=7.791, required 5.8".

If the score is hirer than "required", doesn't that mean it's spam?

-t.

From TGFurnish at HERFF-JONES.COM  Fri Jul 11 00:37:31 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:55 2006
Subject: Where do I start debugging?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C029D@inex1.herffjones.hj-int>

D'OH!!!  Thanks. :-)

>-----Original Message-----
>From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
>Sent: Thursday, July 10, 2003 6:30 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Where do I start debugging?
>
>
>Spam Actions = attachment
>High Scoring Spam Actions = attachment
>
>Its not clear in the docs, but you also need to specify the deliver
>action, i.e.
>
>Spam Actions = attachment deliver
>High Scoring Spam Actions = attachment deliver
>
>
>
>
>BMRB International
>http://www.bmrb.co.uk
>+44 (0)20 8566 5000
>_________________________________________________________________
>This message (and any attachment) is intended only for the
>recipient and may contain confidential and/or privileged
>material.  If you have received this in error, please contact the
>sender and delete this message immediately.  Disclosure, copying
>or other action taken in respect of this email or in
>reliance on it is prohibited.  BMRB International Limited
>accepts no liability in relation to any personal emails, or
>content of any email which does not directly relate to our
>business.
>

From kevins at BMRB.CO.UK  Fri Jul 11 00:41:00 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:55 2006
Subject: Does this mean something's broken?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175DBB@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175DBB@pascal.priv.bmrb.co.uk>
Message-ID: <1057880460.4582.20.camel@bach.kevinspicer.co.uk>

I'm refering to the fact that the X-MailScanner header says "clean,
clean"
even though the spamcheck header says "score=7.791, required 5.8".

Found to be clean really means no virus (or virus like exploits etc.)
found, nothing to do with spam.  The fact it says 'Found to be clean'
twice suggests it has been through two mailscanners, it may well be that
the spam header was added by the first MailScanner (not yours) and that
one is not configured to add Spam to the subject.  IIRC 5.8 isn't the
default score, so unless you've tweaked yours to this then it wasn't
added by you.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From richard_cipher at YAHOO.COM  Fri Jul 11 00:40:55 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:55 2006
Subject: Does this mean something's broken?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C029C@inex1.herffjones.hj-int>
Message-ID: <NHBBIDLEJBNNEMOPKJPNOEJKDBAA.richard_cipher@yahoo.com>

"Found to be clean" means that it's not infected with a virus.

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Furnish, Trever G
Sent: Thursday, July 10, 2003 5:31 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Does this mean something's broken?


Um, can I safely assume that the following headers should not appear
together on a message, especially one that isn't marked as spam?

X-MailScanner: Found to be clean, Found to be clean
X-MailScanner-SpamCheck: spam, spamcop.net, SpamAssassin (score=7.791,
        required 5.8, BAYES_99 3.01[...snip...]

I'm refering to the fact that the X-MailScanner header says "clean, clean"
even though the spamcheck header says "score=7.791, required 5.8".

If the score is hirer than "required", doesn't that mean it's spam?

-t.
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From mike at CAMAROSS.NET  Fri Jul 11 00:38:48 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:55 2006
Subject: Does this mean something's broken?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C029C@inex1.herffjones.hj-int>
Message-ID: <009301c3473c$6a666090$9c01a8c0@home.middlefinger.net>

What are your Spam Actions = 
and 
Sign Messages Already Processed = 
values set to?

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Furnish, Trever G
Sent: Thursday, July 10, 2003 6:31 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Does this mean something's broken?


Um, can I safely assume that the following headers should not appear
together on a message, especially one that isn't marked as spam?

X-MailScanner: Found to be clean, Found to be clean
X-MailScanner-SpamCheck: spam, spamcop.net, SpamAssassin (score=7.791,
        required 5.8, BAYES_99 3.01[...snip...]

I'm refering to the fact that the X-MailScanner header says "clean, clean"
even though the spamcheck header says "score=7.791, required 5.8".

If the score is hirer than "required", doesn't that mean it's spam?

-t.


From mikea at MIKEA.ATH.CX  Fri Jul 11 00:42:08 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:55 2006
Subject: Where do I start debugging?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C0714@inex1.herffjones.hj-int>;
              from TGFurnish@HERFF-JONES.COM on Thu, Jul 10,
              2003 at 06:19:49PM -0500
References: <8FFC76593085ED4A80D3601BC41EFCDF0C0714@inex1.herffjones.hj-int>
Message-ID: <20030710184208.A34916@mikea.ath.cx>

On Thu, Jul 10, 2003 at 06:19:49PM -0500, Furnish, Trever G wrote:
> Ok, so now I have some spam coming to my filtering domain, but mailscanner
> is behaving unexpectedly and I'm not sure where to look in order to figure
> out why.
>
> I have Log Spam = yes and logging is showing up in syslog, but I'm hoping
> there's more logging going somewhere else I'm not aware of.
>
> I've discovered (by reversing the my work in order till everything worked
> again) that these two statements in MailScanner.conf cause it to do bad
> things - messages seem to disappear into the void.  Perhaps I should mention
> that this is version 4.21-9.
>
> Any suggestions?
>
> Spam Actions = attachment
> High Scoring Spam Actions = attachment

This was discussed earlier this week; you need to to use
                    "attachment deliver"
to have the spam turned into an attachment *and* delivered.

> If I change those back to the default (deliver), then I successfully get
> message subjects tagged as spam, but I'd prefer to have MailScanner
> repackage the messages as attachments.
>
> When I have the actions set to 'attachment', sometimes I even get the syslog
> message that says "actions are attachment".  Usually I just get "Spam
> Checks: Starting" and "Virus and Content Scanning: Starting", followed by
> "Uninfected: Delivered" and then sendmail's log entry stating it delivered
> the message.
>
> Most troubling is that even though sendmail logs an entry stating it handed
> off the message, the message doesn't arrive.  Not even sure how that could
> be related to mailscanner...

Which of the two sendmails? The inbound sendmail or the outbound one?
How about a set of maillog lines showing complete processing of a
piece of E-mail, from A to Z?

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From TGFurnish at HERFF-JONES.COM  Fri Jul 11 00:43:18 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:55 2006
Subject: Does this mean something's broken?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C029E@inex1.herffjones.hj-int>

>-----Original Message-----
>From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
>Sent: Thursday, July 10, 2003 6:41 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Does this mean something's broken?
>
>
>I'm refering to the fact that the X-MailScanner header says "clean,
>clean"
>even though the spamcheck header says "score=7.791, required 5.8".
>
>Found to be clean really means no virus (or virus like exploits etc.)
>found, nothing to do with spam.  The fact it says 'Found to be clean'
>twice suggests it has been through two mailscanners, it may
>well be that
>the spam header was added by the first MailScanner (not yours) and that
>one is not configured to add Spam to the subject.  IIRC 5.8 isn't the
>default score, so unless you've tweaked yours to this then it wasn't
>added by you.

Ah - that explains it then.  Someone from the list redirecting some spam
they've already caught.  I wondered about the 5.8 but I'd never have
realized that was the reason it was different.

Thanks again, Mr. Spicer.

--
Trever

From mike at CAMAROSS.NET  Fri Jul 11 00:40:43 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C029B@inex1.herffjones.hj-int>
Message-ID: <009401c3473c$adf9b960$9c01a8c0@home.middlefinger.net>

I turned mine off :)



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Furnish, Trever G
Sent: Thursday, July 10, 2003 6:25 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: How can I get some spam?


LOL - Turn it off now?

UNCLE!!!

Talk about "ask and ye shall receive"!!!  I've gotten enough. :-)  Thanks,
all.  Now if only I hadn't posted to all those usenet groups already. :-)

>-----Original Message-----
>From: Mike Kercher [mailto:mike@CAMAROSS.NET]
>Sent: Thursday, July 10, 2003 5:40 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: How can I get some spam?
>
>
>I'll make that email address the forward action on my High Scoring Spam 
>on a couple of machines.  If you want this, tell me when to turn it off 
>:)
>
>Mike
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On 
>Behalf Of Furnish, Trever G
>Sent: Thursday, July 10, 2003 4:01 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: How can I get some spam?
>
>
>:-)  Seriously - I need to test a mailscanner subdomain so I need some 
>spam.
>:-)
>
>I've clicked a few unsubscribe links (modified to reflect the filter 
>testing domain), but now I'm out of spam, so any suggestions
>(specifics, not general
>concepts - got a link?) would be appreciated.
>
>Address that wants spam: tgfurnish@public.herff-jones.com
>
>--
>Trever
>


From TGFurnish at HERFF-JONES.COM  Fri Jul 11 00:52:34 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:18:55 2006
Subject: Where do I start debugging?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C0715@inex1.herffjones.hj-int>

>-----Original Message-----
>From: mikea [mailto:mikea@MIKEA.ATH.CX]
>Sent: Thursday, July 10, 2003 6:42 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Where do I start debugging?
>
>> Most troubling is that even though sendmail logs an entry
>> stating it handed
>> off the message, the message doesn't arrive.  Not even sure
>> how that could
>> be related to mailscanner...
>
>Which of the two sendmails? The inbound sendmail or the outbound one?
>How about a set of maillog lines showing complete processing of a
>piece of E-mail, from A to Z?
>
>Mike Andrews

Thanks - once I added deliver to the end of the actions, it's passing
messages through again.  Guess I should have done more than just skim the
old messages looking for this one.

I'm still a tad confused by the log entry made by sendmail though that
claims the message was delivered to the next mx server, but I'm going to
attribute that to confusion on my part and pretend it didn't happen unless I
bump into it again.

--
Trever

From cparker at SWATGEAR.COM  Fri Jul 11 01:32:06 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:18:55 2006
Subject: anyone noticing a rise in spam?
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE2B7D3A@ati-ex-01.ati.local>

Hello,

My boss said to me today "I've noticed that since you put in that spam filter [about 2 months ago] we've [himself and at least one other employee] been getting a lot more spam. Most of it gets marked as spam but there is definitely an increase. Can you find out why?"

Well my immediate reaction is that it's just coincidence and there's no other reason for it. But I thought I would survey the list and see if anyone else has any other ideas.

Our email addresses (except for maybe mine) are not plastered on the internet anymore than they used to be.

Any/all ideas welcome.


Thanks,
Chris. 


From forrie at FORRIE.COM  Fri Jul 11 01:48:30 2003
From: forrie at FORRIE.COM (Forrest Aldrich)
Date: Thu Jan 12 21:18:55 2006
Subject: anyone noticing a rise in spam?
In-Reply-To: <001BD19C96E6E64E8750D72C2EA0ECEE2B7D3A@ati-ex-01.ati.local >
Message-ID: <5.2.1.1.2.20030710204530.0312ce80@192.168.1.1>

SPAM is generally on the rise.   CNN had a commentary about it recently,
about how it's increasing.   I've noticed it here, too.

A friend of mine mentioned that some of the more sophisticated spammers
have been hijacking IP space and AS numbers.  For example, 9.0.0.0/8
belongs to IBM and is NEVER on a public network (so you can safely filter
that out), and some of the dot.gone companies have seen their IP space
hijacked.  It's getting to be quite a mess.

Speaking of which, anyone here see that infamous G-2 Resumes spam?   It's
by someone in a nearby city (Framingham, MA -- and rayprotech.com).

FWIW, I've been running spamass-milter with a rejection level of 10 (SA
score) and it's done wonders.



Forrest


At 08:32 PM 7/10/2003, Chris W. Parker wrote:
>Hello,
>
>My boss said to me today "I've noticed that since you put in that spam
>filter [about 2 months ago] we've [himself and at least one other
>employee] been getting a lot more spam. Most of it gets marked as spam but
>there is definitely an increase. Can you find out why?"
>
>Well my immediate reaction is that it's just coincidence and there's no
>other reason for it. But I thought I would survey the list and see if
>anyone else has any other ideas.
>
>Our email addresses (except for maybe mine) are not plastered on the
>internet anymore than they used to be.
>
>Any/all ideas welcome.
>
>
>Thanks,
>Chris.

From mikea at MIKEA.ATH.CX  Fri Jul 11 01:52:17 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:55 2006
Subject: anyone noticing a rise in spam?
In-Reply-To: <001BD19C96E6E64E8750D72C2EA0ECEE2B7D3A@ati-ex-01.ati.local>;
              from cparker@SWATGEAR.COM on Thu, Jul 10, 2003 at 05:32:06PM -0700
References: <001BD19C96E6E64E8750D72C2EA0ECEE2B7D3A@ati-ex-01.ati.local>
Message-ID: <20030710195217.A35733@mikea.ath.cx>

On Thu, Jul 10, 2003 at 05:32:06PM -0700, Chris W. Parker wrote:
> Hello,

> My boss said to me today "I've noticed that since you put in that
> spam filter [about 2 months ago] we've [himself and at least one other
> employee] been getting a lot more spam. Most of it gets marked as spam
> but there is definitely an increase. Can you find out why?"

> Well my immediate reaction is that it's just coincidence and there's
> no other reason for it. But I thought I would survey the list and see
> if anyone else has any other ideas.

> Our email addresses (except for maybe mine) are not plastered on the
> internet anymore than they used to be.

> Any/all ideas welcome.

See, among others, <http://www.tesp.com> for some graphs. The story
of Nadine also is of considerable interest, as it shows how addresses
get passed around.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From raymond at PROLOCATION.NET  Fri Jul 11 01:54:07 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:55 2006
Subject: anyone noticing a rise in spam?
In-Reply-To: <5.2.1.1.2.20030710204530.0312ce80@192.168.1.1>
Message-ID: <Pine.LNX.4.44.0307110252400.17778-100000@mailbox.prolocation.net>

Hi!

> A friend of mine mentioned that some of the more sophisticated spammers
> have been hijacking IP space and AS numbers.  For example, 9.0.0.0/8
> belongs to IBM and is NEVER on a public network (so you can safely filter
> that out), and some of the dot.gone companies have seen their IP space
> hijacked.  It's getting to be quite a mess.

On NANOG, one of the lists that network admins use there has been a lot
of talk about hijacked AS numbers and IP ranges. Its not only that
particular block you mention, but much more ...

Its a pain.

Bye,
Raymond.

From danieltan at shopnsave.com.sg  Fri Jul 11 03:50:47 2003
From: danieltan at shopnsave.com.sg (Daniel Tan)
Date: Thu Jan 12 21:18:55 2006
Subject: mail not moving in mqueue.in
Message-ID: <00af01c34757$3bafa700$3900a8c0@Daniel>

hi,
    recently had a major problem with my mail server and had to reinstall
everything from scratch again.been working till late last night and now i
brought the server back to my office and mailscanner seems unable to process
the emails in  mqueue.in

permissions....
drwxr-x---    2 root     mail         8192 Jul 11 10:36 mqueue
drwxr-x---    2 root     mail         8192 Jul 11 10:45 mqueue.in

any idea why?

i am using mailscanner-4.22-5 and spamassassin-2.53-1
with f-prot as the virus scanner

Regards,
Daniel Tan
67469188 Ext.665
DID: 68430665
MIS Department
Shop N Save Pte Ltd
: danieltan@shopnsave.com.sg

[This e-mail is confidential and may also be privileged. If you are not the
intended recipient, please delete it and notify us immediately; you should
not copy or use it for any purpose, nor disclose its contents to any other
person. Thank you.]

From tony.johansson at SVENSKAKYRKAN.SE  Fri Jul 11 07:43:38 2003
From: tony.johansson at SVENSKAKYRKAN.SE (Tony Johansson)
Date: Thu Jan 12 21:18:55 2006
Subject: MS Performance
Message-ID: <LISTSERV%2003071107433847@JISCMAIL.AC.UK>

>I am processing around 600.000 messages on two dual xeon machines, daily,
>with peaks to 800.000-1.000.000 daily. I think MS is doing just fine :)
>
>Most of the time its a matter of the test setup also that is limiting the
>figures. Also some tweaking on the machines wont harm...
>
>Bye,
>Raymond.

What MTA are you using? I recall an earlier post by Julian where he tested
exim vs sendmail on one of his test machines, getting 3 times the
throughput with exim.

I'm interested in what kind of performance people are getting with sendmail
and MS. I'm about to design a system built on redhat and sendmail which
will handle lots of relaying (500k-1mil email daily approx)

I'd rather use sendmail but if the performance gain with exim really is 3
to 1 that might be the road we haveto take.

regards, Tony

From giampiero.raschetti at POPSO.IT  Fri Jul 11 08:04:18 2003
From: giampiero.raschetti at POPSO.IT (Giampiero Raschetti)
Date: Thu Jan 12 21:18:55 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <20030710181244.GB32608@bud.cs.uky.edu>
References: <20030709023925.GA12072@bud.cs.uky.edu>
            <20030710181244.GB32608@bud.cs.uky.edu>
Message-ID: <3F0E6172.8090709@popso.it>

Thanks to your work now it works here too.

I had read the warning line about McAfee but I didn't understand if the links
referred where those where the program reside or those where it was working on.

Anyway till last running release it had always worked with the link active
without any problem.... so why not now ?

Anyway now I had changed this in MailScanner.conf
# Set where to unpack incoming messages before scanning them
Incoming Work Dir = /home1/spool/MailScanner/incoming

And it works great !!

Thanks again Paul.
Giampiero

Paul Linton wrote:
> Solved.  It was simply a matter of trusting the documentation.  I had
> read, and ignored, the note about McAfee and symbolic links.  So my
> /var/spool/MailScanner/incoming option was really somewhere else.  Since
> McAfee was running fine and seeing viruses I didn't think this was an issue.
>
> After a LOT of debugging I tracked it down to the following line(s):
>
> SweepViruses.pm: lines 976-978
>
>   # McAfee prints the whole path as opposed to
>   # ./messages/part so make it the same
>   $lastline =~ s/$BaseDir//;
>
> Since I will be trying to keep my .conf files fairly consistent across
> domains I would like to change that line to be more forgiving.  If anyone
> is interested drop me a line and maybe we can convince someone to incorporate
> the change.
>
> - Paul
>
> On Tue, Jul 08, 2003 at 10:39:25PM -0400, Paul Linton wrote:
>
>>I have a brand new install of MailScanner/Spamassassin/McAfee.  Most
>>seems to be working fine, with the exception of virus removal.  MailScanner
>>calls McAfee and sees the virus, but then happily sends the message on, virus
>>and all, no warning to the recipient, etc.  Did I miss something in the .conf
>>file?
>
> --
> Paul Linton      Systems Programmer       paul@cs.uky.edu
> UofK Department of Computer Science       (859) 257-3962


--
Best Regards
  __________________________________________________
|o                      Banca Popolare di Sondrio o|
|o                             Sistemi Innovativi o|
|o Ing.Giampiero Raschetti                        o|
|o tel: +39-0342-528876                  _   _   _o|
|o http://www.popso.it  _   _   _   _   / `-' `-' `.
|o _   _   _   _   _   / `-' `-' `-' `-'
`-' `-' `-' `-' `-' `-'

From raymond at PROLOCATION.NET  Fri Jul 11 08:06:04 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:55 2006
Subject: mail not moving in mqueue.in
In-Reply-To: <00af01c34757$3bafa700$3900a8c0@Daniel>
Message-ID: <Pine.LNX.4.44.0307110905360.19214-100000@mailbox.prolocation.net>

Hi!

> permissions....
> drwxr-x---    2 root     mail         8192 Jul 11 10:36 mqueue
> drwxr-x---    2 root     mail         8192 Jul 11 10:45 mqueue.in
>
> any idea why?

How about posting some logs ?

Bye,
Raymond.

From raymond at PROLOCATION.NET  Fri Jul 11 08:07:51 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:55 2006
Subject: MS Performance
In-Reply-To: <LISTSERV%2003071107433847@JISCMAIL.AC.UK>
Message-ID: <Pine.LNX.4.44.0307110906480.19214-100000@mailbox.prolocation.net>

Hi!

> >I am processing around 600.000 messages on two dual xeon machines, daily,
> >with peaks to 800.000-1.000.000 daily. I think MS is doing just fine :)
> >
> >Most of the time its a matter of the test setup also that is limiting the
> >figures. Also some tweaking on the machines wont harm...

> I'm interested in what kind of performance people are getting with sendmail
> and MS. I'm about to design a system built on redhat and sendmail which
> will handle lots of relaying (500k-1mil email daily approx)

This is sendmail.

> I'd rather use sendmail but if the performance gain with exim really is 3
> to 1 that might be the road we haveto take.

No, tests that i did showed sendmail is able to do about the same, but you
have to tweak sendmail a little for that.

Bye,
Raymond.

From raymond at PROLOCATION.NET  Fri Jul 11 08:54:05 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:55 2006
Subject: New f-prot minor update
Message-ID: <Pine.LNX.4.44.0307110951030.27844-100000@mailbox.prolocation.net>

Hi!

Got linux/MD5SUMS 380 1
Got linux/fp-linux-ws-4.1.1-1.i386.rpm.md5 63 0
Got linux/fp-linux-ws-4.1.1.tar.gz.md5 59 1
Got linux/fp-linux-ws.deb.md5 50 0
Got linux/fp-linux-ws.rpm.md5 50 0
Got linux/fp-linux-ws.tar.gz.md5 53 1
Got linux/fp-linux-ws_4.1.1-1_i386.deb.md5 63 0
Got linux/fp-linux-ws-4.1.1-1.i386.rpm 2095581 7
Got linux/fp-linux-ws-4.1.1.tar.gz 2105643 6
Got linux/fp-linux-ws_4.1.1-1_i386.deb 2091780 6

Seems to work just fine.

Bye,
Raymond.

From andersan at LTKALMAR.SE  Fri Jul 11 09:47:37 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:55 2006
Subject: Regarding striphtml....
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE65B@lkl63.ltkalmar.se>

Hi
Just got a mail from microsoft technet and the have been been stripped from
html.
When I look at the header it says
X-MailScanner-SpamCheck: ej spam, "not spam"
        SpamAssassin (Meddelande st?rre ?n maximal test storlek) "bigger
then maximal test size"

I its not spam dont that mean that it shouldnt do a "striphtml"
or could it be because the size was to big.
I guess the solution should be to whitelist microsoft mail then?

/Anders


From Kevin.Spicer at BMRB.CO.UK  Fri Jul 11 09:51:34 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:55 2006
Subject: Regarding striphtml....
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF70E@pascal.priv.bmrb.co.uk>

> I its not spam dont that mean that it shouldnt do a "striphtml"
> or could it be because the size was to big.
> I guess the solution should be to whitelist microsoft mail then?
> 
Maybe you are stripping html if it finds iframe/ object-codebase or form content?  (the convert dangerous html to text option)



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From andersan at LTKALMAR.SE  Fri Jul 11 09:55:16 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:18:55 2006
Subject: SV: Regarding striphtml....
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE65C@lkl63.ltkalmar.se>

> -----Ursprungligt meddelande-----
> Fr?n: Spicer, Kevin [mailto:Kevin.Spicer@BMRB.CO.UK] 
> Skickat: den 11 juli 2003 10:52
> Till: MAILSCANNER@JISCMAIL.AC.UK
> ?mne: Re: Regarding striphtml....
> 
> 
> > I its not spam dont that mean that it shouldnt do a "striphtml" or 
> > could it be because the size was to big. I guess the 
> solution should 
> > be to whitelist microsoft mail then?
> > 
> Maybe you are stripping html if it finds iframe/ 
> object-codebase or form content?  (the convert dangerous html 
> to text option)


Thanks, checked config and  
Convert Dangerous HTML To Text = yes
Damn, I was hoping not to have to start using rules to keep it as simple
as possible but I guess I might have to go there...

Thanks again


From maxsec at TOTALISE.CO.UK  Fri Jul 11 09:57:35 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:18:55 2006
Subject: anyone noticing a rise in spam?
In-Reply-To: <001BD19C96E6E64E8750D72C2EA0ECEE2B7D3A@ati-ex-01.ati.local>
References: <001BD19C96E6E64E8750D72C2EA0ECEE2B7D3A@ati-ex-01.ati.local>
Message-ID: <3F0E7BFF.10004@totalise.co.uk>

Chris W. Parker wrote:

> Hello,
>
> My boss said to me today "I've noticed that since you put in that spam filter [about 2 months ago] we've [himself and at least one other employee] been getting a lot more spam. Most of it gets marked as spam but there is definitely an increase. Can you find out why?"
>
> Well my immediate reaction is that it's just coincidence and there's no other reason for it. But I thought I would survey the list and see if anyone else has any other ideas.
>
> Our email addresses (except for maybe mine) are not plastered on the internet anymore than they used to be.
>
> Any/all ideas welcome.
>
>
> Thanks,
> Chris.
Chris

Yes its gone up rapidly over the last 6 months.

two years ago we had 250 users on email and around 2,500 emails per week
last year we had 200 users on email and around 7,000 emails per week
now we have 150 users on email and 24,000 emails per week. (85% of which
is spam).

yes the average number of emails per user is rising, but mostly I be
eating spam this year! The increase is almost purely spam.

--
martin
(at home)

From P.G.M.Peters at utwente.nl  Fri Jul 11 10:15:52 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:55 2006
Subject: How can I get some spam?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C0712@inex1.herffjones.hj-int>
References: <8FFC76593085ED4A80D3601BC41EFCDF0C0712@inex1.herffjones.hj-int>
Message-ID: <b10tgvsjkpbrchtulvsq4pmkb5tv1rttdi@4ax.com>

On Thu, 10 Jul 2003 16:57:54 -0500, you wrote:

>Well, yes, thanks, but I'm also hoping to test rbl lookups and I'm thinking
>that would be difficult if I'm sending the spam myself.

Use xx.countries.nerd.dk as your rbl. It lists all IPv4 addresses.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From dot at DOTAT.AT  Fri Jul 11 10:59:04 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:18:55 2006
Subject: Quick Exim question
In-Reply-To: <m2n.19aey5-000tQc@chiark.greenend.org.uk>
Message-ID: <E19augC-00039r-00@chiark.greenend.org.uk>

Mike Oliveri <moliveri@UTI.COM> wrote:
>
>Because my current config is only running with one config file, I only have
>one spool directory: /var/spool/exim/input/*  The new config files will
>have an input directory of /var/spool/exim.in/input/*, but of course they
>do not exist yet. The MailScanner Exim configure page says I should create
>all the subdirectories of ../input before running MailScanner.

MailScanner's much happier if all the directories it needs exist before it
starts. There's not much point in taking shortcuts. My Exim setup script does

        for exim in exim exim.in
        do
                for split in \
                    a b c d e f g h i j k l m \
                    n o p q r s t u v w x y z \
                    A B C D E F G H I J K L M \
                    N O P Q R S T U V W X Y Z \
                    0 1 2 3 4 5 6 7 8 9
                do
                        run mkdir -p /var/spool/$exim/input/$split
                done
                run chown -R exim:exim /var/spool/$exim
                run chmod -R 0750      /var/spool/$exim
        done

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
ST DAVIDS HEAD TO COLWYN BAY, INCLUDING ST GEORGES CHANNEL: WEST 4 LOCALLY 5,
VEERING NORTHWEST TO WEST 2 OR 3 LOCALLY 4. ISOLATED SHOWERS IN THE NORTH
OTHERWISE MAINLY FAIR. MAINLY GOOD. SLIGHT TO MODERATE.

From john at TRADOC.FR  Fri Jul 11 12:26:08 2003
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:18:55 2006
Subject: Virus Update Scripts with Timeouts
In-Reply-To: <Pine.LNX.4.44.0307101859140.5091-300000@tiger.dorfam.ca>
References: <Pine.LNX.4.44.0307101859140.5091-300000@tiger.dorfam.ca>
Message-ID: <2h7tgv47fou2pstqnigrap4ujd7n7tmgrt@tradoc.fr>

On Thu, 10 Jul 2003 19:28:37 -0400, Gerry Doris wrote:
> I have modified the two update scripts to add a timeout (default=15sec).
> If the script has not completed the connection to the download site before
> the timeout the script is aborted and MailScanner is given back control.

I've tried these new scripts here on a redhat 9 box - they work fine
if called directly from a shell prompt, but for some reason don't log
the usual updated / does not need updating information to the syslog
when called from Julian's cron.hourly script. Any ideas? 

John.

-- 
-- Over 2000 webcams from ski resorts around the world - http://www.snoweye.com/
-- Translate your technical documents and web pages    - http://www.tradoc.fr/


From myr at HTW-SAARLAND.DE  Fri Jul 11 12:46:34 2003
From: myr at HTW-SAARLAND.DE (Margit Meyer)
Date: Thu Jan 12 21:18:55 2006
Subject: Notify sender and postmaster
Message-ID: <LISTSERV%2003071112463467@JISCMAIL.AC.UK>

Hi all,

I' m using MailScanner 4.22-5 and I want to notify senders and postmaster if
a virus is sent or caught.
I made the following settings:

Notify Senders = yes
Send Notices = yes
Notices From = MailScanner
Notices To = postmaster@htw-saarland.de
Local Postmaster = postmaster@htw-saarland.de
%report-dir% = /opt/MailScanner/etc/reports/de
Sender Virus Report = %report-dir%/sender.virus.report.txt

But there are neither notifies to the senders nor to postmaster. No error
messages about not being able to send notifications appear in the syslog.

But the rest works fine :-))

What could be wrong?

Regards
Margit

From gerry at DORFAM.CA  Fri Jul 11 13:36:54 2003
From: gerry at DORFAM.CA (Gerry Doris)
Date: Thu Jan 12 21:18:55 2006
Subject: Virus Update Scripts with Timeouts
In-Reply-To: <2h7tgv47fou2pstqnigrap4ujd7n7tmgrt@tradoc.fr>
Message-ID: <Pine.LNX.4.44.0307110833520.5091-100000@tiger.dorfam.ca>

On Fri, 11 Jul 2003, John Wilcock wrote:

> On Thu, 10 Jul 2003 19:28:37 -0400, Gerry Doris wrote:
> > I have modified the two update scripts to add a timeout (default=15sec).
> > If the script has not completed the connection to the download site before
> > the timeout the script is aborted and MailScanner is given back control.
>
> I've tried these new scripts here on a redhat 9 box - they work fine
> if called directly from a shell prompt, but for some reason don't log
> the usual updated / does not need updating information to the syslog
> when called from Julian's cron.hourly script. Any ideas?
>
> John.

I'm using a Redhat 7.3 box and don't have RH 9 to test with.  When I run
"update_virus_scanners" from the command line I see the correct logging in
/var/log/maillog.  It also works correctly when run from the cron.hourly
script.

Perhaps someone with a RH 9 box can try them and let us know if it works
for them.

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer

From P.G.M.Peters at utwente.nl  Fri Jul 11 13:43:11 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:55 2006
Subject: Notify sender and postmaster
In-Reply-To: <LISTSERV%2003071112463467@JISCMAIL.AC.UK>
References: <LISTSERV%2003071112463467@JISCMAIL.AC.UK>
Message-ID: <64ctgvgpgfa0ri26ckvrkti8knuasg1c90@4ax.com>

On Fri, 11 Jul 2003 12:46:34 +0100, you wrote:

>Notify Senders = yes
>Send Notices = yes
>Notices From = MailScanner
                           ^^^^^^ No domain?

>Notices To = postmaster@htw-saarland.de
>Local Postmaster = postmaster@htw-saarland.de
>%report-dir% = /opt/MailScanner/etc/reports/de
>Sender Virus Report = %report-dir%/sender.virus.report.txt
>
>But there are neither notifies to the senders nor to postmaster. No error
>messages about not being able to send notifications appear in the syslog.

I have had this in another situation (not MS related) where the
mailserver did not accept the from-address because he knew it didn't
exist. Neither could he return a bounce because the address did not
exist.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From combs at magnet.fsu.edu  Fri Jul 11 14:58:13 2003
From: combs at magnet.fsu.edu (Tom Combs)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
Message-ID: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>

Hello,

  I'm not clear on the need for denying multiple filename extensions.
  It seems if an attachment contained a virus, it would be checked by
  the virus scanner and either caught or cleared regardless of the
  extension.  Does having multiply filename extensions somehow
  circumvent this process?

  I'm considering dropping this ruleset:

deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible filename hiding
                        Attempt to hide real filename extension


  Is this a mistake?

  Thanks for the help!    --Tom Combs


--
Tom Combs                                      E-mail: combs@magnet.fsu.edu
National High Magnetic Field Laboratory        Phone:  (850) 644-1657
1800 E. Paul Dirac Drive                       Tallahassee, FL 32310

From mikea at MIKEA.ATH.CX  Fri Jul 11 15:09:12 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>; from
              combs@magnet.fsu.edu on Fri, Jul 11, 2003 at 09:58:13AM -0400
References: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>
Message-ID: <20030711090912.A38157@mikea.ath.cx>

On Fri, Jul 11, 2003 at 09:58:13AM -0400, Tom Combs wrote:
> Hello,
>
>   I'm not clear on the need for denying multiple filename extensions.
>   It seems if an attachment contained a virus, it would be checked by
>   the virus scanner and either caught or cleared regardless of the
>   extension.  Does having multiply filename extensions somehow
>   circumvent this process?
>
>   I'm considering dropping this ruleset:
>
> deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible filename hiding
>                         Attempt to hide real filename extension
>
>
>   Is this a mistake?

I had to drop it at the day job, where we have lots of people sending
in files with names like IH35.Moore.C03-192045.wpd. Each piece of
that filename has meaning, and it's much less inconvenient to accept
the mild risk of passing multocomponent filenames than it is to force
the users to adhere to 8.3 names -- if I could even try to do so. I
know from 25 years here that any attempt to force that would be doomed
to spectacular failure.

But each installation is different, and others may differ with either
or both of us.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From howard at harper-adams.ac.uk  Fri Jul 11 15:21:20 2003
From: howard at harper-adams.ac.uk (Howard Robinson)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <20030711090912.A38157@mikea.ath.cx>
References: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>; from          
            combs@magnet.fsu.edu on Fri, Jul 11, 2003 at 09:58:13AM -0400
Message-ID: <200307111419.h6BEJqUr010191@blackhole.harper-adams.ac.uk>

On 11 Jul 03, at 9:09, mikea wrote:
Hello
I block all > single extensions and exe etc.
If users can't use sensible names that's their problem. A little
education can help and those that don't/won't understand are the
very ones that may run something nasty.
It would be better is if the hide know extensions in windows was
removed so that the true filename was always shown.

> On Fri, Jul 11, 2003 at 09:58:13AM -0400, Tom Combs wrote:
> > Hello,
> >
> >   I'm not clear on the need for denying multiple filename extensions. It
> >   seems if an attachment contained a virus, it would be checked by the
> >   virus scanner and either caught or cleared regardless of the
> >   extension.  Does having multiply filename extensions somehow
> >   circumvent this process?
> >
> >   I'm considering dropping this ruleset:
> >
> > deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible filename
> > hiding
> >                         Attempt to hide real filename extension
> >
> >
> >   Is this a mistake?
>
> I had to drop it at the day job, where we have lots of people sending in
> files with names like IH35.Moore.C03-192045.wpd. Each piece of that
> filename has meaning, and it's much less inconvenient to accept the mild
> risk of passing multocomponent filenames than it is to force the users to
> adhere to 8.3 names -- if I could even try to do so. I know from 25 years
> here that any attempt to force that would be doomed to spectacular
> failure.
>
> But each installation is different, and others may differ with either or
> both of us.
>
> --
> Mike Andrews
> mikea@mikea.ath.cx
> Tired old sysadmin since 1964




Regards

Howard Robinson
(Senior Technical Development Officer)
Harper Adams University College
Edgmond
Newport
Shropshire
TF10 8NB UK

E-mail: hrobinson@harper-adams.ac.uk
Tel.  : +44(0)1952 820280 Via switchboard
      : +44(0)1952 815253 Direct line
Fax.  : +44(0)1952 814783
College Web site http://www.harper-adams.ac.uk

From Antony at SOFT-SOLUTIONS.CO.UK  Fri Jul 11 15:21:45 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>
References: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>
Message-ID: <200307111421.h6BELoW02305@Beryl.Rockstone.co.uk>

On Friday 11 July 2003 2:58 pm, Tom Combs wrote:

> Hello,
>
>   I'm not clear on the need for denying multiple filename extensions.
>   It seems if an attachment contained a virus, it would be checked by
>   the virus scanner and either caught or cleared regardless of the
>   extension.  Does having multiply filename extensions somehow
>   circumvent this process?
>
>   I'm considering dropping this ruleset:
>
> deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible filename
> hiding Attempt to hide real filename extension
>
>   Is this a mistake?

I have removed this rule from my systems - I am happy simply to block the
explicit final extensions which I know can be dangerous.

I look at it this way:

1. If the final extension is on my 'blocked' list, the email gets blocked and
I don't care if there was a double extension.

2. If the final extension is not on my 'blocked' list, then allow the email,
because it's not going to do anything dangerous on a Windoze machine which
acts on that final extension anyway.

If anyone knows of a reason why this could be a dangerous policy, please tell
me :)

Regards,

Antony.

--

G- GIT/E d- s+:--(-) a+ C++++$ UL++++$ P+(---)>++ L+++(++++)$ !E W(-) N(-) o?
w-- O !M V+++(--) !PS !PE Y+ PGP+> t- tv@ b+++ DI++ D--- e++>+++ h++ r@? 5?
!X- !R K--?

From Peter.Bates at LSHTM.AC.UK  Fri Jul 11 15:27:22 2003
From: Peter.Bates at LSHTM.AC.UK (Peter Bates)
Date: Thu Jan 12 21:18:55 2006
Subject: Mailscanner + Postfix
Message-ID: <sf0ed76a.070@s-webmail.lshtm.ac.uk>

Hello all...

Bit slow to reply on this one, been a bit distracted...

>I am only a new person at this but on the face of it there would appear >to be two ways that my be better at doing this but I am not at all sure if >they would work with MailScanner.

>1 is to use the 'content_filter=' directive in /etc/postfix/main.cf. I would
>guess that this is a NO but thought I would ask!!

Yes. This is is a NO ;)

The Postfix content_filter explicitly works on the basis that the 'filter' re-injects mail into Postfix using SMTP. If you really want to do this, Amavis does it, but compared to MailScanner, Amavis is... well.

>2. Would it be possible to adapt the process used for anomy as detailed >on:
>http://advosys.ca/papers/postfix-filtering.html ? .....creating a filter
>script to move the files/invoke mailscanner and define this script as a 
>new service in /etc/postfix/master.cf?

This looks to be the way that old versions of Amavis used to work, before it became a horrendous SMTP-server emulating (badly) monster.
It doesn't really differ tremendously from the content_filter method.

I'm running a solitary instance of Postfix method in production, suggested by another member of the list.

I have header_checks defined in main.cf:

header_checks = pcre:/etc/postfix/header_checks

And then, in there I have:

/^Received:.*by .*\.lshtm.ac.uk \(Postfix\)/ HOLD

As a result of this, any mail being relayed through the 
system (which results in a 'Received:' header being added),
gets 'held' which puts the mail in:

/var/spool/postfix/hold

so I have 

Incoming Queue Dir = /var/spool/postfix/hold

in MailScanner.conf.

Outgoing is as normal:

Outgoing Queue Dir = /var/spool/postfix/incoming

... and this works.

Locally generated messages (like cron reports) from the box itself
bypass this whole thing, but my box is a gateway with no local users.

I had to adopt this method because I was using address verification, and the method that employs deferring the queues doesn't work too nicely with this (the address checks get deferred). This problem is fixed in newer versions of Postfix (you can specify the 'verify' service as having a different transport), but I'm still happier only running one version of Postfix.

The main weirdness with similar methods and things like Amavis is ending up with essentially two 'chains' of activity in a log, where a message is received, and then re-injected after scanning. With the above, log analysis is now a lot more easier.

...



--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838 


From mdunder at GE.UCL.AC.UK  Fri Jul 11 15:33:04 2003
From: mdunder at GE.UCL.AC.UK (Mike Dunderdale)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <200307111421.h6BELoW02305@Beryl.Rockstone.co.uk>
References: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>
            <200307111421.h6BELoW02305@Beryl.Rockstone.co.uk>
Message-ID: <Pine.GSO.4.53.0307111529440.6527@apollo.ge.ucl.ac.uk>

The reason that the double extensions are disallowed is because it's a
known method of trying to fool users, in particular Outlook Express, into
running programs. Certain windows programs only show the first of the two
extensions, thus  fooling the user into thinking that they're opening one
sort of file (eg a document .doc) instead of opening a nasty script (.vbs)

That's the sort of attack which may not be a virus per se, but will still
do nasty things to your users computer.

Hence the double extension rule.

I'd just encourage your users to put it all into a correctly named zip
file - bypassing this kind of check and reducing bandwidth into the
bargain.

M.

On Fri, 11 Jul 2003, Antony Stone wrote:

> On Friday 11 July 2003 2:58 pm, Tom Combs wrote:
>
> > Hello,
> >
> >   I'm not clear on the need for denying multiple filename extensions.
> >   It seems if an attachment contained a virus, it would be checked by
> >   the virus scanner and either caught or cleared regardless of the
> >   extension.  Does having multiply filename extensions somehow
> >   circumvent this process?
> >
> >   I'm considering dropping this ruleset:
> >
> > deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible filename
> > hiding Attempt to hide real filename extension
> >
> >   Is this a mistake?
>
> I have removed this rule from my systems - I am happy simply to block the
> explicit final extensions which I know can be dangerous.
>
> I look at it this way:
>
> 1. If the final extension is on my 'blocked' list, the email gets blocked and
> I don't care if there was a double extension.
>
> 2. If the final extension is not on my 'blocked' list, then allow the email,
> because it's not going to do anything dangerous on a Windoze machine which
> acts on that final extension anyway.
>
> If anyone knows of a reason why this could be a dangerous policy, please tell
> me :)
>
> Regards,
>
> Antony.
>
> --
>
> G- GIT/E d- s+:--(-) a+ C++++$ UL++++$ P+(---)>++ L+++(++++)$ !E W(-) N(-) o?
> w-- O !M V+++(--) !PS !PE Y+ PGP+> t- tv@ b+++ DI++ D--- e++>+++ h++ r@? 5?
> !X- !R K--?
>

-------------------------------------------------------------------------
           Mike Dunderdale                |  tel: ++44 20 7679 2756
IT Systems Manager, Geomatic Engineering  |  fax: ++44 20 7380 0453
     mike.dunderdale@ge.ucl.ac.uk         |  mob: ++44 7939 455 245

From Antony at SOFT-SOLUTIONS.CO.UK  Fri Jul 11 15:35:00 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <200307111419.h6BEJqUr010191@blackhole.harper-adams.ac.uk>
References: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>
            <200307111419.h6BEJqUr010191@blackhole.harper-adams.ac.uk>
Message-ID: <200307111435.h6BEZ5W04953@Beryl.Rockstone.co.uk>

On Friday 11 July 2003 3:21 pm, Howard Robinson wrote:

> On 11 Jul 03, at 9:09, mikea wrote:
> Hello
> I block all > single extensions and exe etc.
> If users can't use sensible names that's their problem.

I disagree with this.

I think that multiple extensions on filenames are perfectly sensible (eg
Forecast.aug.xls, or kernel.tar.bz2) and should not be discouraged.   It is
only the CP/M - Dos - Windows mentality that places such emphasis on the last
three letters and a dot at the end of a filename which causes any confusion -
Unix people have been using multiple extensions for years with no problems.

> A little
> education can help and those that don't/won't understand are the
> very ones that may run something nasty.

Surely they can only run something nasty if the *final* extension is one of
exe, com, bat, pif, scr etc - and those are the ones which you (hopefully)
block anyway using the other rules?

> It would be better is if the hide known extensions in windows was
> removed so that the true filename was always shown.

I agree :))   However, let's stick to a reasonable objective please :)

Regards,

Antony.

--

If you think you see a Heffalump in a trap,
make sure it isn't really a Bear with an empty honey jar stuck on his head.

From Antony at SOFT-SOLUTIONS.CO.UK  Fri Jul 11 15:38:34 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <Pine.GSO.4.53.0307111529440.6527@apollo.ge.ucl.ac.uk>
References: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>
            <200307111421.h6BELoW02305@Beryl.Rockstone.co.uk>
            <Pine.GSO.4.53.0307111529440.6527@apollo.ge.ucl.ac.uk>
Message-ID: <200307111438.h6BEcdW05508@Beryl.Rockstone.co.uk>

On Friday 11 July 2003 3:33 pm, Mike Dunderdale wrote:

> The reason that the double extensions are disallowed is because it's a
> known method of trying to fool users, in particular Outlook Express, into
> running programs. Certain windows programs only show the first of the two
> extensions, thus  fooling the user into thinking that they're opening one
> sort of file (eg a document .doc) instead of opening a nasty script (.vbs)

Oh, I understand the reason for the rule, yes, but my point is that it's only
the *final* extension (which may be hidden from the end user, but gets
examined by MailScanner) which determines whether it really is dangerous or
not.

Eg: an attachment document.doc.scr should get blocked because it ends in
.scr, agreed, but an attachment forecast.aug.xls should not be blocked,
because there's nothing wrong with .xls files.

In either case there's no need to examine more than the final extension.

Regards,

Antony.
--

Abandon hope, all ye who enter here.
You'll feel much better about things once you do.

From mikea at MIKEA.ATH.CX  Fri Jul 11 15:42:34 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <200307111435.h6BEZ5W04953@Beryl.Rockstone.co.uk>; from
              Antony@SOFT-SOLUTIONS.CO.UK on Fri, Jul 11,
              2003 at 03:35:00PM +0100
References: <200307111358.h6BDwDM8028514@osprey.magnet.fsu.edu>
            <200307111419.h6BEJqUr010191@blackhole.harper-adams.ac.uk>
            <200307111435.h6BEZ5W04953@Beryl.Rockstone.co.uk>
Message-ID: <20030711094234.A38308@mikea.ath.cx>

On Fri, Jul 11, 2003 at 03:35:00PM +0100, Antony Stone wrote:
> On Friday 11 July 2003 3:21 pm, Howard Robinson wrote:
>
> > On 11 Jul 03, at 9:09, mikea wrote:
> > Hello
> > I block all > single extensions and exe etc.
> > If users can't use sensible names that's their problem.

Actually I did *not* write that; someone else wrote it in response
to my post to the list.

I'm not about to impose my definition of "sensible names" on my user
community. We provide a computing, file storage, and file transfer
utility service, and not some procrustean bed into which we force all
the users by stretching the short ones and trimming the long ones.

It's there so that they can get *their* work done, and where we don't
have to get in the way, we have no business getting in the way.

Again, your shop may be different. Those are the rules for *my* shop.
I wrote them over a period of 25 years.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From dot at DOTAT.AT  Fri Jul 11 15:32:56 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <m2n.19ayPy-000qMi@chiark.greenend.org.uk>
Message-ID: <E19ayxE-0004DW-00@chiark.greenend.org.uk>

Tom Combs <combs@MAGNET.FSU.EDU> wrote:
>
>  I'm not clear on the need for denying multiple filename extensions.
>  It seems if an attachment contained a virus, it would be checked by
>  the virus scanner and either caught or cleared regardless of the
>  extension.  Does having multiply filename extensions somehow
>  circumvent this process?

It's aimed more at social engineering attacks, or as a backup protection
strategy for the time between a virus getting out and the scanner database
being updated.

The problem is that Windows often hides a file's extension which means
names like info.txt.exe might fool users.

To reduce the number of false positives I've added more known-safe file
extensions fo the list, e.g. .doc, .pdf, etc.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
FISHER: WEST VEERING NORTHWEST 4 OR 5, INCREASING 6. SHOWERS. GOOD.

From lvargas at CFT.COM.MX  Fri Jul 11 17:45:10 2003
From: lvargas at CFT.COM.MX (Luis Amado Vargas)
Date: Thu Jan 12 21:18:55 2006
Subject: Uninstall Mailscanner
Message-ID: <000d01c347cb$cdf19280$0402a8c0@ATILVARGAS>

How to uninstall mailscaner from Raq4.

Thks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030711/ff53e021/attachment.html
From mikea at MIKEA.ATH.CX  Fri Jul 11 15:51:28 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:55 2006
Subject: Uninstall Mailscanner
In-Reply-To: <000d01c347cb$cdf19280$0402a8c0@ATILVARGAS>; from
              lvargas@CFT.COM.MX on Fri, Jul 11, 2003 at 09:45:10AM -0700
References: <000d01c347cb$cdf19280$0402a8c0@ATILVARGAS>
Message-ID: <20030711095128.B38308@mikea.ath.cx>

On Fri, Jul 11, 2003 at 09:45:10AM -0700, Luis Amado Vargas wrote:
> How to uninstall mailscaner from Raq4.

1. Put your sendmail (or other MTA) configuration back the way it was;

2. undo any changes you made to the boot-time startup scripts
   (/etc/init.d or whatever);

3. stop all MailScanner and MTA instances;

4. start your MTA the way you used to do it;

5. remove the directory that MailScanner installed to (/opt/MailScanner
   on my systems).

I may have missed something. In any event, reverse the actions you
took to install MailScanner; use the MailScanner install documentation
to see what needs to be undone and how.

What went wrong that you're uninstalling?

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From moliveri at uti.com  Fri Jul 11 16:03:39 2003
From: moliveri at uti.com (Mike Oliveri)
Date: Thu Jan 12 21:18:55 2006
Subject: Quick Exim question
References: <E19augC-00039r-00@chiark.greenend.org.uk>
Message-ID: <008701c347bd$9c8c5760$2a35f8cc@poseidon>

I've got a currently-working Exim configuration; would I just go ahead and
run the Exim setup script again to populate a new exim.in spool directory?
Of course, that's assuming I can find the Exim setup script the last admin
used... I'm still rather new to Exim and I'm running 3.36 on FreeBSD.

I did fire up MailScanner yesterday after moving everything to that exim.in
directory and ended up with an error message after all. Outlook Express
simply reported refused connections, but Pine said it was unable to create
/var/spool/exim.in. I assume it's related to the above directory problems,
as the permissions on exim and exim.in match.

Would simply eliminating the split spool functionality avoid this problem
altogether?

Take care,
Mike Oliveri
Systems Administrator
UTI Systems, Inc.
moliveri@uti.com
815-941-4555


----- Original Message -----
From: "Tony Finch" <dot@DOTAT.AT>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, July 11, 2003 4:59 AM
Subject: Re: Quick Exim question


> Mike Oliveri <moliveri@UTI.COM> wrote:
> >
> >Because my current config is only running with one config file, I only
have
> >one spool directory: /var/spool/exim/input/*  The new config files will
> >have an input directory of /var/spool/exim.in/input/*, but of course they
> >do not exist yet. The MailScanner Exim configure page says I should
create
> >all the subdirectories of ../input before running MailScanner.
>
> MailScanner's much happier if all the directories it needs exist before it
> starts. There's not much point in taking shortcuts. My Exim setup script
does
>
>         for exim in exim exim.in
>         do
>                 for split in \
>                     a b c d e f g h i j k l m \
>                     n o p q r s t u v w x y z \
>                     A B C D E F G H I J K L M \
>                     N O P Q R S T U V W X Y Z \
>                     0 1 2 3 4 5 6 7 8 9
>                 do
>                         run mkdir -p /var/spool/$exim/input/$split
>                 done
>                 run chown -R exim:exim /var/spool/$exim
>                 run chmod -R 0750      /var/spool/$exim
>         done
>
> Tony.
> --
> f.a.n.finch  <dot@dotat.at>  http://dotat.at/
> ST DAVIDS HEAD TO COLWYN BAY, INCLUDING ST GEORGES CHANNEL: WEST 4 LOCALLY
5,
> VEERING NORTHWEST TO WEST 2 OR 3 LOCALLY 4. ISOLATED SHOWERS IN THE NORTH
> OTHERWISE MAINLY FAIR. MAINLY GOOD. SLIGHT TO MODERATE.
>
>

From JFalgout at CO.JEFFERSON.CO.US  Fri Jul 11 16:26:34 2003
From: JFalgout at CO.JEFFERSON.CO.US (Jeff Falgout)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
Message-ID: <sf0e82d5.067@gc6.jefferson.co.us>

>>> Tom Combs <combs@magnet.fsu.edu> 7/11/2003 7:58:13 AM >>>
>Hello,
>
>  I'm not clear on the need for denying multiple filename extensions.
>  It seems if an attachment contained a virus, it would be checked by
>  the virus scanner and either caught or cleared regardless of the
>  extension.  Does having multiply filename extensions somehow
>  circumvent this process?
>
>  I'm considering dropping this ruleset:
>
>deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible
filename hiding
                        Attempt to hide real filename extension

Would the proper way to allow double extensions be to change the "deny"
to
"allow" or comment out the line?

Jeff

From ryanb at AACRAO.ORG  Fri Jul 11 16:29:32 2003
From: ryanb at AACRAO.ORG (Bingham, Ryan)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
Message-ID: <D18EA7FDD69C5642A752EE7A30F6ED8A33FE56@mail.aacrao.org>

Don't forget a lot of these problematic attachments can now be handled
with the new Filetype rule, so I don't think the multiple extension rule
is as critical anymore.

Ryan


From jstuart at EDENPR.K12.MN.US  Fri Jul 11 16:41:47 2003
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:18:55 2006
Subject: Upgrade spamassassin
Message-ID: <sf0e947a.045@edenpr.k12.mn.us>

I am going to uopgrade spamassassin from 2.41 to current and was
wondering if it is neccessary to remove the 2.41 files first? They where
not installed from rpm.

thanks

From Antony at SOFT-SOLUTIONS.CO.UK  Fri Jul 11 16:41:32 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:55 2006
Subject: Allow multiple filename extensions?
In-Reply-To: <sf0e82d5.067@gc6.jefferson.co.us>
References: <sf0e82d5.067@gc6.jefferson.co.us>
Message-ID: <200307111541.h6BFfcW20439@Beryl.Rockstone.co.uk>

On Friday 11 July 2003 4:26 pm, Jeff Falgout wrote:

> >  I'm considering dropping this ruleset:
> >
> > deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible
> > filename hiding               Attempt to hide real filename extension
>
> Would the proper way to allow double extensions be to change the "deny"
> to "allow" or comment out the line?
>
> Jeff

I simply commented out the line - I don't want MailScanner to even consider
the idea of double extensions - positively or negatively.

Regards,

Antony.

--

Most people have more than the average number of legs.

From dwinkler at ALGORITHMICS.COM  Fri Jul 11 16:44:51 2003
From: dwinkler at ALGORITHMICS.COM (Derek Winkler)
Date: Thu Jan 12 21:18:56 2006
Subject: Allow multiple filename extensions?
Message-ID: <06EE2C86D3DAD5119A6C0060943F3C97055E7089@tormail1.algorithmics.com>

Comment out.

If you change it to allow, it will allow anything with a double extension.

I added some extensions that should be allowed whether doubled or not above
this rule and left it as deny.

I've really been trying to talk everyone into a list of extensions to allow
and deny everyting else.

-----Original Message-----
From: Jeff Falgout [mailto:JFalgout@co.jefferson.co.us]
Sent: Friday, July 11, 2003 11:27 AM
To: MAILSCANNER@jiscmail.ac.uk
Subject: Re: Allow multiple filename extensions?


>>> Tom Combs <combs@magnet.fsu.edu> 7/11/2003 7:58:13 AM >>>
>Hello,
>
>  I'm not clear on the need for denying multiple filename extensions.
>  It seems if an attachment contained a virus, it would be checked by
>  the virus scanner and either caught or cleared regardless of the
>  extension.  Does having multiply filename extensions somehow
>  circumvent this process?
>
>  I'm considering dropping this ruleset:
>
>deny    \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3}$   Found possible
filename hiding
                        Attempt to hide real filename extension

Would the proper way to allow double extensions be to change the "deny"
to
"allow" or comment out the line?

Jeff
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030711/995af1d6/attachment.html
From wpc4 at DODGETHIS.ORG  Fri Jul 11 16:55:09 2003
From: wpc4 at DODGETHIS.ORG (William Curley)
Date: Thu Jan 12 21:18:56 2006
Subject: Upgrade spamassassin {Scanned}
In-Reply-To: <sf0e947a.045@edenpr.k12.mn.us>
References: <sf0e947a.045@edenpr.k12.mn.us>
Message-ID: <1057938909.8db8a6136ed93@mail.cynical.us>

If you are upgrading from a tar file, there should be no problem upgrading from
previous versions. There should be an UPGRADE File or maybe some text in the
INSTALL file. I personally have never had problems upgrading.


Quoting Joe Stuart <jstuart@EDENPR.K12.MN.US>:

> I am going to uopgrade spamassassin from 2.41 to current and was
> wondering if it is neccessary to remove the 2.41 files first? They where
> not installed from rpm.
>
> thanks
>

From mkettler at EVI-INC.COM  Fri Jul 11 17:52:46 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:56 2006
Subject: Upgrade spamassassin
In-Reply-To: <1057938909.8db8a6136ed93@mail.cynical.us>
References: <sf0e947a.045@edenpr.k12.mn.us> <sf0e947a.045@edenpr.k12.mn.us>
Message-ID: <5.2.1.1.0.20030711124724.01e74ff0@xanadu.evi-inc.com>

At 08:55 AM 7/11/2003 -0700, William Curley wrote:
>If you are upgrading from a tar file, there should be no problem upgrading
>from
>previous versions. There should be an UPGRADE File or maybe some text in the
>INSTALL file. I personally have never had problems upgrading.

It should go just fine.. however, be aware that if you (improperly) edited
files in /usr/share/spamassassin, they will be obliterated by the upgrade
process. (the installer does a rm -f on this directory). Move any
customizations to /etc/mail/spamassassin/local.cf or MailScanner's
spam.assassin.prefs.conf.

There have only been two occasions where I've had upgrade problems:

The first was when I had made a subdirectory under /usr/share/spamassassin
for some backups. The install failed because it couldn't clean out
/usr/share/spamassassin.

The second was when I upgraded via CPAN and I had a buggy version of CPAN
that tried to install a whole new copy of perl in /usr/local/*. I wound up
with two copies of SA and two copies of perl. That was a mess to clean up..

From jstuart at EDENPR.K12.MN.US  Fri Jul 11 18:24:17 2003
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:18:56 2006
Subject: Upgrade spamassassin
Message-ID: <sf0eac83.055@edenpr.k12.mn.us>

Ok I did the upgrade and it seemed to go smooth, but now when I test it
it's not marking anything with spam. I'm testing it with obviuos spam
stuff that scored 6-8 points before is now only scoring maybe 2. I have
no idea what is wrong. any help is appreciated.

Thanks

>>> mkettler@EVI-INC.COM 07/11/03 11:52AM >>>
At 08:55 AM 7/11/2003 -0700, William Curley wrote:
>If you are upgrading from a tar file, there should be no problem
upgrading
>from
>previous versions. There should be an UPGRADE File or maybe some text
in the
>INSTALL file. I personally have never had problems upgrading.

It should go just fine.. however, be aware that if you (improperly)
edited
files in /usr/share/spamassassin, they will be obliterated by the
upgrade
process. (the installer does a rm -f on this directory). Move any
customizations to /etc/mail/spamassassin/local.cf or MailScanner's
spam.assassin.prefs.conf.

There have only been two occasions where I've had upgrade problems:

The first was when I had made a subdirectory under
/usr/share/spamassassin
for some backups. The install failed because it couldn't clean out
/usr/share/spamassassin.

The second was when I upgraded via CPAN and I had a buggy version of
CPAN
that tried to install a whole new copy of perl in /usr/local/*. I wound
up
with two copies of SA and two copies of perl. That was a mess to clean
up..

From damian at WORKGROUPSOLUTIONS.COM  Fri Jul 11 18:59:32 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:18:56 2006
Subject: Spamassassin timed out
Message-ID: <F6B4162F6771E44ABF0958023547FFC4096701@w2kserver.workgroupsolutions.com>

Hi,

Any ideas why I receive SpamAssassin timed out errors? It occurs every day and I have not been able resolve why it happens. I've removed RBLs from MailScanner.conf. I'm using DCC and Razor. I have multiple T1 connections to the Internet dedicated just for SMTP messages - about 6500 messages a day.

Jul 11 10:38:38 spamgate MailScanner[21117]: SpamAssassin timed out and was killed, consecutive failure 4 of 20 
Jul 11 10:38:43 spamgate MailScanner[20984]: SpamAssassin timed out and was killed, consecutive failure 4 of 20 
Jul 11 10:38:52 spamgate MailScanner[21233]: SpamAssassin timed out and was killed, consecutive failure 3 of 20 
Jul 11 10:39:20 spamgate MailScanner[21117]: SpamAssassin timed out and was killed, consecutive failure 5 of 20 
Jul 11 10:39:24 spamgate MailScanner[20884]: SpamAssassin timed out and was killed, consecutive failure 4 of 20 

Usually the consecutive failure remains less than 8. Should I worry about these errors?


Thanks,

Damian


From mkettler at EVI-INC.COM  Fri Jul 11 19:14:29 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:56 2006
Subject: Spamassassin timed out
In-Reply-To: <F6B4162F6771E44ABF0958023547FFC4096701@w2kserver.workgroup
              solutions.com>
Message-ID: <5.2.1.1.0.20030711140924.019a29f8@xanadu.evi-inc.com>

At 10:59 AM 7/11/2003 -0700, Damian Mendoza wrote:
>Any ideas why I receive SpamAssassin timed out errors? It occurs every day
>and I have not been able resolve why it happens. I've removed RBLs from
>MailScanner.conf. I'm using DCC and Razor. I have multiple T1 connections
>to the Internet dedicated just for SMTP messages - about 6500 messages a day.
>
>Jul 11 10:38:38 spamgate MailScanner[21117]: SpamAssassin timed out and
>was killed, consecutive failure 4 of 20
>Jul 11 10:38:43 spamgate MailScanner[20984]: SpamAssassin timed out and
>was killed, consecutive failure 4 of 20
>Jul 11 10:38:52 spamgate MailScanner[21233]: SpamAssassin timed out and
>was killed, consecutive failure 3 of 20
>Jul 11 10:39:20 spamgate MailScanner[21117]: SpamAssassin timed out and
>was killed, consecutive failure 5 of 20
>Jul 11 10:39:24 spamgate MailScanner[20884]: SpamAssassin timed out and
>was killed, consecutive failure 4 of 20
>
>Usually the consecutive failure remains less than 8. Should I worry about
>these errors?

Yes you should worry about it. SA is likely calling an RBL that is dead and
timing out.

What version of SA are you using?

If not a current version, VISI and ORBS both seem to be down and should
have zeroed scores. Add the following to /etc/mail/spamassassin/local.cf.
VISI was removed from the ruleset somewhere around 2.54, but ORBS is
currently only removed in the CVS versions:

     score RCVD_IN_VISI                   0
     score RCVD_IN_ORBS         0


What is your spamassassin timeout set to in mailscanner.conf? What is your
rbl_timeout set to in spamassassin (note: this is not a mailscanner.conf
setting)?

If both are 30, you should set the RBL timeout in SA to something smaller?
I'd suggest the following change to /etc/mail/spamassassin/local.cf to
reduce the impact of RBL outages:
         rbl_timeout 10

From mkettler at EVI-INC.COM  Fri Jul 11 19:15:34 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:56 2006
Subject: Upgrade spamassassin
In-Reply-To: <sf0eac83.055@edenpr.k12.mn.us>
Message-ID: <5.2.1.1.0.20030711141458.01a32210@xanadu.evi-inc.com>

At 12:24 PM 7/11/2003 -0500, Joe Stuart wrote:
>Ok I did the upgrade and it seemed to go smooth, but now when I test it
>it's not marking anything with spam. I'm testing it with obviuos spam
>stuff that scored 6-8 points before is now only scoring maybe 2. I have
>no idea what is wrong. any help is appreciated.
>
>Thanks

Send yourself a GTUBE email. See my post yesterday under the subject "Re:
How can I get some spam?"

From jstuart at EDENPR.K12.MN.US  Fri Jul 11 19:27:47 2003
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:18:56 2006
Subject: Upgrade spamassassin
Message-ID: <sf0ebb64.013@edenpr.k12.mn.us>

thanks, it worked. The weird thing is that I have old spam that I'm
sending to myself

>>> mkettler@EVI-INC.COM 07/11/03 01:15PM >>>
At 12:24 PM 7/11/2003 -0500, Joe Stuart wrote:
>Ok I did the upgrade and it seemed to go smooth, but now when I test
it
>it's not marking anything with spam. I'm testing it with obviuos spam
>stuff that scored 6-8 points before is now only scoring maybe 2. I
have
>no idea what is wrong. any help is appreciated.
>
>Thanks

Send yourself a GTUBE email. See my post yesterday under the subject
"Re:
How can I get some spam?"

From jstuart at EDENPR.K12.MN.US  Fri Jul 11 19:30:50 2003
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:18:56 2006
Subject: Upgrade spamassassin
Message-ID: <sf0ebc17.020@edenpr.k12.mn.us>

sorry accidently sent that last one.

>>> jstuart@EDENPR.K12.MN.US 07/11/03 01:27PM >>>
thanks, it worked. The weird thing is that I have old spam that I'm
sending to myself

>>> mkettler@EVI-INC.COM 07/11/03 01:15PM >>>
At 12:24 PM 7/11/2003 -0500, Joe Stuart wrote:
>Ok I did the upgrade and it seemed to go smooth, but now when I test
it
>it's not marking anything with spam. I'm testing it with obviuos spam
>stuff that scored 6-8 points before is now only scoring maybe 2. I
have
>no idea what is wrong. any help is appreciated.
>
>Thanks

Send yourself a GTUBE email. See my post yesterday under the subject
"Re:
How can I get some spam?"

From emcc-mailscanner at CTCNET.COM  Fri Jul 11 19:25:36 2003
From: emcc-mailscanner at CTCNET.COM (Eric McClelland)
Date: Thu Jan 12 21:18:56 2006
Subject: Mysterious MailScanner hangs
Message-ID: <Pine.LNX.4.21.0307111424460.28248-100000@redpill.ctcnet.com>

Hi All,

I have a sporadic problem where MailScanner mysteriously stops picking up inbound MTA spool files.  A 'service MailScanner restart' temporarily clears the problem for the most part (inbound MTA queue, normally 0-10, still hovers between 30-95 afterwards).  When the problem occurs, there is invariably one MailScanner process taking >90% of the CPU (load usually 1-3), and the problem persists until I intervene (i.e. MailScanner does not kill and restart itself periodically as it normally does).  I've poked around the MTA and MailScanner queues, but noticed nothing amiss with any of the messages (except that some appear never to get processed), nor do any log entries provide a clue.

At this point I'm trying to decide the next step in troubleshooting; setting "Debug = yes" in MailScanner.conf merely stops the scanning again, but I see no output.  Then again I haven't found much documentation on debugging so perhaps I'm not looking in the right place.

My current setup:
6 servers in a DNS round-robin under one hostname (i.e. one hostname mapping to six different machine IP addresses).
CPU:            Pentium III / 733 MHz
RAM:            Two (512MB each), One (256MB), Three (128 MB)
Distribution:   RedHat 7.3, up2date'd periodically
MailScanner:    4.20-3
All six servers run MailScanner + Postfix + McAfee; no spam checking at this time.

The hardware setup is certainly not ideal, especially where I'm using IDE drives; I have access to suboptimal hardware, but a lot of it.  It's actually easier for me to throw a whole box into the mix than to get a single DIMM > 128MB.  For the most part, the quantity-over-quality strategy has worked fine, and I've seen this problem occur on all the boxes - again sporadically - so I don't think the issue is hardware.

Sheer load does not appear to be the issue, either:  a 'service MailScanner restart' will result in an inbound MTA queue being whittled from several thousand messages to under 100 in minutes.  We did ramp up a lot of traffic on these servers on Monday, but the problem did not appear until Tuesday evening / Wednesday morning.

FWIW we originally saw similar symptoms several weeks ago, back when we ran ClamAV in conjunction with McAfee, but we discovered that the clamav-autoupdate was hanging; killing that script caused MailScanner to wake up with no need for a restart.  I removed clamav from the Virus Scanners list at that time (I've since seen some postings about this in the list archives).  When this problem occurs now, I see no update scripts running.

Any suggestions would be appreciated.  Hopefully I've provided enough info without being long-winded. :)

Cheers,
--Eric

From lists at STHOMAS.NET  Fri Jul 11 19:45:33 2003
From: lists at STHOMAS.NET (Steve Thomas)
Date: Thu Jan 12 21:18:56 2006
Subject: Spamassassin timed out
In-Reply-To: <F6B4162F6771E44ABF0958023547FFC4096701@w2kserver.workgroupsolutions.com>; from
              damian@WORKGROUPSOLUTIONS.COM on Fri, Jul 11,
              2003 at 10:59:32AM -0700
References: <F6B4162F6771E44ABF0958023547FFC4096701@w2kserver.workgroupsolutions.com>
Message-ID: <20030711114532.A24576@sthomas.net>

On Fri, Jul 11, 2003 at 10:59:32AM -0700, Damian Mendoza is rumored to have said:
>
> Any ideas why I receive SpamAssassin timed out errors? It occurs every day and
> I have not been able resolve why it happens. I've removed RBLs from
> MailScanner.conf. I'm using DCC and Razor. I have multiple T1 connections to
> the Internet dedicated just for SMTP messages - about 6500 messages a day.

First, some background. I call SA (spamc/d) from procmail, not MS, and I use a semi-regularly updated CVS version of SA.

I was seeing similar problems. I figured it was a dead RBL or something, so I disabled all DNS, razor, RBL, dcc, etc. checks with no improvement. At that point, I turned on SA debugging and waited for a message to come through unscanned - it didn't take long...

It turned out to be the bayes database. When SA was running, it was finding my bayes db and was trying to convert it from "version 0" to "version 2". It was doing this for each message and would usually take almost two full minutes to do. Procmail would forget about it before it completed and "rescue" the message, delivering it unfiltered. I deleted (renamed, actually) the bayes_* files in ~/.spamassassin/ and let them start rebuilding from scratch. Haven't seen a single spam hit my inbox since...

Since I don't use SA with MS, I can't comment on whether or not this might be your problem, but it might be worth checking out.

HTH,
St-

--
"I love Mickey Mouse more than any woman I have ever known."
- Walt Disney (1901-1966)

From zabriskw at ITECH.NET  Fri Jul 11 19:44:55 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:18:56 2006
Subject: Mysterious MailScanner hangs
References: <Pine.LNX.4.21.0307111424460.28248-100000@redpill.ctcnet.com>
Message-ID: <003a01c347dc$85d14ed0$0c02a8c0@itech.dom>

Eric,
I just skimmed through your message quickly.  We had a VERY similar problem.
What we do now (and it works) is in crontab we do this:

0,5,10,15,20,25,30,35,40,45,50,55 * * * * [ -x /usr/bin/resms ] &&
/usr/bin/resms >/dev/null 2>&1

resms is simply a script that kills all processes of MailScanner and then
runs the ./bin/check_mailscanner binary.

Hope that helps... and again, I apologize if this has nothing to do with
your problem, I just skimmed.

Kris Zabriskie
Network Admin / Consultant
I-Tech Inc.
zabriskw@itech.net
717-657-3035


----- Original Message -----
From: "Eric McClelland" <emcc-mailscanner@CTCNET.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, July 11, 2003 2:25 PM
Subject: Mysterious MailScanner hangs


> Hi All,
>
> I have a sporadic problem where MailScanner mysteriously stops picking up
inbound MTA spool files.  A 'service MailScanner restart' temporarily clears
the problem for the most part (inbound MTA queue, normally 0-10, still
hovers between 30-95 afterwards).  When the problem occurs, there is
invariably one MailScanner process taking >90% of the CPU (load usually
1-3), and the problem persists until I intervene (i.e. MailScanner does not
kill and restart itself periodically as it normally does).  I've poked
around the MTA and MailScanner queues, but noticed nothing amiss with any of
the messages (except that some appear never to get processed), nor do any
log entries provide a clue.
>
> At this point I'm trying to decide the next step in troubleshooting;
setting "Debug = yes" in MailScanner.conf merely stops the scanning again,
but I see no output.  Then again I haven't found much documentation on
debugging so perhaps I'm not looking in the right place.
>
> My current setup:
> 6 servers in a DNS round-robin under one hostname (i.e. one hostname
mapping to six different machine IP addresses).
> CPU:            Pentium III / 733 MHz
> RAM:            Two (512MB each), One (256MB), Three (128 MB)
> Distribution:   RedHat 7.3, up2date'd periodically
> MailScanner:    4.20-3
> All six servers run MailScanner + Postfix + McAfee; no spam checking at
this time.
>
> The hardware setup is certainly not ideal, especially where I'm using IDE
drives; I have access to suboptimal hardware, but a lot of it.  It's
actually easier for me to throw a whole box into the mix than to get a
single DIMM > 128MB.  For the most part, the quantity-over-quality strategy
has worked fine, and I've seen this problem occur on all the boxes - again
sporadically - so I don't think the issue is hardware.
>
> Sheer load does not appear to be the issue, either:  a 'service
MailScanner restart' will result in an inbound MTA queue being whittled from
several thousand messages to under 100 in minutes.  We did ramp up a lot of
traffic on these servers on Monday, but the problem did not appear until
Tuesday evening / Wednesday morning.
>
> FWIW we originally saw similar symptoms several weeks ago, back when we
ran ClamAV in conjunction with McAfee, but we discovered that the
clamav-autoupdate was hanging; killing that script caused MailScanner to
wake up with no need for a restart.  I removed clamav from the Virus
Scanners list at that time (I've since seen some postings about this in the
list archives).  When this problem occurs now, I see no update scripts
running.
>
> Any suggestions would be appreciated.  Hopefully I've provided enough info
without being long-winded. :)
>
> Cheers,
> --Eric
>

From damian at WORKGROUPSOLUTIONS.COM  Fri Jul 11 21:00:12 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:18:56 2006
Subject: Spamassassin timed out
Message-ID: <F6B4162F6771E44ABF0958023547FFC413D2C1@w2kserver.workgroupsolutions.com>

Steve,

Thanks for the feedback - I'll look into rebuilding the bayes database. I did not think of bayes being a possible suspect to the problem.


Regards,

Damian

-----Original Message-----
From: Steve Thomas [mailto:lists@STHOMAS.NET]
Sent: Friday, July 11, 2003 11:46 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Spamassassin timed out


On Fri, Jul 11, 2003 at 10:59:32AM -0700, Damian Mendoza is rumored to have said:
>
> Any ideas why I receive SpamAssassin timed out errors? It occurs every day and
> I have not been able resolve why it happens. I've removed RBLs from
> MailScanner.conf. I'm using DCC and Razor. I have multiple T1 connections to
> the Internet dedicated just for SMTP messages - about 6500 messages a day.

First, some background. I call SA (spamc/d) from procmail, not MS, and I use a semi-regularly updated CVS version of SA.

I was seeing similar problems. I figured it was a dead RBL or something, so I disabled all DNS, razor, RBL, dcc, etc. checks with no improvement. At that point, I turned on SA debugging and waited for a message to come through unscanned - it didn't take long...

It turned out to be the bayes database. When SA was running, it was finding my bayes db and was trying to convert it from "version 0" to "version 2". It was doing this for each message and would usually take almost two full minutes to do. Procmail would forget about it before it completed and "rescue" the message, delivering it unfiltered. I deleted (renamed, actually) the bayes_* files in ~/.spamassassin/ and let them start rebuilding from scratch. Haven't seen a single spam hit my inbox since...

Since I don't use SA with MS, I can't comment on whether or not this might be your problem, but it might be worth checking out.

HTH,
St-

--
"I love Mickey Mouse more than any woman I have ever known."
- Walt Disney (1901-1966)


From mkettler at EVI-INC.COM  Fri Jul 11 21:06:26 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:56 2006
Subject: Upgrade spamassassin
In-Reply-To: <sf0ebb64.012@edenpr.k12.mn.us>
Message-ID: <5.2.1.1.0.20030711155757.017ff190@xanadu.evi-inc.com>

At 01:27 PM 7/11/2003 -0500, Joe Stuart wrote:
>thanks, it worked. The weird thing is that I have old spam that I'm
>sending to myself

There's a few reasons that sending yourself old spam may cause a negative hit.

1) by sending the message to yourself, you've changed the message headers.
This removes a large quantity of information that SA uses to look for
"invalid" patterns commonly present in spam, such as date fields that
contain a non-existent timezone, and replaces them with legitimate headers,
which can greatly reduce their score.

2) in general I've found the 2.5x ruleset to be slightly weaker than past
versions, but this weakness is greatly made up for by the awesome power of
the bayes engine. Once you get bayes trained 2.5x works considerably
better, and more to the point, it's harder for spammers to tune their
emails to avoid it (because everyone has a different training).

3) Also how old is "old"? In general the current version of SA is tuned to
catch current trends in spam. Since the behavior of spammers (and
legitimate mailers) changes over time, the current version of SA might not
catch all historical spam. But that's ok, because you really want SA to
catch the spam you get today. How well it catches spam you got a year ago
isn't very important.

From penguin at DHCP.NET  Sat Jul 12 00:17:34 2003
From: penguin at DHCP.NET (penguin)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
Message-ID: <000001c34802$9f0efd40$0200a8c0@penguin>

Heya,

I occasionally seem to get a spam E-mail that gets through without being
checked
properly. If I manually pipe it through SpamAssassin, it scores unusually
high
(39.90!). Even so, both of my spam 'actions' are set to 'delete' in the
MailScanner
configuration file. Also, the E-mail lacks the MailScanner and SpamAssassin
headers
altogether..? Oddly, I don't see it in my mail.log either.

Any ideas, suggestions?

-- Arnim



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From kevins at BMRB.CO.UK  Sat Jul 12 00:28:26 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175DF7@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175DF7@pascal.priv.bmrb.co.uk>
Message-ID: <1057966110.4398.7.camel@bach.kevinspicer.co.uk>

> Also, the E-mail lacks the MailScanner and SpamAssassin
>headers
>altogether..? Oddly, I don't see it in my mail.log either.

>Any ideas, suggestions?

Do the recieved headers show it passing through your mailscanner server?

What are you looking for in your maillog?  (I find messageid best)

Could you post some headers please...




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From raymond at PROLOCATION.NET  Sat Jul 12 09:18:36 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:18:56 2006
Subject: MS Performance
In-Reply-To: <20030712052218.GF11320@hoiho.nz.lemon-computing.com>
Message-ID: <Pine.LNX.4.44.0307121016190.8150-100000@mailbox.prolocation.net>

Hi!

> > No, tests that i did showed sendmail is able to do about the same, but you
> > have to tweak sendmail a little for that.

> Well if you're going to start tweaking, you should be tweaking exim too :-P
> Biased? I suppose I am, yes...

I do have a large setup with EXIM running also. Little larger then the
sendmail setup. I dont see much difference there, really. The only nice
thing is the throtthling EXIM can do, thats a thing i miss with sendmail.

Its always biased, but i run both myself...

Bye,
Raymond.

From Janssen at RZ.UNI-FRANKFURT.DE  Sat Jul 12 14:40:12 2003
From: Janssen at RZ.UNI-FRANKFURT.DE (Michael Janssen)
Date: Thu Jan 12 21:18:56 2006
Subject: Mysterious MailScanner hangs
In-Reply-To: <Pine.LNX.4.21.0307111424460.28248-100000@redpill.ctcnet.com>
References: <Pine.LNX.4.21.0307111424460.28248-100000@redpill.ctcnet.com>
Message-ID: <Pine.A41.4.56.0307121517400.1289562@hermes-22.rz.uni-frankfurt.de>

On Fri, 11 Jul 2003, Eric McClelland wrote:

> Hi All,
>
> I have a sporadic problem where MailScanner mysteriously stops picking
> up inbound MTA spool files.  A 'service MailScanner restart' temporarily
> clears the problem for the most part (inbound MTA queue, normally 0-10,
> still hovers between 30-95 afterwards).  When the problem occurs, there
> is invariably one MailScanner process taking >90% of the CPU (load
> usually 1-3), and the problem persists until I intervene (i.e.
> MailScanner does not kill and restart itself periodically as it normally
> does).  I've poked around the MTA and MailScanner queues, but noticed
> nothing amiss with any of the messages (except that some appear never to
> get processed), nor do any log entries provide a clue.

[I work with exim but nevertheless]

In which state the MS-process hangs? E.G. the last logline *for this pid*
might be "Virus and Content Scanning: Starting". This *might* indicate a
problem while scanning (but there is a default 300sec timeout for the
scanner). Is there a scanner process? More likly its indicate a problem
with MS-postfix (especially with "Deliver in Background = no" or "Delivery
Method" on some values).

The really good thing is, that you can inspect the hanging MS-process with
"strace": "strace -p [process-pid]" will plug into the running proces and
shows all the system calls it does. On our system this is often
"wait4([pid of a exim-process], " for hanged or delayed MS-processes.
"wait4" means the process is (possibly innocently) waiting for another
process to complete. This information can also be seen via some output
formats of "ps" providing the waitchannel abbrv "WCHAN":
ps -C MailScanner o pid,wchan # with GNU-ps

Note that "strace" can damage running processes in rare cases - you will
need to check after stracing that the process has survived.


As already said, I work with exim but last logline and strace should give
some important informations to solve this problem.

Michael

From oliverbp at EPOST.DE  Sun Jul 13 01:24:26 2003
From: oliverbp at EPOST.DE (Oliver Pawellek)
Date: Thu Jan 12 21:18:56 2006
Subject: MailScanner + SuSE Linux 8.2
Message-ID: <LISTSERV%2003071301242688@JISCMAIL.AC.UK>

Would anyone have a MailScanner shell script that works under SuSE Linux
8.2? The supplied MailScanner script for SuSE Linux 8.0/8.1 appears to
only partially work under SuSE Linux 8.2, which produces: "Initializing
sendmail and MailScanner = failed". The script seems to start sendmail
fine on localhost:smtp and appears to scan emails that are sent to an from
local email accounts, it does however fail to start sendmail listening on
Port 25 for incoming mail from the internet.

- Oliver

From damian at WORKGROUPSOLUTIONS.COM  Sun Jul 13 19:48:38 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
Message-ID: <F6B4162F6771E44ABF0958023547FFC4096704@w2kserver.workgroupsolutions.com>

Hi,

I have seen the same problem many times as well. I can see the scores in the maillog file as being tagged as spam, I also see it being deleted in maillog and then I see it being delivered to the receipient in the maillog.

The end-user receives the SPAM message - no spam header information included. It was a message sent to multiple recepients, however none of them are whitelisted.

Regards,

Damian


-----Original Message-----
From: penguin [mailto:penguin@DHCP.NET]
Sent: Friday, July 11, 2003 4:18 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Some spam getting through for some odd reason


Heya,

I occasionally seem to get a spam E-mail that gets through without being
checked
properly. If I manually pipe it through SpamAssassin, it scores unusually
high
(39.90!). Even so, both of my spam 'actions' are set to 'delete' in the
MailScanner
configuration file. Also, the E-mail lacks the MailScanner and SpamAssassin
headers
altogether..? Oddly, I don't see it in my mail.log either.

Any ideas, suggestions?

-- Arnim



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From damian at WORKGROUPSOLUTIONS.COM  Sun Jul 13 20:30:41 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
Message-ID: <F6B4162F6771E44ABF0958023547FFC413D2C8@w2kserver.workgroupsolutions.com>

The following is an example of a SPAM message being delivered to an end user when the action is delete. You can see the message was delivered to the end user without the SPAM header information. Message ID "h6A04Q9F032454"

Maillog file:
 
Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9F032454: from=<swims-blew@kroc.com>, size=2207, class=0, nrcpts=1, msgid=<2730416505.01380945810856@kroc.com>, proto=ESMTP, daemon=MTA, relay=gateway.svusd.k12.ca.us [198.188.250.254]
Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9F032454: to=<chuw@svusd.k12.ca.us>, delay=00:00:00, mailer=esmtp, pri=30531, stat=queued
Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9G032454: from=<optindeals-yh@para3ds.com>, size=6546, class=0, nrcpts=1, msgid=<1057795388.2242@64.119.200.139.impro6.com>, proto=ESMTP, daemon=MTA, relay=gateway.svusd.k12.ca.us [198.188.250.254]
Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9G032454: to=<garciat@svusd.k12.ca.us>, delay=00:00:00, mailer=esmtp, pri=30487, stat=queued
Jul  9 17:04:29 spamgate MailScanner[26052]: New Batch: Forwarding 2 unscanned messages, 9748 bytes 
Jul  9 17:04:29 spamgate MailScanner[26052]: Spam Checks: Starting 
Jul  9 17:04:30 spamgate MailScanner[26052]: Message h6A04Q9G032454 from 198.188.250.254 (para3ds.com) to svusd.k12.ca.us is spam, SpamAssassin (score=15.8, required 4, BAYES_80, DCC_CHECK, EXCUSE_1, EXCUSE_19, EXCUSE_3, HIDE_WIN_STATUS, HTML_70_80, HTML_IMAGE_ONLY_06, HTML_TAG_EXISTS_TBODY, HTML_WEB_BUGS, MIME_HEADER_CTYPE_ONLY, MIME_HTML_ONLY, NORMAL_HTTP_TO_IP, OFFER, OFFERS_ETC, RECEIVE_OFFER) 
Jul  9 17:04:31 spamgate MailScanner[26052]: Spam Checks: Found 1 spam messages 
Jul  9 17:04:31 spamgate MailScanner[26052]: Spam Actions: message h6A04Q9G032454 actions are delete 
Jul  9 17:04:31 spamgate MailScanner[26052]: Unscanned: Delivered 1 messages 
Jul  9 17:04:31 spamgate MailScanner[26052]: Virus and Content Scanning: Starting 
Jul  9 17:04:32 spamgate sendmail[32466]: h6A04Q9F032454: to=<chuw@svusd.k12.ca.us>, delay=00:00:05, xdelay=00:00:01, mailer=esmtp, pri=120531, relay=[10.1.254.3] [10.1.254.3], dsn=2.0.0, stat=Sent ( <2730416505.01380945810856@kroc.com> Queued mail for delivery)

Header Information from Message:

by spamgate.spamgate.us (8.12.5/8.12.5) with ESMTP id h6A04Q9F032454
 for <chuw@svusd.k12.ca.us>; Wed, 9 Jul 2003 17:04:27 -0700
Received: from 24.203.227.247 ([24.203.227.247]) by gateway.svusd.k12.ca.us with SMTP id <119056>; Wed, 9 Jul 2003 14:04:29 -1000
Date:  Thu, 10 Jul 2003 14:34:01 GMT
From: Vballoons Gballota <swims-blew@kroc.com>
To: chuw@svusd.k12.ca.us
X-Priority: 3 (Normal)
Message-ID: <2730416505.01380945810856@kroc.com>
Subject: Young gays (C76M6ZQUON below)
MIME-Version: 1.0
Content-type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Accept-Language: en-us, en
X-Mailer: Gnus v5.7/Emacs 20.17
X-Priority: 3 (Normal)
Return-Path: swims-blew@kroc.com
X-OriginalArrivalTime: 10 Jul 2003 00:04:36.0100 (UTC) FILETIME=[D9394440:01C34676]

Any ideas?

Thanks,

Damian



-----Original Message-----
From: penguin [mailto:penguin@DHCP.NET]
Sent: Friday, July 11, 2003 4:18 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Some spam getting through for some odd reason


Heya,

I occasionally seem to get a spam E-mail that gets through without being
checked
properly. If I manually pipe it through SpamAssassin, it scores unusually
high
(39.90!). Even so, both of my spam 'actions' are set to 'delete' in the
MailScanner
configuration file. Also, the E-mail lacks the MailScanner and SpamAssassin
headers
altogether..? Oddly, I don't see it in my mail.log either.

Any ideas, suggestions?

-- Arnim



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From kevins at BMRB.CO.UK  Sun Jul 13 20:44:36 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E02@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E02@pascal.priv.bmrb.co.uk>
Message-ID: <1058125481.13291.3.camel@bach.kevinspicer.co.uk>

Its clear that MS/SA aren't even looking at the message, (the spam check
in your log was for a different message).  Have you got any rulesets
defined anywhere?  (Particularly for either Virus Scanning or Spam
Checks)




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From damian at WORKGROUPSOLUTIONS.COM  Sun Jul 13 21:35:02 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
Message-ID: <F6B4162F6771E44ABF0958023547FFC4096705@w2kserver.workgroupsolutions.com>

You are correct as it does not match. The spam check should be for [32466] I believe. No rulesets that I can think of other than whitelist and blacklists. We receive about 6,000 mail messages a day - most are being tagged correctly. The few that that are being reported have been like this problem.


Jul  9 17:04:32 spamgate sendmail[32466]: h6A04Q9F032454: to=<chuw@svusd.k12.ca.
us>, delay=00:00:05, xdelay=00:00:01, mailer=esmtp, pri=120531, relay=[10.1.254.
3] [10.1.254.3], dsn=2.0.0, stat=Sent ( <2730416505.01380945810856@kroc.com> Que
ued mail for delivery)

Thanks,

Damian


-----Original Message-----
From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
Sent: Sunday, July 13, 2003 12:45 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Some spam getting through for some odd reason


Its clear that MS/SA aren't even looking at the message, (the spam check
in your log was for a different message).  Have you got any rulesets
defined anywhere?  (Particularly for either Virus Scanning or Spam
Checks)




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.


From kevins at BMRB.CO.UK  Sun Jul 13 22:13:00 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E04@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E04@pascal.priv.bmrb.co.uk>
Message-ID: <1058130781.13291.27.camel@bach.kevinspicer.co.uk>

>On Sun, 2003-07-13 at 21:35, Damian Mendoza wrote:

>You are correct as it does not match. The spam check should be for
>[32466] I believe.

I'm not sure that we are clear whats going on.  I've split your supplied
log up to show the progress of the message incorrectly delivered
(h6A04Q9F032454) and ignoring the other correctly processed message
(h6A04Q9G032454)   (note the single character difference - G not F)


MESSAGE h6A04Q9F032454 (incorrectly delivered without scanning)
<start>

Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9F032454:
from=<swims-blew@kroc.com>, size=2207, class=0, nrcpts=1,
msgid=<2730416505.01380945810856@kroc.com>, proto=ESMTP, daemon=MTA,
relay=gateway.svusd.k12.ca.us [198.188.250.254]

Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9F032454:
to=<chuw@svusd.k12.ca.us>, delay=00:00:00, mailer=esmtp, pri=30531,
stat=queued

Jul  9 17:04:31 spamgate MailScanner[26052]: Unscanned: Delivered 1
messages

Jul  9 17:04:32 spamgate sendmail[32466]: h6A04Q9F032454:
to=<chuw@svusd.k12.ca.us>, delay=00:00:05, xdelay=00:00:01,
mailer=esmtp, pri=120531, relay=[10.1.254.3] [10.1.254.3], dsn=2.0.0,
stat=Sent ( <2730416505.01380945810856@kroc.com> Queued mail for
delivery)

<end>

There must be a reason why MS is ignoring these messages.  It looks like
the sender forged the server HELO to use a name in your domain (the name
and IP don't resolve to each other).  If you are whitelisting based on
domain, or have virus checking turned off for some mail (maybe
'outgoing'?) then this may explain the behaviour. Could you post your
various rulesets and the values for 'Virus Scanning' and 'Spam Checks'
from MailScanner.conf?






BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From norman at NORMAN.COM.BR  Mon Jul 14 02:20:03 2003
From: norman at NORMAN.COM.BR (Norman Schmidt Jr)
Date: Thu Jan 12 21:18:56 2006
Subject: Strange (non working) behaviour 4.22-4
Message-ID: <LISTSERV%2003071402200372@JISCMAIL.AC.UK>

Some days ago I installed a sendmail 8.12.9 + mailscanner 4.22-4. The setup
worked flawlessy for two days, scanning and blocking viruses and blocking
attachments as configured in filename and filetype.rules.conf. Everything
was running fine and smoothly. On Saturday, after some "MailScanner child
dying of old age" and restarting messages - and absolutely NO modifications
on any config file - Mailscanner stopped to scan and block files, and its
now just forwarding unscanned messages. Everything goes in: viruses, files
blocked by rules, etc:

MailScanner[1122]: New Batch: Forwarding 1 unscanned messages, 8465 bytes
MailScanner[1122]: Unscanned: Delivered 1 messages

I really dont have a clue about what happened. Everything looks fine. Can
someone help me pointing where I can start looking for something wrong?
Thanks in advance,
Norman

From mailscanner at BARENDSE.TO  Mon Jul 14 08:20:33 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:56 2006
Subject: filename rules
Message-ID: <Pine.LNX.4.44.0307140913370.28907-100000@raveon.barendse.to>

I just received an e-mail message with an attachment.

I have .url blocked in my filename rules, the attachment was named
something.url. and was let through.

Outlook blocked access to it but I think the trailing dot let it through.
Is there a way to filter a trailing dot too?

From Kevin.Spicer at BMRB.CO.UK  Mon Jul 14 08:39:16 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:56 2006
Subject: filename rules
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF719@pascal.priv.bmrb.co.uk>

Remco Barendse wrote:
> I just received an e-mail message with an attachment.
> 
> I have .url blocked in my filename rules, the attachment was named
> something.url. and was let through.
> 
> Outlook blocked access to it but I think the trailing dot let it
> through. Is there a way to filter a trailing dot too?

I think adding a rule near the top of filename.rules.conf like this

deny    \.$             Trailing dot in Filename        Trailing dots are not permitted in filenames


should do the trick (note those are tabs between the fields).



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From Kevin.Spicer at BMRB.CO.UK  Mon Jul 14 08:42:55 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:56 2006
Subject: Strange (non working) behaviour 4.22-4
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF71A@pascal.priv.bmrb.co.uk>

> I really dont have a clue about what happened. Everything looks fine.
> Can someone help me pointing where I can start looking for something
> wrong? Thanks in advance,

Sounds like you might have a sendmail process running which is bypassing mailscanner, try (assuming RedHat like syntax)

service MailScanner stop
service sendmail stop
chkconfig sendmail --level 2345 off

ps -elf | grep sendmail
[Now kill all sendmail processes & ps again to check they are dead]

service MailScanner start

If that doesn't work could you post some of your maillog so we can see whats happening.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From yusri at TMNET.COM.MY  Mon Jul 14 09:25:49 2003
From: yusri at TMNET.COM.MY (Mohd Yusri Mahadi)
Date: Thu Jan 12 21:18:56 2006
Subject: mailscanner didn't pickup mail in /var/spool/mqueue.in
Message-ID: <LISTSERV%2003071409254971@JISCMAIL.AC.UK>

Hi,

I've installed MailScanner-4.21-9 with sendmail. But seem that mailscanner
didn't pick-up email from /var/spool/mqueue.in.

Pls help.

From Antony at SOFT-SOLUTIONS.CO.UK  Mon Jul 14 09:40:31 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:18:56 2006
Subject: mailscanner didn't pickup mail in /var/spool/mqueue.in
In-Reply-To: <LISTSERV%2003071409254971@JISCMAIL.AC.UK>
References: <LISTSERV%2003071409254971@JISCMAIL.AC.UK>
Message-ID: <200307140842.h6E8gdg26082@agate.rockstone.co.uk>

On Monday 14 July 2003 9:25 am, Mohd Yusri Mahadi wrote:

> Hi,
>
> I've installed MailScanner-4.21-9 with sendmail. But seem that mailscanner
> didn't pick-up email from /var/spool/mqueue.in.

What do you have "Incoming Queue Dir" set to in MailScanner.conf?

Antony.

--

If at first you don't succeed, destroy all the evidence that you tried.

From kfliong at WOFS.COM  Mon Jul 14 10:40:10 2003
From: kfliong at WOFS.COM (kfliong)
Date: Thu Jan 12 21:18:56 2006
Subject: emails with No Message Collected
In-Reply-To: <LISTSERV%2003071013354270@JISCMAIL.AC.UK>
Message-ID: <5.2.1.1.0.20030714173600.02670a60@192.168.10.2>

Hi,

I have this problem where some of the outgoing mails are received as <<< No
Message Collected >>>.

All the contents including attachments are ripped and only left with this
message "<<< No Message Collected >>>".

I am not sure if this is related to Mailscanner or any of the settings in
it that i have implemented. This truly strange. So far, I can't find any
pattern that can lead me to diagnose this problem. The sender, recipient,
subject, contents are random.

I would appreciate any help or suggestions. Thanks in advance.

From Kevin.Spicer at BMRB.CO.UK  Mon Jul 14 10:57:37 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:56 2006
Subject: emails with No Message Collected
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4ADCB@pascal.priv.bmrb.co.uk>

kfliong wrote:
> Hi,
> 
> I have this problem where some of the outgoing mails are received as
> <<< No Message Collected >>>.
> 
> All the contents including attachments are ripped and only left with
> this message "<<< No Message Collected >>>".

Thats a sendmail error - probably you have a sendmail process which is trying to process the incoming queue, which leads to a race condition between mailscanner and sendmail.  Sometimes MailScanner gets the message, sometimes sendmail gets the message, sometimes mailscanner gets the message, sometimes theres a draw, mailscanner gets the message - sendmail only gets the headers - but sendmail delivers first, therefore the second (full) copy (from MailScanner) is discarded as a duplicate (same messageid).  You can verify if this is the case by grepping your maillogs for affected message ids.  When this happened to me it was caused by an exchange server issuing ETRN's - make sure your MailScanner init script is starting sendmail with the noetrn option.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From richard at HELPPLC.COM  Mon Jul 14 11:50:29 2003
From: richard at HELPPLC.COM (Richard Sidlin)
Date: Thu Jan 12 21:18:56 2006
Subject: Chinese Emails
In-Reply-To: <1057858790.29126.7.camel@bach.kevinspicer.co.uk>
Message-ID: <001201c349f5$c108a410$0b01a8c0@rich>

Here's one that got through. Any thoughts?

Return-Path: <me2@hotmail.com>
Received: from hotmail.com ([211.147.233.7])
	by hosting.helpplc.co.uk (8.10.2/8.10.2) with ESMTP id
h6BG4j513185
	for <info@xxxx.co.uk>; Fri, 11 Jul 2003 17:04:46 +0100
Date: Fri, 11 Jul 2003 17:04:46 +0100
Message-Id: <200307111604.h6BG4j513185@ns.helpplc.co.uk>
From: "me2@hotmail.com" <me2@hotmail.com>
Subject: 
 
=?GB2312?B?08PI/bfW1tOjrL2owaLX1Ly6tcR3ZWLT79L0wcTM7LrNtee7sLvh0unPtc2z?
=
X-MailScanner-Information: Provided by Help Internet - 01707 897111
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: not spam, SpamAssassin (score=5.7, required 6,
	BAYES_20, CHARSET_FARAWAY_HEADERS, FORGED_HOTMAIL_RCVD,
HTML_10_20,
	HTML_CHARSET_FARAWAY, HTML_TITLE_UNTITLED,
UNDESIRED_LANGUAGE_BODY)
X-MailScanner-SpamScore: sssss
X-UIDL: 3NU!!M%-!!K$f"!G3&!!

Message:


=?GB2312?B?o6zD4rfRz8LU2Mq508M=?=
To: info@xxxx.co.uk
Content-Type: text/html;charset="GB2312"
Reply-To: me2@hotmail.com
Date: Sat, 12 Jul 2003 00:06:09 +0800
X-Priority: 3
X-Mailer: Microsoft Outlook Express 6.00.2600.0000

<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
</head>

<body bgcolor="#FFFFFF" text="#000000">
<p>ÓÃÈý·ÖÖÓ£¬½¨Á¢×Ô¼ºµÄwebÓïÒôÁÄÌìºÍµç»°»áÒéϵͳ£¬Ãâ·ÑÏÂÔØʹÓá£</p>
<p>MeChatÓÃweb·½Ê½ÊµÏÖÎÄ×ÖºÍÓïÒôÁÄÌì,ÓïÒôÊý¾Ý¿ÉÒÔͨ¹ý¾ÖÓòÍø¡¢ADSL¡¢
Internet¡¢NAT¡£ </p>
<p>ÓÃ;°üÀ¨:<br>
  1.´ó¡¢ÖС¢Ð¡ÍøÕ¾µÄµÄÓïÒôÁÄÌìÊÒ¡£<br>
  2.Ô¶³Ì½ÌÓý£¬ÌرðÓÃÀ´Ñ§Ï°½»Á÷ÍâÓï¡£<br>
  3.ºÍweb·½Ê½µÄOAϵͳ½áºÏ£¬ÊµÏÖ·½±ã¹«Ë¾ÄÚ²¿½»Á÷.¿ÉÒÔ×÷Ϊµç»°»áÒéϵͳ¡£
</p>
<p>°²×°¹ý³Ì·ÖÈý²½,ÿ²½Ò»·ÖÖÓ×óÓÒ£º<br>
  Ãâ·Ñ<a href="http://www.mechat.com/cn/download/MeChat3.60.zip">ÏÂÔØ
</a>£»ÓÃwinzip½âѹËõ£»ÔÚ½âѹËõĿ¼˫»÷install.bat£»
<p>ÏêϸÐÅÏ¢£¬¿ÉÒÔ·ÃÎʵØÖ·<a href="http://www.mechat.com/cn/">
http://www.mechat.com/cn/</a>¡£
<p>MeChat°²×°¡¢Î¬»¤¼«Æä¼òµ¥¡£MeChat²ÉÓÃC++±àÖÆ£¬ËÙ¶ÈÆæ¿ì£¬Èç¹ûÎı¾ÁÄÌìÖ§
³Ö5000ÈËͬʱÔÚÏß! MeChatÁé»îµÄÄ£°å½á¹¹£¬ÌṩÄúÒ»¸ö³ä·Öչʾ×Ô¼º¸öÐÔµÄƽ
̨¡£Ö§³ÖwindowNT/2000/XP/linux/solaris/unix¡£±¾ÏµÍ³ÎÞÐèÈκÎWEB 
  SERVER¡¢Êý¾Ý¿âϵͳ֧³Ö£¬ÍêÈ«¶ÀÁ¢ÔËÐС£</p>
<p>MeChat Server¿ÉÒÔ°ÑÊý¾Ý´æ´¢ÔÚÎļþÖУ¬Ò²¿ÉÒÔ·ÅÔÚÊý¾Ý¿âÖУ¬Ê¹ÓÃÊý¾Ý¿â£¬
¸üÈÝÒ׺ÍÆäËû³ÌÐòÒ»ÆðʹÓá£Ö§³ÖµÄÊý¾Ý¿âÓÐAccess,Ms Sql 
  Server,MySql,OralceµÈ.</p>
<p>²»Í¬ÓëÒ»°ãµÄCGIºÍASPµÄÁÄÌì³ÌÐò£¬MeChatÕ¼Ó÷þÎñÆ÷µÄ×ÊÔ´·Ç³£ÉÙ¡£·þÎñÆ÷
Ó²¼þÅäÖÃΪ£ºDELL PIII-550 256MÄڴ棬ͬһ̨·þÎñÆ÷ÉÏ»¹ÔËÐÐ×ÅÐí¶àÓ¦Ó㬠
  500ÈËͬʱÔÚÏßʱ£¬MeChat½öÏûºÄ2%-6%µÄCPU£¬5M×óÓÒµÄÄÚ´æ¡£¶øÇÒÁ¬ÐøÔËÐÐÁË
Èý¸ö¶àÔ´Óδ³öÏÖ¹ý±ÀÀ£µÄÇé¿ö¡£ Èç¹ûÓÃASP»òÆäËû»ùÓÚWeb serverµÄÁÄÌì³ÌÐò£¬
¿ÖÅÂCPUÖÁÉÙÒ²µ½99%ÁË!<br>
  ËùÒÔ£¬Ê¹ÓÃMeChatÄãÔÙÒ²²»±Øµ£ÐÄÁÄÌì³ÌÐò»áÍÏ¿åÄúµÄ·þÎñÆ÷£¬¶øÇÒÄãÒ²¾ø¶Ô²»
Óõ¥¶ÀΪÁÄÌìÊÒ¶øרÃÅÉèÁ¢Ò»Ì¨·þÎñÆ÷¡£ µã»÷<a
href="http://demo2.mechat.com:6000/">MeChatÑÝʾÁÄÌìÊÒ</a>¿´³ÌÐòÑÝʾЧ¹û.
</p>
<p><br>
</p>
</body>
</html>


>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Kevin Spicer
>Sent: 10 July 2003 18:40
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Chinese Emails
>
>
>So just add this at the end?
>
>score MIME_CHARSET_FARAWAY 3
>
>Yes, but you should first activate
>
>Always Include SpamAssassin Report = yes
>
>so that you can see whether that rule is in fact being 
>triggered by these emails, and decide what to change the score 
>to.  There may be other scores you want to tweak too.
>
>
>
>
>BMRB International
>http://www.bmrb.co.uk
>+44 (0)20 8566 5000
>_________________________________________________________________
>This message (and any attachment) is intended only for the 
>recipient and may contain confidential and/or privileged 
>material.  If you have received this in error, please contact 
>the sender and delete this message immediately.  Disclosure, 
>copying or other action taken in respect of this email or in 
>reliance on it is prohibited.  BMRB International Limited 
>accepts no liability in relation to any personal emails, or 
>content of any email which does not directly relate to our business.
>

--This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and isbelieved to be clean. For details on having your email scanned email support@helpinternet.co.uk


From Kevin.Spicer at BMRB.CO.UK  Mon Jul 14 11:59:24 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:56 2006
Subject: Chinese Emails
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF721@pascal.priv.bmrb.co.uk>

Richard Sidlin wrote:
> Here's one that got through. Any thoughts?

Your threshold is quite conservative!

Maybe increase the scores for each of these (say by 0.3 or 0.4)  I don't know what the current scores are so you'll have to look them up!
CHARSET_FARAWAY_HEADERS
HTML_CHARSET_FARAWAY
UNDESIRED_LANGUAGE_BODY



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From richard at HELPPLC.COM  Mon Jul 14 12:09:26 2003
From: richard at HELPPLC.COM (Richard Sidlin)
Date: Thu Jan 12 21:18:56 2006
Subject: Chinese Emails
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF721@pascal.priv.bmrb.co.uk>
Message-ID: <001b01c349f8$673fb010$0b01a8c0@rich>

The only manual entry I have in spam.assassin.prefs.conf is:

Score MIME_CHARSET_FARAWAY 3

Should I add some others under this and can you be specific please!


Richard

>-----Original Message-----
>From: MailScanner mailing list
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Spicer, Kevin
>Sent: 14 July 2003 11:59
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Chinese Emails
>
>
>Richard Sidlin wrote:
>> Here's one that got through. Any thoughts?
>
>Your threshold is quite conservative!
>
>Maybe increase the scores for each of these (say by 0.3 or
>0.4)  I don't know what the current scores are so you'll have
>to look them up! CHARSET_FARAWAY_HEADERS HTML_CHARSET_FARAWAY
>UNDESIRED_LANGUAGE_BODY
>
>
>
>BMRB International
>http://www.bmrb.co.uk
>+44 (0)20 8566 5000
>_________________________________________________________________
>This message (and any attachment) is intended only for the
>recipient and may contain confidential and/or privileged
>material.  If you have received this in error, please contact the
>sender and delete this message immediately.  Disclosure, copying
>or other action taken in respect of this email or in
>reliance on it is prohibited.  BMRB International Limited
>accepts no liability in relation to any personal emails, or
>content of any email which does not directly relate to our
>business.
>
>



--
This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email support@helpinternet.co.uk

From mailscanner at BARENDSE.TO  Mon Jul 14 12:15:03 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:56 2006
Subject: Chinese Emails
In-Reply-To: <001b01c349f8$673fb010$0b01a8c0@rich>
Message-ID: <Pine.LNX.4.44.0307141314001.29617-100000@raveon.barendse.to>

and also increase the scores for the other items:
CHARSET_FARAWAY_HEADERS
HTML_CHARSET_FARAWAY

Installing DCC also helps a lot, I now only get 1-2 mails per week for all
my users that slip through!

On Mon, 14 Jul 2003, Richard Sidlin wrote:

> The only manual entry I have in spam.assassin.prefs.conf is:
>
> Score MIME_CHARSET_FARAWAY 3
>
> Should I add some others under this and can you be specific please!
>
>
> Richard
>
> >-----Original Message-----
> >From: MailScanner mailing list
> >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Spicer, Kevin
> >Sent: 14 July 2003 11:59
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Chinese Emails
> >
> >
> >Richard Sidlin wrote:
> >> Here's one that got through. Any thoughts?
> >
> >Your threshold is quite conservative!
> >
> >Maybe increase the scores for each of these (say by 0.3 or
> >0.4)  I don't know what the current scores are so you'll have
> >to look them up! CHARSET_FARAWAY_HEADERS HTML_CHARSET_FARAWAY
> >UNDESIRED_LANGUAGE_BODY
> >
> >
> >
> >BMRB International
> >http://www.bmrb.co.uk
> >+44 (0)20 8566 5000
> >_________________________________________________________________
> >This message (and any attachment) is intended only for the
> >recipient and may contain confidential and/or privileged
> >material.  If you have received this in error, please contact the
> >sender and delete this message immediately.  Disclosure, copying
> >or other action taken in respect of this email or in
> >reliance on it is prohibited.  BMRB International Limited
> >accepts no liability in relation to any personal emails, or
> >content of any email which does not directly relate to our
> >business.
> >
> >
>
>
>
> --
> This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and is
> believed to be clean. For details on having your email scanned email support@helpinternet.co.uk
>

From Kevin.Spicer at BMRB.CO.UK  Mon Jul 14 12:18:46 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:56 2006
Subject: Chinese Emails
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF724@pascal.priv.bmrb.co.uk>

Richard Sidlin wrote:
> The only manual entry I have in spam.assassin.prefs.conf is:
> 
> Score MIME_CHARSET_FARAWAY 3
> 
> Should I add some others under this and can you be specific please!

Yes.  look up the current scores for each of the following (if they are not in spam.assassin.prefs.conf grep for them in the files in /usr/share/spamassassin) then add a line for each to spam.assassin.prefs.conf, adding 0.3 to the score in each case.

I can't tell you what the scores should be because it depends which ruleset you are using.

CHARSET_FARAWAY
CHARSET_FARAWAY_HEADERS 
HTML_CHARSET_FARAWAY
MIME_CHARSET_FARAWAY
UNDESIRED_LANGUAGE_BODY 



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From richard at HELPPLC.COM  Mon Jul 14 12:22:36 2003
From: richard at HELPPLC.COM (Richard Sidlin)
Date: Thu Jan 12 21:18:56 2006
Subject: Chinese Emails
In-Reply-To: <Pine.LNX.4.44.0307141314001.29617-100000@raveon.barendse.to>
Message-ID: <002201c349fa$3d98edb0$0b01a8c0@rich>

I have the following setting:

Score DCC_CHECK 0.0

Do I need to change the score on this?

Richard


>-----Original Message-----
>From: MailScanner mailing list
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Remco Barendse
>Sent: 14 July 2003 12:15
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Chinese Emails
>
>
>and also increase the scores for the other items:
>CHARSET_FARAWAY_HEADERS HTML_CHARSET_FARAWAY
>
>Installing DCC also helps a lot, I now only get 1-2 mails per
>week for all my users that slip through!
>
>On Mon, 14 Jul 2003, Richard Sidlin wrote:
>
>> The only manual entry I have in spam.assassin.prefs.conf is:
>>
>> Score MIME_CHARSET_FARAWAY 3
>>
>> Should I add some others under this and can you be specific please!
>>
>>
>> Richard
>>
>> >-----Original Message-----
>> >From: MailScanner mailing list
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> >Behalf Of Spicer,
>Kevin
>> >Sent: 14 July 2003 11:59
>> >To: MAILSCANNER@JISCMAIL.AC.UK
>> >Subject: Re: Chinese Emails
>> >
>> >
>> >Richard Sidlin wrote:
>> >> Here's one that got through. Any thoughts?
>> >
>> >Your threshold is quite conservative!
>> >
>> >Maybe increase the scores for each of these (say by 0.3 or
>> >0.4)  I don't know what the current scores are so you'll
>have to look
>> >them up! CHARSET_FARAWAY_HEADERS HTML_CHARSET_FARAWAY
>> >UNDESIRED_LANGUAGE_BODY
>> >
>> >
>> >
>> >BMRB International
>> >http://www.bmrb.co.uk
>> >+44 (0)20 8566 5000
>> >_________________________________________________________________
>> >This message (and any attachment) is intended only for the
>recipient
>> >and may contain confidential and/or privileged material.
>If you have
>> >received this in error, please contact the sender and delete this
>> >message immediately.  Disclosure, copying or other action taken in
>> >respect of this email or in reliance on it is prohibited.  BMRB
>> >International Limited accepts no liability in relation to any
>> >personal emails, or content of any email which does not directly
>> >relate to our business.
>> >
>> >
>>
>>
>>
>> --
>> This message has been scanned for viruses and dangerous
>content by the
>> Help Internet Virus Spam Defence, and is believed to be clean. For
>> details on having your email scanned email support@helpinternet.co.uk
>>
>
>



--
This message has been scanned for viruses and dangerous content by the Help Internet Virus Spam Defence, and is
believed to be clean. For details on having your email scanned email support@helpinternet.co.uk

From Kevin.Spicer at BMRB.CO.UK  Mon Jul 14 12:24:53 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:56 2006
Subject: Chinese Emails
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF726@pascal.priv.bmrb.co.uk>

Richard Sidlin wrote:
> I have the following setting:
> 
> Score DCC_CHECK 0.0
> 
> Do I need to change the score on this?
> 
> Richard
> 
Only if you have installed DCC



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From tony.johansson at SVENSKAKYRKAN.SE  Mon Jul 14 13:02:47 2003
From: tony.johansson at SVENSKAKYRKAN.SE (Tony Johansson)
Date: Thu Jan 12 21:18:56 2006
Subject: Messages per user survey
Message-ID: <LISTSERV%2003071413024754@JISCMAIL.AC.UK>

Hello,

I'm interested in knowing how many messages your users send/receive per day
on average. (external traffic)

I have some fairly low-volume users. The grand total is no more than 1.5
incoming messages and about 1.1 outgoing per day for a total of 14.000
users.

I ask because I've seen some pretty weird quotes saying that the average
email user gets 24 and send 11 (or so) messages per day. Would be
interesting with some real live figures from this list as a reference.


regards, Tony

From denis at CROOMBS.ORG  Mon Jul 14 13:11:13 2003
From: denis at CROOMBS.ORG (Denis Croombs)
Date: Thu Jan 12 21:18:56 2006
Subject: Messages per user survey
References: <LISTSERV%2003071413024754@JISCMAIL.AC.UK>
Message-ID: <00b401c34a01$05d05d30$85b8fea9@Laptop>

Hi

I have a number of servers & 1 of these handles between 1500 to 2500
received emails per day & 20 to 100 emails sent per day, this servers has 10
users.

Denis

www.just-servers.co.uk

----- Original Message -----
From: "Tony Johansson" <tony.johansson@SVENSKAKYRKAN.SE>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, July 14, 2003 1:02 PM
Subject: Messages per user survey


> Hello,
>
> I'm interested in knowing how many messages your users send/receive per
day
> on average. (external traffic)
>
> I have some fairly low-volume users. The grand total is no more than 1.5
> incoming messages and about 1.1 outgoing per day for a total of 14.000
> users.
>
> I ask because I've seen some pretty weird quotes saying that the average
> email user gets 24 and send 11 (or so) messages per day. Would be
> interesting with some real live figures from this list as a reference.
>
>
> regards, Tony

From myr at HTW-SAARLAND.DE  Mon Jul 14 13:49:22 2003
From: myr at HTW-SAARLAND.DE (Margit Meyer)
Date: Thu Jan 12 21:18:56 2006
Subject: Notify sender and postmaster
Message-ID: <LISTSERV%2003071413492243@JISCMAIL.AC.UK>

>
>>Notify Senders = yes
>>Send Notices = yes
>>Notices From = MailScanner
>                           ^^^^^^ No domain?
>

>I have had this in another situation (not MS related) where the
>mailserver did not accept the from-address because he knew it didn't
>exist. Neither could he return a bounce because the address did not
>exist.
>
>--
>Peter Peters, senior netwerkbeheerder
>Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
>Universiteit Twente,  Postbus 217,  7500 AE  Enschede
>telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

I added our domain and created the account MailScanner - but it didn' t help.

Regards
Margit

From Thomas.Ehweiner at T-SYSTEMS.COM  Mon Jul 14 16:30:55 2003
From: Thomas.Ehweiner at T-SYSTEMS.COM (Thomas Ehweiner)
Date: Thu Jan 12 21:18:56 2006
Subject: AW: Strange (non working) behaviour 4.22-4
Message-ID: <698647D9732ED84290AB276EC481B64301EEB0@U8SM7.gppng01.telekom.de>

Same behaviour by me. But MS doesn?t works never before. Every message is unscanned. 

Jul 14 17:00:54 192.168.10.52 MailScanner[5913]: MailScanner E-Mail Virus Scanner version 4.22-5 starting... 
Jul 14 17:00:55 192.168.10.52 MailScanner[5913]: Using locktype = flock 
Jul 14 17:01:00 192.168.10.52 MailScanner[5913]: New Batch: Forwarding 1 unscanned messages, 5652 bytes 
Jul 14 17:01:00 192.168.10.52 MailScanner[5913]: Spam Checks: Starting 
Jul 14 17:01:00 192.168.10.52 MailScanner[5913]: Unscanned: Delivered 1 messages 
Jul 14 17:01:00 192.168.10.52 MailScanner[5913]: Virus and Content Scanning: Starting

No whitelisting for sender domain/IP. No blacklist.
SA-Test ("spamassassin -t < sample-spam.txt > spam.out") is ok.

SA 2.55
MS 4.22-5
Solaris 8
perl 5.8

in mailscanner.conf:

Mark Infected Messages = yes
Mark Unscanned Messages = yes
Deliver Cleaned Messages = yes
Detailed Spam Report = yes
Include Scores In SpamAssassin Report = yes

sendmail-in runs as smmsp, sendmail-out as root. Use MS only for spam checking (Virus Scanning = no). Any help would be appreciated.

Norman, 

Thomas


> -----Urspr?ngliche Nachricht-----
> Von: Norman Schmidt Jr [mailto:norman@NORMAN.COM.BR]
> Gesendet: Montag, 14. Juli 2003 03:20
> An: MAILSCANNER@JISCMAIL.AC.UK
> Betreff: Strange (non working) behaviour 4.22-4
> 
> 
> Some days ago I installed a sendmail 8.12.9 + mailscanner 4.22-4. The 
> setup worked flawlessy for two days, scanning and blocking viruses and 
> blocking attachments as configured in filename and 
> filetype.rules.conf. Everything was running fine and smoothly. On 
> Saturday, after some "MailScanner child dying of old age" and 
> restarting messages - and absolutely NO modifications on any config 
> file - Mailscanner stopped to scan and block files, and its now just 
> forwarding unscanned messages. Everything goes in: viruses, files 
> blocked by rules, etc:
> 
> MailScanner[1122]: New Batch: Forwarding 1 unscanned messages, 8465 
> bytes
> MailScanner[1122]: Unscanned: Delivered 1 messages
> 
> I really dont have a clue about what happened. Everything looks fine. 
> Can someone help me pointing where I can start looking for something 
> wrong? Thanks in advance, Norman
> 


From Kevin.Spicer at BMRB.CO.UK  Mon Jul 14 16:45:54 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:56 2006
Subject: Strange (non working) behaviour 4.22-4
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF72D@pascal.priv.bmrb.co.uk>

> (Virus Scanning = no)

That turns off all processing, including spam checks!  It is misnamed, but theres a historical reason for that.  You need to set Virus Scanning=yes and Virus Scanners=no, you'llprobably want to disable the other virus related content checks too (read the comments in MailScanner.conf).



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From Thomas.Ehweiner at T-SYSTEMS.COM  Mon Jul 14 17:29:48 2003
From: Thomas.Ehweiner at T-SYSTEMS.COM (Thomas Ehweiner)
Date: Thu Jan 12 21:18:56 2006
Subject: AW: Strange (non working) behaviour 4.22-4
Message-ID: <698647D9732ED84290AB276EC481B64301EEB1@U8SM7.gppng01.telekom.de>

Kevin, you?re right! It works.

Another issue is, Mailscanner complains about logging. 
In Debug-mode:

--------------------
Starting MailScanner...
In Debugging mode, not forking...
unix passed to setlogsock, but path not available at /opt/MailScanner/lib/MailScanner/Log.pm line 62
debug: Score set 0 chosen.
debug: running in taint mode? no
-----------------

I?m using syslog-ng 1.6 with this source
"source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal();"

facility is local4 (to /var/log/scanmail) - and it works!
Should I pay attention to the error message above?

Thomas


> -----Urspr?ngliche Nachricht-----
> Von: Spicer, Kevin [mailto:Kevin.Spicer@BMRB.CO.UK] 
> Gesendet: Montag, 14. Juli 2003 17:46
> An: MAILSCANNER@JISCMAIL.AC.UK
> Betreff: Re: Strange (non working) behaviour 4.22-4
> 
> 
> > (Virus Scanning = no)
> 
> That turns off all processing, including spam checks!  It is 
> misnamed, but theres a historical reason for that.  You need 
> to set Virus Scanning=yes and Virus Scanners=no, 
> you'llprobably want to disable the other virus related 
> content checks too (read the comments in MailScanner.conf).
> 
> 
> 
> BMRB International 
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the 
> recipient and may contain confidential and/or privileged 
> material.  If you have received this in error, please contact the 
> sender and delete this message immediately.  Disclosure, copying 
> or other action taken in respect of this email or in 
> reliance on it is prohibited.  BMRB International Limited 
> accepts no liability in relation to any personal emails, or 
> content of any email which does not directly relate to our 
> business.
> 


From ka at PACIFIC.NET  Mon Jul 14 17:30:11 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:56 2006
Subject: MS Performance
In-Reply-To: <LISTSERV%2003071107433847@JISCMAIL.AC.UK>
References: <LISTSERV%2003071107433847@JISCMAIL.AC.UK>
Message-ID: <3F12DA93.4060804@pacific.net>

We relay about 500k emails a day through 2 MS machines running redhat &
sendmail. Both machines are dual Xeon/1gb RAM/SCSI, RAID1
About 45% of the total incoming mail is spam, half of which is deleted.

With the exception of the following, it's a default rpm install:
Max Children = 15
Log Spam = yes (since we need the logs for stats.)
MS Spam Action is "attachment, deliver".
If one rbl goes down or is slow, we found that we very quickly had a
backlog of 20k messages, so we've turned off rbl checks in SA. Adjusting
the timeouts for rbl checks may be a better solution.

We've made a few other tweaks to the default MS settings, but I don't
think they are related to performance.

The load average when the machines are sharing the mail load is usually
about 3-4, rising to about 10-15 when one machine handles the full load
by itself. Everything seems to fit into memory, there is no swapping to
disk, and the average delay for a message being relayed is < 1 minute.

A possible bottleneck is syslog, since both sendmail & MS are very busy
adding log entries to the maillog, though I haven't done any testing to
see if this is really a problem.

Another bottleneck is the way 'user unknowns' are handled. Currently,
because mail is relayed through the MS boxes, the MS boxes don't know if
the user exists at the domain or not. So MS spends time scanning mail
that is destined for a user that doesn't exist. Next Sendmail tries to
deliver it and it is rejected by the destination mailserver. Then
sendmail tries to bounce it back to an address that usually doesn't
exist, or a mailserver that is not accepting connections or can't be
resolved. Using re-mqueue to re-queue outgoing mail is helpful with this
problem.

Ken A.


Tony Johansson wrote:
>>I am processing around 600.000 messages on two dual xeon machines, daily,
>>with peaks to 800.000-1.000.000 daily. I think MS is doing just fine :)
>>
>>Most of the time its a matter of the test setup also that is limiting the
>>figures. Also some tweaking on the machines wont harm...
>>
>>Bye,
>>Raymond.
>
>
> What MTA are you using? I recall an earlier post by Julian where he tested
> exim vs sendmail on one of his test machines, getting 3 times the
> throughput with exim.
>
> I'm interested in what kind of performance people are getting with sendmail
> and MS. I'm about to design a system built on redhat and sendmail which
> will handle lots of relaying (500k-1mil email daily approx)
>
> I'd rather use sendmail but if the performance gain with exim really is 3
> to 1 that might be the road we haveto take.
>
> regards, Tony
>
>

From lists at STHOMAS.NET  Mon Jul 14 17:50:47 2003
From: lists at STHOMAS.NET (Steve Thomas)
Date: Thu Jan 12 21:18:56 2006
Subject: FW: qmail smtp-auth bug allows open relay
Message-ID: <20030714095047.A13086@sthomas.net>

Heads up to all qmail users out there...

----- Forwarded message from John Brown -----

Date: Mon, 14 Jul 2003 10:34:00 -0600
From: John Brown <.....@chagresventures.com>
To: nanog@merit.edu
Subject: qmail smtp-auth bug allows open relay


seems that there are installs of the smtp-auth patch
to qmail that accept anything as a user name and password
and thus allow you to connect.

http://marc.theaimsgroup.com/?l=qmail&m=105452174430616&w=2

is one URL that talks about this.

There has been an increase is what appears to be qmail based
open-relays over the last 5 days.  Each of these servers
pass the normal suite of open-relay tests.

Spammers are scanning for SMTP-AUTH and STARTTLS based
mail servers that may be misconfigured. Then using them
to send out their trash.

Some early docs on setting up qmail based smtp-auth systems
had the config infor incorrect.  This leads to /usr/bin/true
being used as the password checker. :(

>From an operational perspective, I suspect we will see more
SMTP scans

The basic test (see URL above) should get incorporated into
various open-relay testing scripts.

cheers

john brown
chagres technologies, inc

----- End forwarded message -----

--
"All truth passes through three stages. First, it is ridiculed. Second, it is violently opposed. Third, it is accepted as being self-evident."
- Arthur Schopenhauer (1788-1860)

From tsevy at EPX.COM  Mon Jul 14 17:54:51 2003
From: tsevy at EPX.COM (Tom Sevy)
Date: Thu Jan 12 21:18:56 2006
Subject: MS Performance
Message-ID: <006101c34a28$a4727e60$bc0aa8c0@epx.com>

Don't know what you use for Firewalling, but I have taken the top invalid
recipients and created a rule in our Firewalls to reject email to them.

----- Original Message -----
From: "Ken Anderson" <ka@PACIFIC.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, July 14, 2003 12:30 PM
Subject: Re: MS Performance


We relay about 500k emails a day through 2 MS machines running redhat &
sendmail. Both machines are dual Xeon/1gb RAM/SCSI, RAID1
About 45% of the total incoming mail is spam, half of which is deleted.

With the exception of the following, it's a default rpm install:
Max Children = 15
Log Spam = yes (since we need the logs for stats.)
MS Spam Action is "attachment, deliver".
If one rbl goes down or is slow, we found that we very quickly had a
backlog of 20k messages, so we've turned off rbl checks in SA. Adjusting
the timeouts for rbl checks may be a better solution.

We've made a few other tweaks to the default MS settings, but I don't
think they are related to performance.

The load average when the machines are sharing the mail load is usually
about 3-4, rising to about 10-15 when one machine handles the full load
by itself. Everything seems to fit into memory, there is no swapping to
disk, and the average delay for a message being relayed is < 1 minute.

A possible bottleneck is syslog, since both sendmail & MS are very busy
adding log entries to the maillog, though I haven't done any testing to
see if this is really a problem.

Another bottleneck is the way 'user unknowns' are handled. Currently,
because mail is relayed through the MS boxes, the MS boxes don't know if
the user exists at the domain or not. So MS spends time scanning mail
that is destined for a user that doesn't exist. Next Sendmail tries to
deliver it and it is rejected by the destination mailserver. Then
sendmail tries to bounce it back to an address that usually doesn't
exist, or a mailserver that is not accepting connections or can't be
resolved. Using re-mqueue to re-queue outgoing mail is helpful with this
problem.

Ken A.


Tony Johansson wrote:
>>I am processing around 600.000 messages on two dual xeon machines, daily,
>>with peaks to 800.000-1.000.000 daily. I think MS is doing just fine :)
>>
>>Most of the time its a matter of the test setup also that is limiting the
>>figures. Also some tweaking on the machines wont harm...
>>
>>Bye,
>>Raymond.
>
>
> What MTA are you using? I recall an earlier post by Julian where he tested
> exim vs sendmail on one of his test machines, getting 3 times the
> throughput with exim.
>
> I'm interested in what kind of performance people are getting with
sendmail
> and MS. I'm about to design a system built on redhat and sendmail which
> will handle lots of relaying (500k-1mil email daily approx)
>
> I'd rather use sendmail but if the performance gain with exim really is 3
> to 1 that might be the road we haveto take.
>
> regards, Tony
>
>

From norman at NORMAN.COM.BR  Mon Jul 14 18:01:45 2003
From: norman at NORMAN.COM.BR (Norman Schmidt Jr)
Date: Thu Jan 12 21:18:56 2006
Subject: Strange (non working) behaviour 4.22-4
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF71A@pascal.priv.bmrb.co.uk>
Message-ID: <3F12E1F9.4070501@norman.com.br>

Hi Folks,
At first, thanks to everybody who replied my post!
For the record, I found the problem:
Friday I was playing with the webmin mailscanner module
(http://lushsoft.dyndns.org/mailscanner-webmin/) in that server.
Although I hadnt saved any configuration change using that webmin module
- installing it just to check how look its interface - it seems that the
first thing the module did was change the "Virus Scanning"
MailScanner.conf directive to "no", without any warning. As it was
supposed to be, new child processes were reborning forwarding
everything. As this is such a blatantly obvious problem and I am subject
to all Murphy's laws, I simply didnt saw it in my three or four previous
.conf file checks.  A fifth check after a cup of coffee and a (thanks
Matt!) grep -v ^# MailScanner.conf hit the spot.
Again, thanks everybody!
Norman

Spicer, Kevin escreveu:
 >>I really dont have a clue about what happened. Everything looks fine.
 >>Can someone help me pointing where I can start looking for something
 >>wrong? Thanks in advance,
 >
 >
 > Sounds like you might have a sendmail process running which is
bypassing mailscanner, try (assuming RedHat like syntax)
 >
 > service MailScanner stop
 > service sendmail stop
 > chkconfig sendmail --level 2345 off
 >
 > ps -elf | grep sendmail
 > [Now kill all sendmail processes & ps again to check they are dead]
 >
 > service MailScanner start
 >
 > If that doesn't work could you post some of your maillog so we can
see whats happening.
 >
 >
 >
 > BMRB International
 > http://www.bmrb.co.uk
 > +44 (0)20 8566 5000
 > _________________________________________________________________
 > This message (and any attachment) is intended only for the
 > recipient and may contain confidential and/or privileged
 > material.  If you have received this in error, please contact the
 > sender and delete this message immediately.  Disclosure, copying
 > or other action taken in respect of this email or in
 > reliance on it is prohibited.  BMRB International Limited
 > accepts no liability in relation to any personal emails, or
 > content of any email which does not directly relate to our
 > business.
 >
 >

From vanhorn at whidbey.com  Mon Jul 14 18:53:59 2003
From: vanhorn at whidbey.com (G. Armour Van Horn)
Date: Thu Jan 12 21:18:56 2006
Subject: Smooth upgrade to 4.22-5
References: <5.2.1.1.2.20030606191640.02586da8@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030606180831.03cf99a0@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030606180831.03cf99a0@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030606191640.02586da8@imap.ecs.soton.ac.uk>
            <5.2.1.1.2.20030608145043.03927510@imap.ecs.soton.ac.uk>
Message-ID: <3F12EE37.66408831@whidbey.com>

Julian,

I just reved my system to 4.22-5 (from 4.14-9, also reved SA from 2.53 to 2.55)
with no problems at all. (Well, I did have to include ignore-perl, but that's a
known artifact of something that you and I went throuh last year, but I didn't
have to force anything else.) When I restarted the service I checked to make sure
all my processes were running, and was stunned to find that I had two Queue
runners serving /var/spool/clientmqueue, one from last month, and one from the
restart.

Yippee!!! I no long have to remember to manually start that queue after a system
restart.

Van




--
----------------------------------------------------------
Sign up now for Quotes of the Day, a handful of quotations
on a theme delivered every morning.
Enlightenment! Daily, for free!
mailto:twisted@whidbey.com?subject=Subscribe_QOTD

For web hosting and maintenance,
visit Van's home page: http://www.domainvanhorn.com/van/
----------------------------------------------------------

From chris at FRACTALWEB.COM  Mon Jul 14 18:54:10 2003
From: chris at FRACTALWEB.COM (Chris Yuzik)
Date: Thu Jan 12 21:18:56 2006
Subject: strange glitch results in lost mail
Message-ID: <038a01c34a30$edcff3a0$1501a8c0@pandora>

Hi everyone,

I have SpamAssassin and MailScanner running on my RedHat 7.3 machine. The server is running Ensim WEBppliance PRO 3.5.10. The server hosts about a dozen domains. I run sendmail and procmail. Almost everything works great. Almost.

Mail from the outside world works as expected, gets scanned and scored and so forth. I've got SA's threshold set to 5 and am running DCC and Razor...in the two days I tested it over the weekend, it correctly identified 99%+ of spam.

My big problem is that sometimes mail from within the server never arrives...never bounces...just goes to a black hole.

I'll list some examples so it makes more sense:

1) let's pretend that domain1.com and domain2.com are hosted on my server. external1.com is not hosted on my server.
2) steve@domain1.com and john@domain1.com can both sent to and receive email from susan@external1.com just fine. dave@domain2.com and scott@domain2.com can also sent to and receive email from susan@external1.com to. Internal to the outside world works.
3) steve@domain1.com can not email john@domain1.com and vice-versa. Internal to internal is not working.
4) it gets stranger. dave@domain2.com can send email to scott@domain2.com, but not the other way around. If scott replies to dave's message, then dave never gets the reply.

As I said before, the message doesn't bounce or anything...it just goes into a black hole and is never seen again.

When I installed MailScanner, the documentation said I was supposed to do the following (which is what I did):
1) "service sendmail stop"
2) "service MailScanner start"

In an attempt to troubleshoot the problem, I tried the following:
1) "service MailScanner stop"
2) "service sendmail start"
3) "service MailScanner start"

Now everyone can email everyone else: internal<-> internal and internal<->external just fine. Unfortunately, now nothing gets processed through spamassassin.

How do I go about fixing this?

Please help.

Regards,
Chris Yuzik
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030714/30263958/attachment.html
From damian at WORKGROUPSOLUTIONS.COM  Mon Jul 14 19:15:29 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
Message-ID: <F6B4162F6771E44ABF0958023547FFC413D2DB@w2kserver.workgroupsolutions.com>

Kevin,

Thanks for the feedback - I now believe that the message was scanned, but did not score high enough to be displayed as SPAM in my logs or the header of the message. It was a strange message with a lot of misspelled words.


Regards,

Damian

-----Original Message-----
From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
Sent: Sunday, July 13, 2003 2:13 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Some spam getting through for some odd reason


>On Sun, 2003-07-13 at 21:35, Damian Mendoza wrote:

>You are correct as it does not match. The spam check should be for
>[32466] I believe.

I'm not sure that we are clear whats going on.  I've split your supplied
log up to show the progress of the message incorrectly delivered
(h6A04Q9F032454) and ignoring the other correctly processed message
(h6A04Q9G032454)   (note the single character difference - G not F)


MESSAGE h6A04Q9F032454 (incorrectly delivered without scanning)
<start>

Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9F032454:
from=<swims-blew@kroc.com>, size=2207, class=0, nrcpts=1,
msgid=<2730416505.01380945810856@kroc.com>, proto=ESMTP, daemon=MTA,
relay=gateway.svusd.k12.ca.us [198.188.250.254]

Jul  9 17:04:27 spamgate sendmail[32454]: h6A04Q9F032454:
to=<chuw@svusd.k12.ca.us>, delay=00:00:00, mailer=esmtp, pri=30531,
stat=queued

Jul  9 17:04:31 spamgate MailScanner[26052]: Unscanned: Delivered 1
messages

Jul  9 17:04:32 spamgate sendmail[32466]: h6A04Q9F032454:
to=<chuw@svusd.k12.ca.us>, delay=00:00:05, xdelay=00:00:01,
mailer=esmtp, pri=120531, relay=[10.1.254.3] [10.1.254.3], dsn=2.0.0,
stat=Sent ( <2730416505.01380945810856@kroc.com> Queued mail for
delivery)

<end>

There must be a reason why MS is ignoring these messages.  It looks like
the sender forged the server HELO to use a name in your domain (the name
and IP don't resolve to each other).  If you are whitelisting based on
domain, or have virus checking turned off for some mail (maybe
'outgoing'?) then this may explain the behaviour. Could you post your
various rulesets and the values for 'Virus Scanning' and 'Spam Checks'
from MailScanner.conf?






BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.


From mikea at MIKEA.ATH.CX  Mon Jul 14 19:22:36 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
In-Reply-To: <F6B4162F6771E44ABF0958023547FFC413D2DB@w2kserver.workgroupsolutions.com>; from
              damian@WORKGROUPSOLUTIONS.COM on Mon, Jul 14,
              2003 at 11:15:29AM -0700
References: <F6B4162F6771E44ABF0958023547FFC413D2DB@w2kserver.workgroupsolutions.com>
Message-ID: <20030714132236.A63832@mikea.ath.cx>

On Mon, Jul 14, 2003 at 11:15:29AM -0700, Damian Mendoza wrote:
> Kevin,
>
> Thanks for the feedback - I now believe that the message was scanned, but did not score high enough to be displayed as SPAM in my logs or the header of the message. It was a strange message with a lot of misspelled words.

I see that a lot now. "L337" spellings, with lots of s/l/1/, s/E/3/,
s/O/0/, s/o/0/, s/A/4/, and the like.

Once you have enough ham and spam to get Bayesian classification
working, SA finds that stuff very handily.

The "L337" alphabet, as near as I've been able to figure it out:

        abcdefghijk1mn0pqrs7uvwxyz
        4BCD3FGHIJKLMN0PQRSTUVWXYZ

Additions will be useful.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From nejc.skoberne at guest.arnes.si  Mon Jul 14 19:27:19 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:18:56 2006
Subject: Some spam getting through for some odd reason
In-Reply-To: <20030714132236.A63832@mikea.ath.cx>
References: <F6B4162F6771E44ABF0958023547FFC413D2DB@w2kserver.workgroupsolutions.com>
            <20030714132236.A63832@mikea.ath.cx>
Message-ID: <111901813.20030714202719@guest.arnes.si>

Hi.

> The "L337" alphabet, as near as I've been able to figure it out:

>         abcdefghijk1mn0pqrs7uvwxyz
>         4BCD3FGHIJKLMN0PQRSTUVWXYZ

> Additions will be useful.

I think this is not "exact science". I mean there are many l33t0
interpretations. In some cases 1 means i, not l. Also, s is 5, v is
sometimes \/, etc.

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From richard_cipher at YAHOO.COM  Mon Jul 14 19:36:46 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:56 2006
Subject: strange glitch results in lost mail
In-Reply-To: <038a01c34a30$edcff3a0$1501a8c0@pandora>
Message-ID: <NHBBIDLEJBNNEMOPKJPNCEKJDBAA.richard_cipher@yahoo.com>

since you aren't having any mail delivery problems when you start sendmail
outside of MailScanner, I'd suggest looking at your whitelist rules and
blacklist rules, and next I'd suggest looking for a configuration error in
MailScanner.conf.  I had a similar problem until I whitelisted the internal
domains I manage.

in MailScanner.conf,  look at the following settings(just for starters):
MTA = sendmail
and
Sendmail = /usr/sbin/sendmail
if you are using a standard install path on Redhat 7.3 for sendmail

also, are you seeing any errors in your maillog on the e-mails that aren'd
delivered?

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com
  -----Original Message-----
  From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Chris Yuzik
  Sent: Monday, July 14, 2003 11:54 AM
  To: MAILSCANNER@JISCMAIL.AC.UK
  Subject: strange glitch results in lost mail


  Hi everyone,

  I have SpamAssassin and MailScanner running on my RedHat 7.3 machine. The
server is running Ensim WEBppliance PRO 3.5.10. The server hosts about a
dozen domains. I run sendmail and procmail. Almost everything works great.
Almost.

  Mail from the outside world works as expected, gets scanned and scored and
so forth. I've got SA's threshold set to 5 and am running DCC and Razor...in
the two days I tested it over the weekend, it correctly identified 99%+ of
spam.

  My big problem is that sometimes mail from within the server never
arrives...never bounces...just goes to a black hole.

  I'll list some examples so it makes more sense:

  1) let's pretend that domain1.com and domain2.com are hosted on my server.
external1.com is not hosted on my server.
  2) steve@domain1.com and john@domain1.com can both sent to and receive
email from susan@external1.com just fine. dave@domain2.com and
scott@domain2.com can also sent to and receive email from
susan@external1.com to. Internal to the outside world works.
  3) steve@domain1.com can not email john@domain1.com and vice-versa.
Internal to internal is not working.
  4) it gets stranger. dave@domain2.com can send email to scott@domain2.com,
but not the other way around. If scott replies to dave's message, then dave
never gets the reply.

  As I said before, the message doesn't bounce or anything...it just goes
into a black hole and is never seen again.

  When I installed MailScanner, the documentation said I was supposed to do
the following (which is what I did):
  1) "service sendmail stop"
  2) "service MailScanner start"

  In an attempt to troubleshoot the problem, I tried the following:
  1) "service MailScanner stop"
  2) "service sendmail start"
  3) "service MailScanner start"

  Now everyone can email everyone else: internal<-> internal and
internal<->external just fine. Unfortunately, now nothing gets processed
through spamassassin.

  How do I go about fixing this?

  Please help.

  Regards,
  Chris Yuzik
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030714/e1ee6843/attachment.html
From ka at PACIFIC.NET  Mon Jul 14 21:07:38 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:56 2006
Subject: MS Performance
In-Reply-To: <006101c34a28$a4727e60$bc0aa8c0@epx.com>
References: <006101c34a28$a4727e60$bc0aa8c0@epx.com>
Message-ID: <3F130D8A.2030206@pacific.net>

We're using iptables on the MS machines; I'm not sure how to use
iptables to do this (or it is possible?). What are you using for a
firewall?

Adding the top invalid recipients to /etc/mail/access should help
similarly, as long as sendmail.cf was compiled with:
FEATURE(`access_db', `hash -T<TMPF> /etc/mail/access')dnl
and
FEATURE(`blacklist_recipients')

Thanks for the idea,
Ken A.


Tom Sevy wrote:

> Don't know what you use for Firewalling, but I have taken the top invalid
> recipients and created a rule in our Firewalls to reject email to them.
>
> ----- Original Message -----
> From: "Ken Anderson" <ka@PACIFIC.NET>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Monday, July 14, 2003 12:30 PM
> Subject: Re: MS Performance
>
>
> We relay about 500k emails a day through 2 MS machines running redhat &
> sendmail. Both machines are dual Xeon/1gb RAM/SCSI, RAID1
> About 45% of the total incoming mail is spam, half of which is deleted.
>
> With the exception of the following, it's a default rpm install:
> Max Children = 15
> Log Spam = yes (since we need the logs for stats.)
> MS Spam Action is "attachment, deliver".
> If one rbl goes down or is slow, we found that we very quickly had a
> backlog of 20k messages, so we've turned off rbl checks in SA. Adjusting
> the timeouts for rbl checks may be a better solution.
>
> We've made a few other tweaks to the default MS settings, but I don't
> think they are related to performance.
>
> The load average when the machines are sharing the mail load is usually
> about 3-4, rising to about 10-15 when one machine handles the full load
> by itself. Everything seems to fit into memory, there is no swapping to
> disk, and the average delay for a message being relayed is < 1 minute.
>
> A possible bottleneck is syslog, since both sendmail & MS are very busy
> adding log entries to the maillog, though I haven't done any testing to
> see if this is really a problem.
>
> Another bottleneck is the way 'user unknowns' are handled. Currently,
> because mail is relayed through the MS boxes, the MS boxes don't know if
> the user exists at the domain or not. So MS spends time scanning mail
> that is destined for a user that doesn't exist. Next Sendmail tries to
> deliver it and it is rejected by the destination mailserver. Then
> sendmail tries to bounce it back to an address that usually doesn't
> exist, or a mailserver that is not accepting connections or can't be
> resolved. Using re-mqueue to re-queue outgoing mail is helpful with this
> problem.
>
> Ken A.
>
>
> Tony Johansson wrote:
>
>>>I am processing around 600.000 messages on two dual xeon machines, daily,
>>>with peaks to 800.000-1.000.000 daily. I think MS is doing just fine :)
>>>
>>>Most of the time its a matter of the test setup also that is limiting the
>>>figures. Also some tweaking on the machines wont harm...
>>>
>>>Bye,
>>>Raymond.
>>
>>
>>What MTA are you using? I recall an earlier post by Julian where he tested
>>exim vs sendmail on one of his test machines, getting 3 times the
>>throughput with exim.
>>
>>I'm interested in what kind of performance people are getting with
>
> sendmail
>
>>and MS. I'm about to design a system built on redhat and sendmail which
>>will handle lots of relaying (500k-1mil email daily approx)
>>
>>I'd rather use sendmail but if the performance gain with exim really is 3
>>to 1 that might be the road we haveto take.
>>
>>regards, Tony
>>
>>
>
>
>
>

From kevins at BMRB.CO.UK  Mon Jul 14 21:16:07 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:56 2006
Subject: MS Performance
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E25@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E25@pascal.priv.bmrb.co.uk>
Message-ID: <1058213771.17104.9.camel@bach.kevinspicer.co.uk>

>Adding the top invalid recipients to /etc/mail/access should help

Thats how I do it - knocked my spam down by a third simply by adding a
couple of dozen ex-employees into the access database!

I'd be interested to know what firewall product does this, and how
(although I'd take some persuading to get me away from the notion that
which emails to accept is a decision for the MTA, and in larger
organizations that means the mail administrator not the firewall
administrator).  I hope it blocks the mail by sending the appropriate
SMTP responses, not just blocking the packets outright (I'm thinking
sending MTA tries primary, secondary, and tertiary MX's repeatedly for 5
days - not very efficient).




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From marco at MUW.EDU  Mon Jul 14 21:55:00 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:18:56 2006
Subject: MS Performance
In-Reply-To: <1058213771.17104.9.camel@bach.kevinspicer.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E25@pascal.priv.bmrb.co.uk>
            <1058213771.17104.9.camel@bach.kevinspicer.co.uk>
Message-ID: <1058216100.3f1318a47c856@webmail.MUW.Edu>

Hi everyone,

There is a good document on Python's website that you can look at here:

http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq04.011.htp

While relates to Mailman, I found it useful !!!

I cut down on load spikes by denying mail at the MTA level.
Also, mounting /var/spool/MailScanner/incoming into RAM.
Finally, spreading the load on multiple scsi disks ---> made the world of
difference for my site. Specifically, spreading spool and syslog logs on
different physical fast scsi drives.

Marco

_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From chris at FRACTALWEB.COM  Mon Jul 14 21:50:02 2003
From: chris at FRACTALWEB.COM (Chris Yuzik)
Date: Thu Jan 12 21:18:56 2006
Subject: strange glitch results in lost mail
References: <NHBBIDLEJBNNEMOPKJPNCEKJDBAA.richard_cipher@yahoo.com>
Message-ID: <002001c34a49$7f7f67f0$6501a8c0@pandora>

Hi Evert,

Everything in my MailScanner.conf file looks ok from what I can tell. MTA and Sendmail are as you show, and sendmail is in /usr/bin/sendmail.

I haven't noticed anything particularly strange in the /var/log/maillog file...but I'm not sure what I'm supposed to look for either. Any hints?

I have added a crontab for /usr/lib/opcenter/virtualhosting/MailQueueCleaner and set it to run every 5 minutes. Not sure if this will help anything or not. I read somewhere that it might help, but certainly won't hurt anything.

Where exactly do you whitelist the internal domains? Is that in "/etc/MailScanner/spam.whitelist.rules"? I don't have this file on my system and am not sure what format to use. Could you give me a couple of examples, or point me to the right place in the docs for this?

Thanks.
Chris Yuzik


  ----- Original Message ----- 
  From: Evert Ford 
  To: MAILSCANNER@JISCMAIL.AC.UK 
  Sent: Monday, July 14, 2003 11:36 AM
  Subject: Re: strange glitch results in lost mail


  since you aren't having any mail delivery problems when you start sendmail outside of MailScanner, I'd suggest looking at your whitelist rules and blacklist rules, and next I'd suggest looking for a configuration error in MailScanner.conf.  I had a similar problem until I whitelisted the internal domains I manage.

  in MailScanner.conf,  look at the following settings(just for starters):
  MTA = sendmail
  and
  Sendmail = /usr/sbin/sendmail
  if you are using a standard install path on Redhat 7.3 for sendmail

  also, are you seeing any errors in your maillog on the e-mails that aren'd delivered?

  Evert Ford
  Information Analyst
  Westone Laboratories
  http://www.westone.com
    -----Original Message-----
    From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Chris Yuzik
    Sent: Monday, July 14, 2003 11:54 AM
    To: MAILSCANNER@JISCMAIL.AC.UK
    Subject: strange glitch results in lost mail


    Hi everyone,

    I have SpamAssassin and MailScanner running on my RedHat 7.3 machine. The server is running Ensim WEBppliance PRO 3.5.10. The server hosts about a dozen domains. I run sendmail and procmail. Almost everything works great. Almost.

    Mail from the outside world works as expected, gets scanned and scored and so forth. I've got SA's threshold set to 5 and am running DCC and Razor...in the two days I tested it over the weekend, it correctly identified 99%+ of spam.

    My big problem is that sometimes mail from within the server never arrives...never bounces...just goes to a black hole.

    I'll list some examples so it makes more sense:

    1) let's pretend that domain1.com and domain2.com are hosted on my server. external1.com is not hosted on my server.
    2) steve@domain1.com and john@domain1.com can both sent to and receive email from susan@external1.com just fine. dave@domain2.com and scott@domain2.com can also sent to and receive email from susan@external1.com to. Internal to the outside world works.
    3) steve@domain1.com can not email john@domain1.com and vice-versa. Internal to internal is not working.
    4) it gets stranger. dave@domain2.com can send email to scott@domain2.com, but not the other way around. If scott replies to dave's message, then dave never gets the reply.

    As I said before, the message doesn't bounce or anything...it just goes into a black hole and is never seen again.

    When I installed MailScanner, the documentation said I was supposed to do the following (which is what I did):
    1) "service sendmail stop"
    2) "service MailScanner start"

    In an attempt to troubleshoot the problem, I tried the following:
    1) "service MailScanner stop"
    2) "service sendmail start"
    3) "service MailScanner start"

    Now everyone can email everyone else: internal<-> internal and internal<->external just fine. Unfortunately, now nothing gets processed through spamassassin.

    How do I go about fixing this?

    Please help.

    Regards,
    Chris Yuzik
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030714/a4fda270/attachment.html
From mikea at MIKEA.ATH.CX  Mon Jul 14 22:02:20 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:56 2006
Subject: strange glitch results in lost mail
In-Reply-To: <002001c34a49$7f7f67f0$6501a8c0@pandora>; from
              chris@FRACTALWEB.COM on Mon, Jul 14, 2003 at 01:50:02PM -0700
References: <NHBBIDLEJBNNEMOPKJPNCEKJDBAA.richard_cipher@yahoo.com>
            <002001c34a49$7f7f67f0$6501a8c0@pandora>
Message-ID: <20030714160220.A64716@mikea.ath.cx>

On Mon, Jul 14, 2003 at 01:50:02PM -0700, Chris Yuzik wrote:
> Hi Evert,

> Everything in my MailScanner.conf file looks ok from what I
can tell. MTA and Sendmail are as you show, and sendmail is in
/usr/bin/sendmail.

> I haven't noticed anything particularly strange in the
> /var/log/maillog file...but I'm not sure what I'm supposed to look for
> either. Any hints?

Mail that comes in through the input Sendmail, but never gets picked
up by the output Sendmail, for one. You could have a quick look
through the /var/spool/mqueue.in directory tree for stuff that
should have been processed, too.

> Where exactly do you whitelist the internal domains? Is that in
> "/etc/MailScanner/spam.whitelist.rules"? I don't have this file on my
> system and am not sure what format to use. Could you give me a couple
> of examples, or point me to the right place in the docs for this?

Try /opt/MailScanner/etc/rules. Mine has the following files in it:

EXAMPLES                README                  spam.whitelist.rules

and spam.whitelist.rules looks like this:

# This is where you can build a Spam WhiteList
# Addresses matching in here, with the value
# "yes" will never be marked as spam.
From:                   152.78.                         yes
#From:                  130.246.                        yes
FromOrTo:               default                  no
From:            westernunion.com       yes
From:            *@*.state.ok.us         yes
From:            *@*.mil                         yes
From:            *@*.gov                         yes

NOTE: The whitespace between the pairs of columns is Tab characters.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From richard_cipher at YAHOO.COM  Mon Jul 14 22:10:11 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:56 2006
Subject: strange glitch results in lost mail
In-Reply-To: <002001c34a49$7f7f67f0$6501a8c0@pandora>
Message-ID: <NHBBIDLEJBNNEMOPKJPNMEKKDBAA.richard_cipher@yahoo.com>

if you have a standard install of MailScanner you should have the file
/etc/MailScanner/rules/spam.whitelist.rules .  It is called from MailScanner
via:
Is Definitely Not Spam = /etc/MailScanner/rules/spam.whitelist.rules .

An example of a rule that would whitelist anything going to an internal
domain:
To:    *@myinternaldomain.com    yes
If you wanted to whitelist inbound mail to a specific user, you would do
something like:
To:    joe@myinternaldomain.com    yes

In the rules directory there is an excellent README and EXAMPLES file that
helps explain how to do this, by the way

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com


  -----Original Message-----
  From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Chris Yuzik
  Sent: Monday, July 14, 2003 2:50 PM
  To: MAILSCANNER@JISCMAIL.AC.UK
  Subject: Re: strange glitch results in lost mail


  Hi Evert,

  Everything in my MailScanner.conf file looks ok from what I can tell. MTA
and Sendmail are as you show, and sendmail is in /usr/bin/sendmail.

  I haven't noticed anything particularly strange in the /var/log/maillog
file...but I'm not sure what I'm supposed to look for either. Any hints?

  I have added a crontab for
/usr/lib/opcenter/virtualhosting/MailQueueCleaner and set it to run every 5
minutes. Not sure if this will help anything or not. I read somewhere that
it might help, but certainly won't hurt anything.

  Where exactly do you whitelist the internal domains? Is that in
"/etc/MailScanner/spam.whitelist.rules"? I don't have this file on my system
and am not sure what format to use. Could you give me a couple of examples,
or point me to the right place in the docs for this?

  Thanks.
  Chris Yuzik


    ----- Original Message -----
    From: Evert Ford
    To: MAILSCANNER@JISCMAIL.AC.UK
    Sent: Monday, July 14, 2003 11:36 AM
    Subject: Re: strange glitch results in lost mail


    since you aren't having any mail delivery problems when you start
sendmail outside of MailScanner, I'd suggest looking at your whitelist rules
and blacklist rules, and next I'd suggest looking for a configuration error
in MailScanner.conf.  I had a similar problem until I whitelisted the
internal domains I manage.

    in MailScanner.conf,  look at the following settings(just for starters):
    MTA = sendmail
    and
    Sendmail = /usr/sbin/sendmail
    if you are using a standard install path on Redhat 7.3 for sendmail

    also, are you seeing any errors in your maillog on the e-mails that
aren'd delivered?

    Evert Ford
    Information Analyst
    Westone Laboratories
    http://www.westone.com
      -----Original Message-----
      From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Chris Yuzik
      Sent: Monday, July 14, 2003 11:54 AM
      To: MAILSCANNER@JISCMAIL.AC.UK
      Subject: strange glitch results in lost mail


      Hi everyone,

      I have SpamAssassin and MailScanner running on my RedHat 7.3 machine.
The server is running Ensim WEBppliance PRO 3.5.10. The server hosts about a
dozen domains. I run sendmail and procmail. Almost everything works great.
Almost.

      Mail from the outside world works as expected, gets scanned and scored
and so forth. I've got SA's threshold set to 5 and am running DCC and
Razor...in the two days I tested it over the weekend, it correctly
identified 99%+ of spam.

      My big problem is that sometimes mail from within the server never
arrives...never bounces...just goes to a black hole.

      I'll list some examples so it makes more sense:

      1) let's pretend that domain1.com and domain2.com are hosted on my
server. external1.com is not hosted on my server.
      2) steve@domain1.com and john@domain1.com can both sent to and receive
email from susan@external1.com just fine. dave@domain2.com and
scott@domain2.com can also sent to and receive email from
susan@external1.com to. Internal to the outside world works.
      3) steve@domain1.com can not email john@domain1.com and vice-versa.
Internal to internal is not working.
      4) it gets stranger. dave@domain2.com can send email to
scott@domain2.com, but not the other way around. If scott replies to dave's
message, then dave never gets the reply.

      As I said before, the message doesn't bounce or anything...it just
goes into a black hole and is never seen again.

      When I installed MailScanner, the documentation said I was supposed to
do the following (which is what I did):
      1) "service sendmail stop"
      2) "service MailScanner start"

      In an attempt to troubleshoot the problem, I tried the following:
      1) "service MailScanner stop"
      2) "service sendmail start"
      3) "service MailScanner start"

      Now everyone can email everyone else: internal<-> internal and
internal<->external just fine. Unfortunately, now nothing gets processed
through spamassassin.

      How do I go about fixing this?

      Please help.

      Regards,
      Chris Yuzik
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030714/21da225a/attachment.html
From marco at MUW.EDU  Mon Jul 14 22:20:08 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:18:57 2006
Subject: strange glitch results in lost mail
In-Reply-To: <002001c34a49$7f7f67f0$6501a8c0@pandora>
References: <NHBBIDLEJBNNEMOPKJPNCEKJDBAA.richard_cipher@yahoo.com>
            <002001c34a49$7f7f67f0$6501a8c0@pandora>
Message-ID: <1058217608.3f131e88e56cd@webmail.MUW.Edu>

Hi,

> Where exactly do you whitelist the internal domains? Is that in
> "/etc/MailScanner/spam.whitelist.rules"? I don't have this file on my system
> and am not sure what format to use. Could you give me a couple of examples,
> or point me to the right place in the docs for this?

Look into /etc/MailScanner/rules directory and you should find
spam.whitelist.rules file. Here is an example:

# This is where you can build a Spam WhiteList
# Addresses matching in here, with the value
# "yes" will never be marked as spam.
From:          152.78.            yes # whitelists mail from a network
From:           user@*            yes # whitelists any mail coming from user
FromAndTo:      localhost         yes # whitelists from and to localhost
From:           10.10.10.15       yes # whitlists mail from a host
To:             host.domain.tld   yes # whitelists mail TO a host
FromOrTo:       default           no  # Default is to check spam

Make sure you change this line in MailScanner.conf (if not already set):

Is Definitely Not Spam = /etc/MailScanner/rules/spam.whitelist.rules

Hope this helps
Marco




_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From penguin at DHCP.NET  Mon Jul 14 22:49:07 2003
From: penguin at DHCP.NET (penguin)
Date: Thu Jan 12 21:18:57 2006
Subject: tar.gz upgrade question
Message-ID: <000001c34a51$c39abbd0$0200a8c0@penguin>

Hiya,

Has anyone seen an upgrade script for the tar.gz installation of
MailScanner? I have Gentoo and I don't use the RPM of MailScanner,
so I was wondering if someone had developed or considered developing
a nice .sh script that would perform the updates required in an
RPM-like fashion. If not, I'm willing to give it a go and/or work
with someone in making a script that does that.

A. Eijkhoudt



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From nwp at LEMON-COMPUTING.COM  Sat Jul 12 06:22:18 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:18:57 2006
Subject: MS Performance
In-Reply-To: <Pine.LNX.4.44.0307110906480.19214-100000@mailbox.prolocation.net>
References: <LISTSERV%2003071107433847@JISCMAIL.AC.UK>
            <Pine.LNX.4.44.0307110906480.19214-100000@mailbox.prolocation.net>
Message-ID: <20030712052218.GF11320@hoiho.nz.lemon-computing.com>

On Fri, Jul 11, 2003 at 09:07:51AM +0200, Raymond Dijkxhoorn wrote:

> No, tests that i did showed sendmail is able to do about the same, but you
> have to tweak sendmail a little for that.

Well if you're going to start tweaking, you should be tweaking exim too :-P

Biased? I suppose I am, yes...


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
Caution: Keep out of reach of children.

From nwp at LEMON-COMPUTING.COM  Sat Jul 12 06:12:20 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:18:57 2006
Subject: MailScanner not removing virus even though it was found?
In-Reply-To: <3F0E6172.8090709@popso.it>
References: <20030709023925.GA12072@bud.cs.uky.edu>
            <20030710181244.GB32608@bud.cs.uky.edu> <3F0E6172.8090709@popso.it>
Message-ID: <20030712051220.GD11320@hoiho.nz.lemon-computing.com>

On Fri, Jul 11, 2003 at 09:04:18AM +0200, Giampiero Raschetti wrote:

> I had read the warning line about McAfee but I didn't understand if the
> links
> referred where those where the program reside or those where it was working
> on.

> Anyway now I had changed this in MailScanner.conf
> # Set where to unpack incoming messages before scanning them
> Incoming Work Dir = /home1/spool/MailScanner/incoming

This is the path which was being referred to; search the list archives for
details -- I can't remember the exact problem when this was not the 'real'
path (was it something like McAfee reporting the entire real path to the
file, and confusing MailScanner?...)


> >Since I will be trying to keep my .conf files fairly consistent across
> >domains I would like to change that line to be more forgiving.  If anyone
> >is interested drop me a line and maybe we can convince someone to
> >incorporate
> >the change.

What exactly is "the change"?


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
Truth will out this morning.  (Which may really mess things up.)

From nwp at LEMON-COMPUTING.COM  Sat Jul 12 06:18:44 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:18:57 2006
Subject: MS Performance
In-Reply-To: <67D9E7698329D411936E00508B6590B902773A10@neelix.lbsltd.co.uk>
References: <67D9E7698329D411936E00508B6590B902773A10@neelix.lbsltd.co.uk>
Message-ID: <20030712051844.GE11320@hoiho.nz.lemon-computing.com>

On Wed, Jul 09, 2003 at 03:24:31PM +0100, Steve Freegard wrote:

> Obviously 1Gb's probably enough, but what about the machine with 512Mb?? -
> what happens if I end up with a queue full of largeish mails - will it just
> swap like crazy and is there any chance of loosing mail by doing this if the
> server runs out of memory??

Messages aren't removed from the incoming queue until they are believed to
be safely copied/linked in to the outgoing queue. So, no matter what crashes,
you should never lose mail.

This of course assumes that we are successful in judging when a mail has
been successfully transferred to the outgoing queue :-/


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
You will wish you hadn't.

From nwp at LEMON-COMPUTING.COM  Sat Jul 12 06:03:16 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:18:57 2006
Subject: One more Exim scanner
In-Reply-To: <5.2.0.9.0.20030710133226.00a7ab30@mail211.pair.com>
References: <5.2.0.9.0.20030710133226.00a7ab30@mail211.pair.com>
Message-ID: <20030712050316.GB11320@hoiho.nz.lemon-computing.com>

On Thu, Jul 10, 2003 at 01:35:41PM -0500, Mike Oliveri wrote:
> Whoops, one more thing for Exim:
>
> The MailScanner startup options in rc.local on FreeBSD refer to the
> MailScanner incoming mail spool as being /var/spool/mqueue.in
>
> Should that actually be the incoming Exim queue at
> /var/spool/exim.in/input/*? Or are these supposed to be two separate queues?

It refers to the spool directory at the same level that the exim config
file does -- /var/spool/<something>.

The 'input', 'db' and 'msglog' subdirectories are all part of the same spool,
and exim does not provide any way to configure weird uses of them at that
level. As far as config files are concerned, you should not be looking any
deeper than /var/spool/<whatever>.


Cheers,


Nick
--
Nick Phillips -- nwp@lemon-computing.com
You can rent this space for only $5 a week.

From nwp at LEMON-COMPUTING.COM  Sat Jul 12 06:06:08 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:18:57 2006
Subject: MailScanner delivering SPAM messages
In-Reply-To: <F6B4162F6771E44ABF0958023547FFC40966FB@w2kserver.workgroupsolutions.com>
References: <F6B4162F6771E44ABF0958023547FFC40966FB@w2kserver.workgroupsolutions.com>
Message-ID: <20030712050608.GC11320@hoiho.nz.lemon-computing.com>

On Thu, Jul 10, 2003 at 09:40:53AM -0700, Damian Mendoza wrote:
> Hi,
>
> I'm starting to see messages that are marked as SPAM being delivered by MailScanner - (version 4.12-2.) This only happens occasionally - The majority of SPAM messages are not delivered, just deleted which is defined in spam.actions.rules file.
>
> Any ideas?

This would usually happen when the message has multiple receipients, at least
one of which is configured to have spam delivered. Since mailscanner does as
little as possible to the messages themselves, they must either be delivered
to all recipients or to none -- so in this case they would be delivered to all.

If that's not what's happening here, *shrug*...


Cheers,


Nick
--
Nick Phillips -- nwp@lemon-computing.com
It may or may not be worthwhile, but it still has to be done.

From chris at FRACTALWEB.COM  Mon Jul 14 22:58:49 2003
From: chris at FRACTALWEB.COM (Chris Yuzik)
Date: Thu Jan 12 21:18:57 2006
Subject: strange glitch results in lost mail
References: <NHBBIDLEJBNNEMOPKJPNCEKJDBAA.richard_cipher@yahoo.com>           
            <002001c34a49$7f7f67f0$6501a8c0@pandora> 
            <20030714160220.A64716@mikea.ath.cx>
Message-ID: <001e01c34a53$1b857d20$6501a8c0@pandora>

I've setup the whitelist rules to include *@fractalweb.com and my other
domains that are hosted on the server, and specified the complete path to
the whitelist file in MailScanner.conf. I then stopped sendmail and started
the Mailscanner service.

I then sent a test email from cyuzik@fractalweb.com to chris@fractalweb.com;
the message never did arrive.

Here are (what I believe to be) the relevant portions of the maillog file.

Jul 14 14:29:00 ns1 sendmail[23636]: h6ELSxo23636:
to=<chris@fractalweb.com>, delay=00:00:00, mailer=virthostmail, pri=141805,
stat=queued
Jul 14 14:29:02 ns1 MailScanner[23606]: New Batch: Scanning 1 messages, 4376
bytes
Jul 14 14:29:03 ns1 MailScanner[23606]: Spam Checks: Starting
Jul 14 14:29:03 ns1 MailScanner[23606]: Virus and Content Scanning: Starting
Jul 14 14:29:03 ns1 MailScanner[23606]: Uninfected: Delivered 1 messages
Jul 14 14:29:03 ns1 virthostmail[23646]: Chrooting to
/home/virtual/site2/fst
Jul 14 14:29:03 ns1 sendmail[23644]: h6ELSxo23636:
to=<chris@fractalweb.com>, delay=00:00:03, xdelay=00:00:00,
mailer=virthostmail, pri=231805, relay=fractalweb.com, dsn=2.0.0, stat=Sent
(h6ELT3m23648 Message accepted for delivery)
Jul 14 14:29:03 ns1 sendmail[23649]: h6ELT3m23648:
to=<chris@fractalweb.com>, delay=00:00:00, xdelay=00:00:00, mailer=local,
pri=139143, dsn=2.0.0, stat=Sent

There is nothing in /var/spool/mail.

HOWEVER...(and now we're getting somewhere)...there are a ton of files
sitting in /home/virtual/fractalweb.com. According to the dates and times of
these oddly named files, this looks like it could be the lost mail. It looks
like the mail is being delivered to the wrong directory. AHA!!!

In fact, each of my virtual directories has a bunch of these suspicious
looking mail files.

So, it looks like sendmail or procmail or whatever program is transferring
the messages to the right mailbox isn't getting it quite right. Instead of
putting my mail into /home/virtual/fractalweb.com, it should be putting it
into "/home/virtual/fractalweb.com/var/spool/mail/mqueue", right? Or am I
wrong here?

My thoughts are now this: all I need to do is figure out what file is doing
the job of xferring the messages, find its configuration file, and tweak
something.

I don't know where to start though, so I need help.

Help! :-)

ps - this is more fun than most games...kinda reminds me of the old Zork
games.

From jscott at INFOCONEX.COM  Mon Jul 14 23:57:59 2003
From: jscott at INFOCONEX.COM (Jim Scott)
Date: Thu Jan 12 21:18:57 2006
Subject: OT: Zipping all email attachments
Message-ID: <02a401c34a5b$62e52690$1302a8c0@jimplat>

Not sure this is a topic for the MailSCanner list. We would like to zip all
incoming email attachments over a certain size or possibly just everything
that comes in as an attachment place in a zip file.

Can anyone give me some direction to accomplishing this.

Thanks
Jim

From mike at CAMAROSS.NET  Tue Jul 15 01:24:38 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:57 2006
Subject: tar.gz upgrade question
In-Reply-To: <000001c34a51$c39abbd0$0200a8c0@penguin>
Message-ID: <004e01c34a67$7aa7f3a0$9c01a8c0@home.middlefinger.net>

You may need to adjust paths because I use the rpm distro.

[root@genesis rules]# cat /usr/sbin/upgrade_MailScanner_conf
#!/usr/bin/perl

#
#   MailScanner - SMTP E-Mail Virus Scanner
#   Copyright (C) 2002  Julian Field
#
#   $Id: upgrade_MailScanner_conf,v 1.1.2.5 2003/03/10 19:42:37 jkf Exp $
#
#   This program is free software; you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation; either version 2 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program; if not, write to the Free Software
#   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
USA
#
#   The author, Julian Field, can be contacted by email at
#      Jules@JulianField.net
#   or by paper mail at
#      Julian Field
#      Dept of Electronics & Computer Science
#      University of Southampton
#      Southampton
#      SO17 1BJ
#      United Kingdom
#

#
# This script will output the contents of a new MailScanner.conf file based
# on an old MailScanner.conf file and a default copy of the new file.
# It is designed for upgrading MailScanner.conf files from one release of
# version 4 to another release of version 4. It will not help with the
upgrade
# from version 3 or earlier to version 4, you still have to do that by hand.
#

use FileHandle;
use strict;

sub Usage {
  print STDERR <<EOU;
Usage:

If you are using the RPM distributions then try this:

cd /etc/MailScanner
upgrade_MailScanner_conf MailScanner.conf MailScanner.conf.rpmnew >
MailScanner.new
mv MailScanner.conf MailScanner.old
mv MailScanner.new  MailScanner.conf

If you are using the tar distribution so that the old version is in
/opt/MailScanner and the new one is in /opt/MailScanner.new then:

cd /opt/MailScanner.new/etc
../bin/upgrade_MailScanner_conf /opt/MailScanner/etc/MailScanner.conf
/opt/MailScanner.new/etc/MailScanner.conf > MailScanner.new
mv MailScanner.conf MailScanner.old
mv MailScanner.new  MailScanner.conf

EOU
  exit 1;
}

sub Afterwards {
  print STDERR "\nOnce you have checked that MailScanner.new contains
what\n";
  print STDERR "you want, you can then save your old one and move the
new\n";
  print STDERR "one into place, using commands like these:\n";
  print STDERR "  mv -f MailScanner.conf MailScanner.old\n";
  print STDERR "  mv -f MailScanner.new  MailScanner.conf\n";
}

my $oldfname = shift;
my $newfname = shift;

Usage() unless $oldfname && $newfname && -f $oldfname && -f $newfname;

# Read in the old file to get all their current settings
my $oldfh = new FileHandle;
$oldfh->open($oldfname)
  or die "Cannot read old MailScanner.conf file $oldfname, $!";
my($key, $value, $origkey, $origline, %oldsettings, $ReadOldValue,
%oldkeys);
my(%oldcomments, $comments);
$ReadOldValue = 0;
$comments = "";
while(<$oldfh>) {
  chomp;
  $origline = $_;
  s/#.*$//;
  s/^\s+//;
  s/\s+$//;
  ($comments .= "$origline\n"),next if /^$/;

  undef $origkey;
  undef $key;
  undef $value;
  /^(.*?)\s*=/; # \s*(.*)$/;
  $origkey = $1;
  $origline =~ /=\s*(.*)$/;
  $value = $1;

  $key = lc($origkey);
  $key =~ s/[^a-z0-9]//g; # Leave numbers and letters only

  $oldsettings{$key} = $value;
  $oldkeys{$key} = $origkey;
  $oldcomments{$key} = $comments;
  $comments = "";
  $ReadOldValue++;
}
$oldfh->close();

# Read in the new file to get all the default settings and new key names
my $newfh = new FileHandle;
$newfh->open($newfname)
  or die "Cannot read new default MailScanner.conf file $newfname, $!";
my($defaultvalue, $UsedOldValue, $UsedDefaultValue);
$UsedOldValue = 0;
$UsedDefaultValue = 0;
$comments = "";
while(<$newfh>) {
  chomp;
  $origline = $_;
  s/#.*$//;
  s/^\s+//;
  s/\s+$//;
  ($comments .= "$origline\n"),next if /^$/;

  undef $origkey;
  undef $key;
  undef $defaultvalue;
  /^(.*?)\s*=/; # \s*(.*)$/;
  $origkey = $1;
  /=\s*(.*)$/;
  $defaultvalue = $1;

  $key = lc($origkey);
  $key =~ s/[^a-z0-9]//g; # Leave numbers and letters only

  if (exists $oldsettings{$key}) {
    # They previously had a setting for this parameter
    print $oldcomments{$key};
    print "$origkey = $oldsettings{$key}\n";
    delete $oldsettings{$key};
    $comments = "";
    $UsedOldValue++;
  } else {
    # they are using the new default value for this parameter
    print $comments;
    print "$origline\n";
    print STDERR "Added new: $origline\n";
    sleep(2);
    $comments = "";
    $UsedDefaultValue++;
  }
}
$newfh->close();
while (($key, $value) = each %oldsettings) {
  print STDERR "Removed old: $oldkeys{$key} = $value\n";
  sleep(2);
}

print STDERR <<EOL;

Summary
-------
Read $ReadOldValue settings from old $oldfname
Used $UsedOldValue settings from old $oldfname
Used $UsedDefaultValue default settings from new $newfname

Notes
-----
I would advise you to check on any parameters which are different between
the default new conf file and the conf file you just created, so that you
find any parameters whose default values have changed.
If you ran this with a command like this
  upgrade_MailScanner_conf MailScanner.conf MailScanner.conf.rpmnew >
MailScanner.conf.new
then you should do
  diff MailScanner.conf.rpmnew MailScanner.conf.new
and check for any differences in values you have not changed yourself.

EOL
sleep(5);
Afterwards();
exit 0;



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of penguin
Sent: Monday, July 14, 2003 4:49 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: tar.gz upgrade question


Hiya,

Has anyone seen an upgrade script for the tar.gz installation of
MailScanner? I have Gentoo and I don't use the RPM of MailScanner, so I was
wondering if someone had developed or considered developing a nice .sh
script that would perform the updates required in an RPM-like fashion. If
not, I'm willing to give it a go and/or work with someone in making a script
that does that.

A. Eijkhoudt



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From melilela at TIME.NET.MY  Tue Jul 15 02:49:41 2003
From: melilela at TIME.NET.MY (Ramli Mohd)
Date: Thu Jan 12 21:18:57 2006
Subject: Need Some Help
In-Reply-To: <004e01c34a67$7aa7f3a0$9c01a8c0@home.middlefinger.net>
Message-ID: <NHBBJMFAGLELAKIJFMCEAEIMCMAA.melilela@time.net.my>

I already upgrade from MailScanner 4.13 to MailScanner 4.22-5 I got this in
the log file

Jul 15 09:45:32 pop MailScanner[4479]: Looked up unknown string spamassassin
in language translation file /etc/MailScanner/reports/en/languages.conf

What it mean. How to solve this prob.

Thank You

From mike at CAMAROSS.NET  Tue Jul 15 03:04:48 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:57 2006
Subject: Need Some Help
In-Reply-To: <NHBBJMFAGLELAKIJFMCEAEIMCMAA.melilela@time.net.my>
Message-ID: <006a01c34a75$78dcc830$9c01a8c0@home.middlefinger.net>

You probably didn't rename /etc/MailScanner/reports/en/languages.conf.rpmnew
to /etc/MailScanner/reports/en/languages.conf

Mike


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Ramli Mohd
Sent: Monday, July 14, 2003 8:50 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Need Some Help


I already upgrade from MailScanner 4.13 to MailScanner 4.22-5 I got this in
the log file

Jul 15 09:45:32 pop MailScanner[4479]: Looked up unknown string spamassassin
in language translation file /etc/MailScanner/reports/en/languages.conf

What it mean. How to solve this prob.

Thank You


From mikea at MIKEA.ATH.CX  Tue Jul 15 03:11:59 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:57 2006
Subject: Need Some Help
In-Reply-To: <006a01c34a75$78dcc830$9c01a8c0@home.middlefinger.net>; from
              mike@CAMAROSS.NET on Mon, Jul 14, 2003 at 09:04:48PM -0500
References: <NHBBJMFAGLELAKIJFMCEAEIMCMAA.melilela@time.net.my>
            <006a01c34a75$78dcc830$9c01a8c0@home.middlefinger.net>
Message-ID: <20030714211159.A66087@mikea.ath.cx>

On Mon, Jul 14, 2003 at 09:04:48PM -0500, Mike Kercher wrote:
> You probably didn't rename /etc/MailScanner/reports/en/languages.conf.rpmnew
> to /etc/MailScanner/reports/en/languages.conf

I got it, too -- on a FreeBSD box, building MailScanner from
a tar.gz distribution. That doesn't provide a <foo>.rpmnew
file to rename, and does provide languages.conf.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From mike at CAMAROSS.NET  Tue Jul 15 03:50:08 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:57 2006
Subject: Need Some Help
In-Reply-To: <20030714211159.A66087@mikea.ath.cx>
Message-ID: <006b01c34a7b$ce3cf4c0$9c01a8c0@home.middlefinger.net>

Here's mine:

cat /etc/MailScanner/reports/en/languages.conf
#
# This file contains all the word, phrases and sentences that are output
# to a user by MailScanner. They are all here so that you can translate
# them into your language.
# You should only edit what is on the right of each "=".
# If you set the "Language Strings" option in MailScanner.conf to be a
# ruleset (or even a function!) then you can output responses in different
# languages to different users and customers.
#

# Used in spam header
Blacklisted = blacklisted
Whitelisted = whitelisted
NotSpam = not spam
Spam = spam
# used when creating VirusWarning.txt
TheEntireMessage = the entire message
NotNamed = not named
# used for sysadmin notifications
NoticeSubject = Warning: E-mail viruses detected
FullHeadersAre = Full headers are
# used for delivering truly disinfected attachments
Disinfected = Disinfected
# used for virus report in unparsable messages
CantAnalyze = Could not analyze message
# used for virus report in unparsable TNEF messages
BadTNEF = Could not parse Outlook Rich Text attachment
# used for creating sysadmin notifications
NoticeHeading = The following e-mail messages were found to have viruses in
them
# used when SpamAssassin has timed out too often
SADisabled = Disabled due to %d consecutive timeouts
# used when message size exceeds configured SpamAssassin max message size
SATooLarge = Message larger than max testing size
# used when trying to use SpamAssassin on a bad message with no headers
SANoHeaders = Message had no headers
# used when creating SpamAssassin results header
score = score
required = required
SATimedOut = timed out
# used when creating reports for messages with dangerous content
PartialMessage = Fragmented messages cannot be scanned and are removed
FoundIFrame = Found dangerous IFrame tag in HTML message
FoundObject = Found dangerous Object Codebase tag in HTML message
ExternalBody = External message bodies cannot be scanned and are removed
EudoraLongMIME = Eudora long-MIME-boundary attack
# used when detecting denial-of-service attacks
DOSAttack = Denial of Service attack in message!
# used when detecting+blocking (un)encrypted messages
encrypted = Message was encrypted
unencrypted = Message was not encrypted
# used in spam reports
SpamAssassin = SpamAssassin



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of mikea
Sent: Monday, July 14, 2003 9:12 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need Some Help


On Mon, Jul 14, 2003 at 09:04:48PM -0500, Mike Kercher wrote:
> You probably didn't rename 
> /etc/MailScanner/reports/en/languages.conf.rpmnew
> to /etc/MailScanner/reports/en/languages.conf

I got it, too -- on a FreeBSD box, building MailScanner from
a tar.gz distribution. That doesn't provide a <foo>.rpmnew
file to rename, and does provide languages.conf.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964


From chris at FRACTALWEB.COM  Tue Jul 15 04:14:56 2003
From: chris at FRACTALWEB.COM (Chris Yuzik)
Date: Thu Jan 12 21:18:57 2006
Subject: outbound mail gets stuck when MailScanner running
Message-ID: <001201c34a7f$44bc77d0$6501a8c0@pandora>

I've done extensive testing and now understand what's going on...but I don't know how to fix it.

When MailScanner is running, all mail sent from any of the user accounts (on my virtual domains), will get stuck on the server. In fact, it doesn't even go into a queue directory anywhere. Each time a message is sent, it just sits in the root of the virtual directory from which it came from.

When MailScanner is running, each time I attempt to send a message I get two new files in /home/virtual/fractalweb.com (which would be the root directory for the virtual domain when it's chrooted). One file always starts with a "d" and the other a "q"; the rest of the file name is the same.

My last test generated these:
-rw-------    1 root     root            3 Jul 14 19:54 dfh6F2sot32240
-rw-------    1 root     root         1040 Jul 14 19:54 qfh6F2sot32240

If I copy these files to (the real) /var/spool/mqueue and type "sendmail -q" then they're actually sent out. Otherwise, they just sit there and collect dust.

Incoming mail from the outside (my server) world works great.

My guess is there is some sort of config file somewhere that needs a good tweak. Problem is...I'm stuck again and I need help.

"Help please." :-)

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030714/425322a9/attachment.html
From yusri at TM.NET.MY  Tue Jul 15 06:27:35 2003
From: yusri at TM.NET.MY (Yusri Mahadi)
Date: Thu Jan 12 21:18:57 2006
Subject: mailscanner didn't pickup mail in /var/spool/mqueue.in
Message-ID: <LISTSERV%2003071506273512@JISCMAIL.AC.UK>

Hi,

Here are some config in MailScanner.conf

Incoming Queue Dir = /var/spool/mqueue.in

# Set location of outgoing mail queue.
# This can also be the filename of a ruleset.
Outgoing Queue Dir = /var/spool/mqueue

# Set where to unpack incoming messages before scanning them
Incoming Work Dir = /var/spool/MailScanner/incoming

# Set where to store infected and message attachments (if they are kept)
# This can also be the filename of a ruleset.
Quarantine Dir = /var/spool/MailScanner/quarantine


On Mon, 14 Jul 2003 09:40:31 +0100, Antony Stone <Antony@SOFT-
SOLUTIONS.CO.UK> wrote:

>On Monday 14 July 2003 9:25 am, Mohd Yusri Mahadi wrote:
>
>> Hi,
>>
>> I've installed MailScanner-4.21-9 with sendmail. But seem that
mailscanner
>> didn't pick-up email from /var/spool/mqueue.in.
>
>What do you have "Incoming Queue Dir" set to in MailScanner.conf?
>
>Antony.
>
>--
>
>If at first you don't succeed, destroy all the evidence that you tried.

From danieltan at shopnsave.com.sg  Tue Jul 15 08:11:45 2003
From: danieltan at shopnsave.com.sg (Daniel Tan)
Date: Thu Jan 12 21:18:57 2006
Subject: outbound mail gets stuck when MailScanner running
References: <001201c34a7f$44bc77d0$6501a8c0@pandora>
Message-ID: <005d01c34aa0$5f5f26c0$3900a8c0@Daniel>

i am not an expert but i think you can try not switching on mailscanner and
try only with sendmail....

service MailScanner off
service sendmail off (just to make sure)
service sendmail on
try sending mails again with mailscanner...see if it gets through....if yes,
switch on mailscanner and then check the log file..very helpful...

  ----- Original Message -----
  From: Chris Yuzik
  To: MAILSCANNER@JISCMAIL.AC.UK
  Sent: Tuesday, July 15, 2003 11:14 AM
  Subject: outbound mail gets stuck when MailScanner running


  I've done extensive testing and now understand what's going on...but I
don't know how to fix it.

  When MailScanner is running, all mail sent from any of the user accounts
(on my virtual domains), will get stuck on the server. In fact, it doesn't
even go into a queue directory anywhere. Each time a message is sent, it
just sits in the root of the virtual directory from which it came from.

  When MailScanner is running, each time I attempt to send a message I get
two new files in /home/virtual/fractalweb.com (which would be the root
directory for the virtual domain when it's chrooted). One file always starts
with a "d" and the other a "q"; the rest of the file name is the same.

  My last test generated these:
  -rw-------    1 root     root            3 Jul 14 19:54 dfh6F2sot32240
  -rw-------    1 root     root         1040 Jul 14 19:54 qfh6F2sot32240

  If I copy these files to (the real) /var/spool/mqueue and type
"sendmail -q" then they're actually sent out. Otherwise, they just sit there
and collect dust.

  Incoming mail from the outside (my server) world works great.

  My guess is there is some sort of config file somewhere that needs a good
tweak. Problem is...I'm stuck again and I need help.

  "Help please." :-)


--
This message has been scanned for viruses and
dangerous content by Email Virus Scanner, and is
believed to be clean.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030715/724d3a91/attachment.html
From penguin at DHCP.NET  Tue Jul 15 08:12:22 2003
From: penguin at DHCP.NET (penguin)
Date: Thu Jan 12 21:18:57 2006
Subject: tar.gz upgrade question
In-Reply-To: <004e01c34a67$7aa7f3a0$9c01a8c0@home.middlefinger.net>
Message-ID: <000401c34aa0$72e26bd0$0200a8c0@penguin>

Hello Mike,

Thanks for the script, but this isn't quite what I meant. I'm more
curious about an all-in-one script that will perform -all- updates
for MailScanner, including replacing the changed binaries en replacing/
merging/renaming the .conf files where necessary. Right now, I have to
unpack the tar.gz and manually copy the files over. An 'UPGRADING' file
in the tarball provided by Julian will help with this or with developing
an installer/upgrader script.

-- Arnim

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mike Kercher
> Sent: Tuesday, 15 July, 2003 02:25
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: tar.gz upgrade question
>
>
> You may need to adjust paths because I use the rpm distro.
>
> [root@genesis rules]# cat /usr/sbin/upgrade_MailScanner_conf
> #!/usr/bin/perl

<Snip>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From tony.johansson at SVENSKAKYRKAN.SE  Tue Jul 15 08:20:29 2003
From: tony.johansson at SVENSKAKYRKAN.SE (Tony Johansson)
Date: Thu Jan 12 21:18:57 2006
Subject: MS Performance
Message-ID: <LISTSERV%2003071508202925@JISCMAIL.AC.UK>

On Mon, 14 Jul 2003 09:30:11 -0700, Ken Anderson <ka@PACIFIC.NET> wrote:


>A possible bottleneck is syslog, since both sendmail & MS are very busy
>adding log entries to the maillog, though I haven't done any testing to
>see if this is really a problem.
>
Have you tried turning off fsync on the maillogs?

>From "Sendmail performance tuning" by Nick Christenson (highly recommended):
"On Linux systems, by default the syslog daemon will fsync() its log files
after each entry is written to them. On a busy email server, this operation
can cause a measurable slowdown. In most organizations, email server logs
aren't so critical. This behaviour can be switched off by preceding the
appropriate entry in the /etc/syslog.conf file with "-":
mail.* -/var/adm/mail    "


regards, Tony

From P.G.M.Peters at utwente.nl  Tue Jul 15 09:10:10 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:57 2006
Subject: MS Performance
In-Reply-To: <3F12DA93.4060804@pacific.net>
References: <LISTSERV%2003071107433847@JISCMAIL.AC.UK>
            <3F12DA93.4060804@pacific.net>
Message-ID: <c2d7hv8j5mtnpjcpdiobppscjja4ma9pch@4ax.com>

On Mon, 14 Jul 2003 09:30:11 -0700, you wrote:

>We relay about 500k emails a day through 2 MS machines running redhat &
>sendmail. Both machines are dual Xeon/1gb RAM/SCSI, RAID1
>About 45% of the total incoming mail is spam, half of which is deleted.

We relay about 200k a day through 2 machines running MS, f-prot and SA.
One system is a Celeron 1.3G. The other one is a dual Xeon 2.4G. Both
have 1G RAM. The second server also does nameserving, radius and dhcp.

The load allmost never reaches 1.

We have 1/3 spam which all are delivered to the intended recipient.

>With the exception of the following, it's a default rpm install:
>Max Children = 15

Kept it at 5

>Log Spam = yes (since we need the logs for stats.)
>MS Spam Action is "attachment, deliver".

Just deliver.

>If one rbl goes down or is slow, we found that we very quickly had a
>backlog of 20k messages, so we've turned off rbl checks in SA. Adjusting
>the timeouts for rbl checks may be a better solution.

We have disabled rbl's in SA but we have a total of 17 RBL's in MS.

>The load average when the machines are sharing the mail load is usually
>about 3-4, rising to about 10-15 when one machine handles the full load
>by itself. Everything seems to fit into memory, there is no swapping to
>disk, and the average delay for a message being relayed is < 1 minute.

A message that is checked for all RBL's and is spam according to SA and
one RBL is through in 13 seconds.

>Another bottleneck is the way 'user unknowns' are handled. Currently,
>because mail is relayed through the MS boxes, the MS boxes don't know if
>the user exists at the domain or not. So MS spends time scanning mail
>that is destined for a user that doesn't exist. Next Sendmail tries to
>deliver it and it is rejected by the destination mailserver. Then
>sendmail tries to bounce it back to an address that usually doesn't
>exist, or a mailserver that is not accepting connections or can't be
>resolved. Using re-mqueue to re-queue outgoing mail is helpful with this
>problem.

We have all excisting users (with a few exeptions) in the virtusertable
on the mailservers. It keeps the number of message a bit down (4000 a
day).

We also block a number of sites, addresses etc before it reaches MS.
Appr. 2500 attempts a day.

These figures are from today, extrapolated for 24 hours. You should also
take in consideration that it's holiday overhere so the numbers are a
bit off.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From Kevin.Spicer at BMRB.CO.UK  Tue Jul 15 09:12:37 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:57 2006
Subject: outbound mail gets stuck when MailScanner running
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0A4ADCE@pascal.priv.bmrb.co.uk>

If you're working in a chroot environment and send a mail, using the 'mail' command, mail starts a sendmail process, but that sendmail is within the chroot itself and so can't see the real system mailqueue (or its configuration?).  Is that your problem?
You could try using pine (or similar) configured to send mail to locahost:25 rather than invoking sendmail directly.  You could even hijack the mail command in the chroot environment and replace it with smtpclient ( http://www.engelschall.com/sw/smtpclient/)
 

-----Original Message-----
From: Chris Yuzik [mailto:chris@FRACTALWEB.COM]
Sent: 15 July 2003 04:15
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: outbound mail gets stuck when MailScanner running


I've done extensive testing and now understand what's going on...but I don't know how to fix it.

When MailScanner is running, all mail sent from any of the user accounts (on my virtual domains), will get stuck on the server. In fact, it doesn't even go into a queue directory anywhere. Each time a message is sent, it just sits in the root of the virtual directory from which it came from.

When MailScanner is running, each time I attempt to send a message I get two new files in /home/virtual/fractalweb.com (which would be the root directory for the virtual domain when it's chrooted). One file always starts with a "d" and the other a "q"; the rest of the file name is the same.

My last test generated these:
-rw-------    1 root     root            3 Jul 14 19:54 dfh6F2sot32240
-rw-------    1 root     root         1040 Jul 14 19:54 qfh6F2sot32240
 
If I copy these files to (the real) /var/spool/mqueue and type "sendmail -q" then they're actually sent out. Otherwise, they just sit there and collect dust.
 
Incoming mail from the outside (my server) world works great.
 
My guess is there is some sort of config file somewhere that needs a good tweak. Problem is...I'm stuck again and I need help.
 
"Help please." :-)
 
 




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030715/44ed52b4/attachment.html
From Kevin.Spicer at BMRB.CO.UK  Tue Jul 15 09:17:50 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:57 2006
Subject: outbound mail gets stuck when MailScanner running
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF730@pascal.priv.bmrb.co.uk>

Replying to myself!  Having now read other messages in the thread (maillog entries)I now realise I'm talking ****, please ignore me!

-----Original Message-----
From: Spicer, Kevin 
Sent: 15 July 2003 09:13
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: outbound mail gets stuck when MailScanner running


If you're working in a chroot environment and send a mail, using the 'mail' command, mail starts a sendmail process, but that sendmail is within the chroot itself and so can't see the real system mailqueue (or its configuration?).  Is that your problem?
You could try using pine (or similar) configured to send mail to locahost:25 rather than invoking sendmail directly.  You could even hijack the mail command in the chroot environment and replace it with smtpclient ( http://www.engelschall.com/sw/smtpclient/)
 

-----Original Message-----
From: Chris Yuzik [mailto:chris@FRACTALWEB.COM]
Sent: 15 July 2003 04:15
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: outbound mail gets stuck when MailScanner running


I've done extensive testing and now understand what's going on...but I don't know how to fix it.

When MailScanner is running, all mail sent from any of the user accounts (on my virtual domains), will get stuck on the server. In fact, it doesn't even go into a queue directory anywhere. Each time a message is sent, it just sits in the root of the virtual directory from which it came from.

When MailScanner is running, each time I attempt to send a message I get two new files in /home/virtual/fractalweb.com (which would be the root directory for the virtual domain when it's chrooted). One file always starts with a "d" and the other a "q"; the rest of the file name is the same.

My last test generated these:
-rw-------    1 root     root            3 Jul 14 19:54 dfh6F2sot32240
-rw-------    1 root     root         1040 Jul 14 19:54 qfh6F2sot32240
 
If I copy these files to (the real) /var/spool/mqueue and type "sendmail -q" then they're actually sent out. Otherwise, they just sit there and collect dust.
 
Incoming mail from the outside (my server) world works great.
 
My guess is there is some sort of config file somewhere that needs a good tweak. Problem is...I'm stuck again and I need help.
 
"Help please." :-)
 
 




BMRB International 
http://www.bmrb.co.uk 
+44 (0)20 8566 5000 

This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB International Limited accept no liability in relation to any personal emails, or content of any email which does not directly relate to our business. 





BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030715/5da376df/attachment.html
From kfliong at WOFS.COM  Tue Jul 15 10:46:28 2003
From: kfliong at WOFS.COM (kfliong)
Date: Thu Jan 12 21:18:57 2006
Subject: emails with No Message Collected
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0A4ADCB@pascal.priv.bmrb.co .uk>
Message-ID: <5.2.1.1.0.20030715174610.026b7e70@192.168.10.2>

<<< No Message Collected >>>

From mailscanner at jiscmail.ac.uk  Tue Jul 15 13:30:16 2003
From: mailscanner at jiscmail.ac.uk (mailscanner)
Date: Thu Jan 12 21:18:57 2006
Subject: {Virus?} A very  funny website
Message-ID: <E19cOwh-003x6q-00@pop1.sccoast.net>

Warning: This message has had one or more attachments removed
Warning: (demo.scr, msg-926457-59.html).
Warning: Please read the "VirusWarning.txt" attachment(s) for more information.


-------------- next part --------------
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "msg-926457-59.html"
was believed to be infected by a virus and has been replaced by this warning
message.

If you wish to receive a copy of the *infected* attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Tue Jul 15 08:30:56 2003 the virus scanner said:
   Found dangerous IFrame tag in HTML message

Note to Help Desk: Look on the MailScanner in /d/MailScanner/quarantine/20030715 (message 19cOwh-003x6q-00).
-- 
Postmaster
Mailscanner thanks transtec Computers for their support
-------------- next part --------------
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "demo.scr"
was believed to be infected by a virus and has been replaced by this warning
message.

If you wish to receive a copy of the *infected* attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Tue Jul 15 08:30:56 2003 the virus scanner said:
   >>> Virus 'W32/Klez-H' found in file demo.scr
   Windows Screensavers are often used to hide viruses (demo.scr)

Note to Help Desk: Look on the MailScanner in /d/MailScanner/quarantine/20030715 (message 19cOwh-003x6q-00).
-- 
Postmaster
Mailscanner thanks transtec Computers for their support
-------------- next part --------------
Content-Type: application/octet-stream;
	name=notifiers[1].jpg
Content-Transfer-Encoding: base64
Content-ID: <K2G768Hf711>

/9j/4AAQSkZJRgABAgAAZABkAAD/7AARRHVja3kAAQAEAAAAJgAA/+4AIUFkb2JlAGTAAAAA
AQMAEAMCAwYAAAp9AAAU1AAAQM3/2wCEAA0JCQkKCQ0KCg0TDAsMExYQDQ0QFhkUFBYUFBkY
ExUVFRUTGBgdHiAeHRgmJikpJiY4Nzc3OD4+Pj4+Pj4+Pj4BDgwMDg8OEQ8PERQOEA4UFRER
EREVHxUVFxUVHyccGBgYGBwnIyUgICAlIysrJycrKzU1MzU1Pj4+Pj4+Pj4+Pv/CABEIAN8B
SgMBIgACEQEDEQH/xADsAAACAgMBAQAAAAAAAAAAAAAABQQGAgMHAQgBAQADAQEBAAAAAAAA
AAAAAAACAwQBBQYQAAIDAAECBQMEAgIBBQAAAAMEAQIFABEGECASExQVFgcwITEXQCJQMiRB
IzMlNhEAAgECAwQFBwgGBQoEBwAAAQIDEQQAIRIxQSITUWFxMgUQgZGhQiMUILFSYoKSM5Mw
0XKi0jXBskMkNEBQ8PHCc4OzFQbh4lNjo9NEVHS0JRIAAQMCAwUFBAkEAwAAAAAAAQARAiES
MUEDEFFhIhMgcYGRMqHRQgQwQPCxwVJiciPhgpIzslMU/9oADAMBAAIRAxEAAADpwAJXSuEk
1kqj+m1qBpoAAAAAAANUQYC8GAvBgLwYC4GIu2E089AAAAAAAAAAAAACOhs1UottZFlXVgHe
AAABWGKAgJ7pXYcUe23DzOVctGZU/LFst5XMbaZp0nbakfoxbWtEn0y6SABqoUb+hHPCGjoZ
y2/yqZgTygAAAACxmc7WrHUm+S811v3y7b1tVNfYygGiCKqdG5mS49e9rj0DGqe+Ry3+1DdV
JwyqHmmu1+VXyqVpp8ytbZXNas6Hv7ZgCh0q4V7H9JA2uPafRRNd8azJ10Dd8qAAAAAAClDc
+dYte3zHDFdb3FXe6c0sD0c4AJF9rCq+WRHyWnCTKIBaDsasWkKrlaAhTQAAi8u62Q0cBx7M
kp9Kj9PfFuAAsyAAAAAABA570bmuP1HMCUoz32jN4x2eXTJtlh95CkeLSZ6mm80Tccoc4a8Y
u+VbNjBXxsswvYWZQDvAIjumg7I13G1k527lDoZCm5rDX6oGe2FH51uBKIAAAABz6/czz+pG
s9X6jVqkAbfBAASMkVenLz0p3EhGohgbvKlnxaIyVvK/a7S7bT8C/AKG6fkqZC6Gk1eZXJre
dPGznRpOL3tFctEGM8ILmPHrAC2oAAAABVQr1VsPpZ2dDYO0tQNuMAFyuyxIXpPLPhydcykb
aerIr0lBAxkZxui63eVsZYFuM898IMOZP7Wq9aL3WAHJitophPCajd8lNAsqAAAAEsZbq02U
5dOVzrdosrANFAHh6AHhRrIbFkg9DFGz3k4MLRQGODdY8IMvDc510TfHl4KFMHcNRvloYOKg
wLSBdn5TWJCo6tTOzfP3O92mVK294JXSpPzVrheNt2TFa/P1+meIfUpts+BP15gIvYxEzRh8
/bIyr7v14J0TSH7nlrN+i8wuTa8Fkq8oknHTRcZ1Od+J6lehsJ/gy2t6i79XsbWSN3Ins9XV
21b0DqTn8C0sOd01C/RuJTGmWbvJseQHPJDrbgR0DNnK3SlawMWx09pNl252NcsddvoiPObX
/wCatr1q5Z1b6OlZFZQfX8pDtZQdEfdUiwVW1WJ0anRkptFdsvn3SfE234O/Lfhl9pKNJia9
b2VI1T4Wmj3jg452Pj9XUlt5h086cAAB4mdRuEuS1l5ezVh75i0SFTOBRdcIZM+o8bmG9gfM
+oo6ChXejiuaGyVz6Dy9KpzC05rt7zLPPss6TRUst1ysseqZtF+reLLFCw1zXE9eOWGMnfDD
Ypmx77d6lbcvTn3Qec1d5R3PhndizgEDLDA36I8KPdep2m8/TNg4bvK3RtZry6b3H0zfrfAT
zqm4+Y0yNtduno156dx7VFK8uqPZjR6mKy6vRatO/wAf1aa22sOy0WRY57TVF9ypuaPuDSH7
0dO3GMO7NCm4ZnJ7lzaCo9w586OqGraEaSCyC82iqDYyuVDwv5i089k3k6SxrGaqaFOt5XfQ
HdkHADVkADVAaAgzn6Ku6Zc5TEy2rmNvCDOJK/5YSzlc9sQAFfU82WBXbEEeQAAAAAAAAAAA
AAAAAAAARFs2j0WXdXgmrk/lKLforAJxAAAAAAAAAA//2gAIAQIAAQUA4WLTQF7+r/EN/rMT
Ex5CEgY42wTM7YIidcMVna/2Tco1TwvetI98fShaX8tqxaJNYIbB0fQmx8hfwMP3BfRLRJMQ
vLZEWiMS0UzVCLU8Dx1vA44Ovpt5XRxapfdgGTWw1fGZjnXzXHW/JXnrQVa+ZqJ6zyq9Zr7J
K8mT1iCX6RP7+7FuevpyJiY8CqWlcKvqBE9YmenIt+/katHpWrW1vAlukcglo5W9o5F5tI7d
J5PXlLEKvWlxLV6+m/8AMT1nyM/91o/38L09U+1HPZp19qscqP8AeBT18K2tXk2mfC/8R0m3
ja8V41HQi1f28RCsSw1BV5YAp4dSRRWxpqNsdy1ZrNae+Q3qLQ3hERHh6fVxh8wyAZYmx7Te
adPRa0VgmmRkibomqLxFRMHvFhDPMdOsN3GtBd+sFzbDIBk8BGs5U8Wr6Z8kodbUToOjGh1s
k4EtWY6i7jDI9Cwq0ZFbrSto6kapTgSSed5P3VJXit8RX44iJyVuV6Sc38+Sf4bLUlbkGPhb
xWf5hwgwmCca4lrdYmsXrCV5mrdq3+SwS2iD3KplqTkf68mI9Zv2nyXiZrVG8WaF6LiiPX1g
g/o7EHycsIaxMxI2o58sUcgEeq1ZiB1mOJr3VdiZiZ6Twl/XfylFUtJyx8jLF0hYUBEiAfAI
hDfxIT0yblbRaImYn3y8kxJ/wDxPLUvFR1iI8/8A/9oACAEDAAEFAOUmIsWlfT/iC/2iY6T5
LdentF57ReegvX279Ires+C6pmLfSnfcZQYW8tZms3pF7RZfhaei/heZiPkX5VieQa8T8i3X
1+u3hkkgatnL9HTe4DyqdbzFessxMk8YrMx6Z6eVdsq8114mjLxjx5c32/QmGb8se0W92k8i
A2mi1OXp+3xbDn48Xi1ZrPIiZkDVKNOs1EzMTExEzya/t5MWlrNbBIFXwVH6rcIW3qsxe0r3
m3GR+qnKenq40NJoel8nStMTan8RHSvkzj+xLNptHgFj26w5bratJ56aTys0DSW4mPAoBF5Q
Q6eA/wCZiYr41rNpB+1WLdZ8SEqOCNltyrBK8G370ft42oGgJGKQ+E2mfAfT1UUpNWLLAkUx
1t19UR15FIrFqzXjN5sQAa+liQzyszEjt6qdeTysdZmvTx6T41uWCsUghALdKsrkpNP+wZ60
69anjoWbWtwat7cJEBste1+RHXlv4i3SvX9o8scDWazSl78FWZ5/EiOGtD2qS7gpngiei3y6
dLJ0nkBDSkx6bWjw/wDSPLExEyevRcnqref9ZrNbWj00P662mOvCKdZ+ITrJZmLWpPJnryfG
PNS80tDt+S7fkHJBS6BycO+Y1PGI5E+PSOdI/wAAUVma1pNrftPn/9oACAEBAAEFAPHuhpxd
LD3yBRzm5cT/AOH1sa+hJ8+6nO3bzZH9IrSwOW38Ks/cOBz7hwOfcOBz7hwOfcOBz7hwOfcO
Bz7iwOfcXb/BbWOea3peP8F5ILq/brllz/oTPTmjsncLuZlIzXylWahx6OQ+/HPqD/PqL/Pq
D/JdfngvqzAzC1RDmXJ4BejEehjOLh7Y9QP+DsqyDSzHIdT8/czcq5Ob6edxez9CoATHc/07
MJJM/MqMqWUI9srNirSSUa1slMQJXSDaF0jVfz0AqZtawrp+jmW9ZHd8Gml019H8kNkJnfkZ
8ZNX8iOlIr373EuTB30txT9HfTswlgOwJspaCGxqltyj7Y5WYGyHx7yBJcVJ6KxtaHrzMgkG
7kDMckfSsitWbx++lF66WiURqt+uOe3IQ6A7WWVYiijr0W5l0u/v+H5M0S1j496BtERCyjDF
CLlg/aTZ8ruf9LRTlJ2Xfm5EuNm0h6X/AJeRfoXxJShKdwYTuCZ/R9ambsLrNR3Hlc+4cuY+
4c3n3QhC31/O6/X83n3Bm8+4czk92Z1VYc9I7OGZL2f2xfJH4fk9S8FSez6D+s5s3T188bZt
POsviCjV7v8A0u4lfcToYgoSP1G0SSEypmGfJMRaHOzO2HZ/rTtXn9bdr8/rrteLf1z2zEC7
A7YJP9ddtc/rrtrn9c9tc/rjtnn9b9scH+OO1KWz8bKzI8dPNV1UdfsbdziXm1Le5zM7e2tb
navaq+Av+laK2q8Qay85IbDDWma9n61AML6uczPmYaqHjWjsXeJq6WdXL7jVdJ+p3B2rmbwe
1uwA55IiIj9PcZ+LmUvDDt2JGwwX16aubouwbH0qwN5tSQ7+lXge5KdJ7hyYg3dOeHl9CXSU
FQfAEGtp/ThJtMIwov0KCFH1W6+bQ3szOLo98bpXcb8hNTOb3Oo6fxkt5mT2pyhKEr+hqIxo
IRB09D3JBf1zFu36Erk8tWtoJjZRJt2/nTzTx2E6rK1vbrPURPcpoAa9UPjsDNT+bS//AEmO
s52hc0+TVfpnZylui+qdHTycUwEkikG3l42hXSy+F6+lkN3jtWXSXUbXNb9HuwdKbxJsSna3
a65QeXTa+SfwSavcdzFmtMvXvFWIHUzgoEMgyVmJmM9z5QfE2pj6DSjuetxqQuczVGqs6kOs
BxpQ+m8c/wDgO3pLM77d08tI7hxfoHMMAdJwj2hIiGrn2DKPk0GbLKUpFK+D6i7a0g9InFrg
toNgMzjA0l9Nak1DxI3x3fHa7WydojGTnK4fxrxQYiWonNIaz0QZ6vC09wafqqCbTNfb9139
DuK8xnu19DaKsLi7btMqeTbpaVusemtrEj3KdVYNHLoQUN8VW9tPDsYFc9BHO6dOdJ4eegY/
jwmYiOpG2IwiU4HDW6qDCsTx+RYUGI2Qas1uz+h3JE/FZWqRz+eduDiud5a5WdW8REQUIjUE
KRNkKMURctooUZONR0lHN+WOcfNngstERfG1YtVG/pZ8DRF3/F1cBW1+21lGM0fSv6HcVeuf
/wBmCev0rhquDz2tWldPuSo2IPuFt6dXrOh3AGwdzP0wrOBKoDuXCYoDurBOXhWQBt1jw3Tr
K1x+5LsD0e5pARBeoweH5P7tfrpdnO61NotvyF7Wf+Q+4MPSydRXXzvLMxEGcLokP0Fkj6Tf
GW+Ro+TrHXwtaKxs6x9s4gDFW3SJrX1cmtqyymJmue8fXUW7bI6djtXNKNPYMuKoNDXXwcAW
hCWlsLt9yhenbUS1A80kWpnssjhR+H5IFcfeXbjsIb0zEQ5sKSP8YAILtDwsxp/JrssCj6u8
zX5jbkALSeNV9wYr1qHFTsoj47mqxl0bY01jita4ud1t3GkMFRj0HKKjzO2djUrXspYdSZhg
wUdhEdBe9cLVrrZpKReieokHt3t86mTHa680I+wuiugoQME0GCnu3rrRPqiyLq76nO+e3U97
cF+NFaWtTduiX8XpkjOImgr4OjlfQaL/AO8rNxmHNFaj7jvQwqTcS3QgMVuzSHhovVRXXXpe
9hh9FrUz2FmBNL70e7rWrzLUrqd0vaqGfDfdbZ5IRtif35coxx2ZZoejsuMXLiZB1AaSNHVs
UzeKHaL7+prMmEEKyyQZm0hHS2bqZBJS1WQVZXAifFaV16NxLVo4TY+PIs7X1tT6b4Pg+Ql3
HoO0D24Ulr6Clm81bt7uC2mFxJZgE0gnbd5gvh3KyEbmdrLH2ptaYp3KtBMXrFNYf/2t68qu
2DSojEW9Fa8McQYqLQZDJwhtoObzK4De9octatK6thtivPr7jrWXO49HTomsHTMK2yKzGawa
theHendG1n91fffcfT8a9zaenueTRx0iFze28PDEDQsprE3Wbi+nBhS+ZXqpdrOPl7In553k
nJk+x2Gfq8aKFmM0TDXcOKO9M7dpND3iOWjjT6q/FMrb1OZ3a2YlLlaXC8IQjvz/AOGpnnNh
BjSbvOPnj52xlBI96o+4kx0Jtu1sfdeVE6plG+Xkjm1uzInrHPyl2/8AB0Ofirt2tg+S1a3r
sqUz8oPbuO2AAFwDYfCEnzmacmomBnsRQg71JTb+L9JXNRm8ZntKV0wplHqxfT1lfkohLBgs
CqWmK2phbIyDLS1q0rpdxAuSSFel/FduFXVtmj18urwNOw9PBXtSy+jT4/c9b/H7kat7PcdS
1jubFvFMhcc37R8PzCKJxefjOtY7N8ulSL57BWUsk5aLgzQyFS+hEWCyM3GrVIfDta+MQYyj
0u0US6g+yQxGOjhZV2tHRU01DSwrqAnMetMTxtUTFKI6KEzTTZleswpvPtO9wOCMPF2O5KZr
eAwCyesrGa+PergZu/qk5tXitX1b6C1jsAJoRfM7aYDWnj+YyxGfz8bf/i/CNlQpeusbg2Cr
k3DTIGplxzuBuoUDWrdYa0kBEzEm9U1AGoA6hSCTzTKFViwoh5mqoBZF2CcaVC2BxdzFvU4S
xfl5iOUN7CCmEonYf5UbJfufs3K2pxU1B4hwLvKESjomuJ1LLvdeYE5iyGh9VuJ+p7OLSXtz
w/MTcX0efi9ihez/AAfyhGutVmaa2mQefmOGZ4RJNAdFQGHmlqjNpMmQ5qgGUwLVyNar9GGF
lx7mgt8qBWshg6CkPBOE9PC9KXq52hlnm3Zb3UXbxLSn23CzEaJsUQlsaNXTbDpnIuVdeIis
PoBfX1IcT1G01dVeLb6UWDuvToai+enkZo8tDndvdc48lydbuHV2OwtDN5+PddvKhZkDa/gy
rN7haHfRoBFa2Uoyufex3mnS4skrbKpEfRwksp28Wk4+Kwqz3JgMusVxtm1p7U0YzZydeJ7Z
w20mPIzcg1k3arqHKEdc3QzahCid5rQSEfPWLJlvDTyFNOPtS0WntrQjlu1WyQp2WgCPDT7U
w9VrOys7LDMRMNdh9sslQQVzlPEyip7RERH+E8Utj4tKqo0vW9NQ1nMD/dFj/hdAN7VFtJDN
knrbMVeQJjjI1t1QzNgZ/wDhNwDB85cJwhwVUSqf6Lt9lLNwz+v/AP/aAAgBAgIGPwBERxO5
WSyH1WOoPhLHuQIwPZnqEONOMpkD9IdN0tV93L71EnS1efDD3rSJhP8AmHKKP6jFsd4RkNI9
K63K52HL6t+alOEZREZW8zV8tryLJ7veuU9kg5rWo8tGMpxBzZf+j/0SusGqYD0AHAMKexae
qzGY5hxFDt1NN26kJQfdcGRI12uAHo49/wBioGOr1DcAXizRJNxd/sV8uDqMflhKoizkyupW
jIQ6w9d5/j7mbm4LUhMgjqEwO+LYtXaX3Bl6lFi9e0Q7dSJiWRjEXSZqZqGnqcswZcpNan6O
qoab04x7QPwt7dgJcEhcs/NYRkuZvBOiMVWqcbRqR1LZ2dS39LP5qMzP+SUb7cuCcZ7MOyBm
S6JNbcBtYZ7CKUO7j3qlteH9VlQDDim37KKWjcIG2y8B5AHvQ0xMyshbcRXig7O1Ww8EEOz4
BeB2u6xRJFX3lOx8yiA++qx20JD7lUk9+wd6DdgA4yNsRvJTcEZb6eXYYeJ3L03HeUxiEZQ5
o7kCYRjLOJl+LLpASvAkZAhmtLY5+ChMjl1ZCMDHm5jkdyIjC3T03BMvifcjCembZ1jIVAA3
7abLXMXzGSOkJRkBIw6gjn9yjqzkCYEtd9sFCco2GUaxORUWwZGUiwiHJOQCJ+Xl0tHQkDIz
LGWOFKeLoyg4MfVE+wjeDkVEDGXMV09PHNsVzyYZA1kmlXetSc5NDTq6EYacTEEjqXPTyGeK
hDSL2csv3Csj44qYgQNSOnLUhEgye3gMnIUYytrGAkQadWTvGNMrd6I3dkh+Ql41qKYNhjV1
dqljESuMSwMZYg+SH8RMQ7SicuIQhGTTD8sqFSfAGMpftjIGXsUhpxMeppQnqCOG4k8KOtGE
A0dH5UAtumRZ/wACVHuZOAAczn5phznh70RN+EY0HipaWkAJGo4mJBZWTlz4WRjK4HjdahEu
8gZl6Gq0daRFulGQi1JRlI8xP5gQMKN9w1d0ZNFviljLddjVs0DvHZLLStL4uONMUx8/cyhq
wPNGQII4LvClpz12lC2jSmaDl5uAwGS0iJRkfmCNSVtZdMR/CgRhn6o/iEYlw69Qt3qcdERj
EOIzlU0zXNLqUdjRQ+a04/yfLl5b5QzHhioasC8JUfddRAn4CRLuK5fT7sVEfp7JANpIYHcn
l6YekDGRXODaHj3bioGYJ07hc27NE6c6TibZxyfMdy1OhPR1q1OpUh61d6rqzMNfVuNso1Ee
7jxZOMl/IK/mHuWJPgicrpEdxwTvzPyqT702mDL5X5vllD/q1PhkB+U4KtJClag96Jf9xZgA
MgjLy7su0YSJAP5TafMKmtrD+/8Aomlqasx+UzouiItpszP44qVolzxMS8sir43PxPYYeKiX
ThOKL1y81WR+oAxHihJsctyBYjg/4fQf/9oACAEDAgY/AECcFfHM/VTA51HemOXZpiSB5r1x
R540UhcOXH7014ubw+5NIg0em0jShc2JwA8V0+kXZ7nFv+SB1I8p+KJcdkEZKEhhMgFWWx9R
hXEkYsjHdtcB2ILdxX+o/bwRfTMafbJTPTP8jfcyfpSwbH+iuYx5Q779sDEXG6V4G+rfgiRp
EEAGtcw48lqjUjbGyX+QwbtCA3hnX2yxRkBRhXsPlvT4jtGw0OMTgiZRImPhyPirZNGP5Y/j
2td/9ghK0M9CKlassoach/dIIszOuaHks4pz7UY4KJLjvRMeUhEEMRsAGJQ0paPWgdTpSnlE
79yMI6VumJ9N6vfg0ckQaEFjscHDs3D0xhK7xooaWkBp3OZ2U7gW37bjhH79hdtyBkXYMiGw
Vwxj92zmJHGORUdaOmZ9WV/PNovEucBjV1p6mppxAlMtEEkAnAmvq3okOQ5xx8UUe49m/hIe
yntRlIvKUnfaYs+arEMrhhKvmqFXOebLuRFp2jqQjqW4XB2dckIw/bEDYRvCL9hgiNxQju7D
lMCwTiRQjKkh2ATO/U1GkBH4WyKE4TF0KThKhJOYrtqdgcOEZVwe18s1a9lzKbF6ovi6YKtS
VVEflor5t4rkHMMxgnGIQkaONjquDr7YbcNt9z1wejNgyBDnlYZY4hesAnEFGZHKfiFQh5eK
rvojxkpd7oRem5OeUcfcgIgEt6ipOXTIDciN6btzuVFPTkKGNQu5C2Dvjdj7KImETACnihqD
KkkCsC6jPUMpSkxlEYVwATgWB7aLu+hBNVTGWPBERIuoe/epCJF9tPwTSDEGoKhKYlAT9NMW
VhBhTPimKJgW4FZID9IEu8KLQMYkEni276MSDON4df69P/FOIacTvEaoa13OM1G4xFkhINHM
d6snaI5sPrPMfBEEogMR9B//2gAIAQEBBj8A8qC0LoXccyVCAQtDkK7zieCZuZLAjSQs571B
q01PTtHoxHcFdDNUMo3EEj/NHMiupLeTToK11RFfrR1FcC0ulUt3g26SntjZ58Ohz5crgHqJ
r/T+j99MkX7bBfnONLeJWoI2gzx/xY/mdp+fH/Fj+Z2n58f8WP5nafnx/wAWP5nafnx/xY/m
dp+fH/Fj+Z2n58f8WP5nafnx/wAWP5nafnx/xY/mdp+fH/FikN/bSHoSaNvmbGpGDKdhBqP8
iaGUbc0cd5W3MuGtJ8hOSDX2Z4+Bx9rT6uv9DU7MPb2bGK3Wql1qruekHaBhnZAdUkIYkVJr
IgzO/C21vDGTo5jPJWgqxUAKvZj8O3+638WPw7f7r/xY/Ct/uv8AxY/Ct/uv/Fj8K3+6/wDF
j8O3+6/8WHkiggdY2RGord6Q6EHe3nAllhgRC7RZq1dad5aat2O7AerSw/pxYz8sKZJosttC
X0nPBls3MD1qdGQP7S7D58MrUS6hpzox17GXqP8AkUmk6FuKTxMPZkWgY+oHEc3t92Veh1yb
9BIAaNOywrQ0PH3qfZBwK4ene51vT85MQRyqHjaFAynYeKXEJFoqajE7AEmoZJDp7OHEztbq
iyqvETQRFoS4016WxGGt0DRo9IiaGU6I2Q035kgYaEW61aR6SZ1AEyR6R5mxYqtuscUpKyRe
yaOyA+fEbSoqgxorucqM0yqWr+ycCeG3VQ0lvpUE6f8AENGHHmocTzzWyPpnuODOlVdU1dp2
nF0sduokUO6S51FJQlB5seFk/wD3EP8AzcNTFpIpISWVYZFGwrKeXn2MQfLJc3MgigiGp3bY
AMMnhdukUQPDLPVnI6dCkAek4C+JwJNETxPCCjqOpWJDekYKeExLBCMhLKuqRuvT3V89cBp5
Eu03xyIqZdTRKtPXj4i24JEos8Dd5GPzg7j+i50YrNanmKBtK/2i/d9eOQWHJvBqjP8A7gG7
9pR6uvBkkNFXae3IY4DyV66VOAQ+sDarb/PhZY9hyIO0EbQfkNKo1G1kSbsA4GPmVzgZ4KV/
tIT6JUOEf6MSCv2pcQUIBpBTPfolpi6aRtfuwl5rYECkJbZsqGO7EarQzxxP8KzEFtOiPOrf
WJ24aWo5au6s1RkTcRn5hi2aVi0iHUQSDQc06dmzhwsDhSgu4YyNxFFlzwOcRqElvvHdFyxX
Z9WmJ43I1GWd8jukkR19TYupBQpR0rUbeeDixFe5PH6pcHPFhAmdJ0lY7aLEea39Xy2fhqNS
OTVPMOnSQsYPVWpxDM1NM+rQBt4TpNfIzwxl1RkViKZGQ6UHnOGt2XTKhYMpIFCtdW3sxBC5
0Cd/hZ0rUHXkn79P0bwx1jjb31sw9nOpA/ZbZ24SduFwwSVR9MHSf14py3W1FQJNQpUZCi8v
YenViSJFkQ25DOzABHUnS1N+VcSxbmAfzjh9fyGjkAZHBVlOwg5EYaWMNL4cxrHMKnQPoS9F
OnfgrX2kPoYHEklwHKyIqqyDVQqWOYrXfjITfln9eKaZqHb7s/rxXTNXZXlnZ6cNbLHIqv33
EPGRXVSurFdM1TtPLP68dyb8v/xxms35Z/XjNZvyz+vBt1jkCtmzCLjYA6tOotiFTkVlVqdH
HqwsECtLLIaJGgLMSegDDXt7Q+ITrp0jMRJt0V6SdvlsL4D3ZDwO3Q1daDzjViyZ5njmtg6E
cvUoLlyJVOr2dQNKYWV25jrOqlyubRUVnlOR2utcXrSSLpmaNlZQ1GaJSQ2YHt9WCGnV2aaZ
wpBqusTL9HfqXOvzYtGgqUEkdzI1NnJVZGr9safP+jF0g47U6z1pscejPHC392ldRMNwJyVx
0Z7caKFuWSrKtNdK8JAYrX04itVAMkjguBuANaE/PgqNhU183+v5JBFQciDswxn8PjBY1blF
oqnp90y4yimH/Hf9ePw5/wA9/wBeAuiepzA5z47k/wCc+GXl3KMu1WmcHPftx3J/znx3J/zn
x3J/znx3J/zn/Xj8Of8AOf8AXjU1tJLTYHmloD08LLgiwtY7ct3mReI9rHiPp+RLY3aloZhQ
kZMpGasp6QcOYIjfWwzWWEVan1ou9Xsrgo4KspoysKEHoIPkU2Vq7RMaCdxoi7dbbfNXDMWE
19MBzp6UAAz0J0L8/wCjKsKqRQg7CMGzgbWjSSCN67Yg7UPnFMR1d0lC0d1NCa7QctmIyIua
JAViUNQqchqOrpxzbmCSNAhWq0kzJU7EJO7owFhuELn2GOh/uPRvV8sKBrlYEqlaZDeegYFn
Z6DcsgdtK5KlTSpc7K7Tjl+JSj4k05axR81ZQTTgHA1R7XRtx8POPh7kZBW7rfsnd2H9Keen
KugPd3SAax0BvpL1HD3XjCpdXCuRbp3o1VTlIVO1m257O3FAKAbAP0k8ldJI0hujVlXEdRSP
UFRehF2DDI1X1KGjRRVsjQ/6HEdagRlVodx2nD3FuYxDGWRUdipdhkxqEbYcESWwlHTGwao+
1oOAgnmtyBwxSjIDsYH58cfKnXdRWQ+nUw9WALm3eMnfGeYPmFMVE+s5VVFZ2FelVBOASkpU
14tIGzqLavVgCJnhgGaMDoZz84XBKjibvMSSx7WOeBLIQqXMYiDnKjqagE9YOI4nu+ffXd1J
cW7mtYw0bofaO7Lrx4e3ikguPElk5byLnzI3OhhID3hxAVONcUkjGLNYi5KkD2eKu7FYXBYd
6M5Ov7S7fliG4lrORq5MYLvTpIXZgJG/wUDyEImgagmxdTNWpOJbTxC1a5uYso2txTXT6dTQ
duEtpYpLKeUViScAayNoUg0J+R7tKge2x0jzbTgc0IB1Pn+8FxqQhh0jPZ+hmsy2gyrRXpWh
GYNO3Bhnj47aQo5BFCRlUV3HaMXE81NYVSq7qU4VB7duOaxzDByT0g1xA0ictpdUuk7QJGLi
vXQ+SjAMDkQRXBZrSIMdrKgVvStDjhDp1K5p664M9sTPbKKvGxGtab1J0gj14+JlXNgAiH6I
OoMw6a7BioND04B3jJh14a6h5cqpEVa2lHCwB1niFaHLBVfD40R6OfeAbMwTpStRhb27UBS4
e3iUsaCM8LszGpzGQ2YY9RwHBKyJ3JFyZSRTI45FxQTAVVxkHHZuI3j5NxfSZiBCwHSfZXzn
E3iNy9ZJdU9zMdp6B2dAxzbbMwkcbCjBqjLE19eEhpZdEhUcWXsgYlvwxA08y1bYVdOJGHRp
IxbXi7ZUBcdDjJh6fIF2BiAT1b/ViN2vpLa3p7q2h0Lroe8zMrE16KYNw0ZKilVijLnb9FAT
j4u0fVFIpY5MucZo6lW0mtBv3/optP8AaRxO/wC1Rl/qqMBJGZlXYCTl/pTEfiN+Gl1nXBA5
qoA7rNXad+fyjbr/AIeA0f68gzp2L8/Z5eclvK0UgDI1FWv32XDK1rKAQVY8GVRTc56cLby2
jxwDKSZGjZmUblTWCNXXhU+GnjVQFUcpmoBkO5qw2UinZxRSL/WQY1RsHXZUZ54yYqwzVhtU
jYRg6spYjolHXQEMOpga/IvPAbhqSrGRNHINIZGGZRjtpiawmfmW1pI6Jcsvupvorr7tRXAs
7NdFsXVrmeNaKM+FVrkSfRieN7VrmxlfUshC5MMjUVwLe1spRZqAJniCnRFWjlVrtxAvhwpb
INKjeCNurr6fIzAVK1plXMgr/TiCCOzjnguWTROHIcUK1UppNNI4q7KDD3KRc/llC6E6Rp1D
US2lqADqxHNc2wsnnry4BIJdIkXTxMFUbTsH6F5pTpjjUsx6hie7kGku2lUO1UXJRhoohqdw
QAOsYg5BJiCKFrtyFKHrG/5LyJnJksYP0myGAoNabWO0k5lj2nPy2lpcrzIRezhUJI/spGpl
TLM4trW2CSJepZNcpcSOscjaJAhd1qRq07ujFzBeabuaMWt5KySH31tCRFLb1rtjZdQ6cX1x
aq7WF0tvJKgm0tckSlWCca8s5EUqK41Max+GRxi4ke4ZzokieQryzqD6mYHVXaMsKW78lZJC
Mqu51N8/kjcmiTe5k7dsZ9OXn+Qk90jLPGNImjOliv0T04lsYokS1iQsEYVFV4qtXeabce4k
rGw/CkGpKHcN+BG6CGJMtCHJvmoMLEToSdGh4ciNQyp6MJawV0JXNsyScyT2+RkrTUCARtB6
cBGyZcmHWMt2Ap8xxENgiBcgitaCgHpNf0Ij3SyIG7AwanqxKOk6h9r/AMccX4j5uej6vmxO
p2LMdPUCqk+uvyY5aEpBIJHpuUqyVPUNVcaqjTt1Vyp24rFHJKv0kRmX0gY0k6WrTSwKmvRR
gMctraCUpLJNHJIxJBeoqo0Gh0mm3DwPZWZhkRYnjIahRM0XIbFrlhnfw6zdnZJGI1Alo8kN
absTfBeH2sVxcSJLMZPeRyaW1FXQkZGu7EUclrIfELa2MEVxpFGrnpAjdsq5CuzFBu8jEAsR
Qqo2lgQVA6yfkEnYM8LGx9xp5ksdBSjfhqd9d5wE+IkZFyXSFGW4EnPFZuY4G5329oGHTkRD
kOE5g/ECt3GJI66bfkShV1uZXWNK0q1WIz3Zb8Ri4thGkR1NPHIH0U9oBc+2uJG20QaT1Ma/
0foYTu5oB84OLd9u3WvSFz/p8nMp+O7SV6Qch6h8rWttGGrUcIoD1DYMUGQG7BSRQ6nIgjE8
ROoQkBW6QwDivWK4rIwQHZXf2YLLbzFB7WgD91mDerBCnNe8pBDDtBwrVoNhOBPOWSFs441J
UsNzMRnQ7h6cf4dVPSpKn0qRgSrGS6mq6nZwCN6h2IB+QVOwinpxPBJlKoQAH2lUU1DytCne
kROZ2Kxap+b5DR3CiSNqSaTUDYUoaHtw1xHcyBSCBGmmMUO1W0ihFMsxXrw8lKAkIg3aUy+f
9CH+hLGfvHl/7WP92g/fJ/hxpjFZHokY+u50r6ziOBO7EoRexRT9AWchVGZJNABiWLwt/jGd
iTJoCqp2fiEnXTdRPPgyNc/Ds20xji+82pvXjUPErjV08xvm2YV2mW85fdMgAcDeA60PpqMN
aysbS6dSojk2VIpwkbcfEEiNEB5hOSro73EacPXiV472MLCNTl6x8Naal5gXUKnaMLCl2Fdz
RDIkkSknIAPKirnuz8kayyBDM2iMMaamPsjr8qXVxqjEauEnTvI5ppr1YWG65Zus6ANoLAAZ
0fKvYcQxRmKNZGIkm1iXlgbaqvbgSMS80wDzSNtLEeoDcPK3gVjM1vBAim6MZKs7uNeksM9I
UjLEcHh01J7lXVY5GPLdwjFA/nwQPDrMlAGNJiS/Sq134mtrsi8tI5nEltLTWnEdQjlXPI9N
RiDxG0JMFwupQcmBBoyt1qRQ/KJJoBmScaIHaKxG2RCVeb9kjNU69p3Zbbu0HctZUaIHdGxW
VRn0NUDErdDaPu/68K7dy1HMPW7ZL6NvyaVzGZG/ylmNABUk7AMNbwOY/DYzQ0yMpG9uroGN
Mahab8ZmmOEhj0A4IYUPQccXC4zVxkQRsNcN/wBveITcq8UpJbzsNSTLE6vokWq12UIrmMNL
43GAsBT4SKGZqBwG1yhkEbZ6gBXZTDLE01uzChZZWkU/txzmRGHauHsPD/FbdG5zQKkpqvA2
nVbMxflh/oMGH0cs8eLwN4nMlxZxoqWwlRjzggnLtRFYKWoqstNhIzxW5uJYbpo0uYnh0LG8
UtSneQy6k2NWToNc8k8O+NS4kiuxb/DSxkzvEGBeQsZNQUR1ZSQT1muBGTz2mXXbQxmrBRlx
D2FB3nI4VlisIyBRhKk1w56Tr5kSgnqX04ln+DV3ehLWr1GQo1YZFU/dYnqxOxl5loh5a6jx
CQbRT2abD5fECwIEnKdCd45UYy84OPD7xjRIZ4y/7OqjerGonLbXqx4jbnw+Ga5urmSQX8hY
yIpbJUAIAxbM5JE0ksiA7l1lfnWvluhHOvupSoikjBUKVVloVKt7WK3VrqUZl7dtf7j6W9Fc
a7dI7eI7GlrI9OtFKgfexJFd3Gq3GbIqBNag7HNSadWA6mqnKox4nTMCGCvmZ2Pqw0rd0lnJ
7ThBIKTS+8lHQzZ6fsjL5Ecyxxm2z50sjUKmoC8IzINdorToxJ4yeVauwZZWYmVTGAqwRgAp
XU5JBOyuEZqaioLaTUVpnQ+RbOI0kuzpam3QNvpwEXd8+CSaECpJ6MJcXT/A2r8QXbMy/snJ
fP6Me7u5S/S+kj0ADBguiGX2Juiuw9mGjfavrG44WaFilzARJE42grniK7ppkI0zIPZkXJx6
cMhyDAqSNuYphvBIWs1vfDJfhLy0vGSJJY4pNErKXoCZEzr048andpZrrxAlfCtdSbm3UvFb
6DSpaveJ9mjYmBOoWMMFgG3F405khH31xLfSIC0a0GkDW5Joka9bMQBh57phLf3RD3co2Ft0
adCIOFR59pw9t4Zbi6eI6ZpnflwIw9jWFYs3SFGW/Be7so5Il7/wkjSSKN55ciJq+ya9WE8b
8GYSTsoLoppHdRD2H+uPYbaDkcq4ivLZtUMy6lrkRuKsNzKciNx8lvPDdBHEXIlRV1FmViy6
fvGuNDpczSA58UcY823AsuVJEnLEQlWSMSaQNNdTLkcExtPFJuXXFL81D6sW3hun4XkxKkcT
kE6VAQVYdJ8qz/2V2BE/VKlSh+0tV8wwkSrq11DHow0DZBqgjoPTiee5GmGFGMhI3dXTiSCK
0ROUomeBpDzuW3td0rXqri9VSGivbNZkpv1K6H93Tgq2YJYN9rj+ZsIZDqliJikO8lfaPWRQ
ny8zTzJXYRwRA0LyNsHZvPVgT3Di4uWyeY0IXpWMeyo/14KsoKUoQRUUx/8AznVWPE/h5YBZ
B9QHuP0UyO/pxHcQmscg1LXI9hG4jfiNd0UdfOSfJFBKNUFqpuJFOwlCAgP2iDj+8zBWOaxj
ic9iDPBSyi5K/TejP6Bwj141XMzOTtBOKEk0yFTXFXYDF0scTnw+4XmcwiiLKtBSp+kMDw2z
cxSPHzZ5hkUjJKoqnc0jA57gDvpiPntqEgL3NvKqOBOTm8TruPXXdvrgxFIncEGMzpzEU7Cd
IZTs68fEMDHaG4dbiAhlDRFlQXKpIztGRtIrQr14sbLbHCr3ko+svuoa9VWZu1cR29qaXd7I
LeBtuioLPL9hAT24jt1XTFbqdLEE0oDVmbbU1Oe/AljcAhdQcDmA6epTnXAVf8D4oxIWlBHd
ga2oNwmUE0+kOvE1lst74NdQDcsy0E6j9sFXA6dWJIGJVZFKkjbnh7iS2e6dzRJ0GpUXoAFS
D2jGpIOZSvE0gO3oouWKtADTYDITT93ACRBQSBywwNSfoigzx8XIjW8IY6pJFK8NMlVDQnH+
Ik/B5G3d9Lt8k8NKsyNp6mpVSOsHErxOwjhtY7lY0JXmGQEkuVo1FpsGIlWQTQ3lqLpAH5vL
ZSBIgc5+1s3YvYkqX5LMgAJJZeJRQdJGJb23tjbfGW4t5xcGPSK046qWbLoGLiwE4D2NmltE
7ZBnVWZwG2ahw1GCiEEMikU6VGk4uotx0SU6K1X/AGfLB8U2i1gjMkrZ5B5I42bLoWo8+Lqx
gjjjENQGhNYpEFCjj6wBocUJyGL6C6CpEzaLThJknuC+mqNs93lluxdJ7CXD6e1grv8AvMcV
PtRCnmPklubOV45JE5blKDhJBIqdmzBeViztmxJJJP1mOZxRRQdWKuwHVg3Ecfw9oNtzKCFp
9UbW82K2sHx0wP490CIgfqwrmftHzYZrm7dIo14YYfdJ6I6E4klJzuLS0mX9kiUf1gfJqdgq
jaSaD14isYmEhvpFtxpIPC596cvoxqx82L9iPwYoIEP1VXm/PKcSL7FhbhE6pLg6nb7qrhri
4jdgpURKgKu8hOkRhWoTVtnVtxC/iVk9lHO45LpNzIg7exJpC6C+7IgnFxJEwaWAc+20moV4
DzUp1nTnix8Rj/spoJkPQkxEL/8Aw5T5fELa2mXkxsmhHjjcCsSE01qenFObDT/8eH/5eLi0
vpEeNrcyIqxonGjoPYUbmPySl4xgiJY2l3GdOgSGskEhYFdJbNdWW7C3K11W4JFzK/dU7QKU
ULnspiS6mu3vbCJWKfBx+7BY92U6s6DZpw0MUaLfTZww11GCIjKS5IyB36R2YFv+IwJcyPQs
8jGrO/WxxxWy1G8KPnGDLayEEjS0UwLqQDWlTxj04MLryLpBVoiahh9KNvaHrHkWQCoZZLZ+
yYAofzEUefFtbTMOTbRzpBQAHQx10Y76Md+PhFuYjc/+iHXX92tcW8VxIWtbKWWURHZEFcyT
Me3SMRvINMk5ad1O0GVjJp8wNMW1xuqY28+zyfPijuC25RmcBlj+Btj/AGkwoxH1U2+nAkkU
3dwM+bNnQ/VTYMaHHC1QR1UONMShRpXZ04l7MeFXlqAbu3tkAjJoJYmVS0VdxyBU9PUTiYw+
K8pldg9q9snMhBJ0owYhqgbzUHaMsc6/r4hcUqZbqjgfsx0EaDsGJfGUhENtTlWKgaQ4I95O
q7lPdTqq3tY8TXfWKv5MWPFlkUMpaE0P+5ixa2zsXjtYubn/AOpMxiU/ZRGHnxPZPSksZQje
pI4W6qHMYtpWGlpIgJVAAo4GmTZ9YHCkGjLYVB6Ckf8A5cA+RfGDMZH8TlesdKBFjSNUA6es
+Rf+4BI0cyTSwcvIpJCY184Ic7er5JVgGU5EHMEYurrw8PBLFGWjjiaiFtg902pPVhPE7maW
cSIJmdpNCCq1LERBBljRboqRnMaRka+111xyFV57imrkwrqYA7C2wKO041TWMqRjayskhH2E
NfRgEjUjiqnYaHHPj/FtW5ikbwveX7S1GFkU1VwGU9Rzxdm7cxwLEzPIASU0jUGAG8EVGGl8
PgSynuVpdXIdTIa98QoGITUd+3HwzNHFGJOaHLojD6I1d6oOeqtcFbl4LmKZ0F5PAB8TJGDm
raOF679lR14+BWL3en8WtOMKsmnRTZpYZ4kQd9RqTtGeFfYw4WHWMFG2HoyxIPEYgbe4I5N2
41GFhlSp2Ka5nAkjYOjZhlNQR2jBdyFVRUscgBgw2oaagIUoK7cmfsGwdOHuLdCYlbltLJVE
UrlpzGonqUHEavcRpDcCocRt582cU+7iC18QjRLYIqQ3sDF4iFAX3gPEnbmOk4MsBEV/EpNr
cilQ1Mlb6SMe8v8ATQ4mm5ZJeGQPCe8siBg0bU3q4IxE0ZBRkUqRsIIypjXsS9t1I63hZkc+
iRMTqcluoIXHWVLxt6OHGptkttGy/wDCkcP/AMwYieM1W5t5InpvMLLIh82thgSnu67iQHpU
zSMD6MQQnJp7WOMds1EH9fy2MvtJc6R00aNif6vksSBQs0xbrPOkHzD5V0pNAYnqfsnF1DGh
ksrxNQUHigkmpqAB2xsWrlsxJM/chQuR1KK4V5fx5/fXDby75/ujIY4EqBvJpig4X+icPvU5
f0YsWbaYI6/dGGjkUPG4KurCoIORBGGi8PZUhWOsylFkEcleFdTZ8S7q5U68APPH1lLeMN6X
L/Nic3KF76OQmCOUB5CmyMwqBQ6qbhkcFpJDFPIJ5IuXGQpmYIUjkklBQoqLmV6MQzshQyor
lGFCNQrQjHNAPwlydu5X6MZZg7MFJVDDpwf+n3k1un0EY6c/qmox/fbuWcZVV24cvqigwHjq
JLplUNvAZuWh+yp1YewhkltoLKsXh1tCCaOoGio1L32zZ/PizWYe8UjX1VBNMQ+GpZrcSSxm
eSWSURBV4uFNXDsTftOWJLmz1BoJLaaGTUamC4ZQ0TKTSigMAN2VNmDdAUsPEnC3HRFdGipJ
1LL3W+tT6RxNa3ag/CRsfD2c6VkVRwQM+5k2D6S5ipriynvkSCaKUcqWJmeOSKYaJF1MqaWQ
6Hz2gZb6Wfi+xbdjDdH6MU1BqPUsiqezENzbEC9tCWjDZK1RSSJjuDjfuNDibxSW3lt1sbd4
4EmXSz3ExAooqdQGkCoyNcJZJnPyUtlHTI4EfrdseF+FJnrngQAbdFv74+qLy+Gw73mkf7ig
f7fk8O/4/wD+xL5ZILMNdzQsUlWICisu1WZyqinbjJYrVTvYmV/QuhfXhYL0g6zSK4A0qx+g
w9lujpwtjHUyXfDJT2YR+Ix7RwjrOI7KMe5gZZrttw08UUPaTxHq7cPCAXluOFVG5QauzHcK
ZdZywzxmqslVI6CKj1YMqniBPD2YqMiMCNDSWdlhir9OQ6F+fEcKdyJQi9iigw7RsULFVaUe
wrGjP5hhDajTGa0B2kgkEk51JO/HdqcNOEEki0WOOoDMzEKqA9ZOI5vE9EnKYSRWyCsauNjs
W7zDduHke3nXVG4oerrGNE6mayPcuANnU3QcVRgerf5Kk0xby97kyRK2kVJCyiNiB+znh/EZ
kWeaNSymNQWIUVGe1uoYZp7O3NtqoYSXEmmuypqpPmxazSzt4cwWsblNVY24zCykijKWNO3F
9PZg/Duhitic6xWqGJG+0wZsPBOokt7hCrqdhVhh/BfFR8QGUiCZwPfwjef/AHErRvvb8XH/
AG74qOa1tSPWe88e2GZT9KnrBxJ4N4pSRwmksw4Z4jwiWnWMnG445QEs9kMre4iVpHRd0UyK
Cx07A1M9+eIp7hJI7C0YSlplMZllX8MKjgNoQ8RJGZphX/8Ao/DONidjTkcC/YUlj10xNeUr
DYR8qM7ubNRm86xgff8AL4dZg5wwvKw/3rBR/wAvyW0ampt5Jo26iZGl+Zx5fiYo1M47ynhE
gH11zVuhhgtZ3JbRk9tdDUyH6JdeIevE6XEPJZWSOd6c5Ejk/tQAM9mVRtwLe2ItGlqoluGN
1dSIhI1nTwIMiBqNMLHCrSyvUrAD7yaTaWZj072OWGHj9g3/AFG5qVWJXkCxpQhFZaDSlfTn
twfDJxKkCmlnLcqV1K1fdFjvXd0jDKoqjZrXBkkqcwAqirMzGgCjecVWdEkidTG+pTplQhly
rtruwY5VEV3EAZYwaqQfbQ71PqwXuZUij3tIwUelsK//AG/Jp0EtdNGoMMmY4UU0BelTqXH/
AFH/AKsq2WnXzREBRfOxz3UptxJN4zM1WbXYNcUVIxmNLaaKJKbz5sB4ZFkQ7GQhh6vKUdQy
sKMpFQQenBe3L2chzrEeH7jVHoweX4lw7tUefqbDS3sr/CamWO416EYI5jJk0xOY6kZVNKb8
R3FusfJQakgMrvGX06eZUx1OW6tN+I7S7gNx7NqtqyvIyVOlOU5RuAcNRXCz3/8A28tpLL/e
FcMJnQlqI0sEY0gsQTw6qY8PgVXXw+4kobwjSH1LqWOMGjUfZq9GJvDLeFik7EQMq0jSOY+8
qRkvLqxA35UwAMgMgMGGWqkEPFKuTxuO66HpHr2HLFjJcxGO5LNavMikwzJpaZHVs9JBQ8DZ
ip2jPChmKSIdUM0ZAkifpWvrByOOWYBeoO7LAyKSPrRzMuk9jEYpKF8Ph9qSRlklp9SNKxg9
ZY9mG8N8GT4ieJSWUHUAzHvTP0s3nJxHaIxdlq0sp2ySudUjntY7N2zyR2NmFfxC4FVLkaI1
J0hmr07sSh1fxC/Ue9cOCoUZd6oQLnuwjG2laIRI0ssXvFDkcYJAyocXNlHGtxYBhcTlnSOS
MsNJZNZAfJBw4jubdxJDKoZHGwg+UXFuwiukFA/ssPoSDevzbsSrMoic2458TkZaGIrU5FTr
yOJU8GuZIopW1yQWcSyrq2Eo5UqnpxKzRsIZRq5lxIJLjXlkStRo6q5YF0kQuoQgRI9elk3t
pVqKdWW+uCs3hkzKcmBQkfusa4Aa0ulA2DTNQejCk2dzKy92qzGhOWVcVtPCREfpuI48/Oxb
1Y+Mu5F5gRo0hiqVAYqzFmYAseEbsR31pSaRF0PBIaZA1DRE5Kenpxo+CkB6SUC/e1Y0CVDK
bj4k2lfdV0aO9Tve10V9ONJsZSdmWkj72qmJb26UW5kTQluhrWpqXl08NcqD5MskSGSREZkR
drMASFHbiG2NtdOYo1QsYW4iooSe3DNbLf2MVCZkhgJTSMzpV1YIetcC4sbK5dZlB+IMTM8g
3FpHOtvPi6vZGmtYptMIgZUV2ijX6VCyAs7bDh7daQ8tQYHUAcp4842UfVIGIpmFDIiuR0Fg
D5YueXSSAkxSRsVZSwo3Ua9YwSviU4XcCkJPp5eODxQgfWhBPqkXBWbxLWrAggQAGh2952ws
bzyyW6kEW6hIUJH0uSisfT5fi72AvNpCFg7rULsyVgMcmwt0t0Pe0jian0mNWbznBBFQciDj
mm1MJOZWJii+Zdg82I7O0TlwQghFqTtJY5npJ+QrTwpKydwuoYivRXFAKDoH+Rw2UT8r4hZH
eUULBI9IKpqqKnWM8fBEEfAMYCxBoyrxIwO+qkV68B0NVYAqekHFzLaPyjPA4VmFStQVbIe0
PnxbIsjyQ3D8gxOdWlgjOHVjxexQj/Q/5ljuYhWa1YyKo9pSNLx/aXZ10xc0LTRySBkdKFSD
FGMjXETF6rGDGXbL8NinF6MT2XO0mRrqNWAJC1llCnFvPAlIYIyS5laFhdFdDjgVm92CR58L
Ld+JM0a0/u6AEN+28gJp2Af5lkSCRYyKNIHbQrRjN0Z89II34MBZOKIhJbZxLGH1PmpT9ro3
YllvtKFpKlTNTi0JqDKj6RxDtw8UdGthJcFWh95GQ0upKNHqGQJHVi4umkZYTGsUsDsGLShi
VkZQTpIjoM8z/kH/2T==
From ka at PACIFIC.NET  Tue Jul 15 14:31:36 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:57 2006
Subject: MS Performance
In-Reply-To: <LISTSERV%2003071508202925@JISCMAIL.AC.UK>
References: <LISTSERV%2003071508202925@JISCMAIL.AC.UK>
Message-ID: <3F140238.60405@pacific.net>

Tony Johansson wrote:

> On Mon, 14 Jul 2003 09:30:11 -0700, Ken Anderson <ka@PACIFIC.NET> wrote:
>
>
>
>>A possible bottleneck is syslog, since both sendmail & MS are very busy
>>adding log entries to the maillog, though I haven't done any testing to
>>see if this is really a problem.
>>
>
> Have you tried turning off fsync on the maillogs?
>
>>From "Sendmail performance tuning" by Nick Christenson (highly recommended):
> "On Linux systems, by default the syslog daemon will fsync() its log files
> after each entry is written to them. On a busy email server, this operation
> can cause a measurable slowdown. In most organizations, email server logs
> aren't so critical. This behaviour can be switched off by preceding the
> appropriate entry in the /etc/syslog.conf file with "-":
> mail.* -/var/adm/mail    "


LA dropped from 2.7 to 1.3 with just that modification to syslog.conf.
Seems I should pick up that book!
Thanks,

Ken A.

>
> regards, Tony
>
>

From rherban at HYPERVINE.NET  Tue Jul 15 14:35:22 2003
From: rherban at HYPERVINE.NET (Randy Herban)
Date: Thu Jan 12 21:18:57 2006
Subject: MS Performance
Message-ID: <00FD7F04EA248947B8FBB971044379DB80BD@corpserv1.hvcorp.hypervine.net>

> -----Original Message-----
> From: Ken Anderson [mailto:ka@PACIFIC.NET] 
> Sent: Tuesday, July 15, 2003 8:32 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MS Performance
> 
> 
> Tony Johansson wrote:
> 
> > On Mon, 14 Jul 2003 09:30:11 -0700, Ken Anderson <ka@PACIFIC.NET> 
> > wrote:
> >
> >
> >
> >>A possible bottleneck is syslog, since both sendmail & MS are very 
> >>busy adding log entries to the maillog, though I haven't done any 
> >>testing to see if this is really a problem.
> >>
> >
> > Have you tried turning off fsync on the maillogs?
> >
> >>From "Sendmail performance tuning" by Nick Christenson (highly 
> >>recommended):
> > "On Linux systems, by default the syslog daemon will 
> fsync() its log 
> > files after each entry is written to them. On a busy email server, 
> > this operation can cause a measurable slowdown. In most 
> organizations, 
> > email server logs aren't so critical. This behaviour can be 
> switched 
> > off by preceding the appropriate entry in the 
> /etc/syslog.conf file with "-":
> > mail.* -/var/adm/mail    "
> 
> 
> LA dropped from 2.7 to 1.3 with just that modification to 
> syslog.conf. Seems I should pick up that book! Thanks,
> 
> Ken A.
> 
> >
> > regards, Tony
> >
> >
> 

Another thing to consider if you have enough servers or enough logs to
warrant it is using a central syslog server.  Helps keep the burden off
your mail servers and keeps all the logs in one place, easier for
searching through for problems and/or running any of the stats programs
that have been produced by this list.


From P.G.M.Peters at utwente.nl  Tue Jul 15 14:49:45 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:57 2006
Subject: MS Performance
In-Reply-To: <00FD7F04EA248947B8FBB971044379DB80BD@corpserv1.hvcorp.hypervine.net>
References: <00FD7F04EA248947B8FBB971044379DB80BD@corpserv1.hvcorp.hypervine.net>
Message-ID: <ph18hv0fl2lhjf2vcunb478j31am6eepus@4ax.com>

On Tue, 15 Jul 2003 08:35:22 -0500, you wrote:

>Another thing to consider if you have enough servers or enough logs to
>warrant it is using a central syslog server.  Helps keep the burden off
>your mail servers and keeps all the logs in one place, easier for
>searching through for problems and/or running any of the stats programs
>that have been produced by this list.

I would suggest at least two syslog servers. When one has problems you
don't loose possibly important loglines.

And you can even have routers, switches etc log to those servers.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From richard_cipher at YAHOO.COM  Tue Jul 15 15:35:32 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:57 2006
Subject: outbound mail gets stuck when MailScanner running
Message-ID: <NHBBIDLEJBNNEMOPKJPNIEKNDBAA.richard_cipher@yahoo.com>

Chris,

In MailScanner.conf there is a variable with the default setting
Incoming Queue Dir = /var/spool/mqueue.in

Just above it in the comments, it shows one of the options being the name of
a file containing a list of directory names.

You might try this.

an example:
in MailScanner.conf:
Incoming Queue Dir = /etc/MailScanner/mqueue.in.rules

in mqueue.in.rules:
myinternaldomain1.com/var/spool/mqueue.in
myinternaldomain2.com/var/spool/mqueue.in
and so on...
you would, of course, have to actually make these directories before doing
this, stop sendmail from running external to MailScanner, and start
MailScanner.

Other than this(which occurred to me while taking a shower this morning
:-)), I'm fresh out of ideas.

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From mike at UNIXSECURITY.ORG  Tue Jul 15 15:48:27 2003
From: mike at UNIXSECURITY.ORG (Mike Wallis)
Date: Thu Jan 12 21:18:57 2006
Subject: RH9 and SophosSAVI
Message-ID: <3F14143B.8000008@unixsecurity.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I upgraded my mail server from RH 7.3 to RH9 yesterday and then proceded
to spend several hours trying to figure out why MS was no longer
working. I completely uninstalled and reinstalled Perl and everything MS
related, but finally tracekd it down to SophosSAVI. Apparently the SAVI
module doesn't like something on my RH9 system, since every time it's
called, it simply produces the following unhelpful error message:

Jul 14 21:43:27 deep-thought root: Process did not exit cleanly,
returned 0 with signal 11

I finally gave up fighting with it and changed the virus scanner back to
sohpos, but I'd like to be able to use sohpossavi again.
Anybody seen anything like this, or have any ideas?

- --
Mike Wallis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1-nr1 (Windows XP)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE/FBQ7Xes7jE7XvgsRAv2bAKC69sk1yPg3dDLiDCtUGgV+hjYd5QCffBVi
5fChp1T/Jrg4QWcTeRWmLVY=
=1R9K
-----END PGP SIGNATURE-----

From steve.freegard at LBSLTD.CO.UK  Tue Jul 15 16:02:03 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:18:57 2006
Subject: RH9 and SophosSAVI
Message-ID: <67D9E7698329D411936E00508B6590B902773A24@neelix.lbsltd.co.uk>

Mike,

I'm using RH9 with SophosSAVI, and I did have a few troubles to begin with -
check to make sure you haven't got the file /etc/sav.conf on your system -
if you have delete it, and SophosSAVI should start working.

Also check that your're running the latest version of MailScanner as Julian
has made numerous improvements to the handling of SopohsSAVI.

Hope this helps.

Kind regards,
Steve

--
Steve Freegard
Systems Manager
Littlehampton Book Services Ltd.

-----Original Message-----
From: Mike Wallis [mailto:mike@UNIXSECURITY.ORG]
Sent: 15 July 2003 15:48
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: RH9 and SophosSAVI


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I upgraded my mail server from RH 7.3 to RH9 yesterday and then proceded
to spend several hours trying to figure out why MS was no longer
working. I completely uninstalled and reinstalled Perl and everything MS
related, but finally tracekd it down to SophosSAVI. Apparently the SAVI
module doesn't like something on my RH9 system, since every time it's
called, it simply produces the following unhelpful error message:

Jul 14 21:43:27 deep-thought root: Process did not exit cleanly,
returned 0 with signal 11

I finally gave up fighting with it and changed the virus scanner back to
sohpos, but I'd like to be able to use sohpossavi again.
Anybody seen anything like this, or have any ideas?

- --
Mike Wallis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1-nr1 (Windows XP)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE/FBQ7Xes7jE7XvgsRAv2bAKC69sk1yPg3dDLiDCtUGgV+hjYd5QCffBVi
5fChp1T/Jrg4QWcTeRWmLVY=
=1R9K
-----END PGP SIGNATURE-----

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From ap at HPI.COM  Tue Jul 15 20:36:12 2003
From: ap at HPI.COM (Adam Polkosnik)
Date: Thu Jan 12 21:18:57 2006
Subject: Eicar signature in the subject line
Message-ID: <3F1457AC.2050701@hpi.com>

Just as I was updating my mail system and started to do some testing
I've noticed that an e-mail with eicar signature in the subject line was
able to pass through (without any problem) my mailserver equipped with
Mailscanner and ClamAv.
Would anyone like to comment on this one?

--
Best regards,
Adam Polkosnik
718.768.8800 x245
IT Dept
HPI International, Inc.

From mkettler at EVI-INC.COM  Tue Jul 15 21:29:14 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:57 2006
Subject: Eicar signature in the subject line
In-Reply-To: <3F1457AC.2050701@hpi.com>
Message-ID: <5.2.1.1.0.20030715162735.01b80ea8@xanadu.evi-inc.com>

At 03:36 PM 7/15/2003 -0400, Adam Polkosnik wrote:
>Just as I was updating my mail system and started to do some testing
>I've noticed that an e-mail with eicar signature in the subject line was
>able to pass through (without any problem) my mailserver equipped with
>Mailscanner and ClamAv.
>Would anyone like to comment on this one?

My comment "Yeah, it works as it should, so what's the issue?"

From ap at HPI.COM  Wed Jul 16 02:44:28 2003
From: ap at HPI.COM (Adam Polkosnik)
Date: Thu Jan 12 21:18:57 2006
Subject: Eicar signature in the subject line
In-Reply-To: <5.2.1.1.0.20030715162735.01b80ea8@xanadu.evi-inc.com>
References: <5.2.1.1.0.20030715162735.01b80ea8@xanadu.evi-inc.com>
Message-ID: <3F14ADFC.8020103@hpi.com>

Matt Kettler wrote:

> At 03:36 PM 7/15/2003 -0400, Adam Polkosnik wrote:
>
>> Just as I was updating my mail system and started to do some testing
>> I've noticed that an e-mail with eicar signature in the subject line was
>> able to pass through (without any problem) my mailserver equipped with
>> Mailscanner and ClamAv.
>> Would anyone like to comment on this one?
>
>
> My comment "Yeah, it works as it should, so what's the issue?"
>
Are you trying to say that by design the Subject line is excluded from
being scanned?

From wpc4 at DODGETHIS.ORG  Wed Jul 16 02:47:38 2003
From: wpc4 at DODGETHIS.ORG (William Curley)
Date: Thu Jan 12 21:18:57 2006
Subject: Eicar signature in the subject line {Scanned}
References: <5.2.1.1.0.20030715162735.01b80ea8@xanadu.evi-inc.com>
            <3F14ADFC.8020103@hpi.com>
Message-ID: <000701c34b3c$3d4b4590$0600a8c0@dejour>

Appears to be, I'm running latest mailscanner with postfix 2.0.13 with
f-prot 4.1.1 and it doesn't detect the subject line.
Thinking about it there is little reason for it to. You can't get a virus
from only the subject line so why should it scan it?


----- Original Message -----
From: "Adam Polkosnik" <ap@HPI.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 15, 2003 6:44 PM
Subject: Re: Eicar signature in the subject line {Scanned}


> Matt Kettler wrote:
>
> > At 03:36 PM 7/15/2003 -0400, Adam Polkosnik wrote:
> >
> >> Just as I was updating my mail system and started to do some testing
> >> I've noticed that an e-mail with eicar signature in the subject line
was
> >> able to pass through (without any problem) my mailserver equipped with
> >> Mailscanner and ClamAv.
> >> Would anyone like to comment on this one?
> >
> >
> > My comment "Yeah, it works as it should, so what's the issue?"
> >
> Are you trying to say that by design the Subject line is excluded from
> being scanned?
>

From kfliong at WOFS.COM  Wed Jul 16 03:23:20 2003
From: kfliong at WOFS.COM (kfliong)
Date: Thu Jan 12 21:18:57 2006
Subject: emails with No Message Collected
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0A4ADCB@pascal.priv.bmrb.co .uk>
Message-ID: <5.2.1.1.0.20030716102245.02663600@192.168.10.2>

I have checked and my "noetrn" command is in the init script. So, what else
could be the reason?

Thanks in advance.

At 10:57 AM 7/14/2003 +0100, you wrote:
>kfliong wrote:
> > Hi,
> >
> > I have this problem where some of the outgoing mails are received as
> > <<< No Message Collected >>>.
> >
> > All the contents including attachments are ripped and only left with
> > this message "<<< No Message Collected >>>".
>
>Thats a sendmail error - probably you have a sendmail process which is
>trying to process the incoming queue, which leads to a race condition
>between mailscanner and sendmail.  Sometimes MailScanner gets the message,
>sometimes sendmail gets the message, sometimes mailscanner gets the
>message, sometimes theres a draw, mailscanner gets the message - sendmail
>only gets the headers - but sendmail delivers first, therefore the second
>(full) copy (from MailScanner) is discarded as a duplicate (same
>messageid).  You can verify if this is the case by grepping your maillogs
>for affected message ids.  When this happened to me it was caused by an
>exchange server issuing ETRN's - make sure your MailScanner init script is
>starting sendmail with the noetrn option.
>
>
>
>BMRB International
>http://www.bmrb.co.uk
>+44 (0)20 8566 5000
>_________________________________________________________________
>This message (and any attachment) is intended only for the
>recipient and may contain confidential and/or privileged
>material.  If you have received this in error, please contact the
>sender and delete this message immediately.  Disclosure, copying
>or other action taken in respect of this email or in
>reliance on it is prohibited.  BMRB International Limited
>accepts no liability in relation to any personal emails, or
>content of any email which does not directly relate to our
>business.

From batucker at ICNET.NET  Wed Jul 16 04:38:20 2003
From: batucker at ICNET.NET (Brady A. Tucker)
Date: Thu Jan 12 21:18:57 2006
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off
Message-ID: <ILEGLLEHLGEPGCEHMOKNOEIKGPAD.batucker@icnet.net>

I have some messages getting through that say they are whitelisted,  though
they are not.    I'm not sure when this started as I'm just now looking for
them specifically,  I've done updates as they have come out (Except for MS
4.22-5) on both SA and Mailscanner, Any suggestions ?

Specifics :
  -MailScanner 4.22-4, SA 2.5.5, RH 9, sendmail 8.12.8
  -Doesn't happen with very many addresses,  but with ~65,000 messages a
day....
  -I have 'SpamAssassin Auto Whitelist = no' set in MailScanner.conf
  -I do use spam.whitelist.rules,  not excessively (30 or so entries),  and
the address to which this was sent (me) has no 'To' or 'FromorTo' lines,
nor does the address it was received from have any entries...

  -I'm betting there is another whitelist setting I'm missing in SA ?  Can't
fine anything, even though this is not an SA list,  any suggestions are
appreciated


MailScanner headers :
<!--- snip --->
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: not spam (whitelisted), spamassassin (score=18.4,
        required 5, BAYES_60, CLICK_BELOW, DATE_IN_FUTURE_12_24, HG_HORMONE,
        HTML_40_50, HTML_IMAGE_ONLY_06, HTML_LINK_CLICK_HERE, HTML_WEB_BUGS,
        MIME_HTML_ONLY, MSG_ID_ADDED_BY_MTA_SHORT, RCVD_IN_BL_SPAMCOP_NET,
        RCVD_IN_DSBL, USERPASS)
<!--- snip --->

                                      Brady A. Tucker
                                      Internet Complete! inc.
                                      http://www.icnet.net

From damian at WORKGROUPSOLUTIONS.COM  Wed Jul 16 06:27:24 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:18:57 2006
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off
Message-ID: <F6B4162F6771E44ABF0958023547FFC413D2F2@w2kserver.workgroupsolutions.com>

Brady,

I have the exact same problem with messages being "whitelisted" when they should not be. Others have reported the problem as well.

I have not been able to resolve it yet, though I keep trying new ideas.

Regards,

Damian

-----Original Message-----
From: Brady A. Tucker [mailto:batucker@ICNET.NET]
Sent: Tuesday, July 15, 2003 8:38 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off


I have some messages getting through that say they are whitelisted,  though
they are not.    I'm not sure when this started as I'm just now looking for
them specifically,  I've done updates as they have come out (Except for MS
4.22-5) on both SA and Mailscanner, Any suggestions ?

Specifics :
  -MailScanner 4.22-4, SA 2.5.5, RH 9, sendmail 8.12.8
  -Doesn't happen with very many addresses,  but with ~65,000 messages a
day....
  -I have 'SpamAssassin Auto Whitelist = no' set in MailScanner.conf
  -I do use spam.whitelist.rules,  not excessively (30 or so entries),  and
the address to which this was sent (me) has no 'To' or 'FromorTo' lines,
nor does the address it was received from have any entries...

  -I'm betting there is another whitelist setting I'm missing in SA ?  Can't
fine anything, even though this is not an SA list,  any suggestions are
appreciated


MailScanner headers :
<!--- snip --->
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: not spam (whitelisted), spamassassin (score=18.4,
        required 5, BAYES_60, CLICK_BELOW, DATE_IN_FUTURE_12_24, HG_HORMONE,
        HTML_40_50, HTML_IMAGE_ONLY_06, HTML_LINK_CLICK_HERE, HTML_WEB_BUGS,
        MIME_HTML_ONLY, MSG_ID_ADDED_BY_MTA_SHORT, RCVD_IN_BL_SPAMCOP_NET,
        RCVD_IN_DSBL, USERPASS)
<!--- snip --->

                                      Brady A. Tucker
                                      Internet Complete! inc.
                                      http://www.icnet.net


From danieltan at shopnsave.com.sg  Wed Jul 16 07:11:11 2003
From: danieltan at shopnsave.com.sg (Daniel Tan)
Date: Thu Jan 12 21:18:57 2006
Subject: local.cf or spamassassin.prefs.conf?
Message-ID: <004401c34b61$0e432c20$3900a8c0@Daniel>

hi all,
        i am trying to create my own rules to prohibit spam mails. As
20_porn.cf file in /usr/share/spamassassin advice not to edit that file. so
currently i have 2 entries in spamassassin.prefs.conf  in /etc/MailScanner
to do the job nicely for me. But 20_porn.cf file advice to put my local
rules in /etc/mail/spamassassin...tried that but did not work whereas
putting the same rules in spamassassin.prefs.conf works! i am thinking of
using local.cf file as it is empty whereas spamassassin.prefs.conf file has
some settings already in there...

Regards,
Daniel Tan
67469188 Ext.665
DID: 68430665
MIS Department
Shop N Save Pte Ltd
: danieltan@shopnsave.com.sg

[This e-mail is confidential and may also be privileged. If you are not the
intended recipient, please delete it and notify us immediately; you should
not copy or use it for any purpose, nor disclose its contents to any other
person. Thank you.]



--
This message has been scanned for viruses and
dangerous content by Email Virus Scanner, and is
believed to be clean.

From john at TRADOC.FR  Wed Jul 16 07:31:31 2003
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:18:57 2006
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off
In-Reply-To: <ILEGLLEHLGEPGCEHMOKNOEIKGPAD.batucker@icnet.net>
References: <ILEGLLEHLGEPGCEHMOKNOEIKGPAD.batucker@icnet.net>
Message-ID: <i4s9hv4s1fde4i1qtu2dm6ctkaeck14f7a@tradoc.fr>

On Tue, 15 Jul 2003 22:38:20 -0500, Brady A. Tucker wrote:
>   -I'm betting there is another whitelist setting I'm missing in SA ?  Can't
> fine anything, even though this is not an SA list,  any suggestions are
> appreciated

Could it be the default whitelists in
/usr/share/spamassassin/60_whitelist.cf ?

John.

-- 
-- Over 2000 webcams from ski resorts around the world - http://www.snoweye.com/
-- Translate your technical documents and web pages    - http://www.tradoc.fr/


From kevins at BMRB.CO.UK  Wed Jul 16 07:32:55 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:57 2006
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E48@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E48@pascal.priv.bmrb.co.uk>
Message-ID: <1058337183.15737.6.camel@bach.kevinspicer.co.uk>

On Wed, 2003-07-16 at 04:38, Brady A. Tucker wrote:

>I have some messages getting through that say they are whitelisted,
>though
>they are not.    I'm not sure when this started as I'm just now looking
>for

Have you whitlisted you own domains (by name)? - many spammers use your
own address as the envelope from address (this doesn't appear in the
headers, but may be in your maillog).  Note that the whitelist in the
header you posted is a MailScanner whitelist (spam.whitelist.rules) not
a SpamAssassin whitelist (which would give it a negative score).  If you
have whitelisted your domains by name change spam.whitelist.rules to
whitelist your domain's mail servers by IP instead (alternativly
whitelist your entire IP range if thats easier).




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From kevins at BMRB.CO.UK  Wed Jul 16 07:34:47 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:57 2006
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E4B@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E4B@pascal.priv.bmrb.co.uk>
Message-ID: <1058337287.13524.9.camel@bach.kevinspicer.co.uk>

>On Wed, 2003-07-16 at 07:31, John Wilcock wrote:

>On Tue, 15 Jul 2003 22:38:20 -0500, Brady A. Tucker wrote:
>>   -I'm betting there is another whitelist setting I'm missing in SA
?  Can't
>> fine anything, even though this is not an SA list,  any suggestions
are
>> appreciated

>Could it be the default whitelists in
>/usr/share/spamassassin/60_whitelist.cf ?

No, because the headers posted showed that it was the mailscanner
whitelist and not a spamassassin whitelist (which would give a negative
score).




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From kevins at BMRB.CO.UK  Wed Jul 16 07:43:38 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:57 2006
Subject: emails with No Message Collected
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E47@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E47@pascal.priv.bmrb.co.uk>
Message-ID: <1058337818.13524.19.camel@bach.kevinspicer.co.uk>

On Wed, 2003-07-16 at 03:23, kfliong wrote:

I have checked and my "noetrn" command is in the init script. So, what
else
could be the reason?

Maybe a locking problem?  Check that sendmail and MS are using the same
lock type (and that none of your mail spools are on NFS shares).  You
can find sendmails lock type as described below (from sendmails site)...


"You can determine which locking system is used by sendmail from the
output of:

        sendmail -bt -d0.10 < /dev/null | grep HASFLOCK

If HASFLOCK is in the output, your system is using flock() for locking.
Otherwise, it is using fcntl() for locking.  "

fcntl() is called 'posix' in MS, check that 'Lock Type' in MS.conf is
set to the correct type (or commented out if sendmail is using flock()).

Failing that - have you checked for anything unusual in the maillog?





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From Thomas.Ehweiner at T-SYSTEMS.COM  Wed Jul 16 07:42:27 2003
From: Thomas.Ehweiner at T-SYSTEMS.COM (Thomas Ehweiner)
Date: Thu Jan 12 21:18:57 2006
Subject: AW: emails with No Message Collected
Message-ID: <698647D9732ED84290AB276EC481B64301EEB4@u8sm7.gppng01.telekom.de>

Do you have "timeout waiting for input from <host> during message collect" in your logs?
If yes, mtu/mss size is too big for some servers.
Thomas

> -----Urspr?ngliche Nachricht-----
> Von: kfliong [mailto:kfliong@WOFS.COM] 
> Gesendet: Montag, 14. Juli 2003 11:40
> An: MAILSCANNER@JISCMAIL.AC.UK
> Betreff: emails with No Message Collected
> 
> 
> Hi,
> 
> I have this problem where some of the outgoing mails are 
> received as <<< No Message Collected >>>.
> 
> All the contents including attachments are ripped and only 
> left with this message "<<< No Message Collected >>>".
> 
> I am not sure if this is related to Mailscanner or any of the 
> settings in it that i have implemented. This truly strange. 
> So far, I can't find any pattern that can lead me to diagnose 
> this problem. The sender, recipient, subject, contents are random.
> 
> I would appreciate any help or suggestions. Thanks in advance.
> 


From kfliong at WOFS.COM  Wed Jul 16 08:43:33 2003
From: kfliong at WOFS.COM (kfliong)
Date: Thu Jan 12 21:18:57 2006
Subject: emails with No Message Collected
In-Reply-To: <1058337818.13524.19.camel@bach.kevinspicer.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E47@pascal.priv.bmrb.co.uk>
            <5C0296D26910694BB9A9BBFC577E7AB001175E47@pascal.priv.bmrb.co.uk>
Message-ID: <5.2.1.1.0.20030716151522.02674a98@192.168.10.2>

I have check and both sendmail and MS is using flock.

I see this in MS.conf file - Lock Type = flock

So, both is flock type.

Here is a short list of what i get when it tail maillog.

MTP, daemon=MTA, relay=215.Red-80-36-94.pooles.rima-tde.net [80.36.94.215]
Jul 16 15:38:00 ensim sendmail[12706]: h6GJbnV12706: to=<adverts@wofs.com>,
delay=00:00:07, mailer=virthostmail, pri=32201, stat=queued
Jul 16 15:38:01 ensim MailScanner[12047]: New Batch: Found 2 messages waiting
Jul 16 15:38:01 ensim MailScanner[12047]: New Batch: Scanning 1 messages,
2762 bytes
Jul 16 15:38:01 ensim MailScanner[12098]: Spam Checks: Found 1 spam messages
Jul 16 15:38:01 ensim sendmail[12765]: h6GJc1l12765: from=<>, size=999,
class=0, nrcpts=1,
msgid=<200307161938.h6GJc1l12765@ensim.wofsproperties.com>,
relay=root@localhost
Jul 16 15:38:01 ensim MailScanner[12098]: Virus and Content Scanning: Starting
Jul 16 15:38:03 ensim sendmail[12768]: h6GJc1l12765:
to=mariawantsu@compuserve.com, delay=00:00:02, xdelay=00:00:02,
mailer=esmtp, pri=30999, relay=mx2.compuserve.com. [149.174.40.8],
dsn=2.0.0, stat=Sent (h6G7hpAR016440 Message accepted for delivery)
Jul 16 15:38:05 ensim MailScanner[12047]: Spam Checks: Found 1 spam messages
Jul 16 15:38:05 ensim sendmail[12775]: h6GJc5912775: from=<>, size=937,
class=0, nrcpts=1,
msgid=<200307161938.h6GJc5912775@ensim.wofsproperties.com>,
relay=root@localhost
Jul 16 15:38:05 ensim MailScanner[12047]: Virus and Content Scanning: Starting
Jul 16 15:38:06 ensim sendmail[12778]: h6GJc5912775:
to=mariawantsu@yahoo.com, delay=00:00:01, xdelay=00:00:01, mailer=esmtp,
pri=30937, relay=mx2.mail.yahoo.com. [64.156.215.5], dsn=5.0.0,
stat=Service unavailable
Jul 16 15:38:06 ensim sendmail[12778]: h6GJc5912775: h6GJc6812778:
postmaster notify: Service unavailable
Jul 16 15:38:06 ensim sendmail[12778]: h6GJc6812778: to=root,
delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31037, dsn=2.0.0, stat=Sent
Jul 16 15:38:23 ensim sendmail[12815]: h6GJcNh12815: from=apache, size=832,
class=0, nrcpts=1,
msgid=<200307161938.h6GJcNh12815@ensim.wofsproperties.com>,
relay=apache@localhost
Jul 16 15:38:25 ensim sendmail[12818]: h6GJcNh12815: to=izancj@hotmail.com,
ctladdr=apache (48/48), delay=00:00:02, xdelay=00:00:02, mailer=esmtp,
pri=30832, relay=mx4.hotmail.com. [65.54.254.151], dsn=2.0.0, stat=Sent (
<200307161938.h6GJcNh12815@ensim.wofsproperties.com> Queued mail for delivery)

Well, I am not sure if this is correct, but how come some mails are being
handled by MailScanne and some by sendmail?

Thanks in advance.

At 07:43 AM 7/16/2003 +0100, you wrote:
>On Wed, 2003-07-16 at 03:23, kfliong wrote:
>
>I have checked and my "noetrn" command is in the init script. So, what
>else
>could be the reason?
>
>Maybe a locking problem?  Check that sendmail and MS are using the same
>lock type (and that none of your mail spools are on NFS shares).  You
>can find sendmails lock type as described below (from sendmails site)...
>
>
>"You can determine which locking system is used by sendmail from the
>output of:
>
>         sendmail -bt -d0.10 < /dev/null | grep HASFLOCK
>
>If HASFLOCK is in the output, your system is using flock() for locking.
>Otherwise, it is using fcntl() for locking.  "
>
>fcntl() is called 'posix' in MS, check that 'Lock Type' in MS.conf is
>set to the correct type (or commented out if sendmail is using flock()).
>
>Failing that - have you checked for anything unusual in the maillog?
>
>
>
>
>
>BMRB International
>http://www.bmrb.co.uk
>+44 (0)20 8566 5000
>_________________________________________________________________
>This message (and any attachment) is intended only for the
>recipient and may contain confidential and/or privileged
>material.  If you have received this in error, please contact the
>sender and delete this message immediately.  Disclosure, copying
>or other action taken in respect of this email or in
>reliance on it is prohibited.  BMRB International Limited
>accepts no liability in relation to any personal emails, or
>content of any email which does not directly relate to our
>business.

From m.sapsed at BANGOR.AC.UK  Wed Jul 16 09:02:10 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:57 2006
Subject: Eicar signature in the subject line
References: <5.2.1.1.0.20030715162735.01b80ea8@xanadu.evi-inc.com>
            <3F14ADFC.8020103@hpi.com>
Message-ID: <3F150682.9040000@bangor.ac.uk>

Adam Polkosnik wrote:
> Matt Kettler wrote:
>
>> At 03:36 PM 7/15/2003 -0400, Adam Polkosnik wrote:
>>
>>> Just as I was updating my mail system and started to do some testing
>>> I've noticed that an e-mail with eicar signature in the subject line was
>>> able to pass through (without any problem) my mailserver equipped with
>>> Mailscanner and ClamAv.
>>> Would anyone like to comment on this one?
>>
>> My comment "Yeah, it works as it should, so what's the issue?"
>>
> Are you trying to say that by design the Subject line is excluded from
> being scanned?

Yes, as are the rest of the headers. What would be the point of scanning
it? I'm not aware of any way for the contents of the Subject line to be
executed (better put a "yet" in there!). As far as I can remember the
MyParty "issue" was the only reason MailScanner started checking the
body of messages. In general, attachments (including bits of HTML) are
the main things to worry about.

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From m.sapsed at BANGOR.AC.UK  Wed Jul 16 09:06:08 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:57 2006
Subject: local.cf or spamassassin.prefs.conf?
References: <004401c34b61$0e432c20$3900a8c0@Daniel>
Message-ID: <3F150770.5080903@bangor.ac.uk>

Daniel Tan wrote:
>         i am trying to create my own rules to prohibit spam mails. As
> 20_porn.cf file in /usr/share/spamassassin advice not to edit that file. so
> currently i have 2 entries in spamassassin.prefs.conf  in /etc/MailScanner
> to do the job nicely for me. But 20_porn.cf file advice to put my local
> rules in /etc/mail/spamassassin...tried that but did not work whereas
> putting the same rules in spamassassin.prefs.conf works! i am thinking of
> using local.cf file as it is empty whereas spamassassin.prefs.conf file has
> some settings already in there...

Received wisdom on the list is to make local.cf a symbolic link to
spamassassin.prefs.conf - that way, any alterations affect both
MailScanner's use of SpamAssassin and use of spamassassin on its own.

> [This e-mail is confidential and may also be privileged. If you are not the
> intended recipient, please delete it and notify us immediately; you should
> not copy or use it for any purpose, nor disclose its contents to any other
> person. Thank you.]

[This disclaimer is ludicrous when attached to e-mails to a list.
According to it, I shouldn't have read it, replied to it or copied any
of it to the list!] ;-)

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From john at TRADOC.FR  Wed Jul 16 10:10:20 2003
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:18:57 2006
Subject: Virus Update Scripts with Timeouts
In-Reply-To: <2h7tgv47fou2pstqnigrap4ujd7n7tmgrt@tradoc.fr>
References: <Pine.LNX.4.44.0307101859140.5091-300000@tiger.dorfam.ca>
            <2h7tgv47fou2pstqnigrap4ujd7n7tmgrt@tradoc.fr>
Message-ID: <9a5ahv0brr7sf47ed4ucren4erlotmu5g0@tradoc.fr>

On Fri, 11 Jul 2003 13:26:08 +0200, I wrote:
> I've tried these new scripts here on a redhat 9 box - they work fine
> if called directly from a shell prompt, but for some reason don't log
> the usual updated / does not need updating information to the syslog
> when called from Julian's cron.hourly script. Any ideas? 

Suddenly had a flash of inspiration - I'd forgotten to dos2unix these
scripts when transferring them from the Windows box on which I receive
mail. I don't fully understand why they worked anyway when called
directly from shell, but still... they work correctly now no matter
how I call them.

John.

-- 
-- Over 2000 webcams from ski resorts around the world - http://www.snoweye.com/
-- Translate your technical documents and web pages    - http://www.tradoc.fr/


From michele at BLACKNIGHTSOLUTIONS.COM  Wed Jul 16 10:39:58 2003
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:18:57 2006
Subject: Blacklisted e-mails not deleted???
In-Reply-To: <Pine.LNX.4.44.0307161130190.19165-100000@raveon.barendse.to>
References: <Pine.LNX.4.44.0307161130190.19165-100000@raveon.barendse.to>
Message-ID: <2098.213.140.31.171.1058348398.squirrel@www.blacknightsolutions.com>

> I have a domain on spam blacklist, and in spam actions the same domain
> is marked with action delete.
>
> Their crap still gets delivered however. Is there a bug in
> mailscanner-4.22-5?
>
> Thanks!

Why don't you block in via Sendmail


--
Mr. Michele Neylon
Blacknight Solutions
http://www.blacknightsolutions.com/
Shell hosting now available



#########################################################
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance to it is prohibited.

From mailscanner at BARENDSE.TO  Wed Jul 16 10:33:31 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:57 2006
Subject: Blacklisted e-mails not deleted???
Message-ID: <Pine.LNX.4.44.0307161130190.19165-100000@raveon.barendse.to>

I have a domain on spam blacklist, and in spam actions the same domain is
marked with action delete.

Their crap still gets delivered however. Is there a bug in
mailscanner-4.22-5?

Thanks!

From Kevin.Spicer at BMRB.CO.UK  Wed Jul 16 10:48:34 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:57 2006
Subject: Blacklisted e-mails not deleted???
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF739@pascal.priv.bmrb.co.uk>

Michele Neylon :: Blacknight Solutions wrote:
>> I have a domain on spam blacklist, and in spam actions the same
>> domain is marked with action delete. 
>> 
>> Their crap still gets delivered however. Is there a bug in
>> mailscanner-4.22-5? 
Maybe they are using a different domain in the envelope than the one they are using in the headers?  Does the domain show up in your maillog?



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From mailscanner at BARENDSE.TO  Wed Jul 16 12:40:17 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:57 2006
Subject: Blacklisted e-mails not deleted???
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF739@pascal.priv.bmrb.co.uk>
Message-ID: <Pine.LNX.4.44.0307161331560.19165-100000@raveon.barendse.to>

They do show up in the maillog without any remarks.

This is the header as viewed in pine:
Return-Path: <quiminews@quiminet.biz>
Received: from gw.xxx.xx (gw.xxx.xxx [1.1.1.1])
        by l.xxxx (8.12.8/8.12.8) with ESMTP id h6G9SCos011122
        for <xxxxxx@xxxx>; Wed, 16 Jul 2003 11:28:12 +0200
Received: from diseno3. (dsl-200-67-178-168.prodigy.net.mx
[200.67.178.168])
        by gw.xxx.xxx (8.12.9/8.12.9) with SMTP id h6G9HFR5027587
        for <xxxxxxx>; Wed, 16 Jul 2003 11:27:44 +0200
x-esmtp: 0 0 1
Message-ID: <9493103-22003731662334624@diseno3>
From: "QuimiNews" <quiminews@quiminet.biz>

This is what it says in maillog:
Jul 16 11:20:13 l sendmail[10506]: h6G9KDos010506:
from=<quiminews@quiminet.biz>, size=17915, class=0, nrcpts=1, msgid=<
4506104-2200373165220452@diseno3>, proto=ESMTP, daemon=MTA,
relay=

I think maybe that one action in MailScanner cancels the other.
New Batch: Scanning 1 messages, 18332 bytes
Spam Checks: Found 1 spam messages
Virus and Content Scanning: Starting
Content Checks: Detected HTML-specific exploits in h6G9KDos010506
Content Checks: Found 1 problems
Content Checks: Detected and will convert HTML message to plain text in h6G9KDos010
Uninfected: Delivered 1 messages


It seems as if the message has passed through html cleansing, MailScanner
forgets to apply the spam delivery rule??

Or maybe the html cleaning does an auto deliver??




On Wed, 16 Jul 2003, Spicer, Kevin wrote:

> Michele Neylon :: Blacknight Solutions wrote:
> >> I have a domain on spam blacklist, and in spam actions the same
> >> domain is marked with action delete.
> >>
> >> Their crap still gets delivered however. Is there a bug in
> >> mailscanner-4.22-5?
> Maybe they are using a different domain in the envelope than the one they are using in the headers?  Does the domain show up in your maillog?
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact the
> sender and delete this message immediately.  Disclosure, copying
> or other action taken in respect of this email or in
> reliance on it is prohibited.  BMRB International Limited
> accepts no liability in relation to any personal emails, or
> content of any email which does not directly relate to our
> business.
>

From zabriskw at ITECH.NET  Wed Jul 16 13:10:37 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:18:57 2006
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off
References: <ILEGLLEHLGEPGCEHMOKNOEIKGPAD.batucker@icnet.net>
Message-ID: <001101c34b93$4498dbd0$0c02a8c0@itech.dom>

Brady,
I have been trying for a couple of months now, and I can not solve the
problem either.  If you find a solution could you please post it to the
Mailing list, because I know several people are having the same problem.
Thanks!

----- Original Message -----
From: "Brady A. Tucker" <batucker@ICNET.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 15, 2003 11:38 PM
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off


> I have some messages getting through that say they are whitelisted,
though
> they are not.    I'm not sure when this started as I'm just now looking
for
> them specifically,  I've done updates as they have come out (Except for MS
> 4.22-5) on both SA and Mailscanner, Any suggestions ?
>
> Specifics :
>   -MailScanner 4.22-4, SA 2.5.5, RH 9, sendmail 8.12.8
>   -Doesn't happen with very many addresses,  but with ~65,000 messages a
> day....
>   -I have 'SpamAssassin Auto Whitelist = no' set in MailScanner.conf
>   -I do use spam.whitelist.rules,  not excessively (30 or so entries),
and
> the address to which this was sent (me) has no 'To' or 'FromorTo' lines,
> nor does the address it was received from have any entries...
>
>   -I'm betting there is another whitelist setting I'm missing in SA ?
Can't
> fine anything, even though this is not an SA list,  any suggestions are
> appreciated
>
>
> MailScanner headers :
> <!--- snip --->
> X-MailScanner: Found to be clean
> X-MailScanner-SpamCheck: not spam (whitelisted), spamassassin (score=18.4,
>         required 5, BAYES_60, CLICK_BELOW, DATE_IN_FUTURE_12_24,
HG_HORMONE,
>         HTML_40_50, HTML_IMAGE_ONLY_06, HTML_LINK_CLICK_HERE,
HTML_WEB_BUGS,
>         MIME_HTML_ONLY, MSG_ID_ADDED_BY_MTA_SHORT, RCVD_IN_BL_SPAMCOP_NET,
>         RCVD_IN_DSBL, USERPASS)
> <!--- snip --->
>
>                                       Brady A. Tucker
>                                       Internet Complete! inc.
>                                       http://www.icnet.net
>

From steve.douglas at SBIINCORPORATED.COM  Wed Jul 16 13:52:02 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:18:57 2006
Subject: Block whole address
Message-ID: <3963522F0E71474CB14C0FF54A6914F7011151DC@mail.gardenbotanika.com>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: Steve Douglas.vcf
Type: application/octet-stream
Size: 380 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/90e81680/SteveDouglas.obj
From Kevin.Spicer at BMRB.CO.UK  Wed Jul 16 14:05:19 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:57 2006
Subject: Block whole address
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF73E@pascal.priv.bmrb.co.uk>

You're probably better off doing that at the MTA (e.g. in sendmail's access database).

-----Original Message-----
From: Steve Douglas [mailto:steve.douglas@SBIINCORPORATED.COM]
Sent: 16 July 2003 13:52
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Block whole address



Is there a way to block an entire address from entering an email server using MailScanner?

 

 

 

 




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/2bc45e9c/attachment.html
From mailscanner at ecs.soton.ac.uk  Wed Jul 16 14:30:39 2003
From: mailscanner at ecs.soton.ac.uk (mailscanner)
Date: Thu Jan 12 21:18:57 2006
Subject: {Virus?} Re:look,my beautiful girl friend
Message-ID: <E19cmMh-004KOX-00@pop1.sccoast.net>

Warning: This message has had one or more attachments removed
Warning: (click.bat, msg-1771660-28.html).
Warning: Please read the "VirusWarning.txt" attachment(s) for more information.


-------------- next part --------------
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "msg-1771660-28.html"
was believed to be infected by a virus and has been replaced by this warning
message.

If you wish to receive a copy of the *infected* attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Wed Jul 16 09:31:16 2003 the virus scanner said:
   Found dangerous IFrame tag in HTML message

Note to Help Desk: Look on the MailScanner in /d/MailScanner/quarantine/20030716 (message 19cmMh-004KOX-00).
-- 
Postmaster
Mailscanner thanks transtec Computers for their support
-------------- next part --------------
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "click.bat"
was believed to be infected by a virus and has been replaced by this warning
message.

If you wish to receive a copy of the *infected* attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Wed Jul 16 09:31:17 2003 the virus scanner said:
   >>> Virus 'W32/Klez-H' found in file click.bat
   Batch files are often mailicious (click.bat)

Note to Help Desk: Look on the MailScanner in /d/MailScanner/quarantine/20030716 (message 19cmMh-004KOX-00).
-- 
Postmaster
Mailscanner thanks transtec Computers for their support
-------------- next part --------------
Content-Type: application/octet-stream;
	name=misc[1].htm
Content-Transfer-Encoding: base64
Content-ID: <SvNNIc4yM>

Ly8gSmF2YXNjcmlwdCBVdGlsaXRpZXMKLy8gTmV0TGFicy5uZXQgIEFsbCBSaWdodHMgUmVz
ZXJ2ZWQsIGluZm9AbmV0bGFicy5uZXQgQ29weXJpZ2h0IDIwMDIKLy8KCk5TNCA9IChkb2N1
bWVudC5sYXllcnMpID8gdHJ1ZSA6IGZhbHNlOwpJRSA9IChkb2N1bWVudC5hbGwpID8gdHJ1
ZSA6IGZhbHNlOwpJRTQgPSAoKGRvY3VtZW50LmFsbCkmJihuYXZpZ2F0b3IuYXBwVmVyc2lv
bi5pbmRleE9mKCJNU0lFIDQuIikhPS0xKSkgPyB0cnVlIDogZmFsc2U7CklFNSA9ICgoZG9j
dW1lbnQuYWxsKSYmKG5hdmlnYXRvci5hcHBWZXJzaW9uLmluZGV4T2YoIk1TSUUgNS4iKSE9
LTEpKSA/IHRydWUgOiBmYWxzZTsKSUU2ID0gKChkb2N1bWVudC5hbGwpJiYobmF2aWdhdG9y
LmFwcFZlcnNpb24uaW5kZXhPZigiTVNJRSA2LiIpIT0tMSkpID8gdHJ1ZSA6IGZhbHNlOwp2
ZXI0ID0gKE5TNCB8fCBJRTQpID8gdHJ1ZSA6IGZhbHNlOwpOUzYgPSAoZG9jdW1lbnQuZ2V0
RWxlbWVudEJ5SWQpICYmIChuYXZpZ2F0b3IudXNlckFnZW50LmluZGV4T2YoJ05ldHNjYXBl
JykhPS0xKT90cnVlOmZhbHNlOwpJRTVwbHVzID0gSUU1IHx8IElFNjsKREhUTUw9IChOUzQg
fHwgSUUgfHwgTlM2KTsKCgpmdW5jdGlvbiBnZXRPYmoobmFtZSkKewogIGlmIChkb2N1bWVu
dC5hbGwpCiAgeyByZXR1cm4gZG9jdW1lbnQuYWxsW25hbWVdIH0KICBlbHNlIGlmIChkb2N1
bWVudC5nZXRFbGVtZW50QnlJZCkKICB7IHJldHVybiBkb2N1bWVudC5nZXRFbGVtZW50QnlJ
ZChuYW1lKSB9CiAgZWxzZSBpZiAoZG9jdW1lbnQubGF5ZXJzKQogIHsgcmV0dXJuIGRvY3Vt
ZW50LmxheWVyc1tuYW1lXTsgfQogIGVsc2UgcmV0dXJuIGZhbHNlOwp9CgoKCmZ1bmN0aW9u
IGFyck9uKG51bSkgewogICBpZiAoIURIVE1MICkgcmV0dXJuOwogICBlPWdldE9iaignYXJy
JytudW0pOwogICBpZiAoIWUgKSByZXR1cm47CiAgIGUuc3JjID0gIi9pbWFnZXMvbG4tZ3JB
cnJEb3duLmdpZiI7CiAgIGU9Z2V0T2JqKCdsbicrbnVtKTsKICAgaWYgKCFlICkgcmV0dXJu
OwogICBlLnNyYyA9ICIvaW1hZ2VzLzY2OTk2NnB4LmdpZiI7CiAgIC8vZS5zdHlsZS52aXNp
YmlsaXR5PSJ2aXNpYmxlIjsKfQoKCmZ1bmN0aW9uIGFyck9mZihudW0pIHsKICAgaWYgKCFE
SFRNTCApIHJldHVybjsKICAgZT1nZXRPYmooJ2FycicrbnVtKTsKICAgaWYgKCFlICkgcmV0
dXJuOwogICBlLnNyYyA9ICIvaW1hZ2VzL2xuLWJsdUFyclJ0LmdpZiI7CiAgIGU9Z2V0T2Jq
KCdsbicrbnVtKTsKICAgaWYgKCFlICkgcmV0dXJuOwogICBlLnNyYyA9ICIvaW1hZ2VzL3Ry
YW5zcHguZ2lmIjsKICAgLy9lLnN0eWxlLnZpc2liaWxpdHk9ImhpZGRlbiI7Cn0KCgoKZnVu
Y3Rpb24gc3dhcEltYWdlKCkgeyAKICB2YXIgaSwgdGhlT2JqLCBqPTAsIHN3YXBBcnJheT1u
ZXcgQXJyYXksIG9sZEFycmF5PWRvY3VtZW50LnN3YXBJbWdEYXRhOyAgCiAgZm9yIChpPTA7
IGkgPCAoc3dhcEltYWdlLmFyZ3VtZW50cy5sZW5ndGgtMik7IGkrPTMpIHsgIAogICAgdGhl
T2JqID0gZXZhbChzd2FwSW1hZ2UuYXJndW1lbnRzWyhuYXZpZ2F0b3IuYXBwTmFtZSA9PSAn
TmV0c2NhcGUnKT9pOmkrMV0pICAKICAgIGlmICh0aGVPYmogIT0gbnVsbCkgeyAgCiAgICAg
IHN3YXBBcnJheVtqKytdID0gdGhlT2JqOyAgCiAgICAgIHN3YXBBcnJheVtqKytdID0gKG9s
ZEFycmF5PT1udWxsIHx8IG9sZEFycmF5W2otMV0hPXRoZU9iaik/dGhlT2JqLnNyYzpvbGRB
cnJheVtqXTsgIAogICAgICB0aGVPYmouc3JjID0gc3dhcEltYWdlLmFyZ3VtZW50c1tpKzJd
OyAgCiAgfSB9ICAKICBkb2N1bWVudC5zd2FwSW1nRGF0YSA9IHN3YXBBcnJheTsgLy91c2Vk
IGZvciByZXN0b3JlICAKfSAgCgpmdW5jdGlvbiBzd2FwSW1nUmVzdG9yZSgpIHsgCiAgaWYg
KGRvY3VtZW50LnN3YXBJbWdEYXRhICE9IG51bGwpICAKICAgIGZvciAodmFyIGk9MDsgaTwo
ZG9jdW1lbnQuc3dhcEltZ0RhdGEubGVuZ3RoLTEpOyBpKz0yKSAgCiAgICAgIGRvY3VtZW50
LnN3YXBJbWdEYXRhW2ldLnNyYyA9IGRvY3VtZW50LnN3YXBJbWdEYXRhW2krMV07ICAKfSAg
CgoKcGFnZT13aW5kb3cubG9jYXRpb247CmZ1bmN0aW9uIHNlbmRfbWFpbCgpCnsKdGl0bGU9
ZG9jdW1lbnQudGl0bGU7CmJvZHk9IlRha2UgYSBsb29rIGF0IHRoaXMlMEQlMEEiK3RpdGxl
KyIlMEQlMEEiK3BhZ2U7Cgptc2c9Im1haWx0bzo/c3ViamVjdD0iK3RpdGxlKyImYm9keT0i
K2JvZHk7CgovLyBhbGVydChtc2cpCndpbmRvdy5sb2NhdGlvbj1tc2c7Cgp9CgoKCgpmdW5j
dGlvbiBvcGVuV2luICggaHRtbEZpbGUsIGZpbGVIZWlnaHQsIGZpbGVXaWR0aCApCnsKCiAg
V2luUHJvY2Vzcz13aW5kb3cub3BlbiggaHRtbEZpbGUgLCAnX2JsYW5rJywic2Nyb2xsYmFy
cz15ZXMscmVzaXphYmxlPXllcyxoZWlnaHQ9IitmaWxlSGVpZ2h0KyIsd2lkdGg9IitmaWxl
V2lkdGgpIAogIFdpblByb2Nlc3MuZm9jdXMoKTsKfQoKZnVuY3Rpb24gb3Blbldpbk5TICgg
aHRtbEZpbGUsIGZpbGVIZWlnaHQsIGZpbGVXaWR0aCApCnsKICBXaW5Qcm9jZXNzPXdpbmRv
dy5vcGVuKCBodG1sRmlsZSAsICdfYmxhbmsnLCJzY3JvbGxiYXJzPW5vLHJlc2l6YWJsZT15
ZXMsaGVpZ2h0PSIrZmlsZUhlaWdodCsiLHdpZHRoPSIrZmlsZVdpZHRoKSAKICBXaW5Qcm9j
ZXNzLmZvY3VzOwp9CgoKCmZ1bmN0aW9uIG9wZW5QSShwaSkKewogIHBpV2luPXdpbmRvdy5v
cGVuKCBwaSwgJ19ibGFuaycsJ3Njcm9sbGJhcnM9eWVzLHJlc2l6YWJsZT15ZXMsaGVpZ2h0
PTYwMCx3aWR0aD02MDAnKTsKICBwaVdpbi5mb2N1cygpOwp9CgoKZnVuY3Rpb24gaW50ZXJz
dGl0KCBwYWdlICkgewogdmFyIHJldDsKCiAgJG1zZz0nWW91IGFyZSBub3cgbGVhdmluZyB0
aGUgd3d3LnBoYXJtYS51cy5ub3ZhcnRpcy5jb20gc2l0ZSBhbmQgbW92aW5nIHRvIGFuIGV4
dGVybmFsIFdlYiBzaXRlIGluZGVwZW5kZW50bHkgb3BlcmF0ZWQgYW5kIG5vdCBtYW5hZ2Vk
IGJ5IHRoZSBOb3ZhcnRpcyBQaGFybWFjZXV0aWNhbHMgQ29ycG9yYXRpb24uIE5vdmFydGlz
IGFzc3VtZXMgbm8gcmVzcG9uc2liaWxpdHkgZm9yIHRoZSBzaXRlLlxuXG4gSWYgeW91IGRv
IG5vdCB3aXNoIHRvIGxlYXZlIHRoaXMgc2l0ZSwgY2xpY2sgQ2FuY2VsLiAgT3IsIGNsaWNr
IE9LIHRvIGNvbnRpbnVlLiAnOwoKICByZXQ9Y29uZmlybSgkbXNnKTsKCmlmICggcmV0ICkK
ICB7CiAgICAgIHdpbmRvdy5vcGVuKHBhZ2UpCiAgICAgIC8vd2luZG93LmxvY2F0aW9uLmhy
ZWY9cGFnZTsKICB9Cgp9CgoKLy8gRW5kIE5ldExhYnMgSmF2YXNjcmlwdCBGdW5jdGlvbnMK
Ly8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLwoK
Cj==
From gerry at dorfam.ca  Wed Jul 16 14:50:27 2003
From: gerry at dorfam.ca (Gerry Doris)
Date: Thu Jan 12 21:18:57 2006
Subject: Virus Update Scripts with Timeouts
In-Reply-To: <9a5ahv0brr7sf47ed4ucren4erlotmu5g0@tradoc.fr>
References: <Pine.LNX.4.44.0307101859140.5091-300000@tiger.dorfam.ca>
            <2h7tgv47fou2pstqnigrap4ujd7n7tmgrt@tradoc.fr>
            <9a5ahv0brr7sf47ed4ucren4erlotmu5g0@tradoc.fr>
Message-ID: <64695.129.80.22.133.1058363427.squirrel@tiger.dorfam.ca>

> On Fri, 11 Jul 2003 13:26:08 +0200, I wrote:
>> I've tried these new scripts here on a redhat 9 box - they work fine
>> if called directly from a shell prompt, but for some reason don't log
>> the usual updated / does not need updating information to the syslog
>> when called from Julian's cron.hourly script. Any ideas?
>
> Suddenly had a flash of inspiration - I'd forgotten to dos2unix these
> scripts when transferring them from the Windows box on which I receive
> mail. I don't fully understand why they worked anyway when called
> directly from shell, but still... they work correctly now no matter
> how I call them.
>
> John.
>

Great!  No one else complained and I wasn't able to reproduce the error.
Thanks for getting back.

Gerry

From robbyv at DISASTER.COM  Wed Jul 16 15:00:45 2003
From: robbyv at DISASTER.COM (Rob V)
Date: Thu Jan 12 21:18:57 2006
Subject: forged From:
In-Reply-To: <64695.129.80.22.133.1058363427.squirrel@tiger.dorfam.ca>
References: <9a5ahv0brr7sf47ed4ucren4erlotmu5g0@tradoc.fr>
            <Pine.LNX.4.44.0307101859140.5091-300000@tiger.dorfam.ca>
            <2h7tgv47fou2pstqnigrap4ujd7n7tmgrt@tradoc.fr>
            <9a5ahv0brr7sf47ed4ucren4erlotmu5g0@tradoc.fr>
Message-ID: <5.2.1.1.2.20030716095822.01de4578@mailhost.disaster.com>

Has Anyone got a way to block or detect a forged From: address.
I am getting spam sent to us with forged From (they are putting that the
mail is from someone at our domain)
Since we do not scan our own domain these messages are getting in no problem.
Any help or suggested would be appreciated.

From zabriskw at ITECH.NET  Wed Jul 16 15:03:10 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:18:58 2006
Subject: forged From:
References: <9a5ahv0brr7sf47ed4ucren4erlotmu5g0@tradoc.fr>           
            <Pine.LNX.4.44.0307101859140.5091-300000@tiger.dorfam.ca>          
            <2h7tgv47fou2pstqnigrap4ujd7n7tmgrt@tradoc.fr>           
            <9a5ahv0brr7sf47ed4ucren4erlotmu5g0@tradoc.fr> 
            <5.2.1.1.2.20030716095822.01de4578@mailhost.disaster.com>
Message-ID: <001601c34ba2$fe71ec90$0c02a8c0@itech.dom>

We got slammed recently with the same problem.  The best advise I can give
you is do some research on the check_* feature in sendmail.  If you are
using sendmail.


----- Original Message -----
From: "Rob V" <robbyv@DISASTER.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, July 16, 2003 10:00 AM
Subject: forged From:


> Has Anyone got a way to block or detect a forged From: address.
> I am getting spam sent to us with forged From (they are putting that the
> mail is from someone at our domain)
> Since we do not scan our own domain these messages are getting in no
problem.
> Any help or suggested would be appreciated.
>

From Kevin.Spicer at BMRB.CO.UK  Wed Jul 16 15:08:17 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:58 2006
Subject: forged From:
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF73F@pascal.priv.bmrb.co.uk>

Rob V wrote:
> Has Anyone got a way to block or detect a forged From: address.
> I am getting spam sent to us with forged From (they are putting that
> the mail is from someone at our domain)
> Since we do not scan our own domain these messages are getting in no
> problem. Any help or suggested would be appreciated.

You should not whitelist your own domains by their domain name, instead you should whitelist trusted internal servers by IP, or your IP address blocks.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From steve.douglas at SBIINCORPORATED.COM  Wed Jul 16 15:10:28 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:18:58 2006
Subject: Block whole address
Message-ID: <3963522F0E71474CB14C0FF54A6914F7011151ED@mail.gardenbotanika.com>

Awesome.  Never thought of that.  Thanks for the suggestion!



SD

:-)



-----Original Message-----
From: Spicer, Kevin [mailto:Kevin.Spicer@BMRB.CO.UK]
Sent: Wednesday, July 16, 2003 8:05 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Block whole address



You're probably better off doing that at the MTA (e.g. in sendmail's access
database).

-----Original Message-----
From: Steve Douglas [mailto:steve.douglas@SBIINCORPORATED.COM]
Sent: 16 July 2003 13:52
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Block whole address

Is there a way to block an entire address from entering an email server
using MailScanner?












BMRB International
http://www.bmrb.co.uk <http://www.bmrb.co.uk>
+44 (0)20 8566 5000

This message (and any attachment) is intended only for the recipient and may
contain confidential and/or privileged material. If you have received this
in error, please contact the sender and delete this message immediately.
Disclosure, copying or other action taken in respect of this email or in
reliance on it is prohibited. BMRB International Limited accept no liability
in relation to any personal emails, or content of any email which does not
directly relate to our business.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/748710b7/attachment.html
From chris at TRUDEAU.ORG  Wed Jul 16 16:21:53 2003
From: chris at TRUDEAU.ORG (Chris-Personal)
Date: Thu Jan 12 21:18:58 2006
Subject: Fw: Rejected posting to MAILSCANNER@JISCMAIL.AC.UK
Message-ID: <011301c34bad$fd064da0$5702010a@mscore.trusecure.net>

uhhhh....

This is the address i signed up with...did I do something wrong in my
subscription process?

THX
CT

----- Original Message ----- 
From: "L-Soft list server at JISCMAIL (1.8e)" <LISTSERV@JISCMAIL.AC.UK>
To: "Chris Trudeau" <ctrudeau@BELLSOUTH.NET>
Sent: Wednesday, July 16, 2003 9:53 AM
Subject: Rejected posting to MAILSCANNER@JISCMAIL.AC.UK


> You  are  not  authorized to  send  mail  to  the  MAILSCANNER list  from
your
> ctrudeau@BELLSOUTH.NET account.  You might  be authorized to  send to  the
list
> from another of your accounts, or perhaps when using another mail program
which
> generates slightly  different addresses, but  LISTSERV has no way  to
associate
> this other account or address with yours. If you need assistance or if you
have
> any question regarding  the policy of the MAILSCANNER list,  please
contact the
> list owners: MAILSCANNER-request@JISCMAIL.AC.UK.
>
-------------- next part --------------
An embedded message was scrubbed...
From: "Chris-Bellsouth" <ctrudeau@bellsouth.net>
Subject: problems starting
Date: Wed, 16 Jul 2003 09:33:21 -0400
Size: 3755
Url: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/a8b7989d/problemsstarting.eml
From ka at PACIFIC.NET  Wed Jul 16 16:30:21 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
Message-ID: <3F156F8D.20505@pacific.net>

MailScanner only looks at the envelope TO address, so if your mail
server allows messages to have 100 recipients, you have 99 users who
can't control what they perceive to be their own email filtering. :-(

What is the best way to handle this issue?

So far, we've limited the MaxRecipients in sendmail.cf to 10.
Users don't send mail out through our MailScanner boxes, so this works
reasonably well, since less than 1% of incoming mail is actually
addressed to more than 1 user.

Thanks for any ideas,
Ken A.

From mkettler at EVI-INC.COM  Wed Jul 16 16:47:58 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
In-Reply-To: <3F156F8D.20505@pacific.net>
Message-ID: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>

At 08:30 AM 7/16/2003 -0700, Ken Anderson wrote:
>MailScanner only looks at the envelope TO address, so if your mail
>server allows messages to have 100 recipients, you have 99 users who
>can't control what they perceive to be their own email filtering. :-(
>
>What is the best way to handle this issue?
>
>So far, we've limited the MaxRecipients in sendmail.cf to 10.
>Users don't send mail out through our MailScanner boxes, so this works
>reasonably well, since less than 1% of incoming mail is actually
>addressed to more than 1 user.

Unfortunately, since there's only one message at the transport layer, only
one action can be taken. It's either whitelisted or not.

SpamAssassin (a tool used by MailScanner) suffers from the same basic issue
whenever it's called at the transport layer. It looks at the body "To:"
header (along with some others), and must whitelist if any of the addresses
are whitelist addresses.

It's unfortunately impossible to magically make one message into many at
the MTA layer.. It's an inherent drawback.

Of course, you can switch to using tools that scan at the point of delivery
instead of transport, however those wind up scanning a message once per
recipient, instead of once, which increases overhead. It's kind of a
trade-off between flexibility and efficiency.

(Those who call SA from the MDA can force per-user preference files by
using spamc -u with the name of the actual recipient.)

From Steve at swaney.com  Wed Jul 16 17:09:27 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
In-Reply-To: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
Message-ID: <1058371767.22504.9.camel@speedy>

What about a MailScanner option that passes delivery of messages to
multiple to a recipients to another program, i.e. procmail?

Steve
Steve Swaney
Steve@Swaney.com

 On Wed, 2003-07-16 at 11:47, Matt Kettler wrote:

> At 08:30 AM 7/16/2003 -0700, Ken Anderson wrote:
> >MailScanner only looks at the envelope TO address, so if your mail
> >server allows messages to have 100 recipients, you have 99 users who
> >can't control what they perceive to be their own email filtering. :-(
> >
> >What is the best way to handle this issue?
> >
> >So far, we've limited the MaxRecipients in sendmail.cf to 10.
> >Users don't send mail out through our MailScanner boxes, so this works
> >reasonably well, since less than 1% of incoming mail is actually
> >addressed to more than 1 user.
>
> Unfortunately, since there's only one message at the transport layer, only
> one action can be taken. It's either whitelisted or not.
>
> SpamAssassin (a tool used by MailScanner) suffers from the same basic issue
> whenever it's called at the transport layer. It looks at the body "To:"
> header (along with some others), and must whitelist if any of the addresses
> are whitelist addresses.
>
> It's unfortunately impossible to magically make one message into many at
> the MTA layer.. It's an inherent drawback.
>
> Of course, you can switch to using tools that scan at the point of delivery
> instead of transport, however those wind up scanning a message once per
> recipient, instead of once, which increases overhead. It's kind of a
> trade-off between flexibility and efficiency.
>
> (Those who call SA from the MDA can force per-user preference files by
> using spamc -u with the name of the actual recipient.)


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/7c5f3dd1/attachment.html
From robbyv at DISASTER.COM  Wed Jul 16 17:12:11 2003
From: robbyv at DISASTER.COM (Rob V)
Date: Thu Jan 12 21:18:58 2006
Subject: forged From:
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF73F@pascal.priv.bmrb.co .uk>
Message-ID: <5.2.1.1.2.20030716121105.01e8a498@mailhost.disaster.com>

Can I add that in my scan.rules ?
like
From:           192.168.198.    no

will that no scan all of 192.168.198
or do I have to add it differently ?



At 03:08 PM 7/16/2003 +0100, you wrote:
>Rob V wrote:
> > Has Anyone got a way to block or detect a forged From: address.
> > I am getting spam sent to us with forged From (they are putting that
> > the mail is from someone at our domain)
> > Since we do not scan our own domain these messages are getting in no
> > problem. Any help or suggested would be appreciated.
>
>You should not whitelist your own domains by their domain name, instead
>you should whitelist trusted internal servers by IP, or your IP address blocks.
>
>
>
>BMRB International
>http://www.bmrb.co.uk
>+44 (0)20 8566 5000
>_________________________________________________________________
>This message (and any attachment) is intended only for the
>recipient and may contain confidential and/or privileged
>material.  If you have received this in error, please contact the
>sender and delete this message immediately.  Disclosure, copying
>or other action taken in respect of this email or in
>reliance on it is prohibited.  BMRB International Limited
>accepts no liability in relation to any personal emails, or
>content of any email which does not directly relate to our
>business.

Rob Vicchiullo
robv@disaster.com
http://www.disaster.com
(518) 218-0900

From richard_cipher at YAHOO.COM  Wed Jul 16 17:23:58 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
In-Reply-To: <3F156F8D.20505@pacific.net>
Message-ID: <NHBBIDLEJBNNEMOPKJPNKELEDBAA.richard_cipher@yahoo.com>

To me this sounds more like the job of the MTA(Sendmail or Exim, for
example) or the MDA(procmail), since only one is received, but 100 are
delivered.  I don't know much about other MTA's, but Sendmail can do
filtering through changes to sendmail.cf and its access file(aptly named
access), and procmail through .procmailrc.

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Ken Anderson
Sent: Wednesday, July 16, 2003 9:30 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: mailscanner only sees the envelope TO


MailScanner only looks at the envelope TO address, so if your mail
server allows messages to have 100 recipients, you have 99 users who
can't control what they perceive to be their own email filtering. :-(

What is the best way to handle this issue?

So far, we've limited the MaxRecipients in sendmail.cf to 10.
Users don't send mail out through our MailScanner boxes, so this works
reasonably well, since less than 1% of incoming mail is actually
addressed to more than 1 user.

Thanks for any ideas,
Ken A.
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From kevins at BMRB.CO.UK  Wed Jul 16 17:49:19 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:58 2006
Subject: forged From:
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E63@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E63@pascal.priv.bmrb.co.uk>
Message-ID: <1058374162.8235.0.camel@bach.kevinspicer.co.uk>

On Wed, 2003-07-16 at 17:12, Rob V wrote:

Can I add that in my scan.rules ?
like
From:           192.168.198.    no

will that no scan all of 192.168.198

That should work fine.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From ka at PACIFIC.NET  Wed Jul 16 17:56:27 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
In-Reply-To: <1058371767.22504.9.camel@speedy>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
            <1058371767.22504.9.camel@speedy>
Message-ID: <3F1583BB.3090606@pacific.net>

I've looked at options for using a pop3 proxy with SA, but there's
nothing very mature in this area yet. See Prometo project at sourceforge
if you are interested.

But, I'd like to stay with MS because of it's additional capabilities,
and do this with per user configs for virtual users (no accounts on the
system means no procmail or spamc -u).

I've also wondered about forcing sendmail to break apart a message by
putting another mailserver out front that accepted up to 20 recipients
per message, but did no filtering. It would just relay to the MS boxes
that would only accept 1 recip per message. Wouldn't the sending
mailserver break the messages up into bits for you, or am I
misunderstanding mail delivery?

from sendmail.org: MaxRecipientsPerMessage - If set, allow no more than
the specified number of recipients in an SMTP envelope. Further
recipients receive a 452 error code (i.e., they are deferred for the
next delivery attempt).

Thanks,
Ken A.


Stephen Swaney wrote:

> What about a MailScanner option that passes delivery of messages to
> multiple to a recipients to another program, i.e. procmail?
>
> Steve
> Steve Swaney
> Steve@Swaney.com
>
>  On Wed, 2003-07-16 at 11:47, Matt Kettler wrote:
>
>
>>At 08:30 AM 7/16/2003 -0700, Ken Anderson wrote:
>>
>>>MailScanner only looks at the envelope TO address, so if your mail
>>>server allows messages to have 100 recipients, you have 99 users who
>>>can't control what they perceive to be their own email filtering. :-(
>>>
>>>What is the best way to handle this issue?
>>>
>>>So far, we've limited the MaxRecipients in sendmail.cf to 10.
>>>Users don't send mail out through our MailScanner boxes, so this works
>>>reasonably well, since less than 1% of incoming mail is actually
>>>addressed to more than 1 user.
>>
>>Unfortunately, since there's only one message at the transport layer, only
>>one action can be taken. It's either whitelisted or not.
>>
>>SpamAssassin (a tool used by MailScanner) suffers from the same basic issue
>>whenever it's called at the transport layer. It looks at the body "To:"
>>header (along with some others), and must whitelist if any of the addresses
>>are whitelist addresses.
>>
>>It's unfortunately impossible to magically make one message into many at
>>the MTA layer.. It's an inherent drawback.
>>
>>Of course, you can switch to using tools that scan at the point of delivery
>>instead of transport, however those wind up scanning a message once per
>>recipient, instead of once, which increases overhead. It's kind of a
>>trade-off between flexibility and efficiency.
>>
>>(Those who call SA from the MDA can force per-user preference files by
>>using spamc -u with the name of the actual recipient.)
>
>
>
>

From mkettler at EVI-INC.COM  Wed Jul 16 18:48:16 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
In-Reply-To: <1058371767.22504.9.camel@speedy>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
Message-ID: <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>

At 12:09 PM 7/16/2003 -0400, Stephen Swaney wrote:
>What about a MailScanner option that passes delivery of messages to
>multiple to a recipients to another program, i.e. procmail?
>
>Steve

At that point, why use spam-scanning via MailScanner at all? Why not just
use procmail to call SA for everything?.

By passing a subset of the messages to procmail, you've lost any benefits
of using MS to call SA.

From mkettler at EVI-INC.COM  Wed Jul 16 18:57:32 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:58 2006
Subject: Eicar signature in the subject line
In-Reply-To: <3F14ADFC.8020103@hpi.com>
References: <5.2.1.1.0.20030715162735.01b80ea8@xanadu.evi-inc.com>
            <5.2.1.1.0.20030715162735.01b80ea8@xanadu.evi-inc.com>
Message-ID: <5.2.1.1.0.20030716135527.01e511a8@xanadu.evi-inc.com>

At 09:44 PM 7/15/2003 -0400, you wrote:
>Are you trying to say that by design the Subject line is excluded from
>being scanned?


I'm trying to ponder why on earth would the subject line would ever be
scanned for viruses at all.

Client exploits maybe, but viruses, I don't see the point.

From Steve at swaney.com  Wed Jul 16 19:00:47 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
In-Reply-To: <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
            <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>
Message-ID: <1058378447.22259.19.camel@speedy>

On Wed, 2003-07-16 at 13:48, Matt Kettler wrote:

> At 12:09 PM 7/16/2003 -0400, Stephen Swaney wrote:
> >What about a MailScanner option that passes delivery of messages to
> >multiple to a recipients to another program, i.e. procmail?
> >
> >Steve
>
> At that point, why use spam-scanning via MailScanner at all? Why not just
> use procmail to call SA for everything?.
>

Absolutely right and silly of me not to think of it.

> By passing a subset of the messages to procmail, you've lost any benefits
> of using MS to call SA.

Right again and that is the way I used to use SpamAssassin. Don't want
to go there again!

Am I right in thinking that a message to multiple recipients is not
"split into separate messages" until until the local delivery agent is
called? If so, might it be possible to write another delivery agent that
is only called if the message has multiple recipients. This new delivery
agent would simply deliver the individual (split) messages to the
incoming MailScanner directory.

Steve
Steve@Swaney.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/9cea3d4a/attachment.html
From billa at STERLING.NET  Wed Jul 16 20:36:33 2003
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:18:58 2006
Subject: Whitelist via DNSBL
Message-ID: <015701c34bd1$903c8800$0a010a0a@dirt>

Does mailscanner have the ability to use a whitelist via a DNSBL / DNS
Query.  I am looking at implementing TCATS whitelist which is a DNS Query.
Thanks.

From kl571 at YAHOO.COM  Wed Jul 16 20:40:47 2003
From: kl571 at YAHOO.COM (Kenny Liu)
Date: Thu Jan 12 21:18:58 2006
Subject: bayes_journal file size
Message-ID: <20030716194047.91859.qmail@web41303.mail.yahoo.com>

- Solaris 8
- MailScanner-4.21-9
- Perl 5.8
- Sendmail 8.12.9
- Spamassassin 2.55

I've been running mailscanner on our mail gateway for
about 9 days and have been pleased with its
functionality.  The mail gateway handles about 15K
incoming email of which 33% appear to be spam.  I
wanted to know how I can safely control the size of
the bayes_journal file in the /.spamassassin
directory.  It just seems to grow and grow.  Is there
a setting that I can adjust to put a cap on this
bayes_journal file?

bash-2.03# ls -l
total 279852
-rw-------   1 root     other    140768200 Jul 16
15:23 bayes_journal
-rw-------   1 root     other       3419 Jul 16 15:23
bayes_msgcount
-rw-------   1 root     root      335872 Jul 16 15:20
bayes_seen
-rw-------   1 root     root     2605056 Jul 16 15:20
bayes_toks
-rw-r--r--   1 root     other       1218 Jul  8 15:24
user_prefs

Thanks,
Ken

__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com

From kevins at BMRB.CO.UK  Wed Jul 16 21:16:16 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:58 2006
Subject: bayes_journal file size
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E6B@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E6B@pascal.priv.bmrb.co.uk>
Message-ID: <1058386576.8235.13.camel@bach.kevinspicer.co.uk>

>Is there
>a setting that I can adjust to put a cap on this
>bayes_journal file?

You should run   sa-learn --rebuild    periodically.

The other largish file is the bayes_toks file which will initially tend
to grow quite quickly, as the Bayes engine learns new tokens.  Over time
this rate of growth will slow, and IIRC tokens which have not been used
for a while are removed (not sure on that).





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From tyler at BELOIT.EDU  Wed Jul 16 21:34:32 2003
From: tyler at BELOIT.EDU (Tim Tyler)
Date: Thu Jan 12 21:18:58 2006
Subject: Sophos issue?
Message-ID: <5.2.0.9.0.20030716145443.01714b78@beloit.edu>

I am in the process of trying to upgrade from mailscanner 2.6 to the latest
4.x version.  I am a bit confused in the virus configuration section.  We
use Sophos.  I believe its simply the Sophossavi license since we only use
it for email purposes.  I have sophos installed in /usr/local/sav with the
sweep binary in /usr/local/bin and the libraries in /usr/local/lib.  I
noticed there is a install.sophos script in mailscanner/bin.  I presume
that is for the full sophos package and not sophos savi, correct?   The old
configuration used to have a direct path for the sweep binary.  How do I
make sure that it can find the sweep binary now?
Note:
If I use sophossavi, it doesn't process the messages.  I get the following
errors in syslog:
Jul 16 15:07:37 backt MailScanner[27962]: MailScanner E-Mail Virus Scanner
version 4.22-5 starting...
Jul 16 15:07:46 backt root: Process did not exit cleanly, returned 2 with
signal 0

Somehow, I don't think its finding the sophos binary, "sweep".

Note: the spam side with spamassassin seems to be working fine.



Tim Tyler
Network Engineer - Beloit College
tyler@beloit.edu

From Steve at swaney.com  Wed Jul 16 21:59:52 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:58 2006
Subject: Sophos issue?
In-Reply-To: <5.2.0.9.0.20030716145443.01714b78@beloit.edu>
References: <5.2.0.9.0.20030716145443.01714b78@beloit.edu>
Message-ID: <1058389192.22506.36.camel@speedy>

Tim,

This has been covered before but I'll check the FAQ and add it if it's
missing.

Julian has well scripted the Sophos installation and you need to use his
scripts:

cd to wherever you un-tarred the Sophos files:

cd <somewhere>/sav-install tehn run

        /usr/sbin/Sophos.install

This script does it all!

Then make sure that the SAVI-Perl module is correctly installed:

        http://www.sng.ecs.soton.ac.uk/mailscanner/install/SAVI.shtml


Then change your MailScanner.conf file:

        Virus Scanners = sophossavi


The update_virus scanners script will also be installed by the new
MailScanner

Note there is no need to run spamd with this setup.

Steve
Steve@Swaney.com

On Wed, 2003-07-16 at 16:34, Tim Tyler wrote:

> I am in the process of trying to upgrade from mailscanner 2.6 to the latest
> 4.x version.  I am a bit confused in the virus configuration section.  We
> use Sophos.  I believe its simply the Sophossavi license since we only use
> it for email purposes.  I have sophos installed in /usr/local/sav with the
> sweep binary in /usr/local/bin and the libraries in /usr/local/lib.  I
> noticed there is a install.sophos script in mailscanner/bin.  I presume
> that is for the full sophos package and not sophos savi, correct?   The old
> configuration used to have a direct path for the sweep binary.  How do I
> make sure that it can find the sweep binary now?
> Note:
> If I use sophossavi, it doesn't process the messages.  I get the following
> errors in syslog:
> Jul 16 15:07:37 backt MailScanner[27962]: MailScanner E-Mail Virus Scanner
> version 4.22-5 starting...
> Jul 16 15:07:46 backt root: Process did not exit cleanly, returned 2 with
> signal 0
>
> Somehow, I don't think its finding the sophos binary, "sweep".
>
> Note: the spam side with spamassassin seems to be working fine.
>
>
>
> Tim Tyler
> Network Engineer - Beloit College
> tyler@beloit.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/2c5a15d9/attachment.html
From ka at PACIFIC.NET  Wed Jul 16 22:50:51 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
In-Reply-To: <1058378447.22259.19.camel@speedy>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>           
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>           
            <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>
            <1058378447.22259.19.camel@speedy>
Message-ID: <3F15C8BB.5030003@pacific.net>

Stephen Swaney wrote:

> On Wed, 2003-07-16 at 13:48, Matt Kettler wrote:
>
>
>>At 12:09 PM 7/16/2003 -0400, Stephen Swaney wrote:
>>
>>>What about a MailScanner option that passes delivery of messages to
>>>multiple to a recipients to another program, i.e. procmail?
>>>
>>>Steve
>>
>>At that point, why use spam-scanning via MailScanner at all? Why not just
>>use procmail to call SA for everything?.
>>
>
>
> Absolutely right and silly of me not to think of it.
>
>
>>By passing a subset of the messages to procmail, you've lost any benefits
>>of using MS to call SA.
>
>
> Right again and that is the way I used to use SpamAssassin. Don't want
> to go there again!
>
> Am I right in thinking that a message to multiple recipients is not
> "split into separate messages" until until the local delivery agent is
> called? If so, might it be possible to write another delivery agent that
> is only called if the message has multiple recipients. This new delivery
> agent would simply deliver the individual (split) messages to the
> incoming MailScanner directory.

This seems ideal. If sendmail could be made to put all messages in the
incoming MS queue if they have 1 recipient, and all messages with > 1
recipient in another queue. Then you could use perl/other mail tools to
split/clone the messages with >1 recip and then move them back to the MS
incoming queue.

Another option:

Looking at sendmail/TUNING:
------ snip ---------

Before 8.12 sendmail delivers an e-mail sequentially to all its
recipients. For mailing lists or large aliases the overall delivery
time can be substantial... Some mailing list software therefore "split"
up e-mails into smaller pieces with fewer recipients. Sendmail 8.12 can
do this itself, either across queue groups or within a queue
directory... The latter is controlled by the 'r=' field of a queue group
declaration.
... So for this queue each envelope will have at most 5 recipients.
You can apply this to the main queue:
QUEUE_GROUP(`mqueue', `P=/var/spool/mqueue, F=f, r=5, R=8, I=2m')dnl

-------- snip ---------

Or QUEUE_GROUP(`mqueue', `P=/var/spool/mqueue, F=f, r=5, R=8, I=2m')dnl
for 1 recip per message.

This could be used to split all messages with multiple recipients into
messages with 1 recipient, right? Mail could then be queued up properly
for MS with 1 recip per message max, so all per-user rules never
affected other users. Anyone tried this?

Thanks,

Ken A.


> Steve
> Steve@Swaney.com
>

From kevins at BMRB.CO.UK  Wed Jul 16 22:49:26 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:58 2006
Subject: Sophos issue?
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E6D@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E6D@pascal.priv.bmrb.co.uk>
Message-ID: <1058392167.8235.20.camel@bach.kevinspicer.co.uk>

Set the scanner to 'sophos' if you have just installed Sophos - this
will then call the Sweep binary.

If you find that the startup time for sweep is bogging your mail server
down you can install the savi perl module (as described on the
MailScanner website), this is a perl API that allows one to use the
Sophos C libraries without having to run sweep.  Under this circumstance
you should change virus scanners to sophossavi.

The Sophos C libraries come with the command line scanner and there is n
additional license, although you do have to install the perl module
(which is not distributed by Sophos themselves).

Unless you have performance issues its easier to stick with regular
Sophos.







BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From steve.douglas at SBIINCORPORATED.COM  Wed Jul 16 22:52:04 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:18:58 2006
Subject: False-positives
Message-ID: <3963522F0E71474CB14C0FF54A6914F701115206@mail.gardenbotanika.com>

I have the "SPAM lists to reach high score" setting set to 5.  My server
only gets about 2000 messages a day, yet I have about 100 or so messages
that were originally identified as SPAM.  Is there something I need to do
here?  I have white listed these messages by their network IDs to prevent
this in the future, but the false-positives are reflected as an important
area of concern by my management due the fact alot of this information is
directly tied to the company's revenue.

Any suggestions are appreciated.  Thank you!!!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/8452dec0/attachment.html
From lindsay at pa.net  Wed Jul 16 23:00:17 2003
From: lindsay at pa.net (Lindsay Snider)
Date: Thu Jan 12 21:18:58 2006
Subject: False-positives
In-Reply-To: <3963522F0E71474CB14C0FF54A6914F701115206@mail.gardenbotanika.com>
References: <3963522F0E71474CB14C0FF54A6914F701115206@mail.gardenbotanika.com>
Message-ID: <200307161800.17241.lindsay@pa.net>

On Wednesday 16 July 2003 17:52, you wrote:
> I have the "SPAM lists to reach high score" setting set to 5.  My server

I would suggest picking a larger number then 5.  We have ours set to 7 and see 
little to no false positives.  If you want to be really safe, maybe try 10.

> only gets about 2000 messages a day, yet I have about 100 or so messages
> that were originally identified as SPAM.  Is there something I need to do
> here?  I have white listed these messages by their network IDs to prevent
> this in the future, but the false-positives are reflected as an important
> area of concern by my management due the fact alot of this information is
> directly tied to the company's revenue.
>
> Any suggestions are appreciated.  Thank you!!!


From Steve at swaney.com  Wed Jul 16 23:47:22 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO
In-Reply-To: <3F15C8BB.5030003@pacific.net>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>
            <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>
            <1058378447.22259.19.camel@speedy>   <3F15C8BB.5030003@pacific.net>
Message-ID: <1058395642.22259.60.camel@speedy>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: smiley-3.png
Type: image/png
Size: 819 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030716/1fbe950e/smiley-3.png
From batucker at ICNET.NET  Thu Jul 17 01:04:05 2003
From: batucker at ICNET.NET (Brady A. Tucker)
Date: Thu Jan 12 21:18:58 2006
Subject: A Few Messages are 'whitelisted' even with auto-whitelist off
In-Reply-To: <1058337183.15737.6.camel@bach.kevinspicer.co.uk>
Message-ID: <ILEGLLEHLGEPGCEHMOKNOEBGHAAD.batucker@icnet.net>

Kevin,

I have not whitelisted my own domains/virtual domains in their entirety..
only those individual users (gluttons) that wish to receive their full and
unfiltered share of SPAM,  and a few mailing lists.

However,  I did in fact  find a resolutions for what was causing it,  I had
'FROM:' whitelisted my own address at some point for some reason,  so when
the return/to address was faked with my own, and whitelisted address,  it
was of course accepted/delivered as whitelisted.  Thanks for helping to
point this out in a round-about way.

I had completely forgotten that I had whitelisted my own address,  I have NO
idea why I did this, so perhaps this will help the other people having
difficulties with this as well.

                                      Brady A. Tucker
                                      Internet Complete! inc.
                                      http://www.icnet.net

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Kevin Spicer
Sent: Wednesday, July 16, 2003 1:33 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: A Few Messages are 'whitelisted' even with auto-whitelist
off


On Wed, 2003-07-16 at 04:38, Brady A. Tucker wrote:

>I have some messages getting through that say they are whitelisted,
>though
>they are not.    I'm not sure when this started as I'm just now looking
>for

Have you whitlisted you own domains (by name)? - many spammers use your
own address as the envelope from address (this doesn't appear in the
headers, but may be in your maillog).  Note that the whitelist in the
header you posted is a MailScanner whitelist (spam.whitelist.rules) not
a SpamAssassin whitelist (which would give it a negative score).  If you
have whitelisted your domains by name change spam.whitelist.rules to
whitelist your domain's mail servers by IP instead (alternativly
whitelist your entire IP range if thats easier).




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From m.sapsed at BANGOR.AC.UK  Thu Jul 17 09:16:00 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:58 2006
Subject: False-positives
References: <3963522F0E71474CB14C0FF54A6914F701115206@mail.gardenbotanika.com>
Message-ID: <3F165B40.30607@bangor.ac.uk>

Steve Douglas wrote:
> I have the "SPAM lists to reach high score" setting set to 5.  My server
> only gets about 2000 messages a day, yet I have about 100 or so messages
> that were originally identified as SPAM.  Is there something I need to
> do here?  I have white listed these messages by their network IDs to
> prevent this in the future, but the false-positives are reflected as an
> important area of concern by my management due the fact alot of this
> information is directly tied to the company's revenue.

If I understand you correctly, 100 or so out of 2000 messages per day
are marked as spam when they shouldn't be?

You haven't said which version of SpamAssassin you're using - that has a
big effect on the scores you get. If you look at the SpamCheck header
and there's a high-value category listed consistently among the wrongly-
marked messages you could lower that score in
MailScanner/etc/spam.assassin.prefs.conf perhaps?

If your correctly marked spam is consistently coming in with higher
scores, then just raise the threshold.

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From mdunder at GE.UCL.AC.UK  Thu Jul 17 09:21:10 2003
From: mdunder at GE.UCL.AC.UK (Mike Dunderdale)
Date: Thu Jan 12 21:18:58 2006
Subject: Block whole address
In-Reply-To: <MMEBKBBDEGGFLDBJHPGEKEJGCBAA.smohan@vsnl.com>
References: <MMEBKBBDEGGFLDBJHPGEKEJGCBAA.smohan@vsnl.com>
Message-ID: <Pine.GSO.4.53.0307170914270.26398@apollo.ge.ucl.ac.uk>

If you're going to do the access thing, I suggest the following:

have a set of lines allowing your domain and connecting mail servers to
connect

connect:your.mail.servers             RELAY
connect:127.0.0.1                       RELAY
connect:your.domain.IP                       RELAY
connect:your.transferring.mail.server             RELAY

Add a line allowing abuse@yourdomain.com through even from spammers

To:abuse@       SPAMFRIEND

Add locally allowed email addresses:

From:im@notaspammer.com   OK

And then add the domains/spammers to be dropped:


From:spamdomain.com ERROR:"550 SPAM suspected. Falsely accused should  \
email abuse@yourdomains.com"


Hope this helps.

M


On Fri, 18 Jul 2003, S Mohan wrote:

> If you are using sendmail, use the access feature to block the address.
> /etc/mail/access file needs to be edited and the address followed by reject
> or drop in capitals should be given in a line.
>
> Mohan
>   -----Original Message-----
>   From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Steve Douglas
>   Sent: Wednesday, July 16, 2003 6:22 PM
>   To: MAILSCANNER@JISCMAIL.AC.UK
>   Subject: Block whole address
>
>
>   Is there a way to block an entire address from entering an email server
> using MailScanner?
>
>
>
>
>
>
>
>
>
>

-------------------------------------------------------------------------
           Mike Dunderdale                |  tel: ++44 20 7679 2756
IT Systems Manager, Geomatic Engineering  |  fax: ++44 20 7380 0453
     mike.dunderdale@ge.ucl.ac.uk         |  mob: ++44 7939 455 245

From m.sapsed at BANGOR.AC.UK  Thu Jul 17 09:22:39 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:18:58 2006
Subject: Sophos issue?
References: <5C0296D26910694BB9A9BBFC577E7AB001175E6D@pascal.priv.bmrb.co.uk>
            <1058392167.8235.20.camel@bach.kevinspicer.co.uk>
Message-ID: <3F165CCF.2080307@bangor.ac.uk>

Kevin Spicer wrote:
> Set the scanner to 'sophos' if you have just installed Sophos - this
> will then call the Sweep binary.
>
> If you find that the startup time for sweep is bogging your mail server
> down you can install the savi perl module (as described on the
> MailScanner website), this is a perl API that allows one to use the
> Sophos C libraries without having to run sweep.  Under this circumstance
> you should change virus scanners to sophossavi.
>
> The Sophos C libraries come with the command line scanner and there is n
> additional license, although you do have to install the perl module
> (which is not distributed by Sophos themselves).
>
> Unless you have performance issues its easier to stick with regular
> Sophos.

The only thing I'd add to Kevin's answer is that you should use the
supplied Sophos.install script to do the install in the way MailScanner
likes it. (I confess that I alter the script slightly because I wanted
intercheck available but that's just me!)

If you want to use the command line scanner to check something then call
sweep via the sophos-wrapper rather than directly.

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From dean.plant at ROKE.CO.UK  Thu Jul 17 10:02:53 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:18:58 2006
Subject: forged From:
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A702366FA@rsys004a.roke.co.uk>

Instead of whitelisting, would it be better to use a ruleset for enabling spamchecks only for your domain? Then a forged From: would not be missed.

ie.
Spam Checks = /etc/MailScanner/rules/spam.check.rules

To:      *@your.domain.com   yes
FromOrTo:    default    no

Dean Plant

-----Original Message-----
From: Spicer, Kevin [mailto:Kevin.Spicer@BMRB.CO.UK]
Sent: 16 July 2003 15:08
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: forged From:


Rob V wrote:
> Has Anyone got a way to block or detect a forged From: address.
> I am getting spam sent to us with forged From (they are putting that
> the mail is from someone at our domain)
> Since we do not scan our own domain these messages are getting in no
> problem. Any help or suggested would be appreciated.

You should not whitelist your own domains by their domain name, instead you should whitelist trusted internal servers by IP, or your IP address blocks.



BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

From Steve at swaney.com  Thu Jul 17 12:43:31 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:58 2006
Subject: White-Black-listing Email to multiple recipients
In-Reply-To: <MMEBKBBDEGGFLDBJHPGEGEJICBAA.smohan@vsnl.com>
References: <MMEBKBBDEGGFLDBJHPGEGEJICBAA.smohan@vsnl.com>
Message-ID: <1058442210.22498.106.camel@speedy>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 819 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/c3522bb6/attachment.png
From mailscannerlist at TNJINFL.COM  Thu Jul 17 13:49:41 2003
From: mailscannerlist at TNJINFL.COM (James Pifer)
Date: Thu Jan 12 21:18:58 2006
Subject: MailScanner/Sendmail + Mailman?
Message-ID: <1058446180.18388.26.camel@tweety.tnjinfl.com>

Anyone running Mailman on the same server that is running MailScanner
with Sendmail?

The Mailman readme wants you to configure the sendmail.cf and make some
changes. I don't want to mess up my functioning MailScanner server.

Anyone doing this? Anyone have any suggestions for making Mailman work
in this situation? Right now it doesn't seem to deliver mail.

Thanks,
James

From Steve at swaney.com  Thu Jul 17 13:55:49 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:58 2006
Subject: MailScanner/Sendmail + Mailman?
In-Reply-To: <1058446180.18388.26.camel@tweety.tnjinfl.com>
References: <1058446180.18388.26.camel@tweety.tnjinfl.com>
Message-ID: <1058446549.1570.7.camel@speedy>

I'm running Mailman on two systems, Red Hat 7 and red Hat 8, that are
also running MailScanner and SpamAssassin. Quite nice because my lists
get NO spam.

No Problems.

Steve
Steve@Swaney.com


On Thu, 2003-07-17 at 08:49, James Pifer wrote:

> Anyone running Mailman on the same server that is running MailScanner
> with Sendmail?
>
> The Mailman readme wants you to configure the sendmail.cf and make some
> changes. I don't want to mess up my functioning MailScanner server.
>
> Anyone doing this? Anyone have any suggestions for making Mailman work
> in this situation? Right now it doesn't seem to deliver mail.
>
> Thanks,
> James
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/5bb4707a/attachment.html
From David.While at UCE.AC.UK  Thu Jul 17 13:52:53 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:18:58 2006
Subject: MailScanner/Sendmail + Mailman?
Message-ID: <107DE25EC0216C45AEF670016024245F6EFA@exchangea.staff.uce.ac.uk>

Yep - I am running Mailman on the same server as sendmail and
MailScanner and have no problems.

The only changes I made were to the sendmail alias files to provide the
mailman aliases. This has no effect on MailScanner.

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------


-----Original Message-----
From: James Pifer [mailto:mailscannerlist@TNJINFL.COM]
Sent: 17 July 2003 13:50
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner/Sendmail + Mailman?


Anyone running Mailman on the same server that is running MailScanner
with Sendmail?

The Mailman readme wants you to configure the sendmail.cf and make some
changes. I don't want to mess up my functioning MailScanner server.

Anyone doing this? Anyone have any suggestions for making Mailman work
in this situation? Right now it doesn't seem to deliver mail.

Thanks,
James


From mdlaney at morehouse.edu  Thu Jul 17 14:00:06 2003
From: mdlaney at morehouse.edu (Matt Laney)
Date: Thu Jan 12 21:18:58 2006
Subject: MailScanner/Sendmail + Mailman?
In-Reply-To: <1058446180.18388.26.camel@tweety.tnjinfl.com> from "James Pifer"
              at Jul 17, 2003 08:49:41 AM
Message-ID: <200307171300.JAA31594@earl.morehouse.edu>

> Anyone running Mailman on the same server that is running MailScanner
> with Sendmail?

Yep:  MailScanner 4.22-5, sendmail 8.12.something, GNU Mailman
2.0.something.  Works great.


> The Mailman readme wants you to configure the sendmail.cf and make some
> changes. I don't want to mess up my functioning MailScanner server.

I ran through the Mailman docs just now and didn't see any required
changes to sendmail.cf, rather a couple aliases to enter and a smrsh
change ( cd /usr/adm/sm.bin && ln -s /home/mailman/mail/wrapper . ).

What did it ask you to do?  (Perhaps I have an old version that doesn't
require whatever this is.)


> Right now it doesn't seem to deliver mail.

Can you tell from your sendmail logs or from the mailman data/ and qfiles/
and logs/ directories how far along the delivery process is going?
Is the mail getting to mailman?  If so, is it being sent out (by the
cron job, qrunner, I believe)?


-Matt


--
Matt Laney, mdlaney@morehouse.edu
Network and Unix Systems Engineer
Morehouse College --- Atlanta, GA

From wmcdonald at ORCTEL.CO.UK  Thu Jul 17 14:09:42 2003
From: wmcdonald at ORCTEL.CO.UK (Will Mc Donald)
Date: Thu Jan 12 21:18:58 2006
Subject: Restarting the MailScanner process.
Message-ID: <0a1601c34c64$b315d960$cb3ca8c0@orctel.internal>

Guys,

hopefully a quickie here. I've just modified my MailScanner.conf to look at a rule to allow HTML <form> tags FromOrTo just one specific address. 

We're running MailScanner-4.22-4 from the tarball distribution and I just wanted to know what's the quickest, safest way to restart to reread that config? Can I just kill -1 the PPID? Or do I kill the process and its children then run check_mailscanner again? 

Cheers,

Will.


From David.While at UCE.AC.UK  Thu Jul 17 14:09:48 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:18:58 2006
Subject: Restarting the MailScanner process.
Message-ID: <107DE25EC0216C45AEF670016024245F6EFB@exchangea.staff.uce.ac.uk>

If you are running RedHat try 

service MailScanner reload

-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------


-----Original Message-----
From: Will Mc Donald [mailto:wmcdonald@ORCTEL.CO.UK]
Sent: 17 July 2003 14:10
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Restarting the MailScanner process.


Guys,

hopefully a quickie here. I've just modified my MailScanner.conf to look at a rule to allow HTML <form> tags FromOrTo just one specific address. 

We're running MailScanner-4.22-4 from the tarball distribution and I just wanted to know what's the quickest, safest way to restart to reread that config? Can I just kill -1 the PPID? Or do I kill the process and its children then run check_mailscanner again? 

Cheers,

Will.


From zabriskw at ITECH.NET  Thu Jul 17 14:11:41 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:18:58 2006
Subject: Restarting the MailScanner process.
References: <0a1601c34c64$b315d960$cb3ca8c0@orctel.internal>
Message-ID: <000401c34c64$f6dcc550$0c02a8c0@itech.dom>

I have always killed all the processes (kill -9), and then used
check_mailscanner to kick it back off again.


----- Original Message -----
From: "Will Mc Donald" <wmcdonald@ORCTEL.CO.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 17, 2003 9:09 AM
Subject: Restarting the MailScanner process.


> Guys,
>
> hopefully a quickie here. I've just modified my MailScanner.conf to look
at a rule to allow HTML <form> tags FromOrTo just one specific address.
>
> We're running MailScanner-4.22-4 from the tarball distribution and I just
wanted to know what's the quickest, safest way to restart to reread that
config? Can I just kill -1 the PPID? Or do I kill the process and its
children then run check_mailscanner again?
>
> Cheers,
>
> Will.
>
>

From Kevin.Spicer at BMRB.CO.UK  Thu Jul 17 14:16:44 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:58 2006
Subject: Restarting the MailScanner process.
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF74B@pascal.priv.bmrb.co.uk>

When I do service MailScanner reload, I see in the logs...
 
MailScanner child caught a SIGHUP

So I would suggest that sending all the MailScanner processes a SIGHUP should do the job.




BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From wmcdonald at ORCTEL.CO.UK  Thu Jul 17 14:18:28 2003
From: wmcdonald at ORCTEL.CO.UK (Will Mc Donald)
Date: Thu Jan 12 21:18:58 2006
Subject: Restarting the MailScanner process.
References: <107DE25EC0216C45AEF670016024245F6EFB@exchangea.staff.uce.ac.uk>
Message-ID: <0a5101c34c65$fd1f4a40$cb3ca8c0@orctel.internal>

I think that probably only works for the RPM install since all it does (AFAIA) is:

/etc/rc.d/init.s/$service restart

And there's no $service for MailScanner since it's a tarball install. 

Cheers anyway though.

Will.

----- Original Message ----- 
From: "David While" <David.While@UCE.AC.UK>

> If you are running RedHat try 
> 
> service MailScanner reload
> 
> -----Original Message-----
> From: Will Mc Donald [mailto:wmcdonald@ORCTEL.CO.UK]
>
> I just wanted to know what's the quickest, safest way to restart to reread that config?


From mailscanner at BARENDSE.TO  Thu Jul 17 14:49:45 2003
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:18:58 2006
Subject: DSN: Return receipt ??
In-Reply-To: <20030702153804.GA15524@internetx.de>
Message-ID: <Pine.LNX.4.44.0307171549450.2958@raveon.barendse.to>

I have something which I can't quite figure out:
I use the following to kill all the read/not read messages with sendmail 
through the following lines in sendmail.mc:

LOCAL_RULESETS
F{SSJunk} /etc/mail/ssjunk.txt
F{DiscardSubs} /etc/mail/discardsubs.txt

HSubject: $>Check_Subject

SCheck_Subject
R$* $={SSJunk} $*       $#error $: NMJUNKSUB
R$* NMJUNKSUB $*        $#error $: "553 Rejected"
R$* $={DiscardSubs} $*  $#discard


This is what's in discardsubs.txt
read:
not.read:
gelezen:
niet.gelezen:
le?do:
no.le?do:


Still some read/not read messages are getting through. When I look at the 
copies in normal view in pine the subject line is this:
Subject: Read: FW: Entrega de

which should comply with the sendmail rule to get discarded (but isn't).

I suspect this maybe because of M$ Exchange doing something funny with the 
read receipt messages (they are generated by Exchange, not Outlook 
according to the signature of the message). When doing full header view 
the subject looks like this:
Subject: =?iso-8859-1?Q?Read=3A_FW=3A_Entrega_de

If the funny subject is indeed the problem is there any way to filter 
these weird messages out too??

The option in the message below (goaway) doesn't do anything in my case, I 
think sendmail will refuse to send out DSN messages but all the users are 
connected to an Exchange server and the behaviour of Exchange is not 
affected by this option (apparently the mails themselves aren't cleaned of 
any DSN parts either).

Any help greatly appreciated!

Remco



On Wed, 2 Jul 2003, Sebastian Wiesinger wrote:

> * Remco Barendse <mailscanner@BARENDSE.TO> [2003-07-02 16:15]:
> > In the maillog I noticed a remark about a DSN: Return receipt.
> >
> > What does the line from maillog mean? Any return receipt did not appear in
> > the mailbox for archived outgoing mail.
> 
> If a user adds a "Return-Receipt-To: <mail@address>" header to his/her
> mail, sendmail will deliver an receipt upon successful delivery of the
> mail. You can deactivate this feature with the following option in
> your sendmail.mc:
> 
> define(`confPRIVACY_FLAGS', `noreceipts')dnl
> 
> >From the sendmail operation guide:
> #v+
> public         Allow open access
> needmailhelo   Insist on HELO or EHLO command before MAIL
> needexpnhelo   Insist on HELO or EHLO command before EXPN
> noexpn         Disallow EXPN entirely, implies noverb.
> needvrfyhelo   Insist on HELO or EHLO command before VRFY
> novrfy         Disallow VRFY entirely
> noetrn         Disallow ETRN entirely
> noverb         Disallow VERB entirely
> restrictmailq  Restrict mailq command
> restrictqrun   Restrict -q command line flag
> restrictexpand Restrict -bv and -v command line flags
> noreceipts     Don't return success DSNs20
> nobodyreturn   Don't return the body of a message with DSNs
> goaway         Disallow essentially all SMTP status queries
> authwarnings   Put X-Authentication-Warning: headers in messages
>                and log warnings
> #v-
> 
> I prefer the following line:
> 
> define(`confPRIVACY_FLAGS', `goaway,noreceipts,restrictqrun,restrictexpand')dnl
> 
> > I use sendmail rules to discard read receipt messages but in this case
> > there is nothing in the maillog that this message or reply was discarded.
> 
> I don't know what rules you use for discarding, but the configuration
> option above is the right way to deactivate the DSN2.x.x messages.
> 
> For more info about the privacy options, see the sendmail installation
> and operation guide (op/op.txt.gz).
> 
> --
> InterNetX GmbH
> Sebastian Wiesinger
> System Administration
> 
> eMail: sw@internetx.de
> 


From mailscannerlist at TNJINFL.COM  Thu Jul 17 15:05:02 2003
From: mailscannerlist at TNJINFL.COM (James Pifer)
Date: Thu Jan 12 21:18:58 2006
Subject: MailScanner/Sendmail + Mailman?
In-Reply-To: <200307171300.JAA31594@earl.morehouse.edu>
References: <200307171300.JAA31594@earl.morehouse.edu>
Message-ID: <1058450701.18388.39.camel@tweety.tnjinfl.com>

Well, first I tried the Mailman RPM that comes with Redhat and had
trouble with the Admin pages not saving changes. The Mailman list said
to uninstall the RPM and download the newer non-rpm install.

The README.SENDMAIL says to look at mm-handler.readme, and that's where
it talks about modifying the cf file. I don't think you really need to
after taking another look. One thing it did say you "must" do was to
modify the mailertable and add an entry like(their example):
listtest.uchicago.edu   mailman:listtest.uchicago.edu

Did you have to modify the mailertable?

I looked at the files you suggested and found a few things. Under
data/qfiles there was a file that said I should have some stuff in
/etc/aliases, so I added those entries as it suggested.

I can see what appears to be the outgoing messages stuck in
/qfiles/virgin.

I see nothing in /var/log/messages related to my mailman list.

I didn't see anything about changing the wrapper stuff. Maybe that's
what I'm missing? Honestly not sure I understand what you said here:
smrsh change (cd /usr/adm/sm.bin && ln -s /home/mailman/mail/wrapper. ).
Would I type that line exactly as you show in the ()?

Thanks for your help.
James

On Thu, 2003-07-17 at 09:00, Matt Laney wrote:
> > Anyone running Mailman on the same server that is running MailScanner
> > with Sendmail?
>
> Yep:  MailScanner 4.22-5, sendmail 8.12.something, GNU Mailman
> 2.0.something.  Works great.
>
>
> > The Mailman readme wants you to configure the sendmail.cf and make some
> > changes. I don't want to mess up my functioning MailScanner server.
>
> I ran through the Mailman docs just now and didn't see any required
> changes to sendmail.cf, rather a couple aliases to enter and a smrsh
> change ( cd /usr/adm/sm.bin && ln -s /home/mailman/mail/wrapper . ).
>
> What did it ask you to do?  (Perhaps I have an old version that doesn't
> require whatever this is.)
>
>
> > Right now it doesn't seem to deliver mail.
>
> Can you tell from your sendmail logs or from the mailman data/ and qfiles/
> and logs/ directories how far along the delivery process is going?
> Is the mail getting to mailman?  If so, is it being sent out (by the
> cron job, qrunner, I believe)?
>
>
> -Matt
>
>
> --
> Matt Laney, mdlaney@morehouse.edu
> Network and Unix Systems Engineer
> Morehouse College --- Atlanta, GA

From mdlaney at morehouse.edu  Thu Jul 17 15:30:19 2003
From: mdlaney at morehouse.edu (Matt Laney)
Date: Thu Jan 12 21:18:58 2006
Subject: MailScanner/Sendmail + Mailman?
In-Reply-To: <1058450701.18388.39.camel@tweety.tnjinfl.com> from "James Pifer"
              at Jul 17, 2003 10:05:02 AM
Message-ID: <200307171430.KAA31790@earl.morehouse.edu>

James,

> The README.SENDMAIL says to look at mm-handler.readme...

Ah--that's if you're using mm-handler as your local delivery agent
for mailman.  I'm not, and I happen to know nothing about it.

If you're also not using mm-handler, then the stuff you stuck in the
sendmail aliases file should help.  (Make sure to rebuild that with
'newaliases'.)

> Did you have to modify the mailertable?

No, but I run my list processor on the same domain as the rest of
my stuff.  That is, I didn't add a subdomain just for Mailman.  In
my experience, adding extra mailertable entries for your own domains
doesn't really hurt, so I'd suggest trying it and, if you find later
that something else might have made it work, undo it to see if it's
necessary.


> I can see what appears to be the outgoing messages stuck in
> /qfiles/virgin.

Sounds like the qrunner process isn't running.  Check the Mailman
documentation for some stuff to run from cron periodically.  You
can run it by hand, too, just to see if that's what's causing the
problem.


> I see nothing in /var/log/messages related to my mailman list.

I'd expect mail.log or sendmail.log to be more helpful:  that will show
if the mail was delivered to your Mailman setup or not.  For example:

        Jul 16 08:58:02 mybox sendmail[1242]: h6klaj025495:
        to="|/home/mailman/mail/wrapper post big-list-l",
        ctladdr=<big-list-l@my.com> (51/0), delay=00:00:04,
        xdelay=00:00:01, mailer=prog, pri=120787, dsn=2.0.0, stat=Sent

This is where sendmail dropped a message on Mailman.  If that part is
happening, the problem isn't in the aliases and probably is in Mailman.


> I didn't see anything about changing the wrapper stuff. Maybe that's
> what I'm missing? Honestly not sure I understand what you said here:
> smrsh change (cd /usr/adm/sm.bin && ln -s /home/mailman/mail/wrapper. ).
> Would I type that line exactly as you show in the ()?

Yep.  That's if you're using sendmail's restricted shell (smrsh):  it
needs symlinks in its directory, which might not be the one I mentioned,
before it'll run your wrapper program.  Sendmail will gripe fairly loudly
in the logs if that's not configured right, though.


If this doesn't help, let's take the conversation off the list for a bit
since it's pretty off-topic.  We can come back to present the solution.


-Matt


--
Matt Laney, mdlaney@morehouse.edu
Network and Unix Systems Engineer
Morehouse College --- Atlanta, GA

From mikea at MIKEA.ATH.CX  Thu Jul 17 16:16:16 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
Message-ID: <20030717101616.A80801@mikea.ath.cx>

Is there a way to store ham and spam as mbox files, or just to
concatenate all the ham to one file and all the spam to another?

I know about Non Spam Actions, High Scoring Spam Actions, and Spam
Actions, but these (at least in the MailScanner version I have) just
store to directories in the quarantine subtree, and then only as
queue files.

I'd *love* to be able to store them as mbox files, so that I could
just run mutt against them to see what had been caught overnight, and
it would mean that I didn't have to forward spam to my Lotus Notes
mailbox.

The Lotus Notes admin would be happy about that, too, I can assure
you.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From Kevin.Spicer at BMRB.CO.UK  Thu Jul 17 16:20:15 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF750@pascal.priv.bmrb.co.uk>

> Is there a way to store ham and spam as mbox files, or just to
> concatenate all the ham to one file and all the spam to another?
> 
>

Can't you just use the forward action to forward the mails to a mailbox on the local machine?



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From ka at PACIFIC.NET  Thu Jul 17 16:23:31 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:58 2006
Subject: mailscanner only sees the envelope TO - solved
In-Reply-To: <1058395642.22259.60.camel@speedy>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>           
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>           
            <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>           
            <1058378447.22259.19.camel@speedy>   <3F15C8BB.5030003@pacific.net>
            <1058395642.22259.60.camel@speedy>
Message-ID: <3F16BF73.8020401@pacific.net>

I have incoming sendmail splitting multiple recipient messages into
multiple messages, so MailScanner and SA only see 1 recip per message.

Here's what I did. If any sendmail gurus out there thing this is a bad
idea, please let me know what a mess I've made of things :-)

1) Start the incoming sendmail with a different config file.
Changes to /etc/rc.d/init.d/MailScanner (from rpm install on redhat)
make this change to the incoming sendmail command line:
------ snip -------

  $SENDMAIL -bd -OPrivacyOptions=noetrn \
                       -ODeliveryMode=queueonly \
                       -OQueueDirectory=$INQDIR \
                       -OPidFile=$INPID \
                       -C/etc/mail/sendmail_in.cf

-------- snip --------

2) Make changes to the new sendmail config:
cp /etc/mail/sendmail /etc/mail/sendmail_in.cf

In sendmail_in.cf, add the following:
The comment header "QUEUE GROUP DEFINITIONS" should be there already.
Just add the single line under it.

------- snip --------
############################
# QUEUE GROUP DEFINITIONS  #
############################

Qmqueue, P=/var/spool/mqueue.in, F=f, r=1, R=8, I=2m

------- snip --------


AND, just above the "Ruleset 3" comment header, add the following:
(not sure if both lines are required or not...)

--------- snip --------

# LOCAL_RULESETS
Squeuegroup
R$* @ $*                $# mqueue
R$*                     $# mqueue

############################################
###  Ruleset 3 -- Name Canonicalization  ###
############################################


--------- snip ----------


Restart sendmail, and things like this start showing up in the log when
messages with multiple recipients come in:

Jul 17 08:14:31 host sendmail[7183]: h6HFDop8007183: split: maxrcpts=1,
rcpts=3, count=2, ids=h6HFDop9007183; h6HFDopA007183

So now mailscanner only sees 1 recip per message and rulesets only apply
to the user they are supposed to apply to. Cool, huh?
Thanks for all the suggestions!

Ken A
Pacific.Net



Stephen Swaney wrote:
> Excellent thought. Certainly the MTA is the right place to accomplish
> this if it can do the job. More below.
>
> On Wed, 2003-07-16 at 17:50, Ken Anderson wrote:
>
>
>>Stephen Swaney wrote:
>>
>>
>>>On Wed, 2003-07-16 at 13:48, Matt Kettler wrote:
>>>
>>>
>>>
>>>>At 12:09 PM 7/16/2003 -0400, Stephen Swaney wrote:
>>>>
>>>>
>>>>>What about a MailScanner option that passes delivery of messages to
>>>>>multiple to a recipients to another program, i.e. procmail?
>>>>>
>>>>>Steve
>>>>
>>>>At that point, why use spam-scanning via MailScanner at all? Why not just
>>>>use procmail to call SA for everything?.
>>>>
>>>
>>>
>>>Absolutely right and silly of me not to think of it.
>>>
>>>
>>>
>>>>By passing a subset of the messages to procmail, you've lost any benefits
>>>>of using MS to call SA.
>>>
>>>
>>>Right again and that is the way I used to use SpamAssassin. Don't want
>>>to go there again!
>>>
>>>Am I right in thinking that a message to multiple recipients is not
>>>"split into separate messages" until until the local delivery agent is
>>>called? If so, might it be possible to write another delivery agent that
>>>is only called if the message has multiple recipients. This new delivery
>>>agent would simply deliver the individual (split) messages to the
>>>incoming MailScanner directory.
>>
>>This seems ideal. If sendmail could be made to put all messages in the
>>incoming MS queue if they have 1 recipient, and all messages with > 1
>>recipient in another queue. Then you could use perl/other mail tools to
>>split/clone the messages with >1 recip and then move them back to the MS
>>incoming queue.
>
>
>
>
>>Another option:
>>
>>Looking at sendmail/TUNING:
>>------ snip ---------
>>
>>Before 8.12 sendmail delivers an e-mail sequentially to all its
>>recipients. For mailing lists or large aliases the overall delivery
>>time can be substantial... Some mailing list software therefore "split"
>>up e-mails into smaller pieces with fewer recipients. Sendmail 8.12 can
>>do this itself, either across queue groups or within a queue
>>directory... The latter is controlled by the 'r=' field of a queue group
>>declaration.
>>... So for this queue each envelope will have at most 5 recipients.
>>You can apply this to the main queue:
>>QUEUE_GROUP(`mqueue', `P=/var/spool/mqueue, F=f, r=5, R=8, I=2m')dnl
>>
>
>
> Very good catch. It if nothing else it pointed me to the sendmail tuning
> file :)
>
>
>>-------- snip ---------
>>
>>Or QUEUE_GROUP(`mqueue', `P=/var/spool/mqueue, F=f, r=5, R=8, I=2m')dnl
>>for 1 recip per message.
>>
>
>
> I'm having a hard time finding the documentation for the F=f & I=2m
> flags. Also wouldn't this operate on only emails with more the 5
> recipients (r=5), splitting the message into multiple messages, each
> with 5 recipients? Since I believe "R=" the number of queue runners and
> we wouldn't want any want "real" delivery (just MailScanner) picking up
> the messages, might something like:
>
>
>         QUEUE_GROUP(`multimqueue', `P=/var/spool/mqueue.in, F=f, r=1, R=0')dnl
>
>
> Work? Would this split the messages and leave them where MailScanner
> would normally pick them up?
>
> Since you would want this behavior only of the instance of sendmail that
> that processing incoming mail, that instance of sendmail might best call
> a separate sendmail.cf file.
>
> Any comments or suggestions appreciated.
>
>
>
>>This could be used to split all messages with multiple recipients into
>>messages with 1 recipient, right? Mail could then be queued up properly
>>for MS with 1 recip per message max, so all per-user rules never
>>affected other users. Anyone tried this?
>>
>>Thanks,
>>
>>Ken A.
>>
>>
>>
>>>Steve
>>>Steve@Swaney.com
>>>
>
>

From billa at STERLING.NET  Thu Jul 17 16:23:34 2003
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:18:58 2006
Subject: DNSBL Whitelist
Message-ID: <043101c34c77$6392a540$0a010a0a@dirt>

I asked this question earlier, however from the lack of response, I assume I
posed the question unclearly.

In the MailScanner.conf file there is a section to use blacklist by using
ORDB, MAPS, etc...

# This is the list of spam blacklists (RBLs) which you are using.
# See the "Spam List Definitions" file for more information about what
# you can put here.
# This can also be the filename of a ruleset.
Spam List = ORDB-RBL Infinite-Monkeys # MAPS-RBL+ costs money (except
.ac.uk)

Is there a way to do the same thing, however make the response a whitelist.
There is a service out there called TCATS, that provides a whitelist of good
IP's as well as a black list.  I would like to use the whitelist to reduce
false positives, but have not found a way to integrate it with MailScanner.

Here is the the link to TCATS:

http://www.the-carrot-and-the-stick.com/How_To/index.php?VIEW=direct_query

From andersjk at SOL-INVICTUS.ORG  Thu Jul 17 16:29:17 2003
From: andersjk at SOL-INVICTUS.ORG (Kevin Anderson)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
In-Reply-To: <20030717101616.A80801@mikea.ath.cx>
Message-ID: <Pine.LNX.4.33L2.0307171725550.3462-100000@iktinus.netmanage.de>

on my linux box i create a user spam, installed pine then forward all spam
mail to that, then in the morning sort thru it to see if any real mail was
caught, or for automation use bounce and delete the spam, of course any
NDR's will come back with error messages which is no fun then setup
procmail with this:

:0 B
*Unsolicited commercial email rejected
/dev/null

:0
* ^From.*
! user@domain.com

user@domain.com is then the replacement postmaster.

thanks,
kevin



On Thu, 17 Jul 2003, mikea wrote:

> Is there a way to store ham and spam as mbox files, or just to
> concatenate all the ham to one file and all the spam to another?
>
> I know about Non Spam Actions, High Scoring Spam Actions, and Spam
> Actions, but these (at least in the MailScanner version I have) just
> store to directories in the quarantine subtree, and then only as
> queue files.
>
> I'd *love* to be able to store them as mbox files, so that I could
> just run mutt against them to see what had been caught overnight, and
> it would mean that I didn't have to forward spam to my Lotus Notes
> mailbox.
>
> The Lotus Notes admin would be happy about that, too, I can assure
> you.
>
> --
> Mike Andrews
> mikea@mikea.ath.cx
> Tired old sysadmin since 1964
>

--
@
_____________________________________________
chaos, panic and disorder... my job is done...

From mikea at MIKEA.ATH.CX  Thu Jul 17 16:31:52 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF750@pascal.priv.bmrb.co.uk>;
              from Kevin.Spicer@BMRB.CO.UK on Thu, Jul 17,
              2003 at 04:20:15PM +0100
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF750@pascal.priv.bmrb.co.uk>
Message-ID: <20030717103152.A81002@mikea.ath.cx>

On Thu, Jul 17, 2003 at 04:20:15PM +0100, Spicer, Kevin wrote:
> > Is there a way to store ham and spam as mbox files, or just to
> > concatenate all the ham to one file and all the spam to another?

> Can't you just use the forward action to forward the mails to a mailbox on the local machine?

I'll give it a try.

<later>

Nope.

The "forward" action requires an address of the form something@domain,
and just supplying an address local to the machine without the
"@domain" part fails.

Unfortunately for me, the MX for our "inside" network is a Lotus Notes
server which is set to not relay anywhere. I can't get that changed,
and it is ... well, "unpleasant" is a very short way out along that
axis, and my situation lies considerably farther out.

Any ideas will be enthusiastically examined, and probably will be
given The Old School Try.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From Kevin.Spicer at BMRB.CO.UK  Thu Jul 17 16:36:41 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF751@pascal.priv.bmrb.co.uk>

> <later>
> 
> Nope.
> 
> The "forward" action requires an address of the form something@domain,
> and just supplying an address local to the machine without the
> "@domain" part fails.
> 
You should be able to do yourname@yourmailserver.yourdomain.com, or possibly yourname@localhost. 



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From mikea at MIKEA.ATH.CX  Thu Jul 17 16:47:13 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF751@pascal.priv.bmrb.co.uk>;
              from Kevin.Spicer@BMRB.CO.UK on Thu, Jul 17,
              2003 at 04:36:41PM +0100
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF751@pascal.priv.bmrb.co.uk>
Message-ID: <20030717104713.A81139@mikea.ath.cx>

On Thu, Jul 17, 2003 at 04:36:41PM +0100, Spicer, Kevin wrote:
> > <later>
> >
> > Nope.
> >
> > The "forward" action requires an address of the form something@domain,
> > and just supplying an address local to the machine without the
> > "@domain" part fails.
> >
> You should be able to do yourname@yourmailserver.yourdomain.com, or possibly yourname@localhost.

No; I tried that. The MX won't relay back to this machine, or indeed
to any other machine; stuff goes to the MX (Lotus Notes) and thence
to Dave Null if addressed to the MX.

Decidedly Unpleasant.

I'll plead with the Notes admin, but I really expect to get nowhere
fast.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From denis at IMSLTD.COM  Thu Jul 17 16:40:25 2003
From: denis at IMSLTD.COM (Denis Croombs)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF751@pascal.priv.bmrb.co.uk> 
            <20030717104713.A81139@mikea.ath.cx>
Message-ID: <013c01c34c79$c178a950$9601a8c0@cel1700>

Try

root@localhost

denis

www.just-server.co.uk

----- Original Message -----
From: "mikea" <mikea@MIKEA.ATH.CX>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 17, 2003 4:47 PM
Subject: Re: storing spam and ham as mbox files


> On Thu, Jul 17, 2003 at 04:36:41PM +0100, Spicer, Kevin wrote:
> > > <later>
> > >
> > > Nope.
> > >
> > > The "forward" action requires an address of the form something@domain,
> > > and just supplying an address local to the machine without the
> > > "@domain" part fails.
> > >
> > You should be able to do yourname@yourmailserver.yourdomain.com, or
possibly yourname@localhost.
>
> No; I tried that. The MX won't relay back to this machine, or indeed
> to any other machine; stuff goes to the MX (Lotus Notes) and thence
> to Dave Null if addressed to the MX.
>
> Decidedly Unpleasant.
>
> I'll plead with the Notes admin, but I really expect to get nowhere
> fast.
>
> --
> Mike Andrews
> mikea@mikea.ath.cx
> Tired old sysadmin since 1964


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.501 / Virus Database: 299 - Release Date: 14/07/2003

From Kevin.Spicer at BMRB.CO.UK  Thu Jul 17 16:55:58 2003
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
Message-ID: <5C0296D26910694BB9A9BBFC577E7AB0EBF752@pascal.priv.bmrb.co.uk>

> No; I tried that. The MX won't relay back to this machine, or indeed
> to any other machine; stuff goes to the MX (Lotus Notes) and thence
> to Dave Null if addressed to the MX.
> 
But it should never leave the machine if addressed to localhost (presuming you're using sendmail) - it should be passed to procmail for local delivery.  Unless that is you have configured your box with a smarthost (but then presumably you wouldn't be scanning outgoing mail in that case?)



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.


From mikea at MIKEA.ATH.CX  Thu Jul 17 17:06:40 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB0EBF752@pascal.priv.bmrb.co.uk>;
              from Kevin.Spicer@BMRB.CO.UK on Thu, Jul 17,
              2003 at 04:55:58PM +0100
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF752@pascal.priv.bmrb.co.uk>
Message-ID: <20030717110640.A81383@mikea.ath.cx>

On Thu, Jul 17, 2003 at 04:55:58PM +0100, Spicer, Kevin wrote:
> > No; I tried that. The MX won't relay back to this machine, or indeed
> > to any other machine; stuff goes to the MX (Lotus Notes) and thence
> > to Dave Null if addressed to the MX.
> >
> But it should never leave the machine if addressed to localhost
> (presuming you're using sendmail) - it should be passed to procmail
> for local delivery. Unless that is you have configured your box with a
> smarthost (but then presumably you wouldn't be scanning outgoing mail
> in that case?)

Sendmail is configured with the Lotus server as a smarthost, for
reasons related to the overall (ugly) setup of the firewall and Lotus
server, and to management paranoia^Wconcerns.

All mail that comes into this box goes to the Notes server,

I can't do anything about it now. Before I retired and came back as
a contract peon, I was #2 in the IT division and *still* couldn't do
anything about it; I tried. Now I have absolutely zero stroke.

So, within the "all mail inbound to this box will definitely go to the
Notes server and stay there" constraint, what can I do to preserve ham
and spam on the MailScanner box as something other than queuefiles?

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From mikea at MIKEA.ATH.CX  Thu Jul 17 17:12:58 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
In-Reply-To: <3F16C852.5050307@sumark.com>; from rismiller@SUMARK.COM on Thu,
              Jul 17, 2003 at 12:01:22PM -0400
References: <20030717101616.A80801@mikea.ath.cx> <3F16C852.5050307@sumark.com>
Message-ID: <20030717111258.B81383@mikea.ath.cx>

On Thu, Jul 17, 2003 at 12:01:22PM -0400, Chad Rismiller wrote:
> mikea wrote:
> > Is there a way to store ham and spam as mbox files, or just to
> > concatenate all the ham to one file and all the spam to another?
> >
> > I know about Non Spam Actions, High Scoring Spam Actions, and Spam
> > Actions, but these (at least in the MailScanner version I have) just
> > store to directories in the quarantine subtree, and then only as
> > queue files.
>
> If you quarantine your spam, then just run df2mbox located in the
> MailScanner/bin directory.  This will turn all your qf and df files into
> mbox files.  I run mine like this:
>
> df2mbox /var/spool/MailScanner/quarantine/*

Thanks! I was unaware of that utility!

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From rismiller at SUMARK.COM  Thu Jul 17 17:01:22 2003
From: rismiller at SUMARK.COM (Chad Rismiller)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
In-Reply-To: <20030717101616.A80801@mikea.ath.cx>
References: <20030717101616.A80801@mikea.ath.cx>
Message-ID: <3F16C852.5050307@sumark.com>

mikea wrote:
> Is there a way to store ham and spam as mbox files, or just to
> concatenate all the ham to one file and all the spam to another?
>
> I know about Non Spam Actions, High Scoring Spam Actions, and Spam
> Actions, but these (at least in the MailScanner version I have) just
> store to directories in the quarantine subtree, and then only as
> queue files.

If you quarantine your spam, then just run df2mbox located in the
MailScanner/bin directory.  This will turn all your qf and df files into
mbox files.  I run mine like this:

df2mbox /var/spool/MailScanner/quarantine/*


Chad

From steve.freegard at LBSLTD.CO.UK  Thu Jul 17 17:16:28 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:18:58 2006
Subject: storing spam and ham as mbox files
Message-ID: <67D9E7698329D411936E00508B6590B902773A2D@neelix.lbsltd.co.uk>

Mike,

I've been playing with the MailScanner quarantine actions quite a bit
recently with a view to putting 'Quarantine Manager' screens into MailWatch.

I know this isn't exactly what you want - but you could set:

 Spam/High Scoring Spam Actions = store
 Quarantine Whole Message = yes
 Quarantine Whole Messages As Queue Files = no

in MailScanner.conf - then you'll have all the files in
/var/spool/MailScanner/quarantine/<date>/(not-spam|spam)/<messageid> stored
as files in message/rfc822 format that you can parse with awk/perl to do
what you want with it.  Alternativly there may be a util around out there
somewhere to munge a load of rfc822 files into mbox format...

Just an idea while I was watching this thread....

Kind regards,
Steve.

--
Steve Freegard
Systems Manager
Littlehampton Book Services Ltd.

-----Original Message-----
From: mikea [mailto:mikea@MIKEA.ATH.CX]
Sent: 17 July 2003 16:32
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: storing spam and ham as mbox files


On Thu, Jul 17, 2003 at 04:20:15PM +0100, Spicer, Kevin wrote:
> > Is there a way to store ham and spam as mbox files, or just to
> > concatenate all the ham to one file and all the spam to another?

> Can't you just use the forward action to forward the mails to a mailbox on
the local machine?

I'll give it a try.

<later>

Nope.

The "forward" action requires an address of the form something@domain,
and just supplying an address local to the machine without the
"@domain" part fails.

Unfortunately for me, the MX for our "inside" network is a Lotus Notes
server which is set to not relay anywhere. I can't get that changed,
and it is ... well, "unpleasant" is a very short way out along that
axis, and my situation lies considerably farther out.

Any ideas will be enthusiastically examined, and probably will be
given The Old School Try.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From tyler at beloit.edu  Thu Jul 17 17:44:09 2003
From: tyler at beloit.edu (Tim Tyler)
Date: Thu Jan 12 21:18:58 2006
Subject: Sophos issue?
Message-ID: <200307171644.h6HGi9p37282@beloit.edu>

Ok, I have 10's of thousands of messages that go out in a
day on my student server.   I think it would be to my
advantage to have the savi perl module installed.  The steps
were going fine until I got to step 6 of the Perl SAVI
Module instructions:

Create a link so that "-lsavi" works:
[ -e /usr/local/Sophos/lib/libsavi.so.2 ] && ln -sf
libsavi.so.2 /usr/local/Sophos/lib/libsavi.so
[ -e /usr/local/Sophos/lib/libsavi.so.3 ] && ln -sf
libsavi.so.3 /usr/local/Sophos/lib/libsavi.so


I don't quite understand this step.  I am running on an
AIX5.1 system.  I don't have any libsavi.so* files laying
around anywhere.  Should I?  Should I skip this step?  Am I
missing libraries that I should have from Sophos?  Note: the
sophos/lib directory has libsavi.a and vdl.* files.  Can
someone clarify this step better to me? -thanks!

Tim





> Set the scanner to 'sophos' if you have just installed
> Sophos - this will then call the Sweep binary.
>
> If you find that the startup time for sweep is bogging
> your mail server down you can install the savi perl module
> (as described on the MailScanner website), this is a perl
> API that allows one to use the Sophos C libraries without
> having to run sweep.  Under this circumstance you should
> change virus scanners to sophossavi.
>
> The Sophos C libraries come with the command line scanner
> and there is n additional license, although you do have to
> install the perl module (which is not distributed by
> Sophos themselves).
>
> Unless you have performance issues its easier to stick
> with regular Sophos.
>
>
>
>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> __________________________________________________________
> _______ This message (and any attachment) is intended only
> for the recipient and may contain confidential and/or
> privileged material.  If you have received this in error,
> please contact the sender and delete this message
> immediately.  Disclosure, copying or other action taken in
> respect of this email or in reliance on it is prohibited.
> BMRB International Limited accepts no liability in
> relation to any personal emails, or content of any email
> which does not directly relate to our business.
>

Tim Tyler
Network Engineer

From vosburgh at DALSEMI.COM  Thu Jul 17 17:54:04 2003
From: vosburgh at DALSEMI.COM (David Vosburgh)
Date: Thu Jan 12 21:18:59 2006
Subject: storing spam and ham as mbox files
References: <5C0296D26910694BB9A9BBFC577E7AB0EBF751@pascal.priv.bmrb.co.uk>
            <20030717104713.A81139@mikea.ath.cx>
Message-ID: <3F16D4AC.2090100@dalsemi.com>

is this what you're looking for:

High Scoring Spam Actions = forward
spam-archive-highscore@MS-server.your-domain.com

and then create an alias in /etc/mail/aliases that points to a local file:

spam-archive-highscore: /blah/blah/blah/spam-archive-highscore

and then read them with pine.

dave

mikea wrote:

>On Thu, Jul 17, 2003 at 04:36:41PM +0100, Spicer, Kevin wrote:
>
>
>>><later>
>>>
>>>Nope.
>>>
>>>The "forward" action requires an address of the form something@domain,
>>>and just supplying an address local to the machine without the
>>>"@domain" part fails.
>>>
>>>
>>>
>>You should be able to do yourname@yourmailserver.yourdomain.com, or possibly yourname@localhost.
>>
>>
>
>No; I tried that. The MX won't relay back to this machine, or indeed
>to any other machine; stuff goes to the MX (Lotus Notes) and thence
>to Dave Null if addressed to the MX.
>
>Decidedly Unpleasant.
>
>I'll plead with the Notes admin, but I really expect to get nowhere
>fast.
>
>--
>Mike Andrews
>mikea@mikea.ath.cx
>Tired old sysadmin since 1964
>
>
>

From kevins at BMRB.CO.UK  Thu Jul 17 18:47:52 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:59 2006
Subject: [Fwd: Re: Sophos issue?]
Message-ID: <1058464072.6514.10.camel@bach.kevinspicer.co.uk>

Sorry, I meant to post this to the list...

> From: Kevin Spicer <kevins@bmrb.co.uk>
> To: tyler@beloit.edu
> Subject: Re: Sophos issue?
> Date: 17 Jul 2003 18:39:41 +0100
>
> I don't quite understand this step.  I am running on an
> AIX5.1 system.  I don't have any libsavi.so* files laying
> around anywhere.  Should I?  Should I skip this step?  Am I
> missing libraries that I should have from Sophos?  Note: the
> sophos/lib directory has libsavi.a and vdl.* files.  Can
> someone clarify this step better to me? -thanks!
>
> You can't skip the step, however it doesn't look good as a .a file is a
> static library, not a shared library like a .so file.  So it looks like
> Sophos on AIX is statically linked.
>
> Maybe you could build the savi module statically linked - but this means
> you'll have to rebuild it every time you do an upgrade of Sophos to the
> latest version, you may well decide that isn't worth it.





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mailscanner at LISTS.COM.AR  Thu Jul 17 19:20:56 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:59 2006
Subject: mcafee-autoupdate not executable
Message-ID: <3F16BED8.8981.107DC89D@localhost>

Hi Julian,

a small one for your homecoming...

The mcafee-autoupdate script inside the 4.22-5 tarball is not executable...
would you "chmod +x " it, please?

TIA


--
Mariano Absatz
El Baby
----------------------------------------------------------
Build a system that even a fool can use, and only a fool will use it.

From Steve at swaney.com  Thu Jul 17 19:24:35 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:59 2006
Subject: [Fwd: Re: Sophos issue?]
In-Reply-To: <1058464072.6514.10.camel@bach.kevinspicer.co.uk>
References: <1058464072.6514.10.camel@bach.kevinspicer.co.uk>
Message-ID: <1058466275.1333.27.camel@speedy>

Did you use /usr/sbin/Sophos.install to install Sophos?

I posted a response to a similar problem on the faq-o-matic yesterday.

Try using Julian's script to install Sophos.

Steve
Steve@Swaney.com

On Thu, 2003-07-17 at 13:47, Kevin Spicer wrote:

> Sorry, I meant to post this to the list...
>
> > From: Kevin Spicer <kevins@bmrb.co.uk>
> > To: tyler@beloit.edu
> > Subject: Re: Sophos issue?
> > Date: 17 Jul 2003 18:39:41 +0100
> >
> > I don't quite understand this step.  I am running on an
> > AIX5.1 system.  I don't have any libsavi.so* files laying
> > around anywhere.  Should I?  Should I skip this step?  Am I
> > missing libraries that I should have from Sophos?  Note: the
> > sophos/lib directory has libsavi.a and vdl.* files.  Can
> > someone clarify this step better to me? -thanks!
> >
> > You can't skip the step, however it doesn't look good as a .a file is a
> > static library, not a shared library like a .so file.  So it looks like
> > Sophos on AIX is statically linked.
> >
> > Maybe you could build the savi module statically linked - but this means
> > you'll have to rebuild it every time you do an upgrade of Sophos to the
> > latest version, you may well decide that isn't worth it.
>
>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact the
> sender and delete this message immediately.  Disclosure, copying
> or other action taken in respect of this email or in
> reliance on it is prohibited.  BMRB International Limited
> accepts no liability in relation to any personal emails, or
> content of any email which does not directly relate to our
> business.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/c3aecf67/attachment.html
From emcc-mailscanner at CTCNET.COM  Thu Jul 17 19:47:22 2003
From: emcc-mailscanner at CTCNET.COM (Eric McClelland)
Date: Thu Jan 12 21:18:59 2006
Subject: Mysterious MailScanner hangs
In-Reply-To: <Pine.A41.4.56.0307121517400.1289562@hermes-22.rz.uni-frankfurt.de>
Message-ID: <Pine.LNX.4.21.0307171436410.24856-100000@redpill.ctcnet.com>

Well I feel a little silly because I somehow overlooked something in
syslog:

Jul 13 04:04:15 Iris MailScanner[10213]: Batch: Found invalid queue file
for message 8BEE88EABD

Doing some research on this message I discovered this issue had been
raised back in May:

http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A2=ind0305&L=mailscanner&P=R22003&I=-1

...only I hadn't looked back that far in the archives.  I installed
MailScanner 4.22-5 and the problem disappeared.

Thanks for the responses.

Cheers,
--Eric

From vboulytchev at COINFOTECH.COM  Thu Jul 17 20:23:38 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:18:59 2006
Subject: subscribe
Message-ID: <1958DE295D9656499ECAAD3642822DE0033F6B@willow.office.coinfotech.com>

 
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/6460344e/attachment.html
From vboulytchev at COINFOTECH.COM  Thu Jul 17 20:36:18 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:18:59 2006
Subject: .bad files .....
Message-ID: <1958DE295D9656499ECAAD3642822DE0033F6E@willow.office.coinfotech.com>

ladies and Gents,
    I have an issue with mailscanner putting .bad files in
/var/Communigate/Submitted/
 
I have looked at most of MailScanner's code...... I dont see the point
where that is being added, so I am thinking its something else.
 
PLEASE HELP!!!!!!!!!!!!!!!!!!!!!!!
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/366a612a/attachment.html
From chris at FRACTALWEB.COM  Thu Jul 17 20:36:05 2003
From: chris at FRACTALWEB.COM (Chris Yuzik)
Date: Thu Jan 12 21:18:59 2006
Subject: attach spam doesn't work
Message-ID: <018401c34c9a$aa455190$1501a8c0@pandora>

Hi,

I tried setting up my MailScanner.conf file to do attachments for spam, but then all mail stopped coming in.

I had: Spam Actions = attachment

But then no spam came in...it just got eaten by the server. As soon as I changed it back to:
Spam Actions = deliver

Then the spam started flowing again. Now, much as I would like to see all spam go away...I don't think this is a safe option and is certainly not what I intended.

Also, I was using one of my email addresses to test the spam filtering and labelling and have sent the "gtube" string several times. Now I can't seem to send any email from that address anymore. I do have "auto-whitelist=yes". Any thoughts?

Thanks,
Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/a5941101/attachment.html
From Steve at swaney.com  Thu Jul 17 20:44:22 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:18:59 2006
Subject: attach spam doesn't work
In-Reply-To: <018401c34c9a$aa455190$1501a8c0@pandora>
References: <018401c34c9a$aa455190$1501a8c0@pandora>
Message-ID: <1058471062.1338.97.camel@speedy>

Try:

Spam Actions = attachment deliver

This has been covered in the list a few times before.

Steve
Steve@Swaney.com

On Thu, 2003-07-17 at 15:36, Chris Yuzik wrote:

> Hi,
>
> I tried setting up my MailScanner.conf file to do attachments for
> spam, but then all mail stopped coming in.
>
> I had: Spam Actions = attachment
>
> But then no spam came in...it just got eaten by the server. As soon as
> I changed it back to:
> Spam Actions = deliver
>
> Then the spam started flowing again. Now, much as I would like to see
> all spam go away...I don't think this is a safe option and is
> certainly not what I intended.
>
> Also, I was using one of my email addresses to test the spam filtering
> and labelling and have sent the "gtube" string several times. Now I
> can't seem to send any email from that address anymore. I do have
> "auto-whitelist=yes". Any thoughts?
>
> Thanks,
> Chris
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/170fe106/attachment.html
From mike at CAMAROSS.NET  Thu Jul 17 21:32:54 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:18:59 2006
Subject: MailScanner/Sendmail + Mailman?
In-Reply-To: <1058446180.18388.26.camel@tweety.tnjinfl.com>
Message-ID: <003a01c34ca2$9a539e10$9c01a8c0@home.middlefinger.net>

I run MM 2.1.2 on the same box as MailScanner without any problems.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of James Pifer
Sent: Thursday, July 17, 2003 7:50 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner/Sendmail + Mailman?


Anyone running Mailman on the same server that is running MailScanner with
Sendmail?

The Mailman readme wants you to configure the sendmail.cf and make some
changes. I don't want to mess up my functioning MailScanner server.

Anyone doing this? Anyone have any suggestions for making Mailman work in
this situation? Right now it doesn't seem to deliver mail.

Thanks,
James


From steve.douglas at SBIINCORPORATED.COM  Thu Jul 17 21:39:38 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:18:59 2006
Subject: False-positives
Message-ID: <3963522F0E71474CB14C0FF54A6914F70111522B@mail.gardenbotanika.com>

The system has version 2.55 of SPAMAssassin.  I did raise the score to seven
from five and that appears to have reduced it significantly.  Thanks for the
suggestion.

SD
:-)


> -----Original Message-----
> From: Martin Sapsed [mailto:m.sapsed@BANGOR.AC.UK]
> Sent: Thursday, July 17, 2003 3:16 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: False-positives
>
> Steve Douglas wrote:
> > I have the "SPAM lists to reach high score" setting set to 5.  My server
> > only gets about 2000 messages a day, yet I have about 100 or so messages
> > that were originally identified as SPAM.  Is there something I need to
> > do here?  I have white listed these messages by their network IDs to
> > prevent this in the future, but the false-positives are reflected as an
> > important area of concern by my management due the fact alot of this
> > information is directly tied to the company's revenue.
>
> If I understand you correctly, 100 or so out of 2000 messages per day
> are marked as spam when they shouldn't be?
>
> You haven't said which version of SpamAssassin you're using - that has a
> big effect on the scores you get. If you look at the SpamCheck header
> and there's a high-value category listed consistently among the wrongly-
> marked messages you could lower that score in
> MailScanner/etc/spam.assassin.prefs.conf perhaps?
>
> If your correctly marked spam is consistently coming in with higher
> scores, then just raise the threshold.
>
> Cheers,
>
> Martin
>
> --
> Martin Sapsed
> Information Services               "Who do you say I am?"
> University of Wales, Bangor             Jesus of Nazareth

From steve.douglas at SBIINCORPORATED.COM  Thu Jul 17 21:40:49 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:18:59 2006
Subject: DNSBL Whitelist
Message-ID: <3963522F0E71474CB14C0FF54A6914F70111522C@mail.gardenbotanika.com>

Why not just raise your SPAMAssassin score higher.

SD
:-)


> -----Original Message-----
> From: Bill Anderson [mailto:billa@STERLING.NET]
> Sent: Thursday, July 17, 2003 10:24 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: DNSBL Whitelist
>
> I asked this question earlier, however from the lack of response, I assume
> I
> posed the question unclearly.
>
> In the MailScanner.conf file there is a section to use blacklist by using
> ORDB, MAPS, etc...
>
> # This is the list of spam blacklists (RBLs) which you are using.
> # See the "Spam List Definitions" file for more information about what
> # you can put here.
> # This can also be the filename of a ruleset.
> Spam List = ORDB-RBL Infinite-Monkeys # MAPS-RBL+ costs money (except
> .ac.uk)
>
> Is there a way to do the same thing, however make the response a
> whitelist.
> There is a service out there called TCATS, that provides a whitelist of
> good
> IP's as well as a black list.  I would like to use the whitelist to reduce
> false positives, but have not found a way to integrate it with
> MailScanner.
>
> Here is the the link to TCATS:
>
> http://www.the-carrot-and-the-stick.com/How_To/index.php?VIEW=direct_query

From kevins at BMRB.CO.UK  Thu Jul 17 22:11:09 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:59 2006
Subject: DNSBL Whitelist
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175E8C@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175E8C@pascal.priv.bmrb.co.uk>
Message-ID: <1058476269.6514.20.camel@bach.kevinspicer.co.uk>

On Thu, 2003-07-17 at 16:23, Bill Anderson wrote:

>Is there a way to do the same thing, however make the response a
>whitelist.
>There is a service out there called TCATS, that provides a whitelist of
>good
>IP's as well as a black list.  I would like to use the whitelist to
>reduce
>false positives, but have not found a way to integrate it with
>MailScanner.

I don't believe theres currently any way of doing this with MailScanner,
however if you use SpamAssassin to do the RBL checks you can do it.

I _think_ its done by adding something like the following to
spam.assassin.prefs.conf

header RCVD_IN_TCATS rbleval:check_rbl('relay',
'accept.the-carrot-and-the-stick.com.')

describe RCVD_IN_TCATS Listed in TCATS see
http://www.the-carrot-and-the-stick.com/

tflags RCVD_IN_TCATS net nice

score RCVD_IN_TCATS -10

[NOTE: the first two pairs of lines are single lines which my mail
client has wrapped] You can set the score to what you like (but it
should be negative).

I basically nicked the above from the way spamassassin handles the
bondedsender.org whitelist.






BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From vboulytchev at COINFOTECH.COM  Thu Jul 17 22:14:29 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:18:59 2006
Subject: .bad files continued
Message-ID: <1958DE295D9656499ECAAD3642822DE0033F75@willow.office.coinfotech.com>

Ladies and Gents,
    cgp2ms is adding RPFD to the recipients line.  Why its doing that, I
have no clue.  Another thing that is bazaar, is I have a few domains
working with no problems, its just this one.........  It does have a
route rule in Communigate, but how would that affect
anything......................  If I take those stupid RPFD: out from
those .bad files, and copy them to .sub, communigate pushes the files.
 
Any Suggestions?
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/5eba7635/attachment.html
From billa at STERLING.NET  Thu Jul 17 22:41:24 2003
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:18:59 2006
Subject: DNSBL Whitelist
References: <5C0296D26910694BB9A9BBFC577E7AB001175E8C@pascal.priv.bmrb.co.uk> 
            <1058476269.6514.20.camel@bach.kevinspicer.co.uk>
Message-ID: <048401c34cac$2bfb4800$0a010a0a@dirt>

Thanks, I will give it a go.

----- Original Message -----
From: "Kevin Spicer" <kevins@BMRB.CO.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 17, 2003 2:11 PM
Subject: Re: DNSBL Whitelist


> On Thu, 2003-07-17 at 16:23, Bill Anderson wrote:
>
> >Is there a way to do the same thing, however make the response a
> >whitelist.
> >There is a service out there called TCATS, that provides a whitelist of
> >good
> >IP's as well as a black list.  I would like to use the whitelist to
> >reduce
> >false positives, but have not found a way to integrate it with
> >MailScanner.
>
> I don't believe theres currently any way of doing this with MailScanner,
> however if you use SpamAssassin to do the RBL checks you can do it.
>
> I _think_ its done by adding something like the following to
> spam.assassin.prefs.conf
>
> header RCVD_IN_TCATS rbleval:check_rbl('relay',
> 'accept.the-carrot-and-the-stick.com.')
>
> describe RCVD_IN_TCATS Listed in TCATS see
> http://www.the-carrot-and-the-stick.com/
>
> tflags RCVD_IN_TCATS net nice
>
> score RCVD_IN_TCATS -10
>
> [NOTE: the first two pairs of lines are single lines which my mail
> client has wrapped] You can set the score to what you like (but it
> should be negative).
>
> I basically nicked the above from the way spamassassin handles the
> bondedsender.org whitelist.
>
>
>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact the
> sender and delete this message immediately.  Disclosure, copying
> or other action taken in respect of this email or in
> reliance on it is prohibited.  BMRB International Limited
> accepts no liability in relation to any personal emails, or
> content of any email which does not directly relate to our
> business.
>

From smohan at VSNL.COM  Fri Jul 18 05:27:11 2003
From: smohan at VSNL.COM (S Mohan)
Date: Thu Jan 12 21:18:59 2006
Subject: Block whole address
In-Reply-To: <3963522F0E71474CB14C0FF54A6914F7011151DC@mail.gardenbotanika.com>
Message-ID: <MMEBKBBDEGGFLDBJHPGEKEJGCBAA.smohan@vsnl.com>

If you are using sendmail, use the access feature to block the address.
/etc/mail/access file needs to be edited and the address followed by reject
or drop in capitals should be given in a line.

Mohan
  -----Original Message-----
  From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Steve Douglas
  Sent: Wednesday, July 16, 2003 6:22 PM
  To: MAILSCANNER@JISCMAIL.AC.UK
  Subject: Block whole address


  Is there a way to block an entire address from entering an email server
using MailScanner?









-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030718/06c8cc1e/attachment.html
From smohan at VSNL.COM  Fri Jul 18 06:06:26 2003
From: smohan at VSNL.COM (S Mohan)
Date: Thu Jan 12 21:18:59 2006
Subject: forged From:
In-Reply-To: <1058374162.8235.0.camel@bach.kevinspicer.co.uk>
Message-ID: <MMEBKBBDEGGFLDBJHPGECEJICBAA.smohan@vsnl.com>

Outgoing mails i.e. to ther domains also will not be scanned then, is it
not?

Mohan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Kevin Spicer
Sent: Wednesday, July 16, 2003 10:19 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: forged From:


On Wed, 2003-07-16 at 17:12, Rob V wrote:

Can I add that in my scan.rules ?
like
From:           192.168.198.    no

will that no scan all of 192.168.198

That should work fine.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From smohan at VSNL.COM  Fri Jul 18 06:06:24 2003
From: smohan at VSNL.COM (S Mohan)
Date: Thu Jan 12 21:18:59 2006
Subject: forged From:
In-Reply-To: <5.2.1.1.2.20030716121105.01e8a498@mailhost.disaster.com>
Message-ID: <MMEBKBBDEGGFLDBJHPGEAEJICBAA.smohan@vsnl.com>

The rule should actually be From: IP and to:*@domain.com. I do not think we
can do this in the rules right now.

Could be looked at as a feature enhancement. Current we have FromTo(meaning
From billa at STERLING.NET  Thu Jul 17 22:41:51 2003
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:18:59 2006
Subject: DNSBL Whitelist
References: <3963522F0E71474CB14C0FF54A6914F70111522C@mail.gardenbotanika.com>
Message-ID: <048901c34cac$3bd5f770$0a010a0a@dirt>

I tried that, but to much spam got through.

----- Original Message -----
From: "Steve Douglas" <steve.douglas@SBIINCORPORATED.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 17, 2003 1:40 PM
Subject: Re: DNSBL Whitelist


> Why not just raise your SPAMAssassin score higher.
>
> SD
> :-)
>
>
> > -----Original Message-----
> > From: Bill Anderson [mailto:billa@STERLING.NET]
> > Sent: Thursday, July 17, 2003 10:24 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: DNSBL Whitelist
> >
> > I asked this question earlier, however from the lack of response, I
assume
> > I
> > posed the question unclearly.
> >
> > In the MailScanner.conf file there is a section to use blacklist by
using
> > ORDB, MAPS, etc...
> >
> > # This is the list of spam blacklists (RBLs) which you are using.
> > # See the "Spam List Definitions" file for more information about what
> > # you can put here.
> > # This can also be the filename of a ruleset.
> > Spam List = ORDB-RBL Infinite-Monkeys # MAPS-RBL+ costs money (except
> > .ac.uk)
> >
> > Is there a way to do the same thing, however make the response a
> > whitelist.
> > There is a service out there called TCATS, that provides a whitelist of
> > good
> > IP's as well as a black list.  I would like to use the whitelist to
reduce
> > false positives, but have not found a way to integrate it with
> > MailScanner.
> >
> > Here is the the link to TCATS:
> >
> >
http://www.the-carrot-and-the-stick.com/How_To/index.php?VIEW=direct_query
>

From kevins at BMRB.CO.UK  Thu Jul 17 22:42:06 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:59 2006
Subject: .bad files continued
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175EA5@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175EA5@pascal.priv.bmrb.co.uk>
Message-ID: <1058478127.6635.25.camel@bach.kevinspicer.co.uk>

On Thu, 2003-07-17 at 22:14, Boulytchev, Vasiliy wrote:
>Ladies and Gents,
>    cgp2ms is adding RPFD to the recipients line.  Why its doing that,
>I have no clue.  Another thing that is bazaar, is I have a few domains
>working with no problems, its just this one.........  It does have a
> route rule in Communigate, but how would that affect
>anything......................  If I take those stupid RPFD: out from
>those .bad files, and copy them to .sub, communigate pushes the files.

Perhaps you should try a mailing list for communicate users?  This
doesn't sound like any symptom I've seen anyone report on this list - so
its probably a Communigate issue.  You could try ruling out MailScanner
by taking it out of the mix temporarily.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From chris at FRACTALWEB.COM  Thu Jul 17 23:38:49 2003
From: chris at FRACTALWEB.COM (Chris Yuzik)
Date: Thu Jan 12 21:18:59 2006
Subject: outbound mail stuck ... in wrong directory
Message-ID: <009c01c34cb4$3150a9a0$1501a8c0@pandora>

Hi everyone,

Just when I approach "spam nirvana" I keep hitting speedbumps.Thanks to this list, you guys keep helping me get over them. Thanks.

I have RedHat 7.3 with multiple virtual domains set up. Incoming mail works great...and Mailscanner is catching virtually all the spam that arrives at the system. Sendmail and Procmail are handling mail.

I have 1 remaining problem (so far):

When MailScanner is running, outbound mail is getting placed in the incorrect directory on the hard disk. 

Specifically, the outbound mail should (I think) be going into /var/spool/mqueue, but it's going to /home/virtual/site2/fst/ instead...and there's nothing to move it from there to the outbound queue.

What's the fix for this? ...I'm pulling out what little hair I have.

Thanks,
Chris

PS - I asked a similar question a couple of days ago...but most of my incoming mail got shredded. If you answered it before...please re-answer. Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030717/6767c097/attachment.html
From P.G.M.Peters at utwente.nl  Fri Jul 18 10:43:51 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:59 2006
Subject: mailscanner only sees the envelope TO - solved
In-Reply-To: <3F16BF73.8020401@pacific.net>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>           
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>           
            <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>           
            <1058378447.22259.19.camel@speedy>   <3F15C8BB.5030003@pacific.net>
            <1058395642.22259.60.camel@speedy> <3F16BF73.8020401@pacific.net>
Message-ID: <epffhvo928h0i99i97sfdgtm194f5k8ke3@4ax.com>

On Thu, 17 Jul 2003 08:23:31 -0700, you wrote:

>Here's what I did. If any sendmail gurus out there thing this is a bad
>idea, please let me know what a mess I've made of things :-)

It looks good.

>Restart sendmail, and things like this start showing up in the log when
>messages with multiple recipients come in:
>
>Jul 17 08:14:31 host sendmail[7183]: h6HFDop8007183: split: maxrcpts=1,
>rcpts=3, count=2, ids=h6HFDop9007183; h6HFDopA007183

I use queue-ID's to track messages through our systems. I presume this
logline appears next to the from=/to= lines from the incoming sendmail.
After that the messages is processed by MS. Could you confirm that the
new queue-ID's are used in de MS loglines. I presume that sendmail
handles it correctly when he delivers the three messages after the
scanning.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From SJCJonker at SJC.NL  Fri Jul 18 12:00:57 2003
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:18:59 2006
Subject: MailScanner/Sendmail + Mailman?
In-Reply-To: <200307171430.KAA31790@earl.morehouse.edu>
References: <200307171430.KAA31790@earl.morehouse.edu>
Message-ID: <Pine.LNX.4.53.0307181252230.31454@ph-wks-01.sjc.nl>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

Just in short, if you want to use mm-handler, with sendmail, MS, SA etc
etc etc. Some of my comments when implementing it.

I think it is only reasonable to do if you use 1 specific subdomain to
handle the list.

Don't forget the: VIRTUSER_DOMAIN in the sendmail.mc it took me 2 days to
figure out why it wasn't working, only to see i missed this entry.

Attached is my sendmail.mc, anonymized, and with comments for the
mm-handler setup. Remove the comments to make it an m4.

Oh, and don't add the list.* hostnames to the local-host-names (The Fw
macro.)

in mailertable do:

list.domain-1.com       mailman:list.domain-1.com
etc

And it should work.

Good luck.

P.S. In regards to configing sendmail, the ora bat book is your best
friend. If you need info, you can find it in there, if it doesn't work, it
makes nice sounds when landing on the floor/chair/door or you collegue
;-))

On Thu, 17 Jul 2003, Matt Laney wrote:

> James,
>
> > The README.SENDMAIL says to look at mm-handler.readme...
>
> Ah--that's if you're using mm-handler as your local delivery agent
> for mailman.  I'm not, and I happen to know nothing about it.


<<SNIP>>

> > Did you have to modify the mailertable?
>
> No, but I run my list processor on the same domain as the rest of
> my stuff.  That is, I didn't add a subdomain just for Mailman.  In

<<SNIP ALL>>

- --
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/F9NvjU9r45tKnOARAoCHAKDSZmpC5uzp2u8c7Xj16zEJUp4NOQCfcsKr
qjt4tCBUS5pYt1dhSq38mng=
=BC6h
-----END PGP SIGNATURE-----
-------------- next part --------------
divert(-1)
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`ph-dmz-01 config')dnl
OSTYPE(`linux')dnl
define(`confDEF_USER_ID',`8:12')dnl
undefine(`UUCP_RELAY')dnl
undefine(`BITNET_RELAY')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST',true)dnl
define(`confDONT_PROBE_INTERFACES',true)dnl
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
define(`STATUS_FILE', `/var/log/sendmail.st')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
define(`confTO_QUEUEWARN', `4h')dnl
define(`confTO_QUEUERETURN', `5d')dnl
define(`confTO_IDENT',`0')dnl
define(`confQUEUE_LA', `12')dnl
define(`confREFUSE_LA', `18')dnl
#
# This server doens't have any local accounts
# the following 4 setting makes sure it will
# (hopefully) never deliver locally
#
#
define(`MAIL_HUB', `smtp-final.XXXX')dnl
define(`LUSER_RELAY', `smtp-final.XXXX')dnl
define(`LOCAL_RELAY', `smtp-final.XXXX')dnl
define(`SMART_HOST', `smtp-out.XXXX') dnl
define(`confMAX_MESSAGE_SIZE',15000000)dnl
define(`confMAX_HOP',30)dnl
define(`confUSE_ERRORS_TO',true)dnl
define(`confCOPY_ERRORS_TO',Postmaster)dnl
define(`confDOUBLE_BOUNCE_ADDRESS',`postmaster')dnl
dnl
dnl By default, sendmail applies virtusertable mapping, if at all, for
dnl all interfaces for which it accepts mail -- i.e., all domains in
dnl $=w. Mm-handler relies on your having a single domain (hostname)
dnl that serves only lists, with no users. To avoid potential namespace
dnl conflicts, you need not to have this list domain included in $=w.
dnl As a result, virtuser mapping does not apply for the Mailman
dnl list domain. However, you can pre-empt this rule by defining
dnl $={VirtHost}: if there are domains in this class, they will be
dnl mapped before $=w is mapped.
dnl
dnl VIRTUSER_DOMAIN() defines this class.
dnl
#
# Like said in the email this is important
#
VIRTUSER_DOMAIN(`list.domain-1.com list.domain-2.com list.domain-3.com')
FEATURE(`no_default_msa',`dnl')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
FEATURE(`mailertable',`hash -o /etc/mail/mailertable')dnl
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
FEATURE(local_procmail)dnl
FEATURE(`access_db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root bin daemon adm lp sync shutdown halt mail news uucp operator games gopher ftp nobody xfs gdm rpc mailnull postfix named apache')dnl
MAILER(`smtp')dnl
MAILER(`procmail')dnl
dnl
dnl Our Mailman-specific local mailer.
dnl
MAILER_DEFINITIONS
####################################
###   New Mailer specifications  ###
####################################
                                                                                
## Special flags! See
##      http://www.sendmail.org/~ca/email/doc8.10/op-sh-5.html#sh-5.4
## Note especially the absence of the "m" and "n" flags. THIS IS
## IMPORTANT: mm-handler assumes this behavior to avoid having to know
## too much about address parsing and other RFC-2822 mail details.
                                                                                
Mmailman,       P=/etc/mail/mm-handler, F=rDFMhlqSu, U=mailman:mailman,
                S=EnvFromL, R=EnvToL/HdrToL,
                A=mm-handler $h $u
From dustin.baer at IHS.COM  Fri Jul 18 14:16:47 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:18:59 2006
Subject: not reading spam.assassin.prefs.conf
Message-ID: <3F17F33F.CD0C6B74@ihs.com>

I am searching throught the archives also, but thought I would send a
message here, also.

Solaris 9
Sendmail 8.12.9
MailScanner 4.13-3

Yesterday, I upgraded SpamAssassin from 2.43 to 2.55 using perl -MCPAN.
Now, my spam.assassin.prefs.conf file does not seem to be working.

Any suggestions on where to start?

Thanks for any leads...

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

From ka at PACIFIC.NET  Fri Jul 18 14:30:18 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:59 2006
Subject: mailscanner only sees the envelope TO - solved
In-Reply-To: <epffhvo928h0i99i97sfdgtm194f5k8ke3@4ax.com>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>             
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>             
            <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>             
            <1058378447.22259.19.camel@speedy>   <3F15C8BB.5030003@pacific.net>
            <1058395642.22259.60.camel@speedy> <3F16BF73.8020401@pacific.net>
            <epffhvo928h0i99i97sfdgtm194f5k8ke3@4ax.com>
Message-ID: <3F17F66A.1050607@pacific.net>

Peter Peters wrote:

> On Thu, 17 Jul 2003 08:23:31 -0700, you wrote:
>
>
>>Here's what I did. If any sendmail gurus out there thing this is a bad
>>idea, please let me know what a mess I've made of things :-)
>
>
> It looks good.
>
>
>>Restart sendmail, and things like this start showing up in the log when
>>messages with multiple recipients come in:
>>
>>Jul 17 08:14:31 host sendmail[7183]: h6HFDop8007183: split: maxrcpts=1,
>>rcpts=3, count=2, ids=h6HFDop9007183; h6HFDopA007183
>
>
> I use queue-ID's to track messages through our systems. I presume this
> logline appears next to the from=/to= lines from the incoming sendmail.

Yes, the first TO gets the original message id, and the new split
messages get the ids listed above as ids=xxxxx;xxxxx, so it's possible
to track them.

> After that the messages is processed by MS. Could you confirm that the
> new queue-ID's are used in de MS loglines. I presume that sendmail
> handles it correctly when he delivers the three messages after the
> scanning.

Yes, we put about 500k messages through it yesterday. Sendmail splits
the message before it puts the clones of the message into the mqueue.in
queue that is used by MailScanner as input. Each message has a unique
message id. The total number of messages that your system will then
process, and the load on mailscanner will increase a bit, but MS sees
these as individual messages having the ids that sendmail assigns in the
split log line.

Note: I wouldn't do this on a system that accepted messages with 100
recipients per message, since the load would skyrocket if a spammer sent
more than a few such messages to your system at a time. I'm not sure how
things like 'BadRecipient Throttle' work in combination with Queue
Groups, but it might help in such cases.

Ken



> --
> Peter Peters, senior netwerkbeheerder
> Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
> Universiteit Twente,  Postbus 217,  7500 AE  Enschede
> telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ
>
>

From richard_cipher at yahoo.com  Fri Jul 18 15:29:33 2003
From: richard_cipher at yahoo.com (Evert Ford)
Date: Thu Jan 12 21:18:59 2006
Subject: not reading spam.assassin.prefs.conf
In-Reply-To: <3F17F33F.CD0C6B74@ihs.com>
Message-ID: <NHBBIDLEJBNNEMOPKJPNAEMBDBAA.richard_cipher@yahoo.com>

did you upgrade using the  rpm or the tarball?

if you used the rpm, uninstall it using rpm -e spamassassin
download and unpack the tarball
something like: tar zxvf /path/to/Mail-SpamAssassin-2.55.tar.gz
navigate to the directory spamassassin is residing in then:
perl Makefile.pl
make
make test
make install

then reload MailScanner.

It should work fine at this point.

Evert Ford
Information Analyst
http://www.westone.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Dustin Baer
Sent: Friday, July 18, 2003 7:17 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: not reading spam.assassin.prefs.conf


I am searching throught the archives also, but thought I would send a
message here, also.

Solaris 9
Sendmail 8.12.9
MailScanner 4.13-3

Yesterday, I upgraded SpamAssassin from 2.43 to 2.55 using perl -MCPAN.
Now, my spam.assassin.prefs.conf file does not seem to be working.

Any suggestions on where to start?

Thanks for any leads...

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From richard_cipher at YAHOO.COM  Fri Jul 18 15:35:13 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:59 2006
Subject: not reading spam.assassin.prefs.conf
In-Reply-To: <3F17F33F.CD0C6B74@ihs.com>
Message-ID: <NHBBIDLEJBNNEMOPKJPNMEMBDBAA.richard_cipher@yahoo.com>

sorry...stupid response...i just re-read your message......i would try
downloading the tarball and trying it that way instead of MCPAN....i've
never had a problem on my system that way

Evert

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Dustin Baer
Sent: Friday, July 18, 2003 7:17 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: not reading spam.assassin.prefs.conf


I am searching throught the archives also, but thought I would send a
message here, also.

Solaris 9
Sendmail 8.12.9
MailScanner 4.13-3

Yesterday, I upgraded SpamAssassin from 2.43 to 2.55 using perl -MCPAN.
Now, my spam.assassin.prefs.conf file does not seem to be working.

Any suggestions on where to start?

Thanks for any leads...

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From P.G.M.Peters at utwente.nl  Fri Jul 18 16:16:01 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:18:59 2006
Subject: mailscanner only sees the envelope TO - solved
In-Reply-To: <3F17F66A.1050607@pacific.net>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>             
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>             
            <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>             
            <1058378447.22259.19.camel@speedy>   <3F15C8BB.5030003@pacific.net>
            <1058395642.22259.60.camel@speedy> <3F16BF73.8020401@pacific.net>
            <epffhvo928h0i99i97sfdgtm194f5k8ke3@4ax.com>
            <3F17F66A.1050607@pacific.net>
Message-ID: <5k3ghvge6hqsopkcd1chjmep5ommlbdo4r@4ax.com>

On Fri, 18 Jul 2003 06:30:18 -0700, you wrote:

>> After that the messages is processed by MS. Could you confirm that the
>> new queue-ID's are used in de MS loglines. I presume that sendmail
>> handles it correctly when he delivers the three messages after the
>> scanning.
>
>Yes, we put about 500k messages through it yesterday. Sendmail splits
>the message before it puts the clones of the message into the mqueue.in
>queue that is used by MailScanner as input. Each message has a unique
>message id. The total number of messages that your system will then
>process, and the load on mailscanner will increase a bit, but MS sees
>these as individual messages having the ids that sendmail assigns in the
>split log line.

I know sendmail puts "for <x>" in the received header when there is only
one recipient. Does this mean the "for" clause is now also in the
received headers of the "first" sendmail?

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From dustin.baer at IHS.COM  Fri Jul 18 16:16:20 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:18:59 2006
Subject: not reading spam.assassin.prefs.conf
References: <NHBBIDLEJBNNEMOPKJPNMEMBDBAA.richard_cipher@yahoo.com>
Message-ID: <3F180F44.DBE878CD@ihs.com>

Evert Ford wrote:
>
> sorry...stupid response...i just re-read your message......i would try
> downloading the tarball and trying it that way instead of MCPAN....i've
> never had a problem on my system that way
>
> Evert

No, not a stupid response.  I am glad someone even responded.  I thought
of this, also and am in the process of doing that.

The very strange thing is that I upgraded with MCPAN on both our test
and our production mail server and things worked fine on the test
server.

I will post whether this works or not.

Thanks!
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

From ka at PACIFIC.NET  Fri Jul 18 17:00:43 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:59 2006
Subject: mailscanner only sees the envelope TO - solved
In-Reply-To: <5k3ghvge6hqsopkcd1chjmep5ommlbdo4r@4ax.com>
References: <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>             
            <5.2.1.1.0.20030716114104.014fb008@xanadu.evi-inc.com>             
            <5.2.1.1.0.20030716134542.01e4d3b0@xanadu.evi-inc.com>             
            <1058378447.22259.19.camel@speedy>   <3F15C8BB.5030003@pacific.net>
            <1058395642.22259.60.camel@speedy> <3F16BF73.8020401@pacific.net>  
            <epffhvo928h0i99i97sfdgtm194f5k8ke3@4ax.com>           
            <3F17F66A.1050607@pacific.net>
            <5k3ghvge6hqsopkcd1chjmep5ommlbdo4r@4ax.com>
Message-ID: <3F1819AB.1040605@pacific.net>

Peter Peters wrote:

> On Fri, 18 Jul 2003 06:30:18 -0700, you wrote:
>
>
>>>After that the messages is processed by MS. Could you confirm that the
>>>new queue-ID's are used in de MS loglines. I presume that sendmail
>>>handles it correctly when he delivers the three messages after the
>>>scanning.
>>
>>Yes, we put about 500k messages through it yesterday. Sendmail splits
>>the message before it puts the clones of the message into the mqueue.in
>>queue that is used by MailScanner as input. Each message has a unique
>>message id. The total number of messages that your system will then
>>process, and the load on mailscanner will increase a bit, but MS sees
>>these as individual messages having the ids that sendmail assigns in the
>>split log line.
>
>
> I know sendmail puts "for <x>" in the received header when there is only
> one recipient. Does this mean the "for" clause is now also in the
> received headers of the "first" sendmail?

We have 2 MS boxes that scan and then relay to our mail hub. What happen
is interesting:
The first TO in the original msg gets the "for <x>" line. After the
message is split, scanned and delivered as separate messages to the mail
hub, ALL of the messages get the "for <x>" line added by the mail hub,
since they appear to our mail hub as separate messages with 1 recip each.

This means that the "for <x>" line can't be depended on to tell you who
the message was really originally addressed to.

However, the original message will have 2 "for <x>" lines, so it's still
possible to tell if a message is an original or a clone so to speak. You
don't really lose anything, since the "other" recipients of a message
never had the "to <X>" information anyway.

The message header of each of the split messages contains the original
message id from before the split, and NOT the new queue.in id assigned
and logged by sendmail, so you can trace using that just as you could
before.

Ken




> --
> Peter Peters, senior netwerkbeheerder
> Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
> Universiteit Twente,  Postbus 217,  7500 AE  Enschede
> telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ
>
>

From ka at PACIFIC.NET  Fri Jul 18 17:04:30 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:59 2006
Subject: not reading spam.assassin.prefs.conf
In-Reply-To: <3F17F33F.CD0C6B74@ihs.com>
References: <3F17F33F.CD0C6B74@ihs.com>
Message-ID: <3F181A8E.3010506@pacific.net>

SA also looks at /etc/spamassassin/local.cf
Not sure what you mean by "does not seem to be working", but this file
may affect how spam.assassin.prefs.conf is used. I don't know in what
order they are read/applied though.
Ken A.


Dustin Baer wrote:

> I am searching throught the archives also, but thought I would send a
> message here, also.
>
> Solaris 9
> Sendmail 8.12.9
> MailScanner 4.13-3
>
> Yesterday, I upgraded SpamAssassin from 2.43 to 2.55 using perl -MCPAN.
> Now, my spam.assassin.prefs.conf file does not seem to be working.
>
> Any suggestions on where to start?
>
> Thanks for any leads...
>
> Dustin
> --
> Dustin Baer
> Unix Administrator/Postmaster
> Information Handling Services
> 15 Inverness Way East
> Englewood, CO 80112
> 303-397-2836
>
>

From ka at PACIFIC.NET  Fri Jul 18 17:08:48 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:18:59 2006
Subject: is the list going crazy or is it me?
Message-ID: <3F181B90.8050809@pacific.net>

I've sent 3 emails to the list today, and 2 times have received this
warning email back:

> Your message  is being returned to  you unprocessed because it  appears to have
> already  been distributed  to the  MAILSCANNER list.  That is,  a message  with
> identical text  (but possibly with different  mail headers) has been  posted to
> the list recently, either by you or by  someone else. If you have a good reason
> to resend this message to the list (for instance because you have been notified
> of a hardware failure with loss of  data), please alter the text of the message
> in some way and  resend it to the list. Note that  altering the "Subject:" line
> or adding blank  lines at the top  or bottom of the message  is not sufficient;
> you should  instead add a  sentence or  two at the  top explaining why  you are
> resending the  message, so that the  other subscribers understand why  they are
> getting two copies of the same message.

I only sent one copy of each email, and messages are being posted to the
list AFAIK.

Ken

From dustin.baer at IHS.COM  Fri Jul 18 17:09:33 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:18:59 2006
Subject: not reading spam.assassin.prefs.conf
References: <3F17F33F.CD0C6B74@ihs.com> <3F181A8E.3010506@pacific.net>
Message-ID: <3F181BBD.78DB0EED@ihs.com>

Ken Anderson wrote:
>
> SA also looks at /etc/spamassassin/local.cf
> Not sure what you mean by "does not seem to be working", but this file
> may affect how spam.assassin.prefs.conf is used. I don't know in what
> order they are read/applied though.
> Ken A.

Thanks Ken,

"does not seem to be working" means that my customized scoring is not
working.

I don't have an /etc/spamassassin directory.

The manual (perl Makefile.PL, etc.) upgrade didn't work, either, so I
will keep trying.

Thanks for the input.

Dustin

From richard_cipher at YAHOO.COM  Fri Jul 18 17:12:03 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:18:59 2006
Subject: is the list going crazy or is it me?
In-Reply-To: <3F181B90.8050809@pacific.net>
Message-ID: <NHBBIDLEJBNNEMOPKJPNGEMDDBAA.richard_cipher@yahoo.com>

I've had the same happen.  It appears to be a problem.

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Ken Anderson
Sent: Friday, July 18, 2003 10:09 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: is the list going crazy or is it me?


I've sent 3 emails to the list today, and 2 times have received this
warning email back:

> Your message  is being returned to  you unprocessed because it  appears to
have
> already  been distributed  to the  MAILSCANNER list.  That is,  a message
with
> identical text  (but possibly with different  mail headers) has been
posted to
> the list recently, either by you or by  someone else. If you have a good
reason
> to resend this message to the list (for instance because you have been
notified
> of a hardware failure with loss of  data), please alter the text of the
message
> in some way and  resend it to the list. Note that  altering the "Subject:"
line
> or adding blank  lines at the top  or bottom of the message  is not
sufficient;
> you should  instead add a  sentence or  two at the  top explaining why
you are
> resending the  message, so that the  other subscribers understand why
they are
> getting two copies of the same message.

I only sent one copy of each email, and messages are being posted to the
list AFAIK.

Ken
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From dustin.baer at IHS.COM  Fri Jul 18 17:10:09 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:18:59 2006
Subject: is the list going crazy or is it me?
References: <3F181B90.8050809@pacific.net>
Message-ID: <3F181BE1.BCB6BF3F@ihs.com>

Ken Anderson wrote:
>
> I've sent 3 emails to the list today, and 2 times have received this
> warning email back:
>
> > ...
>
> I only sent one copy of each email, and messages are being posted to the
> list AFAIK.
>
> Ken

Same here!

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

From mkettler at EVI-INC.COM  Fri Jul 18 18:00:05 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:59 2006
Subject: not reading spam.assassin.prefs.conf
In-Reply-To: <3F181BBD.78DB0EED@ihs.com>
References: <3F17F33F.CD0C6B74@ihs.com> <3F181A8E.3010506@pacific.net>
Message-ID: <5.2.1.1.0.20030718125727.0199d880@xanadu.evi-inc.com>

At 10:09 AM 7/18/2003 -0600, Dustin Baer wrote:
>Thanks Ken,
>
>"does not seem to be working" means that my customized scoring is not
>working.
>
>I don't have an /etc/spamassassin directory.
>
>The manual (perl Makefile.PL, etc.) upgrade didn't work, either, so I
>will keep trying.
>
>Thanks for the input.

As a suggestion, I usually copy or ln -s my spam.assassin.prefs.conf to
/root/.spamassassin/user_prefs and then run spamassassin --lint to check my
config files for bugs and typos.

There are several commands in the configfile syntax that have changed for
2.5x. In theory these should be irrelevant on a MailScanner setup as they
are almost all related to the report format and html stripping, which
MailScanner does on it's own.

From dustin.baer at IHS.COM  Fri Jul 18 18:02:38 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:18:59 2006
Subject: not reading spam.assassin.prefs.conf - DUH!
References: <3F17F33F.CD0C6B74@ihs.com>
Message-ID: <3F18282E.947D90CF@ihs.com>

Dustin Baer wrote:
>
> I am searching throught the archives also, but thought I would send a
> message here, also.
>
> Solaris 9
> Sendmail 8.12.9
> MailScanner 4.13-3
>
> Yesterday, I upgraded SpamAssassin from 2.43 to 2.55 using perl -MCPAN.
> Now, my spam.assassin.prefs.conf file does not seem to be working.
>
> Any suggestions on where to start?
>
> Thanks for any leads...

NOTHING to do with SpamAssassin.

I edited my spam.assassin.prefs.conf file and instead of using a pipe
(|) to separate keywords to catch in the subject line, I used a slash
(/):

        header   IHS_SUBJECT_JUNK_2 Subject =~ /STEPHANIE/URGENT/

That obviously broke the Perl.

THANK YOU to everyone who responded and also to those who looked into
this and didn't respond.

I will crawl back into my hole, now.

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

From mkettler at EVI-INC.COM  Fri Jul 18 18:30:00 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:59 2006
Subject: is the list going crazy or is it me? - found source of problem to be COINFOTECH.COM
In-Reply-To: <NHBBIDLEJBNNEMOPKJPNGEMDDBAA.richard_cipher@yahoo.com>
References: <3F181B90.8050809@pacific.net>
Message-ID: <5.2.1.1.0.20030718132213.01a0cb10@xanadu.evi-inc.com>

At 10:12 AM 7/18/2003 -0600, you wrote:
>I've had the same happen.  It appears to be a problem.
>
>Evert Ford
>Information Analyst
>Westone Laboratories
>http://www.westone.com

If you look at the headers in the rejected messages it's a broken
mailserver that's looping messages back to the list, presumably by
delivering based on the To: address instead of the envelope (a common
mistake to make in custom scripts).

See:

Received: from mailsvc.com (iowa.coinfotech.com [209.12.32.105])
         by ori.rl.ac.uk (8.11.1/8.11.1) with ESMTP id h6IH1uS14042
         for <MAILSCANNER@jiscmail.ac.uk>; Fri, 18 Jul 2003 18:01:57 +0100
Received: by mailsvc.com (CommuniGate Pro PIPE 4.0.6)
   with PIPE id 12184636; Fri, 18 Jul 2003 10:57:08 -0600
Received: from smtp.jiscmail.ac.uk ([130.246.192.48] verified)
   by mailsvc.com (CommuniGate Pro SMTP 4.0.6)
   with ESMTP id 12184630 for xxxxx@COINFOTECH.COM; Fri, 18 Jul 2003
10:57:03 -0600


(I censored the subscriber's address for politeness, although it can be
readily figured out by the recipients of the bounces)

From shawn at ADVANCEDMANAGED.COM  Fri Jul 18 19:07:43 2003
From: shawn at ADVANCEDMANAGED.COM (shawn)
Date: Thu Jan 12 21:18:59 2006
Subject: bayes autolearn
Message-ID: <00b401c34d57$7c3de330$3cced7c0@pong>

If your mailscanner installation is just a relay, with the email
addresses not local, is it wise to use bayes with the db built only with
autolearn?  Having outlook users use resend to a spam/notspam address is
not an option.



Also are mailscanner whitelisted items still put thru spamassassin for
autolearning?



Tia

shawn

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030718/7c5b7415/attachment.html
From vboulytchev at COINFOTECH.COM  Fri Jul 18 19:19:37 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:18:59 2006
Subject: Bcc not going through
Message-ID: <1958DE295D9656499ECAAD3642822DE0033F8D@willow.office.coinfotech.com>

Ladies and Gents,
    I use Communigate Pro for my email server.  I see when the
/Submitted/ directory has a .bad file, the recipients field is set to
"Undisclosed".  When I push an email with someone with BCC field filled
out, email disapears.
 
 
Any suggestions?
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030718/7b0358a6/attachment.html
From evertjan at VANRAMSELAAR.NL  Fri Jul 18 19:25:48 2003
From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar)
Date: Thu Jan 12 21:18:59 2006
Subject: Bcc not going through
In-Reply-To: <1958DE295D9656499ECAAD3642822DE0033F8D@willow.office.coinfotech.com>
References: <1958DE295D9656499ECAAD3642822DE0033F8D@willow.office.coinfotech.com>
Message-ID: <3F183BAC.2070908@vanramselaar.nl>

Boulytchev, Vasiliy wrote:
> Ladies and Gents,
>     I use Communigate Pro for my email server.  I see when the
> /Submitted/ directory has a .bad file, the recipients field is set to
> "Undisclosed".  When I push an email with someone with BCC field filled
> out, email disapears.

This list is NOT about Communigate, but about MailScanner. AFAIK
MailScanner does not support Communigate. See www.mailscanner.info for
more about MailScanner.

Btw, please turn off HTML when sending mail to mailinglists.

--
   Evert Jan van Ramselaar  <evertjan@vanramselaar.nl>
   Van Ramselaar Info Tech  <http://www.vanramselaar.nl>

From evertjan at VANRAMSELAAR.NL  Fri Jul 18 19:31:23 2003
From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar)
Date: Thu Jan 12 21:18:59 2006
Subject: Bcc not going through
In-Reply-To: <1958DE295D9656499ECAAD3642822DE0033F8D@willow.office.coinfotech.com>
References: <1958DE295D9656499ECAAD3642822DE0033F8D@willow.office.coinfotech.com>
Message-ID: <3F183CFB.9070508@vanramselaar.nl>

Boulytchev, Vasiliy wrote:
> Ladies and Gents,
>     I use Communigate Pro for my email server.  I see when the
> /Submitted/ directory has a .bad file, the recipients field is set to
> "Undisclosed".  When I push an email with someone with BCC field filled
> out, email disapears.

And PLEASE fix your mailserver!! It is resending all messages from this
list back to this same list, resulting in error messages to the original
sender!

And PLEASE fix it NOW!

--
   Evert Jan van Ramselaar  <evertjan@vanramselaar.nl>
   Van Ramselaar Info Tech  <http://www.vanramselaar.nl>

From kevins at BMRB.CO.UK  Fri Jul 18 19:39:18 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:59 2006
Subject: Bcc not going through
In-Reply-To: <3F183CFB.9070508@vanramselaar.nl>
References: <1958DE295D9656499ECAAD3642822DE0033F8D@willow.office.coinfotech.com>
            <3F183CFB.9070508@vanramselaar.nl>
Message-ID: <1058553559.4382.15.camel@bach.kevinspicer.co.uk>

> And PLEASE fix your mailserver!! It is resending all messages from this
> list back to this same list, resulting in error messages to the original
> sender!
>
> And PLEASE fix it NOW!
>
Or at least have the courtesy to unsubscribe until you have fixed it
(you could always re-subscribe with a hotmail account or similar)




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mailscanner at ELKNET.NET  Fri Jul 18 21:57:50 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:18:59 2006
Subject: From = to
Message-ID: <200307182058.h6IKw1S08416@ori.rl.ac.uk>

I searched the archives, but didn't find an answer, so I'm trying here.
Thanks in advance for any help :)

We see a number of spams coming in where the 'From:' address has been set by the spammer to be the same as the 'To:' address.
When MS detects these, a bounce message typically consisting of the 'Sender Spamassassin Report', it sends the bounce message to the spam's 'From:' address. As the 'From:' was forged to be the same as the intended recepient of the spam, its that poor recepient who gets the bounce message.

They quickly in turn email us screaming "I didn't send out that spam, especially not to myself!"

So, what I'm looking for is some means of bypassing the 'bounce' action anytime the 'From:' or the 'Rely to:' is the same as the 'To:' address.

Any ideas?

-Alan

From kevins at BMRB.CO.UK  Fri Jul 18 22:12:58 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:18:59 2006
Subject: From = to
In-Reply-To: <200307182058.h6IKw1S08416@ori.rl.ac.uk>
References: <200307182058.h6IKw1S08416@ori.rl.ac.uk>
Message-ID: <1058562779.5559.18.camel@bach.kevinspicer.co.uk>

> So, what I'm looking for is some means of bypassing the 'bounce' action anytime the 'From:' or the 'Rely to:' is the same as the 'To:' address.
>
> Any ideas?
>
Can't you just make spam actions a ruleset along the lines of...

From:   *@yourdomain.com        delete
FromorTo:       default         bounce






BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From mkettler at EVI-INC.COM  Fri Jul 18 22:38:54 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:18:59 2006
Subject: From = to
In-Reply-To: <200307182058.h6IKw1S08416@ori.rl.ac.uk>
Message-ID: <5.2.1.1.0.20030718172953.01850750@xanadu.evi-inc.com>

At 03:57 PM 7/18/2003 -0500, Alan Fiebig wrote:
>So, what I'm looking for is some means of bypassing the 'bounce' action
>anytime the 'From:' or the 'Rely to:' is the same as the 'To:' address.
>
>Any ideas?

(note: the following is my opinion, but it's at least one that comes from a
fairly well thought-out perspective).

My suggestion would be to not use bounce at all. The way it's done in
MailScanner (which is really the best that MS can do) is pretty much
hopelessly broken and abuses other networks.

99.99% of spam has a forged From: address, so bouncing these messages
increases the severity of joe-jobs. The only useful function it provides is
in the case of a false positive, the sender is notified. However, if your
false-positive rate is reasonable, at least 99% of your bounce messages are
just going to some poor guy that got joe-jobbed.

That's a "more harm than good" situation by a ratio of approximately 100:1.

silent deletion isn't exactly a good idea either, but it's at least it
isn't dumping your spam problems back onto another network.

I'd say best practice is to tag-only or quarantine for hand review.
Bouncing with MS is just a bad idea that is only attractive to those who
like to litter in other people's yards.

From mailscanner at LISTS.COM.AR  Fri Jul 18 22:43:04 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:59 2006
Subject: ZMailer + MailScanner
Message-ID: <3F183FB8.30554.165D49C7@localhost>

Hi there,

a guy who works with me wrote the initial code that allowed MailScanner to 
work along with ZMailer.

I maintain it and wrote the simple instructions in: 
http://www.sng.ecs.soton.ac.uk/mailscanner/install/zmailer.shtml

As I said there, I didn't have a proper init.d script... in fact, I never had 
installed either ZMailer or MailScanner from RPM... I'm usually more 
comfortable compiling my most critical pieces of software, and my mail 
server, certainly is critical.

However I could argue that if you're running ZMailer, then "you should know" 
and if you just want to plain run a MailScanner, you'll be more comfortable 
using either Sendmail or Postfix, I just got a hand on a spare old pentium 
with redhat in it and I installed ZMailer from rpm using the closest to an 
official ZMailer rpm, which is the one developed by Xos? V?zquez, found at 
http://rpmfind.net/linux/RPM/contrib/libc6/i386/zmailer-2.99.55-5.i386.html

Then I installed the latest MailScanner 4.22-5 RPM following the 
instructions.

Finally, I modified the necesary files in both so they work together.

I'm attaching 3 files:
modify-zmailer.sh: 
  is a script to create the /var/spool/postoffice-incoming hierarchy, with
  the proper subdirectories and permissions.

ZMailer-2.99.55-5.rpm-MailScanner.patch:
  is a small patch that modifies the main ZMailer configuration file, 
  /etc/zmailer/zmailer.conf so that smtpserver works in that new hierarchy.

MailScanner-4.22-5.rpm-ZMailer.patch:
  is a patch that modifies the following files:
  /etc/rc.d/init.d/MailScanner
  /etc/sysconfig/MailScanner
  /etc/MailScanner/MailScanner.conf
  so that MailScanner works with ZMailer.

You have to be root to make this:

0) Install ZMailer and MailScanner from the rpm's.

1) stop ZMailer if it's running, and disable its startup script (as you do 
with Sendmail previous to run MailScanner):
  service zmailer stop
  chkconfig zmailer off

2) run the included shell script:
  ./modify-zmailer.sh
This will check that you're root, will ask for confirmation, and then, it'll 
create a bunch of directories... it's a simple script, I used "-v" in most 
commands so you can see what's beeing done.

3) Patch ZMailer:
  cd /
  patch -p0 < /path/to/ZMailer-2.99.55-5.rpm-MailScanner.patch

4) Patch MailScanner:
  cd /
  patch -p0 < /path/to/MailScanner-4.22-5.rpm-ZMailer.patch

5) Enable and start MailScanner. This will also start ZMailer:
  chkconfig --add MailScanner
  chkconfig MailScanner on
  service MailScanner start

voil?!


--
Mariano Absatz
El Baby
----------------------------------------------------------
I write all my critical routines in assembler, and my comedy routines in
FORTRAN.
                  -- Anonymous


-------------- next part --------------
A non-text attachment was scrubbed...
Name: modify-zmailer.sh
Type: application/octet-stream
Size: 1067 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030718/147a4287/modify-zmailer.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ZMailer-2.99.55-5.rpm-MailScanner.patch
Type: application/octet-stream
Size: 624 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030718/147a4287/ZMailer-2.99.55-5.rpm-MailScanner.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: MailScanner-4.22-5.rpm-ZMailer.patch
Type: application/octet-stream
Size: 9247 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030718/147a4287/MailScanner-4.22-5.rpm-ZMailer.obj
From mailscanner at LISTS.COM.AR  Fri Jul 18 23:06:25 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:18:59 2006
Subject: MailScanner startup script standalone
Message-ID: <3F184531.9360.1672ACCC@localhost>

Hi,

in case someone is interested, based on some old MailScanner startup script,
I modified it so that it only cares about MailScanner itself and not about
the MTA.

In fact, this is the way I prefer to handle it, I have a separate startup
script for ZMailer and this one for MailScanner.

Whenever both are related services and mail won't be delivered if both aren't
running, I can start and stop both of them independently and nothing
brakes... only mail can accumulate in one or another queue.

When something goes wrong, I like the ability to stop only a part and watch
the queues by hand.

In fact, with the standard zmailer script (the zmailer command, not the
startup script) I can independently start or stop the different daemons...
MailScanner would be a fourth daemon in here, with its own startup script.

The script is quite simple and works nicely in redhat, I don't know about
other flavors of linux, but it should be easier to adapt than the standard
MailScanner startup script, since it's smaller.

Enjoy it!

--
Mariano Absatz
El Baby
----------------------------------------------------------
Everyone must believe in something. I believe I'll have another drink.
      -- W.C. Fields


-------------- next part --------------
A non-text attachment was scrubbed...
Name: MailScanner
Type: application/octet-stream
Size: 3522 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030718/99544a04/MailScanner.obj
From mailscanner at LISTS.COM.AR  Fri Jul 18 23:27:55 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:00 2006
Subject: scripts & patches for download
Message-ID: <3F184A3B.23580.16865C27@localhost>

Hi,

I know, my Pegasus mail client has too much personality for adding some text
attachments...

I uploaded all the patches and scripts I sent so you can download them from
the web...

The patches and script for using ZMailer and MailScanner from rpm's are in
http://baby.com.ar/MailScanner/ZMailer.rpm.patches/

The standalone startup script (so you can start it independently from the
MTA) is in
http://baby.com.ar/MailScanner/StandAloneStartupScript/MailScanner

Finally, Julian, when you're back, would you replace the
/etc/rc.d/init.d/MailScanner and /etc/sysconfig/MailScanner files in the rpm
with the ones at
http://baby.com.ar/MailScanner/ModifiedFilesForMailScannerDistribution/ ?

This would incorporate ZMailer into the rpm distribution.

I'll modify the web page at
http://www.sng.ecs.soton.ac.uk/mailscanner/install/zmailer.shtml
and post it so you can upgrade that too.

Have a nice weekend!


--
Mariano Absatz
El Baby
----------------------------------------------------------
What is a "free" gift ? Aren't all gifts free?

From so-mlist-alias at ALL-ABOUT-SHIFT.COM  Sat Jul 19 13:58:05 2003
From: so-mlist-alias at ALL-ABOUT-SHIFT.COM (Soeren Gerlach)
Date: Thu Jan 12 21:19:00 2006
Subject: Fw: bayes autolearn
Message-ID: <009601c34df5$6c2fbce0$6301010a@vaiosan>

I do have the same setup (two mail servers configured via MX as relays) and
I do the following with quite remarkable results:

 * Quanrantine "high score spam" messages
 * Collect them once a day from the two relays to another consolidation
server
 * There use the "sa-learn" from S.A.
 * Additionally I feed the mails back to the razor network
 * copy back the resulting database to the two relays (MailScanner must be
stopped while copying back because of file locks)

With now some 5.000+ Spam messages it increases the overall "yield" quite
good. The problem with autolearn that the "ham" portion of the mail is only
usefull one a single user basis (there're some articels about this issue on
the net) because of the often individual dictionaries a user's mail have,
while the spam portion on the other hand isn't.

regards,
Soeren Gerlach

----- Original Message -----
From: "shawn" <shawn@ADVANCEDMANAGED.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, July 18, 2003 8:07 PM
Subject: bayes autolearn


> If your mailscanner installation is just a relay, with the email
> addresses not local, is it wise to use bayes with the db built only with
> autolearn?  Having outlook users use resend to a spam/notspam address is
> not an option.
>
>
>
> Also are mailscanner whitelisted items still put thru spamassassin for
> autolearning?
>
>
>
> Tia
>
> shawn

From mailscanner at ELKNET.NET  Sat Jul 19 23:06:13 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:19:00 2006
Subject: From = to
Message-ID: <B0070858532@mail.elknet.net>

Well, this idea is certainly a start. But it would end up in MS blindly deleting any spams sent by my customers to my customers.

Thanks!

>> So, what I'm looking for is some means of bypassing the 'bounce' action anytime the 'From:' or the 'Rely to:' is the same as the 'To:' address.
>>
>> Any ideas?
>>
>Can't you just make spam actions a ruleset along the lines of...
>
>From:   *@yourdomain.com        delete
>FromorTo:       default         bounce

From mailscanner at ELKNET.NET  Sat Jul 19 23:04:57 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:19:00 2006
Subject: From = to
Message-ID: <B0070858488@mail.elknet.net>

I can't hand examine 66,000+ quarantined spams per day.

I also can't afford to blindly delete. Far to many potential instances have already arisen where a customer 'Wanted' the spam, and only knew it was being filtered because the bounce wnet to the sender, who notified the recepient. We deal with about a dozen complaints per day from those that receive the bounce messages and want to resolve the issues. Sometimes we whitelist them, sometimes our customer opts-out of our filters, sometimes the sender adjusts their message. So the bounces ARE working and necessary for me.

Tag only is also worthless for the vast majority of my customers. They would have no idea what to do with the tag, they would simply be getting all the spam like always. Setting client filters to sort or delete based upon a tag is beyond them.

Thanks for the reply though.

>My suggestion would be to not use bounce at all. The way it's done in
>MailScanner (which is really the best that MS can do) is pretty much
>hopelessly broken and abuses other networks.
>
>99.99% of spam has a forged From: address, so bouncing these messages
>increases the severity of joe-jobs. The only useful function it provides is
>in the case of a false positive, the sender is notified. However, if your
>false-positive rate is reasonable, at least 99% of your bounce messages are
>just going to some poor guy that got joe-jobbed.
>
>That's a "more harm than good" situation by a ratio of approximately 100:1.
>
>silent deletion isn't exactly a good idea either, but it's at least it
>isn't dumping your spam problems back onto another network.
>
>I'd say best practice is to tag-only or quarantine for hand review.
>Bouncing with MS is just a bad idea that is only attractive to those who
>like to litter in other people's yards.

From Antony at SOFT-SOLUTIONS.CO.UK  Sat Jul 19 22:45:20 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:00 2006
Subject: From = to
In-Reply-To: <200307182058.h6IKw1S08416@ori.rl.ac.uk>
References: <200307182058.h6IKw1S08416@ori.rl.ac.uk>
Message-ID: <200307192145.h6JLjPi12710@Primary.networker.test>

On Friday 18 July 2003 9:57 pm, Alan Fiebig wrote:

> We see a number of spams coming in where the 'From:' address has been set
> by the spammer to be the same as the 'To:' address. When MS detects these,
> a bounce message typically consisting of the 'Sender Spamassassin Report',
> it sends the bounce message to the spam's 'From:' address. As the 'From:'
> was forged to be the same as the intended recepient of the spam, its that
> poor recepient who gets the bounce message.
>
> They quickly in turn email us screaming "I didn't send out that spam,
> especially not to myself!"
>
> So, what I'm looking for is some means of bypassing the 'bounce' action
> anytime the 'From:' or the 'Rely to:' is the same as the 'To:' address.
>
> Any ideas?

Is there any mileage in creating yourself a SpamAssassin rule which picks up
on From=To, and assigning it a high enough score that it reaches your
MailScanner High Spam Score, which you can then delete?

Antony.

--

The truth is rarely pure, and never simple.

 - Oscar Wilde

From kevins at BMRB.CO.UK  Sat Jul 19 23:10:45 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:19:00 2006
Subject: From = to
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175EC9@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175EC9@pascal.priv.bmrb.co.uk>
Message-ID: <1058652649.15041.7.camel@bach.kevinspicer.co.uk>

On Sat, 2003-07-19 at 23:06, Alan Fiebig wrote:

Well, this idea is certainly a start. But it would end up in MS blindly
deleting any spams sent by my customers to my customers.

Presumably you mean false positives, since I can't imagine you'd be
particularly keen on your customers spamming anyone through your
server.  A suggestion (not knowing your setup this may or may not be a
good one!), set up a ruleset so that only incoming mail (external to
your network) is checked for spam [you would need to do this by IP range
not domain] and also apply the ruleset I suggested previously.  This
would also improve performance on outgoing mail.

Failing that, get your hands dirty with a little perl and write a custom
config module (in CustomConfig.pm) which checks if the From and To
addresses are identical [or better, whether it comes from a local domain
but an IP external to your network] and use this for spam actions.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From Antony at SOFT-SOLUTIONS.CO.UK  Sun Jul 20 00:08:11 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:00 2006
Subject: From = to
In-Reply-To: <200307192145.h6JLjPi12710@Primary.networker.test>
References: <200307182058.h6IKw1S08416@ori.rl.ac.uk>
            <200307192145.h6JLjPi12710@Primary.networker.test>
Message-ID: <200307192308.h6JN8Go22533@Primary.networker.test>

On Saturday 19 July 2003 10:45 pm, Antony Stone wrote:

> Is there any mileage in creating yourself a SpamAssassin rule which picks
> up on From=To, and assigning it a high enough score that it reaches your
> MailScanner High Spam Score, which you can then delete?

This seemed like a neat opportunity to write my first SpamAssassin rule, so I
thought I'd give it a try.

I came up with this:

In the file /usr/lib/perl5/site_perl/Mail/SpamAssassin/EvalTests.pm there is
already a function called check_for_from_to_same (which is badly named,
because it explicitly does *not* match the from and to addresses being
identical - only if they are 'similar'....)

Using this as a template, I created a new function:

sub check_for_from_to_identical {
  my ($self) = @_;

  my $addr_from = $self->get('From:addr');
  my $addr_to = $self->get('To:addr');
  $addr_from =~ s/\s+//g;
  $addr_to =~ s/\s+//g;
  return 1 if ($addr_from eq $addr_to);
  return 0;
}

I then added three lines to /opt/MailScanner/etc/spam.assassin.prefs.conf:

header FROM_AND_TO_IDENTICAL eval:check_for_from_to_identical()
describe FROM_AND_TO_IDENTICAL From and To are the same address
score FROM_AND_TO_IDENTICAL 20

The only thing which bothers me slightly about this idea is that I think I
see some emails from genuine mailing lists which set the from and to
addresses to the same thing - I disapprove of that, but it would lead to some
false positivies if the mailing lists aren't whitelisted....

Anyway, have fun,

Antony.

--

It is also possible that putting the birds in a laboratory setting
inadvertently renders them relatively incompetent.

 - Daniel C Dennett

From jrudd at UCSC.EDU  Sun Jul 20 06:43:59 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:00 2006
Subject: .bad files continued
In-Reply-To: <1058478127.6635.25.camel@bach.kevinspicer.co.uk>
Message-ID: <295D16EA-BA75-11D7-873F-003065F939FE@ucsc.edu>

On Thursday, Jul 17, 2003, at 14:42 US/Pacific, Kevin Spicer wrote:

> On Thu, 2003-07-17 at 22:14, Boulytchev, Vasiliy wrote:
>> Ladies and Gents,
>>    cgp2ms is adding RPFD to the recipients line.  Why its doing that,
>> I have no clue.  Another thing that is bazaar, is I have a few domains
>> working with no problems, its just this one.........  It does have a
>> route rule in Communigate, but how would that affect
>> anything......................  If I take those stupid RPFD: out from
>> those .bad files, and copy them to .sub, communigate pushes the files.
>
> Perhaps you should try a mailing list for communicate users?  This
> doesn't sound like any symptom I've seen anyone report on this list -
> so
> its probably a Communigate issue.  You could try ruling out MailScanner
> by taking it out of the mix temporarily.
>
>

It's related to the glue scripts I wrote between CommuniGate Pro and
MailScanner.  IIRC, it's caused when MailScanner is generating its own
messages.  I have a fix for it that I'm putting out in the next couple
days.

From tony.johansson at SVENSKAKYRKAN.SE  Sun Jul 20 19:32:32 2003
From: tony.johansson at SVENSKAKYRKAN.SE (Tony Johansson)
Date: Thu Jan 12 21:19:00 2006
Subject: Fw: bayes autolearn
Message-ID: <LISTSERV%2003072019323269@JISCMAIL.AC.UK>

On Sat, 19 Jul 2003 14:58:05 +0200, Soeren Gerlach <so-mlist-alias@ALL-
ABOUT-SHIFT.COM> wrote:

>I do have the same setup (two mail servers configured via MX as relays) and
>I do the following with quite remarkable results:
>
> * Quanrantine "high score spam" messages
> * Collect them once a day from the two relays to another consolidation
>server
> * There use the "sa-learn" from S.A.
> * Additionally I feed the mails back to the razor network
> * copy back the resulting database to the two relays (MailScanner must be
>stopped while copying back because of file locks)
>
>With now some 5.000+ Spam messages it increases the overall "yield" quite
>good. The problem with autolearn that the "ham" portion of the mail is only
>usefull one a single user basis (there're some articels about this issue on
>the net) because of the often individual dictionaries a user's mail have,
>while the spam portion on the other hand isn't.
>
>regards,
>Soeren Gerlach

How much ham do you use when training?
From so-mlist-alias at ALL-ABOUT-SHIFT.COM  Sun Jul 20 21:27:09 2003
From: so-mlist-alias at ALL-ABOUT-SHIFT.COM (Soeren Gerlach)
Date: Thu Jan 12 21:19:00 2006
Subject: Fw: bayes autolearn
References: <LISTSERV%2003072019323269@JISCMAIL.AC.UK>
Message-ID: <000801c34efd$50882d20$6301010a@vaiosan>

> On Sat, 19 Jul 2003 14:58:05 +0200, Soeren Gerlach <so-mlist-alias@ALL-
> ABOUT-SHIFT.COM> wrote:
>
> >I do have the same setup (two mail servers configured via MX as relays)
and
> >I do the following with quite remarkable results:
> >
> > * Quanrantine "high score spam" messages
> > * Collect them once a day from the two relays to another consolidation
> >server
> > * There use the "sa-learn" from S.A.
> > * Additionally I feed the mails back to the razor network
> > * copy back the resulting database to the two relays (MailScanner must
be
> >stopped while copying back because of file locks)
> >
> >With now some 5.000+ Spam messages it increases the overall "yield" quite
> >good. The problem with autolearn that the "ham" portion of the mail is
only
> >usefull one a single user basis (there're some articels about this issue
on
> >the net) because of the often individual dictionaries a user's mail have,
> >while the spam portion on the other hand isn't.
> >
> >regards,
> >Soeren Gerlach
>
> How much ham do you use when training?
> From http://www.spamassassin.org/doc/sa-learn.html
> "It's also worth noting that training with a very small quantity of ham,
> will produce atrocious results. You should aim to train with at least the
> same amount (or more if possible!) of ham data than spam"

I use no ham at all, spam only works quite well.


regards,
Soeren

From kfliong at WOFS.COM  Mon Jul 21 03:25:46 2003
From: kfliong at WOFS.COM (kfliong)
Date: Thu Jan 12 21:19:00 2006
Subject: emails with No Message Collected
In-Reply-To: <5.2.1.1.0.20030716151522.02674a98@192.168.10.2>
References: <1058337818.13524.19.camel@bach.kevinspicer.co.uk>
            <5C0296D26910694BB9A9BBFC577E7AB001175E47@pascal.priv.bmrb.co.uk>
            <5C0296D26910694BB9A9BBFC577E7AB001175E47@pascal.priv.bmrb.co.uk>
Message-ID: <5.2.1.1.0.20030721102324.027057c8@192.168.10.2>

I have no idea why sendmail is interfering with the mails. Could someone
please tell me how I could go about to find out the problem?

Would re-installing MailScanner help? And if I re-install MailScanner, do I
need to remove the old version first? What about MailWatch 0.2? Do I need
to do something with that as well?

Thanks in advance.


At 03:43 PM 7/16/2003 +0800, you wrote:
>I have check and both sendmail and MS is using flock.
>
>I see this in MS.conf file - Lock Type = flock
>
>So, both is flock type.
>
>Here is a short list of what i get when it tail maillog.
>
>MTP, daemon=MTA, relay=215.Red-80-36-94.pooles.rima-tde.net [80.36.94.215]
>Jul 16 15:38:00 ensim sendmail[12706]: h6GJbnV12706: to=<adverts@wofs.com>,
>delay=00:00:07, mailer=virthostmail, pri=32201, stat=queued
>Jul 16 15:38:01 ensim MailScanner[12047]: New Batch: Found 2 messages waiting
>Jul 16 15:38:01 ensim MailScanner[12047]: New Batch: Scanning 1 messages,
>2762 bytes
>Jul 16 15:38:01 ensim MailScanner[12098]: Spam Checks: Found 1 spam messages
>Jul 16 15:38:01 ensim sendmail[12765]: h6GJc1l12765: from=<>, size=999,
>class=0, nrcpts=1,
>msgid=<200307161938.h6GJc1l12765@ensim.wofsproperties.com>,
>relay=root@localhost
>Jul 16 15:38:01 ensim MailScanner[12098]: Virus and Content Scanning: Starting
>Jul 16 15:38:03 ensim sendmail[12768]: h6GJc1l12765:
>to=mariawantsu@compuserve.com, delay=00:00:02, xdelay=00:00:02,
>mailer=esmtp, pri=30999, relay=mx2.compuserve.com. [149.174.40.8],
>dsn=2.0.0, stat=Sent (h6G7hpAR016440 Message accepted for delivery)
>Jul 16 15:38:05 ensim MailScanner[12047]: Spam Checks: Found 1 spam messages
>Jul 16 15:38:05 ensim sendmail[12775]: h6GJc5912775: from=<>, size=937,
>class=0, nrcpts=1,
>msgid=<200307161938.h6GJc5912775@ensim.wofsproperties.com>,
>relay=root@localhost
>Jul 16 15:38:05 ensim MailScanner[12047]: Virus and Content Scanning: Starting
>Jul 16 15:38:06 ensim sendmail[12778]: h6GJc5912775:
>to=mariawantsu@yahoo.com, delay=00:00:01, xdelay=00:00:01, mailer=esmtp,
>pri=30937, relay=mx2.mail.yahoo.com. [64.156.215.5], dsn=5.0.0,
>stat=Service unavailable
>Jul 16 15:38:06 ensim sendmail[12778]: h6GJc5912775: h6GJc6812778:
>postmaster notify: Service unavailable
>Jul 16 15:38:06 ensim sendmail[12778]: h6GJc6812778: to=root,
>delay=00:00:00, xdelay=00:00:00, mailer=local, pri=31037, dsn=2.0.0, stat=Sent
>Jul 16 15:38:23 ensim sendmail[12815]: h6GJcNh12815: from=apache, size=832,
>class=0, nrcpts=1,
>msgid=<200307161938.h6GJcNh12815@ensim.wofsproperties.com>,
>relay=apache@localhost
>Jul 16 15:38:25 ensim sendmail[12818]: h6GJcNh12815: to=izancj@hotmail.com,
>ctladdr=apache (48/48), delay=00:00:02, xdelay=00:00:02, mailer=esmtp,
>pri=30832, relay=mx4.hotmail.com. [65.54.254.151], dsn=2.0.0, stat=Sent (
><200307161938.h6GJcNh12815@ensim.wofsproperties.com> Queued mail for delivery)
>
>Well, I am not sure if this is correct, but how come some mails are being
>handled by MailScanne and some by sendmail?
>
>Thanks in advance.
>
>At 07:43 AM 7/16/2003 +0100, you wrote:
>>On Wed, 2003-07-16 at 03:23, kfliong wrote:
>>
>>I have checked and my "noetrn" command is in the init script. So, what
>>else
>>could be the reason?
>>
>>Maybe a locking problem?  Check that sendmail and MS are using the same
>>lock type (and that none of your mail spools are on NFS shares).  You
>>can find sendmails lock type as described below (from sendmails site)...
>>
>>
>>"You can determine which locking system is used by sendmail from the
>>output of:
>>
>>         sendmail -bt -d0.10 < /dev/null | grep HASFLOCK
>>
>>If HASFLOCK is in the output, your system is using flock() for locking.
>>Otherwise, it is using fcntl() for locking.  "
>>
>>fcntl() is called 'posix' in MS, check that 'Lock Type' in MS.conf is
>>set to the correct type (or commented out if sendmail is using flock()).
>>
>>Failing that - have you checked for anything unusual in the maillog?
>>
>>
>>
>>
>>
>>BMRB International
>>http://www.bmrb.co.uk
>>+44 (0)20 8566 5000
>>_________________________________________________________________
>>This message (and any attachment) is intended only for the
>>recipient and may contain confidential and/or privileged
>>material.  If you have received this in error, please contact the
>>sender and delete this message immediately.  Disclosure, copying
>>or other action taken in respect of this email or in
>>reliance on it is prohibited.  BMRB International Limited
>>accepts no liability in relation to any personal emails, or
>>content of any email which does not directly relate to our
>>business.

From kevins at BMRB.CO.UK  Mon Jul 21 05:25:07 2003
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:19:00 2006
Subject: emails with No Message Collected
In-Reply-To: <5C0296D26910694BB9A9BBFC577E7AB001175ED1@pascal.priv.bmrb.co.uk>
References: <5C0296D26910694BB9A9BBFC577E7AB001175ED1@pascal.priv.bmrb.co.uk>
Message-ID: <1058761507.12045.14.camel@bach.kevinspicer.co.uk>

On Mon, 2003-07-21 at 03:25, kfliong wrote:


>Could someone
>please tell me how I could go about to find out the problem?

Could you please identify an affected message, look for the sendmail
message ID in its headers and then grep the maillog for the message ID
and post what you find  (previously you tailed the maillog, it wasn't
clear whether that showed anything happening that sholdn't have).





BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

From P.G.M.Peters at utwente.nl  Mon Jul 21 10:39:42 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:19:00 2006
Subject: is the list going crazy or is it me?
In-Reply-To: <3F181B90.8050809@pacific.net>
References: <3F181B90.8050809@pacific.net>
Message-ID: <c4dnhv4ka7uro3gsr420q7883itc3dcpln@4ax.com>

On Fri, 18 Jul 2003 09:08:48 -0700, you wrote:

>> Your message  is being returned to  you unprocessed because it  appears to have
>> already  been distributed  to the  MAILSCANNER list.  That is,  a message  with
>> identical text  (but possibly with different  mail headers) has been  posted to
>> the list recently, either by you or by  someone else. If you have a good reason
>> to resend this message to the list (for instance because you have been notified
>> of a hardware failure with loss of  data), please alter the text of the message
>> in some way and  resend it to the list. Note that  altering the "Subject:" line
>> or adding blank  lines at the top  or bottom of the message  is not sufficient;
>> you should  instead add a  sentence or  two at the  top explaining why  you are
>> resending the  message, so that the  other subscribers understand why  they are
>> getting two copies of the same message.
>
>I only sent one copy of each email, and messages are being posted to the
>list AFAIK.

I my case I get a message stating that my address is not on the
subscriberslist and the message will not be processed. But my e-mail
gets distributed.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From davidj at IMPOL.NET  Mon Jul 21 12:11:37 2003
From: davidj at IMPOL.NET (David Jacobson)
Date: Thu Jan 12 21:19:00 2006
Subject: Fw: MailScanner + Exim spooler - processing, but not delivering mails.
Message-ID: <OF317D4A2F.D8E07D21-ON42256D6A.003D6937-42256D69.003D68DC@impcapital.co.za>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: configure
Type: application/octet-stream
Size: 22644 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/047f2cbc/configure.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: MailScanner.conf
Type: application/octet-stream
Size: 48193 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/047f2cbc/MailScanner.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: MailScanner-init.d
Type: application/octet-stream
Size: 7887 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/047f2cbc/MailScanner-init.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: MailScanner-sysconfig
Type: application/octet-stream
Size: 1003 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/047f2cbc/MailScanner-sysconfig.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: maillog
Type: application/octet-stream
Size: 20148 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/047f2cbc/maillog.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mainlog
Type: application/octet-stream
Size: 3186 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/047f2cbc/mainlog.obj
From davidj at IMPOL.NET  Mon Jul 21 13:23:18 2003
From: davidj at IMPOL.NET (David Jacobson)
Date: Thu Jan 12 21:19:00 2006
Subject: Fw: MailScanner + Exim spooler - processing, but not delivering mails.
In-Reply-To: <20030721114359.GC30668@hoiho.nz.lemon-computing.com>
Message-ID: <OFB6DE814B.1439DC64-ON42256D6A.0043E85A-42256D69.0043F911@impcapital.co.za>

Hi,

Thanks for your prompt reply.  I used to have split incoming and outgoing
directories, however since nothing
was working, to attempt to resolve the problem I made it not split the
directories however yes there are indeed
two exim processes running

PS OUTPUT
-------------------

  PID TTY      STAT   TIME COMMAND
    1 ?        S      0:04 init
    2 ?        SW     0:00 [keventd]
    3 ?        SWN    0:00 [ksoftirqd_CPU0]
    8 ?        SW     0:00 [bdflush]
    4 ?        SW     0:00 [kswapd]
    5 ?        SW     0:00 [kscand/DMA]
    6 ?        SW     0:00 [kscand/Normal]
    7 ?        SW     0:00 [kscand/HighMem]
    9 ?        SW     0:00 [kupdated]
   10 ?        SW     0:00 [mdrecoveryd]
   14 ?        SW     0:00 [kjournald]
   72 ?        SW     0:00 [khubd]
  279 ?        SW     0:00 [kjournald]
  280 ?        SW     0:00 [kjournald]
  281 ?        SW     0:00 [kjournald]
  595 ?        S      0:00 syslogd -m 0
  599 ?        S      0:00 klogd -x
  617 ?        S      0:00 portmap
  636 ?        S      0:00 rpc.statd
  732 ?        S      0:00 /usr/sbin/sshd
  747 ?        S      0:00 xinetd -stayalive -pidfile /var/run/xinetd.pid
  789 ?        S      0:00 gpm -t ps/2 -m /dev/mouse
  798 ?        S      0:00 crond
  820 ?        S      0:00 /usr/sbin/atd
  832 ?        S      0:00 /usr/bin/perl /usr/libexec/webmin/miniserv.pl
/etc/webmin/miniserv.conf
  835 tty1     S      0:00 /sbin/mingetty tty1
  836 tty2     S      0:00 /sbin/mingetty tty2
  837 tty3     S      0:00 /sbin/mingetty tty3
  838 tty4     S      0:00 /sbin/mingetty tty4
  839 tty5     S      0:00 /sbin/mingetty tty5
  840 tty6     S      0:00 /sbin/mingetty tty6
  907 ?        S      0:01 /usr/sbin/sshd
  909 pts/0    S      0:01 -bash
 1732 ?        S      0:00 /usr/exim/bin/exim -C /usr/exim/configure -q15m
 1750 ?        S      0:00 /usr/bin/perl -I/usr/lib/MailScanner
/usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf
 1751 ?        S      0:01 /usr/bin/perl -I/usr/lib/MailScanner
/usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf
 1756 ?        S      0:01 /usr/bin/perl -I/usr/lib/MailScanner
/usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf
 1758 ?        S      0:01 /usr/bin/perl -I/usr/lib/MailScanner
/usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf
 1764 ?        S      0:01 /usr/bin/perl -I/usr/lib/MailScanner
/usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf
 1765 ?        S      0:01 /usr/bin/perl -I/usr/lib/MailScanner
/usr/sbin/MailScanner /etc/MailScanner/MailScanner.conf
 1729 ?        S      0:00 /usr/exim/bin/exim -C /usr/exim/configure -bd
-odq -DSPOOL=/var/spool/exim
 2075 ?        Z      0:00 [exim <defunct>]
 2076 pts/0    R      0:00 ps ax


Kind regards,

David Jacobson
System Architect

Imperial Online - The Imperial Connection

Switchboard     (+27) 11 723-8000
Helpdesk        (+27) 11 723-8181
Mobile          (+27) 83 235-0760
Facsimile       (+27) 11 454 1236
Email           davidj@impol.net

www.imperialonline.co.za / www.imperialtoday.co.za

Confidentiality Notice:
This communication and the information it contains are intended for the
person(s) or organisation(s) named above and for no other person(s) or
organisation(s).
The content of this communication may be confidential, legally privileged
and protected. Unauthorised use, copying or disclosure of any part of this
communication may be unlawful.



Nick Phillips <nwp@LEMON-COMPUTING.COM>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
07/21/2003 01:43 PM
Please respond to
MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>


To
MAILSCANNER@JISCMAIL.AC.UK
cc

Subject
Re: Fw: MailScanner + Exim spooler - processing, but not delivering mails.






On Mon, Jul 21, 2003 at 01:11:37PM +0200, David Jacobson wrote:
> To whom it may concern,
>
> OS : Linux
> Distribution: Redhat 9
> Kernel: 2.4.20-18.9
> MTA: Exim 4.20
> MailScanner: 4.22-5 (RPM)
>
> Mail should work like this
> -------------------------------------
>
> Hits our spooler (MailScanner), it should scan the message then deliver
it
> to the real mail servers where the
> mail boxes reside.
>
> Problem: Mail comes in - I see it in queue for 1 second, it then says
it's
> scanned and delivered and the message
> does not get delivered even though the files are out the queue.
>
> I am using one spool directory...

You do actually have two exim processes, don't you? With separate spool
directories (one each)?


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
You will soon forget this.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/e913fa97/attachment.html
From mailscanner at ELKNET.NET  Mon Jul 21 14:11:58 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:19:00 2006
Subject: From = to
Message-ID: <200307211312.h6LDC0S21092@ori.rl.ac.uk>

Excellent! Thankyou!

>On Saturday 19 July 2003 10:45 pm, Antony Stone wrote:
>
>> Is there any mileage in creating yourself a SpamAssassin rule which picks
>> up on From=To, and assigning it a high enough score that it reaches your
>> MailScanner High Spam Score, which you can then delete?
>
>This seemed like a neat opportunity to write my first SpamAssassin rule, so I
>thought I'd give it a try.
>
>I came up with this:
>
>In the file /usr/lib/perl5/site_perl/Mail/SpamAssassin/EvalTests.pm there is
>already a function called check_for_from_to_same (which is badly named,
>because it explicitly does *not* match the from and to addresses being
>identical - only if they are 'similar'....)
>
>Using this as a template, I created a new function:
>
>sub check_for_from_to_identical {
>  my ($self) = @_;
>
>  my $addr_from = $self->get('From:addr');
>  my $addr_to = $self->get('To:addr');
>  $addr_from =~ s/\s+//g;
>  $addr_to =~ s/\s+//g;
>  return 1 if ($addr_from eq $addr_to);
>  return 0;
>}
>
>I then added three lines to /opt/MailScanner/etc/spam.assassin.prefs.conf:
>
>header FROM_AND_TO_IDENTICAL eval:check_for_from_to_identical()
>describe FROM_AND_TO_IDENTICAL From and To are the same address
>score FROM_AND_TO_IDENTICAL 20
>
>The only thing which bothers me slightly about this idea is that I think I
>see some emails from genuine mailing lists which set the from and to
>addresses to the same thing - I disapprove of that, but it would lead to some
>false positivies if the mailing lists aren't whitelisted....
>
>Anyway, have fun,
>
>Antony.
>
>--
>
>It is also possible that putting the birds in a laboratory setting
>inadvertently renders them relatively incompetent.
>
> - Daniel C Dennett

From steve.douglas at SBIINCORPORATED.COM  Mon Jul 21 15:23:55 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:19:00 2006
Subject: bayes_journal file size
Message-ID: <3963522F0E71474CB14C0FF54A6914F701115254@mail.gardenbotanika.com>

I have incorporated MS with SpamAssassin, but I can not locate where this
bayes database exists.  Am I missing something?  I would like to at minimum
check the size of my database and autolearn if necessary.  Thanks.

SD
:-)


> -----Original Message-----
> From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
> Sent: Wednesday, July 16, 2003 3:16 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: bayes_journal file size
>
> >Is there
> >a setting that I can adjust to put a cap on this
> >bayes_journal file?
>
> You should run   sa-learn --rebuild    periodically.
>
> The other largish file is the bayes_toks file which will initially tend
> to grow quite quickly, as the Bayes engine learns new tokens.  Over time
> this rate of growth will slow, and IIRC tokens which have not been used
> for a while are removed (not sure on that).
>
>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact the
> sender and delete this message immediately.  Disclosure, copying
> or other action taken in respect of this email or in
> reliance on it is prohibited.  BMRB International Limited
> accepts no liability in relation to any personal emails, or
> content of any email which does not directly relate to our
> business.

From wpc4 at DODGETHIS.ORG  Mon Jul 21 15:27:36 2003
From: wpc4 at DODGETHIS.ORG (William Curley)
Date: Thu Jan 12 21:19:00 2006
Subject: bayes_journal file size
References: <3963522F0E71474CB14C0FF54A6914F701115254@mail.gardenbotanika.com>
Message-ID: <004301c34f94$3c4e1490$0600a8c0@dejour>

Unless mailscanner does it differently the bayes_* files are stored under
~/.spamassassin

----- Original Message -----
From: "Steve Douglas" <steve.douglas@SBIINCORPORATED.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Monday, July 21, 2003 7:23 AM
Subject: Re: bayes_journal file size


> I have incorporated MS with SpamAssassin, but I can not locate where this
> bayes database exists.  Am I missing something?  I would like to at
minimum
> check the size of my database and autolearn if necessary.  Thanks.
>
> SD
> :-)
>
>
> > -----Original Message-----
> > From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
> > Sent: Wednesday, July 16, 2003 3:16 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: bayes_journal file size
> >
> > >Is there
> > >a setting that I can adjust to put a cap on this
> > >bayes_journal file?
> >
> > You should run   sa-learn --rebuild    periodically.
> >
> > The other largish file is the bayes_toks file which will initially tend
> > to grow quite quickly, as the Bayes engine learns new tokens.  Over time
> > this rate of growth will slow, and IIRC tokens which have not been used
> > for a while are removed (not sure on that).
> >
> >
> >
> >
> >
> > BMRB International
> > http://www.bmrb.co.uk
> > +44 (0)20 8566 5000
> > _________________________________________________________________
> > This message (and any attachment) is intended only for the
> > recipient and may contain confidential and/or privileged
> > material.  If you have received this in error, please contact the
> > sender and delete this message immediately.  Disclosure, copying
> > or other action taken in respect of this email or in
> > reliance on it is prohibited.  BMRB International Limited
> > accepts no liability in relation to any personal emails, or
> > content of any email which does not directly relate to our
> > business.
>

From TGFurnish at HERFF-JONES.COM  Mon Jul 21 15:29:44 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:00 2006
Subject: bayes_journal file size
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C02E5@inex1.herffjones.hj-int>

If you don't know, then it's probably in some user's .spamassassin directory
(typically root's).  You probably want to look at the config file
/etc/MailScanner/spam.assassin.prefs.conf and ponder this setting:

bayes_path                 /var/spool/spamassassin/bayes

>-----Original Message-----
>From: Steve Douglas [mailto:steve.douglas@SBIINCORPORATED.COM]
>Sent: Monday, July 21, 2003 9:24 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: bayes_journal file size
>
>
>I have incorporated MS with SpamAssassin, but I can not locate
>where this
>bayes database exists.  Am I missing something?  I would like
>to at minimum
>check the size of my database and autolearn if necessary.  Thanks.
>
>SD
>:-)
>
>
>> -----Original Message-----
>> From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
>> Sent: Wednesday, July 16, 2003 3:16 PM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: bayes_journal file size
>>
>> >Is there
>> >a setting that I can adjust to put a cap on this
>> >bayes_journal file?
>>
>> You should run   sa-learn --rebuild    periodically.
>>
>> The other largish file is the bayes_toks file which will
>initially tend
>> to grow quite quickly, as the Bayes engine learns new
>tokens.  Over time
>> this rate of growth will slow, and IIRC tokens which have
>not been used
>> for a while are removed (not sure on that).
>>
>>
>>
>>
>>
>> BMRB International
>> http://www.bmrb.co.uk
>> +44 (0)20 8566 5000
>> _________________________________________________________________
>> This message (and any attachment) is intended only for the
>> recipient and may contain confidential and/or privileged
>> material.  If you have received this in error, please contact the
>> sender and delete this message immediately.  Disclosure, copying
>> or other action taken in respect of this email or in
>> reliance on it is prohibited.  BMRB International Limited
>> accepts no liability in relation to any personal emails, or
>> content of any email which does not directly relate to our
>> business.
>

From steve.douglas at SBIINCORPORATED.COM  Mon Jul 21 15:29:56 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:19:00 2006
Subject: bayes_journal file size
Message-ID: <3963522F0E71474CB14C0FF54A6914F701115255@mail.gardenbotanika.com>

I am not a Linux guru by any stretch, but does ~/.spamassassin imply the
root?

SD
:-)


> -----Original Message-----
> From: William Curley [mailto:wpc4@DODGETHIS.ORG]
> Sent: Monday, July 21, 2003 9:28 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: bayes_journal file size
>
> Unless mailscanner does it differently the bayes_* files are stored under
> ~/.spamassassin
>
> ----- Original Message -----
> From: "Steve Douglas" <steve.douglas@SBIINCORPORATED.COM>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Monday, July 21, 2003 7:23 AM
> Subject: Re: bayes_journal file size
>
>
> > I have incorporated MS with SpamAssassin, but I can not locate where
> this
> > bayes database exists.  Am I missing something?  I would like to at
> minimum
> > check the size of my database and autolearn if necessary.  Thanks.
> >
> > SD
> > :-)
> >
> >
> > > -----Original Message-----
> > > From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
> > > Sent: Wednesday, July 16, 2003 3:16 PM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: bayes_journal file size
> > >
> > > >Is there
> > > >a setting that I can adjust to put a cap on this
> > > >bayes_journal file?
> > >
> > > You should run   sa-learn --rebuild    periodically.
> > >
> > > The other largish file is the bayes_toks file which will initially
> tend
> > > to grow quite quickly, as the Bayes engine learns new tokens.  Over
> time
> > > this rate of growth will slow, and IIRC tokens which have not been
> used
> > > for a while are removed (not sure on that).
> > >
> > >
> > >
> > >
> > >
> > > BMRB International
> > > http://www.bmrb.co.uk
> > > +44 (0)20 8566 5000
> > > _________________________________________________________________
> > > This message (and any attachment) is intended only for the
> > > recipient and may contain confidential and/or privileged
> > > material.  If you have received this in error, please contact the
> > > sender and delete this message immediately.  Disclosure, copying
> > > or other action taken in respect of this email or in
> > > reliance on it is prohibited.  BMRB International Limited
> > > accepts no liability in relation to any personal emails, or
> > > content of any email which does not directly relate to our
> > > business.
> >

From TGFurnish at HERFF-JONES.COM  Mon Jul 21 15:31:32 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:00 2006
Subject: bayes_journal file size
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C02E6@inex1.herffjones.hj-int>

"~" is "current user's home directory", so if you're logged in as root, then
~/.spamassassin is the .spamassassin directory under root's home directory.

>-----Original Message-----
>From: Steve Douglas [mailto:steve.douglas@SBIINCORPORATED.COM]
>Sent: Monday, July 21, 2003 9:30 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: bayes_journal file size
>
>
>I am not a Linux guru by any stretch, but does ~/.spamassassin
>imply the
>root?
>
>SD
>:-)
>
>
>> -----Original Message-----
>> From: William Curley [mailto:wpc4@DODGETHIS.ORG]
>> Sent: Monday, July 21, 2003 9:28 AM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: bayes_journal file size
>>
>> Unless mailscanner does it differently the bayes_* files are
>stored under
>> ~/.spamassassin
>>
>> ----- Original Message -----
>> From: "Steve Douglas" <steve.douglas@SBIINCORPORATED.COM>
>> To: <MAILSCANNER@JISCMAIL.AC.UK>
>> Sent: Monday, July 21, 2003 7:23 AM
>> Subject: Re: bayes_journal file size
>>
>>
>> > I have incorporated MS with SpamAssassin, but I can not
>locate where
>> this
>> > bayes database exists.  Am I missing something?  I would like to at
>> minimum
>> > check the size of my database and autolearn if necessary.  Thanks.
>> >
>> > SD
>> > :-)
>> >
>> >
>> > > -----Original Message-----
>> > > From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
>> > > Sent: Wednesday, July 16, 2003 3:16 PM
>> > > To: MAILSCANNER@JISCMAIL.AC.UK
>> > > Subject: Re: bayes_journal file size
>> > >
>> > > >Is there
>> > > >a setting that I can adjust to put a cap on this
>> > > >bayes_journal file?
>> > >
>> > > You should run   sa-learn --rebuild    periodically.
>> > >
>> > > The other largish file is the bayes_toks file which will
>initially
>> tend
>> > > to grow quite quickly, as the Bayes engine learns new
>tokens.  Over
>> time
>> > > this rate of growth will slow, and IIRC tokens which
>have not been
>> used
>> > > for a while are removed (not sure on that).
>> > >
>> > >
>> > >
>> > >
>> > >
>> > > BMRB International
>> > > http://www.bmrb.co.uk
>> > > +44 (0)20 8566 5000
>> > > _________________________________________________________________
>> > > This message (and any attachment) is intended only for the
>> > > recipient and may contain confidential and/or privileged
>> > > material.  If you have received this in error, please contact the
>> > > sender and delete this message immediately.  Disclosure, copying
>> > > or other action taken in respect of this email or in
>> > > reliance on it is prohibited.  BMRB International Limited
>> > > accepts no liability in relation to any personal emails, or
>> > > content of any email which does not directly relate to our
>> > > business.
>> >
>

From mailscanner at LISTS.COM.AR  Mon Jul 21 15:38:58 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:00 2006
Subject: scripts & patches for download
In-Reply-To: <3F184A3B.23580.16865C27@localhost>
Message-ID: <3F1BD0D2.13151.244C4EE3@localhost>

As promised, here's the updated installation instrucions for 
MailScanner+ZMailer:

http://baby.com.ar/MailScanner/ModifiedFilesForMailScannerDistribution/doc/install/zmailer.shtml

When Julian comes back, we'll see if he uploads this update, as well as some 
of the modifications to the startup script, so it is easier to do 
MailScanner+ZMailer via RPM.

El 18 Jul 2003 a las 19:27, Mariano Absatz escribi?:

> Hi,
> 
> I know, my Pegasus mail client has too much personality for adding some text
> attachments...
> 
> I uploaded all the patches and scripts I sent so you can download them from
> the web...
> 
> The patches and script for using ZMailer and MailScanner from rpm's are in
> http://baby.com.ar/MailScanner/ZMailer.rpm.patches/
> 
> The standalone startup script (so you can start it independently from the
> MTA) is in
> http://baby.com.ar/MailScanner/StandAloneStartupScript/MailScanner
> 
> Finally, Julian, when you're back, would you replace the
> /etc/rc.d/init.d/MailScanner and /etc/sysconfig/MailScanner files in the rpm
> with the ones at
> http://baby.com.ar/MailScanner/ModifiedFilesForMailScannerDistribution/ ?
> 
> This would incorporate ZMailer into the rpm distribution.
> 
> I'll modify the web page at
> http://www.sng.ecs.soton.ac.uk/mailscanner/install/zmailer.shtml
> and post it so you can upgrade that too.
> 
> Have a nice weekend!
> 

--
Mariano Absatz
El Baby
----------------------------------------------------------
I am not afraid of death, I just don't want to
be there when it happens.
        -- Woody Allen


From steve.douglas at SBIINCORPORATED.COM  Mon Jul 21 15:44:37 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:19:00 2006
Subject: bayes_journal file size
Message-ID: <3963522F0E71474CB14C0FF54A6914F701115256@mail.gardenbotanika.com>

Thank you.  Apparently I am not using bayes.  I looked through the
MailScanner Config file and the keyword bayes is nowhere to be found.
However, I do have SpamAssassin on my gateway.

I am using the following config:

Fprot 4.1.0
SpamAssassin 2.55
MS 4.21-9
SendMail
Perl

SD
:-)


> -----Original Message-----
> From: Furnish, Trever G [mailto:TGFurnish@HERFF-JONES.COM]
> Sent: Monday, July 21, 2003 9:32 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: bayes_journal file size
>
> "~" is "current user's home directory", so if you're logged in as root,
> then
> ~/.spamassassin is the .spamassassin directory under root's home
> directory.
>
> >-----Original Message-----
> >From: Steve Douglas [mailto:steve.douglas@SBIINCORPORATED.COM]
> >Sent: Monday, July 21, 2003 9:30 AM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: bayes_journal file size
> >
> >
> >I am not a Linux guru by any stretch, but does ~/.spamassassin
> >imply the
> >root?
> >
> >SD
> >:-)
> >
> >
> >> -----Original Message-----
> >> From: William Curley [mailto:wpc4@DODGETHIS.ORG]
> >> Sent: Monday, July 21, 2003 9:28 AM
> >> To: MAILSCANNER@JISCMAIL.AC.UK
> >> Subject: Re: bayes_journal file size
> >>
> >> Unless mailscanner does it differently the bayes_* files are
> >stored under
> >> ~/.spamassassin
> >>
> >> ----- Original Message -----
> >> From: "Steve Douglas" <steve.douglas@SBIINCORPORATED.COM>
> >> To: <MAILSCANNER@JISCMAIL.AC.UK>
> >> Sent: Monday, July 21, 2003 7:23 AM
> >> Subject: Re: bayes_journal file size
> >>
> >>
> >> > I have incorporated MS with SpamAssassin, but I can not
> >locate where
> >> this
> >> > bayes database exists.  Am I missing something?  I would like to at
> >> minimum
> >> > check the size of my database and autolearn if necessary.  Thanks.
> >> >
> >> > SD
> >> > :-)
> >> >
> >> >
> >> > > -----Original Message-----
> >> > > From: Kevin Spicer [mailto:kevins@BMRB.CO.UK]
> >> > > Sent: Wednesday, July 16, 2003 3:16 PM
> >> > > To: MAILSCANNER@JISCMAIL.AC.UK
> >> > > Subject: Re: bayes_journal file size
> >> > >
> >> > > >Is there
> >> > > >a setting that I can adjust to put a cap on this
> >> > > >bayes_journal file?
> >> > >
> >> > > You should run   sa-learn --rebuild    periodically.
> >> > >
> >> > > The other largish file is the bayes_toks file which will
> >initially
> >> tend
> >> > > to grow quite quickly, as the Bayes engine learns new
> >tokens.  Over
> >> time
> >> > > this rate of growth will slow, and IIRC tokens which
> >have not been
> >> used
> >> > > for a while are removed (not sure on that).
> >> > >
> >> > >
> >> > >
> >> > >
> >> > >
> >> > > BMRB International
> >> > > http://www.bmrb.co.uk
> >> > > +44 (0)20 8566 5000
> >> > > _________________________________________________________________
> >> > > This message (and any attachment) is intended only for the
> >> > > recipient and may contain confidential and/or privileged
> >> > > material.  If you have received this in error, please contact the
> >> > > sender and delete this message immediately.  Disclosure, copying
> >> > > or other action taken in respect of this email or in
> >> > > reliance on it is prohibited.  BMRB International Limited
> >> > > accepts no liability in relation to any personal emails, or
> >> > > content of any email which does not directly relate to our
> >> > > business.
> >> >
> >

From P.G.M.Peters at utwente.nl  Mon Jul 21 15:44:58 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:19:00 2006
Subject: bayes_journal file size
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C02E6@inex1.herffjones.hj-int>
References: <8FFC76593085ED4A80D3601BC41EFCDF0C02E6@inex1.herffjones.hj-int>
Message-ID: <v1vnhvg9gkkpd4e3p0se1e6dvgvianbct0@4ax.com>

On Mon, 21 Jul 2003 09:31:32 -0500, you wrote:

>"~" is "current user's home directory", so if you're logged in as root, then
>~/.spamassassin is the .spamassassin directory under root's home directory.

It doesn't refer to the user you are logged into but to the user MS is
running as. Yes, usually root but to be save something else.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From dot at DOTAT.AT  Mon Jul 21 15:36:55 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:00 2006
Subject: Fw: MailScanner + Exim spooler - processing, but not delivering mails.
In-Reply-To: <m2n.19eZiC-000pqW@chiark.greenend.org.uk>
References: <20030721114359.GC30668@hoiho.nz.lemon-computing.com>
Message-ID: <E19ebmZ-00069s-00@chiark.greenend.org.uk>

David Jacobson <davidj@IMPOL.NET> wrote:
>
> 1732 ?        S      0:00 /usr/exim/bin/exim -C /usr/exim/configure -q15m
> 1729 ?        S      0:00 /usr/exim/bin/exim -C /usr/exim/configure -bd
>-odq -DSPOOL=/var/spool/exim

Both of your exims are using the same spool directory, which is wrong.
You have the same mistake in your MailScanner.conf.

Is the Exim documentation insufficiently clear? I wrote it so I have
some interest in making sure it's straightforward.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
SOUTHEAST ICELAND: VARIABLE OR SOUTHEASTERLY 3 OR LESS. RAIN OR DRIZZLE AT
TIMES. MODERATE WITH FOG PATCHES.

From nwp at LEMON-COMPUTING.COM  Sat Jul 19 16:15:17 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:19:00 2006
Subject: DNSBL Whitelist
In-Reply-To: <043101c34c77$6392a540$0a010a0a@dirt>
References: <043101c34c77$6392a540$0a010a0a@dirt>
Message-ID: <20030719151517.GB17686@hoiho.nz.lemon-computing.com>

On Thu, Jul 17, 2003 at 08:23:34AM -0700, Bill Anderson wrote:
> I asked this question earlier, however from the lack of response, I assume I
> posed the question unclearly.

Nope, just that:

1) It seems like a good idea;

2) Julian's not around to release anything at the moment, even if it did
   happen to get written somehow.


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
Bonus fortune cookie: buy 10 get 1 FREE!

From nwp at LEMON-COMPUTING.COM  Sat Jul 19 16:18:07 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:19:00 2006
Subject: Restarting the MailScanner process.
In-Reply-To: <0a1601c34c64$b315d960$cb3ca8c0@orctel.internal>
References: <0a1601c34c64$b315d960$cb3ca8c0@orctel.internal>
Message-ID: <20030719151807.GC17686@hoiho.nz.lemon-computing.com>

On Thu, Jul 17, 2003 at 02:09:42PM +0100, Will Mc Donald wrote:
> Guys,
>
> hopefully a quickie here. I've just modified my MailScanner.conf to look at a rule to allow HTML <form> tags FromOrTo just one specific address.
>
> We're running MailScanner-4.22-4 from the tarball distribution and I just wanted to know what's the quickest, safest way to restart to reread that config? Can I just kill -1 the PPID? Or do I kill the process and its children then run check_mailscanner again?

Why not try the former? It should work...



Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
Perfect day for scrubbing the floor and other exciting things.

From nwp at LEMON-COMPUTING.COM  Mon Jul 21 12:43:59 2003
From: nwp at LEMON-COMPUTING.COM (Nick Phillips)
Date: Thu Jan 12 21:19:00 2006
Subject: Fw: MailScanner + Exim spooler - processing, but not delivering mails.
In-Reply-To: <OF317D4A2F.D8E07D21-ON42256D6A.003D6937-42256D69.003D68DC@impcapital.co.za>
References: <OF317D4A2F.D8E07D21-ON42256D6A.003D6937-42256D69.003D68DC@impcapital.co.za>
Message-ID: <20030721114359.GC30668@hoiho.nz.lemon-computing.com>

On Mon, Jul 21, 2003 at 01:11:37PM +0200, David Jacobson wrote:
> To whom it may concern,
>
> OS : Linux
> Distribution: Redhat 9
> Kernel: 2.4.20-18.9
> MTA: Exim 4.20
> MailScanner: 4.22-5 (RPM)
>
> Mail should work like this
> -------------------------------------
>
> Hits our spooler (MailScanner), it should scan the message then deliver it
> to the real mail servers where the
> mail boxes reside.
>
> Problem: Mail comes in - I see it in queue for 1 second, it then says it's
> scanned and delivered and the message
> does not get delivered even though the files are out the queue.
>
> I am using one spool directory...

You do actually have two exim processes, don't you? With separate spool
directories (one each)?


Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
You will soon forget this.

From steve.douglas at SBIINCORPORATED.COM  Mon Jul 21 15:49:55 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:19:00 2006
Subject: bayes_journal file size
Message-ID: <3963522F0E71474CB14C0FF54A6914F701115257@mail.gardenbotanika.com>

Thank you.  I did locate the bayes_journal finally.  Mine is in no way too
big.  I am at 10.3 mb.  So I would presume my SPAM gateway is not passing
anywhere near as much as traffic compared to others I have read about.  Even
though this is the case, is still a good ideas to perform the auto-learn
feature every now and then?

If so, should I stop MailScanner prior to performing this?  Thanks for the
feedback!

SD
:-)


> -----Original Message-----
> From: Peter Peters [mailto:P.G.M.Peters@utwente.nl]
> Sent: Monday, July 21, 2003 9:45 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: bayes_journal file size
>
> On Mon, 21 Jul 2003 09:31:32 -0500, you wrote:
>
> >"~" is "current user's home directory", so if you're logged in as root,
> then
> >~/.spamassassin is the .spamassassin directory under root's home
> directory.
>
> It doesn't refer to the user you are logged into but to the user MS is
> running as. Yes, usually root but to be save something else.
>
> --
> Peter Peters, senior netwerkbeheerder
> Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
> Universiteit Twente,  Postbus 217,  7500 AE  Enschede
> telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From P.Delaney at RL.AC.UK  Mon Jul 21 16:06:10 2003
From: P.Delaney at RL.AC.UK (Delaney, P (Pam))
Date: Thu Jan 12 21:19:00 2006
Subject: Test - please ignore
Message-ID: <350DC7048372D31197F200902773DF4C01EBE6F0@exchange11.rl.ac.uk>

Test for duplication



Pam

Pamela Delaney
JISCmail Helpline Manager
01235 445344
mailto:p.delaney@rl.ac.uk

From HancockS at MORGANCO.COM  Mon Jul 21 17:07:43 2003
From: HancockS at MORGANCO.COM (Hancock, Scott)
Date: Thu Jan 12 21:19:00 2006
Subject: Panda Software Command line update script from Panda support.
Message-ID: <3EA1A302A4978A4C970D2C63F327156E012EEFB8@worc-mail2.int.morganco.com>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: pavcl_update_script.tgz
Type: application/x-compressed
Size: 2319 bytes
Desc: pavcl_update_script.tgz
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/cbf9fe17/pavcl_update_script.bin
From vboulytchev at COINFOTECH.COM  Mon Jul 21 17:23:34 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:19:00 2006
Subject: .bad files continued
Message-ID: <1958DE295D9656499ECAAD3642822DE0033FAC@willow.office.coinfotech.com>

sweeeeeet,
    Would you CC me on the fix?  Also I am noticing, that emails get a
.bad when I have a BCC.  The problem below I resolved     by doing the
following in cgp2ms
 
foreach $to (@rcpt) {     # print the recipient list
            print QF "RPFD:$to\n";
            }
(just take out RPFD:) and no more .bads :)))))))))))
 
 
 
The BCC issue is different. I see that
/opt/Mailscanner/lib/Mailscanner/Sendmail.pm is searching for $RFound,
$SFound, $IPFound.
 
Thanks for looking into this!!!!!!!!!!!!!!!!!!!!!!!!
 
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

-----Original Message-----
From: John Rudd [mailto:jrudd@UCSC.EDU] 
Sent: Saturday, July 19, 2003 11:44 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: .bad files continued



On Thursday, Jul 17, 2003, at 14:42 US/Pacific, Kevin Spicer wrote:

> On Thu, 2003-07-17 at 22:14, Boulytchev, Vasiliy wrote:
>> Ladies and Gents,
>>    cgp2ms is adding RPFD to the recipients line.  Why its doing that,
>> I have no clue.  Another thing that is bazaar, is I have a few
domains
>> working with no problems, its just this one.........  It does have a
>> route rule in Communigate, but how would that affect
>> anything......................  If I take those stupid RPFD: out from
>> those .bad files, and copy them to .sub, communigate pushes the
files.
>
> Perhaps you should try a mailing list for communicate users?  This
> doesn't sound like any symptom I've seen anyone report on this list -
> so
> its probably a Communigate issue.  You could try ruling out
MailScanner
> by taking it out of the mix temporarily.
>
>

It's related to the glue scripts I wrote between CommuniGate Pro and
MailScanner.  IIRC, it's caused when MailScanner is generating its own
messages.  I have a fix for it that I'm putting out in the next couple
days.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/0c0f87b0/attachment.html
From vboulytchev at COINFOTECH.COM  Mon Jul 21 17:27:14 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:19:00 2006
Subject: Restarting the MailScanner process.
Message-ID: <1958DE295D9656499ECAAD3642822DE0033FAD@willow.office.coinfotech.com>

Here is a way you can quickly kill Mailscanner.
 
1.)  Copy check_mailscanner (i hope im right on the filename) to
kill_mailscanner.
2.)  Change to reflect this:
 
else   
  if [ "x$1" != "x-q" ]; then
    echo MailScanner running with pid $pid
    kill $pid
  fi
3.)  Run check_mailscanner.
 
I hope I'm making sense to you guys, if not email me back.
 
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

-----Original Message-----
From: Nick Phillips [mailto:nwp@LEMON-COMPUTING.COM] 
Sent: Saturday, July 19, 2003 9:18 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Restarting the MailScanner process.



On Thu, Jul 17, 2003 at 02:09:42PM +0100, Will Mc Donald wrote:
> Guys,
>
> hopefully a quickie here. I've just modified my MailScanner.conf to
look at a rule to allow HTML <form> tags FromOrTo just one specific
address.
>
> We're running MailScanner-4.22-4 from the tarball distribution and I
just wanted to know what's the quickest, safest way to restart to reread
that config? Can I just kill -1 the PPID? Or do I kill the process and
its children then run check_mailscanner again?

Why not try the former? It should work...



Cheers,


Nick

--
Nick Phillips -- nwp@lemon-computing.com
Perfect day for scrubbing the floor and other exciting things.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/b73c120f/attachment.html
From michele at BLACKNIGHTSOLUTIONS.COM  Mon Jul 21 19:04:20 2003
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon:: Blacknight Solutions)
Date: Thu Jan 12 21:19:00 2006
Subject: Panda Software Command line update script from Panda support.
In-Reply-To: <3EA1A302A4978A4C970D2C63F327156E012EEFB8@worc-mail2.int.morganco.com>
Message-ID: <200307211803.h6LI3Aw22615@camelot.blacknightsolutions.com>

So how did you manage to get a reply from them? What was your trick?

(Thanks for the script!!)

#########################################################
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance to it is prohibited.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/9fbbb269/attachment.html
From HancockS at MORGANCO.COM  Mon Jul 21 21:00:51 2003
From: HancockS at MORGANCO.COM (Hancock, Scott)
Date: Thu Jan 12 21:19:01 2006
Subject: Panda Software Command line update script from Panda support.
Message-ID: <3EA1A302A4978A4C970D2C63F327156ED54388@worc-mail2.int.morganco.com>

I was ready for a fight that never came.  I did threaten to cancel
payment in the subject of my initial email.
I didn't see Julian's <RANT> post until after I bought the software (in
a bit of haste I might add).
I'm really not qualified to write or mess with the MailScanner wrapper.
I'm hoping some one could post an updated wrapper based on the tech
support script.  An English version would be a bonus too. 
 
If I remember the wrapper is necessary to pause the mailscanner while
the sig files download and update.
 
-Scott
 
 
-----Original Message-----
From: Michele Neylon:: Blacknight Solutions
[mailto:michele@BLACKNIGHTSOLUTIONS.COM] 
Sent: Monday, July 21, 2003 2:04 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Panda Software Command line update script from Panda
support.
 
So how did you manage to get a reply from them? What was your trick?
 
(Thanks for the script!!)
  _____  

This message (and any attachment) is intended only for the recipient and
may contain confidential and/or privileged material. If you have
received this in error, please contact the sender and delete this
message immediately. Disclosure, copying or other action taken in
respect of this email or in reliance on it is prohibited. 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030721/64e4be25/attachment.html
From kwang at UCALGARY.CA  Mon Jul 21 21:57:05 2003
From: kwang at UCALGARY.CA (Kai Wang)
Date: Thu Jan 12 21:19:01 2006
Subject: check Spam rules before install them
Message-ID: <3F1C53A1.7040307@ucalgary.ca>

Hi All,

We just had a problem yesterday. We have 4 machines running MailScanner.
We synchronize the spam rules among them. One of our administrator made
a syntax error in the spam rules and it was installed to the four machines.
All in the sudden, the 4 machines' MailScanner processes became defunct.
It took me a while to figure the problem out. Could we have a syntax checker
later to prevent this from happening?

Jul 20 17:13:16 XXXX MailScanner[5632]: Syntax error in first field in
line 3000 of ruleset /etc/MailScanner/rules/spam.blacklist.r
ules
Jul 20 17:13:16 XXXX MailScanner[5632]: Aborting due to syntax errors in
/etc/MailScanner/rules/spam.blacklist.rules.


Kai Wang

From mkettler at EVI-INC.COM  Mon Jul 21 22:11:17 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:01 2006
Subject: check Spam rules before install them
In-Reply-To: <3F1C53A1.7040307@ucalgary.ca>
Message-ID: <5.2.1.1.0.20030721171035.0192f978@xanadu.evi-inc.com>

At 02:57 PM 7/21/2003 -0600, Kai Wang wrote:
>Jul 20 17:13:16 XXXX MailScanner[5632]: Syntax error in first field in
>line 3000 of ruleset /etc/MailScanner/rules/spam.blacklist.r
>ules
>Jul 20 17:13:16 XXXX MailScanner[5632]: Aborting due to syntax errors in
>/etc/MailScanner/rules/spam.blacklist.rules.

Whoops, apparently I didn't read far enough.. Those really are MailScanner
rules.. my bad.

More coffee for me.

From mkettler at EVI-INC.COM  Mon Jul 21 22:10:07 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:01 2006
Subject: check Spam rules before install them
In-Reply-To: <3F1C53A1.7040307@ucalgary.ca>
Message-ID: <5.2.1.1.0.20030721170802.01921be8@xanadu.evi-inc.com>

At 02:57 PM 7/21/2003 -0600, Kai Wang wrote:
>We just had a problem yesterday. We have 4 machines running MailScanner.
>We synchronize the spam rules among them. One of our administrator made
>a syntax error in the spam rules and it was installed to the four machines.
>All in the sudden, the 4 machines' MailScanner processes became defunct.
>It took me a while to figure the problem out. Could we have a syntax checker
>later to prevent this from happening?

I assume by "spam rule" you mean a SpamAssassin rule. If so, this is really
a SA issue, not a MailScanner issue.

However SpamAssassin has had a built-in syntax checker since 2.4x, you just
need to bother to use it.

spamassassin --lint

From jrudd at UCSC.EDU  Mon Jul 21 23:37:12 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:01 2006
Subject: CommuniGate Pro - MailScanner update
Message-ID: <3F1C6B18.87206DFE@ucsc.edu>

I have made an update to my scripts for using MailScanner with
CommuniGate Pro.  I have also updated the text of the CommuniGate Pro
rule instructions (the Execute rule no longer needs the [RETPATH] nor
[RCPT] options).

This should change the problem some people noticed with ".bad" files
showing up in the CommuniGate Pro Queue directory, due to "RPFD:" being
prepended to sender's addresses.  This shouldn't happen any more.


You can get the new scripts and information from:

http://people.ucsc.edu/~jrudd/MailScanner


If you have any questions, or notice any new bugs, please let me know.

(And be sure to edit your path to perl in the first line of each script;
it changed in the downloads because my testing platform changed from
Solaris to Linux)


John Rudd


(ps: one person has mentioned that they see some messages being cross
delivered, but I haven't had anyone else mention this problem to me, nor
have I seen it on my own servers; if you do see such a behavior, please
let me know right away, and try to give me plenty of context
information)

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Jul 22 09:00:43 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:19:01 2006
Subject: Attachment vs Striphtml for tagged messages
Message-ID: <52E50E4D595DDE4D861117A1FB62E79DC00695@bond.ncl.ac.uk>

We are running with the latest MailScanner (and SpamAssassin) releases
and are evaluating with a small group of users the use of the
"attachment" option for messages tagged as spam. The rest of our users
see the "striphtml" behaviour.

We expected that only spam messages with an HTML body would have the
original body moved into an attachment while spam messages with a
non-HTML body would be left as they were.

We are finding that _most_ tagged spam messages, even when they appear
to have no HTML, have the message body moved to an attachment. A few
tagged messages however do not have the body moved into an attachment
but these messages appear to be no different to some that do have the
body moved into an attachment.

What criteria decides which tagged message has its body moved unchanged
into an attachment (and the body replaced with a warning text) and which
has its body left as received?     

What we really want is for the attachment option to do:

  if [ message body is HTML or dangerous ] then
    move body unchanged into an attachment 
  else
    # all text-only messages should get here...
    leave message body as receieved
  fi

This means that any text-only message that is wrongly tagged as spam
will still be readable without having to open an attachment.

As a BTW we note that the "attachment" option works well with Outlook,
Pine, Pegasus, etc, but in the case of Eudora the attachment is opened
automatically when the message body is read. This is precisely the
opposite of what is wanted. It may well be a configurable behaviour on
Eudora but we havn't found the option yet!  

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 


From zen23003 at ZEN.CO.UK  Tue Jul 22 09:55:37 2003
From: zen23003 at ZEN.CO.UK (Paul)
Date: Thu Jan 12 21:19:01 2006
Subject: Change request - prohibited vs infected
Message-ID: <026601c3502f$055cf910$6a0110ac@sbsplc.com>

Various file types are listed in filetype.rules.conf.  The problem I have is
that these files trigger a virus warning message when in fact these are
simply prohibited file types.  So too, the message header gets
"X-MailScanner: Found to be infected" inserted into it.

The same is true of prohibited file names (as specified in
filename.rules.conf).

What brought this to my attention was the default ban on movie files in
filetype.rules.conf .  These, unlike .pif, .scr and .exe etc are rarely
infected.

What I'd like to have is the ability to specify a different value for
"X-MailScanner:" for prohibited file types and names, eg, "Prohibited file
type" and "Prohibited file name".

From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Tue Jul 22 10:08:48 2003
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:19:01 2006
Subject: silent viruses
Message-ID: <sf1d0d4e.092@gwmail.jr2.ox.ac.uk>

Hi,

Reading some old posts, I  saw that some people have very few entries
in their Silent Viruses line in MailScanner.conf

I am probably wrong here, so please tell meif I need all the entries
like
Yaha-A Yaha-B Yaha-C Yaha-D Yaha-E Yaha-J
or would simply Yaha would do?

Thanks in advance,

Sylvain

===========================================================
Sylvain Phaneuf --- Computing Manager   | phone : +44 (0)1865 221323
Information Management Services Unit  -  Medical Sciences Division
Oxford University                               | email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      | fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Tue Jul 22 10:18:47 2003
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:19:01 2006
Subject: blocking messages with <form> tags
Message-ID: <sf1d0f8d.021@gwmail.jr2.ox.ac.uk>

Hi everyone,

I have upgraded MS to 4.22-5 last week, and selected to block messages
containing form tags. I am quite puzzled to see how many messages we
have stopped because of that. It seems that a lot of genuine mail is
coming with those form tags, e.g. from medical /scientific abstract
services.

I haven't got a clue how dangerous can these forms be. Should I
continue stopping these messages? I noticed that a few services seem to
know that their messages are likely to be stopped, they have the
following line in plain text at the top of the message:
""If you cannot view this email, please copy and paste the following
link into your browser: http://master.emedicine.com/email/radio23.html""


Thanks in advance for sharing your opinions.



Sylvain

===========================================================
Sylvain Phaneuf --- Computing Manager   | phone : +44 (0)1865 221323
Information Management Services Unit  -  Medical Sciences Division
Oxford University                               | email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      | fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

From dot at DOTAT.AT  Tue Jul 22 10:16:58 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:01 2006
Subject: silent viruses
In-Reply-To: <m2n.19et9e-000phT@chiark.greenend.org.uk>
Message-ID: <E19etGU-0001Jv-00@chiark.greenend.org.uk>

Sylvain Phaneuf <sylvain.phaneuf@IMSU.OXFORD.AC.UK> wrote:
>
>I am probably wrong here, so please tell meif I need all the entries
>like
>Yaha-A Yaha-B Yaha-C Yaha-D Yaha-E Yaha-J
>or would simply Yaha would do?

Just Yaha will do since MailScanner matches it against any substring in
the virus scanner's report.

I use McAfee, and my Silent Viruses list is Badtrans Braid Bugbear Colevo
Fizzer Ganda Gibe Hybris Klez Korvar Lirva Lovgate Magistr Nimda Sircam
Sobig Yaha. I have a note about aliases for viruses: Palyh=Sobig WinEvar=Korvar

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
LYME REGIS TO LANDS END INCLUDING THE ISLES OF SCILLY: WEST TO SOUTHWEST 3 OR
4, INCREASING SOUTHWEST 4 OR 5 PERHAPS 6 LATER IN THE WEST. ISOLATED SHOWERS,
CHIEFLY IN THE AFTERNOON, OTHERWISE MAINLY FAIR BUT SOME RAIN ON WEDNESDAY.
GOOD OCCASIONALLY MODERATE BECOMING GENERALLY MODERATE LATER. SLIGHT TO
MODERATE BUILDING MODERATE IN THE WEST.

From joan.bryan at KCL.AC.UK  Tue Jul 22 10:32:53 2003
From: joan.bryan at KCL.AC.UK (Joan Bryan)
Date: Thu Jan 12 21:19:01 2006
Subject: silent viruses
In-Reply-To: <sf1d0d4e.092@gwmail.jr2.ox.ac.uk>
References: <sf1d0d4e.092@gwmail.jr2.ox.ac.uk>
Message-ID: <EXECMAIL.1030722103253.F@godiva.kcl.ac.uk>

Sylvain

On Tue, 22 Jul 2003 10:08:48 +0100 Sylvain Phaneuf
<sylvain.phaneuf@IMSU.OXFORD.AC.UK> wrote:

> Hi,
>
> Reading some old posts, I  saw that some people have very few entries
> in their Silent Viruses line in MailScanner.conf
>
> I am probably wrong here, so please tell meif I need all the entries
> like
> Yaha-A Yaha-B Yaha-C Yaha-D Yaha-E Yaha-J
> or would simply Yaha would do?
>
Yaha will do. Here is my list of Silent viruses, but be aware some are
named differently by diffrent anti virus vendors.

Silent Viruses = Bugbear Braid Elkern Fizzer Ganda Holar Klez Korvar Livra Pate
PornDial Sobig WinEvar Yaha



Joan

From raymond at PROLOCATION.NET  Tue Jul 22 11:03:57 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:01 2006
Subject: silent viruses
In-Reply-To: <sf1d0d4e.092@gwmail.jr2.ox.ac.uk>
Message-ID: <Pine.LNX.4.44.0307221203300.32297-100000@mailbox.prolocation.net>

Hi!

> Yaha-A Yaha-B Yaha-C Yaha-D Yaha-E Yaha-J
> or would simply Yaha would do?

It will match the string, so Yaha would catch all of the above.

Bye,
Raymond.

From dot at DOTAT.AT  Tue Jul 22 10:57:23 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:01 2006
Subject: silent viruses
In-Reply-To: <m2n.19etS9-000pip@chiark.greenend.org.uk>
References: <sf1d0d4e.092@gwmail.jr2.ox.ac.uk>
            <sf1d0d4e.092@gwmail.jr2.ox.ac.uk>
Message-ID: <E19ettb-0004RP-00@chiark.greenend.org.uk>

Joan Bryan <joan.bryan@KCL.AC.UK> wrote:
>
>Silent Viruses = Bugbear Braid Elkern Fizzer Ganda Holar Klez Korvar Livra Pate
>PornDial Sobig WinEvar Yaha

I'm interested that you've included Pate and PornDial which aren't mass-mailing
worms -- and Pate in particular can be disinfected. Elkern turns up with Klez
but isn't itself a mass-mailing worm, so listing Klez should deal with it.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
LOUGH FOYLE TO CARLINGFORD LOUGH: SOUTHWEST TO WEST 3 OR 4 LOCALLY 4 OR 5,
BACKING SOUTH TO SOUTHEAST 4 OR 5 LOCALLY 6. ISOLATED SHOWERS, CHIEFLY IN THE
AFTERNOON, RAIN TONIGHT AND ON WEDNESDAY MORNING. GOOD OCCASIONALLY MODERATE
BECOMING GENERALLY MODERATE LATER. SLIGHT TO MODERATE.

From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Tue Jul 22 11:09:48 2003
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:19:01 2006
Subject: silent viruses
Message-ID: <sf1d1b9c.032@gwmail.jr2.ox.ac.uk>

Thanks all for the info. My list contains more now but is shorter...

Sylvain


>>> raymond@PROLOCATION.NET 22/07/2003 11:03:57 >>>
Hi!

> Yaha-A Yaha-B Yaha-C Yaha-D Yaha-E Yaha-J
> or would simply Yaha would do?

It will match the string, so Yaha would catch all of the above.

Bye,
Raymond.

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Jul 22 11:53:41 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:19:01 2006
Subject: blocking messages with <form> tags
Message-ID: <74BC2BBF06470148911E64E2B48FE139049923@pinewood.ncl.ac.uk>

> -----Original Message-----
> From: Sylvain Phaneuf [mailto:sylvain.phaneuf@IMSU.OXFORD.AC.UK] 
> Sent: 22 July 2003 10:19
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: blocking messages with <form> tags
> 
> 
> Hi everyone,
> 
> I have upgraded MS to 4.22-5 last week, and selected to block 
> messages containing form tags. I am quite puzzled to see how 
> many messages we have stopped because of that. It seems that 
> a lot of genuine mail is coming with those form tags, e.g. 
> from medical /scientific abstract services.
> 
> I haven't got a clue how dangerous can these forms be. Should 
> I continue stopping these messages? I noticed that a few 
> services seem to know that their messages are likely to be 
> stopped, they have the following line in plain text at the 
> top of the message: ""If you cannot view this email, please 
> copy and paste the following link into your browser: 
> http://master.emedicine.com/email/radio23.html> ""
> 

Sylvain

This site receives 1,000+ messages per day containing form tags, most of
it in spam. However we had to switch forms blocking off because it was
causing so many problems for recipients of genuine list traffic from
professional sources such as academic news letters, alerting services,
etc.

In addition I discovered that our Admissions 0ffice sends out
applications to Post Graduate enquirers as "forms" in e-mail. However it
should be possible to use a ruleset to exempt local outgoing traffic
from the block. 

Forms can be used in scams to harvest personal information from
unsuspecting recipients. If the form is presented immediately the e-mail
is opened then it is considered preferable to trying to encourage the
recipient to click on a link in an e-mail.

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 


From joan.bryan at KCL.AC.UK  Tue Jul 22 12:02:13 2003
From: joan.bryan at KCL.AC.UK (Joan Bryan)
Date: Thu Jan 12 21:19:01 2006
Subject: silent viruses
In-Reply-To: <E19ettb-0004RP-00@chiark.greenend.org.uk>
References: <E19ettb-0004RP-00@chiark.greenend.org.uk>
            <sf1d0d4e.092@gwmail.jr2.ox.ac.uk>             
            <sf1d0d4e.092@gwmail.jr2.ox.ac.uk>
Message-ID: <EXECMAIL.1030722120213.K@godiva.kcl.ac.uk>

Tony

On Tue, 22 Jul 2003 10:57:23 +0100 Tony Finch <dot@DOTAT.AT> wrote:

> Joan Bryan <joan.bryan@KCL.AC.UK> wrote:
> >
> >Silent Viruses = Bugbear Braid Elkern Fizzer Ganda Holar Klez Korvar Livra Pate
> >PornDial Sobig WinEvar Yaha
>
> I'm interested that you've included Pate and PornDial which aren't mass-mailing
> worms -- and Pate in particular can be disinfected. Elkern turns up with Klez
> but isn't itself a mass-mailing worm, so listing Klez should deal with it.

Pate was spoofing the address of support@microsoft.com so we didn't
want to send out replies to this.

We were being spammed a lot with PordDialer and we did not want to
reply to this hence the reason for adding it to the silent viruses
list.

Joan

From ctrudeau at BELLSOUTH.NET  Tue Jul 22 12:26:16 2003
From: ctrudeau at BELLSOUTH.NET (Chris Trudeau)
Date: Thu Jan 12 21:19:01 2006
Subject: InfoSecurity show
Message-ID: <LISTSERV%2003072212261668@JISCMAIL.AC.UK>

On Tue, 29 Apr 2003 21:52:47 +0100, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>At 21:42 29/04/2003, you wrote:
>>FWIW The main argument I hear for moving to a commercial product is the
>>'content filtering' that some of the commercial products claim to do.
>>The main reasons for this being HR & legal related (not just porn but
>>also profanity, and prevention of information leakage - quite how that
>>could be achieved with any degree or certainty). I know all about the
>>striphtml action, but that alone isn't seen as being enough.  The other
>>'essential requirement' of a content filtering is detailed reporting.
>
>General content filtering (be it for reporting or replacement) is one of my
>next big things to implement. Then writing a simple keyword-spotter will be
>dead easy.
>
>As for the detailed reporting, that will come with a keyword-spotting
>content filter.



Just wondering...has any progress been made on this?  My need is really
more focused toward being able to FULLY stop PROFANE language inbound or
outbound for several domains...so a rules based approach makes my life VERY
easy.

Thanks for great software all!

CT

From ctrudeau at BELLSOUTH.NET  Tue Jul 22 12:33:11 2003
From: ctrudeau at BELLSOUTH.NET (Chris Trudeau)
Date: Thu Jan 12 21:19:01 2006
Subject: SA rules?
Message-ID: <LISTSERV%2003072212331134@JISCMAIL.AC.UK>

All,

probably answered in the past...but am unable to find search paramters that
return anything of value...probably just me...here goes.

I was wondering if the spam.assassin.prefs.conf can be a rules file that
points to seperate spamassassin configurations based on FromOrTo
directives....the reason I'm asking is that this would allow completely
seperate SA rules per domain if I wanted to host several domains...

THNX
CT

From denis at CROOMBS.ORG  Tue Jul 22 13:21:28 2003
From: denis at CROOMBS.ORG (Denis Croombs)
Date: Thu Jan 12 21:19:01 2006
Subject: Rejected e-mail Any Clues ?
Message-ID: <004401c3504b$c73fc3c0$85b8fea9@Laptop>

An e-mail was rejected by 1 of my servers currently running MailScanner
(latest version) and SpamAssassin 2.55 on a redhat 7.3 system with Sendmail,

The returned e-mail is:-

-----Original Message-----
From: Info Avenue Internet Services [mailto:postmaster@InfoAve.Net]
Sent: Monday, July 21, 2003 5:16 AM
To: spw0082@xxxxxx.com
Subject: Delivery Notification: Delivery has failed


This report relates to a message you sent with the following header fields:

  Message-id:

<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAsdlzKiJ/IE+JQwjar04dEsKAAAAQ
AAAAiwmE/lx1vUuurCT2KKM2VAEAAAAA@xxxxxx.com>
  Date: Mon, 21 Jul 2003 06:15:49 -0400
  From: Steve spw0082@xxxxxx.com
  To: Julie julie@yyyyyy.com
  Subject: Meeting

Your message cannot be delivered to the following recipients:

  Recipient address: julie@yyyyyy.com
  Reason: Server rejected MAIL FROM address.
  Diagnostic code: smtp;550 5.7.1 Access denied
  Remote system: dns;mail.yyyyyy.com
(TCP|165.166.0.28|58988|217.199.181.62|25)

Action: failed
Status: 5.0.0 (Server rejected MAIL FROM address.)
Original-recipient: rfc822;julie@yyyyyy.com
Final-recipient: rfc822;julie@yyyyyy.com
Remote-MTA: dns;mail.yyyyyy.com (TCP|165.166.0.28|58988|217.199.181.62|25)
Diagnostic-code: smtp;550 5.7.1 Access denied

**************End of returned message*****************

In my sendmail (maillog) I have the following which are the only entries
relating to the incoming domain & this e-mail address:-

Jul 21 10:47:03 ns sendmail[22305]: h6L9l3322305: ruleset=check_relay,
arg1=smtp03.infoave.net, arg2=165.166.0.28, relay=smtp03.infoave.net
[165.166.0.28], reject=550 5.7.1 Access denied
Jul 21 10:47:04 ns sendmail[22305]: NOQUEUE: smtp03.infoave.net
[165.166.0.28] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

Jul 21 16:46:41 ns sendmail[5948]: h6LFke305948: from=<spw0082@xxxxxx.com>,
size=70816, class=0, nrcpts=1,
msgid=<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAsdlzKiJ/IE+JQwjar04dEs
KAAAAQAAAAGwBd8juOXkax2uIkOJdP, proto=ESMTP, daemon=MTA,
relay=smtp01.infoave.net [165.166.0.26]
Jul 21 16:46:41 ns sendmail[5948]: h6LFke305948: to=<julie@yyyyyy.com>,
delay=00:00:00, mailer=virthostmail, pri=100816, stat=queued
Jul 21 16:46:42 ns MailScanner[31907]: New Batch: Scanning 1 messages, 71369
bytes
Jul 21 16:46:42 ns MailScanner[31907]: Spam Checks: Starting
Jul 21 16:46:44 ns MailScanner[31907]: Virus and Content Scanning: Starting
Jul 21 16:46:44 ns MailScanner[31907]: Uninfected: Delivered 1 messages
Jul 21 16:46:44 ns virthostmail[5956]: Chrooting to /home/virtual/site3/fst
Jul 21 16:46:44 ns sendmail[5958]: h6LFkiO05958: from=<spw0082@xxxxxx.com>,
size=71279, class=0, nrcpts=1,
msgid=<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAsdlzKiJ/IE+JQwjar04dEs
KAAAAQAAAAGwBd8juOXkax2uIkOJdP, proto=ESMTP, relay=root@localhost
Jul 21 16:46:44 ns sendmail[5954]: h6LFke305948: to=<julie@yyyyyy.com>,
delay=00:00:03, xdelay=00:00:00, mailer=virthostmail, pri=190816,
relay=yyyyyy.com, dsn=2.0.0, stat=Sent (h6LFkiO05958 Message accepted for
delivery)
Jul 21 16:46:44 ns sendmail[5959]: h6LFkiO05958: to=<julie@yyyyyy.com>,
delay=00:00:00, xdelay=00:00:00, mailer=local, pri=100014, dsn=2.0.0,
stat=Sent

All clues very welcome

Denis

From rscarano at targetsis.com.br  Tue Jul 22 13:49:41 2003
From: rscarano at targetsis.com.br (Rodrigo Scarano)
Date: Thu Jan 12 21:19:01 2006
Subject: RES: blocking messages with <form> tags
In-Reply-To: <sf1d0f8d.021@gwmail.jr2.ox.ac.uk>
Message-ID: <000001c3504f$bac1b000$6900000a@targetsis.com.br>

Sylvain,
I use Allow IFrame Tags = yes and Allow Object Codebase Tags = yes, but the
line Convert Dangerous HTML To Text is set to yes. I guess i'm secure with
this.

Regards,



Rodrigo Scarano
Target Sistemas
http://www.targetsis.com.br/
rscarano@targetsis.com.br


-----Mensagem original-----
De:     MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Em nome de
Sylvain Phaneuf
Enviada em:     Ter?a-feira, 22 de Julho de 2003 06:19
Para:   MAILSCANNER@JISCMAIL.AC.UK
Assunto:        blocking messages with <form> tags

Hi everyone,

I have upgraded MS to 4.22-5 last week, and selected to block messages
containing form tags. I am quite puzzled to see how many messages we
have stopped because of that. It seems that a lot of genuine mail is
coming with those form tags, e.g. from medical /scientific abstract
services.

I haven't got a clue how dangerous can these forms be. Should I
continue stopping these messages? I noticed that a few services seem to
know that their messages are likely to be stopped, they have the
following line in plain text at the top of the message:
""If you cannot view this email, please copy and paste the following
link into your browser: http://master.emedicine.com/email/radio23.html""


Thanks in advance for sharing your opinions.



Sylvain

===========================================================
Sylvain Phaneuf --- Computing Manager   | phone : +44 (0)1865 221323
Information Management Services Unit  -  Medical Sciences Division
Oxford University                               | email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      | fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================


From mikea at MIKEA.ATH.CX  Tue Jul 22 14:08:52 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:19:01 2006
Subject: Rejected e-mail Any Clues ?
In-Reply-To: <004401c3504b$c73fc3c0$85b8fea9@Laptop>; from denis@CROOMBS.ORG
              on Tue, Jul 22, 2003 at 01:21:28PM +0100
References: <004401c3504b$c73fc3c0$85b8fea9@Laptop>
Message-ID: <20030722080852.A12935@mikea.ath.cx>

On Tue, Jul 22, 2003 at 01:21:28PM +0100, Denis Croombs wrote:
> An e-mail was rejected by 1 of my servers currently running MailScanner
> (latest version) and SpamAssassin 2.55 on a redhat 7.3 system with Sendmail,
>
> The returned e-mail is:-
>
> -----Original Message-----
> From: Info Avenue Internet Services [mailto:postmaster@InfoAve.Net]
> Sent: Monday, July 21, 2003 5:16 AM
> To: spw0082@xxxxxx.com
> Subject: Delivery Notification: Delivery has failed
>
>
> This report relates to a message you sent with the following header fields:
>
>   Message-id:
>
> <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAsdlzKiJ/IE+JQwjar04dEsKAAAAQ
> AAAAiwmE/lx1vUuurCT2KKM2VAEAAAAA@xxxxxx.com>
>   Date: Mon, 21 Jul 2003 06:15:49 -0400
>   From: Steve spw0082@xxxxxx.com
>   To: Julie julie@yyyyyy.com
>   Subject: Meeting
>
> Your message cannot be delivered to the following recipients:
>
>   Recipient address: julie@yyyyyy.com
>   Reason: Server rejected MAIL FROM address.
>   Diagnostic code: smtp;550 5.7.1 Access denied
>   Remote system: dns;mail.yyyyyy.com
> (TCP|165.166.0.28|58988|217.199.181.62|25)
>
> Action: failed
> Status: 5.0.0 (Server rejected MAIL FROM address.)
> Original-recipient: rfc822;julie@yyyyyy.com
> Final-recipient: rfc822;julie@yyyyyy.com
> Remote-MTA: dns;mail.yyyyyy.com (TCP|165.166.0.28|58988|217.199.181.62|25)
> Diagnostic-code: smtp;550 5.7.1 Access denied
>
> **************End of returned message*****************
>
> In my sendmail (maillog) I have the following which are the only entries
> relating to the incoming domain & this e-mail address:-
>
> Jul 21 10:47:03 ns sendmail[22305]: h6L9l3322305: ruleset=check_relay,
> arg1=smtp03.infoave.net, arg2=165.166.0.28, relay=smtp03.infoave.net
> [165.166.0.28], reject=550 5.7.1 Access denied
> Jul 21 10:47:04 ns sendmail[22305]: NOQUEUE: smtp03.infoave.net
> [165.166.0.28] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

[snip]

This looks *very* much like mail service being denied because of an
entry in the /etc/mail/access.db database. The maillog lines above
are pretty much diagnostic for that.

Here is a similar log line pair for rejection of an SMTP connection
because of an access.db entry here:

Jul 15 08:16:42 mikea sendmail[67639]: h6FDGSS8067639:
  from=<txv241@canada.com>, size=4398, class=0, nrcpts=1,
  msgid=<7t--$9-3$1$x0y$r$$n$weh$6@9gx.6.fih>, proto=SMTP,
  daemon=MTA, relay=MG097004084.user.veloxzone.com.br [200.97.4.84]
Jul 15 14:47:10 mikea sendmail[69568]: ruleset=check_relay,
  arg1=MG020198.user.veloxzone.com.br, arg2=200.165.20.198,
  relay=MG020198.user.veloxzone.com.br [200.165.20.198],
  reject=550 5.7.1:Comite Gestor da Internet no Brasil
  not permitted to do SMTP here.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From rscarano at targetsis.com.br  Tue Jul 22 14:09:09 2003
From: rscarano at targetsis.com.br (Rodrigo Scarano)
Date: Thu Jan 12 21:19:01 2006
Subject: Delete Old McAfee Dats
Message-ID: <000101c35052$7118d8e0$6900000a@targetsis.com.br>

Hello all
I use MS with McAfee and I have a simple question.
The auto-update-script creates a new directory for the new dat (when it's
find one on ftp) and keep the old dats for backup. I thing I can delete with
some frequency this old Dat directories. Is thar correct ???

Regards,

Rodrigo Scarano
Target Sistemas
http://www.targetsis.com.br/
rscarano@targetsis.com.br

From jaearick at COLBY.EDU  Tue Jul 22 14:14:56 2003
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:19:01 2006
Subject: extra garbage in Mailscanner syslog lines
Message-ID: <Pine.GSO.4.56.0307220911340.5116@cayuga>

Hi,

   Does anybody else see numbers or other garbage in their syslog
output from MailScanner?  Example:

Jul 22 09:02:12 basalt <22>MailScanner[20750]: Spam Checks: Starting
                       ^^^^

I'm using MS 4.22-5 on a Solaris 9 system.  I moved our email from
a Solaris 8 system this weekend, that box didn't have the extra
numbers in the syslog output (same version of MS).  Any clue how to
clean this up?

--- Jeff Earickson

From denis at CROOMBS.ORG  Tue Jul 22 14:25:14 2003
From: denis at CROOMBS.ORG (Denis Croombs)
Date: Thu Jan 12 21:19:01 2006
Subject: Rejected e-mail Any Clues ?
References: <004401c3504b$c73fc3c0$85b8fea9@Laptop> 
            <20030722080852.A12935@mikea.ath.cx>
Message-ID: <006801c35054$afd7db60$85b8fea9@Laptop>

Hi Mike
Thanks for that, I had checked that, and neither the ISP or the xxxxxx.com
domain are listed for rejection.

Denis
----- Original Message -----
From: "mikea" <mikea@MIKEA.ATH.CX>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 22, 2003 2:08 PM
Subject: Re: Rejected e-mail Any Clues ?


> On Tue, Jul 22, 2003 at 01:21:28PM +0100, Denis Croombs wrote:
> > An e-mail was rejected by 1 of my servers currently running MailScanner
> > (latest version) and SpamAssassin 2.55 on a redhat 7.3 system with
Sendmail,
> >
> > The returned e-mail is:-
> >
> > -----Original Message-----
> > From: Info Avenue Internet Services [mailto:postmaster@InfoAve.Net]
> > Sent: Monday, July 21, 2003 5:16 AM
> > To: spw0082@xxxxxx.com
> > Subject: Delivery Notification: Delivery has failed
> >
> >
> > This report relates to a message you sent with the following header
fields:
> >
> >   Message-id:
> >
> >
<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAsdlzKiJ/IE+JQwjar04dEsKAAAAQ
> > AAAAiwmE/lx1vUuurCT2KKM2VAEAAAAA@xxxxxx.com>
> >   Date: Mon, 21 Jul 2003 06:15:49 -0400
> >   From: Steve spw0082@xxxxxx.com
> >   To: Julie julie@yyyyyy.com
> >   Subject: Meeting
> >
> > Your message cannot be delivered to the following recipients:
> >
> >   Recipient address: julie@yyyyyy.com
> >   Reason: Server rejected MAIL FROM address.
> >   Diagnostic code: smtp;550 5.7.1 Access denied
> >   Remote system: dns;mail.yyyyyy.com
> > (TCP|165.166.0.28|58988|217.199.181.62|25)
> >
> > Action: failed
> > Status: 5.0.0 (Server rejected MAIL FROM address.)
> > Original-recipient: rfc822;julie@yyyyyy.com
> > Final-recipient: rfc822;julie@yyyyyy.com
> > Remote-MTA: dns;mail.yyyyyy.com
(TCP|165.166.0.28|58988|217.199.181.62|25)
> > Diagnostic-code: smtp;550 5.7.1 Access denied
> >
> > **************End of returned message*****************
> >
> > In my sendmail (maillog) I have the following which are the only entries
> > relating to the incoming domain & this e-mail address:-
> >
> > Jul 21 10:47:03 ns sendmail[22305]: h6L9l3322305: ruleset=check_relay,
> > arg1=smtp03.infoave.net, arg2=165.166.0.28, relay=smtp03.infoave.net
> > [165.166.0.28], reject=550 5.7.1 Access denied
> > Jul 21 10:47:04 ns sendmail[22305]: NOQUEUE: smtp03.infoave.net
> > [165.166.0.28] did not issue MAIL/EXPN/VRFY/ETRN during connection to
MTA
>
> [snip]
>
> This looks *very* much like mail service being denied because of an
> entry in the /etc/mail/access.db database. The maillog lines above
> are pretty much diagnostic for that.
>
> Here is a similar log line pair for rejection of an SMTP connection
> because of an access.db entry here:
>
> Jul 15 08:16:42 mikea sendmail[67639]: h6FDGSS8067639:
>   from=<txv241@canada.com>, size=4398, class=0, nrcpts=1,
>   msgid=<7t--$9-3$1$x0y$r$$n$weh$6@9gx.6.fih>, proto=SMTP,
>   daemon=MTA, relay=MG097004084.user.veloxzone.com.br [200.97.4.84]
> Jul 15 14:47:10 mikea sendmail[69568]: ruleset=check_relay,
>   arg1=MG020198.user.veloxzone.com.br, arg2=200.165.20.198,
>   relay=MG020198.user.veloxzone.com.br [200.165.20.198],
>   reject=550 5.7.1:Comite Gestor da Internet no Brasil
>   not permitted to do SMTP here.
>
> --
> Mike Andrews
> mikea@mikea.ath.cx
> Tired old sysadmin since 1964

From mailscanner at LISTS.COM.AR  Tue Jul 22 14:27:28 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:01 2006
Subject: Panda Software Command line update script from Panda support.
In-Reply-To: <3EA1A302A4978A4C970D2C63F327156ED54388@worc-mail2.int.morganco.com>
Message-ID: <3F1D1190.9059.293147B0@localhost>

Well... AFAIK, Julian is on Vacation, I just translated the script... I 
didn't test it, since I don't have PAV, however, the only thing I did was to 
eliminate the Spanish strings (it tried to detect if your locale language was 
Spanish and use Spanish strings, otherwise, it would use English strings), 
and also changed the comments and variable and functions names so it is 
clearer.

The script is somehow poor, but I think Julian or someone else could 
elaborate on it... e.g. wget could be searched for with "which", and there 
are lots of other stuff to enhance...

I'm attaching the modified script... the config file was already in English.

El 21 Jul 2003 a las 16:00, Hancock, Scott escribi?:

> I was ready for a fight that never came.  I did threaten to cancel
> payment in the subject of my initial email.
> I didn't see Julian's <RANT> post until after I bought the software (in
> a bit of haste I might add).
> I'm really not qualified to write or mess with the MailScanner wrapper.
> I'm hoping some one could post an updated wrapper based on the tech
> support script.  An English version would be a bonus too. 
>  
> If I remember the wrapper is necessary to pause the mailscanner while
> the sig files download and update.
>  
> -Scott
>  
>  
> -----Original Message-----
> From: Michele Neylon:: Blacknight Solutions
> [mailto:michele@BLACKNIGHTSOLUTIONS.COM] 
> Sent: Monday, July 21, 2003 2:04 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Panda Software Command line update script from Panda
> support.
>  
> So how did you manage to get a reply from them? What was your trick?
>  
> (Thanks for the script!!)
>   _____  
> 
> This message (and any attachment) is intended only for the recipient and
> may contain confidential and/or privileged material. If you have
> received this in error, please contact the sender and delete this
> message immediately. Disclosure, copying or other action taken in
> respect of this email or in reliance on it is prohibited. 
> 


--
Mariano Absatz
El Baby
----------------------------------------------------------
When I want your opinion, I'll give it to you.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: pavcl_update.sh
Type: application/octet-stream
Size: 6019 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/7ed7f270/pavcl_update.obj
From ka at PACIFIC.NET  Tue Jul 22 14:37:48 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:01 2006
Subject: SA rules?
In-Reply-To: <LISTSERV%2003072212331134@JISCMAIL.AC.UK>
References: <LISTSERV%2003072212331134@JISCMAIL.AC.UK>
Message-ID: <3F1D3E2C.1070006@pacific.net>

Chris Trudeau wrote:
> All,
>
> probably answered in the past...but am unable to find search paramters that
> return anything of value...probably just me...here goes.
>
> I was wondering if the spam.assassin.prefs.conf can be a rules file that
> points to seperate spamassassin configurations based on FromOrTo
> directives....the reason I'm asking is that this would allow completely
> seperate SA rules per domain if I wanted to host several domains...

See CustomConfig.pm for an example of how to implement per-domain
whitelist and blacklist rules. Note that this doesn't give you
completely separate SA rules per domain, just separate white/blacklist
per-domain.

Ken A.

> THNX
> CT
>
>

From SJCJonker at SJC.NL  Tue Jul 22 14:53:55 2003
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:19:01 2006
Subject: Attachment vs Striphtml for tagged messages
In-Reply-To: <52E50E4D595DDE4D861117A1FB62E79DC00695@bond.ncl.ac.uk>
References: <52E50E4D595DDE4D861117A1FB62E79DC00695@bond.ncl.ac.uk>
Message-ID: <Pine.LNX.4.53.0307221546580.20696@ph-wks-01.sjc.nl>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quentin,

I see nobody replied yet, I only have a partial answer.

See my comments inline.

On Tue, 22 Jul 2003, Quentin Campbell wrote:

> We are running with the latest MailScanner (and SpamAssassin) releases
> and are evaluating with a small group of users the use of the
> "attachment" option for messages tagged as spam. The rest of our users
> see the "striphtml" behaviour.
>
> We expected that only spam messages with an HTML body would have the
> original body moved into an attachment while spam messages with a
> non-HTML body would be left as they were.

As far as i know this is as designed, next to protection against "web
bugs" / images with a unique identifier etc, etc It also protects the
users against trash and sexist talk etc etc. Imho a good move. but off
course your milage may vary.

> We are finding that _most_ tagged spam messages, even when they appear
> to have no HTML, have the message body moved to an attachment. A few
> tagged messages however do not have the body moved into an attachment
> but these messages appear to be no different to some that do have the
> body moved into an attachment.

As MailScanner doesn't copy messages if they have multiple receipients it
takes only one rule on what action to take. (I seem to remeber it's the
first rule, but i'm not sure.) You might want to check the messages where
the body isn't an attachment if they where send to multiple receipients on
SMTP level. (So not only the body).

> What criteria decides which tagged message has its body moved unchanged
> into an attachment (and the body replaced with a warning text) and which
> has its body left as received?
>
See my reasons above, but i'm not julian ;-))

>
> As a BTW we note that the "attachment" option works well with Outlook,
> Pine, Pegasus, etc, but in the case of Eudora the attachment is opened
> automatically when the message body is read. This is precisely the
> opposite of what is wanted. It may well be a configurable behaviour on
> Eudora but we havn't found the option yet!

Maybe you can help me here, i can't see to get pine to leave the attached
message as it, it display the attachment here after the MailScanner
notice. What option did you use to disable the behaviour to display the
message inline?

Hope it helps.

- --
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/HUIAjU9r45tKnOARAjkpAJ0SWUPfwMgrsNEXgl0spYc3CH8WDQCg1lGn
b/FvcbCk0oLirThLcF5TzhA=
=n+aZ
-----END PGP SIGNATURE-----

From mailscanner at LISTS.COM.AR  Tue Jul 22 14:59:37 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:01 2006
Subject: Delete Old McAfee Dats
In-Reply-To: <000101c35052$7118d8e0$6900000a@targetsis.com.br>
Message-ID: <3F1D1919.15385.294EB86D@localhost>

Yes, you can delete the old dat directories.

There's no "frequency" to do this, you should do it when you're sure the 
newer dat has no problems.

I think of two different schemes:

1) You could delete the old directory(ies) after 2 or 3 days passed from the 
last update if nothing went wrong (every now and then there can be updates 
that are broken, though they're usually followed by a newer update fixing 
it).

2) You could manage to keep, for instance, the current dat directory plus one 
or two old ones, regardless of time.



El 22 Jul 2003 a las 10:09, Rodrigo Scarano escribi?:

> Hello all
> I use MS with McAfee and I have a simple question.
> The auto-update-script creates a new directory for the new dat (when it's
> find one on ftp) and keep the old dats for backup. I thing I can delete with
> some frequency this old Dat directories. Is thar correct ???
> 
> Regards,
> 
> Rodrigo Scarano
> Target Sistemas
> http://www.targetsis.com.br/
> rscarano@targetsis.com.br


--
Mariano Absatz
El Baby
----------------------------------------------------------
Never underestimate the bandwidth of a station wagon full of tapes
hurtling down the highway.
        -- Andrew S. Tanenbaum - Computer Networks


From rscarano at targetsis.com.br  Tue Jul 22 15:11:07 2003
From: rscarano at targetsis.com.br (Rodrigo Scarano)
Date: Thu Jan 12 21:19:01 2006
Subject: RES: Delete Old McAfee Dats
In-Reply-To: <3F1D1919.15385.294EB86D@localhost>
Message-ID: <000a01c3505b$1935ad20$6900000a@targetsis.com.br>

Txs Mariano, i will follow your sugestions... ;-).
Regards,


Rodrigo Scarano
Target Sistemas
http://www.targetsis.com.br/
rscarano@targetsis.com.br


-----Mensagem original-----
De:     MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Em nome de
Mariano Absatz
Enviada em:     Ter?a-feira, 22 de Julho de 2003 11:00
Para:   MAILSCANNER@JISCMAIL.AC.UK
Assunto:        Re: Delete Old McAfee Dats

Yes, you can delete the old dat directories.

There's no "frequency" to do this, you should do it when you're sure the
newer dat has no problems.

I think of two different schemes:

1) You could delete the old directory(ies) after 2 or 3 days passed from the
last update if nothing went wrong (every now and then there can be updates
that are broken, though they're usually followed by a newer update fixing
it).

2) You could manage to keep, for instance, the current dat directory plus
one
or two old ones, regardless of time.



El 22 Jul 2003 a las 10:09, Rodrigo Scarano escribi?:

> Hello all
> I use MS with McAfee and I have a simple question.
> The auto-update-script creates a new directory for the new dat (when it's
> find one on ftp) and keep the old dats for backup. I thing I can delete
with
> some frequency this old Dat directories. Is thar correct ???
>
> Regards,
>
> Rodrigo Scarano
> Target Sistemas
> http://www.targetsis.com.br/
> rscarano@targetsis.com.br


--
Mariano Absatz
El Baby
----------------------------------------------------------
Never underestimate the bandwidth of a station wagon full of tapes
hurtling down the highway.
        -- Andrew S. Tanenbaum - Computer Networks


From mbowman at UDCOM.COM  Tue Jul 22 15:12:05 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:19:01 2006
Subject: Threshold ruleset syntax
Message-ID: <OF7F685505.71DB9EDE-ON85256D6B.004DEAE1-85256D6B.004E2B9F@udcomm.net>

Hi

What is the syntax for the Threshold ruleset ?

To: domain1.tld         4
To: domain2.tld         5
To: default             6

?

Please advise.

Thanks

Matthew

From zabriskw at ITECH.NET  Tue Jul 22 15:19:51 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
Message-ID: <000701c3505c$509521f0$0c02a8c0@itech.dom>

I know this has come up several times on the MailScanner mailing list, but I
have not seen a clear cut answer on why this happends and I know several
people are having the same problem.  Our spam has gone through the roof
recently.  A good portion of it is spam, that SpamAssassin has identified as
spam, but in the header it says "not spam (whitelisted)".  OK.  Obviously
somewhere it says, that this e-mail address is ok.  So I continue to look
around.  No mentionment of the address in spam.whitelist.rules for
mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
address is not in there, in fact I delete all of the addresses.  I then,
jump over to the MailScanner conf, and take a look in there to make sure I
am not using SA for whitelisting.  In the MailScanner conf it says:
SpamAssassin Auto Whitelist = no

I have NO idea what is going on here!  Below is just an example of one that
got through.

This is everything from mail.log pertaining to the example message:

Jul 22 09:11:08 mustang sendmail[385422]: h6MDB1OS385422:
from=<7hd29nsrepo@springfieldrealty.com>, size=2700, class=0, nrcpts=17,
msgid=<xi2$-6$s-$9t$2chf4$-okqx0ur-ms@7pjel.x.vy5>, proto=SMTP, daemon=MTA,
relay=_Crystal@c66.110.164-221.clta.globetrotter.net [66.110.164.221]
Jul 22 09:11:12 mustang sendmail[387950]: h6MDB1OS385422:
to=<bmyers@itech.net>,<bmcnamee@itech.net>,<blue1@itech.net>,<blshu@itech.ne
t>,<bknipple@itech.net>,support,<brandon@itech.net>,<bobs@itech.net>,<bigopi
mp@itech.net>,<bassman@itech.net>,<baron@itech.net>,<bigbro@itech.net>,<berr
ier@itech.net>,<bergman@itech.net>,<bentley@itech.net>,<bearden@itech.net>,<
bbani@itech.net>, delay=00:00:11, xdelay=00:00:01, mailer=local, pri=600558,
dsn=2.0.0, stat=Sent

This is the header of the email:

X-Priority: 3
X-MSMail-Priority: Normal
X-MailScanner-Information: Please contact the ISP for more information
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=8.2,
required 5, BANG_GUARANTEE, CLICK_BELOW_CAPS, HTML_70_80, HTML_FONT_BIG,
HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE, MIME_HTML_ONLY,
MISSING_MIMEOLD, MISSING_OUTLOOK_NAME, OBFUSCATING_COMMENT, PENIS_ENLARGE2)

Any help would be greatly appreciated.  I am trying to stop little kids from
getting bombarded with Penis Enlargement e-mails.  Thanks in advance.


Kris Zabriskie
Network Admin / Consultant
I-Tech Inc.
zabriskw@itech.net
717-657-3035

From srhitch at MECHENG1.UWATERLOO.CA  Tue Jul 22 15:17:19 2003
From: srhitch at MECHENG1.UWATERLOO.CA (Steve Hitchman)
Date: Thu Jan 12 21:19:01 2006
Subject: SA only scores 0
In-Reply-To: <3F1D3E2C.1070006@pacific.net>
Message-ID: <001401c3505b$f65fb7e0$202e6181@NEXUS.UWATERLOO.CA>

Hello all,

I have recently upgraded from ver3.x to ver4.22(Sophos/Solaris 7). Seems
to be working great! I have not been running Spamassassin in the past. I
installed SA 2.60. Within MS I get nothing but "SpamAssassin (score=0,
required 5)" on all messages including spam that detects as spam when
piped to "spamassassin".

Regards,

Steve Hitchman
University of Waterloo
Dept of Mechanical Engineering
Ontario, Canada

From Steve at swaney.com  Tue Jul 22 16:33:25 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:01 2006
Subject: SA only scores 0
In-Reply-To: <001401c3505b$f65fb7e0$202e6181@NEXUS.UWATERLOO.CA>
References: <001401c3505b$f65fb7e0$202e6181@NEXUS.UWATERLOO.CA>
Message-ID: <1058888004.3386.27.camel@speedy>

Steve,

Have you set:

    Use SpamAssassin = yes

in MailScanner.conf?

Also I believe that SpamAssasssin 2.60 is still pre-relaease. Still it
should work.

Steve
Steve@swaney.com

On Tue, 2003-07-22 at 10:17, Steve Hitchman wrote:

> Hello all,
>
> I have recently upgraded from ver3.x to ver4.22(Sophos/Solaris 7). Seems
> to be working great! I have not been running Spamassassin in the past. I
> installed SA 2.60. Within MS I get nothing but "SpamAssassin (score=0,
> required 5)" on all messages including spam that detects as spam when
> piped to "spamassassin".
>
> Regards,
>
> Steve Hitchman
> University of Waterloo
> Dept of Mechanical Engineering
> Ontario, Canada
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/796f2260/attachment.html
From srhitch at MECHENG1.UWATERLOO.CA  Tue Jul 22 16:54:59 2003
From: srhitch at MECHENG1.UWATERLOO.CA (Steve Hitchman)
Date: Thu Jan 12 21:19:01 2006
Subject: SA only scores 0
In-Reply-To: <1058888004.3386.27.camel@speedy>
Message-ID: <003b01c35069$9b270640$202e6181@NEXUS.UWATERLOO.CA>

Yes. I have set Use SpamAssassin=yes.

The "SpamAssassin (score=0,required 5)" message shows up in the header
of all delivered mail. Does that not mean the MS has used or attempted
to use SA?

Steve Hitchman
University of Waterloo
Dept of Mechanical Engineering

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Stephen Swaney
Sent: July 22, 2003 11:33 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: SA only scores 0


Steve,

Have you set:

    Use SpamAssassin = yes

in MailScanner.conf?

Also I believe that SpamAssasssin 2.60 is still pre-relaease. Still it
should work.

Steve
Steve@swaney.com

On Tue, 2003-07-22 at 10:17, Steve Hitchman wrote:
Hello all,

I have recently upgraded from ver3.x to ver4.22(Sophos/Solaris 7). Seems
to be working great! I have not been running Spamassassin in the past. I
installed SA 2.60. Within MS I get nothing but "SpamAssassin (score=0,
required 5)" on all messages including spam that detects as spam when
piped to "spamassassin".

Regards,

Steve Hitchman
University of Waterloo
Dept of Mechanical Engineering
Ontario, Canada

From tchamtieh at YAHOO.COM  Tue Jul 22 16:57:10 2003
From: tchamtieh at YAHOO.COM (Thomas Chamtieh)
Date: Thu Jan 12 21:19:01 2006
Subject: SA only scores 0
In-Reply-To: <003b01c35069$9b270640$202e6181@NEXUS.UWATERLOO.CA>
Message-ID: <20030722155710.48223.qmail@web13208.mail.yahoo.com>

I've had the same problem. I un-installed SpamAssassin completely including the tools and all then re-installed it again. All worked perfect after that.

-Thomas

Steve Hitchman <srhitch@MECHENG1.UWATERLOO.CA> wrote:
Yes. I have set Use SpamAssassin=yes.

The "SpamAssassin (score=0,required 5)" message shows up in the header
of all delivered mail. Does that not mean the MS has used or attempted
to use SA?

Steve Hitchman
University of Waterloo
Dept of Mechanical Engineering

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Stephen Swaney
Sent: July 22, 2003 11:33 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: SA only scores 0


Steve,

Have you set:

Use SpamAssassin = yes

in MailScanner.conf?

Also I believe that SpamAssasssin 2.60 is still pre-relaease. Still it
should work.

Steve
Steve@swaney.com

On Tue, 2003-07-22 at 10:17, Steve Hitchman wrote:
Hello all,

I have recently upgraded from ver3.x to ver4.22(Sophos/Solaris 7). Seems
to be working great! I have not been running Spamassassin in the past. I
installed SA 2.60. Within MS I get nothing but "SpamAssassin (score=0,
required 5)" on all messages including spam that detects as spam when
piped to "spamassassin".

Regards,

Steve Hitchman
University of Waterloo
Dept of Mechanical Engineering
Ontario, Canada


---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/0c76262b/attachment.html
From mkettler at EVI-INC.COM  Tue Jul 22 17:13:10 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:01 2006
Subject: SA only scores 0
In-Reply-To: <1058888004.3386.27.camel@speedy>
References: <001401c3505b$f65fb7e0$202e6181@NEXUS.UWATERLOO.CA>
            <001401c3505b$f65fb7e0$202e6181@NEXUS.UWATERLOO.CA>
Message-ID: <5.2.1.1.0.20030722121004.01893460@xanadu.evi-inc.com>

At 11:33 AM 7/22/2003 -0400, Stephen Swaney wrote:
>Also I believe that SpamAssasssin 2.60 is still pre-relaease. Still it
>should work.

Yes, 2.60 is most definitely NOT a released version.

Since MailScanner uses the direct API, I'd advise against playing with CVS
versions of spamassassin on production boxes.

Steve, Try upgrading your 2.60 to todays version, see if it fixes the
problem.. it changes daily and is sometimes unstable for short periods of
time. (and yes the sa website does warn you that 2.60 is currently a CVS
devel version that may be unstable).

If you want a stable release version, 2.55 is current.

From mkettler at EVI-INC.COM  Tue Jul 22 17:15:52 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
In-Reply-To: <000701c3505c$509521f0$0c02a8c0@itech.dom>
Message-ID: <5.2.1.1.0.20030722121437.01887368@xanadu.evi-inc.com>

At 10:19 AM 7/22/2003 -0400, Kris Zabriskie wrote:
>I know this has come up several times on the MailScanner mailing list, but I
>have not seen a clear cut answer on why this happends and I know several
>people are having the same problem.  Our spam has gone through the roof
>recently.  A good portion of it is spam, that SpamAssassin has identified as
>spam, but in the header it says "not spam (whitelisted)".  OK.  Obviously
>somewhere it says, that this e-mail address is ok.  So I continue to look
>around.  No mentionment of the address in spam.whitelist.rules for
>mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
>address is not in there, in fact I delete all of the addresses.  I then,
>jump over to the MailScanner conf, and take a look in there to make sure I
>am not using SA for whitelisting.  In the MailScanner conf it says:
>SpamAssassin Auto Whitelist = no

The "not spam (whitelisted)" is a MailScanner whitelisting, not a
SpamAssassin whitelisting. Check your mailscanner config.

SA will indicate whitelists by rules that modify the score, and not any
other way.

From rherban at HYPERVINE.NET  Tue Jul 22 17:43:18 2003
From: rherban at HYPERVINE.NET (Randy Herban)
Date: Thu Jan 12 21:19:01 2006
Subject: User Verification
Message-ID: <00FD7F04EA248947B8FBB971044379DB110644@corpserv1.hvcorp.hypervine.net>

I have a question about how versitile mailscanner/spamassassin might be
to do user verification.

I've been thinkin about it for a while and my mentality was to have
mailscanner do the verification, if the user doesn't exist, delete the
mail and proceed onto the next, bypassing the rest of the checks as we
won't be delivering this mail anyway.
This has a nasty side as legit mail to a user who was just deleted
wouldn't get bounced back.

My next thought was to use a spamassassin type scoring to it.  For each
nonexistent user we add a score of 1.  If there are that many to push it
over the high spam score then it will get deleted but single messages
(boucebacks) would go under the radar and get delivered fine.

I know that I would be able to write this into mailscanner itself (being
as it's a perl script) but not sure if it's possible to tie it into the
spamassassin scoring.

Does anyone with more knowledge have any input that might assist me?

Thanks
Randy


From damian at WORKGROUPSOLUTIONS.COM  Tue Jul 22 17:43:48 2003
From: damian at WORKGROUPSOLUTIONS.COM (Damian Mendoza)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
Message-ID: <F6B4162F6771E44ABF0958023547FFC4096730@w2kserver.workgroupsolutions.com>

Matt,

If you find the resolution, please let me know. It's been killing me at one of my accounts - the CEO hates getting SPAM and he is the one that keeps getting the "whitelisted" SPAM.

Regards,

Damian

-----Original Message-----
From: Matt Kettler [mailto:mkettler@EVI-INC.COM]
Sent: Tuesday, July 22, 2003 9:16 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Whitelisted


At 10:19 AM 7/22/2003 -0400, Kris Zabriskie wrote:
>I know this has come up several times on the MailScanner mailing list, but I
>have not seen a clear cut answer on why this happends and I know several
>people are having the same problem.  Our spam has gone through the roof
>recently.  A good portion of it is spam, that SpamAssassin has identified as
>spam, but in the header it says "not spam (whitelisted)".  OK.  Obviously
>somewhere it says, that this e-mail address is ok.  So I continue to look
>around.  No mentionment of the address in spam.whitelist.rules for
>mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
>address is not in there, in fact I delete all of the addresses.  I then,
>jump over to the MailScanner conf, and take a look in there to make sure I
>am not using SA for whitelisting.  In the MailScanner conf it says:
>SpamAssassin Auto Whitelist = no

The "not spam (whitelisted)" is a MailScanner whitelisting, not a
SpamAssassin whitelisting. Check your mailscanner config.

SA will indicate whitelists by rules that modify the score, and not any
other way.


From Steve at swaney.com  Tue Jul 22 17:54:21 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:01 2006
Subject: User Verification
In-Reply-To: <00FD7F04EA248947B8FBB971044379DB110644@corpserv1.hvcorp.hypervine.net>
References: <00FD7F04EA248947B8FBB971044379DB110644@corpserv1.hvcorp.hypervine.net>
Message-ID: <1058892861.3386.38.camel@speedy>

Randy,

A lot easier (and better) to do this in the MTA. A sendmail example
would be to use the virtusertable feature.

Enable sendmail to use the virtusertable feature, then create the
virtual user table with entries similar to:

joe@yourdomain.com                       joe@yourdomain1.com

jim@yourdomain.com              jim@yourdomain.com
sally@yourdomain.com            sally@yourdomain.com
@yourdomain.com                 error:nouser No such user here

A fuller explanation can be found at:
http://naughty.monkey.org/openbsd/archive/misc/0204/msg00846.html


On Tue, 2003-07-22 at 12:43, Randy Herban wrote:

> I have a question about how versitile mailscanner/spamassassin might be
> to do user verification.
>
> I've been thinkin about it for a while and my mentality was to have
> mailscanner do the verification, if the user doesn't exist, delete the
> mail and proceed onto the next, bypassing the rest of the checks as we
> won't be delivering this mail anyway.
> This has a nasty side as legit mail to a user who was just deleted
> wouldn't get bounced back.
>
> My next thought was to use a spamassassin type scoring to it.  For each
> nonexistent user we add a score of 1.  If there are that many to push it
> over the high spam score then it will get deleted but single messages
> (boucebacks) would go under the radar and get delivered fine.
>
> I know that I would be able to write this into mailscanner itself (being
> as it's a perl script) but not sure if it's possible to tie it into the
> spamassassin scoring.
>
> Does anyone with more knowledge have any input that might assist me?
>
> Thanks
> Randy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/86afc59b/attachment.html
From mkettler at EVI-INC.COM  Tue Jul 22 17:57:19 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
In-Reply-To: <F6B4162F6771E44ABF0958023547FFC4096730@w2kserver.workgroup
              solutions.com>
Message-ID: <5.2.1.1.0.20030722125412.018882c8@xanadu.evi-inc.com>

At 09:43 AM 7/22/2003 -0700, Damian Mendoza wrote:

>If you find the resolution, please let me know. It's been killing me at
>one of my accounts - the CEO hates getting SPAM and he is the one that
>keeps getting the "whitelisted" SPAM.

I can't find the resolution to a problem I don't have.

My offhanded guess is you've got a mailscanner "accept spam from" statement
that covers a secondary MX.

But this is a problem with your configuration, so you're going to have to
look at the message headers of the whitelisted messages, and at your
mailscanner.conf and figure out why they are matching.

From zabriskw at ITECH.NET  Tue Jul 22 17:59:47 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
References: <5.2.1.1.0.20030722121437.01887368@xanadu.evi-inc.com>
Message-ID: <001601c35072$a89b26e0$0c02a8c0@itech.dom>

Matt,
Thank you for the reply.  I have just looked at my MailScanner.conf file
again, and I do not see anything in there, that would allow for these
messages to be whitelisted.  The only thing I can think of, is if the
spammers were forging the e-mail envelop address as something that I have
whitelisted (only 3 domains).  However, that would be apparent in the
mail.log for sendmail, and that is not appearing to be the case at all.  I
am absolutely clueless about why these are being whitelisted.  I will post
mailscanner.conf and spam.whitelist.rules if that would help at all, but I
don't want to clutter the mailing list if that isn't going to help.  Thanks
again for your help!



----- Original Message -----
From: "Matt Kettler" <mkettler@EVI-INC.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 22, 2003 12:15 PM
Subject: Re: Whitelisted


> At 10:19 AM 7/22/2003 -0400, Kris Zabriskie wrote:
> >I know this has come up several times on the MailScanner mailing list,
but I
> >have not seen a clear cut answer on why this happends and I know several
> >people are having the same problem.  Our spam has gone through the roof
> >recently.  A good portion of it is spam, that SpamAssassin has identified
as
> >spam, but in the header it says "not spam (whitelisted)".  OK.  Obviously
> >somewhere it says, that this e-mail address is ok.  So I continue to look
> >around.  No mentionment of the address in spam.whitelist.rules for
> >mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
> >address is not in there, in fact I delete all of the addresses.  I then,
> >jump over to the MailScanner conf, and take a look in there to make sure
I
> >am not using SA for whitelisting.  In the MailScanner conf it says:
> >SpamAssassin Auto Whitelist = no
>
> The "not spam (whitelisted)" is a MailScanner whitelisting, not a
> SpamAssassin whitelisting. Check your mailscanner config.
>
> SA will indicate whitelists by rules that modify the score, and not any
> other way.
>

From steve.douglas at SBIINCORPORATED.COM  Tue Jul 22 18:14:35 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
Message-ID: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com>

I pretty well have given up on trying to figure out this too.  I have
numerous address in my spam.whitelist.rules and they just get plain ignored.
This statement is invoked by the "Is Definitely Not Spam" statement in the
MS conf file.

SD
:-)


> -----Original Message-----
> From: Kris Zabriskie [mailto:zabriskw@ITECH.NET]
> Sent: Tuesday, July 22, 2003 9:20 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Whitelisted
>
> I know this has come up several times on the MailScanner mailing list, but
> I
> have not seen a clear cut answer on why this happends and I know several
> people are having the same problem.  Our spam has gone through the roof
> recently.  A good portion of it is spam, that SpamAssassin has identified
> as
> spam, but in the header it says "not spam (whitelisted)".  OK.  Obviously
> somewhere it says, that this e-mail address is ok.  So I continue to look
> around.  No mentionment of the address in spam.whitelist.rules for
> mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
> address is not in there, in fact I delete all of the addresses.  I then,
> jump over to the MailScanner conf, and take a look in there to make sure I
> am not using SA for whitelisting.  In the MailScanner conf it says:
> SpamAssassin Auto Whitelist = no
>
> I have NO idea what is going on here!  Below is just an example of one
> that
> got through.
>
> This is everything from mail.log pertaining to the example message:
>
> Jul 22 09:11:08 mustang sendmail[385422]: h6MDB1OS385422:
> from=<7hd29nsrepo@springfieldrealty.com>, size=2700, class=0, nrcpts=17,
> msgid=<xi2$-6$s-$9t$2chf4$-okqx0ur-ms@7pjel.x.vy5>, proto=SMTP,
> daemon=MTA,
> relay=_Crystal@c66.110.164-221.clta.globetrotter.net [66.110.164.221]
> Jul 22 09:11:12 mustang sendmail[387950]: h6MDB1OS385422:
> to=<bmyers@itech.net>,<bmcnamee@itech.net>,<blue1@itech.net>,<blshu@itech.
> ne
> t>,<bknipple@itech.net>,support,<brandon@itech.net>,<bobs@itech.net>,<bigo
> pi
> mp@itech.net>,<bassman@itech.net>,<baron@itech.net>,<bigbro@itech.net>,<be
> rr
> ier@itech.net>,<bergman@itech.net>,<bentley@itech.net>,<bearden@itech.net>
> ,<
> bbani@itech.net>, delay=00:00:11, xdelay=00:00:01, mailer=local,
> pri=600558,
> dsn=2.0.0, stat=Sent
>
> This is the header of the email:
>
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-MailScanner-Information: Please contact the ISP for more information
> X-MailScanner: Found to be clean
> X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=8.2,
> required 5, BANG_GUARANTEE, CLICK_BELOW_CAPS, HTML_70_80, HTML_FONT_BIG,
> HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE, MIME_HTML_ONLY,
> MISSING_MIMEOLD, MISSING_OUTLOOK_NAME, OBFUSCATING_COMMENT,
> PENIS_ENLARGE2)
>
> Any help would be greatly appreciated.  I am trying to stop little kids
> from
> getting bombarded with Penis Enlargement e-mails.  Thanks in advance.
>
>
> Kris Zabriskie
> Network Admin / Consultant
> I-Tech Inc.
> zabriskw@itech.net
> 717-657-3035

From zabriskw at ITECH.NET  Tue Jul 22 18:19:51 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com>
Message-ID: <000501c35075$75e0d350$0c02a8c0@itech.dom>

If this continues, I think I am going to have to change products, which I
really do not want to do.


----- Original Message -----
From: "Steve Douglas" <steve.douglas@SBIINCORPORATED.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 22, 2003 1:14 PM
Subject: Re: Whitelisted


> I pretty well have given up on trying to figure out this too.  I have
> numerous address in my spam.whitelist.rules and they just get plain
ignored.
> This statement is invoked by the "Is Definitely Not Spam" statement in the
> MS conf file.
>
> SD
> :-)
>
>
> > -----Original Message-----
> > From: Kris Zabriskie [mailto:zabriskw@ITECH.NET]
> > Sent: Tuesday, July 22, 2003 9:20 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Whitelisted
> >
> > I know this has come up several times on the MailScanner mailing list,
but
> > I
> > have not seen a clear cut answer on why this happends and I know several
> > people are having the same problem.  Our spam has gone through the roof
> > recently.  A good portion of it is spam, that SpamAssassin has
identified
> > as
> > spam, but in the header it says "not spam (whitelisted)".  OK.
Obviously
> > somewhere it says, that this e-mail address is ok.  So I continue to
look
> > around.  No mentionment of the address in spam.whitelist.rules for
> > mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
> > address is not in there, in fact I delete all of the addresses.  I then,
> > jump over to the MailScanner conf, and take a look in there to make sure
I
> > am not using SA for whitelisting.  In the MailScanner conf it says:
> > SpamAssassin Auto Whitelist = no
> >
> > I have NO idea what is going on here!  Below is just an example of one
> > that
> > got through.
> >
> > This is everything from mail.log pertaining to the example message:
> >
> > Jul 22 09:11:08 mustang sendmail[385422]: h6MDB1OS385422:
> > from=<7hd29nsrepo@springfieldrealty.com>, size=2700, class=0, nrcpts=17,
> > msgid=<xi2$-6$s-$9t$2chf4$-okqx0ur-ms@7pjel.x.vy5>, proto=SMTP,
> > daemon=MTA,
> > relay=_Crystal@c66.110.164-221.clta.globetrotter.net [66.110.164.221]
> > Jul 22 09:11:12 mustang sendmail[387950]: h6MDB1OS385422:
> >
to=<bmyers@itech.net>,<bmcnamee@itech.net>,<blue1@itech.net>,<blshu@itech.
> > ne
> >
t>,<bknipple@itech.net>,support,<brandon@itech.net>,<bobs@itech.net>,<bigo
> > pi
> >
mp@itech.net>,<bassman@itech.net>,<baron@itech.net>,<bigbro@itech.net>,<be
> > rr
> >
ier@itech.net>,<bergman@itech.net>,<bentley@itech.net>,<bearden@itech.net>
> > ,<
> > bbani@itech.net>, delay=00:00:11, xdelay=00:00:01, mailer=local,
> > pri=600558,
> > dsn=2.0.0, stat=Sent
> >
> > This is the header of the email:
> >
> > X-Priority: 3
> > X-MSMail-Priority: Normal
> > X-MailScanner-Information: Please contact the ISP for more information
> > X-MailScanner: Found to be clean
> > X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin
(score=8.2,
> > required 5, BANG_GUARANTEE, CLICK_BELOW_CAPS, HTML_70_80, HTML_FONT_BIG,
> > HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE,
MIME_HTML_ONLY,
> > MISSING_MIMEOLD, MISSING_OUTLOOK_NAME, OBFUSCATING_COMMENT,
> > PENIS_ENLARGE2)
> >
> > Any help would be greatly appreciated.  I am trying to stop little kids
> > from
> > getting bombarded with Penis Enlargement e-mails.  Thanks in advance.
> >
> >
> > Kris Zabriskie
> > Network Admin / Consultant
> > I-Tech Inc.
> > zabriskw@itech.net
> > 717-657-3035
>

From ka at PACIFIC.NET  Tue Jul 22 18:29:20 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
In-Reply-To: <000501c35075$75e0d350$0c02a8c0@itech.dom>
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com>
            <000501c35075$75e0d350$0c02a8c0@itech.dom>
Message-ID: <3F1D7470.6040000@pacific.net>

Can't help you without information. Post your whitelist rules, post your
maillogs & msg headers for the messages that were mysteriously
whitelisted. Try running mailscanner in debug mode? (I have never tried
this, so I can't really help here)
Ken A.


Kris Zabriskie wrote:

> If this continues, I think I am going to have to change products, which I
> really do not want to do.
>
>
> ----- Original Message -----
> From: "Steve Douglas" <steve.douglas@SBIINCORPORATED.COM>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Tuesday, July 22, 2003 1:14 PM
> Subject: Re: Whitelisted
>
>
>
>>I pretty well have given up on trying to figure out this too.  I have
>>numerous address in my spam.whitelist.rules and they just get plain
>
> ignored.
>
>>This statement is invoked by the "Is Definitely Not Spam" statement in the
>>MS conf file.
>>
>>SD
>>:-)
>>
>>
>>
>>>-----Original Message-----
>>>From: Kris Zabriskie [mailto:zabriskw@ITECH.NET]
>>>Sent: Tuesday, July 22, 2003 9:20 AM
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Whitelisted
>>>
>>>I know this has come up several times on the MailScanner mailing list,
>
> but
>
>>>I
>>>have not seen a clear cut answer on why this happends and I know several
>>>people are having the same problem.  Our spam has gone through the roof
>>>recently.  A good portion of it is spam, that SpamAssassin has
>
> identified
>
>>>as
>>>spam, but in the header it says "not spam (whitelisted)".  OK.
>
> Obviously
>
>>>somewhere it says, that this e-mail address is ok.  So I continue to
>
> look
>
>>>around.  No mentionment of the address in spam.whitelist.rules for
>>>mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
>>>address is not in there, in fact I delete all of the addresses.  I then,
>>>jump over to the MailScanner conf, and take a look in there to make sure
>
> I
>
>>>am not using SA for whitelisting.  In the MailScanner conf it says:
>>>SpamAssassin Auto Whitelist = no
>>>
>>>I have NO idea what is going on here!  Below is just an example of one
>>>that
>>>got through.
>>>
>>>This is everything from mail.log pertaining to the example message:
>>>
>>>Jul 22 09:11:08 mustang sendmail[385422]: h6MDB1OS385422:
>>>from=<7hd29nsrepo@springfieldrealty.com>, size=2700, class=0, nrcpts=17,
>>>msgid=<xi2$-6$s-$9t$2chf4$-okqx0ur-ms@7pjel.x.vy5>, proto=SMTP,
>>>daemon=MTA,
>>>relay=_Crystal@c66.110.164-221.clta.globetrotter.net [66.110.164.221]
>>>Jul 22 09:11:12 mustang sendmail[387950]: h6MDB1OS385422:
>>>
>
> to=<bmyers@itech.net>,<bmcnamee@itech.net>,<blue1@itech.net>,<blshu@itech.
>
>>>ne
>>>
>
> t>,<bknipple@itech.net>,support,<brandon@itech.net>,<bobs@itech.net>,<bigo
>
>>>pi
>>>
>
> mp@itech.net>,<bassman@itech.net>,<baron@itech.net>,<bigbro@itech.net>,<be
>
>>>rr
>>>
>
> ier@itech.net>,<bergman@itech.net>,<bentley@itech.net>,<bearden@itech.net>
>
>>>,<
>>>bbani@itech.net>, delay=00:00:11, xdelay=00:00:01, mailer=local,
>>>pri=600558,
>>>dsn=2.0.0, stat=Sent
>>>
>>>This is the header of the email:
>>>
>>>X-Priority: 3
>>>X-MSMail-Priority: Normal
>>>X-MailScanner-Information: Please contact the ISP for more information
>>>X-MailScanner: Found to be clean
>>>X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin
>
> (score=8.2,
>
>>>required 5, BANG_GUARANTEE, CLICK_BELOW_CAPS, HTML_70_80, HTML_FONT_BIG,
>>>HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE,
>
> MIME_HTML_ONLY,
>
>>>MISSING_MIMEOLD, MISSING_OUTLOOK_NAME, OBFUSCATING_COMMENT,
>>>PENIS_ENLARGE2)
>>>
>>>Any help would be greatly appreciated.  I am trying to stop little kids
>>>from
>>>getting bombarded with Penis Enlargement e-mails.  Thanks in advance.
>>>
>>>
>>>Kris Zabriskie
>>>Network Admin / Consultant
>>>I-Tech Inc.
>>>zabriskw@itech.net
>>>717-657-3035
>>
>
>

From zabriskw at ITECH.NET  Tue Jul 22 18:42:01 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com> 
            <000501c35075$75e0d350$0c02a8c0@itech.dom> 
            <3F1D7470.6040000@pacific.net>
Message-ID: <000901c35078$8efbcc70$0c02a8c0@itech.dom>

Here is everything:

Contents:
mail.log is the sendmail mail.log (ONLY information pertaining to the
message in question)
mail.header is the header of the e-mail
spam.whitelist.rules is exactly what it says
MailScanner.conf is exactly what it is =)

Any help will greatly be appreciated!!!  Thanks again to everyone for their
help, and patience!


----- Original Message -----
From: "Ken Anderson" <ka@PACIFIC.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 22, 2003 1:29 PM
Subject: Re: Whitelisted


> Can't help you without information. Post your whitelist rules, post your
> maillogs & msg headers for the messages that were mysteriously
> whitelisted. Try running mailscanner in debug mode? (I have never tried
> this, so I can't really help here)
> Ken A.
>
>
> Kris Zabriskie wrote:
>
> > If this continues, I think I am going to have to change products, which
I
> > really do not want to do.
> >
> >
> > ----- Original Message -----
> > From: "Steve Douglas" <steve.douglas@SBIINCORPORATED.COM>
> > To: <MAILSCANNER@JISCMAIL.AC.UK>
> > Sent: Tuesday, July 22, 2003 1:14 PM
> > Subject: Re: Whitelisted
> >
> >
> >
> >>I pretty well have given up on trying to figure out this too.  I have
> >>numerous address in my spam.whitelist.rules and they just get plain
> >
> > ignored.
> >
> >>This statement is invoked by the "Is Definitely Not Spam" statement in
the
> >>MS conf file.
> >>
> >>SD
> >>:-)
> >>
> >>
> >>
> >>>-----Original Message-----
> >>>From: Kris Zabriskie [mailto:zabriskw@ITECH.NET]
> >>>Sent: Tuesday, July 22, 2003 9:20 AM
> >>>To: MAILSCANNER@JISCMAIL.AC.UK
> >>>Subject: Whitelisted
> >>>
> >>>I know this has come up several times on the MailScanner mailing list,
> >
> > but
> >
> >>>I
> >>>have not seen a clear cut answer on why this happends and I know
several
> >>>people are having the same problem.  Our spam has gone through the roof
> >>>recently.  A good portion of it is spam, that SpamAssassin has
> >
> > identified
> >
> >>>as
> >>>spam, but in the header it says "not spam (whitelisted)".  OK.
> >
> > Obviously
> >
> >>>somewhere it says, that this e-mail address is ok.  So I continue to
> >
> > look
> >
> >>>around.  No mentionment of the address in spam.whitelist.rules for
> >>>mailscanner.  So it must be SA!  I go over to 60_whitelist.conf.  The
> >>>address is not in there, in fact I delete all of the addresses.  I
then,
> >>>jump over to the MailScanner conf, and take a look in there to make
sure
> >
> > I
> >
> >>>am not using SA for whitelisting.  In the MailScanner conf it says:
> >>>SpamAssassin Auto Whitelist = no
> >>>
> >>>I have NO idea what is going on here!  Below is just an example of one
> >>>that
> >>>got through.
> >>>
> >>>This is everything from mail.log pertaining to the example message:
> >>>
> >>>Jul 22 09:11:08 mustang sendmail[385422]: h6MDB1OS385422:
> >>>from=<7hd29nsrepo@springfieldrealty.com>, size=2700, class=0,
nrcpts=17,
> >>>msgid=<xi2$-6$s-$9t$2chf4$-okqx0ur-ms@7pjel.x.vy5>, proto=SMTP,
> >>>daemon=MTA,
> >>>relay=_Crystal@c66.110.164-221.clta.globetrotter.net [66.110.164.221]
> >>>Jul 22 09:11:12 mustang sendmail[387950]: h6MDB1OS385422:
> >>>
> >
> >
to=<bmyers@itech.net>,<bmcnamee@itech.net>,<blue1@itech.net>,<blshu@itech.
> >
> >>>ne
> >>>
> >
> >
t>,<bknipple@itech.net>,support,<brandon@itech.net>,<bobs@itech.net>,<bigo
> >
> >>>pi
> >>>
> >
> >
mp@itech.net>,<bassman@itech.net>,<baron@itech.net>,<bigbro@itech.net>,<be
> >
> >>>rr
> >>>
> >
> >
ier@itech.net>,<bergman@itech.net>,<bentley@itech.net>,<bearden@itech.net>
> >
> >>>,<
> >>>bbani@itech.net>, delay=00:00:11, xdelay=00:00:01, mailer=local,
> >>>pri=600558,
> >>>dsn=2.0.0, stat=Sent
> >>>
> >>>This is the header of the email:
> >>>
> >>>X-Priority: 3
> >>>X-MSMail-Priority: Normal
> >>>X-MailScanner-Information: Please contact the ISP for more information
> >>>X-MailScanner: Found to be clean
> >>>X-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin
> >
> > (score=8.2,
> >
> >>>required 5, BANG_GUARANTEE, CLICK_BELOW_CAPS, HTML_70_80,
HTML_FONT_BIG,
> >>>HTML_LINK_CLICK_CAPS, HTML_LINK_CLICK_HERE, HTML_MESSAGE,
> >
> > MIME_HTML_ONLY,
> >
> >>>MISSING_MIMEOLD, MISSING_OUTLOOK_NAME, OBFUSCATING_COMMENT,
> >>>PENIS_ENLARGE2)
> >>>
> >>>Any help would be greatly appreciated.  I am trying to stop little kids
> >>>from
> >>>getting bombarded with Penis Enlargement e-mails.  Thanks in advance.
> >>>
> >>>
> >>>Kris Zabriskie
> >>>Network Admin / Consultant
> >>>I-Tech Inc.
> >>>zabriskw@itech.net
> >>>717-657-3035
> >>
> >
> >
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: MailScanner.conf
Type: application/octet-stream
Size: 43011 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/f5cb8328/MailScanner.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: spam.whitelist.rules
Type: application/octet-stream
Size: 2248 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/f5cb8328/spam.whitelist.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mail.header
Type: application/octet-stream
Size: 1352 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/f5cb8328/mail.obj
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mail.log
Type: application/octet-stream
Size: 737 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/f5cb8328/mail-0001.obj
From dustin.baer at IHS.COM  Tue Jul 22 18:51:27 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com>
            <000501c35075$75e0d350$0c02a8c0@itech.dom>
            <3F1D7470.6040000@pacific.net>
            <000901c35078$8efbcc70$0c02a8c0@itech.dom>
Message-ID: <3F1D799F.58B5B272@ihs.com>

Kris Zabriskie wrote:
>
> Here is everything:
>
> Contents:
> mail.log is the sendmail mail.log (ONLY information pertaining to the
> message in question)
> mail.header is the header of the e-mail
> spam.whitelist.rules is exactly what it says
> MailScanner.conf is exactly what it is =)


Check this entry in spam.whitelist.rules: "To:
blshu@itech.net             yes # for her daily drool"

Check this entry in the mail logs:   to=...<blshu@itech.net>,...

Hope you don't have to change products now.

Dustin
--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

From zabriskw at ITECH.NET  Tue Jul 22 18:54:47 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:19:01 2006
Subject: Whitelisted
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com> 
            <000501c35075$75e0d350$0c02a8c0@itech.dom>           
            <3F1D7470.6040000@pacific.net>           
            <000901c35078$8efbcc70$0c02a8c0@itech.dom> 
            <3F1D799F.58B5B272@ihs.com>
Message-ID: <001e01c3507a$576d02e0$0c02a8c0@itech.dom>

Dustin,
Maybe that is where my misunderstanding is.  I thought, that would turn off
spam filtering for that user only.  Does that say anything addressed to that
user and anyone else, will go through?


----- Original Message -----
From: "Dustin Baer" <dustin.baer@IHS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 22, 2003 1:51 PM
Subject: Re: Whitelisted


> Kris Zabriskie wrote:
> >
> > Here is everything:
> >
> > Contents:
> > mail.log is the sendmail mail.log (ONLY information pertaining to the
> > message in question)
> > mail.header is the header of the e-mail
> > spam.whitelist.rules is exactly what it says
> > MailScanner.conf is exactly what it is =)
>
>
> Check this entry in spam.whitelist.rules: "To:
> blshu@itech.net             yes # for her daily drool"
>
> Check this entry in the mail logs:   to=...<blshu@itech.net>,...
>
> Hope you don't have to change products now.
>
> Dustin
> --
> Dustin Baer
> Unix Administrator/Postmaster
> Information Handling Services
> 15 Inverness Way East
> Englewood, CO 80112
> 303-397-2836
>

From mbowman at UDCOM.COM  Tue Jul 22 18:57:35 2003
From: mbowman at UDCOM.COM (Matthew Bowman)
Date: Thu Jan 12 21:19:02 2006
Subject: Whitelisted
Message-ID: <OFBE6CB9AB.733620DD-ON85256D6B.00627781-85256D6B.0062C96F@udcomm.net>

Kris,

No.. That means that anything tagged as SPAM will not get tagged as SPAM
for that using and all e-mail (save for viruses) is delivered as normal.

If you want to disable spam scanning for a user, you need to use the
following option (see my example below)

# Do you want to check messages to see if they are spam?
# This can also be the filename of a ruleset.
Spam Checks = /etc/MailScanner/rules/spam.check.rules

FromOrTo:       mbowman@udcom.com       no

HTH

Matthew







Kris Zabriskie <zabriskw@ITECH.NET>
Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
07/22/2003 01:54 PM
Please respond to MailScanner mailing list


        To:     MAILSCANNER@JISCMAIL.AC.UK
        cc:
        Subject:        Re: Whitelisted


Dustin,
Maybe that is where my misunderstanding is.  I thought, that would turn
off
spam filtering for that user only.  Does that say anything addressed to
that
user and anyone else, will go through?


----- Original Message -----
From: "Dustin Baer" <dustin.baer@IHS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 22, 2003 1:51 PM
Subject: Re: Whitelisted


> Kris Zabriskie wrote:
> >
> > Here is everything:
> >
> > Contents:
> > mail.log is the sendmail mail.log (ONLY information pertaining to the
> > message in question)
> > mail.header is the header of the e-mail
> > spam.whitelist.rules is exactly what it says
> > MailScanner.conf is exactly what it is =)
>
>
> Check this entry in spam.whitelist.rules: "To:
> blshu@itech.net             yes # for her daily drool"
>
> Check this entry in the mail logs:   to=...<blshu@itech.net>,...
>
> Hope you don't have to change products now.
>
> Dustin
> --
> Dustin Baer
> Unix Administrator/Postmaster
> Information Handling Services
> 15 Inverness Way East
> Englewood, CO 80112
> 303-397-2836
>

From dustin.baer at IHS.COM  Tue Jul 22 19:00:52 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:19:02 2006
Subject: Whitelisted
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com>
            <000501c35075$75e0d350$0c02a8c0@itech.dom>
            <3F1D7470.6040000@pacific.net>
            <000901c35078$8efbcc70$0c02a8c0@itech.dom>
            <3F1D799F.58B5B272@ihs.com>
            <001e01c3507a$576d02e0$0c02a8c0@itech.dom>
Message-ID: <3F1D7BD4.31F8CD58@ihs.com>

Kris Zabriskie wrote:
>
> Dustin,
> Maybe that is where my misunderstanding is.  I thought, that would turn off
> spam filtering for that user only.  Does that say anything addressed to that
> user and anyone else, will go through?

Hi Kris,

As far as I understand MailScanner's whitelisting, if one recipient is
in the whitelist, all recipients receive the message.  I have run into
your situation also, and refuse to whitelist recipient names here, if I
see that they receive a high volume of spam.  I don't want other people
getting spam, just because they want their name whitelisted.

I am sure someone will correct me, if I have mis-stated how MailScanner
operates its whitelist.

Good luck with your CEO!

Dustin




>
> ----- Original Message -----
> From: "Dustin Baer" <dustin.baer@IHS.COM>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Tuesday, July 22, 2003 1:51 PM
> Subject: Re: Whitelisted
>
> > Kris Zabriskie wrote:
> > >
> > > Here is everything:
> > >
> > > Contents:
> > > mail.log is the sendmail mail.log (ONLY information pertaining to the
> > > message in question)
> > > mail.header is the header of the e-mail
> > > spam.whitelist.rules is exactly what it says
> > > MailScanner.conf is exactly what it is =)
> >
> >
> > Check this entry in spam.whitelist.rules: "To:
> > blshu@itech.net             yes # for her daily drool"
> >
> > Check this entry in the mail logs:   to=...<blshu@itech.net>,...
> >
> > Hope you don't have to change products now.
> >
> > Dustin
> > --
> > Dustin Baer
> > Unix Administrator/Postmaster
> > Information Handling Services
> > 15 Inverness Way East
> > Englewood, CO 80112
> > 303-397-2836

From ka at PACIFIC.NET  Tue Jul 22 19:16:53 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:02 2006
Subject: Whitelisted
In-Reply-To: <3F1D7BD4.31F8CD58@ihs.com>
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com> 
            <000501c35075$75e0d350$0c02a8c0@itech.dom>           
            <3F1D7470.6040000@pacific.net>           
            <000901c35078$8efbcc70$0c02a8c0@itech.dom>           
            <3F1D799F.58B5B272@ihs.com>           
            <001e01c3507a$576d02e0$0c02a8c0@itech.dom>
            <3F1D7BD4.31F8CD58@ihs.com>
Message-ID: <3F1D7F95.20908@pacific.net>

See the previous thread on "mailscanner only sees the envelope TO -
solved" for a solution to this problem.
Ken

Dustin Baer wrote:

> Kris Zabriskie wrote:
>
>>Dustin,
>>Maybe that is where my misunderstanding is.  I thought, that would turn off
>>spam filtering for that user only.  Does that say anything addressed to that
>>user and anyone else, will go through?
>
>
> Hi Kris,
>
> As far as I understand MailScanner's whitelisting, if one recipient is
> in the whitelist, all recipients receive the message.  I have run into
> your situation also, and refuse to whitelist recipient names here, if I
> see that they receive a high volume of spam.  I don't want other people
> getting spam, just because they want their name whitelisted.
>
> I am sure someone will correct me, if I have mis-stated how MailScanner
> operates its whitelist.
>
> Good luck with your CEO!
>
> Dustin
>
>
>
>
>
>>----- Original Message -----
>>From: "Dustin Baer" <dustin.baer@IHS.COM>
>>To: <MAILSCANNER@JISCMAIL.AC.UK>
>>Sent: Tuesday, July 22, 2003 1:51 PM
>>Subject: Re: Whitelisted
>>
>>
>>>Kris Zabriskie wrote:
>>>
>>>>Here is everything:
>>>>
>>>>Contents:
>>>>mail.log is the sendmail mail.log (ONLY information pertaining to the
>>>>message in question)
>>>>mail.header is the header of the e-mail
>>>>spam.whitelist.rules is exactly what it says
>>>>MailScanner.conf is exactly what it is =)
>>>
>>>
>>>Check this entry in spam.whitelist.rules: "To:
>>>blshu@itech.net             yes # for her daily drool"
>>>
>>>Check this entry in the mail logs:   to=...<blshu@itech.net>,...
>>>
>>>Hope you don't have to change products now.
>>>
>>>Dustin
>>>--
>>>Dustin Baer
>>>Unix Administrator/Postmaster
>>>Information Handling Services
>>>15 Inverness Way East
>>>Englewood, CO 80112
>>>303-397-2836
>
>
>

From dustin.baer at IHS.COM  Tue Jul 22 19:28:33 2003
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:19:02 2006
Subject: Whitelisted
References: <OFBE6CB9AB.733620DD-ON85256D6B.00627781-85256D6B.0062C96F@udcomm.net>
Message-ID: <3F1D8251.2D82251F@ihs.com>

Matthew Bowman wrote:
>
> If you want to disable spam scanning for a user, you need to use the
> following option (see my example below)
>
> # Do you want to check messages to see if they are spam?
> # This can also be the filename of a ruleset.
> Spam Checks = /etc/MailScanner/rules/spam.check.rules
>
> FromOrTo:       mbowman@udcom.com       no

I just put the following entry in my SpamChecks.rules file:

        FromOrTo:       devnull@ihs.com         no

And sent devnull@ihs.com and dustin.baer@ihs.com a spam filled email.  I
received the email and no spam checking was done.  After taking the
above entry out of SpamChecks.rules and resending the email, the message
was properly quarantined.

It seems to me that your example is acting the same way as whitelisting
an email address.

Did I misunderstand you?

Dustin

--
Dustin Baer
Unix Administrator/Postmaster
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

From thomas_duvally at BROWN.EDU  Tue Jul 22 19:35:22 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
Message-ID: <1058898921.1282.38.camel@croithine>

I recently upgraded both SA (2.55) and MS (4-20.3). I am running it in
parallel to one of the older versions (2.43/4-10).

I process about 70-100k per system per day. Each machine is otherwise
identical and getting the same number and types of messages (equally
weighted MX)

Everyday around peak time the upgraded system starts to get backed up.
The incoming queue goes from a normal 2-4 message count up to 1000+.

Restarting MS will begin clearing this out.

Question:  Is there a possible memory issue with eith MS or SA I should
be aware of?  I've got it trimmed down pretty good with no bayes or RBLS
and only incoming messages content checked.

Specs:  Solaris 9
        UltraSparc III+
        2 CPU
        4G mem
        Perl 5.8

If I can't figure this out I may have to downgrade.
--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From TGFurnish at HERFF-JONES.COM  Tue Jul 22 19:37:06 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:02 2006
Subject: moving the bayes files?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C0306@inex1.herffjones.hj-int>

I suppose I'm taking a rather haphazard approach to learning mailscanner,
but I've recently realized spamassassin *may* be storing bayesian
filtering-related files under /root/.spamassassin on my system, which isn't
a good long-term situation for me, so I stopped mailscanner, uncommented the
following lines in /etc/MailScanner/spam.assassin.prefs.conf, and restarted
MailScanner:

auto_whitelist_path        /var/spool/spamassassin/auto-whitelist
auto_whitelist_file_mode   0600
bayes_path                 /var/spool/spamassassin/bayes
bayes_file_mode            0600

That didn't seem to work (for moving the files) -- The
/var/spool/spamassassin directory did not get created and MailScanner died
quietly.

So...I ran the mailscanner init script with 'stop' as an arg, then did a
mkdir /var/spool/spamassassin, then restarted mailscanner.  Now it doesn't
die, but it also doesn't create files under /var/spool/spamassassin.  What
else do I need to do in order to get that working?  I'm not even sure the
bayesian stuff was working to begin with.

In case it helps, here's the output of spamassassin -D --lint 2>&1 - any
suggestions would be appreciated.

debug: Score set 0 chosen.
debug: running in taint mode? no
debug: ignore: using a test message to lint rules
debug: using "/usr/share/spamassassin" for default rules dir
debug: using "/etc/mail/spamassassin" for site rules dir
debug: using "/root/.spamassassin" for user state dir
debug: using "/root/.spamassassin/user_prefs" for user prefs file
debug: using "/root/.spamassassin" for user state dir
debug: bayes: 22042 tie-ing to DB file R/O /root/.spamassassin/bayes_toks
debug: bayes: 22042 tie-ing to DB file R/O /root/.spamassassin/bayes_seen
debug: debug: Only 5 spam(s) in Bayes DB < 200
debug: bayes: 22042 untie-ing
debug: bayes: 22042 untie-ing db_toks
debug: bayes: 22042 untie-ing db_seen
debug: Score set 1 chosen.
debug: Initialising learner
debug: using "/root/.spamassassin" for user state dir
debug: bayes: 22042 tie-ing to DB file R/O /root/.spamassassin/bayes_toks
debug: bayes: 22042 tie-ing to DB file R/O /root/.spamassassin/bayes_seen
debug: debug: Only 5 spam(s) in Bayes DB < 200
debug: bayes: 22042 untie-ing
debug: bayes: 22042 untie-ing db_toks
debug: bayes: 22042 untie-ing db_seen
debug: is Net::DNS::Resolver available? yes
debug: trying (3) amazon.com...
debug: looking up MX for 'amazon.com'
debug: MX for 'amazon.com' exists? 1
debug: MX lookup of amazon.com succeeded => Dns available (set dns_available
to
hardcode)
debug: is DNS available? 1
debug: running header regexp tests; score so far=0
debug: running body-text per-line regexp tests; score so far=1.9
debug: running raw-body-text per-line regexp tests; score so far=1.9
debug: running uri tests; score so far=1.9
debug: uri tests: Done uriRE
debug: running full-text regexp tests; score so far=1.9
debug: Razor2 is not available
debug: Current PATH is:
/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/us
r/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin
debug: DCC is not available: dccproc not found
debug: Pyzor is not available: pyzor not found
debug: all '*To' addrs:
debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
debug: running meta tests; score so far=2.4
debug: is spam? score=2.4 required=5
tests=DATE_MISSING,MISSING_HEADERS,NO_REAL_
NAME
debug: bayes: 22042 untie-ing

From raymond at PROLOCATION.NET  Tue Jul 22 19:46:05 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <1058898921.1282.38.camel@croithine>
Message-ID: <Pine.LNX.4.44.0307222044510.29552-100000@mailbox.prolocation.net>

Hi!

> Restarting MS will begin clearing this out.
>
> Question:  Is there a possible memory issue with eith MS or SA I should
> be aware of?  I've got it trimmed down pretty good with no bayes or RBLS
> and only incoming messages content checked.

I have a simmilar thing without SA running. After a few days two of m
yservers, both RH9 seem to slow down, sounds like a memmory leak
somewhere. the strange thing is that on a less busy (identical) system all
seems just fine.

Bye,
Raymond.

From thomas_duvally at BROWN.EDU  Tue Jul 22 20:09:05 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <Pine.LNX.4.44.0307222044510.29552-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307222044510.29552-100000@mailbox.prolocation.net>
Message-ID: <1058900944.1278.44.camel@croithine>

On Tue, 2003-07-22 at 14:46, Raymond Dijkxhoorn wrote:

> I have a simmilar thing without SA running. After a few days two of m
> yservers, both RH9 seem to slow down, sounds like a memmory leak
> somewhere. the strange thing is that on a less busy (identical) system all
> seems just fine.

Yup, during the off-peak times (not 11am-3pm) everything is smooth (load
is low, delay is small, queues are almost empty).  At some point each
weekday, some critical mass must be getting reached and blockage
occurs.  The older versions don't seem to care.  Hmmmm....

--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From m.sapsed at BANGOR.AC.UK  Tue Jul 22 21:11:29 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:19:02 2006
Subject: Whitelisted
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com> 
            <000501c35075$75e0d350$0c02a8c0@itech.dom>                      
            <3F1D7470.6040000@pacific.net>                      
            <000901c35078$8efbcc70$0c02a8c0@itech.dom>            
            <3F1D799F.58B5B272@ihs.com>
            <001e01c3507a$576d02e0$0c02a8c0@itech.dom>
Message-ID: <3F1D9A71.4060509@bangor.ac.uk>

Kris et al,

Kris Zabriskie wrote:
> Maybe that is where my misunderstanding is.  I thought, that would turn off
> spam filtering for that user only.  Does that say anything addressed to that
> user and anyone else, will go through?

As other people have said, MailScanner treats each message in one way
only, no matter how many recipients.

Can I ask what you're trying to achieve by whitelisting all those
internal people? Wouldn't it be simpler to let MailScanner/SpamAssassin
mark the messages as they see fit using subject alterations and then let
the users choose what/how to filter using either the subject line or
spam score header. People who don't want to see the spam can filter it,
people who do leave it alone. I believe that would get you to where you
want to be although via a slightly different route?

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From jase at SENSIS.COM  Tue Jul 22 21:16:51 2003
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:19:02 2006
Subject: ClamAV 0.60 problems -  ProcessClamAVOutput: unrecognized line
Message-ID: <ADF6087CA978A4418AF7F76DDCF2F7210275728E@europa.ats.sensis.com>

Hello.  I just upgraded to MailScanner 4.22-5 and ClamAV to 0.60.  I've
noticed a few entries in my mail.log file such as:

Jul 21 15:06:47 hostname MailScanner[26628]:
/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 Rev 14.zip:
Files number limit exceeded.
Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
unrecognised line
"/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 Rev 14.zip:
Files number limit exceeded.". Please contact the authors!
Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
CODE/RDI-68K/Load/LoadAsm.bat
Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
unrecognised line " extracting: CODE/RDI-68K/Load/LoadAsm.bat ". Please
contact the authors!
Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
CODE/RDI-68K/Main/MainCc.bat
Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
unrecognised line " extracting: CODE/RDI-68K/Main/MainCc.bat ". Please
contact the authors!
Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
CODE/RDI-68K/Main/MainMap.bat
Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
unrecognised line " extracting: CODE/RDI-68K/Main/MainMap.bat ". Please
contact the authors!
Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
CODE/RDI-68K/RDISTART/RdiAsm.bat
Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
unrecognised line " extracting: CODE/RDI-68K/RDISTART/RdiAsm.bat ". Please
contact the authors!
Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
CODE/RStatusDecodeDLL/TestDriver/test.bcv
Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
unrecognised line " extracting: CODE/RStatusDecodeDLL/TestDriver/test.bcv ".
Please contact the authors!
Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
CODE/SensorDataDLL/res/SensorDataDLL.rc2
Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
unrecognised line " extracting: CODE/SensorDataDLL/res/SensorDataDLL.rc2 ".
Please contact the authors!

and

Jul 21 19:28:28 hostname MailScanner[25439]:
/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_07_18.zip: File
size limit exceeded.
Jul 21 19:28:28 hostname MailScanner[25439]: ProcessClamAVOutput:
unrecognised line
"/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_07_18.zip:
File size limit exceeded.". Please contact the authors!

I am thinking that this has to do with the new version of ClamAV.  I found
some options for clamscan to disable some of these limits, and put them in
clamav-wrapper.  Specifically, I set

ScanOptions="--max-files=0 --max-space=0 --max-recursion=0"

Questions:

*  Has anyone else come across this?
*  Since MailScanner already has timeouts for virus scanning, would you
think it is safe to run this way?
*  If yes, should this be the default?  (I'm not sure if versions < 0.60
support this - maybe put some comments in the clamav-wrapper script?)
*  Is "unrecognised" British for "unrecognized" or is it just misspelled?

Thanks.

Jason

From mkettler at EVI-INC.COM  Tue Jul 22 21:16:21 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:02 2006
Subject: Whitelisted
In-Reply-To: <3F1D7BD4.31F8CD58@ihs.com>
References: <3963522F0E71474CB14C0FF54A6914F7011152C4@mail.gardenbotanika.com>
            <000501c35075$75e0d350$0c02a8c0@itech.dom>
            <3F1D7470.6040000@pacific.net>
            <000901c35078$8efbcc70$0c02a8c0@itech.dom>
            <3F1D799F.58B5B272@ihs.com>
            <001e01c3507a$576d02e0$0c02a8c0@itech.dom>
Message-ID: <5.2.1.1.0.20030722153627.01471d00@xanadu.evi-inc.com>

At 12:00 PM 7/22/2003 -0600, Dustin Baer wrote:
> > Dustin,
> > Maybe that is where my misunderstanding is.  I thought, that would turn off
> > spam filtering for that user only.  Does that say anything addressed to
> that
> > user and anyone else, will go through?
>
>Hi Kris,
>
>As far as I understand MailScanner's whitelisting, if one recipient is
>in the whitelist, all recipients receive the message.  I have run into
>your situation also, and refuse to whitelist recipient names here, if I
>see that they receive a high volume of spam.  I don't want other people
>getting spam, just because they want their name whitelisted.
>
>I am sure someone will correct me, if I have mis-stated how MailScanner
>operates its whitelist.

That is correct. And this "problem" is a fundamental limit of running at
the MTA layer. It's not a bug, or a mistake, it's a design tradeoff between
flexibility and efficiency.

Mailscanner runs at the MTA layer, not the MDA layer, so there is not one
copy of the message per user when MS sees it.. there's just one message
with many recipients. Thus MailScanner can only whitelist that one message,
or not whitelist it. There is no such thing as "well, later when you go to
deliver this, give these guys this copy, and that guy this other version".
It's one message, and they'll all get the same message, all MailScanner can
do is edit it.

Running at the MTA layer is much more efficient, because you only scan the
message once, but it inherently has limits on "per user" customization. The
MTA layer is the ideal spot to do virus scanning, because you rarely want
user-specific behaviors for virus scanning. However doing spam scanning at
the MTA layer is somewhat limiting if you've got users that need "exceptions".

Personally I deal with it by creating custom SpamAssassin rules instead of
whitelists. This gives me the ability to target specific kinds of messages,
rather than specific sources or destinations. If I have to do a whitelist,
I try to make it a "fromto" type whitelist where it winds up narrowly
defined. I  never use To: type whitelists, and I avoid simple From:
whitelists as well.

From dwinkler at ALGORITHMICS.COM  Tue Jul 22 21:19:43 2003
From: dwinkler at ALGORITHMICS.COM (Derek Winkler)
Date: Thu Jan 12 21:19:02 2006
Subject: Whitelisted
Message-ID: <06EE2C86D3DAD5119A6C0060943F3C97055E70A2@tormail1.algorithmics.com>

See earlier thread on splitting messages with multiple recipients into
messages with one recipient each as a workaround.

-----Original Message-----
From: Matt Kettler [mailto:mkettler@EVI-INC.COM]
Sent: Tuesday, July 22, 2003 4:16 PM
To: MAILSCANNER@jiscmail.ac.uk
Subject: Re: Whitelisted


At 12:00 PM 7/22/2003 -0600, Dustin Baer wrote:
> > Dustin,
> > Maybe that is where my misunderstanding is.  I thought, that would turn
off
> > spam filtering for that user only.  Does that say anything addressed to
> that
> > user and anyone else, will go through?
>
>Hi Kris,
>
>As far as I understand MailScanner's whitelisting, if one recipient is
>in the whitelist, all recipients receive the message.  I have run into
>your situation also, and refuse to whitelist recipient names here, if I
>see that they receive a high volume of spam.  I don't want other people
>getting spam, just because they want their name whitelisted.
>
>I am sure someone will correct me, if I have mis-stated how MailScanner
>operates its whitelist.

That is correct. And this "problem" is a fundamental limit of running at
the MTA layer. It's not a bug, or a mistake, it's a design tradeoff between
flexibility and efficiency.

Mailscanner runs at the MTA layer, not the MDA layer, so there is not one
copy of the message per user when MS sees it.. there's just one message
with many recipients. Thus MailScanner can only whitelist that one message,
or not whitelist it. There is no such thing as "well, later when you go to
deliver this, give these guys this copy, and that guy this other version".
It's one message, and they'll all get the same message, all MailScanner can
do is edit it.

Running at the MTA layer is much more efficient, because you only scan the
message once, but it inherently has limits on "per user" customization. The
MTA layer is the ideal spot to do virus scanning, because you rarely want
user-specific behaviors for virus scanning. However doing spam scanning at
the MTA layer is somewhat limiting if you've got users that need
"exceptions".

Personally I deal with it by creating custom SpamAssassin rules instead of
whitelists. This gives me the ability to target specific kinds of messages,
rather than specific sources or destinations. If I have to do a whitelist,
I try to make it a "fromto" type whitelist where it winds up narrowly
defined. I  never use To: type whitelists, and I avoid simple From:
whitelists as well.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/e7a79321/attachment.html
From Steve at swaney.com  Tue Jul 22 21:38:09 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:02 2006
Subject: Whitelisted
In-Reply-To: <06EE2C86D3DAD5119A6C0060943F3C97055E70A2@tormail1.algorithmics.com>
References: <06EE2C86D3DAD5119A6C0060943F3C97055E70A2@tormail1.algorithmics.com>
Message-ID: <1058906289.29144.14.camel@speedy>

Actually I placed Ken A, Pacific.Net's excellent solution for this in
the MailScanner FAQ.


http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html

How easy can it get.

Steve
Steve Swaney
steve@swaney.com

 On Tue, 2003-07-22 at 16:19, Derek Winkler wrote:

> See earlier thread on splitting messages with multiple recipients into
> messages with one recipient each as a workaround.
>
> -----Original Message-----
> From: Matt Kettler [mailto:mkettler@EVI-INC.COM]
> Sent: Tuesday, July 22, 2003 4:16 PM
> To: MAILSCANNER@jiscmail.ac.uk
> Subject: Re: Whitelisted
>
>
> At 12:00 PM 7/22/2003 -0600, Dustin Baer wrote:
> > > Dustin,
> > > Maybe that is where my misunderstanding is.  I thought, that would
> turn off
> > > spam filtering for that user only.  Does that say anything
> addressed to
> > that
> > > user and anyone else, will go through?
> >
> >Hi Kris,
> >
> >As far as I understand MailScanner's whitelisting, if one recipient
> is
> >in the whitelist, all recipients receive the message.  I have run
> into
> >your situation also, and refuse to whitelist recipient names here, if
> I
> >see that they receive a high volume of spam.  I don't want other
> people
> >getting spam, just because they want their name whitelisted.
> >
> >I am sure someone will correct me, if I have mis-stated how
> MailScanner
> >operates its whitelist.
>
> That is correct. And this "problem" is a fundamental limit of running
> at
> the MTA layer. It's not a bug, or a mistake, it's a design tradeoff
> between
> flexibility and efficiency.
>
> Mailscanner runs at the MTA layer, not the MDA layer, so there is not
> one
> copy of the message per user when MS sees it.. there's just one
> message
> with many recipients. Thus MailScanner can only whitelist that one
> message,
> or not whitelist it. There is no such thing as "well, later when you
> go to
> deliver this, give these guys this copy, and that guy this other
> version".
> It's one message, and they'll all get the same message, all
> MailScanner can
> do is edit it.
>
> Running at the MTA layer is much more efficient, because you only scan
> the
> message once, but it inherently has limits on "per user"
> customization. The
> MTA layer is the ideal spot to do virus scanning, because you rarely
> want
> user-specific behaviors for virus scanning. However doing spam
> scanning at
> the MTA layer is somewhat limiting if you've got users that need
> "exceptions".
>
> Personally I deal with it by creating custom SpamAssassin rules
> instead of
> whitelists. This gives me the ability to target specific kinds of
> messages,
> rather than specific sources or destinations. If I have to do a
> whitelist,
> I try to make it a "fromto" type whitelist where it winds up narrowly
> defined. I  never use To: type whitelists, and I avoid simple From:
> whitelists as well.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/05c8b0ec/attachment.html
From miguelk at KONSULTEX.COM.BR  Tue Jul 22 21:46:56 2003
From: miguelk at KONSULTEX.COM.BR (Miguel Koren O'Brien de Lacy)
Date: Thu Jan 12 21:19:02 2006
Subject: ClamAV 0.60 problems -  ProcessClamAVOutput: unrecognized line
References: <ADF6087CA978A4418AF7F76DDCF2F7210275728E@europa.ats.sensis.com>
Message-ID: <3F1DA2C0.4090904@konsultex.com.br>

Jason;

I have these versions on 2 servers (RH7.3) with the default values and
it works fine form me.

Miguel

Desai, Jason wrote:

>Hello.  I just upgraded to MailScanner 4.22-5 and ClamAV to 0.60.  I've
>noticed a few entries in my mail.log file such as:
>
>Jul 21 15:06:47 hostname MailScanner[26628]:
>/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 Rev 14.zip:
>Files number limit exceeded.
>Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
>unrecognised line
>"/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 Rev 14.zip:
>Files number limit exceeded.". Please contact the authors!
>Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
>CODE/RDI-68K/Load/LoadAsm.bat
>Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
>unrecognised line " extracting: CODE/RDI-68K/Load/LoadAsm.bat ". Please
>contact the authors!
>Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
>CODE/RDI-68K/Main/MainCc.bat
>Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
>unrecognised line " extracting: CODE/RDI-68K/Main/MainCc.bat ". Please
>contact the authors!
>Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
>CODE/RDI-68K/Main/MainMap.bat
>Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
>unrecognised line " extracting: CODE/RDI-68K/Main/MainMap.bat ". Please
>contact the authors!
>Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
>CODE/RDI-68K/RDISTART/RdiAsm.bat
>Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
>unrecognised line " extracting: CODE/RDI-68K/RDISTART/RdiAsm.bat ". Please
>contact the authors!
>Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
>CODE/RStatusDecodeDLL/TestDriver/test.bcv
>Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
>unrecognised line " extracting: CODE/RStatusDecodeDLL/TestDriver/test.bcv ".
>Please contact the authors!
>Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
>CODE/SensorDataDLL/res/SensorDataDLL.rc2
>Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
>unrecognised line " extracting: CODE/SensorDataDLL/res/SensorDataDLL.rc2 ".
>Please contact the authors!
>
>and
>
>Jul 21 19:28:28 hostname MailScanner[25439]:
>/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_07_18.zip: File
>size limit exceeded.
>Jul 21 19:28:28 hostname MailScanner[25439]: ProcessClamAVOutput:
>unrecognised line
>"/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_07_18.zip:
>File size limit exceeded.". Please contact the authors!
>
>I am thinking that this has to do with the new version of ClamAV.  I found
>some options for clamscan to disable some of these limits, and put them in
>clamav-wrapper.  Specifically, I set
>
>ScanOptions="--max-files=0 --max-space=0 --max-recursion=0"
>
>Questions:
>
>*  Has anyone else come across this?
>*  Since MailScanner already has timeouts for virus scanning, would you
>think it is safe to run this way?
>*  If yes, should this be the default?  (I'm not sure if versions < 0.60
>support this - maybe put some comments in the clamav-wrapper script?)
>*  Is "unrecognised" British for "unrecognized" or is it just misspelled?
>
>Thanks.
>
>Jason
>
>

From vboulytchev at COINFOTECH.COM  Tue Jul 22 21:58:18 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:19:02 2006
Subject: CommuniGate Pro - MailScanner update
Message-ID: <1958DE295D9656499ECAAD3642822DE0033FCF@willow.office.coinfotech.com>

John,
    We greatly appreciate your prompt updates.  As my testing goes, I
will keep you posted.  
 
THANKS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

-----Original Message-----
From: John Rudd [mailto:jrudd@UCSC.EDU] 
Sent: Monday, July 21, 2003 4:37 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: CommuniGate Pro - MailScanner update



I have made an update to my scripts for using MailScanner with
CommuniGate Pro.  I have also updated the text of the CommuniGate Pro
rule instructions (the Execute rule no longer needs the [RETPATH] nor
[RCPT] options).

This should change the problem some people noticed with ".bad" files
showing up in the CommuniGate Pro Queue directory, due to "RPFD:" being
prepended to sender's addresses.  This shouldn't happen any more.


You can get the new scripts and information from:

http://people.ucsc.edu/~jrudd/MailScanner


If you have any questions, or notice any new bugs, please let me know.

(And be sure to edit your path to perl in the first line of each script;
it changed in the downloads because my testing platform changed from
Solaris to Linux)


John Rudd


(ps: one person has mentioned that they see some messages being cross
delivered, but I haven't had anyone else mention this problem to me, nor
have I seen it on my own servers; if you do see such a behavior, please
let me know right away, and try to give me plenty of context
information)


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/a2545451/attachment.html
From Denis.Beauchemin at USHERBROOKE.CA  Tue Jul 22 21:32:58 2003
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:19:02 2006
Subject: How to setup a tmpfs on a RH system
Message-ID: <1058905978.3137.37.camel@dbeauchemin.sti.usherbrooke.ca>

Hi,

I would like to experiment with a tmpfs and MS but am at a loss as to
how to create one on a RH 7.3 system.

I searched my man pages and this list's archives to no avail.

Also which directories should I put on it for best performance and
reliability?

Thanks again!

Denis
-- 
Denis Beauchemin, analyste
Universit? de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045


From jrudd at UCSC.EDU  Tue Jul 22 22:02:03 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:02 2006
Subject: PIPE module, mailscanner and cgp2ms/ms2cgp
In-Reply-To: <list-26914945@mail.stalker.com>
Message-ID: <BE8F63B0-BC87-11D7-A34A-003065F939FE@ucsc.edu>

(Mailscanner list: There was another bug reported in the
CGP<->MailScanner scripts, and I've tracked it down and released a new
version today)


I found the problem.  It wasn't what I expected it to be (what I
described earlier).  I'm putting up a second update.

(the problem was this: I had written ms2cgp to accept multiple sendmail
jobs at once, as it should, but had not cleared/reset all of the
variables in the loop (specifically, the one I had not reset was $rcpt;
not sure how that one escaped me), but the bug hadn't shown up because
none of my test servers is being used heavily enough to have multiple
jobs come through in one pass (and we wont be going to production with
CGP until September); I'm guessing no one else is having a heavy enough
load to see it, either, because so far you're the only person to report
it)

(by the way, thank you for your patience, and for helping me track it
down)

The web page has the fixed version of the script now.

For the individual script:
http://people.ucsc.edu/~jrudd/MailScanner/ms2cgp

Or, if you just want the actual fix:

In the ms2cgp script I released yesterday, lines 46 and 47 are:

 >   $msg = "/tmp/ms2cgp.$$.msg";    # the tempfile we'll give to CGP
 >

Change them to this (which will now be lines 46-48, because you're
inserting a new line between the above two lines):

 >   $msg = "/tmp/ms2cgp.$$.msg";    # the tempfile we'll give to CGP
 >   $rcpt = "";
 >


The whole site:
http://people.ucsc.edu/~jrudd/MailScanner

If anyone sees any new bugs, please let me know, and I'll get right on
them.


John


On Tuesday, Jul 22, 2003, at 12:58 US/Pacific, NTIN Page Guy wrote:

>
> Hello John,
>
> We are running Redhat Linux 8.1
>
> This doesn't happen for every message.  I have noticed the messages
> that it does occur on appear to have been delivered at the exact same
> time, down to the second.
>
>  Tuesday, July 22, 2003, you wrote:
>
>
>
> JR> What platform are you using?
>
> JR> The mesg id comes from the process ID of the cgp2ms script that was
> JR> invoked for that message.  I could make it longer, to encode a time
> JR> string, but it really shouldn't be rolling over in a time frame
> that
> JR> would matter.  This makes me wonder what's happening that gives
> you the
> JR> same process ID every time cgp2ms gets run.
>
>
> JR> On Tuesday, Jul 22, 2003, at 10:45 US/Pacific, NTIN Page Guy wrote:
>
>>>
>>> Hello John,
>>>
>>> Now, I have a new problem.  I've sent you a email about this, I hope
>>> you don't mind.
>>>
>>> People are getting other peoples emails,  For example
>>>
>>> Lets say the server receives a email to test1
>>>
>>> It executes sendmail
>>>
>>> /opt/CommuniGate/sendmail -i test1@mydomain.com <
>>> /tmp/ms2cgp.5741.msg
>>>
>>> then quickly there after it gets a message for test2
>>>
>>> it then executes sendmail like this
>>>
>>> /opt/CommuniGate/sendmail -i test1@mydomain.com test2@mydomain.com <
>>> /tmp/ms2cgp.5741.msg
>>>
>>> then quickly there after it gets a message for test3
>>>
>>> /opt/CommuniGate/sendmail -i test1@mydomain.com test2@mydomain.com
>>> test3@mydomain.com < /tmp/ms2cgp.5741.msg
>>>
>>>
>>> I don't know why its doing this other than to speculate that what
>>> ever
>>> is
>>> passing the id number to ms2cgp is giving it the same id number it
>>> did
>>> last message,
>>> rather than changing.
>>>
>>>  Tuesday, July 22, 2003, you wrote:
>>>
>>>
>>>
>>> JR> Are you still having this problem after my update yesterday?
>>>
>>> JR> I posted the message to both this list and to the mailscanner
>>> list
>>> JR> yesterday afternoon.
>>>
>>>
>>> JR> On Tuesday, Jul 22, 2003, at 08:39 US/Pacific, NTIN Page Guy
>>> wrote:
>>>
>>>>>
>>>>> Hello CGatePro,
>>>>>
>>>>> PIPE module, mailscanner and cgp2ms/ms2cgp
>>>>>
>>>>> Im having a rather unusual problem with the above working together.
>>>>>
>>>>> Here is the problem as I understand it.
>>>>>
>>>>> Using ms2cgp as it came, it uses the legacy sendmail support to
>>>>> PIPE
>>>>> the messages back into Communigate, sendmail adds the following
>>>>> line
>>>>> which makes the message undeliverable
>>>>>
>>>>>> Envelope-To: RPFD:rbaldwin@ntin.net
>>>>>
>>>>> Communigate responds that the message has no valid to field, and
>>>>> renames the file to with a .bad extension.
>>>>>
>>>>>
>>>>> Best regards,
>>>>> Robert B, NTIN                           mailto:pages@ntin.net
>>>>>
>>>>>
>>>>> #############################################################
>>>>> This message is sent to you because you are subscribed to
>>>>>   the mailing list <CGatePro@mail.stalker.com>.
>>>>> To unsubscribe, E-mail to: <CGatePro-off@mail.stalker.com>
>>>>> To switch to the DIGEST mode, E-mail to
>>>>> <CGatePro-digest@mail.stalker.com>
>>>>> To switch to the INDEX mode, E-mail to
>>>>> <CGatePro-index@mail.stalker.com>
>>>>> Send administrative queries to  <CGatePro-request@mail.stalker.com>
>>>
>>>
>>> JR> #############################################################
>>> JR> This message is sent to you because you are subscribed to
>>> JR>   the mailing list <CGatePro@mail.stalker.com>.
>>> JR> To unsubscribe, E-mail to: <CGatePro-off@mail.stalker.com>
>>> JR> To switch to the DIGEST mode, E-mail to
>>> <CGatePro-digest@mail.stalker.com>
>>> JR> To switch to the INDEX mode, E-mail to
>>> <CGatePro-index@mail.stalker.com>
>>> JR> Send administrative queries to
>>> <CGatePro-request@mail.stalker.com>
>>>
>>>
>>>
>>> Best regards,
>>> Robert B, NTIN                           mailto:pages@ntin.net
>>>
>>>
>>> #############################################################
>>> This message is sent to you because you are subscribed to
>>>   the mailing list <CGatePro@mail.stalker.com>.
>>> To unsubscribe, E-mail to: <CGatePro-off@mail.stalker.com>
>>> To switch to the DIGEST mode, E-mail to
>>> <CGatePro-digest@mail.stalker.com>
>>> To switch to the INDEX mode, E-mail to
>>> <CGatePro-index@mail.stalker.com>
>>> Send administrative queries to  <CGatePro-request@mail.stalker.com>
>
>
> JR> #############################################################
> JR> This message is sent to you because you are subscribed to
> JR>   the mailing list <CGatePro@mail.stalker.com>.
> JR> To unsubscribe, E-mail to: <CGatePro-off@mail.stalker.com>
> JR> To switch to the DIGEST mode, E-mail to
> <CGatePro-digest@mail.stalker.com>
> JR> To switch to the INDEX mode, E-mail to
> <CGatePro-index@mail.stalker.com>
> JR> Send administrative queries to  <CGatePro-request@mail.stalker.com>
>
>
>
> Best regards,
> Robert B, NTIN                           mailto:pages@ntin.net
>
>
> #############################################################
> This message is sent to you because you are subscribed to
>   the mailing list <CGatePro@mail.stalker.com>.
> To unsubscribe, E-mail to: <CGatePro-off@mail.stalker.com>
> To switch to the DIGEST mode, E-mail to
> <CGatePro-digest@mail.stalker.com>
> To switch to the INDEX mode, E-mail to
> <CGatePro-index@mail.stalker.com>
> Send administrative queries to  <CGatePro-request@mail.stalker.com>

From mailscanner at LISTS.COM.AR  Tue Jul 22 22:03:27 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:02 2006
Subject: ClamAV 0.60 problems -  ProcessClamAVOutput: unrecognized line
In-Reply-To: <3F1DA2C0.4090904@konsultex.com.br>
Message-ID: <3F1D7C6F.16598.2AD2C3D4@localhost>

I don't use CLAM-AV, but IIRC, it uses the external unzip utility for .zip 
files and maybe you two are using different versions (and they yeld different 
output)...

what does
rpm -q unzip
yeld?

If the output changed, I guess you'll have to wait for Julian to return... 
unless someone is able to come up with a patch before...

El 22 Jul 2003 a las 17:46, Miguel Koren O'Brien de Lacy escribi?:

> Jason;
> 
> I have these versions on 2 servers (RH7.3) with the default values and
> it works fine form me.
> 
> Miguel
> 
> Desai, Jason wrote:
> 
> >Hello.  I just upgraded to MailScanner 4.22-5 and ClamAV to 0.60.  I've
> >noticed a few entries in my mail.log file such as:
> >
> >Jul 21 15:06:47 hostname MailScanner[26628]:
> >/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 Rev 14.zip:
> >Files number limit exceeded.
> >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> >unrecognised line
> >"/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 Rev 14.zip:
> >Files number limit exceeded.". Please contact the authors!
> >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> >CODE/RDI-68K/Load/LoadAsm.bat
> >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> >unrecognised line " extracting: CODE/RDI-68K/Load/LoadAsm.bat ". Please
> >contact the authors!
> >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> >CODE/RDI-68K/Main/MainCc.bat
> >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> >unrecognised line " extracting: CODE/RDI-68K/Main/MainCc.bat ". Please
> >contact the authors!
> >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> >CODE/RDI-68K/Main/MainMap.bat
> >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> >unrecognised line " extracting: CODE/RDI-68K/Main/MainMap.bat ". Please
> >contact the authors!
> >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> >CODE/RDI-68K/RDISTART/RdiAsm.bat
> >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> >unrecognised line " extracting: CODE/RDI-68K/RDISTART/RdiAsm.bat ". Please
> >contact the authors!
> >Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
> >CODE/RStatusDecodeDLL/TestDriver/test.bcv
> >Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
> >unrecognised line " extracting: CODE/RStatusDecodeDLL/TestDriver/test.bcv ".
> >Please contact the authors!
> >Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
> >CODE/SensorDataDLL/res/SensorDataDLL.rc2
> >Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
> >unrecognised line " extracting: CODE/SensorDataDLL/res/SensorDataDLL.rc2 ".
> >Please contact the authors!
> >
> >and
> >
> >Jul 21 19:28:28 hostname MailScanner[25439]:
> >/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_07_18.zip: File
> >size limit exceeded.
> >Jul 21 19:28:28 hostname MailScanner[25439]: ProcessClamAVOutput:
> >unrecognised line
> >"/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_07_18.zip:
> >File size limit exceeded.". Please contact the authors!
> >
> >I am thinking that this has to do with the new version of ClamAV.  I found
> >some options for clamscan to disable some of these limits, and put them in
> >clamav-wrapper.  Specifically, I set
> >
> >ScanOptions="--max-files=0 --max-space=0 --max-recursion=0"
> >
> >Questions:
> >
> >*  Has anyone else come across this?
> >*  Since MailScanner already has timeouts for virus scanning, would you
> >think it is safe to run this way?
> >*  If yes, should this be the default?  (I'm not sure if versions < 0.60
> >support this - maybe put some comments in the clamav-wrapper script?)
> >*  Is "unrecognised" British for "unrecognized" or is it just misspelled?
> >
> >Thanks.
> >
> >Jason
> >
> >


--
Mariano Absatz
El Baby
----------------------------------------------------------
The best cure for insomnia is to get a lot of sleep.
      -- W.C. Fields


From raymond at PROLOCATION.NET  Tue Jul 22 22:04:37 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:02 2006
Subject: How to setup a tmpfs on a RH system
In-Reply-To: <1058905978.3137.37.camel@dbeauchemin.sti.usherbrooke.ca>
Message-ID: <Pine.LNX.4.44.0307222302551.18163-100000@mailbox.prolocation.net>

Hi!

> I would like to experiment with a tmpfs and MS but am at a loss as to
> how to create one on a RH 7.3 system.
>
> I searched my man pages and this list's archives to no avail.
>
> Also which directories should I put on it for best performance and
> reliability?

If you use it 'default' it will take half of your available ram. You can
tune this by adding a size statement in your fstab.

Like this:

none                    /var/spool/MailScanner/incoming/  tmpfs   size=512m        0 0

Bye,
Raymond.

From jase at SENSIS.COM  Tue Jul 22 22:31:04 2003
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:19:02 2006
Subject: ClamAV 0.60 problems -  ProcessClamAVOutput: un recognized line
Message-ID: <ADF6087CA978A4418AF7F76DDCF2F72102757292@europa.ats.sensis.com>

Thanks for the response.  I'm running Debian.  Unzip version 5.50-1woody1.

But I'm pretty sure this is a ClamAV issue, since the man page talks about
the options I put in clamav-wrapper.  And since those changes, I've not seen
the error any more.

I also saved out the offending file and ran clamav-wrapper on it both with
and without my ScanOptions.  Without them, I get the output that MailScanner
does not recognize.  And I think that it does not completely scan the file.
With them, it scans the file fine.

Jason

> 
> I don't use CLAM-AV, but IIRC, it uses the external unzip 
> utility for .zip 
> files and maybe you two are using different versions (and 
> they yeld different 
> output)...
> 
> what does
> rpm -q unzip
> yeld?
> 
> If the output changed, I guess you'll have to wait for Julian 
> to return... 
> unless someone is able to come up with a patch before...
> 
> El 22 Jul 2003 a las 17:46, Miguel Koren O'Brien de Lacy escribi?:
> 
> > Jason;
> > 
> > I have these versions on 2 servers (RH7.3) with the default 
> values and
> > it works fine form me.
> > 
> > Miguel
> > 
> > Desai, Jason wrote:
> > 
> > >Hello.  I just upgraded to MailScanner 4.22-5 and ClamAV 
> to 0.60.  I've
> > >noticed a few entries in my mail.log file such as:
> > >
> > >Jul 21 15:06:47 hostname MailScanner[26628]:
> > 
> >/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 
> Rev 14.zip:
> > >Files number limit exceeded.
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line
> > 
> >"/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3
>  Rev 14.zip:
> > >Files number limit exceeded.". Please contact the authors!
> > >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> > >CODE/RDI-68K/Load/LoadAsm.bat
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RDI-68K/Load/LoadAsm.bat ". Please
> > >contact the authors!
> > >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> > >CODE/RDI-68K/Main/MainCc.bat
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RDI-68K/Main/MainCc.bat ". Please
> > >contact the authors!
> > >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> > >CODE/RDI-68K/Main/MainMap.bat
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RDI-68K/Main/MainMap.bat ". Please
> > >contact the authors!
> > >Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> > >CODE/RDI-68K/RDISTART/RdiAsm.bat
> > >Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RDI-68K/RDISTART/RdiAsm.bat ". Please
> > >contact the authors!
> > >Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
> > >CODE/RStatusDecodeDLL/TestDriver/test.bcv
> > >Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/RStatusDecodeDLL/TestDriver/test.bcv ".
> > >Please contact the authors!
> > >Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
> > >CODE/SensorDataDLL/res/SensorDataDLL.rc2
> > >Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
> > >unrecognised line " extracting: 
> CODE/SensorDataDLL/res/SensorDataDLL.rc2 ".
> > >Please contact the authors!
> > >
> > >and
> > >
> > >Jul 21 19:28:28 hostname MailScanner[25439]:
> > 
> >/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_
> 07_18.zip: File
> > >size limit exceeded.
> > >Jul 21 19:28:28 hostname MailScanner[25439]: ProcessClamAVOutput:
> > >unrecognised line
> > 
> >"/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT
> _07_18.zip:
> > >File size limit exceeded.". Please contact the authors!
> > >
> > >I am thinking that this has to do with the new version of 
> ClamAV.  I found
> > >some options for clamscan to disable some of these limits, 
> and put them in
> > >clamav-wrapper.  Specifically, I set
> > >
> > >ScanOptions="--max-files=0 --max-space=0 --max-recursion=0"
> > >
> > >Questions:
> > >
> > >*  Has anyone else come across this?
> > >*  Since MailScanner already has timeouts for virus 
> scanning, would you
> > >think it is safe to run this way?
> > >*  If yes, should this be the default?  (I'm not sure if 
> versions < 0.60
> > >support this - maybe put some comments in the 
> clamav-wrapper script?)
> > >*  Is "unrecognised" British for "unrecognized" or is it 
> just misspelled?
> > >
> > >Thanks.
> > >
> > >Jason
> > >
> > >
> 
> 
> --
> Mariano Absatz
> El Baby
> ----------------------------------------------------------
> The best cure for insomnia is to get a lot of sleep.
>       -- W.C. Fields
> 


From vboulytchev at COINFOTECH.COM  Tue Jul 22 22:56:08 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:19:02 2006
Subject: CommuniGate Pro - MailScanner update
Message-ID: <1958DE295D9656499ECAAD3642822DE0033FDA@willow.office.coinfotech.com>

Yet another .bad :))))))))))))))))))))
 
Here is the qf-blah file
 
V4
T1058909914
K0
N0
P150900
HFrom: <autoreply@mailsvc.com> (Automatic Reply mailbox for testing)
HDate: Tue, 22 Jul 2003 15:38:33 -0600
HMessage-ID: <react-12399218@mailsvc.com>
HX-Autogenerated: Reply
HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
HSubject: Re:
HIn-Reply-To: <003601c3509a$4af6f4b0$3700000a@office.coinfotech.com>

autoreply@mailsvc.com  is just a mailbox on Communigate Mail Server to
autoreply to the message for testing purposes.
 
 
How about messages from Daemons on Listservers?
 
Here is a copy of a good qf-blah
 
V4
T1058910524
K0
N0
P150900
$_
S<vboulytchev@coinfotech.com>
RPFD:<virus@boulytcheva.com>
HReceived: from [209.12.32.66] (HELO willow.office.coinfotech.com)
  by mailsvc.com (CommuniGate Pro SMTP 4.0.6)
  with ESMTP id 12399741 for virus@boulytcheva.com; Tue, 22 Jul 2003
15:48:43 -0600
HMIME-Version: 1.0
HContent-Type: multipart/alternative;
        boundary="----_=_NextPart_001_01C3509B.93B4BFAB"
Hcontent-class: urn:content-classes:message
HX-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
HSubject:
HDate: Tue, 22 Jul 2003 15:52:42 -0600
HMessage-ID:
<1958DE295D9656499ECAAD3642822DE0033FD7@willow.office.coinfotech.com>
HX-MS-Has-Attach:
HX-MS-TNEF-Correlator:
HThread-Index: AcNQm5OBeCvE5aXeTmW62LdyGyY1eQ==
HFrom: "Boulytchev, Vasiliy" <vboulytchev@coinfotech.com>
HTo: "vasiliy boulytchev" <virus@boulytcheva.com>

 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

-----Original Message-----
From: John Rudd [mailto:jrudd@UCSC.EDU] 
Sent: Monday, July 21, 2003 4:37 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: CommuniGate Pro - MailScanner update



I have made an update to my scripts for using MailScanner with
CommuniGate Pro.  I have also updated the text of the CommuniGate Pro
rule instructions (the Execute rule no longer needs the [RETPATH] nor
[RCPT] options).

This should change the problem some people noticed with ".bad" files
showing up in the CommuniGate Pro Queue directory, due to "RPFD:" being
prepended to sender's addresses.  This shouldn't happen any more.


You can get the new scripts and information from:

http://people.ucsc.edu/~jrudd/MailScanner


If you have any questions, or notice any new bugs, please let me know.

(And be sure to edit your path to perl in the first line of each script;
it changed in the downloads because my testing platform changed from
Solaris to Linux)


John Rudd


(ps: one person has mentioned that they see some messages being cross
delivered, but I haven't had anyone else mention this problem to me, nor
have I seen it on my own servers; if you do see such a behavior, please
let me know right away, and try to give me plenty of context
information)


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/aded9378/attachment.html
From TGFurnish at HERFF-JONES.COM  Tue Jul 22 23:10:44 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:02 2006
Subject: moving the bayes files?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C030E@inex1.herffjones.hj-int>

Replying to my own question, it looks like these files are only created
periodically, so once I made the config change and restarted MailScanner,
the files didn't immediately appear.  Instead they appeared quite a few
hours later, after 30 or so messages had been run through the system.

My thanks to "Matt", who shall remain otherwise nameless because he's
list-"shy". :-)

--
Trever


>-----Original Message-----
>From: Furnish, Trever G [mailto:TGFurnish@HERFF-JONES.COM]
>Sent: Tuesday, July 22, 2003 1:37 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: moving the bayes files?
>
>
>I suppose I'm taking a rather haphazard approach to learning
>mailscanner,
>but I've recently realized spamassassin *may* be storing bayesian
>filtering-related files under /root/.spamassassin on my
>system, which isn't
>a good long-term situation for me, so I stopped mailscanner,
>uncommented the
>following lines in /etc/MailScanner/spam.assassin.prefs.conf,
>and restarted
>MailScanner:
>
>auto_whitelist_path        /var/spool/spamassassin/auto-whitelist
>auto_whitelist_file_mode   0600
>bayes_path                 /var/spool/spamassassin/bayes
>bayes_file_mode            0600
>
>That didn't seem to work (for moving the files) -- The
>/var/spool/spamassassin directory did not get created and
>MailScanner died
>quietly.
>
>So...I ran the mailscanner init script with 'stop' as an arg,
>then did a
>mkdir /var/spool/spamassassin, then restarted mailscanner.
>Now it doesn't
>die, but it also doesn't create files under
>/var/spool/spamassassin.  What
>else do I need to do in order to get that working?  I'm not
>even sure the
>bayesian stuff was working to begin with.
>
>In case it helps, here's the output of spamassassin -D --lint
>2>&1 - any
>suggestions would be appreciated.
>
>debug: Score set 0 chosen.
>debug: running in taint mode? no
>debug: ignore: using a test message to lint rules
>debug: using "/usr/share/spamassassin" for default rules dir
>debug: using "/etc/mail/spamassassin" for site rules dir
>debug: using "/root/.spamassassin" for user state dir
>debug: using "/root/.spamassassin/user_prefs" for user prefs file
>debug: using "/root/.spamassassin" for user state dir
>debug: bayes: 22042 tie-ing to DB file R/O
>/root/.spamassassin/bayes_toks
>debug: bayes: 22042 tie-ing to DB file R/O
>/root/.spamassassin/bayes_seen
>debug: debug: Only 5 spam(s) in Bayes DB < 200
>debug: bayes: 22042 untie-ing
>debug: bayes: 22042 untie-ing db_toks
>debug: bayes: 22042 untie-ing db_seen
>debug: Score set 1 chosen.
>debug: Initialising learner
>debug: using "/root/.spamassassin" for user state dir
>debug: bayes: 22042 tie-ing to DB file R/O
>/root/.spamassassin/bayes_toks
>debug: bayes: 22042 tie-ing to DB file R/O
>/root/.spamassassin/bayes_seen
>debug: debug: Only 5 spam(s) in Bayes DB < 200
>debug: bayes: 22042 untie-ing
>debug: bayes: 22042 untie-ing db_toks
>debug: bayes: 22042 untie-ing db_seen
>debug: is Net::DNS::Resolver available? yes
>debug: trying (3) amazon.com...
>debug: looking up MX for 'amazon.com'
>debug: MX for 'amazon.com' exists? 1
>debug: MX lookup of amazon.com succeeded => Dns available (set
>dns_available
>to
>hardcode)
>debug: is DNS available? 1
>debug: running header regexp tests; score so far=0
>debug: running body-text per-line regexp tests; score so far=1.9
>debug: running raw-body-text per-line regexp tests; score so far=1.9
>debug: running uri tests; score so far=1.9
>debug: uri tests: Done uriRE
>debug: running full-text regexp tests; score so far=1.9
>debug: Razor2 is not available
>debug: Current PATH is:
>/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/us
>r/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin
>debug: DCC is not available: dccproc not found
>debug: Pyzor is not available: pyzor not found
>debug: all '*To' addrs:
>debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
>debug: running meta tests; score so far=2.4
>debug: is spam? score=2.4 required=5
>tests=DATE_MISSING,MISSING_HEADERS,NO_REAL_
>NAME
>debug: bayes: 22042 untie-ing
>

From jrudd at UCSC.EDU  Tue Jul 22 23:20:29 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:02 2006
Subject: CommuniGate Pro - MailScanner update
In-Reply-To: <1958DE295D9656499ECAAD3642822DE0033FDA@willow.office.coinfotech.com>
Message-ID: <B36F9497-BC92-11D7-A34A-003065F939FE@ucsc.edu>

How was that bad message generated?  It would appear that it was 
generated without any recipients (hence the lack of lines that start 
RPFD:, the sendmail queue file line indicating each recipient).  Is it 
being generated by CommuniGate Pro's rules? or something else?

On Tuesday, Jul 22, 2003, at 14:56 US/Pacific, Boulytchev, Vasiliy 
wrote:

> Yet another .bad :))))))))))))))))))))
> ?
> Here is the qf-blah file
> ?
> V4
> T1058909914
> K0
> N0
> P150900
> HFrom: <autoreply@mailsvc.com> (Automatic Reply mailbox for testing)
> HDate: Tue, 22 Jul 2003 15:38:33 -0600
> HMessage-ID: <react-12399218@mailsvc.com>
> HX-Autogenerated: Reply
> HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
> HSubject: Re:
> HIn-Reply-To: <003601c3509a$4af6f4b0$3700000a@office.coinfotech.com>
> autoreply@mailsvc.com? is just a mailbox on Communigate Mail Server to 
> autoreply to the message for testing purposes.
> ?
> ?
> How about messages from Daemons on Listservers?
> ?
> Here is a copy of a good qf-blah
> ?
> V4
> T1058910524
> K0
> N0
> P150900
> $_
> S<vboulytchev@coinfotech.com>
> RPFD:<virus@boulytcheva.com>
> HReceived: from [209.12.32.66] (HELO willow.office.coinfotech.com)
> ? by mailsvc.com (CommuniGate Pro SMTP 4.0.6)
> ? with ESMTP id 12399741 for virus@boulytcheva.com; Tue, 22 Jul 2003 
> 15:48:43 -0600
> HMIME-Version: 1.0
> HContent-Type: multipart/alternative;
> ??????? boundary="----_=_NextPart_001_01C3509B.93B4BFAB"
> Hcontent-class: urn:content-classes:message
> HX-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
> HSubject:
> HDate: Tue, 22 Jul 2003 15:52:42 -0600
> HMessage-ID: 
> <1958DE295D9656499ECAAD3642822DE0033FD7@willow.office.coinfotech.com>
> HX-MS-Has-Attach:
> HX-MS-TNEF-Correlator:
> HThread-Index: AcNQm5OBeCvE5aXeTmW62LdyGyY1eQ==
> HFrom: "Boulytchev, Vasiliy" <vboulytchev@coinfotech.com>
> HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
> ?
> ?
>
> Vasiliy Boulytchev
>
> Colorado Information Technologies Inc.
>
> (719) 473-2800 x15
>
>
>
> ?
>
> ?
>
>
> -----Original Message-----
> From: John Rudd [mailto:jrudd@UCSC.EDU]
> Sent: Monday, July 21, 2003 4:37 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: CommuniGate Pro - MailScanner update
>
> I have made an update to my scripts for using MailScanner with
> CommuniGate Pro.? I have also updated the text of the CommuniGate Pro
> rule instructions (the Execute rule no longer needs the [RETPATH] nor
> [RCPT] options).
>
> This should change the problem some people noticed with ".bad" files
> showing up in the CommuniGate Pro Queue directory, due to "RPFD:" being
> prepended to sender's addresses.? This shouldn't happen any more.
>
>
> You can get the new scripts and information from:
>
> http://people.ucsc.edu/~jrudd/MailScanner
>
>
> If you have any questions, or notice any new bugs, please let me know.
>
> (And be sure to edit your path to perl in the first line of each 
> script;
> it changed in the downloads because my testing platform changed from
> Solaris to Linux)
>
>
> John Rudd
>
>
> (ps: one person has mentioned that they see some messages being cross
> delivered, but I haven't had anyone else mention this problem to me, 
> nor
> have I seen it on my own servers; if you do see such a behavior, please
> let me know right away, and try to give me plenty of context
> information)
>


From vboulytchev at COINFOTECH.COM  Tue Jul 22 23:37:48 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:19:02 2006
Subject: CommuniGate Pro - MailScanner update
Message-ID: <1958DE295D9656499ECAAD3642822DE0033FE1@willow.office.coinfotech.com>

John,
     Your guess was correct.  It is an autoreply rule on account
"autoreply" on "mailsvc.com" domain, in CommunigatePro.  By the way, You
can cross the other errors off the list.  I have tested BCC, RPFD: and
all, the fix worked great that you release earlier.  So we just have one
left, hopefully.
 
THANKS!!!!!!!!!!!!!!!!!!!!!
 
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

-----Original Message-----
From: John Rudd [mailto:jrudd@UCSC.EDU] 
Sent: Tuesday, July 22, 2003 4:20 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: CommuniGate Pro - MailScanner update



How was that bad message generated?  It would appear that it was
generated without any recipients (hence the lack of lines that start
RPFD:, the sendmail queue file line indicating each recipient).  Is it
being generated by CommuniGate Pro's rules? or something else?

On Tuesday, Jul 22, 2003, at 14:56 US/Pacific, Boulytchev, Vasiliy
wrote:

> Yet another .bad :))))))))))))))))))))
>  
> Here is the qf-blah file
>  
> V4
> T1058909914
> K0
> N0
> P150900
> HFrom: <autoreply@mailsvc.com> (Automatic Reply mailbox for testing)
> HDate: Tue, 22 Jul 2003 15:38:33 -0600
> HMessage-ID: <react-12399218@mailsvc.com>
> HX-Autogenerated: Reply
> HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
> HSubject: Re:
> HIn-Reply-To: <003601c3509a$4af6f4b0$3700000a@office.coinfotech.com>
> autoreply@mailsvc.com  is just a mailbox on Communigate Mail Server to
> autoreply to the message for testing purposes.
>  
>  
> How about messages from Daemons on Listservers?
>  
> Here is a copy of a good qf-blah
>  
> V4
> T1058910524
> K0
> N0
> P150900
> $_
> S<vboulytchev@coinfotech.com>
> RPFD:<virus@boulytcheva.com>
> HReceived: from [209.12.32.66] (HELO willow.office.coinfotech.com)
>   by mailsvc.com (CommuniGate Pro SMTP 4.0.6)
>   with ESMTP id 12399741 for virus@boulytcheva.com; Tue, 22 Jul 2003
> 15:48:43 -0600
> HMIME-Version: 1.0
> HContent-Type: multipart/alternative;
>         boundary="----_=_NextPart_001_01C3509B.93B4BFAB"
> Hcontent-class: urn:content-classes:message
> HX-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
> HSubject:
> HDate: Tue, 22 Jul 2003 15:52:42 -0600
> HMessage-ID:
> <1958DE295D9656499ECAAD3642822DE0033FD7@willow.office.coinfotech.com>
> HX-MS-Has-Attach:
> HX-MS-TNEF-Correlator:
> HThread-Index: AcNQm5OBeCvE5aXeTmW62LdyGyY1eQ==
> HFrom: "Boulytchev, Vasiliy" <vboulytchev@coinfotech.com>
> HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
>  
>  
>
> Vasiliy Boulytchev
>
> Colorado Information Technologies Inc.
>
> (719) 473-2800 x15
>
>
>
>  
>
>  
>
>
> -----Original Message-----
> From: John Rudd [mailto:jrudd@UCSC.EDU]
> Sent: Monday, July 21, 2003 4:37 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: CommuniGate Pro - MailScanner update
>
> I have made an update to my scripts for using MailScanner with
> CommuniGate Pro.  I have also updated the text of the CommuniGate Pro
> rule instructions (the Execute rule no longer needs the [RETPATH] nor
> [RCPT] options).
>
> This should change the problem some people noticed with ".bad" files
> showing up in the CommuniGate Pro Queue directory, due to "RPFD:"
being
> prepended to sender's addresses.  This shouldn't happen any more.
>
>
> You can get the new scripts and information from:
>
> http://people.ucsc.edu/~jrudd/MailScanner
>
>
> If you have any questions, or notice any new bugs, please let me know.
>
> (And be sure to edit your path to perl in the first line of each
> script;
> it changed in the downloads because my testing platform changed from
> Solaris to Linux)
>
>
> John Rudd
>
>
> (ps: one person has mentioned that they see some messages being cross
> delivered, but I haven't had anyone else mention this problem to me,
> nor
> have I seen it on my own servers; if you do see such a behavior,
please
> let me know right away, and try to give me plenty of context
> information)
>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030722/84bd3732/attachment.html
From dot at DOTAT.AT  Tue Jul 22 23:44:56 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <m2n.19f206-000xXg@chiark.greenend.org.uk>
Message-ID: <E19f5sO-0005N0-00@chiark.greenend.org.uk>

Thomas DuVally <thomas_duvally@BROWN.EDU> wrote:
>
>Everyday around peak time the upgraded system starts to get backed up.
>The incoming queue goes from a normal 2-4 message count up to 1000+.
>Restarting MS will begin clearing this out.

What are your MailScanner concurrency, batch size, and maximum age settings?

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
ROCKALL: SOUTHERLY VEERING WESTERLY 5 TO 7. OCCASIONAL RAIN. MODERATE OR GOOD.

From raymond at PROLOCATION.NET  Tue Jul 22 23:58:24 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <E19f5sO-0005N0-00@chiark.greenend.org.uk>
Message-ID: <Pine.LNX.4.44.0307230056320.6017-100000@mailbox.prolocation.net>

Hi!

> >Everyday around peak time the upgraded system starts to get backed up.
> >The incoming queue goes from a normal 2-4 message count up to 1000+.
> >Restarting MS will begin clearing this out.
>
> What are your MailScanner concurrency, batch size, and maximum age settings?

On two of my boxes:

Max Children = 16
Restart Every = 14400
Max Unscanned Bytes Per Scan = 100000000
Max Unsafe Bytes Per Scan = 50000000
Max Unscanned Messages Per Scan = 100
Max Unsafe Messages Per Scan = 100

Bye,
Raymond.

From raymond at PROLOCATION.NET  Wed Jul 23 00:20:22 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <53B63D16-BC98-11D7-88FC-000393920D6C@uptime.at>
Message-ID: <Pine.LNX.4.44.0307230118540.9269-100000@mailbox.prolocation.net>

Hi!

> > On two of my boxes:
> >
> > Max Children = 16

> Geeze, does that run on a Sun Fire ? ;)

No, a Dual Xeon 2.8. I played around with the children and this is what
run best. I would not recommend running it on a SUN, tested it on a V880
but uh well ... lets say the Intel box performed much better $/mails per
second.

Bye,
Raymond.

From dh at UPTIME.AT  Wed Jul 23 00:00:45 2003
From: dh at UPTIME.AT (David)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <Pine.LNX.4.44.0307230056320.6017-100000@mailbox.prolocation.net>
Message-ID: <53B63D16-BC98-11D7-88FC-000393920D6C@uptime.at>


On Mittwoch, Juli 23, 2003, at 12:58  Uhr, Raymond Dijkxhoorn wrote:

> Hi!
>
>>> Everyday around peak time the upgraded system starts to get backed 
>>> up.
>>> The incoming queue goes from a normal 2-4 message count up to 1000+.
>>> Restarting MS will begin clearing this out.
>>
>> What are your MailScanner concurrency, batch size, and maximum age 
>> settings?
>
> On two of my boxes:
>
> Max Children = 16
Geeze, does that run on a Sun Fire ? ;)

-d

-- nee amata wo mitsukete soshite midoto wasrezu
    domma mi mumega itakutemo soba mi iru mo
			zutto...zutto...zutto
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030723/c7983f2c/PGP.bin
From jrudd at UCSC.EDU  Wed Jul 23 01:40:01 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:02 2006
Subject: _THIRD_ CommuniGate Pro - MailScanner update
In-Reply-To: <1958DE295D9656499ECAAD3642822DE0033FE1@willow.office.coinfotech.com>
Message-ID: <31DD5E64-BCA6-11D7-A34A-003065F939FE@ucsc.edu>

Well, there's two problems:

1) when you disabled that check in the mailscanner code (that I said 
you shouldn't do), it caused mailscanner to accept messages that aren't 
valid, and then pass them on to communigate pro, which then makes .bad 
files out of them.  If you hadn't done that to mailscanner, they would 
be being built up in the /var/spool/mqueue.in directory for 
mailscanner, and mail scanner would be putting messages into your 
syslog.  You should re-enable the default mailscanner code.

2) my cgp2ms script depended upon receiving a "Received:" header before 
printing out certain qf file variables ($_ the relay host, which it 
extracts from the Received header; S the sender; and the RPFD lines, 
the recipients).  The problem is that for localhost senders, such as 
messages created by CommuniGate Pro's rules, it never triggered this 
because there are no Received headers at all, creating a message with 
no relay, no sender, and no recipients.  I've re-worked my logic in the 
cgp2ms script so that when it moves from the headers to the body, if it 
still hasn't printed those variables, it does so (using localhost for 
the relay).  I also re-wrote the regexp logic for extracting the relay 
host from the Received header (it worked for some received headers, 
that have both the hostname and the ip addr, but not for received 
headers which only list the relay's ip addr; I fixed that).

So, my third update release in 2 days.  Hopefully that fixes everything 
:-)

I also re-formatted my update announcements at the top of the page.

http://people.ucsc.edu/~jrudd/MailScanner


John




On Tuesday, Jul 22, 2003, at 15:37 US/Pacific, Boulytchev, Vasiliy 
wrote:

> John,
> ???? Your guess was correct.? It is an autoreply rule on account 
> "autoreply" on "mailsvc.com" domain, in CommunigatePro.? By the way, 
> You can cross the other errors off the list.? I have tested BCC, RPFD: 
> and all, the fix worked great that you release earlier.? So we just 
> have one left, hopefully.
> ?
> THANKS!!!!!!!!!!!!!!!!!!!!!
> ?
> ?
> ?
>
> Vasiliy Boulytchev
>
> Colorado Information Technologies Inc.
>
> (719) 473-2800 x15
>
>
>
> ?
>
> ?
>
>
> -----Original Message-----
> From: John Rudd [mailto:jrudd@UCSC.EDU]
> Sent: Tuesday, July 22, 2003 4:20 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: CommuniGate Pro - MailScanner update
>
> How was that bad message generated?? It would appear that it was
> generated without any recipients (hence the lack of lines that start
> RPFD:, the sendmail queue file line indicating each recipient).? Is it
> being generated by CommuniGate Pro's rules? or something else?
>
> On Tuesday, Jul 22, 2003, at 14:56 US/Pacific, Boulytchev, Vasiliy
> wrote:
>
> > Yet another .bad :))))))))))))))))))))
> > ?
> > Here is the qf-blah file
> > ?
> > V4
> > T1058909914
> > K0
> > N0
> > P150900
> > HFrom: <autoreply@mailsvc.com> (Automatic Reply mailbox for testing)
> > HDate: Tue, 22 Jul 2003 15:38:33 -0600
> > HMessage-ID: <react-12399218@mailsvc.com>
> > HX-Autogenerated: Reply
> > HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
> > HSubject: Re:
> > HIn-Reply-To: <003601c3509a$4af6f4b0$3700000a@office.coinfotech.com>
> > autoreply@mailsvc.com? is just a mailbox on Communigate Mail Server 
> to
> > autoreply to the message for testing purposes.
> > ?
> > ?
> > How about messages from Daemons on Listservers?
> > ?
> > Here is a copy of a good qf-blah
> > ?
> > V4
> > T1058910524
> > K0
> > N0
> > P150900
> > $_
> > S<vboulytchev@coinfotech.com>
> > RPFD:<virus@boulytcheva.com>
> > HReceived: from [209.12.32.66] (HELO willow.office.coinfotech.com)
> > ? by mailsvc.com (CommuniGate Pro SMTP 4.0.6)
> > ? with ESMTP id 12399741 for virus@boulytcheva.com; Tue, 22 Jul 2003
> > 15:48:43 -0600
> > HMIME-Version: 1.0
> > HContent-Type: multipart/alternative;
> > ??????? boundary="----_=_NextPart_001_01C3509B.93B4BFAB"
> > Hcontent-class: urn:content-classes:message
> > HX-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
> > HSubject:
> > HDate: Tue, 22 Jul 2003 15:52:42 -0600
> > HMessage-ID:
> > <1958DE295D9656499ECAAD3642822DE0033FD7@willow.office.coinfotech.com>
> > HX-MS-Has-Attach:
> > HX-MS-TNEF-Correlator:
> > HThread-Index: AcNQm5OBeCvE5aXeTmW62LdyGyY1eQ==
> > HFrom: "Boulytchev, Vasiliy" <vboulytchev@coinfotech.com>
> > HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
> > ?
> > ?
> >
> > Vasiliy Boulytchev
> >
> > Colorado Information Technologies Inc.
> >
> > (719) 473-2800 x15
> >
> >
> >
> > ?
> >
> > ?
> >
> >
> > -----Original Message-----
> > From: John Rudd [mailto:jrudd@UCSC.EDU]
> > Sent: Monday, July 21, 2003 4:37 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: CommuniGate Pro - MailScanner update
> >
> > I have made an update to my scripts for using MailScanner with
> > CommuniGate Pro.? I have also updated the text of the CommuniGate Pro
> > rule instructions (the Execute rule no longer needs the [RETPATH] nor
> > [RCPT] options).
> >
> > This should change the problem some people noticed with ".bad" files
> > showing up in the CommuniGate Pro Queue directory, due to "RPFD:" 
> being
> > prepended to sender's addresses.? This shouldn't happen any more.
> >
> >
> > You can get the new scripts and information from:
> >
> > http://people.ucsc.edu/~jrudd/MailScanner
> >
> >
> > If you have any questions, or notice any new bugs, please let me 
> know.
> >
> > (And be sure to edit your path to perl in the first line of each
> > script;
> > it changed in the downloads because my testing platform changed from
> > Solaris to Linux)
> >
> >
> > John Rudd
> >
> >
> > (ps: one person has mentioned that they see some messages being cross
> > delivered, but I haven't had anyone else mention this problem to me,
> > nor
> > have I seen it on my own servers; if you do see such a behavior, 
> please
> > let me know right away, and try to give me plenty of context
> > information)
> >
>


From Janssen at RZ.UNI-FRANKFURT.DE  Wed Jul 23 02:35:11 2003
From: Janssen at RZ.UNI-FRANKFURT.DE (Michael Janssen)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <1058898921.1282.38.camel@croithine>
References: <1058898921.1282.38.camel@croithine>
Message-ID: <Pine.A41.4.56.0307230233070.1860260@hermes-22.rz.uni-frankfurt.de>

On Tue, 22 Jul 2003, Thomas DuVally wrote:

> I recently upgraded both SA (2.55) and MS (4-20.3). I am running it in
> parallel to one of the older versions (2.43/4-10).
>
> I process about 70-100k per system per day. Each machine is otherwise
> identical and getting the same number and types of messages (equally
> weighted MX)
>
> Everyday around peak time the upgraded system starts to get backed up.
> The incoming queue goes from a normal 2-4 message count up to 1000+.
>
> Restarting MS will begin clearing this out.
>
> Question:  Is there a possible memory issue with eith MS or SA I should
> be aware of?  I've got it trimmed down pretty good with no bayes or RBLS
> and only incoming messages content checked.

Have you got reasons to suspect a memory problem? 16 MS workes should
consume up to 550MB (I count 33MB resident set size RSS given by "top" per
worker). This should be fine with 4GB (your sendmail(?)/ virus-scanner/ SA
can't take all the rest). Is the machine swapping (while it's mostly no
problem at all when the machine has swaped out some never used data it's
of course a problem if the machine is actually freeing and claiming
swap-space)?

What are the MS-Processes doing? Standing still (last logentry is what?
WCHAN and %CPU? strace-output (In the hope Solaris has all this kind of
information I'm familar to from our linux systems)?) or running too slow?

It's a bit hard to track this for 16 workers. Probably with help of a
filter script, that sets the loglines for different pids to different
colors (uhm 16 readable colors on console...). Anyway, in case the
processes are "just" slow it would be interessting if the TIME and
CTIME (Cumulative TIME - as far as i known only provided by top ("S"
key) of the Processes differs much.


By the way: I've just generated a fresh report for our system (MS 4.22-5):
http://www.rz.uni-frankfurt.de/~janssenm/logstats/daily/07.23.marcy.html

and Batchperformance/ Time/Batch (computing how much time was needed to
work on one batch) shows a very suspious pattern with low scan-times and
high - well, not high in a critical sense but the pattern is there and it
is correlated with the "dying of old age" Messages in the logs. I can't
remember to see such a pattern before and I really don't like it, cause
one might suspect, that MS would take more and more time without the
periodically-restart mechanism (which is by now regarded as a hyper secure
guard against possibly not actual problems). We have upgraded from v4.12
last week and swithced to sophossavi.... Nice, I'd love to investigate
that deeper.


Michael

>
> Specs:  Solaris 9
>         UltraSparc III+
>         2 CPU
>         4G mem
>         Perl 5.8
>
> If I can't figure this out I may have to downgrade.
> --
> Thomas J. DuVally
> Lead Systems Prog.
> CIS, Brown Univ.
>
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6
>

From greyhair at GREYHAIR.NET  Wed Jul 23 04:21:25 2003
From: greyhair at GREYHAIR.NET (Greyhair)
Date: Thu Jan 12 21:19:02 2006
Subject: ClamAV 0.60 problems -  ProcessClamAVOutput: unrecognized line
References: <ADF6087CA978A4418AF7F76DDCF2F7210275728E@europa.ats.sensis.com>
Message-ID: <000f01c350c9$839bcbe0$6245a8c0@laptop>

What version of  ClamAV are you using (0.60 as posted??).
try a snapshot after "Wed Jun 25 03:07:10 CEST 2003"
(read change log first and choose wisely)
I have had zero problems after changing to the snapshot.
but, I do not get but 300+ emails a day so I'm a light load
from what I have read.....
hope that helps.

----- Original Message -----
From: "Desai, Jason" <jase@SENSIS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 22, 2003 3:16 PM
Subject: ClamAV 0.60 problems - ProcessClamAVOutput: unrecognized line


> Hello.  I just upgraded to MailScanner 4.22-5 and ClamAV to 0.60.  I've
> noticed a few entries in my mail.log file such as:
>
> Jul 21 15:06:47 hostname MailScanner[26628]:
> /var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 Rev 14.zip:
> Files number limit exceeded.
> Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> unrecognised line
> "/var/spool/MailScanner/incoming/26628/./19efzB-0002a1-00/RS3 Rev 14.zip:
> Files number limit exceeded.". Please contact the authors!
> Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> CODE/RDI-68K/Load/LoadAsm.bat
> Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> unrecognised line " extracting: CODE/RDI-68K/Load/LoadAsm.bat ". Please
> contact the authors!
> Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> CODE/RDI-68K/Main/MainCc.bat
> Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> unrecognised line " extracting: CODE/RDI-68K/Main/MainCc.bat ". Please
> contact the authors!
> Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> CODE/RDI-68K/Main/MainMap.bat
> Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> unrecognised line " extracting: CODE/RDI-68K/Main/MainMap.bat ". Please
> contact the authors!
> Jul 21 15:06:47 hostname MailScanner[26628]: extracting:
> CODE/RDI-68K/RDISTART/RdiAsm.bat
> Jul 21 15:06:47 hostname MailScanner[26628]: ProcessClamAVOutput:
> unrecognised line " extracting: CODE/RDI-68K/RDISTART/RdiAsm.bat ". Please
> contact the authors!
> Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
> CODE/RStatusDecodeDLL/TestDriver/test.bcv
> Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
> unrecognised line " extracting: CODE/RStatusDecodeDLL/TestDriver/test.bcv
".
> Please contact the authors!
> Jul 21 15:06:48 hostname MailScanner[26628]: extracting:
> CODE/SensorDataDLL/res/SensorDataDLL.rc2
> Jul 21 15:06:48 hostname MailScanner[26628]: ProcessClamAVOutput:
> unrecognised line " extracting: CODE/SensorDataDLL/res/SensorDataDLL.rc2
".
> Please contact the authors!
>
> and
>
> Jul 21 19:28:28 hostname MailScanner[25439]:
> /var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_07_18.zip:
File
> size limit exceeded.
> Jul 21 19:28:28 hostname MailScanner[25439]: ProcessClamAVOutput:
> unrecognised line
> "/var/spool/MailScanner/incoming/25439/./19ek4w-0001fC-00/FAT_07_18.zip:
> File size limit exceeded.". Please contact the authors!
>
> I am thinking that this has to do with the new version of ClamAV.  I found
> some options for clamscan to disable some of these limits, and put them in
> clamav-wrapper.  Specifically, I set
>
> ScanOptions="--max-files=0 --max-space=0 --max-recursion=0"
>
> Questions:
>
> *  Has anyone else come across this?
> *  Since MailScanner already has timeouts for virus scanning, would you
> think it is safe to run this way?
> *  If yes, should this be the default?  (I'm not sure if versions < 0.60
> support this - maybe put some comments in the clamav-wrapper script?)
> *  Is "unrecognised" British for "unrecognized" or is it just misspelled?
>
> Thanks.
>
> Jason
>

From raymond at PROLOCATION.NET  Wed Jul 23 07:10:30 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <Pine.A41.4.56.0307230233070.1860260@hermes-22.rz.uni-frankfurt.de>
Message-ID: <Pine.LNX.4.44.0307230807030.3329-100000@mailbox.prolocation.net>

Hi!

> > Question:  Is there a possible memory issue with eith MS or SA I should
> > be aware of?  I've got it trimmed down pretty good with no bayes or RBLS
> > and only incoming messages content checked.

> Have you got reasons to suspect a memory problem? 16 MS workes should
> consume up to 550MB (I count 33MB resident set size RSS given by "top" per
> worker). This should be fine with 4GB (your sendmail(?)/ virus-scanner/ SA
> can't take all the rest). Is the machine swapping (while it's mostly no
> problem at all when the machine has swaped out some never used data it's
> of course a problem if the machine is actually freeing and claiming
> swap-space)?

I have 2 GIG RAM inside and no, its not swapping :) It just slows down
after some time. I'll upgrade kernels lateron today to see if thats an
issue.

> What are the MS-Processes doing? Standing still (last logentry is what?
> WCHAN and %CPU? strace-output (In the hope Solaris has all this kind of
> information I'm familar to from our linux systems)?) or running too slow?

Its Linux on my two boxes :) ...

> one might suspect, that MS would take more and more time without the
> periodically-restart mechanism (which is by now regarded as a hyper secure
> guard against possibly not actual problems). We have upgraded from v4.12
> last week and swithced to sophossavi.... Nice, I'd love to investigate
> that deeper.

Perhaps once Julian gets back he could have a look. But perhaps the kernel
upgrade allready fixes it, i'll check.

Bye,
Raymond.

From Antony at SOFT-SOLUTIONS.CO.UK  Wed Jul 23 12:16:54 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:02 2006
Subject: Message larger than max testing size
Message-ID: <200307231117.h6NBHN904424@agate.rockstone.co.uk>

Hi.

MailScanner has a setting Max SpamAssassin Size, which avoids doing SA checks
on very large messages.

However, the size appears to apply to the entire incoming email, not just to
the text part of it which would be checked by SA.

For example, I just received a spam mail which is 177684 bytes in size,
however it has two GIF attachments, one 115 kbytes in size and the other 9249
bytes (sorry for the slight mix of units, but that's how my mail client
reports them to me).

The actual text of the message is only 27 lines (not excessively long,
either), but it didn't get SA scanned because the entire mail was too big.

Could this be changed so that the size limit applies to the body of the email
itself, without attachments, rather than the whole thing with images etc
included?

Regards,

Antony.

--

If at first you don't succeed, destroy all the evidence that you tried.

From thomas_duvally at BROWN.EDU  Wed Jul 23 13:53:09 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <E19f5sO-0005N0-00@chiark.greenend.org.uk>
References: <E19f5sO-0005N0-00@chiark.greenend.org.uk>
Message-ID: <1058964788.5726.5.camel@croithine>

On Tue, 2003-07-22 at 18:44, Tony Finch wrote:
> Thomas DuVally <thomas_duvally@BROWN.EDU> wrote:
> >
> >Everyday around peak time the upgraded system starts to get backed up.
> >The incoming queue goes from a normal 2-4 message count up to 1000+.
> >Restarting MS will begin clearing this out.
>
> What are your MailScanner concurrency, batch size, and maximum age settings?
>

Max Children = 10
Max Unsafe Messages Per Scan = 50
Queue Scan Interval = 5


--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From thomas_duvally at BROWN.EDU  Wed Jul 23 13:55:48 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <53B63D16-BC98-11D7-88FC-000393920D6C@uptime.at>
References: <53B63D16-BC98-11D7-88FC-000393920D6C@uptime.at>
Message-ID: <1058964948.5735.9.camel@croithine>

On Tue, 2003-07-22 at 19:00, David wrote:
> On Mittwoch, Juli 23, 2003, at 12:58  Uhr, Raymond Dijkxhoorn wrote:
>
> > Hi!
> >
> >>> Everyday around peak time the upgraded system starts to get backed
> >>> up.
> >>> The incoming queue goes from a normal 2-4 message count up to 1000+.
> >>> Restarting MS will begin clearing this out.
> >>
> >> What are your MailScanner concurrency, batch size, and maximum age
> >> settings?
> >
> > On two of my boxes:
> >
> > Max Children = 16
> Geeze, does that run on a Sun Fire ? ;)
>

I think you're confusing Raymonds responses with my initial question and
specs.

> -d
>
> -- nee amata wo mitsukete soshite midoto wasrezu
>     domma mi mumega itakutemo soba mi iru mo
>                       zutto...zutto...zutto
--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From thomas_duvally at BROWN.EDU  Wed Jul 23 14:07:32 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:19:02 2006
Subject: Vexing problem
In-Reply-To: <Pine.A41.4.56.0307230233070.1860260@hermes-22.rz.uni-frankfurt.de>
References: <1058898921.1282.38.camel@croithine>
            <Pine.A41.4.56.0307230233070.1860260@hermes-22.rz.uni-frankfurt.de>
Message-ID: <1058965651.5737.20.camel@croithine>

On Tue, 2003-07-22 at 21:35, Michael Janssen wrote:

> Have you got reasons to suspect a memory problem? 16 MS workes should
> consume up to 550MB (I count 33MB resident set size RSS given by "top" per
> worker). This should be fine with 4GB (your sendmail(?)/ virus-scanner/ SA
> can't take all the rest). Is the machine swapping (while it's mostly no
> problem at all when the machine has swaped out some never used data it's
> of course a problem if the machine is actually freeing and claiming
> swap-space)?
>

Swapping doesn't seem to be a problem.  There always seems to be at
least 2gig free available. Sure, some stuff has swapped out, but that's
just cruft, I think.  And about 23MB RES per, but multiply that by 10-15
workers and I only get about 230-350MB, not exactly taxing 4gig

> What are the MS-Processes doing? Standing still (last logentry is what?
> WCHAN and %CPU? strace-output (In the hope Solaris has all this kind of
> information I'm familar to from our linux systems)?) or running too slow?
>

I'll have to dig a little.

> It's a bit hard to track this for 16 workers. Probably with help of a
> filter script, that sets the loglines for different pids to different
> colors (uhm 16 readable colors on console...). Anyway, in case the
> processes are "just" slow it would be interessting if the TIME and
> CTIME (Cumulative TIME - as far as i known only provided by top ("S"
> key) of the Processes differs much.
>

This gives me a better point to dig deeper and some ideas to get better
stats.  BTW, that 16 number is from Raymonds responses, not mine.  I'm
running 10 and seen it go up to 15. (should that be happening, I've
never been sure.  I just assumed it was automagicly creating what it
needed above the initial 10.  If so, shouldn't it be labeled "Min
Children"?)

>
> By the way: I've just generated a fresh report for our system (MS 4.22-5):
> http://www.rz.uni-frankfurt.de/~janssenm/logstats/daily/07.23.marcy.html
>
> and Batchperformance/ Time/Batch (computing how much time was needed to
> work on one batch) shows a very suspious pattern with low scan-times and
> high - well, not high in a critical sense but the pattern is there and it
> is correlated with the "dying of old age" Messages in the logs. I can't
> remember to see such a pattern before and I really don't like it, cause
> one might suspect, that MS would take more and more time without the
> periodically-restart mechanism (which is by now regarded as a hyper secure
> guard against possibly not actual problems). We have upgraded from v4.12
> last week and swithced to sophossavi.... Nice, I'd love to investigate
> that deeper.
>
>
> Michael

--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From Denis.Beauchemin at USHERBROOKE.CA  Wed Jul 23 14:12:47 2003
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:19:02 2006
Subject: How to setup a tmpfs on a RH system
In-Reply-To: <Pine.LNX.4.44.0307222302551.18163-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307222302551.18163-100000@mailbox.prolocation.net>
Message-ID: <1058965967.3137.49.camel@dbeauchemin.sti.usherbrooke.ca>

Looks quite simple and works well.

Now, how much RAM should I allocate for this directory?  If I allocate
only 256MB to it and it needs more, what will happen?  Will I lose mail?

I started monitoring this directory's size this morning and my 2 systems
have already used more than 256MB on occasions (I watch it every 5
seconds).

Thanks again!

Denis

Le mar 22/07/2003 ? 17:04, Raymond Dijkxhoorn a ?crit :
> Hi!
> 
> > I would like to experiment with a tmpfs and MS but am at a loss as to
> > how to create one on a RH 7.3 system.
> >
> > I searched my man pages and this list's archives to no avail.
> >
> > Also which directories should I put on it for best performance and
> > reliability?
> 
> If you use it 'default' it will take half of your available ram. You can
> tune this by adding a size statement in your fstab.
> 
> Like this:
> 
> none                    /var/spool/MailScanner/incoming/  tmpfs   size=512m        0 0
> 
> Bye,
> Raymond.
-- 
Denis Beauchemin, analyste
Universit? de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045


From dot at DOTAT.AT  Wed Jul 23 14:00:05 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:02 2006
Subject: Message larger than max testing size
In-Reply-To: <m2n.19fHdF-000qLy@chiark.greenend.org.uk>
Message-ID: <E19fJDx-00042j-00@chiark.greenend.org.uk>

Antony Stone <Antony@SOFT-SOLUTIONS.CO.UK> wrote:
>
>Could this be changed so that the size limit applies to the body of the email
>itself, without attachments, rather than the whole thing with images etc
>included?

I've patched MailScanner to SpamAssassinate only the first N bytes of
a message, according to the Max SpamAssassin Size, rather than not
scan large messages at all. This is closer to what my users want, and
it seems there are some large spams around, and it means I can get away
with a smaller setting and therefore less SA CPU usage.


--- EximDiskStore.pm    13 May 2003 17:44:43 -0000      1.13
+++ EximDiskStore.pm    21 Jul 2003 18:05:01 -0000      1.14
@@ -321,8 +321,8 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
-
+  my($body,$max) = @_;
+  my $size = 0;
   my $dh = $this->{indhandle};

   seek($dh, 0, 0); # Rewind the file
@@ -330,10 +330,11 @@
   my $line = <$dh>;
   # FIXME: check that id is correct here

-  while(<$dh>) {
+  while(defined <$dh> and $size < $max) {
     # End of line characters are already there, so don't add them
     #push @{$body}, $_ . "\n";
     push @{$body}, $_;
+    $size += length $_;
   }
 }

--- PFDiskStore.pm      4 Jul 2003 18:08:28 -0000       1.1.1.3
+++ PFDiskStore.pm      21 Jul 2003 18:05:01 -0000      1.2
@@ -381,14 +382,16 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
+  my($body,$max) = @_;
+  my $size = 0;

   my $b= Body->new( $this->{hdpath} );
   if ($b) {
     $b->Start();
     my $line;
-    while(defined($line = $b->Next())) {
+    while(defined($line = $b->Next()) and $size < $max) {
       push @{$body}, $line . "\n";
+      $size += length $line + 1;
     }
     $b->Done();
   }
--- SA.pm       4 Jul 2003 20:03:18 -0000       1.18
+++ SA.pm       21 Jul 2003 18:05:01 -0000      1.19
@@ -161,10 +161,7 @@
 # Do the SpamAssassin checks on the passed in message
 sub Checks {
   my $message = shift;
-
-  my($dfhandle);
-  my($dfilename, $dfile, $dsize, @WholeMessage, $SAResult, $SAHitList);
-  my($HighScoring, $SAScore);
+  my(@WholeMessage, $SAResult, $SAHitList, $HighScoring, $SAScore);

   # Bail out and fake a miss if too many consecutive SA checks failed
   my $maxfailures = MailScanner::Config::Value('maxspamassassintimeouts');
@@ -196,9 +193,13 @@
        # LEOH 26/03/2003 We do not always have dpath file, so we ask to
   #                 the store module the size
   # $dsize = (stat($message->{store}{dpath}))[7];
-  $dsize = $message->{store}->dsize();
-  return (-1,0, MailScanner::Config::LanguageValue($message,'satoolarge'), 0)
-    if $dsize > MailScanner::Config::Value('maxspamassassinsize');
+  #$dsize = $message->{store}->dsize();
+  #$dmax = MailScanner::Config::Value('maxspamassassinsize');
+  #return (-1,0, MailScanner::Config::LanguageValue($message,'satoolarge'), 0)
+  #  if $dsize > MailScanner::Config::Value('maxspamassassinsize');
+  #MailScanner::Log::InfoLog("Truncating large message %s for SpamAssassin",
+  #                          $message->{id})
+  #  if $dsize > $dmax and MailScanner::Config::Value('logspam');

   # Construct the array of lines of the header and body of the message
   # JKF 30/1/2002 Don't chop off the line endings. Thanks to Andreas Piper
@@ -212,7 +213,8 @@
   return (-1,0, MailScanner::Config::LanguageValue($message, 'sanoheaders'), 0)
     unless @WholeMessage;
   push(@WholeMessage, "\n");
-  $message->{store}->ReadBody(\@WholeMessage);
+  $message->{store}->ReadBody(\@WholeMessage,
+                        MailScanner::Config::Value('maxspamassassinsize'));

   #print STDERR "Whole message is this:\n";
   #print STDERR "----------------------\n";
--- SMDiskStore.pm      4 Jul 2003 19:13:31 -0000       1.13
+++ SMDiskStore.pm      21 Jul 2003 18:05:01 -0000      1.14
@@ -286,15 +286,17 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
-  my($dh) = $this->{indhandle};
+  my($body,$max) = @_;
+  my $size = 0;
+  my $dh = $this->{indhandle};

   seek($dh, 0, 0); # Rewind the file

-  while(<$dh>) {
+  while(defined <$dh> and $size < $max) {
     # End of line characters are already there, so don't add them
     #push @{$body}, $_ . "\n";
     push @{$body}, $_;
+    $size += length $_;
   }
 }

--- ZMDiskStore.pm      4 Jul 2003 18:08:28 -0000       1.1.1.3
+++ ZMDiskStore.pm      21 Jul 2003 18:05:01 -0000      1.2
@@ -291,13 +292,15 @@
 #REVISO LEOH
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
+  my($body,$max) = @_;
+  my $size = 0;

   my $b= Body->new( $this->{hdpath} );
   $b->Start();
   my $line;
-  while( $line= $b->Next() ) {
+  while(defined($line = $b->Next()) and $size < $max) {
     push @{$body}, $line;
+    $size += length $line;
   }
   $b->Done();
 }



Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
ST DAVIDS HEAD TO COLWYN BAY, INCLUDING ST GEORGES CHANNEL: SOUTH TO SOUTHEAST
5 OR 6 LOCALLY 4 VEERING SOUTHWEST TO WEST 4 OR 5, LATER EASING WEST 4 LOCALLY
3. OUTBREAKS OF RAIN AT FIRST, FOLLOWED BY SCATTERED SHOWERS THEN MAINLY FAIR.
MODERATE BECOMING MAINLY GOOD LATER. SLIGHT TO MODERATE BUILDING MODERATE TO
ROUGH IN THE WEST.

From phil at NXTEK.NET  Wed Jul 23 14:16:03 2003
From: phil at NXTEK.NET (Phil Iovino)
Date: Thu Jan 12 21:19:02 2006
Subject: blocking messages with <form> tags
In-Reply-To: <000001c3504f$bac1b000$6900000a@targetsis.com.br>
Message-ID: <02d301c3511c$92268d00$a6f83544@cc109252A>

Is there a way to strip/remove the actual <form> tag instead of blocking
the entire message or converting it to text?

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodrigo Scarano
> Sent: Tuesday, July 22, 2003 7:50 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: RES: blocking messages with <form> tags
> 
> 
> Sylvain,
> I use Allow IFrame Tags = yes and Allow Object Codebase Tags 
> = yes, but the
> line Convert Dangerous HTML To Text is set to yes. I guess 
> i'm secure with
> this.
> 
> Regards,
> 
> 
> 
> Rodrigo Scarano
> Target Sistemas
> http://www.targetsis.com.br/
> rscarano@targetsis.com.br
> 
> 
> -----Mensagem original-----
> De:     MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] Em nome de
> Sylvain 
> Phaneuf
> Enviada em:     Ter?a-feira, 22 de Julho de 2003 06:19
> Para:   MAILSCANNER@JISCMAIL.AC.UK
> Assunto:        blocking messages with <form> tags
> 
> Hi everyone,
> 
> I have upgraded MS to 4.22-5 last week, and selected to block messages
> containing form tags. I am quite puzzled to see how many messages we
> have stopped because of that. It seems that a lot of genuine mail is
> coming with those form tags, e.g. from medical /scientific abstract
> services.
> 
> I haven't got a clue how dangerous can these forms be. Should I
> continue stopping these messages? I noticed that a few 
> services seem to
> know that their messages are likely to be stopped, they have the
> following line in plain text at the top of the message:
> ""If you cannot view this email, please copy and paste the following
> link into your browser: 
> http://master.emedicine.com/email/radio23.html> ""
> 
> 
> Thanks in 
> advance for sharing your opinions.
> 
> 
> 
> Sylvain
> 
> 
> ===========================================================
> Sylvain Phaneuf --- Computing Manager   | phone : +44 (0)1865 221323
> Information Management Services Unit  -  Medical Sciences Division
> Oxford University                               | email :
> sylvain.phaneuf@imsu.ox.ac.uk
> Room 3A25B John Radcliffe Hospital      | fax :  +44 (0) 1865 221322
> Oxford   OX3 9DU   England
> ===========================================================
> 


From mkettler at EVI-INC.COM  Wed Jul 23 15:01:18 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:02 2006
Subject: Message larger than max testing size
In-Reply-To: <200307231117.h6NBHN904424@agate.rockstone.co.uk>
Message-ID: <5.2.1.1.0.20030723100039.015b9408@xanadu.evi-inc.com>

At 12:16 PM 7/23/2003 +0100, Antony Stone wrote:
>MailScanner has a setting Max SpamAssassin Size, which avoids doing SA checks
>on very large messages.
>
>However, the size appears to apply to the entire incoming email, not just to
>the text part of it which would be checked by SA.

SA doesn't just check the "text part".. SA gets the whole message,
completely un-decoded.

From Antony at SOFT-SOLUTIONS.CO.UK  Wed Jul 23 15:16:35 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:02 2006
Subject: Message larger than max testing size
In-Reply-To: <5.2.1.1.0.20030723100039.015b9408@xanadu.evi-inc.com>
References: <5.2.1.1.0.20030723100039.015b9408@xanadu.evi-inc.com>
Message-ID: <200307231417.h6NEH6904515@agate.rockstone.co.uk>

On Wednesday 23 July 2003 3:01 pm, Matt Kettler wrote:

> At 12:16 PM 7/23/2003 +0100, Antony Stone wrote:
> >MailScanner has a setting Max SpamAssassin Size, which avoids doing SA
> > checks on very large messages.
> >
> >However, the size appears to apply to the entire incoming email, not just
> > to the text part of it which would be checked by SA.
>
> SA doesn't just check the "text part".. SA gets the whole message,
> completely un-decoded.

Hmm.   Sounds like a slightly strange way to do it.   What's the point of
SpamAssassin-scanning a GIF image?

Antony.

--

Anything that improbable is effectively impossible.

 - Murray Gell-Mann, Nobel Prizewinner in Physics

From TGFurnish at HERFF-JONES.COM  Wed Jul 23 15:10:54 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:02 2006
Subject: Rejected e-mail Any Clues ?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C0735@inex1.herffjones.hj-int>

The rejection is happening at the inbound sendmail layer, not in
MailScanner.  Are you using anything for sendmail access control besides the
access database (ORDB?)?  Made any changes to your hosts file,
/etc/nsswitch.conf, or /etc/resolv.conf files recently?  It seems to me I
bumped into exactly the same message recently but I can't remember what the
issue ended up being.  Seems like it was a goofy mistake on my part...
Sorry, hope it helps.

>-----Original Message-----
>From: Denis Croombs [mailto:denis@CROOMBS.ORG]
>Sent: Tuesday, July 22, 2003 7:21 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Rejected e-mail Any Clues ?
>
>
>An e-mail was rejected by 1 of my servers currently running MailScanner
>(latest version) and SpamAssassin 2.55 on a redhat 7.3 system
>with Sendmail,
>
>The returned e-mail is:-
>
>-----Original Message-----
>From: Info Avenue Internet Services [mailto:postmaster@InfoAve.Net]
>Sent: Monday, July 21, 2003 5:16 AM
>To: spw0082@xxxxxx.com
>Subject: Delivery Notification: Delivery has failed
>
>
>This report relates to a message you sent with the following
>header fields:
>
>  Message-id:
>
><!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAsdlzKiJ/IE+JQwj
>ar04dEsKAAAAQ
>AAAAiwmE/lx1vUuurCT2KKM2VAEAAAAA@xxxxxx.com>
>  Date: Mon, 21 Jul 2003 06:15:49 -0400
>  From: Steve spw0082@xxxxxx.com
>  To: Julie julie@yyyyyy.com
>  Subject: Meeting
>
>Your message cannot be delivered to the following recipients:
>
>  Recipient address: julie@yyyyyy.com
>  Reason: Server rejected MAIL FROM address.
>  Diagnostic code: smtp;550 5.7.1 Access denied
>  Remote system: dns;mail.yyyyyy.com
>(TCP|165.166.0.28|58988|217.199.181.62|25)
>
>Action: failed
>Status: 5.0.0 (Server rejected MAIL FROM address.)
>Original-recipient: rfc822;julie@yyyyyy.com
>Final-recipient: rfc822;julie@yyyyyy.com
>Remote-MTA: dns;mail.yyyyyy.com
>(TCP|165.166.0.28|58988|217.199.181.62|25)
>Diagnostic-code: smtp;550 5.7.1 Access denied
>
>**************End of returned message*****************
>
>In my sendmail (maillog) I have the following which are the
>only entries
>relating to the incoming domain & this e-mail address:-
>
>Jul 21 10:47:03 ns sendmail[22305]: h6L9l3322305: ruleset=check_relay,
>arg1=smtp03.infoave.net, arg2=165.166.0.28, relay=smtp03.infoave.net
>[165.166.0.28], reject=550 5.7.1 Access denied
>Jul 21 10:47:04 ns sendmail[22305]: NOQUEUE: smtp03.infoave.net
>[165.166.0.28] did not issue MAIL/EXPN/VRFY/ETRN during
>connection to MTA
>
>Jul 21 16:46:41 ns sendmail[5948]: h6LFke305948:
>from=<spw0082@xxxxxx.com>,
>size=70816, class=0, nrcpts=1,
>msgid=<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAsdlzKiJ/I
>E+JQwjar04dEs
>KAAAAQAAAAGwBd8juOXkax2uIkOJdP, proto=ESMTP, daemon=MTA,
>relay=smtp01.infoave.net [165.166.0.26]
>Jul 21 16:46:41 ns sendmail[5948]: h6LFke305948: to=<julie@yyyyyy.com>,
>delay=00:00:00, mailer=virthostmail, pri=100816, stat=queued
>Jul 21 16:46:42 ns MailScanner[31907]: New Batch: Scanning 1
>messages, 71369
>bytes
>Jul 21 16:46:42 ns MailScanner[31907]: Spam Checks: Starting
>Jul 21 16:46:44 ns MailScanner[31907]: Virus and Content
>Scanning: Starting
>Jul 21 16:46:44 ns MailScanner[31907]: Uninfected: Delivered 1 messages
>Jul 21 16:46:44 ns virthostmail[5956]: Chrooting to
>/home/virtual/site3/fst
>Jul 21 16:46:44 ns sendmail[5958]: h6LFkiO05958:
>from=<spw0082@xxxxxx.com>,
>size=71279, class=0, nrcpts=1,
>msgid=<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAsdlzKiJ/I
>E+JQwjar04dEs
>KAAAAQAAAAGwBd8juOXkax2uIkOJdP, proto=ESMTP, relay=root@localhost
>Jul 21 16:46:44 ns sendmail[5954]: h6LFke305948: to=<julie@yyyyyy.com>,
>delay=00:00:03, xdelay=00:00:00, mailer=virthostmail, pri=190816,
>relay=yyyyyy.com, dsn=2.0.0, stat=Sent (h6LFkiO05958 Message
>accepted for
>delivery)
>Jul 21 16:46:44 ns sendmail[5959]: h6LFkiO05958: to=<julie@yyyyyy.com>,
>delay=00:00:00, xdelay=00:00:00, mailer=local, pri=100014, dsn=2.0.0,
>stat=Sent
>
>All clues very welcome
>
>Denis
>

From jrudd at UCSC.EDU  Wed Jul 23 15:28:11 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:02 2006
Subject: Message larger than max testing size
In-Reply-To: <200307231417.h6NEH6904515@agate.rockstone.co.uk>
Message-ID: <E32B97DC-BD19-11D7-A34A-003065F939FE@ucsc.edu>

On Wednesday, Jul 23, 2003, at 07:16 US/Pacific, Antony Stone wrote:

>
> On Wednesday 23 July 2003 3:01 pm, Matt Kettler wrote:
>
>> At 12:16 PM 7/23/2003 +0100, Antony Stone wrote:
>>> MailScanner has a setting Max SpamAssassin Size, which avoids doing
>>> SA
>>> checks on very large messages.
>>>
>>> However, the size appears to apply to the entire incoming email, not
>>> just
>>> to the text part of it which would be checked by SA.
>>
>> SA doesn't just check the "text part".. SA gets the whole message,
>> completely un-decoded.
>
> Hmm.   Sounds like a slightly strange way to do it.   What's the point
> of
> SpamAssassin-scanning a GIF image?
>

If you send it just the mime segments, it wont catch any tell-tale
signs in the headers.  Or even some signs that are in the mime-encoding
headers/separators.  Therefore, you send it the entire message, still
encoded, and it looks at every little piece of the message.  I don't
think any of SA's rules cover the encoded content of a GIF image, but
if you don't send it EVERYTHING, it'll miss important things that it
wouldn't get if you just sent it the content of certain segments.


Though, it might be an interesting exercise to see if you can re-do
some of the SA structure so that you run multiple checks: do a headers
only check, a mime separators check, a check for each non-binary
segment's content, and then work in the whitelist/blacklist info based
upon the sender and receiver.  That would make it easier to avoid
spending time on binary segments, but I bet it would make a bunch of
things more complex and tricky than they need to be.  Might be
interesting to see if it actually improves anything though.

You should propose it on the SA-talk list and see what they say.  :-)

From dean.plant at ROKE.CO.UK  Wed Jul 23 16:27:45 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:19:02 2006
Subject: Mailscanner corrupting pdf files
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A70236735@rsys004a.roke.co.uk>

RH 8.0
Mailscanner 4.21-9
Spamassassin/dcc/razor2
F-prot 4.1.1


A quick description of our mail setup, internal windoze exchange 5.5 server
with outlook 2000 clients. All incoming and outgoing mail is relayed through
a Mailscanner server.

I am having a problem with pdf files corrupting when passing through the
Mailscanner. If a mail with a pdf attachment is sent from one of our
clients, MS exchange encodes the message as either base64 or
quoted-printable format. All messages that are encoded as base64 pass
through the MailScanner correctly. Quoted-printable format mails have the
attachment corrupted. Turning off virus checks on Mailscanner allows the
quoted-printable mails to pass through without corruption, so I assume it
has something to do with:

1. Perl Mime::tools - Is this decoding / encoding the attachment correctly?
2. MS Exchange - Why encode some pdf's as base64 and some as
quoted-printable
3. Different versions/creators of pdf files.

Has anyone else suffered from this problem or does anyone have a suggestion
as a fix.


Thanks

Dean Plant

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

From nejc.skoberne at guest.arnes.si  Wed Jul 23 16:46:34 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:19:02 2006
Subject: MS & AvMailGate
Message-ID: <318685377.20030723174634@guest.arnes.si>

Hi.

AvMailGate (Antivir's) provides it's own SMTP server, but I would like
to use Postfix+(MailScanner+AvMailGate+SpamAssassin).

Does anyone have experience on this one? Does "antivir" program, which
comes with AvMailGate works like command line scanner and does MS
support it?

TIA, best regards.

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From vboulytchev at COINFOTECH.COM  Wed Jul 23 17:07:25 2003
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:19:02 2006
Subject: _THIRD_ CommuniGate Pro - MailScanner update
Message-ID: <1958DE295D9656499ECAAD3642822DE0033FE8@willow.office.coinfotech.com>

Greetings again.  Recap on the latest:
1.)  Its working.
2.) no more .bad files.
3.) its working, working, working.
 
I am so happy to get my servers off cgpav and sophie, I am dancing in
circles.  I would like to thank everyone in MailScanner / CommuniGatePRO
community for their support.
 
 
 
Thanks guys.
 
 
 

Vasiliy Boulytchev

Colorado Information Technologies Inc.

(719) 473-2800 x15

 <http://coinfotech.com/> 

 

 

-----Original Message-----
From: John Rudd [mailto:jrudd@UCSC.EDU] 
Sent: Tuesday, July 22, 2003 6:40 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: _THIRD_ CommuniGate Pro - MailScanner update




Well, there's two problems:

1) when you disabled that check in the mailscanner code (that I said
you shouldn't do), it caused mailscanner to accept messages that aren't
valid, and then pass them on to communigate pro, which then makes .bad
files out of them.  If you hadn't done that to mailscanner, they would
be being built up in the /var/spool/mqueue.in directory for
mailscanner, and mail scanner would be putting messages into your
syslog.  You should re-enable the default mailscanner code.

2) my cgp2ms script depended upon receiving a "Received:" header before
printing out certain qf file variables ($_ the relay host, which it
extracts from the Received header; S the sender; and the RPFD lines,
the recipients).  The problem is that for localhost senders, such as
messages created by CommuniGate Pro's rules, it never triggered this
because there are no Received headers at all, creating a message with
no relay, no sender, and no recipients.  I've re-worked my logic in the
cgp2ms script so that when it moves from the headers to the body, if it
still hasn't printed those variables, it does so (using localhost for
the relay).  I also re-wrote the regexp logic for extracting the relay
host from the Received header (it worked for some received headers,
that have both the hostname and the ip addr, but not for received
headers which only list the relay's ip addr; I fixed that).

So, my third update release in 2 days.  Hopefully that fixes everything
:-)

I also re-formatted my update announcements at the top of the page.

http://people.ucsc.edu/~jrudd/MailScanner


John




On Tuesday, Jul 22, 2003, at 15:37 US/Pacific, Boulytchev, Vasiliy
wrote:

> John,
>      Your guess was correct.  It is an autoreply rule on account
> "autoreply" on "mailsvc.com" domain, in CommunigatePro.  By the way,
> You can cross the other errors off the list.  I have tested BCC, RPFD:
> and all, the fix worked great that you release earlier.  So we just
> have one left, hopefully.
>  
> THANKS!!!!!!!!!!!!!!!!!!!!!
>  
>  
>  
>
> Vasiliy Boulytchev
>
> Colorado Information Technologies Inc.
>
> (719) 473-2800 x15
>
>
>
>  
>
>  
>
>
> -----Original Message-----
> From: John Rudd [mailto:jrudd@UCSC.EDU]
> Sent: Tuesday, July 22, 2003 4:20 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: CommuniGate Pro - MailScanner update
>
> How was that bad message generated?  It would appear that it was
> generated without any recipients (hence the lack of lines that start
> RPFD:, the sendmail queue file line indicating each recipient).  Is it
> being generated by CommuniGate Pro's rules? or something else?
>
> On Tuesday, Jul 22, 2003, at 14:56 US/Pacific, Boulytchev, Vasiliy
> wrote:
>
> > Yet another .bad :))))))))))))))))))))
> >  
> > Here is the qf-blah file
> >  
> > V4
> > T1058909914
> > K0
> > N0
> > P150900
> > HFrom: <autoreply@mailsvc.com> (Automatic Reply mailbox for testing)
> > HDate: Tue, 22 Jul 2003 15:38:33 -0600
> > HMessage-ID: <react-12399218@mailsvc.com>
> > HX-Autogenerated: Reply
> > HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
> > HSubject: Re:
> > HIn-Reply-To: <003601c3509a$4af6f4b0$3700000a@office.coinfotech.com>
> > autoreply@mailsvc.com  is just a mailbox on Communigate Mail Server
> to
> > autoreply to the message for testing purposes.
> >  
> >  
> > How about messages from Daemons on Listservers?
> >  
> > Here is a copy of a good qf-blah
> >  
> > V4
> > T1058910524
> > K0
> > N0
> > P150900
> > $_
> > S<vboulytchev@coinfotech.com>
> > RPFD:<virus@boulytcheva.com>
> > HReceived: from [209.12.32.66] (HELO willow.office.coinfotech.com)
> >   by mailsvc.com (CommuniGate Pro SMTP 4.0.6)
> >   with ESMTP id 12399741 for virus@boulytcheva.com; Tue, 22 Jul 2003
> > 15:48:43 -0600
> > HMIME-Version: 1.0
> > HContent-Type: multipart/alternative;
> >         boundary="----_=_NextPart_001_01C3509B.93B4BFAB"
> > Hcontent-class: urn:content-classes:message
> > HX-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
> > HSubject:
> > HDate: Tue, 22 Jul 2003 15:52:42 -0600
> > HMessage-ID:
> >
<1958DE295D9656499ECAAD3642822DE0033FD7@willow.office.coinfotech.com>
> > HX-MS-Has-Attach:
> > HX-MS-TNEF-Correlator:
> > HThread-Index: AcNQm5OBeCvE5aXeTmW62LdyGyY1eQ==
> > HFrom: "Boulytchev, Vasiliy" <vboulytchev@coinfotech.com>
> > HTo: "vasiliy boulytchev" <virus@boulytcheva.com>
> >  
> >  
> >
> > Vasiliy Boulytchev
> >
> > Colorado Information Technologies Inc.
> >
> > (719) 473-2800 x15
> >
> >
> >
> >  
> >
> >  
> >
> >
> > -----Original Message-----
> > From: John Rudd [mailto:jrudd@UCSC.EDU]
> > Sent: Monday, July 21, 2003 4:37 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: CommuniGate Pro - MailScanner update
> >
> > I have made an update to my scripts for using MailScanner with
> > CommuniGate Pro.  I have also updated the text of the CommuniGate
Pro
> > rule instructions (the Execute rule no longer needs the [RETPATH]
nor
> > [RCPT] options).
> >
> > This should change the problem some people noticed with ".bad" files
> > showing up in the CommuniGate Pro Queue directory, due to "RPFD:"
> being
> > prepended to sender's addresses.  This shouldn't happen any more.
> >
> >
> > You can get the new scripts and information from:
> >
> > http://people.ucsc.edu/~jrudd/MailScanner
> >
> >
> > If you have any questions, or notice any new bugs, please let me
> know.
> >
> > (And be sure to edit your path to perl in the first line of each
> > script;
> > it changed in the downloads because my testing platform changed from
> > Solaris to Linux)
> >
> >
> > John Rudd
> >
> >
> > (ps: one person has mentioned that they see some messages being
cross
> > delivered, but I haven't had anyone else mention this problem to me,
> > nor
> > have I seen it on my own servers; if you do see such a behavior,
> please
> > let me know right away, and try to give me plenty of context
> > information)
> >
>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030723/fae12dba/attachment.html
From Steve at swaney.com  Wed Jul 23 17:36:25 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:02 2006
Subject: Mailscanner corrupting pdf files
In-Reply-To: <EA943CD30BCB104E9D38F5B5DC2D9A70236735@rsys004a.roke.co.uk>
References: <EA943CD30BCB104E9D38F5B5DC2D9A70236735@rsys004a.roke.co.uk>
Message-ID: <1058978185.29144.49.camel@speedy>

Check the MailScanner email list archives searching for  "pdf corrupt"
in the Archives. Might be something of use.

Steve Swaney
Steve@Swaney.com


On Wed, 2003-07-23 at 11:27, Plant, Dean wrote:

> RH 8.0
> Mailscanner 4.21-9
> Spamassassin/dcc/razor2
> F-prot 4.1.1
>
>
> A quick description of our mail setup, internal windoze exchange 5.5 server
> with outlook 2000 clients. All incoming and outgoing mail is relayed through
> a Mailscanner server.
>
> I am having a problem with pdf files corrupting when passing through the
> Mailscanner. If a mail with a pdf attachment is sent from one of our
> clients, MS exchange encodes the message as either base64 or
> quoted-printable format. All messages that are encoded as base64 pass
> through the MailScanner correctly. Quoted-printable format mails have the
> attachment corrupted. Turning off virus checks on Mailscanner allows the
> quoted-printable mails to pass through without corruption, so I assume it
> has something to do with:
>
> 1. Perl Mime::tools - Is this decoding / encoding the attachment correctly?
> 2. MS Exchange - Why encode some pdf's as base64 and some as
> quoted-printable
> 3. Different versions/creators of pdf files.
>
> Has anyone else suffered from this problem or does anyone have a suggestion
> as a fix.
>
>
> Thanks
>
> Dean Plant
>
> --
> Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
> Berkshire. RG12 8FZ
>
> The information contained in this e-mail and any attachments is confidential to
> Roke Manor Research Ltd and must not be passed to any third party without
> permission. This communication is for information only and shall not create or
> change any contractual relationship.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030723/b1162c6b/attachment.html
From nejc.skoberne at guest.arnes.si  Wed Jul 23 17:39:54 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:19:02 2006
Subject: MS & AvMailGate
In-Reply-To: <1058977266.29144.36.camel@speedy>
References: <318685377.20030723174634@guest.arnes.si>
            <1058977266.29144.36.camel@speedy>
Message-ID: <1156636533.20030723183954@guest.arnes.si>

Hi.

> AntiVir appears to be supported:
> http://www.fsl.com/VirusScanners.htm

That appears to be "Antivir" not "AvMailGate". If I understand
correctly, Antivir is a command line scanner, whilst AvMailGate is a
SMTP server which uses this scanner. AvMailGate provides "antivir"
program as well, but it seems that AvMailGate's licence file doesn't
work with "antivir" program alone ("Program running in DEMO mode."). I
guess "antivir" program runs in full-featured mode only if it is
called from AvMailGate SMTP server. Not good.

Thanks anyway.

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From mhewryk at SYMCOR.COM  Wed Jul 23 18:59:55 2003
From: mhewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:19:02 2006
Subject: Permission on the quarantine directories
Message-ID: <LISTSERV%2003072318595587@JISCMAIL.AC.UK>

Hi,

I'm trying to work on permissions in the quarantine directory.

The idea is that Operations can log on to mail gateway and retrieve the
requested attachments if needed.

However, by default the permissions on directories in quarantine directory
are set as 700.

How can I manipulate with permissions to set the default to 770 root:smmsp
the moment they are created? I can then through Ops people to the smmsp
group and this way not only root would have the ability to retrieve
attachments.

Any help?  Can this be accomplished?

Regards,
Magda

drwx------   17 root     root         4096 Jul 23 13:38 20030723:


drwx------    2 root     root         4096 Jul 23 06:39 h6NAd0o4013812
drwx------    2 root     root         4096 Jul 23 07:28 h6NBSto4018142
drwx------    2 root     root         4096 Jul 23 08:50 h6NCopo4026618
drwx------    2 root     root         4096 Jul 23 08:53 h6NCrko4027160
drwx------    2 root     root         4096 Jul 23 09:30 h6NDUeo4030994
drwx------    2 root     root         4096 Jul 23 09:45 h6NDixo4032760
drwx------    2 root     root         4096 Jul 23 10:05 h6NE5so4002634
drwx------    2 root     root         4096 Jul 23 10:34 h6NEWMo4005780
drwx------    2 root     root         4096 Jul 23 11:04 h6NF4Xo4009478
drwx------    2 root     root         4096 Jul 23 11:10 h6NFAko4010119
drwx------    2 root     root         4096 Jul 23 11:37 h6NFbYo4013516
drwx------    2 root     root         4096 Jul 23 13:38 h6NHclo4026919

From nejc.skoberne at guest.arnes.si  Wed Jul 23 19:00:49 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:19:03 2006
Subject: MS with AntiVir
Message-ID: <170102410.20030723200049@guest.arnes.si>

Hi.

root@Octopussy:~# antivir virus.exe
AntiVir / Linux Version 2.0.7-41
Copyright (C) 1994-2003 by H+BEDV Datentechnik GmbH.
All rights reserved.

Loading /usr/lib/AntiVir/antivir.vdf ...

AntiVir is running in DEMO mode.

VDF version: 6.20.0.46 created 23 Jul 2003

virus.exe
 Date: 23.07.2003  Time: 19:56:44  Size: 70
 ALERT: [Eicar-Test-Signatur virus] virus.exe <<< Contains code of the Eicar-Test-Signatur virus


----- scan results -----
 directories:        0
       files:        1
      alerts:        1
    repaired:        0
     deleted:        0
     renamed:        0
   scan time: 00:00:01
------------------------
Thank you for using AntiVir.
-----------------------------------------------------------

As you can see, antivir correctly detects the virus "virus.exe".

If I attach this very file to a message and send it over Postfix+MS,
it passes through.

MailScanner.conf contains this:

Virus Scanners = antivir

If I put clamav there everything works fine. But why does AntiVir not
work? Because of the "DEMO" mode?

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From santialf at DNS.UCNET.COM.MX  Wed Jul 23 19:11:12 2003
From: santialf at DNS.UCNET.COM.MX (Alfredo Santillan Ramos)
Date: Thu Jan 12 21:19:03 2006
Subject: init script for Solaris
Message-ID: <Pine.GSO.4.33.0307231254590.16795-100000@dns.ucnet.com.mx>

Hello,

Does anyone have an init script for MailScanner and sendmail 8.12.x for
Solaris 8 that would mind to share?.

I have looked up into the init script for red hat from the mailscanner
site and this is the manual way we start-up the duo:

# /opt/MailScanner/bin/check_mailscanner
# /usr/local/sbin/sendmail -L sm-mta -bd -OPrivacyOptions=noetrn
-ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in
-OPidFile=/var/run/sendmail.in.pid

# /usr/local/sbin/sendmail -L sm-msp-queue -Ac -q15m

# /usr/local/sbin/sendmail -L sm-mta -q15m
-OPidFile=/var/run/sendmail.out.pid

I appreciate your comments.

Regards,


J. Alfredo S.

From m.sapsed at BANGOR.AC.UK  Wed Jul 23 19:16:32 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:19:03 2006
Subject: Mailscanner corrupting pdf files
References: <EA943CD30BCB104E9D38F5B5DC2D9A70236735@rsys004a.roke.co.uk>
Message-ID: <3F1ED100.5040607@bangor.ac.uk>

Plant, Dean wrote:
> I am having a problem with pdf files corrupting when passing through the
> Mailscanner. If a mail with a pdf attachment is sent from one of our
> clients, MS exchange encodes the message as either base64 or
> quoted-printable format. All messages that are encoded as base64 pass
> through the MailScanner correctly. Quoted-printable format mails have the
> attachment corrupted. Turning off virus checks on Mailscanner allows the
> quoted-printable mails to pass through without corruption, so I assume it
> has something to do with:
>
> 1. Perl Mime::tools - Is this decoding / encoding the attachment correctly?
> 2. MS Exchange - Why encode some pdf's as base64 and some as
> quoted-printable
> 3. Different versions/creators of pdf files.
>
> Has anyone else suffered from this problem or does anyone have a suggestion
> as a fix.

I would say that PDF's ought to be encoded base64 everytime. I also
wouldn't have thought that a PDF could survive being sent as
Quoted-printable?

After a quick search on Google RFC 1521 states "The Quoted-Printable
encoding is intended to represent data that largely consists of octets
that correspond to printable characters in the ASCII character set." and
by my reckoning your average PDF file doesn't fit that description!

I also didn't think that MailScanner altered content of messages unless
it was told to because of some condition being met (striphtml or
something like that). The virus scanner should just be presented with a
copy of the attachment and asked if it's ok or not. I don't think that
the attachment is removed and then reattached in some way.

When you say you can turn scanning off and the quoted-printable PDFs go
through ok, is this (at least one of) the same q-p PDFs which gets
corrupted?

Not much help really am I?? ;-)

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From ka at PACIFIC.NET  Wed Jul 23 19:17:47 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:03 2006
Subject: Permission on the quarantine directories
In-Reply-To: <LISTSERV%2003072318595587@JISCMAIL.AC.UK>
References: <LISTSERV%2003072318595587@JISCMAIL.AC.UK>
Message-ID: <3F1ED14B.7050201@pacific.net>

A good job for sudo.
Just put a line in /etc/sudoers file:
user ALL = NOPASSWD: /usr/local/bin/letgo.pl
Then a user named 'user' can run the command letgo.pl as root.
letgo.pl just puts the qf* and df* files back into the outgoing queue.
This also allows you to webify the thing and have apache (using suexec
to be safer) handle the operation from this machine (or another machine
over ssh).

You can also specify a group name for sudo - see "man sudoers"

Ken A.


Magda Hewryk wrote:

> Hi,
>
> I'm trying to work on permissions in the quarantine directory.
>
> The idea is that Operations can log on to mail gateway and retrieve the
> requested attachments if needed.
>
> However, by default the permissions on directories in quarantine directory
> are set as 700.
>
> How can I manipulate with permissions to set the default to 770 root:smmsp
> the moment they are created? I can then through Ops people to the smmsp
> group and this way not only root would have the ability to retrieve
> attachments.
>
> Any help?  Can this be accomplished?
>
> Regards,
> Magda
>
> drwx------   17 root     root         4096 Jul 23 13:38 20030723:
>
>
> drwx------    2 root     root         4096 Jul 23 06:39 h6NAd0o4013812
> drwx------    2 root     root         4096 Jul 23 07:28 h6NBSto4018142
> drwx------    2 root     root         4096 Jul 23 08:50 h6NCopo4026618
> drwx------    2 root     root         4096 Jul 23 08:53 h6NCrko4027160
> drwx------    2 root     root         4096 Jul 23 09:30 h6NDUeo4030994
> drwx------    2 root     root         4096 Jul 23 09:45 h6NDixo4032760
> drwx------    2 root     root         4096 Jul 23 10:05 h6NE5so4002634
> drwx------    2 root     root         4096 Jul 23 10:34 h6NEWMo4005780
> drwx------    2 root     root         4096 Jul 23 11:04 h6NF4Xo4009478
> drwx------    2 root     root         4096 Jul 23 11:10 h6NFAko4010119
> drwx------    2 root     root         4096 Jul 23 11:37 h6NFbYo4013516
> drwx------    2 root     root         4096 Jul 23 13:38 h6NHclo4026919
>
>

From ctrudeau at BELLSOUTH.NET  Wed Jul 23 19:28:15 2003
From: ctrudeau at BELLSOUTH.NET (Chris-Bellsouth)
Date: Thu Jan 12 21:19:03 2006
Subject: Permission on the quarantine directories
References: <LISTSERV%2003072318595587@JISCMAIL.AC.UK> 
            <3F1ED14B.7050201@pacific.net>
Message-ID: <020401c35148$2f015ee0$5702010a@mscore.trusecure.net>

> A good job for sudo.
> Just put a line in /etc/sudoers file:
> user ALL = NOPASSWD: /usr/local/bin/letgo.pl
> Then a user named 'user' can run the command letgo.pl as root.
> letgo.pl just puts the qf* and df* files back into the outgoing queue.
> This also allows you to webify the thing and have apache (using suexec
> to be safer) handle the operation from this machine (or another machine
> over ssh).

This is good stuff...now where can one find this storied "letgo.pl"  Or
would one have to write it themselves?

CT

From dgeorgiades at POWERENG.COM  Wed Jul 23 19:58:50 2003
From: dgeorgiades at POWERENG.COM (Derrick Georgiades)
Date: Thu Jan 12 21:19:03 2006
Subject: init script for Solaris
Message-ID: <E0747DCCDD2AD411B865009027347CD203067462@boisemx.powereng.com>

These work on Solaris 9, should work fine for 8.

Derrick Georgiades

-----Original Message-----
From: Alfredo Santillan Ramos [mailto:santialf@DNS.UCNET.COM.MX]
Sent: Wednesday, July 23, 2003 12:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: init script for Solaris


Hello,

Does anyone have an init script for MailScanner and sendmail 8.12.x for
Solaris 8 that would mind to share?.

I have looked up into the init script for red hat from the mailscanner
site and this is the manual way we start-up the duo:

# /opt/MailScanner/bin/check_mailscanner
# /usr/local/sbin/sendmail -L sm-mta -bd -OPrivacyOptions=noetrn
-ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in
-OPidFile=/var/run/sendmail.in.pid

# /usr/local/sbin/sendmail -L sm-msp-queue -Ac -q15m

# /usr/local/sbin/sendmail -L sm-mta -q15m
-OPidFile=/var/run/sendmail.out.pid

I appreciate your comments.

Regards,


J. Alfredo S.

-------------- next part --------------
#!/sbin/sh
#
#
process=MailScanner
virusdir="/opt/MailScanner/bin"
config="/opt/MailScanner/etc/MailScanner.conf"
SERVER_PID_FILE="/queue/MailScanner/var/MailScanner.pid"
PID_CHECK=`/usr/bin/ps -e -o pid -o args |
     /usr/bin/fgrep $virusdir/$process |
     /usr/bin/grep -v grep |
     /usr/bin/sed -e 's/^  *//' -e 's/ .*//'`
case "$1" in
'restart')
        $0 stop
        $0 start
        ;;
'start')
        if [ "$PID_CHECK" = "" ]; then
        PATH=${virusdir}:$PATH
        echo Starting virus scanner...
        $process $config
        else
        echo Running with pid $PID_CHECK
        fi
        ;;
'stop')
        [ -f $SERVER_PID_FILE ] && kill `head -1 $SERVER_PID_FILE`
        /usr/bin/pkill -x MailScanner
        ;;
*)
        echo "Usage: $0 { start | stop | restart }"
        exit 1
        ;;
esac
exit 0
-------------- next part --------------
#!/sbin/sh
#
# Copyright (c) 1992 - 2001 by Sun Microsystems, Inc.
# All rights reserved.
#
#ident  "@(#)sendmail   1.19    01/12/05 SMI"

ERRMSG1='WARNING: /var/mail is NFS-mounted without setting actimeo=0,'
ERRMSG2='this can cause mailbox locking and access problems.'
SERVER_PID_FILE="/var/run/sendmail.pid"
CLIENT_PID_FILE="/queue/sendmailqueue.pid"
DEFAULT_FILE="/etc/default/sendmail"
ALIASES_FILE="/etc/mail/aliases"

check_queue_interval_syntax()
{
        default="15m"
        if [ $# -lt 1 ]; then
                answer=$default
                return
        fi
        if echo $1 | egrep '^([0-9]*[1-9][0-9]*[smhdw])+$' >/dev/null 2>&1; then
                answer=$1
        else
                answer=$default
        fi
}

case "$1" in
'start')
        if [ -f /usr/lib/sendmail -a -f /etc/mail/sendmail.cf ]; then
                if [ ! -d /queue/mqueue ]; then
                        /usr/bin/mkdir -m 0750 /queue/mqueue
                        /usr/bin/chown root:bin /queue/mqueue
                fi
                if [ ! -f $ALIASES_FILE.db ] && [ ! -f $ALIASES_FILE.dir ] \
                    && [ ! -f $ALIASES_FILE.pag ]; then
                        /usr/sbin/newaliases
                fi
                MODE="-bd"
                OPTIONS="-ODeliveryMode=queueonly -OQueueDirectory=/queue/mqueue
.in"
                [ -f $DEFAULT_FILE ] && . $DEFAULT_FILE
                #
                # * MODE should be "-bd" or null (MODE= or MODE="") or
                #   left alone.  Anything else and you're on your own.
                # * QUEUEOPTION should be "p" or null (as above).
                # * [CLIENT]QUEUEINTERVAL should be set to some legal value;
                #   sanity checks are done below.
                # * [CLIENT]OPTIONS are catch-alls; set with care.
                #
                if [ -n "$QUEUEOPTION" -a "$QUEUEOPTION" != "p" ]; then
                        QUEUEOPTION=""
                fi
                if [ -z "$QUEUEOPTION" -o -n "$QUEUEINTERVAL" ]; then
                        check_queue_interval_syntax $QUEUEINTERVAL
                        QUEUEINTERVAL=$answer
                fi
                check_queue_interval_syntax $CLIENTQUEUEINTERVAL
                CLIENTQUEUEINTERVAL=$answer
                /usr/lib/sendmail $MODE $OPTIONS &
                /usr/lib/sendmail -q$QUEUEINTERVAL $CLIENTOPTIONS -OPidFile=$CLI
ENT_PID_FILE &
                #
                # ETRN_HOSTS should be of the form
                # "s1:c1.1,c1.2        s2:c2.1 s3:c3.1,c3.2,c3.3"
                # i.e., white-space separated groups of server:client where
                # client can be one or more comma-separated names; N.B. that
                # the :client part is optional; see etrn(1M) for details.
                # server is the name of the server to prod; a mail queue run
                # is requested for each client name.  This is comparable to
                # running "/usr/lib/sendmail -qRclient" on the host server.
                #
                # See RFC 1985 for more information.
                #
                for i in $ETRN_HOSTS; do
                        SERVER=`echo $i | /usr/bin/sed -e 's/:.*$//'`
                        CLIENTS=`echo $i | /usr/bin/sed -n -e 's/,/ /g' \
                            -e '/:/s/^.*://p'`
                        /usr/sbin/etrn $SERVER $CLIENTS >/dev/null 2>&1 &
                done
        fi

        if /usr/bin/nawk 'BEGIN{s = 1}
            $2 == "/var/mail" && $3 == "nfs" && $4 !~ /actimeo=0/ &&
            $4 !~ /noac/{s = 0} END{exit s}' /etc/mnttab; then

                /usr/bin/logger -p mail.crit "$ERRMSG1"
                /usr/bin/logger -p mail.crit "$ERRMSG2"
        fi
        ;;

'stop')
        [ -f $SERVER_PID_FILE ] && kill `head -1 $SERVER_PID_FILE`
        if [ -f $CLIENT_PID_FILE ]; then
                kill `head -1 $CLIENT_PID_FILE`
                rm -f $CLIENT_PID_FILE
        fi
        /usr/bin/pkill -x -u 0 sendmail
        ;;

*)
        echo "Usage: $0 { start | stop }"
        exit 1
        ;;
esac
exit 0
From ka at PACIFIC.NET  Wed Jul 23 21:31:05 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:03 2006
Subject: Permission on the quarantine directories
In-Reply-To: <020401c35148$2f015ee0$5702010a@mscore.trusecure.net>
References: <LISTSERV%2003072318595587@JISCMAIL.AC.UK>            
            <3F1ED14B.7050201@pacific.net>
            <020401c35148$2f015ee0$5702010a@mscore.trusecure.net>
Message-ID: <3F1EF089.9090108@pacific.net>

Chris-Bellsouth wrote:
>>A good job for sudo.
>>Just put a line in /etc/sudoers file:
>>user ALL = NOPASSWD: /usr/local/bin/letgo.pl
>>Then a user named 'user' can run the command letgo.pl as root.
>>letgo.pl just puts the qf* and df* files back into the outgoing queue.
>>This also allows you to webify the thing and have apache (using suexec
>>to be safer) handle the operation from this machine (or another machine
>>over ssh).
>
>
> This is good stuff...now where can one find this storied "letgo.pl"  Or
> would one have to write it themselves?
>
> CT
>
>


Nothing fancy...

------------- snip ----------

#!/usr/bin/perl
#
# the fullpath can be obtained
# from the email sent to the customer
# based on reports/en/stored.filename.message.txt
# using $quarantinedir/$datenumber/$id
#

die "Usage: $0 [full path to msgid directory]\n" if ($#ARGV < 0);
$fullpath = $ARGV[0];
if($fullpath !~
/^\/var\/spool\/MailScanner\/quarantine\/\d\d\d\d\d\d\d\d\/[a-zA-Z0-9]+$/){
        print "Bad Input";
}
else{   # path looks okay
  $res = system("cp $fullpath/qf* $fullpath/df* /var/spool/mqueue/");
  if($res != 0) { print "No such message found"; }
  else { print "$fullpath has been released from quarantine"; }
}

------- snip ---------

(note email client wraps long lines)
Ken

From raymond at PROLOCATION.NET  Wed Jul 23 22:27:04 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:03 2006
Subject: MS with AntiVir
In-Reply-To: <170102410.20030723200049@guest.arnes.si>
Message-ID: <Pine.LNX.4.44.0307232326290.457-100000@mailbox.prolocation.net>

Hi!

> VDF version: 6.20.0.46 created 23 Jul 2003
>
> virus.exe
>  Date: 23.07.2003  Time: 19:56:44  Size: 70
>  ALERT: [Eicar-Test-Signatur virus] virus.exe <<< Contains code of the
> Eicar-Test-Signatur virus

> work? Because of the "DEMO" mode?

Most likely the output changed ?

Bye,
Raymond.

From sanjay.patel at REXWIRE.COM  Thu Jul 24 00:48:42 2003
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:19:03 2006
Subject: More spam after spamassain upgrade
Message-ID: <003901c35174$f645c690$6f01a8c0@Laptop1>

We are seeing more spam getting through after upgrading spam assassin to the
latest version. Even the buy Norton cheap spam is getting through. All the
spam scores below our threshold of 5.

Have the spammers got smarter or do we need to fine tune something?

SKP

From m.sapsed at BANGOR.AC.UK  Thu Jul 24 12:22:46 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:19:03 2006
Subject: More spam after spamassain upgrade
References: <003901c35174$f645c690$6f01a8c0@Laptop1>
Message-ID: <3F1FC186.7060302@bangor.ac.uk>

Sanjay K. Patel wrote:
> We are seeing more spam getting through after upgrading spam assassin to the
> latest version. Even the buy Norton cheap spam is getting through. All the
> spam scores below our threshold of 5.
>
> Have the spammers got smarter or do we need to fine tune something?

Can you post the headers for e.g. a "buy Norton cheap" message which got
through - the categories SA lists might help us to advise you. Which
version do you mean by "the latest version"? What platform? What version
of MailScanner etc etc

I'm using a copy of 2.60 from a little while ago along with DCC (with
it's score raised) and virtually nothing gets passed that.

Cheers

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From nejc.skoberne at guest.arnes.si  Thu Jul 24 12:41:41 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:19:03 2006
Subject: MS with AntiVir
In-Reply-To: <Pine.LNX.4.44.0307232326290.457-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307232326290.457-100000@mailbox.prolocation.net>
Message-ID: <1435484784.20030724134141@guest.arnes.si>

Hi.

>> work? Because of the "DEMO" mode?

> Most likely the output changed ?

Can I fix it by myself? I checked antivir-wrapper but this is not the
right place to fix this, right?

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From Antony at SOFT-SOLUTIONS.CO.UK  Thu Jul 24 13:12:32 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:03 2006
Subject: MS with AntiVir
In-Reply-To: <1435484784.20030724134141@guest.arnes.si>
References: <Pine.LNX.4.44.0307232326290.457-100000@mailbox.prolocation.net>
            <1435484784.20030724134141@guest.arnes.si>
Message-ID: <200307241213.h6OCD5905076@agate.rockstone.co.uk>

On Thursday 24 July 2003 12:41 pm, Nejc Skoberne wrote:

> Hi.
>
> >> work? Because of the "DEMO" mode?
> >
> > Most likely the output changed ?
>
> Can I fix it by myself? I checked antivir-wrapper but this is not the
> right place to fix this, right?

Why not get yourself a private non-commercial licence - it's free, and of
course you're not using a demo product for commercial purposes anyway, are
you :) ?

Antony.

--

This is not a rehearsal.
This is Real Life.

From nejc.skoberne at guest.arnes.si  Thu Jul 24 13:20:11 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:19:03 2006
Subject: MS with AntiVir
In-Reply-To: <200307241213.h6OCD5905076@agate.rockstone.co.uk>
References: <Pine.LNX.4.44.0307232326290.457-100000@mailbox.prolocation.net>
            <1435484784.20030724134141@guest.arnes.si>
            <200307241213.h6OCD5905076@agate.rockstone.co.uk>
Message-ID: <866364121.20030724142011@guest.arnes.si>

Hi.

> Why not get yourself a private non-commercial licence - it's free, and of
> course you're not using a demo product for commercial purposes anyway, are
> you :) ?

We bought licences some time ago. I was quite satisfied with avgated
daemon, but Postfix+MS is better. So we plan to change antivirus
software vendor. In the meanwhile, I would like to use the DEMO version
(although we actually bought the licence for scanning 25 mailboxes -
so noone can sue me - I am just scanning my mailboxes with software I
bought - I don't really care if it says "DEMO" when I am running it,
since I don't do system scans with antivir).

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From Antony at SOFT-SOLUTIONS.CO.UK  Thu Jul 24 13:28:57 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:03 2006
Subject: MS with AntiVir
In-Reply-To: <866364121.20030724142011@guest.arnes.si>
References: <Pine.LNX.4.44.0307232326290.457-100000@mailbox.prolocation.net>
            <200307241213.h6OCD5905076@agate.rockstone.co.uk>
            <866364121.20030724142011@guest.arnes.si>
Message-ID: <200307241229.h6OCTV905085@agate.rockstone.co.uk>

On Thursday 24 July 2003 1:20 pm, Nejc Skoberne wrote:

> Hi.
>
> > Why not get yourself a private non-commercial licence - it's free, and of
> > course you're not using a demo product for commercial purposes anyway,
> > are you :) ?
>
> We bought licences some time ago. I was quite satisfied with avgated
> daemon, but Postfix+MS is better. So we plan to change antivirus
> software vendor. In the meanwhile, I would like to use the DEMO version
> (although we actually bought the licence for scanning 25 mailboxes -
> so noone can sue me - I am just scanning my mailboxes with software I
> bought - I don't really care if it says "DEMO" when I am running it,
> since I don't do system scans with antivir).

But if MS does mind that it says "DEMO" then I would think the easiest
solution to the problem is to put one of your licences onto the machine
you're testing with, and then MS won't complain any more.

Regards,

Antony.

--

90% of network problems are routing problems.
9 of the remaining 10% are routing problems in the other direction.
The remaining 1% might be something else, but check the routing anyway.

From maxsec at TOTALISE.CO.UK  Thu Jul 24 13:32:19 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:03 2006
Subject: sql logging problem
Message-ID: <3F1FD1D3.5010009@totalise.co.uk>

Hi all

well back on task getting MS going and helping Steve with the mailwatch
frontend.

Got everything going on a FreeBSD 4.8 box, but when I enable the
SQLlogging feature I get the following error in the maillog:

Jul 24 13:17:46 soloman MailScanner[61873]: Cannot insert row: MySQL
server has gone away


mail gets delivered etc, but I obviously get no logs..

any pointers as to where to look?

--
Martin

From nejc.skoberne at guest.arnes.si  Thu Jul 24 13:38:50 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:19:03 2006
Subject: MS with AntiVir
In-Reply-To: <200307241229.h6OCTV905085@agate.rockstone.co.uk>
References: <Pine.LNX.4.44.0307232326290.457-100000@mailbox.prolocation.net>
            <200307241213.h6OCD5905076@agate.rockstone.co.uk>
            <866364121.20030724142011@guest.arnes.si>
            <200307241229.h6OCTV905085@agate.rockstone.co.uk>
Message-ID: <45221420.20030724143850@guest.arnes.si>

Hi.

> But if MS does mind that it says "DEMO" then I would think the easiest
> solution to the problem is to put one of your licences onto the machine
> you're testing with, and then MS won't complain any more.

MS doesn't say anything. "Antivir" says "DEMO". MS works like
everything is fine (but viruses are not blocked).

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From mikea at MIKEA.ATH.CX  Thu Jul 24 13:40:35 2003
From: mikea at MIKEA.ATH.CX (mikea)
Date: Thu Jan 12 21:19:03 2006
Subject: sql logging problem
In-Reply-To: <3F1FD1D3.5010009@totalise.co.uk>; from maxsec@TOTALISE.CO.UK on
              Thu, Jul 24, 2003 at 01:32:19PM +0100
References: <3F1FD1D3.5010009@totalise.co.uk>
Message-ID: <20030724074035.B25528@mikea.ath.cx>

On Thu, Jul 24, 2003 at 01:32:19PM +0100, Martin Hepworth wrote:
> Hi all
>
> well back on task getting MS going and helping Steve with the mailwatch
> frontend.
>
> Got everything going on a FreeBSD 4.8 box, but when I enable the
> SQLlogging feature I get the following error in the maillog:
>
> Jul 24 13:17:46 soloman MailScanner[61873]: Cannot insert row: MySQL
> server has gone away
>
>
> mail gets delivered etc, but I obviously get no logs..
>
> any pointers as to where to look?

It's hard to say much about this without knowing your setup. Have a
look at your config to see where it thinks the SQL server should be,
and see if there's something running there that is listening for
SQL queries. On my test MySQL box here at work, the server listens
on TCP port 3306, but you or your database troops may have changed
that on your server.

--
Mike Andrews
mikea@mikea.ath.cx
Tired old sysadmin since 1964

From maxsec at TOTALISE.CO.UK  Thu Jul 24 13:50:48 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:03 2006
Subject: sql logging problem
In-Reply-To: <20030724074035.B25528@mikea.ath.cx>
References: <3F1FD1D3.5010009@totalise.co.uk>
            <20030724074035.B25528@mikea.ath.cx>
Message-ID: <3F1FD628.4050509@totalise.co.uk>

mikea wrote:

> On Thu, Jul 24, 2003 at 01:32:19PM +0100, Martin Hepworth wrote:
>
>>Hi all
>>
>>well back on task getting MS going and helping Steve with the mailwatch
>>frontend.
>>
>>Got everything going on a FreeBSD 4.8 box, but when I enable the
>>SQLlogging feature I get the following error in the maillog:
>>
>>Jul 24 13:17:46 soloman MailScanner[61873]: Cannot insert row: MySQL
>>server has gone away
>>
>>
>>mail gets delivered etc, but I obviously get no logs..
>>
>>any pointers as to where to look?
>
>
> It's hard to say much about this without knowing your setup. Have a
> look at your config to see where it thinks the SQL server should be,
> and see if there's something running there that is listening for
> SQL queries. On my test MySQL box here at work, the server listens
> on TCP port 3306, but you or your database troops may have changed
> that on your server.
>
Mike

it connects OK (had errors when the passwd was wrong for example), but
when it its trying to insert to row it barfs out..

--
martin

From s.kelly at ayrcoll.ac.uk  Thu Jul 24 14:24:32 2003
From: s.kelly at ayrcoll.ac.uk (Shane Kelly)
Date: Thu Jan 12 21:19:03 2006
Subject: sql logging problem
In-Reply-To: <3F1FD1D3.5010009@totalise.co.uk>
References: <3F1FD1D3.5010009@totalise.co.uk>
Message-ID: <200307241424.33042.s.kelly@ayrcoll.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi

On Thursday 24 July 2003 1:32 pm, Martin Hepworth wrote:
> Hi all
>
> well back on task getting MS going and helping Steve with the mailwatch
> frontend.
>
> Got everything going on a FreeBSD 4.8 box, but when I enable the
> SQLlogging feature I get the following error in the maillog:
>
> Jul 24 13:17:46 soloman MailScanner[61873]: Cannot insert row: MySQL
> server has gone away
>
>
> mail gets delivered etc, but I obviously get no logs..
>
> any pointers as to where to look?
>
> --
> Martin


Just a thought ...
        Does the connecting user have the update/write priviledge on the 
database/table?


Regards,
        Shane.
- -- 
Shane Kelly
Network Infrastructure Manager
01292 293577 (Direct line)

WindowError:010 Reserved for future mistakes
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)

iD8DBQE/H94Q/thVM7mR0ZYRAmMjAJ4+4CRnHJq9WalJKNUmUehX7lfUNwCdGltd
kIbXBpQhPKTagfHcBxjDYAs=
=vUQw
-----END PGP SIGNATURE-----


From maxsec at TOTALISE.CO.UK  Thu Jul 24 14:57:36 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:03 2006
Subject: sql logging problem
In-Reply-To: <3F1FD1D3.5010009@totalise.co.uk>
References: <3F1FD1D3.5010009@totalise.co.uk>
Message-ID: <3F1FE5D0.5060601@totalise.co.uk>

Hmm the plot thickens....

If use the values as qiven, there are 'empty' or null values being put
in the string. When I use this syntax on a manual insert mysql complains
about syntax error. However if I fill in these values to be the default
then it's fine and the insert happens...
eg

  insert into maillog values ( '2003-07-24 14:40:57', 'h6ODerXL062460',
1066, 'martinh@soloman.solid-state-logic.com',
'martinh@solid-state-logic.com', 'test9', '127.0.0.1', , 0, 0, , , 0, 0,
, 0, 0, 0, , 'soloman.solid-state-logic.com');

doesn't work..

insert into maillog values ( '2003-07-24 14:40:57', 'h6ODerXL062460',
1066, 'martinh@soloman.solid-state-logic.com',
'martinh@solid-state-logic.com', 'test9', '127.0.0.1',0 , 0, 0,0 ,0 , 0,
0,0 , 0, 0, 0,0 , 'soloman.solid-state-logic.com');


does work..


mysql is version 4.0.13

time to hit the manuals..


--
Martin

From steve.douglas at SBIINCORPORATED.COM  Thu Jul 24 15:52:53 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:19:03 2006
Subject: Whitelisted
Message-ID: <3963522F0E71474CB14C0FF54A6914F70142FA69@mail.gardenbotanika.com>

I am even more confused.  As my eyes glaze over.



-----Original Message-----
From: Stephen Swaney [mailto:Steve@swaney.com]
Sent: Tuesday, July 22, 2003 3:38 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Whitelisted



Actually I placed Ken A, Pacific.Net's excellent solution for this in the
MailScanner FAQ.


http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html
<http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html>

How easy can it get.

Steve
Steve Swaney
steve@swaney.com
 <http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html>
On Tue, 2003-07-22 at 16:19, Derek Winkler wrote:

See earlier thread on splitting messages with multiple recipients into
messages with one recipient each as a workaround.

-----Original Message-----
From: Matt Kettler [ <mailto:mkettler@EVI-INC.COM>
mailto:mkettler@EVI-INC.COM]
Sent: Tuesday, July 22, 2003 4:16 PM
To: MAILSCANNER@jiscmail.ac.uk
Subject: Re: Whitelisted


At 12:00 PM 7/22/2003 -0600, Dustin Baer wrote:
> > Dustin,
> > Maybe that is where my misunderstanding is.  I thought, that would turn
off
> > spam filtering for that user only.  Does that say anything addressed to
> that
> > user and anyone else, will go through?
>
>Hi Kris,
>
>As far as I understand MailScanner's whitelisting, if one recipient is
>in the whitelist, all recipients receive the message.  I have run into
>your situation also, and refuse to whitelist recipient names here, if I
>see that they receive a high volume of spam.  I don't want other people
>getting spam, just because they want their name whitelisted.
>
>I am sure someone will correct me, if I have mis-stated how MailScanner
>operates its whitelist.

That is correct. And this "problem" is a fundamental limit of running at
the MTA layer. It's not a bug, or a mistake, it's a design tradeoff between
flexibility and efficiency.

Mailscanner runs at the MTA layer, not the MDA layer, so there is not one
copy of the message per user when MS sees it.. there's just one message
with many recipients. Thus MailScanner can only whitelist that one message,
or not whitelist it. There is no such thing as "well, later when you go to
deliver this, give these guys this copy, and that guy this other version".
It's one message, and they'll all get the same message, all MailScanner can
do is edit it.

Running at the MTA layer is much more efficient, because you only scan the
message once, but it inherently has limits on "per user" customization. The
MTA layer is the ideal spot to do virus scanning, because you rarely want
user-specific behaviors for virus scanning. However doing spam scanning at
the MTA layer is somewhat limiting if you've got users that need
"exceptions".

Personally I deal with it by creating custom SpamAssassin rules instead of
whitelists. This gives me the ability to target specific kinds of messages,
rather than specific sources or destinations. If I have to do a whitelist,
I try to make it a "fromto" type whitelist where it winds up narrowly
defined. I  never use To: type whitelists, and I avoid simple From:
whitelists as well.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030724/c90c01fb/attachment.html
From richard_cipher at YAHOO.COM  Thu Jul 24 16:01:57 2003
From: richard_cipher at YAHOO.COM (Evert Ford)
Date: Thu Jan 12 21:19:03 2006
Subject: sql logging problem
In-Reply-To: <3F1FE5D0.5060601@totalise.co.uk>
Message-ID: <NHBBIDLEJBNNEMOPKJPNGENEDBAA.richard_cipher@yahoo.com>

I use the same version of MySQL you do and have worked with it quite a bit.

What always works for me when I have  a null value is NULL(and this is what
the manual recommends, btw).

to modify your insert with this:

insert into maillog values ( '2003-07-24 14:40:57', 'h6ODerXL062460',
1066, 'martinh@soloman.solid-state-logic.com',
'martinh@solid-state-logic.com', 'test9', '127.0.0.1', NULL, 0, 0, NULL,
NULL, 0, 0,
NULL, 0, 0, 0, NULL, 'soloman.solid-state-logic.com');

In MySQL NULL is not equal to either the empty string ("") or 0. and logic
testing proves this.

I hope this helps,

Evert Ford
Information Analyst
Westone Laboratories
http://www.westone.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Martin Hepworth
Sent: Thursday, July 24, 2003 7:58 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: sql logging problem


Hmm the plot thickens....

If use the values as qiven, there are 'empty' or null values being put
in the string. When I use this syntax on a manual insert mysql complains
about syntax error. However if I fill in these values to be the default
then it's fine and the insert happens...
eg

  insert into maillog values ( '2003-07-24 14:40:57', 'h6ODerXL062460',
1066, 'martinh@soloman.solid-state-logic.com',
'martinh@solid-state-logic.com', 'test9', '127.0.0.1', , 0, 0, , , 0, 0,
, 0, 0, 0, , 'soloman.solid-state-logic.com');

doesn't work..

insert into maillog values ( '2003-07-24 14:40:57', 'h6ODerXL062460',
1066, 'martinh@soloman.solid-state-logic.com',
'martinh@solid-state-logic.com', 'test9', '127.0.0.1',0 , 0, 0,0 ,0 , 0,
0,0 , 0, 0, 0,0 , 'soloman.solid-state-logic.com');


does work..


mysql is version 4.0.13

time to hit the manuals..


--
Martin
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From ka at PACIFIC.NET  Thu Jul 24 16:25:25 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:03 2006
Subject: Whitelisted
In-Reply-To: <3963522F0E71474CB14C0FF54A6914F70142FA69@mail.gardenbotanika.com>
References: <3963522F0E71474CB14C0FF54A6914F70142FA69@mail.gardenbotanika.com>
Message-ID: <3F1FFA65.7030807@pacific.net>

Okay, mail travels in envelopes with a TO and a FROM, just like postal
mail, right?

Mail is opened by the mailserver and delivered to the TO on the envelope
and to the other TO,CC,BCC recipients. The problem is that this delivery
process doesn't happen until the server writes it to the users mail
spool. This doesn't happen until _after_ MailScanner/SA have looked at
the message.

The result is that a whitelist will affect ALL recipients of a message
that has multiple recipients if the first envelope TO address matches
the whitelist. 95% of the mail we see to multiple recipients is spam. :-(

The only way around this using MailScanner is to use sendmail to split
the message when it first arrives into multiple messages with only 1
recipient each.

MailScanner/SA will then see each recipient's copy of the message
separately, so whitelists will be applied as they were intended. The FAQ
entry explains how to do this (though the linebreaks were lost in the
html faq, so it's a bit hard to read). Basically, you just run the
incoming sendmail process with a very slightly modified config file, and
sendmail takes care of splitting the incoming mail into single recipient
messages. Note that this increases the load on your system too, since
each message with x recipients will be split into x messages that
MailScanner processes separately.

FAQ entry:
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html

Ken A.
Pacific.Net




Steve Douglas wrote:

> I am even more confused.  As my eyes glaze over.
>
>
>
> -----Original Message-----
> From: Stephen Swaney [mailto:Steve@swaney.com]
> Sent: Tuesday, July 22, 2003 3:38 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Whitelisted
>
>
>
> Actually I placed Ken A, Pacific.Net's excellent solution for this in the
> MailScanner FAQ.
>
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html
> <http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html>
>
> How easy can it get.
>
> Steve
> Steve Swaney
> steve@swaney.com
>  <http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html>
> On Tue, 2003-07-22 at 16:19, Derek Winkler wrote:
>
> See earlier thread on splitting messages with multiple recipients into
> messages with one recipient each as a workaround.
>
> -----Original Message-----
> From: Matt Kettler [ <mailto:mkettler@EVI-INC.COM>
> mailto:mkettler@EVI-INC.COM]
> Sent: Tuesday, July 22, 2003 4:16 PM
> To: MAILSCANNER@jiscmail.ac.uk
> Subject: Re: Whitelisted
>
>
> At 12:00 PM 7/22/2003 -0600, Dustin Baer wrote:
>
>>>Dustin,
>>>Maybe that is where my misunderstanding is.  I thought, that would turn
>
> off
>
>>>spam filtering for that user only.  Does that say anything addressed to
>>
>>that
>>
>>>user and anyone else, will go through?
>>
>>Hi Kris,
>>
>>As far as I understand MailScanner's whitelisting, if one recipient is
>>in the whitelist, all recipients receive the message.  I have run into
>>your situation also, and refuse to whitelist recipient names here, if I
>>see that they receive a high volume of spam.  I don't want other people
>>getting spam, just because they want their name whitelisted.
>>
>>I am sure someone will correct me, if I have mis-stated how MailScanner
>>operates its whitelist.
>
>
> That is correct. And this "problem" is a fundamental limit of running at
> the MTA layer. It's not a bug, or a mistake, it's a design tradeoff between
> flexibility and efficiency.
>
> Mailscanner runs at the MTA layer, not the MDA layer, so there is not one
> copy of the message per user when MS sees it.. there's just one message
> with many recipients. Thus MailScanner can only whitelist that one message,
> or not whitelist it. There is no such thing as "well, later when you go to
> deliver this, give these guys this copy, and that guy this other version".
> It's one message, and they'll all get the same message, all MailScanner can
> do is edit it.
>
> Running at the MTA layer is much more efficient, because you only scan the
> message once, but it inherently has limits on "per user" customization. The
> MTA layer is the ideal spot to do virus scanning, because you rarely want
> user-specific behaviors for virus scanning. However doing spam scanning at
> the MTA layer is somewhat limiting if you've got users that need
> "exceptions".
>
> Personally I deal with it by creating custom SpamAssassin rules instead of
> whitelists. This gives me the ability to target specific kinds of messages,
> rather than specific sources or destinations. If I have to do a whitelist,
> I try to make it a "fromto" type whitelist where it winds up narrowly
> defined. I  never use To: type whitelists, and I avoid simple From:
> whitelists as well.
>
>

From maxsec at TOTALISE.CO.UK  Thu Jul 24 16:24:19 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:03 2006
Subject: sql logging problem
In-Reply-To: <NHBBIDLEJBNNEMOPKJPNGENEDBAA.richard_cipher@yahoo.com>
References: <NHBBIDLEJBNNEMOPKJPNGENEDBAA.richard_cipher@yahoo.com>
Message-ID: <3F1FFA23.5010709@totalise.co.uk>

Evert

Still means I have to have the SQLlogging code to test say, insert this
value or NULL.

any perl dudes out there with some help?


--
Martin



Evert Ford wrote:
> I use the same version of MySQL you do and have worked with it quite a bit.
>
> What always works for me when I have  a null value is NULL(and this is what
> the manual recommends, btw).
>
> to modify your insert with this:
>
> insert into maillog values ( '2003-07-24 14:40:57', 'h6ODerXL062460',
> 1066, 'martinh@soloman.solid-state-logic.com',
> 'martinh@solid-state-logic.com', 'test9', '127.0.0.1', NULL, 0, 0, NULL,
> NULL, 0, 0,
> NULL, 0, 0, 0, NULL, 'soloman.solid-state-logic.com');
>
> In MySQL NULL is not equal to either the empty string ("") or 0. and logic
> testing proves this.
>
> I hope this helps,
>
> Evert Ford
> Information Analyst
> Westone Laboratories
> http://www.westone.com
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Martin Hepworth
> Sent: Thursday, July 24, 2003 7:58 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: sql logging problem
>
>
> Hmm the plot thickens....
>
> If use the values as qiven, there are 'empty' or null values being put
> in the string. When I use this syntax on a manual insert mysql complains
> about syntax error. However if I fill in these values to be the default
> then it's fine and the insert happens...
> eg
>
>   insert into maillog values ( '2003-07-24 14:40:57', 'h6ODerXL062460',
> 1066, 'martinh@soloman.solid-state-logic.com',
> 'martinh@solid-state-logic.com', 'test9', '127.0.0.1', , 0, 0, , , 0, 0,
> , 0, 0, 0, , 'soloman.solid-state-logic.com');
>
> doesn't work..
>
> insert into maillog values ( '2003-07-24 14:40:57', 'h6ODerXL062460',
> 1066, 'martinh@soloman.solid-state-logic.com',
> 'martinh@solid-state-logic.com', 'test9', '127.0.0.1',0 , 0, 0,0 ,0 , 0,
> 0,0 , 0, 0, 0,0 , 'soloman.solid-state-logic.com');
>
>
> does work..
>
>
> mysql is version 4.0.13
>
> time to hit the manuals..
>
>
> --
> Martin
> ---
> Incoming mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.483 / Virus Database: 279 - Release Date: 5/19/03

From gerry at dorfam.ca  Thu Jul 24 16:28:22 2003
From: gerry at dorfam.ca (Gerry Doris)
Date: Thu Jan 12 21:19:03 2006
Subject: osirusoft going crazy???
Message-ID: <31759.129.80.22.143.1059060502.squirrel@tiger.dorfam.ca>

Is it just me or has osirusoft RLB checks started going crazy?  I'm
suddenly seeing lots of innocent messages being flagged by this RBL as
spam.

Gerry

From sanjay.patel at REXWIRE.COM  Thu Jul 24 16:38:35 2003
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:19:03 2006
Subject: More spam after spamassain upgrade
In-Reply-To: <3F1FC186.7060302@bangor.ac.uk>
Message-ID: <007d01c351f9$a6033340$6f01a8c0@Laptop1>

Thanks for the response,
Here are the headers. I am using version 2.52

SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
        FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10, HTML_FONT_BIG 0.22,
        HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
        HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
        ORIGINAL_MESSAGE -0.50)

This was the normal buy Norton junk. It should have scored higher.

SKP

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Martin Sapsed
Sent: Thursday, July 24, 2003 7:23 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: More spam after spamassain upgrade


Sanjay K. Patel wrote:
> We are seeing more spam getting through after upgrading spam assassin to
the
> latest version. Even the buy Norton cheap spam is getting through. All the
> spam scores below our threshold of 5.
>
> Have the spammers got smarter or do we need to fine tune something?

Can you post the headers for e.g. a "buy Norton cheap" message which got
through - the categories SA lists might help us to advise you. Which
version do you mean by "the latest version"? What platform? What version
of MailScanner etc etc

I'm using a copy of 2.60 from a little while ago along with DCC (with
it's score raised) and virtually nothing gets passed that.

Cheers

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth


From ka at PACIFIC.NET  Thu Jul 24 16:42:07 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:03 2006
Subject: osirusoft going crazy???
In-Reply-To: <31759.129.80.22.143.1059060502.squirrel@tiger.dorfam.ca>
References: <31759.129.80.22.143.1059060502.squirrel@tiger.dorfam.ca>
Message-ID: <3F1FFE4F.4050906@pacific.net>

I checked current incoming mail with:
tail -f maillog | grep RCVD_IN_OSIRUSOFT
All I see is spam.

OSIRUSOFT only scores .86 in SA since it does have some false positives
now and then.
Are they all from one domain?

If you are using MS for rbl checks, you might need to increase the
"Spam Lists To Reach High Score" setting.

Ken


Gerry Doris wrote:

> Is it just me or has osirusoft RLB checks started going crazy?  I'm
> suddenly seeing lots of innocent messages being flagged by this RBL as
> spam.
>
> Gerry
>
>

From steve.douglas at SBIINCORPORATED.COM  Thu Jul 24 16:53:08 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:19:03 2006
Subject: Whitelisted Revisted
Message-ID: <3963522F0E71474CB14C0FF54A6914F70142FA6E@mail.gardenbotanika.com>

I am still trying to get a handle on this.  The recommendation below seems
to completely override the whitelist.rules.  Can someone clarify the
difference between the suggestion below and the whitelist.rules and
blacklist.rules files.  Thank you.

SD
:-)


> -----Original Message-----
> From: Matthew Bowman [mailto:mbowman@UDCOM.COM]
> Sent: Tuesday, July 22, 2003 12:58 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Whitelisted
>
> Kris,
>
> No.. That means that anything tagged as SPAM will not get tagged as SPAM
> for that using and all e-mail (save for viruses) is delivered as normal.
>
> If you want to disable spam scanning for a user, you need to use the
> following option (see my example below)
>
> # Do you want to check messages to see if they are spam?
> # This can also be the filename of a ruleset.
> Spam Checks = /etc/MailScanner/rules/spam.check.rules
>
> FromOrTo:       mbowman@udcom.com       no
>
> HTH
>
> Matthew
>
>
>
>
>
>
>
> Kris Zabriskie <zabriskw@ITECH.NET>
> Sent by: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> 07/22/2003 01:54 PM
> Please respond to MailScanner mailing list
>
>
>         To:     MAILSCANNER@JISCMAIL.AC.UK
>         cc:
>         Subject:        Re: Whitelisted
>
>
> Dustin,
> Maybe that is where my misunderstanding is.  I thought, that would turn
> off
> spam filtering for that user only.  Does that say anything addressed to
> that
> user and anyone else, will go through?
>
>
> ----- Original Message -----
> From: "Dustin Baer" <dustin.baer@IHS.COM>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Tuesday, July 22, 2003 1:51 PM
> Subject: Re: Whitelisted
>
>
> > Kris Zabriskie wrote:
> > >
> > > Here is everything:
> > >
> > > Contents:
> > > mail.log is the sendmail mail.log (ONLY information pertaining to the
> > > message in question)
> > > mail.header is the header of the e-mail
> > > spam.whitelist.rules is exactly what it says
> > > MailScanner.conf is exactly what it is =)
> >
> >
> > Check this entry in spam.whitelist.rules: "To:
> > blshu@itech.net             yes # for her daily drool"
> >
> > Check this entry in the mail logs:   to=...<blshu@itech.net>,...
> >
> > Hope you don't have to change products now.
> >
> > Dustin
> > --
> > Dustin Baer
> > Unix Administrator/Postmaster
> > Information Handling Services
> > 15 Inverness Way East
> > Englewood, CO 80112
> > 303-397-2836
> >

From dean.plant at ROKE.CO.UK  Thu Jul 24 17:01:26 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:19:03 2006
Subject: Mailscanner corrupting pdf files
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A7023673D@rsys004a.roke.co.uk>

Martin Sapsed wrote:
> Plant, Dean wrote:
>> I am having a problem with pdf files corrupting when passing through
>> the Mailscanner. If a mail with a pdf attachment is sent from one of
>> our clients, MS exchange encodes the message as either base64 or
>> quoted-printable format. All messages that are encoded as base64 pass
>> through the MailScanner correctly. Quoted-printable format mails
>> have the attachment corrupted. Turning off virus checks on
>> Mailscanner allows the quoted-printable mails to pass through
>> without corruption, so I assume it has something to do with:
>>
>> 1. Perl Mime::tools - Is this decoding / encoding the attachment
>> correctly?
>> 2. MS Exchange - Why encode some pdf's as base64 and some as
>> quoted-printable
>> 3. Different versions/creators of pdf files.
>>
>> Has anyone else suffered from this problem or does anyone have a
>> suggestion as a fix.
>
> I would say that PDF's ought to be encoded base64 everytime. I also
> wouldn't have thought that a PDF could survive being sent as
> Quoted-printable?
>
> After a quick search on Google RFC 1521 states "The Quoted-Printable
> encoding is intended to represent data that largely consists of octets
> that correspond to printable characters in the ASCII character set."
> and by my reckoning your average PDF file doesn't fit that
> description!
>
> I also didn't think that MailScanner altered content of messages
> unless it was told to because of some condition being met (striphtml
> or something like that). The virus scanner should just be presented
> with a copy of the attachment and asked if it's ok or not. I don't
> think that the attachment is removed and then reattached in some way.
>
> When you say you can turn scanning off and the quoted-printable PDFs
> go through ok, is this (at least one of) the same q-p PDFs which gets
> corrupted?
>
> Not much help really am I?? ;-)
>
> Cheers,
>
> Martin

Thanks for the reply.

I have a little more time to look at this and your correct about the virus scanning not being at fault. I forgot to mention that the Mailscanner adds a disclaimer, turning off the disclaimer stops the corruption of the pdf.

I found the below link which talks about a similar problem with mimedefang / Exchange & MIME::Tools.

http://lists.roaringpenguin.com/pipermail/mimedefang/2003-June/005988.html

Does anyone know if this could happen within mailscanner?

Thanks

Dean.

From steve.douglas at SBIINCORPORATED.COM  Thu Jul 24 17:09:37 2003
From: steve.douglas at SBIINCORPORATED.COM (Steve Douglas)
Date: Thu Jan 12 21:19:03 2006
Subject: Whitelisted
Message-ID: <3963522F0E71474CB14C0FF54A6914F70142FA70@mail.gardenbotanika.com>

Thank you for the clarification.  That is pretty slick.  I have had a couple
of "higher-ups" in my company express concern over how I can be absolutely
certain that legitimate email from legitimate senders is not overlooked.  At
this point, I think they are to go into the spam.checks.rules file.

Otherwise, I will have some explaining to do down the road.  I am going to
review your suggestion in the FAQ.  That is pretty slick.

SD
:-)


> -----Original Message-----
> From: Ken Anderson [mailto:ka@PACIFIC.NET]
> Sent: Thursday, July 24, 2003 10:25 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Whitelisted
>
> Okay, mail travels in envelopes with a TO and a FROM, just like postal
> mail, right?
>
> Mail is opened by the mailserver and delivered to the TO on the envelope
> and to the other TO,CC,BCC recipients. The problem is that this delivery
> process doesn't happen until the server writes it to the users mail
> spool. This doesn't happen until _after_ MailScanner/SA have looked at
> the message.
>
> The result is that a whitelist will affect ALL recipients of a message
> that has multiple recipients if the first envelope TO address matches
> the whitelist. 95% of the mail we see to multiple recipients is spam. :-(
>
> The only way around this using MailScanner is to use sendmail to split
> the message when it first arrives into multiple messages with only 1
> recipient each.
>
> MailScanner/SA will then see each recipient's copy of the message
> separately, so whitelists will be applied as they were intended. The FAQ
> entry explains how to do this (though the linebreaks were lost in the
> html faq, so it's a bit hard to read). Basically, you just run the
> incoming sendmail process with a very slightly modified config file, and
> sendmail takes care of splitting the incoming mail into single recipient
> messages. Note that this increases the load on your system too, since
> each message with x recipients will be split into x messages that
> MailScanner processes separately.
>
> FAQ entry:
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html
>
> Ken A.
> Pacific.Net
>
>
>
>
> Steve Douglas wrote:
>
> > I am even more confused.  As my eyes glaze over.
> >
> >
> >
> > -----Original Message-----
> > From: Stephen Swaney [mailto:Steve@swaney.com]
> > Sent: Tuesday, July 22, 2003 3:38 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Whitelisted
> >
> >
> >
> > Actually I placed Ken A, Pacific.Net's excellent solution for this in
> the
> > MailScanner FAQ.
> >
> >
> > http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html
> > <http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html>
> >
> > How easy can it get.
> >
> > Steve
> > Steve Swaney
> > steve@swaney.com
> >  <http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html>
> > On Tue, 2003-07-22 at 16:19, Derek Winkler wrote:
> >
> > See earlier thread on splitting messages with multiple recipients into
> > messages with one recipient each as a workaround.
> >
> > -----Original Message-----
> > From: Matt Kettler [ <mailto:mkettler@EVI-INC.COM>
> > mailto:mkettler@EVI-INC.COM]
> > Sent: Tuesday, July 22, 2003 4:16 PM
> > To: MAILSCANNER@jiscmail.ac.uk
> > Subject: Re: Whitelisted
> >
> >
> > At 12:00 PM 7/22/2003 -0600, Dustin Baer wrote:
> >
> >>>Dustin,
> >>>Maybe that is where my misunderstanding is.  I thought, that would turn
> >
> > off
> >
> >>>spam filtering for that user only.  Does that say anything addressed to
> >>
> >>that
> >>
> >>>user and anyone else, will go through?
> >>
> >>Hi Kris,
> >>
> >>As far as I understand MailScanner's whitelisting, if one recipient is
> >>in the whitelist, all recipients receive the message.  I have run into
> >>your situation also, and refuse to whitelist recipient names here, if I
> >>see that they receive a high volume of spam.  I don't want other people
> >>getting spam, just because they want their name whitelisted.
> >>
> >>I am sure someone will correct me, if I have mis-stated how MailScanner
> >>operates its whitelist.
> >
> >
> > That is correct. And this "problem" is a fundamental limit of running at
> > the MTA layer. It's not a bug, or a mistake, it's a design tradeoff
> between
> > flexibility and efficiency.
> >
> > Mailscanner runs at the MTA layer, not the MDA layer, so there is not
> one
> > copy of the message per user when MS sees it.. there's just one message
> > with many recipients. Thus MailScanner can only whitelist that one
> message,
> > or not whitelist it. There is no such thing as "well, later when you go
> to
> > deliver this, give these guys this copy, and that guy this other
> version".
> > It's one message, and they'll all get the same message, all MailScanner
> can
> > do is edit it.
> >
> > Running at the MTA layer is much more efficient, because you only scan
> the
> > message once, but it inherently has limits on "per user" customization.
> The
> > MTA layer is the ideal spot to do virus scanning, because you rarely
> want
> > user-specific behaviors for virus scanning. However doing spam scanning
> at
> > the MTA layer is somewhat limiting if you've got users that need
> > "exceptions".
> >
> > Personally I deal with it by creating custom SpamAssassin rules instead
> of
> > whitelists. This gives me the ability to target specific kinds of
> messages,
> > rather than specific sources or destinations. If I have to do a
> whitelist,
> > I try to make it a "fromto" type whitelist where it winds up narrowly
> > defined. I  never use To: type whitelists, and I avoid simple From:
> > whitelists as well.
> >
> >

From gerry at dorfam.ca  Thu Jul 24 17:14:12 2003
From: gerry at dorfam.ca (Gerry Doris)
Date: Thu Jan 12 21:19:03 2006
Subject: osirusoft going crazy???
In-Reply-To: <3F1FFE4F.4050906@pacific.net>
References: <31759.129.80.22.143.1059060502.squirrel@tiger.dorfam.ca>
            <3F1FFE4F.4050906@pacific.net>
Message-ID: <36974.129.80.22.133.1059063252.squirrel@tiger.dorfam.ca>

> I checked current incoming mail with:
> tail -f maillog | grep RCVD_IN_OSIRUSOFT
> All I see is spam.
>
> OSIRUSOFT only scores .86 in SA since it does have some false positives
> now and then.
> Are they all from one domain?
>
> If you are using MS for rbl checks, you might need to increase the
> "Spam Lists To Reach High Score" setting.
>
> Ken

Thanks.  I'd increased the scoring for some RBL's including osirusoft so
the best thing for me looks like dropping osirusoft back to the default so
I don't get so many false positives.


Gerry

From Steve at swaney.com  Thu Jul 24 17:19:59 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:03 2006
Subject: More spam after spamassain upgrade
In-Reply-To: <007d01c351f9$a6033340$6f01a8c0@Laptop1>
References: <007d01c351f9$a6033340$6f01a8c0@Laptop1>
Message-ID: <1059063599.29144.230.camel@speedy>

Sanjay,

I believe that you should be at version 2.55 of SpamAssassin. This
should make a difference.

Steve
Steve Swaney
Steve@Swaney.com


On Thu, 2003-07-24 at 11:38, Sanjay K. Patel wrote:

> Thanks for the response,
> Here are the headers. I am using version 2.52
>
> SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
>         FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10, HTML_FONT_BIG 0.22,
>         HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
>         HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
>         ORIGINAL_MESSAGE -0.50)
>
> This was the normal buy Norton junk. It should have scored higher.
>
> SKP
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Martin Sapsed
> Sent: Thursday, July 24, 2003 7:23 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: More spam after spamassain upgrade
>
>
> Sanjay K. Patel wrote:
> > We are seeing more spam getting through after upgrading spam assassin to
> the
> > latest version. Even the buy Norton cheap spam is getting through. All the
> > spam scores below our threshold of 5.
> >
> > Have the spammers got smarter or do we need to fine tune something?
>
> Can you post the headers for e.g. a "buy Norton cheap" message which got
> through - the categories SA lists might help us to advise you. Which
> version do you mean by "the latest version"? What platform? What version
> of MailScanner etc etc
>
> I'm using a copy of 2.60 from a little while ago along with DCC (with
> it's score raised) and virtually nothing gets passed that.
>
> Cheers
>
> Martin
>
> --
> Martin Sapsed
> Information Services               "Who do you say I am?"
> University of Wales, Bangor             Jesus of Nazareth
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030724/02b4778c/attachment.html
From Steve at swaney.com  Thu Jul 24 17:31:23 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:03 2006
Subject: Whitelisted
In-Reply-To: <3963522F0E71474CB14C0FF54A6914F70142FA69@mail.gardenbotanika.com>
References: <3963522F0E71474CB14C0FF54A6914F70142FA69@mail.gardenbotanika.com>
Message-ID: <1059064283.29144.238.camel@speedy>

Sorry for the bad formatting in the FAQ. Here is a repeat with hopefully
better, more understandable formatting


----------------------------------

I have incoming sendmail splitting multiple recipient messages into
multiple messages, so MailScanner and SA only see 1 recip per message.

Here's what I did. If any sendmail gurus out there thing this is a bad
idea, please let me know what a mess I've made of things :-)

1) Start the incoming sendmail with a different config file.
Changes to /etc/rc.d/init.d/MailScanner (from rpm install on redhat)
make this change to the incoming sendmail command line:
------ snip -------

  $SENDMAIL -bd -OPrivacyOptions=noetrn \
                       -ODeliveryMode=queueonly \
                       -OQueueDirectory=$INQDIR \
                       -OPidFile=$INPID \
                       -C/etc/mail/sendmail_in.cf

-------- snip --------

2) Make changes to the new sendmail config:
cp /etc/mail/sendmail /etc/mail/sendmail_in.cf

In sendmail_in.cf, add the following:
The comment header "QUEUE GROUP DEFINITIONS" should be there already.
Just add the single line under it.

------- snip --------
############################
# QUEUE GROUP DEFINITIONS  #
############################

Qmqueue, P=/var/spool/mqueue.in, F=f, r=1, R=8, I=2m

------- snip --------


AND, just above the "Ruleset 3" comment header, add the following:
(not sure if both lines are required or not...)

--------- snip --------

# LOCAL_RULESETS
Squeuegroup
R$* @ $*                $# mqueue
R$*                     $# mqueue

############################################
###  Ruleset 3 -- Name Canonicalization  ###
############################################


--------- snip ----------


Restart sendmail, and things like this start showing up in the log when
messages with multiple recipients come in:

Jul 17 08:14:31 host sendmail[7183]: h6HFDop8007183: split: maxrcpts=1,
rcpts=3, count=2, ids=h6HFDop9007183; h6HFDopA007183

So now MailScanner only sees 1 recipipient per message and rulesets only apply
to the user they are supposed to apply to. Cool, huh?
Thanks for all the suggestions!

Ken A
Pacific.Net
-----------------------------------------------

Steve
Steve@Swaney.com







On Thu, 2003-07-24 at 10:52, Steve Douglas wrote:

> I am even more confused.  As my eyes glaze over.
>
>
>
>
> -----Original Message-----
> From: Stephen Swaney [mailto:Steve@swaney.com]
> Sent: Tuesday, July 22, 2003 3:38 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Whitelisted
>
>
>
> Actually I placed Ken A, Pacific.Net's excellent solution for this in
> the MailScanner FAQ.
>
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html
>
> How easy can it get.
>
> Steve
> Steve Swaney
> steve@swaney.com
>
> On Tue, 2003-07-22 at 16:19, Derek Winkler wrote:
>
> See earlier thread on splitting messages with multiple recipients into
> messages with one recipient each as a workaround.
>
> -----Original Message-----
> From: Matt Kettler [mailto:mkettler@EVI-INC.COM]
> Sent: Tuesday, July 22, 2003 4:16 PM
> To: MAILSCANNER@jiscmail.ac.uk
> Subject: Re: Whitelisted
>
>
> At 12:00 PM 7/22/2003 -0600, Dustin Baer wrote:
> > > Dustin,
> > > Maybe that is where my misunderstanding is.  I thought, that would
> turn off
> > > spam filtering for that user only.  Does that say anything
> addressed to
> > that
> > > user and anyone else, will go through?
> >
> >Hi Kris,
> >
> >As far as I understand MailScanner's whitelisting, if one recipient
> is
> >in the whitelist, all recipients receive the message.  I have run
> into
> >your situation also, and refuse to whitelist recipient names here, if
> I
> >see that they receive a high volume of spam.  I don't want other
> people
> >getting spam, just because they want their name whitelisted.
> >
> >I am sure someone will correct me, if I have mis-stated how
> MailScanner
> >operates its whitelist.
>
> That is correct. And this "problem" is a fundamental limit of running
> at
> the MTA layer. It's not a bug, or a mistake, it's a design tradeoff
> between
> flexibility and efficiency.
>
> Mailscanner runs at the MTA layer, not the MDA layer, so there is not
> one
> copy of the message per user when MS sees it.. there's just one
> message
> with many recipients. Thus MailScanner can only whitelist that one
> message,
> or not whitelist it. There is no such thing as "well, later when you
> go to
> deliver this, give these guys this copy, and that guy this other
> version".
> It's one message, and they'll all get the same message, all
> MailScanner can
> do is edit it.
>
> Running at the MTA layer is much more efficient, because you only scan
> the
> message once, but it inherently has limits on "per user"
> customization. The
> MTA layer is the ideal spot to do virus scanning, because you rarely
> want
> user-specific behaviors for virus scanning. However doing spam
> scanning at
> the MTA layer is somewhat limiting if you've got users that need
> "exceptions".
>
> Personally I deal with it by creating custom SpamAssassin rules
> instead of
> whitelists. This gives me the ability to target specific kinds of
> messages,
> rather than specific sources or destinations. If I have to do a
> whitelist,
> I try to make it a "fromto" type whitelist where it winds up narrowly
> defined. I  never use To: type whitelists, and I avoid simple From:
> whitelists as well.
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030724/db718a11/attachment.html
From mailscanner_question at COMCAST.NET  Thu Jul 24 18:17:28 2003
From: mailscanner_question at COMCAST.NET (Dave Wood)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
Message-ID: <3F2014A8.7080400@comcast.net>

RedHat 9
MailScanner 4.22-5
SpamAssassin 2.55

I've installed SpamAssassin and MailScanner and I've configured
MailScanner to use SpamAssassin.  When I start MailScanner, however,
/var/log/maillog fills with:
MailScanner[3625]: SpamAssassin installation could not be found
As a result of this, MailScanner never starts up properly and messages
queue up and are not delivered.  Messages are delivered properly if I
change MailScanner.conf to not use spamassassin.

I can run spamassassin -D --lint as root and it appears to be configured
properly and run fine.  MailScanner also runs as root just as a system
service.

Does anybody have any idea what would cause this or how I can make
MailScanner recognize SpamAssassin?


Thanks,
Dave

From raymond at PROLOCATION.NET  Thu Jul 24 18:34:10 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <3F2014A8.7080400@comcast.net>
Message-ID: <Pine.LNX.4.44.0307241933420.15935-100000@mailbox.prolocation.net>

Hi!

> I can run spamassassin -D --lint as root and it appears to be configured
> properly and run fine.  MailScanner also runs as root just as a system
> service.
>
> Does anybody have any idea what would cause this or how I can make
> MailScanner recognize SpamAssassin?

How many perl instances do you have on your system ? And how did you
install SA ?

Bye,
Raymond.

From Denis.Beauchemin at USHERBROOKE.CA  Thu Jul 24 18:43:51 2003
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:19:03 2006
Subject: tmpfs size recommendations
Message-ID: <1059068631.13875.3.camel@dbeauchemin.sti.usherbrooke.ca>

Hello,

How much RAM should I allocate to a tmpfs for
/var/spool/MailScanner/incoming/ considering in about 1 day monitoring I
saw sizes up to 10GB for that directory.

Would I gain anything with a 512MB tmpfs?  What would happen if MS
needed more than 512MB?

Thanks!
-- 
Denis Beauchemin, analyste
Universit? de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045


From raymond at PROLOCATION.NET  Thu Jul 24 18:47:17 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:03 2006
Subject: tmpfs size recommendations
In-Reply-To: <1059068631.13875.3.camel@dbeauchemin.sti.usherbrooke.ca>
Message-ID: <Pine.LNX.4.44.0307241945200.18757-100000@mailbox.prolocation.net>

Hi!

> How much RAM should I allocate to a tmpfs for
> /var/spool/MailScanner/incoming/ considering in about 1 day monitoring I
> saw sizes up to 10GB for that directory.
>
> Would I gain anything with a 512MB tmpfs?  What would happen if MS
> needed more than 512MB?

I would say go for 512, i monitor my tmpfs in size and have never seen if
bigger then lets say 8-10% of that 512. Its only stored very shortly in
RAM usually. Most of the time its just using 1-2%

By default it takes 50% of your available RAM btw.

Bye,
Raymond.

From marco at MUW.EDU  Thu Jul 24 19:05:04 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:19:03 2006
Subject: tmpfs size recommendations
In-Reply-To: <1059068631.13875.3.camel@dbeauchemin.sti.usherbrooke.ca>
References: <1059068631.13875.3.camel@dbeauchemin.sti.usherbrooke.ca>
Message-ID: <1059069904.3f201fd032b08@webmail.MUW.Edu>

Hi,

> How much RAM should I allocate to a tmpfs for
> /var/spool/MailScanner/incoming/ considering in about 1 day monitoring I
> saw sizes up to 10GB for that directory.

There is a post about this by Julian, somewhere in the archives.
Basically, tmpfs auto-adjusts as needed. You don't have to specify the size.
Also, make sure you have the appropriate entry in /etc/fstab to it will mount
upon rebooting your system.

Marco


_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From marco at MUW.EDU  Thu Jul 24 19:09:39 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:19:03 2006
Subject: tmpfs size recommendations
In-Reply-To: <5.2.0.9.2.20030611161343.044c36d0@imap.ecs.soton.ac.uk>
References: <002f01c33021$2d001520$5b426480@ad.geog.utoronto.ca>           
            <06EE2C86D3DAD5119A6C0060943F3C97055E7000@tormail1.algorithmics.com>           
            <002f01c33021$2d001520$5b426480@ad.geog.utoronto.ca>
            <5.2.0.9.2.20030611161343.044c36d0@imap.ecs.soton.ac.uk>
Message-ID: <1059070179.3f2020e3bb8ae@webmail.MUW.Edu>

Hi,

Below is Julian's response to similar question:

Quoting Julian Field <mailscanner@ECS.SOTON.AC.UK>:

> Use tmpfs and not ramfs and you don't need to worry about it, the OS will
> expand and contract it dynamically for you.
> mount -t tmpfs tmpfs /var/spool/MailScanner/incoming
> (but obviously put the relevant info into your /etc/fstab so it gets
> mounted at boot-time).


Marco

_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From mailscanner_question at COMCAST.NET  Thu Jul 24 18:56:36 2003
From: mailscanner_question at COMCAST.NET (Dave Wood)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <Pine.LNX.4.44.0307241933420.15935-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307241933420.15935-100000@mailbox.prolocation.net>
Message-ID: <3F201DD4.2080006@comcast.net>

I installed SA from a RPM (spamassassin-2.55-1.7.3.i386.rpm and
spamassassin-tools-2.55-1.7.3.i386.rpm)

I'm afraid I don't understand your perl question, or how to answer it.
 If you're referring to how many versions of perl are on the machine,
then I don't know how to determine that.  I can tell you that this is a
clean RH9 install and cyrus-imap, razor, spamassassin, and mailscanner
are the only things I've installed.  If I run "locate perl", it appears
that only perl 5.8.0 is installed.

-- dave

Raymond Dijkxhoorn wrote:

>Hi!
>
>
>
>>I can run spamassassin -D --lint as root and it appears to be configured
>>properly and run fine.  MailScanner also runs as root just as a system
>>service.
>>
>>Does anybody have any idea what would cause this or how I can make
>>MailScanner recognize SpamAssassin?
>>
>>
>
>How many perl instances do you have on your system ? And how did you
>install SA ?
>
>Bye,
>Raymond.
>
>
>

From raymond at PROLOCATION.NET  Thu Jul 24 19:00:11 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <3F201DD4.2080006@comcast.net>
Message-ID: <Pine.LNX.4.44.0307241958190.20898-100000@mailbox.prolocation.net>

Hi!

> I installed SA from a RPM (spamassassin-2.55-1.7.3.i386.rpm and
> spamassassin-tools-2.55-1.7.3.i386.rpm)

It was told on the list a couple of times that that might cause problems,
i guess thats the case here.

Please install SA vie MCPAN ....

> I'm afraid I don't understand your perl question, or how to answer it.
>  If you're referring to how many versions of perl are on the machine,
> then I don't know how to determine that.  I can tell you that this is a
> clean RH9 install and cyrus-imap, razor, spamassassin, and mailscanner
> are the only things I've installed.  If I run "locate perl", it appears
> that only perl 5.8.0 is installed.

Ok, fair enough.

Please deinstall SA (rpm -e) and install it via MCPAN ...

perl -MCPAN -e shell
install Mail::SpamAssassin

Bye,
Raymond.

From dot at DOTAT.AT  Thu Jul 24 18:53:24 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <m2n.19fjsh-000rVv@chiark.greenend.org.uk>
Message-ID: <E19fkHM-0007Wk-00@chiark.greenend.org.uk>

Dave Wood <mailscanner_question@COMCAST.NET> wrote:
>
>Does anybody have any idea what would cause this or how I can make
>MailScanner recognize SpamAssassin?

Try adjusting the SpamAssassin Install Prefix option.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
HEBRIDES BAILEY: WEST OR SOUTHWEST, BECOMING CYCLONIC FOR A TIME, 4 OR 5,
OCCASIONALLY 6. RAIN OR SHOWERS. MODERATE OR GOOD.

From marco at MUW.EDU  Thu Jul 24 19:20:35 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <3F201DD4.2080006@comcast.net>
References: <Pine.LNX.4.44.0307241933420.15935-100000@mailbox.prolocation.net>
            <3F201DD4.2080006@comcast.net>
Message-ID: <1059070835.3f20237387913@webmail.MUW.Edu>

Hi Dave,

> I installed SA from a RPM (spamassassin-2.55-1.7.3.i386.rpm and
> spamassassin-tools-2.55-1.7.3.i386.rpm)

Looking at your e-mail, I don't see that you installed perl-Mail-SpamAssassin-
2.55-1.7.3.i386.rpm ... If not, that could be your problem. The RPM install of
SpamAssassin requires these 3 RPMS:

perl-Mail-SpamAssassin-2.55-1.7.3.i386.rpm
spamassassin-2.55-1.7.3.i386.rpm
spamassassin-tools-2.55-1.7.3.i386.rpm)


Marco


_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From mailscanner_question at COMCAST.NET  Thu Jul 24 19:05:45 2003
From: mailscanner_question at COMCAST.NET (Dave Wood)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <1059070835.3f20237387913@webmail.MUW.Edu>
References: <Pine.LNX.4.44.0307241933420.15935-100000@mailbox.prolocation.net> 
            <3F201DD4.2080006@comcast.net>
            <1059070835.3f20237387913@webmail.MUW.Edu>
Message-ID: <3F201FF9.9020500@comcast.net>

You're right, I didn't mention it, but I did install it.  Good catch,
but that's not my problem.

Thanks though!

-- dave

Marco Obaid wrote:

>Hi Dave,
>
>
>
>>I installed SA from a RPM (spamassassin-2.55-1.7.3.i386.rpm and
>>spamassassin-tools-2.55-1.7.3.i386.rpm)
>>
>>
>
>Looking at your e-mail, I don't see that you installed perl-Mail-SpamAssassin-
>2.55-1.7.3.i386.rpm ... If not, that could be your problem. The RPM install of
>SpamAssassin requires these 3 RPMS:
>
>perl-Mail-SpamAssassin-2.55-1.7.3.i386.rpm
>spamassassin-2.55-1.7.3.i386.rpm
>spamassassin-tools-2.55-1.7.3.i386.rpm)
>
>
>Marco
>
>
>_________________________________________________________________
>This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
>For the latest MUW Events, visit  http://www.MUW.Edu/calendar
>
>
>

From marco at MUW.EDU  Thu Jul 24 19:24:30 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <3F201FF9.9020500@comcast.net>
References: <Pine.LNX.4.44.0307241933420.15935-100000@mailbox.prolocation.net> 
            <3F201DD4.2080006@comcast.net>           
            <1059070835.3f20237387913@webmail.MUW.Edu>
            <3F201FF9.9020500@comcast.net>
Message-ID: <1059071070.3f20245ec58e6@webmail.MUW.Edu>

Hi Dave,

> You're right, I didn't mention it, but I did install it.  Good catch,
> but that's not my problem.

Definitely try Raymond's recommendation !!!

* Uninstall the RPMS
* Install SA via MCPAN

Good luck,
Marco


_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From Steve at swaney.com  Thu Jul 24 19:14:23 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <Pine.LNX.4.44.0307241958190.20898-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307241958190.20898-100000@mailbox.prolocation.net>
Message-ID: <1059070462.29144.336.camel@speedy>

I agree with Raymond's comments and am one of the people that has been
bitten by the rpm install.

I've also been bitten by the MCPAN install. There are a number of CPAN
sites that do NOT have the latest version of SpamAssassin available.
Just last week I inadvertently installed 2.53 by mistake. I did catch
the error when 2.53 rolled by during the install but I should have paid
more attention to the warning message about the mirror site being over
90 days out of date. Be warned.

I rectified the error by downloading the 2.55 version of
Mail::SpamAssassin from www.cpan.org and installed from that. It appears
to be exactly the install as the MCPAN method but the files that are
compiled and installed are the latest versions.

Hope this helps.

Steve
Steve@Swaney.com





On Thu, 2003-07-24 at 14:00, Raymond Dijkxhoorn wrote:

> Hi!
>
> > I installed SA from a RPM (spamassassin-2.55-1.7.3.i386.rpm and
> > spamassassin-tools-2.55-1.7.3.i386.rpm)
>
> It was told on the list a couple of times that that might cause problems,
> i guess thats the case here.
>
> Please install SA vie MCPAN ....
>
> > I'm afraid I don't understand your perl question, or how to answer it.
> >  If you're referring to how many versions of perl are on the machine,
> > then I don't know how to determine that.  I can tell you that this is a
> > clean RH9 install and cyrus-imap, razor, spamassassin, and mailscanner
> > are the only things I've installed.  If I run "locate perl", it appears
> > that only perl 5.8.0 is installed.
>
> Ok, fair enough.
>
> Please deinstall SA (rpm -e) and install it via MCPAN ...
>
> perl -MCPAN -e shell
> install Mail::SpamAssassin
>
> Bye,
> Raymond.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030724/70b0f67d/attachment.html
From mailscanner_question at COMCAST.NET  Thu Jul 24 19:13:46 2003
From: mailscanner_question at COMCAST.NET (Dave Wood)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <Pine.LNX.4.44.0307241958190.20898-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307241958190.20898-100000@mailbox.prolocation.net>
Message-ID: <3F2021DA.9080405@comcast.net>

Okay, I'm not out of the woods yet, when I try to install SA via MCPAN,
I get:

  CPAN.pm: Going to build J/JM/JMASON/Mail-SpamAssassin-2.55.tar.gz

Checking if your kit is complete...
Looks good

Warning: I could not locate your pod2man program. Please make sure,
         your pod2man program is in your PATH before you execute 'make'

Writing Makefile for Mail::SpamAssassin
Run Razor v2 tests (these may fail due to network problems)? (y/n) [n] y
Makefile:92: *** missing separator.  Stop.
  /usr/bin/make  -- NOT OK
Running make test
  Can't test without successful make
Running make install
  make had returned bad status, install seems impossible


Is the lack of pod2man the problem here?  If so, should I try to install
it via RPM or MCPAN (and what would be the correct command for that)?

-- dave

Raymond Dijkxhoorn wrote:

>Hi!
>
>
>
>>I installed SA from a RPM (spamassassin-2.55-1.7.3.i386.rpm and
>>spamassassin-tools-2.55-1.7.3.i386.rpm)
>>
>>
>
>It was told on the list a couple of times that that might cause problems,
>i guess thats the case here.
>
>Please install SA vie MCPAN ....
>
>
>
>>I'm afraid I don't understand your perl question, or how to answer it.
>> If you're referring to how many versions of perl are on the machine,
>>then I don't know how to determine that.  I can tell you that this is a
>>clean RH9 install and cyrus-imap, razor, spamassassin, and mailscanner
>>are the only things I've installed.  If I run "locate perl", it appears
>>that only perl 5.8.0 is installed.
>>
>>
>
>Ok, fair enough.
>
>Please deinstall SA (rpm -e) and install it via MCPAN ...
>
>perl -MCPAN -e shell
>install Mail::SpamAssassin
>
>Bye,
>Raymond.
>
>
>

From marco at MUW.EDU  Thu Jul 24 19:31:55 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <3F201FF9.9020500@comcast.net>
References: <Pine.LNX.4.44.0307241933420.15935-100000@mailbox.prolocation.net> 
            <3F201DD4.2080006@comcast.net>           
            <1059070835.3f20237387913@webmail.MUW.Edu>
            <3F201FF9.9020500@comcast.net>
Message-ID: <1059071515.3f20261b6892e@webmail.MUW.Edu>

Dave,

If this is a clean RH9 system and you are not aware of the problems with UTF-8
language settings, review this FAQ before you begine the SA install via MCPAN:

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/121.html

Otherwise, you may run into some weired error messages.

Marco

_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From mailscanner_question at COMCAST.NET  Thu Jul 24 19:15:28 2003
From: mailscanner_question at COMCAST.NET (Dave Wood)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <E19fkHM-0007Wk-00@chiark.greenend.org.uk>
References: <E19fkHM-0007Wk-00@chiark.greenend.org.uk>
Message-ID: <3F202240.3020303@comcast.net>

Adjust it to what?  And how would I do that (see below that I had
previously installed via RPM)

-- dave

Tony Finch wrote:

>Dave Wood <mailscanner_question@COMCAST.NET> wrote:
>
>
>>Does anybody have any idea what would cause this or how I can make
>>MailScanner recognize SpamAssassin?
>>
>>
>
>Try adjusting the SpamAssassin Install Prefix option.
>
>Tony.
>--
>f.a.n.finch  <dot@dotat.at>  http://dotat.at/
>HEBRIDES BAILEY: WEST OR SOUTHWEST, BECOMING CYCLONIC FOR A TIME, 4 OR 5,
>OCCASIONALLY 6. RAIN OR SHOWERS. MODERATE OR GOOD.
>
>
>

From raymond at PROLOCATION.NET  Thu Jul 24 19:16:23 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <3F2021DA.9080405@comcast.net>
Message-ID: <Pine.LNX.4.44.0307242014500.24688-100000@mailbox.prolocation.net>

Hi!

> Warning: I could not locate your pod2man program. Please make sure,
>          your pod2man program is in your PATH before you execute 'make'
>
> Writing Makefile for Mail::SpamAssassin
> Run Razor v2 tests (these may fail due to network problems)? (y/n) [n] y
> Makefile:92: *** missing separator.  Stop.

Fix your language settings.

> Is the lack of pod2man the problem here?  If so, should I try to install
> it via RPM or MCPAN (and what would be the correct command for that)?

No!

Edit /etc/sysconfig/i18n

And make it look like:

LANG="en_US"
SUPPORTED="en_US.UTF-8:en_US:en"
SYSFONT="latarcyrheb-sun16"

Bye,
Raymond.

From Denis.Beauchemin at USHERBROOKE.CA  Thu Jul 24 19:28:27 2003
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <3F2021DA.9080405@comcast.net>
References: <Pine.LNX.4.44.0307241958190.20898-100000@mailbox.prolocation.net>
            <3F2021DA.9080405@comcast.net>
Message-ID: <1059071307.13875.7.camel@dbeauchemin.sti.usherbrooke.ca>

Dave,

Perhaps the following install guide will guide you through it:
http://www.sng.ecs.soton.ac.uk/mailscanner/install/spamassassin.shtml

Denis
Le jeu 24/07/2003 ? 14:13, Dave Wood a ?crit :
> Okay, I'm not out of the woods yet, when I try to install SA via MCPAN,
> I get:
> 
>   CPAN.pm: Going to build J/JM/JMASON/Mail-SpamAssassin-2.55.tar.gz
> 
> Checking if your kit is complete...
> Looks good
> 
> Warning: I could not locate your pod2man program. Please make sure,
>          your pod2man program is in your PATH before you execute 'make'
> 
> Writing Makefile for Mail::SpamAssassin
> Run Razor v2 tests (these may fail due to network problems)? (y/n) [n] y
> Makefile:92: *** missing separator.  Stop.
>   /usr/bin/make  -- NOT OK
> Running make test
>   Can't test without successful make
> Running make install
>   make had returned bad status, install seems impossible
> 
> 
> Is the lack of pod2man the problem here?  If so, should I try to install
> it via RPM or MCPAN (and what would be the correct command for that)?
> 
> -- dave
> 
> Raymond Dijkxhoorn wrote:
> 
> >Hi!
> >
> >
> >
> >>I installed SA from a RPM (spamassassin-2.55-1.7.3.i386.rpm and
> >>spamassassin-tools-2.55-1.7.3.i386.rpm)
> >>
> >>
> >
> >It was told on the list a couple of times that that might cause problems,
> >i guess thats the case here.
> >
> >Please install SA vie MCPAN ....
> >
> >
> >
> >>I'm afraid I don't understand your perl question, or how to answer it.
> >> If you're referring to how many versions of perl are on the machine,
> >>then I don't know how to determine that.  I can tell you that this is a
> >>clean RH9 install and cyrus-imap, razor, spamassassin, and mailscanner
> >>are the only things I've installed.  If I run "locate perl", it appears
> >>that only perl 5.8.0 is installed.
> >>
> >>
> >
> >Ok, fair enough.
> >
> >Please deinstall SA (rpm -e) and install it via MCPAN ...
> >
> >perl -MCPAN -e shell
> >install Mail::SpamAssassin
> >
> >Bye,
> >Raymond.
> >
> >
> >
-- 
Denis Beauchemin, analyste
Universit? de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045


From rzewnickie at RFA.ORG  Thu Jul 24 19:41:33 2003
From: rzewnickie at RFA.ORG (Eric Dantan Rzewnicki)
Date: Thu Jan 12 21:19:03 2006
Subject: Whitelisted
In-Reply-To: <3F1FFA65.7030807@pacific.net>
References: <3963522F0E71474CB14C0FF54A6914F70142FA69@mail.gardenbotanika.com>
            <3F1FFA65.7030807@pacific.net>
Message-ID: <20030724184132.GF8775@rfa.org>

On Thu 24/07/2003 08:25:25, Ken Anderson wrote:
> Okay, mail travels in envelopes with a TO and a FROM, just like postal
> mail, right?
>
> Mail is opened by the mailserver and delivered to the TO on the envelope
> and to the other TO,CC,BCC recipients. The problem is that this delivery
> process doesn't happen until the server writes it to the users mail
> spool. This doesn't happen until _after_ MailScanner/SA have looked at
> the message.
>
> The result is that a whitelist will affect ALL recipients of a message
> that has multiple recipients if the first envelope TO address matches
> the whitelist. 95% of the mail we see to multiple recipients is spam. :-(
>
> The only way around this using MailScanner is to use sendmail to split
> the message when it first arrives into multiple messages with only 1
> recipient each.

Does anyone know if it is possible to do something similar with postfix?

I'm guessing it's not for the same reason Postfix sends duplicate mails
when a user is a recipient both individually and as a member of an
alias...

http://www.postfix.org/faq.html#duplicate


>
> MailScanner/SA will then see each recipient's copy of the message
> separately, so whitelists will be applied as they were intended. The FAQ
> entry explains how to do this (though the linebreaks were lost in the
> html faq, so it's a bit hard to read). Basically, you just run the
> incoming sendmail process with a very slightly modified config file, and
> sendmail takes care of splitting the incoming mail into single recipient
> messages. Note that this increases the load on your system too, since
> each message with x recipients will be split into x messages that
> MailScanner processes separately.
>
> FAQ entry:
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html
>
> Ken A.
> Pacific.Net
>
>
>
>
> Steve Douglas wrote:
>
> >I am even more confused.  As my eyes glaze over.
> >
> >
> >
> >-----Original Message-----
> >From: Stephen Swaney [mailto:Steve@swaney.com]
> >Sent: Tuesday, July 22, 2003 3:38 PM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Whitelisted
> >
> >
> >
> >Actually I placed Ken A, Pacific.Net's excellent solution for this in the
> >MailScanner FAQ.
> >
> >
> >http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html
> ><http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html>
> >
> >How easy can it get.
> >
> >Steve
> >Steve Swaney
> >steve@swaney.com
> > <http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html>
> >On Tue, 2003-07-22 at 16:19, Derek Winkler wrote:
> >
> >See earlier thread on splitting messages with multiple recipients into
> >messages with one recipient each as a workaround.
> >
> >-----Original Message-----
> >From: Matt Kettler [ <mailto:mkettler@EVI-INC.COM>
> >mailto:mkettler@EVI-INC.COM]
> >Sent: Tuesday, July 22, 2003 4:16 PM
> >To: MAILSCANNER@jiscmail.ac.uk
> >Subject: Re: Whitelisted
> >
> >
> >At 12:00 PM 7/22/2003 -0600, Dustin Baer wrote:
> >
> >>>Dustin,
> >>>Maybe that is where my misunderstanding is.  I thought, that would turn
> >
> >off
> >
> >>>spam filtering for that user only.  Does that say anything addressed to
> >>
> >>that
> >>
> >>>user and anyone else, will go through?
> >>
> >>Hi Kris,
> >>
> >>As far as I understand MailScanner's whitelisting, if one recipient is
> >>in the whitelist, all recipients receive the message.  I have run into
> >>your situation also, and refuse to whitelist recipient names here, if I
> >>see that they receive a high volume of spam.  I don't want other people
> >>getting spam, just because they want their name whitelisted.
> >>
> >>I am sure someone will correct me, if I have mis-stated how MailScanner
> >>operates its whitelist.
> >
> >
> >That is correct. And this "problem" is a fundamental limit of running at
> >the MTA layer. It's not a bug, or a mistake, it's a design tradeoff between
> >flexibility and efficiency.
> >
> >Mailscanner runs at the MTA layer, not the MDA layer, so there is not one
> >copy of the message per user when MS sees it.. there's just one message
> >with many recipients. Thus MailScanner can only whitelist that one message,
> >or not whitelist it. There is no such thing as "well, later when you go to
> >deliver this, give these guys this copy, and that guy this other version".
> >It's one message, and they'll all get the same message, all MailScanner can
> >do is edit it.
> >
> >Running at the MTA layer is much more efficient, because you only scan the
> >message once, but it inherently has limits on "per user" customization. The
> >MTA layer is the ideal spot to do virus scanning, because you rarely want
> >user-specific behaviors for virus scanning. However doing spam scanning at
> >the MTA layer is somewhat limiting if you've got users that need
> >"exceptions".
> >
> >Personally I deal with it by creating custom SpamAssassin rules instead of
> >whitelists. This gives me the ability to target specific kinds of messages,
> >rather than specific sources or destinations. If I have to do a whitelist,
> >I try to make it a "fromto" type whitelist where it winds up narrowly
> >defined. I  never use To: type whitelists, and I avoid simple From:
> >whitelists as well.
> >
> >

From jrudd at UCSC.EDU  Thu Jul 24 19:52:44 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:03 2006
Subject: tmpfs size recommendations
References: <002f01c33021$2d001520$5b426480@ad.geog.utoronto.ca>
            <06EE2C86D3DAD5119A6C0060943F3C97055E7000@tormail1.algorithmics.com>
            <002f01c33021$2d001520$5b426480@ad.geog.utoronto.ca>
            <5.2.0.9.2.20030611161343.044c36d0@imap.ecs.soton.ac.uk>
            <1059070179.3f2020e3bb8ae@webmail.MUW.Edu>
Message-ID: <3F202AFC.7B36810C@ucsc.edu>

Marco Obaid wrote:
>
> Hi,
>
> Below is Julian's response to similar question:
>
> Quoting Julian Field <mailscanner@ECS.SOTON.AC.UK>:
>
> > Use tmpfs and not ramfs and you don't need to worry about it, the OS will
> > expand and contract it dynamically for you.
> > mount -t tmpfs tmpfs /var/spool/MailScanner/incoming
> > (but obviously put the relevant info into your /etc/fstab so it gets
> > mounted at boot-time).
>

Though, it's a good idea to put a ceiling on the tmpfs (Solaris lets you
do that, don't know about other OSes), in case some runaway process
starts dumping stuff into that tmpfs (which will then affect your memory
footprint for general processing).  So, I think the question becomes
"what's a good tmpfs ceiling?"

From thomas_duvally at BROWN.EDU  Thu Jul 24 19:52:36 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:19:03 2006
Subject: Vexing problem
In-Reply-To: <1058964948.5735.9.camel@croithine>
References: <53B63D16-BC98-11D7-88FC-000393920D6C@uptime.at>
             <1058964948.5735.9.camel@croithine>
Message-ID: <1059072756.10225.10.camel@croithine>

On Wed, 2003-07-23 at 08:55, Thomas DuVally wrote:
> On Tue, 2003-07-22 at 19:00, David wrote:
> > On Mittwoch, Juli 23, 2003, at 12:58  Uhr, Raymond Dijkxhoorn wrote:
> >
> > > Hi!
> > >
> > >>> Everyday around peak time the upgraded system starts to get backed
> > >>> up.
> > >>> The incoming queue goes from a normal 2-4 message count up to 1000+.
> > >>> Restarting MS will begin clearing this out.
> > >>

I have been able to partial fix this issue.  I have set the:
Restart Every = 3600

This has helped a lot.  I any resource problems can't seem to wait the
default 4 hours, so 1 hour will have to do.  Not that I like the idea,
but it works.

--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From marco at MUW.EDU  Thu Jul 24 20:16:47 2003
From: marco at MUW.EDU (Marco Obaid)
Date: Thu Jan 12 21:19:03 2006
Subject: tmpfs size recommendations
In-Reply-To: <3F202AFC.7B36810C@ucsc.edu>
References: <002f01c33021$2d001520$5b426480@ad.geog.utoronto.ca>           
            <06EE2C86D3DAD5119A6C0060943F3C97055E7000@tormail1.algorithmics.com>           
            <002f01c33021$2d001520$5b426480@ad.geog.utoronto.ca>           
            <5.2.0.9.2.20030611161343.044c36d0@imap.ecs.soton.ac.uk>           
            <1059070179.3f2020e3bb8ae@webmail.MUW.Edu>
            <3F202AFC.7B36810C@ucsc.edu>
Message-ID: <1059074207.3f20309f21863@webmail.MUW.Edu>

Hi,

> Though, it's a good idea to put a ceiling on the tmpfs (Solaris lets you
> do that, don't know about other OSes), in case some runaway process
> starts dumping stuff into that tmpfs (which will then affect your memory
> footprint for general processing).  So, I think the question becomes
> "what's a good tmpfs ceiling?"

The maximum size is half of the physical RAM. However, the half is not
allocated at startup, it is used as need, allocated out of the spare RAM that
is used for IO buffers and disk cache.

I have always been told that there is not normally any reason to specify any
mount options for tmpfs at all. It's best to leave the OS to manage it all for
you.

Marco


_________________________________________________________________
This mail is sent through MUW Webmail: http://www.MUW.Edu/webmail
For the latest MUW Events, visit  http://www.MUW.Edu/calendar

From Antony at SOFT-SOLUTIONS.CO.UK  Thu Jul 24 20:00:40 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:03 2006
Subject: Vexing problem
In-Reply-To: <1059072756.10225.10.camel@croithine>
References: <53B63D16-BC98-11D7-88FC-000393920D6C@uptime.at>
            <1058964948.5735.9.camel@croithine>
            <1059072756.10225.10.camel@croithine>
Message-ID: <200307241901.h6OJ1G905252@agate.rockstone.co.uk>

On Thursday 24 July 2003 7:52 pm, Thomas DuVally wrote:

> On Wed, 2003-07-23 at 08:55, Thomas DuVally wrote:
> > On Tue, 2003-07-22 at 19:00, David wrote:
> > > On Mittwoch, Juli 23, 2003, at 12:58  Uhr, Raymond Dijkxhoorn wrote:
> > > > Hi!
> > > >
> > > >>> Everyday around peak time the upgraded system starts to get backed
> > > >>> up.
> > > >>> The incoming queue goes from a normal 2-4 message count up to
> > > >>> 1000+. Restarting MS will begin clearing this out.
>
> I have been able to partial fix this issue.  I have set the:
> Restart Every = 3600
>
> This has helped a lot.  I any resource problems can't seem to wait the
> default 4 hours, so 1 hour will have to do.  Not that I like the idea,
> but it works.

I'm not sure I understand what is wrong with setting 'Restart Every' to a
fairly low value like this?  Once an hour seems perfectly acceptable to me -
is there any reason why performance should suffer with a setting this low,
for example?

I agree that it shouldn't really be needed, but I don't see a reason not to
do it.

Antony.

--

Behind the counter a boy with a shaven head stared vacantly into space,
a dozen spikes of microsoft protruding from the socket behind his ear.

 - William Gibson, Neuromancer (1984)

From raymond at PROLOCATION.NET  Thu Jul 24 20:03:18 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:03 2006
Subject: Vexing problem
In-Reply-To: <200307241901.h6OJ1G905252@agate.rockstone.co.uk>
Message-ID: <Pine.LNX.4.44.0307242101410.31251-100000@mailbox.prolocation.net>

Hi!

> I'm not sure I understand what is wrong with setting 'Restart Every' to a
> fairly low value like this?  Once an hour seems perfectly acceptable to me -
> is there any reason why performance should suffer with a setting this low,
> for example?
>
> I agree that it shouldn't really be needed, but I don't see a reason not to
> do it.

When MS is starting it will cost some resources. On a busy box you most
likely want to avoid this, unless needed.

On my box it seems upgrading to the last RH9 kernel heps. I'll know for
sure in a couple of days however.

Bye,
Raymond.

From mailscanner_question at COMCAST.NET  Thu Jul 24 20:48:46 2003
From: mailscanner_question at COMCAST.NET (Dave Wood)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <Pine.LNX.4.44.0307242014500.24688-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307242014500.24688-100000@mailbox.prolocation.net>
Message-ID: <3F20381E.8050908@comcast.net>

I wanted to thank everybody for their help, and sneak in one last
question.  Installing from Perl with the language fix worked, and I am
receiving spam-scanned mail.

Finally, although I know it's not directly in the realm of this board,
can anybody explain how to properly configure SA to use Razor (which I
installed before SA)?  Do I need to do anything?

I have a line in my spam.assassin.prefs.conf file with:
score RAZOR2_CHECK 0.0 4.0 0.0 0.880
This is just something I copied from the local.cf that was installed
with the SA RPM.  But somebody else had told me to use
score RAZOR2_CHECK 6
which seems to fit in more with the syntax specified in the comments of
the file (and I know I can adjust the weight for that).

I saw the doc on the MS FAQ about updating the bayes engine, which I
will do, I just wanted to be sure if Razor was actually being used properly.

Thanks again everybody for all your help, I'm looking forward to
(mostly) spam-free days!

-- dave

From mailscanner_question at COMCAST.NET  Thu Jul 24 21:35:38 2003
From: mailscanner_question at COMCAST.NET (Dave Wood)
Date: Thu Jan 12 21:19:03 2006
Subject: need help with mailscanner and spamassassin
In-Reply-To: <3F20381E.8050908@comcast.net>
References: <Pine.LNX.4.44.0307242014500.24688-100000@mailbox.prolocation.net>
            <3F20381E.8050908@comcast.net>
Message-ID: <3F20431A.8090106@comcast.net>

Nevermind, I found this wonderful little document:
http://useast.spamassassin.org/tests.html

-- dave

Dave Wood wrote:

> I wanted to thank everybody for their help, and sneak in one last
> question.  Installing from Perl with the language fix worked, and I am
> receiving spam-scanned mail.
>
> Finally, although I know it's not directly in the realm of this board,
> can anybody explain how to properly configure SA to use Razor (which I
> installed before SA)?  Do I need to do anything?
>
> I have a line in my spam.assassin.prefs.conf file with:
> score RAZOR2_CHECK 0.0 4.0 0.0 0.880
> This is just something I copied from the local.cf that was installed
> with the SA RPM.  But somebody else had told me to use
> score RAZOR2_CHECK 6
> which seems to fit in more with the syntax specified in the comments of
> the file (and I know I can adjust the weight for that).
>
> I saw the doc on the MS FAQ about updating the bayes engine, which I
> will do, I just wanted to be sure if Razor was actually being used
> properly.
>
> Thanks again everybody for all your help, I'm looking forward to
> (mostly) spam-free days!
>
> -- dave
>

From jrudd at UCSC.EDU  Thu Jul 24 22:41:35 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:03 2006
Subject: More spam after spamassain upgrade
References: <007d01c351f9$a6033340$6f01a8c0@Laptop1>
            <1059063599.29144.230.camel@speedy>
Message-ID: <3F20528F.9136982A@ucsc.edu>

I'm seeing a similar problem.  My production machines are running v 2.43
with MailScanner 4.11-1, and got these scores:

X-UCSC-CATS-MailScanner-SpamCheck: spam, SpamAssassin (score=9.3,
required 8,
        BIG_FONT, CLICK_BELOW, CLICK_HERE_LINK, CTYPE_JUST_HTML,
        FORGED_RCVD_FOUND, HEADER_8BITS, HTML_70_90,
HTML_FONT_COLOR_GRAY,
        HTML_FONT_COLOR_UNSAFE, HTML_FONT_COLOR_YELLOW,
LINES_OF_YELLING,
        MISSING_MIMEOLE, MSG_ID_ADDED_BY_MTA_2, PRIORITY_NO_NAME,
        SPAM_PHRASE_05_08, TO_LOCALPART_EQ_REAL, X_AUTH_WARNING)


The same message, running through SpamAssassin 2.55 and
MailScanner-4.22-5 gives these scores (I'm in the process of upgrading
right now, so my test machines are running these newer versions):

X-UCSC-KZIN-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.6,
        required 5, CLICK_BELOW 0.10, HEADER_8BITS 1.18, HTML_70_80
0.51,
        HTML_FONT_BIG 0.27, HTML_FONT_COLOR_GRAY 0.10,
        HTML_FONT_COLOR_UNSAFE 0.10, HTML_LINK_CLICK_HERE 0.10,
        HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.10, MISSING_MIMEOLE 0.50,
        MSG_ID_ADDED_BY_MTA_2 0.40, PRIORITY_NO_NAME 0.46,
        X_AUTH_WARNING -0.40)


The current Spam Assassin looks like it has assigned 0's to the
LINES_OF_YELLING scores, for example.

(the spam in question, for those scores, was a gold and silver
investment blurb)

I wonder if it has something to do with which SA options mailscanner is
assuming (bayes, etc.), which might not be selecting the best possible
score sets.


> Stephen Swaney wrote:
>
> Sanjay,
>
> I believe that you should be at version 2.55 of SpamAssassin. This
> should make a difference.
>
> Steve
> Steve Swaney
> Steve@Swaney.com
>
> On Thu, 2003-07-24 at 11:38, Sanjay K. Patel wrote:
>
> > Thanks for the response,
> > Here are the headers. I am using version 2.52
> >
> > SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
> >         FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10, HTML_FONT_BIG 0.22,
> >         HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
> >         HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
> >         ORIGINAL_MESSAGE -0.50)
> >
> > This was the normal buy Norton junk. It should have scored higher.
> >
> > SKP
> >
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> > Of Martin Sapsed
> > Sent: Thursday, July 24, 2003 7:23 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: More spam after spamassain upgrade
> >
> >
> > Sanjay K. Patel wrote:
> > > We are seeing more spam getting through after upgrading spam assassin to
> > the
> > > latest version. Even the buy Norton cheap spam is getting through. All the
> > > spam scores below our threshold of 5.
> > >
> > > Have the spammers got smarter or do we need to fine tune something?
> >
> > Can you post the headers for e.g. a "buy Norton cheap" message which got
> > through - the categories SA lists might help us to advise you. Which
> > version do you mean by "the latest version"? What platform? What version
> > of MailScanner etc etc
> >
> > I'm using a copy of 2.60 from a little while ago along with DCC (with
> > it's score raised) and virtually nothing gets passed that.
> >
> > Cheers
> >
> > Martin
> >
> > --
> > Martin Sapsed
> > Information Services               "Who do you say I am?"
> > University of Wales, Bangor             Jesus of Nazareth
> >

From TGFurnish at HERFF-JONES.COM  Thu Jul 24 22:45:33 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:03 2006
Subject: Change request - prohibited vs infected
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF8E1A25@inex1.herffjones.hj-int>

Um, ditto. :-)

>-----Original Message-----
>From: Paul [mailto:zen23003@ZEN.CO.UK]
>Sent: Tuesday, July 22, 2003 3:56 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Change request - prohibited vs infected
>
>
>Various file types are listed in filetype.rules.conf.  The
>problem I have is
>that these files trigger a virus warning message when in fact these are
>simply prohibited file types.  So too, the message header gets
>"X-MailScanner: Found to be infected" inserted into it.
>
>The same is true of prohibited file names (as specified in
>filename.rules.conf).
>
>What brought this to my attention was the default ban on movie files in
>filetype.rules.conf .  These, unlike .pif, .scr and .exe etc are rarely
>infected.
>
>What I'd like to have is the ability to specify a different value for
>"X-MailScanner:" for prohibited file types and names, eg,
>"Prohibited file
>type" and "Prohibited file name".
>

From Steve at swaney.com  Thu Jul 24 22:49:16 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:04 2006
Subject: Sendmail - Multiple recipient and white-black listing
In-Reply-To: <3963522F0E71474CB14C0FF54A6914F70142FA69@mail.gardenbotanika.com>
References: <3963522F0E71474CB14C0FF54A6914F70142FA69@mail.gardenbotanika.com>
Message-ID: <1059083356.29144.411.camel@speedy>

I've found more detailed directions on implementing Sendmail Extended
Queue Groups, the sendmail feature you need to break email to multiple
recipients up into messages to  individual recipients. This allows
MailScanner to apply individual user preferences to each recipient of
the message, not only the first recipient.

The  better reference:
    http://www.murty.net/qgrpx/

NOTE: this reference implies that this "Feature" is only available in
sendmail versions 8.12.x. but this may apply only to the implementation
of the queuegroupx.m4 macro. I don't know if this means that the "snip"
directions in the faq-o-matic will not work with sendmail versions
earlier than 8.12. Any sendmail experts who can comment on this - please
do.

These directions allow you to implement this feature by using the m4
macros to generate the sendmail.cf file which is my preferred way to
build the sendmail.cf file. (no snip cut paste and hurt yourself) .

I need to get this implemented in the next week and will try and post a
full description to the faq-o-matic as soon as I have it tested.

Steve
Steve@Swaney.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030724/f7a26ef7/attachment.html
From raymond at PROLOCATION.NET  Thu Jul 24 23:02:31 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:04 2006
Subject: Whitelisted
In-Reply-To: <1059064283.29144.238.camel@speedy>
Message-ID: <Pine.LNX.4.44.0307250000440.27741-100000@mailbox.prolocation.net>

Hi!

> Here's what I did. If any sendmail gurus out there thing this is a bad
> idea, please let me know what a mess I've made of things :-)
>
> 1) Start the incoming sendmail with a different config file.
> Changes to /etc/rc.d/init.d/MailScanner (from rpm install on redhat)
> make this change to the incoming sendmail command line:

Uhm, what does the user 'see' ?

If i send in a mail, to 5 users, he sees just one or ?
If he now reply's ? He only replys to the sender, and not to the 4
others, since those are stripped, or am i missing something here ?

I think you will break more then you win here.

Bye,
Raymond.

From Steve at swaney.com  Thu Jul 24 23:05:12 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
In-Reply-To: <3F20528F.9136982A@ucsc.edu>
References: <007d01c351f9$a6033340$6f01a8c0@Laptop1>
            <1059063599.29144.230.camel@speedy>  <3F20528F.9136982A@ucsc.edu>
Message-ID: <1059084311.29144.425.camel@speedy>

This will not be too helpful in solving your problems but it does show
that spam detection is working on some systems.

We're running MailScanner SpamAssassin 2.55 and MailScanner-4.22-5 on a
Red Hat Enterprise 2.1 system that is a spampot. It gets NOTHING but
spam. We have fed a lot of the spam to the Bayesian filter and this has
improved our detection rate a bit.

The spam threshold is set to 5 and High Spam is set to 10. A quick look
at 1/2 days stats:

Processed:            5052    24.6Mb
Spam:                   5022    99.4%
High Scoring Spam:  2737    54.2%

Looks like it's missing .6% of today's junk.

Another interesting static is the average size of a Spam message is
4.869 KB

Steve
Steve@Swaney.com

On Thu, 2003-07-24 at 17:41, John Rudd wrote:

> I'm seeing a similar problem.  My production machines are running v 2.43
> with MailScanner 4.11-1, and got these scores:
>
> X-UCSC-CATS-MailScanner-SpamCheck: spam, SpamAssassin (score=9.3,
> required 8,
>         BIG_FONT, CLICK_BELOW, CLICK_HERE_LINK, CTYPE_JUST_HTML,
>         FORGED_RCVD_FOUND, HEADER_8BITS, HTML_70_90,
> HTML_FONT_COLOR_GRAY,
>         HTML_FONT_COLOR_UNSAFE, HTML_FONT_COLOR_YELLOW,
> LINES_OF_YELLING,
>         MISSING_MIMEOLE, MSG_ID_ADDED_BY_MTA_2, PRIORITY_NO_NAME,
>         SPAM_PHRASE_05_08, TO_LOCALPART_EQ_REAL, X_AUTH_WARNING)
>
>
> The same message, running through SpamAssassin 2.55 and
> MailScanner-4.22-5 gives these scores (I'm in the process of upgrading
> right now, so my test machines are running these newer versions):
>
> X-UCSC-KZIN-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.6,
>         required 5, CLICK_BELOW 0.10, HEADER_8BITS 1.18, HTML_70_80
> 0.51,
>         HTML_FONT_BIG 0.27, HTML_FONT_COLOR_GRAY 0.10,
>         HTML_FONT_COLOR_UNSAFE 0.10, HTML_LINK_CLICK_HERE 0.10,
>         HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.10, MISSING_MIMEOLE 0.50,
>         MSG_ID_ADDED_BY_MTA_2 0.40, PRIORITY_NO_NAME 0.46,
>         X_AUTH_WARNING -0.40)
>
>
> The current Spam Assassin looks like it has assigned 0's to the
> LINES_OF_YELLING scores, for example.
>
> (the spam in question, for those scores, was a gold and silver
> investment blurb)
>
> I wonder if it has something to do with which SA options mailscanner is
> assuming (bayes, etc.), which might not be selecting the best possible
> score sets.
>
>
> > Stephen Swaney wrote:
> >
> > Sanjay,
> >
> > I believe that you should be at version 2.55 of SpamAssassin. This
> > should make a difference.
> >
> > Steve
> > Steve Swaney
> > Steve@Swaney.com
> >
> > On Thu, 2003-07-24 at 11:38, Sanjay K. Patel wrote:
> >
> > > Thanks for the response,
> > > Here are the headers. I am using version 2.52
> > >
> > > SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
> > >         FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10, HTML_FONT_BIG 0.22,
> > >         HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
> > >         HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
> > >         ORIGINAL_MESSAGE -0.50)
> > >
> > > This was the normal buy Norton junk. It should have scored higher.
> > >
> > > SKP
> > >
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> > > Of Martin Sapsed
> > > Sent: Thursday, July 24, 2003 7:23 AM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: More spam after spamassain upgrade
> > >
> > >
> > > Sanjay K. Patel wrote:
> > > > We are seeing more spam getting through after upgrading spam assassin to
> > > the
> > > > latest version. Even the buy Norton cheap spam is getting through. All the
> > > > spam scores below our threshold of 5.
> > > >
> > > > Have the spammers got smarter or do we need to fine tune something?
> > >
> > > Can you post the headers for e.g. a "buy Norton cheap" message which got
> > > through - the categories SA lists might help us to advise you. Which
> > > version do you mean by "the latest version"? What platform? What version
> > > of MailScanner etc etc
> > >
> > > I'm using a copy of 2.60 from a little while ago along with DCC (with
> > > it's score raised) and virtually nothing gets passed that.
> > >
> > > Cheers
> > >
> > > Martin
> > >
> > > --
> > > Martin Sapsed
> > > Information Services               "Who do you say I am?"
> > > University of Wales, Bangor             Jesus of Nazareth
> > >
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030724/5a2e2f8f/attachment.html
From ka at PACIFIC.NET  Thu Jul 24 23:15:42 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:04 2006
Subject: Whitelisted
In-Reply-To: <Pine.LNX.4.44.0307250000440.27741-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307250000440.27741-100000@mailbox.prolocation.net>
Message-ID: <3F205A8E.2070104@pacific.net>

Raymond Dijkxhoorn wrote:

> Hi!
>
>
>>Here's what I did. If any sendmail gurus out there thing this is a bad
>>idea, please let me know what a mess I've made of things :-)
>>
>>1) Start the incoming sendmail with a different config file.
>>Changes to /etc/rc.d/init.d/MailScanner (from rpm install on redhat)
>>make this change to the incoming sendmail command line:
>
>
> Uhm, what does the user 'see' ?
>
> If i send in a mail, to 5 users, he sees just one or ?
> If he now reply's ? He only replys to the sender, and not to the 4
> others, since those are stripped, or am i missing something here ?
>
> I think you will break more then you win here.
>
> Bye,
> Raymond.
>
>

No you don't lose anything from the header. It's cloned for all copies
of the message.
Ken

From raymond at PROLOCATION.NET  Thu Jul 24 23:18:18 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:04 2006
Subject: Whitelisted
In-Reply-To: <3F205A8E.2070104@pacific.net>
Message-ID: <Pine.LNX.4.44.0307250017040.27741-100000@mailbox.prolocation.net>

Hi!

> > If he now reply's ? He only replys to the sender, and not to the 4
> > others, since those are stripped, or am i missing something here ?
> >
> > I think you will break more then you win here.

> No you don't lose anything from the header. It's cloned for all copies
> of the message.

Could you draw this for me ? If you clone all the headers you deliver 5
times when you have a machine as relay or ? I guess this only works for
local delivery ?

Bye,
Raymond.

From jase at SENSIS.COM  Thu Jul 24 23:18:28 2003
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
Message-ID: <ADF6087CA978A4418AF7F76DDCF2F721027572AC@europa.ats.sensis.com>

I think that SpamAssassin has for sets of scores:

*  Local
*  Net
*  Bayes
*  Bayes + Net

So I highly recomend using DCC and Razor2, especially if you are doing rbl
lookups in SpamAssassin, since many tests in Net and Bayes + Net score lower
than Local or Bayes.

Jason

> -----Original Message-----
> From: John Rudd [mailto:jrudd@UCSC.EDU]
> Sent: Thursday, July 24, 2003 5:42 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: [MAILSCANNER] More spam after spamassain upgrade
>
>
> I'm seeing a similar problem.  My production machines are
> running v 2.43
> with MailScanner 4.11-1, and got these scores:
>
> X-UCSC-CATS-MailScanner-SpamCheck: spam, SpamAssassin (score=9.3,
> required 8,
>         BIG_FONT, CLICK_BELOW, CLICK_HERE_LINK, CTYPE_JUST_HTML,
>         FORGED_RCVD_FOUND, HEADER_8BITS, HTML_70_90,
> HTML_FONT_COLOR_GRAY,
>         HTML_FONT_COLOR_UNSAFE, HTML_FONT_COLOR_YELLOW,
> LINES_OF_YELLING,
>         MISSING_MIMEOLE, MSG_ID_ADDED_BY_MTA_2, PRIORITY_NO_NAME,
>         SPAM_PHRASE_05_08, TO_LOCALPART_EQ_REAL, X_AUTH_WARNING)
>
>
> The same message, running through SpamAssassin 2.55 and
> MailScanner-4.22-5 gives these scores (I'm in the process of upgrading
> right now, so my test machines are running these newer versions):
>
> X-UCSC-KZIN-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.6,
>         required 5, CLICK_BELOW 0.10, HEADER_8BITS 1.18, HTML_70_80
> 0.51,
>         HTML_FONT_BIG 0.27, HTML_FONT_COLOR_GRAY 0.10,
>         HTML_FONT_COLOR_UNSAFE 0.10, HTML_LINK_CLICK_HERE 0.10,
>         HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.10, MISSING_MIMEOLE 0.50,
>         MSG_ID_ADDED_BY_MTA_2 0.40, PRIORITY_NO_NAME 0.46,
>         X_AUTH_WARNING -0.40)
>
>
> The current Spam Assassin looks like it has assigned 0's to the
> LINES_OF_YELLING scores, for example.
>
> (the spam in question, for those scores, was a gold and silver
> investment blurb)
>
> I wonder if it has something to do with which SA options
> mailscanner is
> assuming (bayes, etc.), which might not be selecting the best possible
> score sets.
>
>
> > Stephen Swaney wrote:
> >
> > Sanjay,
> >
> > I believe that you should be at version 2.55 of SpamAssassin. This
> > should make a difference.
> >
> > Steve
> > Steve Swaney
> > Steve@Swaney.com
> >
> > On Thu, 2003-07-24 at 11:38, Sanjay K. Patel wrote:
> >
> > > Thanks for the response,
> > > Here are the headers. I am using version 2.52
> > >
> > > SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
> > >         FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10,
> HTML_FONT_BIG 0.22,
> > >         HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
> > >         HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
> > >         ORIGINAL_MESSAGE -0.50)
> > >
> > > This was the normal buy Norton junk. It should have scored higher.
> > >
> > > SKP
> > >
> > > -----Original Message-----
> > > From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> > > Of Martin Sapsed
> > > Sent: Thursday, July 24, 2003 7:23 AM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: More spam after spamassain upgrade
> > >
> > >
> > > Sanjay K. Patel wrote:
> > > > We are seeing more spam getting through after upgrading
> spam assassin to
> > > the
> > > > latest version. Even the buy Norton cheap spam is
> getting through. All the
> > > > spam scores below our threshold of 5.
> > > >
> > > > Have the spammers got smarter or do we need to fine
> tune something?
> > >
> > > Can you post the headers for e.g. a "buy Norton cheap"
> message which got
> > > through - the categories SA lists might help us to advise
> you. Which
> > > version do you mean by "the latest version"? What
> platform? What version
> > > of MailScanner etc etc
> > >
> > > I'm using a copy of 2.60 from a little while ago along
> with DCC (with
> > > it's score raised) and virtually nothing gets passed that.
> > >
> > > Cheers
> > >
> > > Martin
> > >
> > > --
> > > Martin Sapsed
> > > Information Services               "Who do you say I am?"
> > > University of Wales, Bangor             Jesus of Nazareth
> > >
>

From TGFurnish at HERFF-JONES.COM  Thu Jul 24 23:44:56 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:04 2006
Subject: What do you monitor and alert on for your mailscanner system?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C073B@inex1.herffjones.hj-int>

I am wondering what the group generally monitors in order to detect problems
with a mailscanner relay (ie things that should cause an alert to be sent to
an admin).

My system is probably a bit more isolated than most - my deployment
(currently only testing) will *only* be intended for inbound mail filtering,
no outbound delivery (not even for "no such user" bounces, if I can prevent
it), so my list may not make sense in situations that handle outbound mail,
but here are the conditions I'm planning to alert on so far - have I missed
anything you monitor on you system?

Failure conditions to alert on:
- Abnormally large inbound or outbound mailq.
- Deferred messages in the outbound mailq.  (I deliver only to an internal
server over a lan link.)
- Deferred messages in the inbound mailq. (Not sure that even is possible.)
- Old messages in the inbound or outbound mailqs (ie they haven't been
accessed or modified in a while)
- MailScanner process count (too high or too low)
- Inbound sendmail process count.
- Outbound sendmail queue runner (not sure how to differentiate in vs out
yet though)
- System unreachable via ping, smtp, http, or ssh (or whatever other methods
are appropriate for your system)
- Low disk space.
- High swap usage.
- High load average (especially anything nearing sendmail's deferal load
average).
- High process count.
- Dmesg errors (sends the dmesg output from the box to a monitoring device).
- High filtering percentages (ie 100% spam).
- Low filtering percentages (ie 10% spam).
- Round trip of test messages - ie send a message to a bounceback address
and expect it to return with X minutes.  Could also check to be sure a
mailscanner header was found in the return message.

Any suggestions for other things I could check?  If it breaks, I want to
know *before* anyone else does. :-)

From jrudd at UCSC.EDU  Fri Jul 25 00:08:33 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
In-Reply-To: <ADF6087CA978A4418AF7F76DDCF2F721027572AC@europa.ats.sensis.com>
Message-ID: <BF9274C6-BE2B-11D7-B951-003065F939FE@ucsc.edu>

Given our configuration, it makes more sense for me to be try to
remember how to specify that it should use the Local rule set and not
the others, and then see which MailScanner is using.  We don't do any
net checks, and I'm not planning to set up Bayes for these machines
just yet.

If MS is defaulting to one of the other rule sets, then that may very
well account for the issue I'm seeing.


On Thursday, Jul 24, 2003, at 15:18 US/Pacific, Desai, Jason wrote:

>
> I think that SpamAssassin has for sets of scores:
>
> *  Local
> *  Net
> *  Bayes
> *  Bayes + Net
>
> So I highly recomend using DCC and Razor2, especially if you are doing
> rbl
> lookups in SpamAssassin, since many tests in Net and Bayes + Net score
> lower
> than Local or Bayes.
>
> Jason
>
>> -----Original Message-----
>> From: John Rudd [mailto:jrudd@UCSC.EDU]
>> Sent: Thursday, July 24, 2003 5:42 PM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: [MAILSCANNER] More spam after spamassain upgrade
>>
>>
>> I'm seeing a similar problem.  My production machines are
>> running v 2.43
>> with MailScanner 4.11-1, and got these scores:
>>
>> X-UCSC-CATS-MailScanner-SpamCheck: spam, SpamAssassin (score=9.3,
>> required 8,
>>         BIG_FONT, CLICK_BELOW, CLICK_HERE_LINK, CTYPE_JUST_HTML,
>>         FORGED_RCVD_FOUND, HEADER_8BITS, HTML_70_90,
>> HTML_FONT_COLOR_GRAY,
>>         HTML_FONT_COLOR_UNSAFE, HTML_FONT_COLOR_YELLOW,
>> LINES_OF_YELLING,
>>         MISSING_MIMEOLE, MSG_ID_ADDED_BY_MTA_2, PRIORITY_NO_NAME,
>>         SPAM_PHRASE_05_08, TO_LOCALPART_EQ_REAL, X_AUTH_WARNING)
>>
>>
>> The same message, running through SpamAssassin 2.55 and
>> MailScanner-4.22-5 gives these scores (I'm in the process of upgrading
>> right now, so my test machines are running these newer versions):
>>
>> X-UCSC-KZIN-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.6,
>>         required 5, CLICK_BELOW 0.10, HEADER_8BITS 1.18, HTML_70_80
>> 0.51,
>>         HTML_FONT_BIG 0.27, HTML_FONT_COLOR_GRAY 0.10,
>>         HTML_FONT_COLOR_UNSAFE 0.10, HTML_LINK_CLICK_HERE 0.10,
>>         HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.10, MISSING_MIMEOLE 0.50,
>>         MSG_ID_ADDED_BY_MTA_2 0.40, PRIORITY_NO_NAME 0.46,
>>         X_AUTH_WARNING -0.40)
>>
>>
>> The current Spam Assassin looks like it has assigned 0's to the
>> LINES_OF_YELLING scores, for example.
>>
>> (the spam in question, for those scores, was a gold and silver
>> investment blurb)
>>
>> I wonder if it has something to do with which SA options
>> mailscanner is
>> assuming (bayes, etc.), which might not be selecting the best possible
>> score sets.
>>
>>
>>> Stephen Swaney wrote:
>>>
>>> Sanjay,
>>>
>>> I believe that you should be at version 2.55 of SpamAssassin. This
>>> should make a difference.
>>>
>>> Steve
>>> Steve Swaney
>>> Steve@Swaney.com
>>>
>>> On Thu, 2003-07-24 at 11:38, Sanjay K. Patel wrote:
>>>
>>>> Thanks for the response,
>>>> Here are the headers. I am using version 2.52
>>>>
>>>> SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
>>>>         FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10,
>> HTML_FONT_BIG 0.22,
>>>>         HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
>>>>         HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
>>>>         ORIGINAL_MESSAGE -0.50)
>>>>
>>>> This was the normal buy Norton junk. It should have scored higher.
>>>>
>>>> SKP
>>>>
>>>> -----Original Message-----
>>>> From: MailScanner mailing list
>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>>>> Of Martin Sapsed
>>>> Sent: Thursday, July 24, 2003 7:23 AM
>>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>>> Subject: Re: More spam after spamassain upgrade
>>>>
>>>>
>>>> Sanjay K. Patel wrote:
>>>>> We are seeing more spam getting through after upgrading
>> spam assassin to
>>>> the
>>>>> latest version. Even the buy Norton cheap spam is
>> getting through. All the
>>>>> spam scores below our threshold of 5.
>>>>>
>>>>> Have the spammers got smarter or do we need to fine
>> tune something?
>>>>
>>>> Can you post the headers for e.g. a "buy Norton cheap"
>> message which got
>>>> through - the categories SA lists might help us to advise
>> you. Which
>>>> version do you mean by "the latest version"? What
>> platform? What version
>>>> of MailScanner etc etc
>>>>
>>>> I'm using a copy of 2.60 from a little while ago along
>> with DCC (with
>>>> it's score raised) and virtually nothing gets passed that.
>>>>
>>>> Cheers
>>>>
>>>> Martin
>>>>
>>>> --
>>>> Martin Sapsed
>>>> Information Services               "Who do you say I am?"
>>>> University of Wales, Bangor             Jesus of Nazareth
>>>>
>>

From mkettler at EVI-INC.COM  Fri Jul 25 00:16:14 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
In-Reply-To: <007d01c351f9$a6033340$6f01a8c0@Laptop1>
References: <3F1FC186.7060302@bangor.ac.uk>
Message-ID: <5.2.1.1.0.20030724190341.01abbe50@xanadu.evi-inc.com>

At 11:38 AM 7/24/2003 -0400, Sanjay K. Patel wrote:
>Here are the headers. I am using version 2.52

OUCH..Do not under any condition use Spamassassin versions 2.50-2.53 for
production purposes if you are concerned about false negatives. The
scoresets in these versions are VERY easily abused by spammers for self
whitelisting.

This is an EXTREMELY well known and easily exploited problem, and is the
whole reason 2.54 got a new scoreset. It is the infamous bug 1589 that
causes it. The effects of this bug were reported on the SA-talk list at
least 3 times a day during the period while it was being fixed.

http://bugzilla.spamassassin.org/show_bug.cgi?id=1589


Now, the example message you posted isn't suffering from this problem, but
you really are begging for false negatives by running 2.52.

It's also pretty well known that the ruleset in the 2.5x family is
considerably weaker than the later part of the 2.4x family. But the ruleset
weaknesses are largely made up for by the power of bayes, and are mostly a
result of the developers focusing on getting bayes added instead of new
rules while writing 2.50. If you're going to use 2.5x, train your bayes DB,
it helps a lot.

From michael at ERG.ABDN.AC.UK  Fri Jul 25 00:30:35 2003
From: michael at ERG.ABDN.AC.UK (Michael Forrest)
Date: Thu Jan 12 21:19:04 2006
Subject: Client's IP in the sender messages
Message-ID: <000001c3523b$98ff1d70$276b7ad5@enterprise>

Hi all,

I was wondering if it would be possible to include the client's IP
address in say the sender.spam.sa.report.txt

A wee snippet from the file would be :-

  To: $to
  Date: $date
  Subject: $subject
  Originating IP: $clientip

I had a wee peek through the code and found a variable called $clientip,
although it doesn't appear to do what I thought it did. All I want is to
include the ip address of where the message originated.

Anyone got any thoughts?

Michael.

From shawn at ADVANCEDMANAGED.COM  Fri Jul 25 00:45:40 2003
From: shawn at ADVANCEDMANAGED.COM (Shawn)
Date: Thu Jan 12 21:19:04 2006
Subject: more white/black list ?s
In-Reply-To: <000001c3523b$98ff1d70$276b7ad5@enterprise>
Message-ID: <001e01c3523d$b092cfc0$0f00010a@station>

Thanks for the help so far, this list has been great.

I am looking at mailscanner white\black listing now.  I want both global
and user specific lists. My servers are just relays.  So I if implement
byemail white/black lists in MailScanner and then use
spam.assassin.prefs.conf for globals this looks like it will do what I
want.  Is there a better way?

Looks like ill have to implement the breaking up of recipients also.

Thanks,
shawn

From santialf at DNS.UCNET.COM.MX  Fri Jul 25 00:46:41 2003
From: santialf at DNS.UCNET.COM.MX (J. Alfredo Sa=?ISO-8859-1?Q?ntill=E1n_Ramos?=)
Date: Thu Jan 12 21:19:04 2006
Subject: init script for Solaris
In-Reply-To: <E0747DCCDD2AD411B865009027347CD203067462@boisemx.powereng.com>
References: <E0747DCCDD2AD411B865009027347CD203067462@boisemx.powereng.com>
Message-ID: <1059090401.3f206fe10b4cc@correo.ucnet.com.mx>

Quoting Derrick Georgiades <dgeorgiades@POWERENG.COM>:

> These work on Solaris 9, should work fine for 8.

Derrick, thank you very much for sharing your scripts.


Regards,


---
J. Santill?n R.


From mkettler at EVI-INC.COM  Fri Jul 25 01:38:08 2003
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:19:04 2006
Subject: Client's IP in the sender messages
In-Reply-To: <000001c3523b$98ff1d70$276b7ad5@enterprise>
Message-ID: <5.2.1.1.0.20030724203225.01522cf0@xanadu.evi-inc.com>

At 12:30 AM 7/25/2003 +0100, Michael Forrest wrote:
>address in say the sender.spam.sa.report.txt
>
>A wee snippet from the file would be :-
>
>   To: $to
>   Date: $date
>   Subject: $subject
>   Originating IP: $clientip
>
>I had a wee peek through the code and found a variable called $clientip,
>although it doesn't appear to do what I thought it did. All I want is to
>include the ip address of where the message originated.
>
>Anyone got any thoughts?

Hmm, could you clarify your expectations? Reliably determining the
originating IP of a spam message isn't possible. The only thing you can
reliably determine is who dropped it off at your MX. Is that what you were
looking for?

From ka at PACIFIC.NET  Fri Jul 25 02:21:04 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:04 2006
Subject: Whitelisted
In-Reply-To: <Pine.LNX.4.44.0307250017040.27741-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307250017040.27741-100000@mailbox.prolocation.net>
Message-ID: <3F208600.7080606@pacific.net>

I can tell you that it works quite well for relays, since that's how we
use it for 600k messages a day and yes of course it increases the load
on your server(s) since you have duplicate(x) deliveries.

Keep in mind that queue groups are a sendmail feature, this isn't a
hack, so you can expect that the coders of sendmail did a good job
testing and polishing the way the queue groups feature works. I'd advise
you to test it yourself and see if it meets your needs.

Ken A.




Raymond Dijkxhoorn wrote:
> Hi!
>
>
>>>If he now reply's ? He only replys to the sender, and not to the 4
>>>others, since those are stripped, or am i missing something here ?
>>>
>>>I think you will break more then you win here.
>
>
>>No you don't lose anything from the header. It's cloned for all copies
>>of the message.
>
>
> Could you draw this for me ? If you clone all the headers you deliver 5
> times when you have a machine as relay or ? I guess this only works for
> local delivery ?
>
> Bye,
> Raymond.
>
>

From michael at ERG.ABDN.AC.UK  Fri Jul 25 08:16:32 2003
From: michael at ERG.ABDN.AC.UK (Michael Forrest)
Date: Thu Jan 12 21:19:04 2006
Subject: Re Client's IP in the sender messages
Message-ID: <000a01c3527c$adb2bba0$3c00000a@enterprise>

>>address in say the sender.spam.sa.report.txt
>>
>>A wee snippet from the file would be :-
>>
>>   To: $to
>>   Date: $date
>>   Subject: $subject
>>   Originating IP: $clientip
>>
>>I had a wee peek through the code and found a variable called
$clientip,
>>although it doesn't appear to do what I thought it did. All I want is
to
>>include the ip address of where the message originated.
>>
>>Anyone got any thoughts?

At 20:38  24/7/2003, Matt Kettler wrote:
>Hmm, could you clarify your expectations? Reliably determining the
>originating IP of a spam message isn't possible. The only thing you can
>reliably determine is who dropped it off at your MX. Is that what you
were
>looking for?

Yeah that would be sufficient. The problem am facing at the moment, is
that spammers are spoofing our addresses. My boss received a message
from our mailserver saying that he had sent spam to someone else within
our domain and via our bounce,delete (our mailserver deleted it due to a
high spamassassin score and he received a bounce msg back).

So if the message had an ip address in it, to say that client
139.133.207.102 dropped the message off to the mailserver, then the
confusion over who sent the message would be reduced. He actually
thought for a while that he had sent it himself, then got all hot and
bothered thinking that someone was using his email addy....the story
gets stranger as it goes on :-)

Anyway, does anyone have any ideas of how to include that ip address in
the sender reports?

Thanks,

Michael.

From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Jul 25 09:18:40 2003
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:19:04 2006
Subject: ClamAV autoupdate Question
Message-ID: <B9D9BD71E387E24AB1D619FE4B748CC703CB88@ERWIN.intern.seceidos.de>

Hi,

when I am doing a clamav-autoupdate here is what I get:

ERROR: Can't connect to port 80 of host clamav.elektrapro.com
ERROR: Connection with clamav.elektrapro.com failed.
ERROR: Can't write to file /usr/local/share/clamav/mirror !

The databases seem to have updated though (at least the viruses.db2
has). One of the mirrors worked. 
Two questions though:

1. Is it correct that only virueses.db2 gets updated (date Jul 25 02:00
while viruses.db is still Jul 18 15:22 and is a lot smaller)?
2. Why the error message?

Any ideas?

Thanks,
  JP


From Antony at SOFT-SOLUTIONS.CO.UK  Fri Jul 25 09:26:09 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:04 2006
Subject: ClamAV autoupdate Question
In-Reply-To: <B9D9BD71E387E24AB1D619FE4B748CC703CB88@ERWIN.intern.seceidos.de>
References: <B9D9BD71E387E24AB1D619FE4B748CC703CB88@ERWIN.intern.seceidos.de>
Message-ID: <200307250826.h6P8Qk905509@agate.rockstone.co.uk>

On Friday 25 July 2003 9:18 am, Jan-Peter Koopmann wrote:

> Hi,
>
> when I am doing a clamav-autoupdate here is what I get:
>
> ERROR: Can't connect to port 80 of host clamav.elektrapro.com
> ERROR: Connection with clamav.elektrapro.com failed.
> ERROR: Can't write to file /usr/local/share/clamav/mirror !
>
> The databases seem to have updated though (at least the viruses.db2
> has). One of the mirrors worked.
> Two questions though:
>
> 1. Is it correct that only virueses.db2 gets updated (date Jul 25 02:00
> while viruses.db is still Jul 18 15:22 and is a lot smaller)?

Viruses.db2 does get updated more often than viruses.db, but viruses.db is
the bigger file.

My system currently holds:

viruses.db 1222321 bytes July 8 02:31
viruses.db2 28222 bytes July 25 02:30

> 2. Why the error message?

1. Can your machine connect to anywhere on port 80?   Do yoou have some
firewalling in place perhaps?

2. Can you connect from some other machine using a web browser to
http://clamav.elektrapro.com ?   The site is occasionally down, and the
current version/s of clamav use a file /usr/local/share/clamav/mirrors.txt to
specify alternative download locations.

Antony.

--

Anyone that's normal doesn't really achieve much.

 - Mark Blair, Australian rocket engineer

From m.sapsed at BANGOR.AC.UK  Fri Jul 25 10:01:08 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
References: <007d01c351f9$a6033340$6f01a8c0@Laptop1>
Message-ID: <3F20F1D4.5000606@bangor.ac.uk>

Sanjay K. Patel wrote:
> Thanks for the response,
> Here are the headers. I am using version 2.52
>
> SpamCheck: not spam, SpamAssassin (score=0.4, required 5,
>         FOR_JUST_SOME_AMT 0.18, HTML_50_60 0.10, HTML_FONT_BIG 0.22,
>         HTML_FONT_COLOR_BLUE 0.10, HTML_FONT_COLOR_GRAY 0.10,
>         HTML_FONT_COLOR_RED 0.10, HTML_WEB_BUGS 0.10,
>         ORIGINAL_MESSAGE -0.50)
>
> This was the normal buy Norton junk. It should have scored higher.

I think you'll have gathered by now that 2.52 is far from the "latest
version". I've found 2.60 (still not released) to be solid so far and
very good at spotting spam, especially when combined with DCC which was
a breeze to install (I've upped the DCC score though from the default.)

We didn't work out a sensible way of training Bayes and found it was
reducing the spam score far too often!

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From m.sapsed at BANGOR.AC.UK  Fri Jul 25 10:08:34 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:19:04 2006
Subject: Mailscanner corrupting pdf files
References: <EA943CD30BCB104E9D38F5B5DC2D9A7023673D@rsys004a.roke.co.uk>
Message-ID: <3F20F392.9010408@bangor.ac.uk>

Plant, Dean wrote:
 > I have a little more time to look at this and your correct about the
 > virus scanning not being at fault. I forgot to mention that the
 > Mailscanner adds a disclaimer, turning off the disclaimer stops the
 > corruption of the pdf.
 >
 > I found the below link which talks about a similar problem with
 > mimedefang / Exchange & MIME::Tools.
 >
 >
http://lists.roaringpenguin.com/pipermail/mimedefang/2003-June/005988.html
 >
 > Does anyone know if this could happen within mailscanner?

That sounds more plausible. I don't quite how the disclaimer is added
but it is feasible that the process of doing that is causing the
problem. Patching Exchange to behave properly (i.e. base64'ing PDF's)
seems the most sensible route, although I realise that there is a lot of
experience in adapting Unix programs to cater for the wierdness of
Bill-ware! ;-)

Am I right in thinking Julian's back next week? He will understand
what's going on here...

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Jul 25 10:09:42 2003
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:19:04 2006
Subject: ClamAV autoupdate Question
Message-ID: <B9D9BD71E387E24AB1D619FE4B748CC703CB8A@ERWIN.intern.seceidos.de>

Hi,

> Viruses.db2 does get updated more often than viruses.db, but 
> viruses.db is the bigger file.
> 
> My system currently holds:
> 
> viruses.db 1222321 bytes July 8 02:31
> viruses.db2 28222 bytes July 25 02:30

-rw-r--r--   1 clamav  clamav  1222321 Jul 18 15:22 viruses.db
-rw-r--r--   1 clamav  clamav    28222 Jul 25 02:00 viruses.db2

Looks ok.



> 1. Can your machine connect to anywhere on port 80?   Do yoou 
> have some
> firewalling in place perhaps?

Nope. Connectivity is ok. I suspect that the site is down. That part of
the error message does not trouble me. It's the 

ERROR: Can't write to file /usr/local/share/clamav/mirror

that causes headaches.

Regards,
  JP


From m.sapsed at BANGOR.AC.UK  Fri Jul 25 10:32:00 2003
From: m.sapsed at BANGOR.AC.UK (Martin Sapsed)
Date: Thu Jan 12 21:19:04 2006
Subject: more white/black list ?s
References: <001e01c3523d$b092cfc0$0f00010a@station>
Message-ID: <3F20F910.2060507@bangor.ac.uk>

Shawn wrote:
> Thanks for the help so far, this list has been great.
>
> I am looking at mailscanner white\black listing now.  I want both global
> and user specific lists. My servers are just relays.  So I if implement
> byemail white/black lists in MailScanner and then use
> spam.assassin.prefs.conf for globals this looks like it will do what I
> want.  Is there a better way?
>
> Looks like ill have to implement the breaking up of recipients also.

I guess it depends on what options you want to use when you find spam.
Personally I think the simplest is to score it all, tag it at 2 levels
(striphtml on the higher one) and then give the user tools to deal with
it as they want.

I guess if you want to look at bouncing or deleteing or stuff like that
then you may need to break things up...

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From ctrudeau at BELLSOUTH.NET  Fri Jul 25 11:04:41 2003
From: ctrudeau at BELLSOUTH.NET (Chris Trudeau)
Date: Thu Jan 12 21:19:04 2006
Subject: Just sops processing
References: <001e01c3523d$b092cfc0$0f00010a@station> 
            <3F20F910.2060507@bangor.ac.uk>
Message-ID: <00c401c35294$2a633cd0$23c8a8c0@SERV>

---Ok all,

My test mailscanner application continues to just die...for no reason...

All I see in the logs is postfix continue to spool messages into the
postfix.in queue...and they sit there...I can't pinpoint a timeframe or
sequence of events...but maillog indicates that MailScanner simply just
stops processing mail...

I log into the test server and check processes with a "ps -ef  |  grp
MailScanner and the processes are all there, but there will be 20-50
messages sitting in queues....stopping and restarting is no good...I have to


killall MailScanner

WAIT for the defunct processes to die...

then  run:

check_MailScanner

Once this happens, it purges queues and runs fine for another "n" amount of
time...

Running MailScanner-4.22-1 with SA, Razor and DCC...all works unbelievably
well (I would compare the accuracy against any application available)
BUT...it keeps bailing on me...ideas are welcome!

CT
Nazareth

From Q.G.Campbell at NEWCASTLE.AC.UK  Fri Jul 25 11:46:35 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:19:04 2006
Subject: Mailscanner corrupting pdf files
Message-ID: <74BC2BBF06470148911E64E2B48FE139049938@pinewood.ncl.ac.uk>

> -----Original Message-----
> From: Martin Sapsed [mailto:m.sapsed@BANGOR.AC.UK] 
> Sent: 25 July 2003 10:09
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Mailscanner corrupting pdf files
> 
> 
> Plant, Dean wrote:
>  > I have a little more time to look at this and your correct 
> about the  > virus scanning not being at fault. I forgot to 
> mention that the  > Mailscanner adds a disclaimer, turning 
> off the disclaimer stops the  > corruption of the pdf.  >  > 
> I found the below link which talks about a similar problem 
> with  > mimedefang / Exchange & MIME::Tools.  >  > 
> http://lists.roaringpenguin.com/pipermail/mimedefang/2003-June
/005988.html
 >
 > Does anyone know if this could happen within mailscanner?

That sounds more plausible. I don't quite how the disclaimer is added
but it is feasible that the process of doing that is causing the
problem. Patching Exchange to behave properly (i.e. base64'ing PDF's)
seems the most sensible route, although I realise that there is a lot of
experience in adapting Unix programs to cater for the wierdness of
Bill-ware! ;-)

Martin

I was about to post to the list about the PDF problem. We are running MS
4.22-5 with SA 2.55 and users are suffering some serious problems
sending/receiving PDF files. The problem seems to have started with SA
4.22-5.

The problem is even apparent with a local sender who is using Pine on a
Unix system. Zipping the PDF file appears to make no difference. It thus
appears that it is within MS or one of the modules that is processing
the PDF file that the problem occurs. 

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 


From dot at DOTAT.AT  Fri Jul 25 14:53:06 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:04 2006
Subject: Current Cambridge patchset [LONG]
Message-ID: <E19g30M-0008AU-00@chiark.greenend.org.uk>

I've made a number of modifications to MailScanner in order to suit
it better to our requirements at Cambridge. I think most of them are
generally useful, so I'm posting them here for your interest (since
Julian is still on holiday). The changes are as follows (by file)...

EXAMPLES, README, Config.pm:

        I've added a new kind of rule: a "soft" rule, which gives
        you a bit more flexibility in the behaviour you can get
        using rulesets. We want all incoming email to be scanned,
        except for certain domains which have opted out of our
        central scanning service because they want to run their
        own. This is fine, but what do you do if a message is sent
        to two addresses, one opted out, one not? We've decided to
        err on the side of safety, and scan. However rulesets are
        first-match-wins, so have to be ordered from the specific
        to the general, which means that it would err on the side
        of the opt-out. By making the opted-out rule soft, other
        addresses on the message can be tested against later rules
        to give us the behaviour we want.

        I've added a special-case match for bounces (messages with
        an empty return path), equivalent to /^$/ but more readable.
        Default rules are handled slightly differently: as before
        they match bounces, but * and *@* only match addresses which
        contain an @ which does not include bounces. Default rules
        must now be last in the ruleset, or be soft.

EximDiskStore.pm, PFDiskStore.pm, SMDiskStore.pm, ZMSiskStore.pm,
SA.pm, Message.pm:

        Instead of not scanning large messages, SpamAssassin scans
        only the first part of messages up to the Max SpamAssassin Size
        configuration.

        SA.pm now tells Message.pm if it has not scanned the message
        for some reason, so that Mesasge.pm can put the Unscanned Header
        Value in the Spam Header instead of leaving it blank if you are
        Always Including the SpamAssassin Report.

        I've also changed the SpamAssassin report so that the required=N
        clause is not added if N is zero.  This is because we don't
        filter spam centrally, and MailScanner's threshold in the Spam
        Header was confusing users because it had nothing to do with the
        threshold they had configured on their own filters.  I've added
        a Log Non Spam option so that the SpamAssassin results of every
        message can be logged.

        I've also changed the From: header of messages carrying
        disinfected attachments to be the same as the from address of
        the original message, to encourage users to follow our policy
        of chasing up virus problems with the infected person rather
        than with us, and for better bounce and autoresponse behaviour.

ConfigDefs.pm MessageBatch.pm Exim.pm SweepContent.pm SweepOther.pm:

        I've changed MessageBatch.pm to log the number of High Scoring
        messages as well as regular spam.  This is for stats accumulation,
        especially if the Required SpamAssassin Score is zero.

        MessageBatch.pm also has a hand in ensuring that "Not Scanned"
        is put in the Spam Header if the message isn't scanned.

        Log HTML Form Tags and Log Object Codebase Tags options, to go
        with the existing Log IFrame Tags option. I've changed these
        options to work even when the corresponding tags are permitted,
        so that you can gauge how much pain would be caused by disallowing
        them.

        There's now a Log Message IDs option to make it easier to track
        what MailScanner has done to each message it handles. I've also
        changed a few existing log messages to include the message-ID.
        I think the coverage of this option is still a bit patchy; in
        particular the other MTA-specific modules need support.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
SHANNON: WEST 5 OR 6 DECREASING 4. RAIN THEN SHOWERS. MODERATE OR POOR
BECOMING GOOD.



--- etc/rules/EXAMPLES  25 Mar 2003 18:32:39 -0000      1.1.1.3
+++ etc/rules/EXAMPLES  24 Jul 2003 18:13:02 -0000      1.2
@@ -55,5 +55,13 @@
    To:         @def.com                postmaster@me.com bill@def.com
    FromOrTo:   default                 postmaster@me.com

+6. Virus scan all but a few domains; if a message is to more than one
+   domain, err on the side of scanning
+
+   Set "Virus Scanning = /opt/MailScanner/etc/rules/virus.scanning.rules".
+   SoftTo:     opt-out-1.com   no
+   SoftTo:     opt-out-2.com   no
+   To:         default         yes
+
 I will add more ideas as I think of them.
 All suggestions for clever tricks are most welcome!

--- etc/rules/README    3 Mar 2003 04:34:23 -0000       1.1.1.3
+++ etc/rules/README    24 Jul 2003 18:13:02 -0000      1.2
@@ -31,6 +31,13 @@
    This specifies the whether the rule should be matched against
    the sender's address (or IP address), or the recipient's address.

+   The direction can also include the word "soft". Usually the value
+   of a ruleset is the value of the first rule that matches. If the
+   rule is soft, then MailScanner continues to look for a rule that
+   matches one of the remaining addresses (excluding the one that
+   matched the soft rule). If only soft rules match, then the value
+   of the ruleset is the value of the last soft rule that matched.
+
 2. The pattern describes what messages should match this rule.
    Some examples are:
        user@sub.domain.com     # Individual address
@@ -45,8 +52,9 @@
                                  # Perl regular expression
        /^192\.168\.1[4567]\./  # Any SMTP client IP address in the networks
                                # 192.168.14 - 192.168.17
-       *@*                     # Default value
        default                 # Default value
+       bounce                  # bounce messages
+       *@*                     # non-bounce messages
    You should be able to do just about anything with that.

 3. The result value is what you could have put in the entry in the main

--- lib/perl5/MailScanner/Config.pm     4 Jul 2003 18:08:27 -0000       1.1.1.7
+++ lib/perl5/MailScanner/Config.pm     24 Jul 2003 18:01:21 -0000      1.11
@@ -62,7 +63,7 @@
 my(%StaticScalars, %ScannerCmds, %SpamLists);
 my(%KeywordCategory, %FilenameRules, %FiletypeRules);
 my(%LanguageStrings);
-my(%RuleScalars, %Defaults, $DefaultRegexp);
+my(%RuleScalars, %Defaults);
 my(%CustomFunctions);
 my(%PercentVars); # For putting substituted variables in all settings

@@ -74,10 +75,6 @@

 %CustomFunctions = (); # These are names of user-written functions

-# This is what the RuleToRegexp function produces when given
-# either "*@*" or "default".
-$DefaultRegexp = '^.*\@.*\.?$';
-
 # Need to read in a filename/ruleset whose value is the location of
 # filename.rules.conf files. Check every rule of every ruleset in
 # turn, stopping with the result of the first rule that matches.
@@ -127,7 +124,8 @@

   my($category, $rulelist, $rule);
   my($direction, $iporaddr, $regexp, $value);
-  my($to, %matches, @addresses, $misses);
+  my($to, %matches, $misses, $return);
+  my(%rcpts, $from, $clientip);

   $category = $KeywordCategory{$name};
   $rulelist = $RuleScalars{$name};
@@ -142,6 +140,12 @@
     # It's a first-match rule
     #

+    $from = $msg->{from};
+    %rcpts = map { $_ => '' } @{$msg->{to}};
+    $clientip = $msg->{clientip};
+
+    $return = $Defaults{$name};
+
     #print STDERR "$name first-match rule\n";

     # If there is no ruleset either, then return the default
@@ -155,26 +159,44 @@
         # It's a text address-based rule
         if ($direction =~ /b/) {
           # Match against all the To addresses and the From address
+          # (not just the ones that are left after matching soft rules).
           $misses = 0;
           $misses++ unless $msg->{from} =~ /$regexp/i;
           foreach $to (@{$msg->{to}}) {
             $misses++,last unless $to =~ /$regexp/i;
           }
-          return $value if $misses == 0;
+          #return $value if $misses == 0;
+          if ($misses == 0) {
+            return $value unless $direction =~ /s/;
+            $return = $value;
+            undef $from;
+            %rcpts = ();
+          }
         } else {
           # Match against any of From and/or To addresses
           if ($direction =~ /f/) {
             # Match against the From address
             #print STDERR "From " . $msg->{from} . " against $regexp\n";
-            return $value if $msg->{from} =~ /$regexp/i;
+            #return $value if $msg->{from} =~ /$regexp/i;
+            if (defined $from and $from =~ /$regexp/i) {
+              return $value unless $direction =~ /s/;
+              $return = $value;
+              undef $from;
+            }
             #print STDERR "Miss\n";
           }
           if ($direction =~ /t/) {
             # Match against every To address
-            foreach $to (@{$msg->{to}}) {
+            #foreach $to (@{$msg->{to}}) {
+            foreach $to (keys %rcpts) {
               #print STDERR "To " . $to . " against $regexp\n";
               #print STDERR "Resulting value would be $value\n";
-              return $value if $to =~ /$regexp/i;
+              #return $value if $to =~ /$regexp/i;
+              if ($to =~ /$regexp/i) {
+                return $value unless $direction =~ /s/;
+                $return = $value;
+                delete $rcpts{$to};
+              }
               #print STDERR "Miss\n";
             }
           }
@@ -185,20 +207,20 @@
         if ($direction =~ /f/) {
           # Match against the SMTP Client IP address
           #print STDERR "Matching IP " . $msg->{clientip} . " against $regexp\n";
-          return $value if $msg->{clientip} =~ /$regexp/;
-        }
-        if ($direction =~ /[tb]/) {
-          # Don't know the target IP address
-          MailScanner::Log::WarnLog("Config Error: Cannot match against " .
-            " destination IP address when resolving configuration option " .
-            " \"%s\"", $name);
+          #return $value if $msg->{clientip} =~ /$regexp/;
+          if (defined $clientip and $clientip =~ /$regexp/i) {
+            return $value unless $direction =~ /s/;
+            $return = $value;
+            undef $clientip;
+          }
         }
       }
     }
     # Nothing matched, so return the default value
     #print STDERR "Nothing matched, so returning default value: " .
     #             $Defaults{$name} . "\n";
-    return $Defaults{$name};
+    #return $Defaults{$name};
+    return $return;

   } else {

@@ -1165,32 +1189,25 @@
     return ('t',$rule);
   }

-  # If it is "default" or "*", then make it *@*
-  if ($rule eq 'default' || $rule eq '*') {
-    $rule = '*@*';
-  }
-  # If it doesn't contain @
-  if ($rule !~ /@/) {
-    if ($rule =~ /^\*/) {
-      # If it starts with *, then make it *@*.domain.com
-      $rule = '*@' . $rule;
-    } else {
-      # If it doesn't contain a *, then make it *@domain.com
-      $rule = '*@' . $rule;
-    }
+  if ($rule eq 'default') {
+    # match anything
+    $rule = '*';
+  } elsif ($rule eq 'bounce') {
+    # bounces have an empty return path
+    $rule = '';
+  } elsif ($rule !~ /\@/) {
+    # If it has no @ then match any local part in the domain
+    $rule = '*@' . $rule;
   }
   # Prepend * if leading @
   $rule = '*' . $rule if $rule =~ /^\@/;
   # Append  * if traiing @
   $rule = $rule . '*' if $rule =~ /\@$/;

-  # Now it's got an @ sign and something both sides of it
   # Change . into \., @ into \@, * into .*
   $rule =~ s/\@/\\@/g;
   $rule =~ s/\./\\./g;
   $rule =~ s/\*/.*/g;
-  # and tack on the optional "." at the end
-  $rule .= '\.?';
   # and tack on the start+end anchors
   $rule = '^' . $rule . '$';
   ('t',$rule);
@@ -1250,6 +1267,9 @@

     # Syntax check and shorten fromto
     $fromto = '';
+    # fanf: soft rules may be overriden by later rules that match a
+    # different address (i.e. one not matched by the soft rule)
+    $fromto = 's' if $direction =~ /soft/i;
     if ($direction =~ /and/i) {
       $fromto = 'b'; # b = both from AND to at the same time
     } else {
@@ -1267,6 +1287,17 @@
     # Pass it the keyword so it can set the default value if there is one.
     ($ruletype, $regexp) = RuleToRegexp($rule);

+    if ($fromto =~ /[tb]/ and lc $rule eq 'bounce') {
+      MailScanner::Log::WarnLog("Config Error: Bounces cannot match " .
+        "against destination addresses in line %d of ruleset %s",
+                                $linecounter, $rulesfilename);
+    }
+    if ($fromto =~ /[tb]/ and $ruletype eq 'd') {
+      MailScanner::Log::WarnLog("Config Error: Cannot match against " .
+        "destination IP address in line %d of ruleset %s",
+        $linecounter, $rulesfilename);
+    }
+
     # Syntax check the value
     #print STDERR "Config: $keyword has rule value " . $File{$keyword} .
     #             " = " . $values{$value} . "\n";
@@ -1281,13 +1312,15 @@
     if (defined $internalvalue || $rulesettype eq 'other') {
       # Update the default value if this is it
       #print STDERR "Ruleset: Is \"$regexp\" the default rule?\n";
-      if ($regexp eq $DefaultRegexp) {
+      # fanf: this is now acheived by the user putting the default
+      # rule last or by making it soft
+      #if ($regexp eq $DefaultRegexp) {
         # Don't store it in the main ruleset as it will always match,
         # whereas we want it to be used only if nothing else matches.
         #print STDERR "Ruleset: Storing Defaults($keyword) = $internalvalue\n";
-        $Defaults{$keyword} = $internalvalue;
-        next;
-      }
+        #$Defaults{$keyword} = $internalvalue;
+        #next;
+      #}
       # It is a valid value, so use it and store it
       my $record = join("\0", $fromto, $ruletype, $regexp, $internalvalue);
       push @{$RuleScalars{$keyword}}, $record;


--- lib/perl5/MailScanner/EximDiskStore.pm      13 May 2003 17:32:25 -0000      1.1.1.5
+++ lib/perl5/MailScanner/EximDiskStore.pm      21 Jul 2003 18:05:01 -0000      1.14
@@ -320,8 +321,8 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
-
+  my($body,$max) = @_;
+  my $size = 0;
   my $dh = $this->{indhandle};

   seek($dh, 0, 0); # Rewind the file
@@ -329,10 +330,11 @@
   my $line = <$dh>;
   # FIXME: check that id is correct here

-  while(<$dh>) {
+  while(defined <$dh> and $size < $max) {
     # End of line characters are already there, so don't add them
     #push @{$body}, $_ . "\n";
     push @{$body}, $_;
+    $size += length $_;
   }
 }


--- lib/perl5/MailScanner/PFDiskStore.pm        4 Jul 2003 18:08:28 -0000       1.1.1.3
+++ lib/perl5/MailScanner/PFDiskStore.pm        21 Jul 2003 18:05:01 -0000      1.2
@@ -381,14 +382,16 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
+  my($body,$max) = @_;
+  my $size = 0;

   my $b= Body->new( $this->{hdpath} );
   if ($b) {
     $b->Start();
     my $line;
-    while(defined($line = $b->Next())) {
+    while(defined($line = $b->Next()) and $size < $max) {
       push @{$body}, $line . "\n";
+      $size += length $line + 1;
     }
     $b->Done();
   }

--- lib/perl5/MailScanner/SMDiskStore.pm        4 Jul 2003 18:08:28 -0000       1.1.1.7
+++ lib/perl5/MailScanner/SMDiskStore.pm        21 Jul 2003 18:05:01 -0000      1.14
@@ -285,15 +286,17 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
-  my($dh) = $this->{indhandle};
+  my($body,$max) = @_;
+  my $size = 0;
+  my $dh = $this->{indhandle};

   seek($dh, 0, 0); # Rewind the file

-  while(<$dh>) {
+  while(defined <$dh> and $size < $max) {
     # End of line characters are already there, so don't add them
     #push @{$body}, $_ . "\n";
     push @{$body}, $_;
+    $size += length $_;
   }
 }


--- lib/perl5/MailScanner/ZMDiskStore.pm        4 Jul 2003 18:08:28 -0000       1.1.1.3
+++ lib/perl5/MailScanner/ZMDiskStore.pm        21 Jul 2003 18:05:01 -0000      1.2
@@ -291,13 +292,15 @@
 #REVISO LEOH
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
+  my($body,$max) = @_;
+  my $size = 0;

   my $b= Body->new( $this->{hdpath} );
   $b->Start();
   my $line;
-  while( $line= $b->Next() ) {
+  while(defined($line = $b->Next()) and $size < $max) {
     push @{$body}, $line;
+    $size += length $line;
   }
   $b->Done();
 }


--- lib/perl5/MailScanner/SA.pm 4 Jul 2003 18:08:28 -0000       1.1.1.9
+++ lib/perl5/MailScanner/SA.pm 21 Jul 2003 18:05:01 -0000      1.19
@@ -160,10 +161,7 @@
 # Do the SpamAssassin checks on the passed in message
 sub Checks {
   my $message = shift;
-
-  my($dfhandle);
-  my($dfilename, $dfile, $dsize, @WholeMessage, $SAResult, $SAHitList);
-  my($HighScoring, $SAScore);
+  my(@WholeMessage, $SAResult, $SAHitList, $HighScoring, $SAScore);

   # Bail out and fake a miss if too many consecutive SA checks failed
   my $maxfailures = MailScanner::Config::Value('maxspamassassintimeouts');
@@ -174,7 +172,7 @@
   # attempts, then disable it completely.
   if ($maxfailures>0) {
     if ($safailures>=2*$maxfailures) {
-      return (0,0,
+      return (-1,0,
         sprintf(MailScanner::Config::LanguageValue($message,'sadisabled'),
         2*$maxfailures), 0);
     } elsif ($safailures>$maxfailures) {
@@ -195,9 +193,13 @@
        # LEOH 26/03/2003 We do not always have dpath file, so we ask to
   #                 the store module the size
   # $dsize = (stat($message->{store}{dpath}))[7];
-  $dsize = $message->{store}->dsize();
-  return (0,0, MailScanner::Config::LanguageValue($message,'satoolarge'), 0)
-    if $dsize > MailScanner::Config::Value('maxspamassassinsize');
+  #$dsize = $message->{store}->dsize();
+  #$dmax = MailScanner::Config::Value('maxspamassassinsize');
+  #return (-1,0, MailScanner::Config::LanguageValue($message,'satoolarge'), 0)
+  #  if $dsize > MailScanner::Config::Value('maxspamassassinsize');
+  #MailScanner::Log::InfoLog("Truncating large message %s for SpamAssassin",
+  #                          $message->{id})
+  #  if $dsize > $dmax and MailScanner::Config::Value('logspam');

   # Construct the array of lines of the header and body of the message
   # JKF 30/1/2002 Don't chop off the line endings. Thanks to Andreas Piper
@@ -208,10 +210,11 @@
   #}
   @WholeMessage = $global::MS->{mta}->OriginalMsgHeaders($message, "\n");
   #print STDERR "Headers are : " . join(', ', @WholeMessage) . "\n";
-  return (0,0, MailScanner::Config::LanguageValue($message, 'sanoheaders'), 0)
+  return (-1,0, MailScanner::Config::LanguageValue($message, 'sanoheaders'), 0)
     unless @WholeMessage;
   push(@WholeMessage, "\n");
-  $message->{store}->ReadBody(\@WholeMessage);
+  $message->{store}->ReadBody(\@WholeMessage,
+                        MailScanner::Config::Value('maxspamassassinsize'));

   #print STDERR "Whole message is this:\n";
   #print STDERR "----------------------\n";
@@ -319,9 +322,9 @@
   # Construct the hit-list including the score we got.
   $SAReqHits = MailScanner::Config::Value('reqspamassassinscore',$Message)+0.0;
   $SAHitList = MailScanner::Config::LanguageValue($Message, 'score') . '=' .
-               ($SAHits+0.0) . ', ' .
+               ($SAHits+0.0) . ($SAReqHits ? ', ' .
                MailScanner::Config::LanguageValue($Message, 'required') .' ' .
-               $SAReqHits . ($SAHitList?", $SAHitList":'');
+               $SAReqHits : '') . ($SAHitList?", $SAHitList":'');

   # Note to self: I only close the KID in the parent, not in the child.



--- lib/perl5/MailScanner/Message.pm    4 Jul 2003 18:08:28 -0000       1.1.1.7
+++ lib/perl5/MailScanner/Message.pm    8 Jul 2003 16:49:49 -0000       1.17
@@ -81,7 +82,7 @@
 # $isrblspam            set by IsSpam
 # $ishigh               set by IsSpam
 # $sascore             set by IsSpam
-# $spamreport           set by IsSpam
+# $spamreport           set by MessageBatch::SpamChecks and IsSpam
 # $deleted             set by delivery functions
 # $headerspath          set by WriterHeaderFile # file is read-only
 # $cantparse           set by Explode
@@ -257,6 +258,7 @@
   my $RBLsaysspam   = 0;
   my $rblcounter    = 0;
   my $LogSpam = MailScanner::Config::Value('logspam');
+  my $LogNonSpam = MailScanner::Config::Value('lognonspam');
   my $LocalSpamText = MailScanner::Config::LanguageValue($this, 'spam');

   # Construct a pretty list of all the unique domain names for logging
@@ -269,12 +271,11 @@
   # $spamwhitelisted      set by IsSpam
   # $isspam               set by IsSpam
   # $ishigh               set by IsSpam
-  # $spamreport           set by IsSpam
+  # $spamreport           set by MessageBatch::SpamChecks and updated here

   $this->{spamwhitelisted} = 0;
   $this->{isspam} = 0;
   $this->{ishigh} = 0;
-  $this->{spamreport} = "";
   $this->{sascore} = 0;

   ## If it's a blacklisted address, don't bother doing any checks at all
@@ -366,10 +367,17 @@
   my $SAHighScoring = 0;
   my $saheader = "";
   my $sascore  = 0;
+  my $scanned  = 1;
   ($SAsaysspam, $SAHighScoring, $saheader, $sascore)
     = MailScanner::SA::Checks($this);
   $this->{sascore} = $sascore; # Save the actual figure for use later...

+  # not scanned after all?
+  if ($SAsaysspam < 0) {
+      $scanned = 0;
+      $SAsaysspam = 0;
+  }
+
   # Fix the return values
   $SAsaysspam = 0 unless $saheader;    # Solve bug with empty SAreports
   $saheader =~ s/\s+$//g if $saheader; # Solve bug with trailing space
@@ -385,8 +393,11 @@
     $this->{issaspam} = $SAsaysspam;
   }

-  # If it's spam...
-  if ($this->{isspam}) {
+  # it didn't scan the message after all?
+  if (not $scanned) {
+      $spamheader = MailScanner::Config::Value('unscannedheader', $this)
+         . ", $saheader";
+  } elsif ($this->{isspam}) {
     #print STDERR "It is spam\nInclude SA = $includesaheader\n";
     #print STDERR "SAHeader = $saheader\n";
     $spamheader = $rblspamheader;
@@ -421,7 +432,7 @@
   }

   # Do the spam logging here so we can log high-scoring spam too
-  if ($LogSpam && $this->{isspam}) {
+  if (($LogSpam && $this->{isspam}) || $LogNonSpam) {
     my $ReportText = $spamheader;
     $ReportText =~ s/\s+/ /sg;
     MailScanner::Log::InfoLog("Message %s from %s (%s) to %s is %s",
@@ -2098,7 +2109,7 @@

   # Create the top-level MIME entity, just the headers
   $top = MIME::Entity->build(Type       => 'multipart/mixed',
-                             From       => "MailScanner <$localpostmaster>",
+                             From       => $from,
                              To         => $to,
                              Subject    => $newsubject,
                              'X-Mailer' => 'MailScanner',


--- lib/perl5/MailScanner/ConfigDefs.pl 4 Jul 2003 18:08:27 -0000       1.1.1.7
+++ lib/perl5/MailScanner/ConfigDefs.pl 10 Jul 2003 15:00:41 -0000      1.12
@@ -85,6 +86,8 @@
 lastlookup                     = alwayslookeduplast
 listsascores                    = includescoresinspamassassinreport
 logfacility                    = syslogfacility
+logformtags                    = loghtmlformtags
+logobjecttags                  = logobjectcodebasetags
 maxdirtybytes                  = maxunsafebytesperscan
 maxdirtymessages               = maxunsafemessagesperscan
 maxmessagesize                 = maximummessagesize
@@ -140,6 +143,8 @@
 debugspamassassin      0       no      0       yes     1
 deliverinbackground    1       no      0       yes     1
 logspam                        1       no      0       yes     1
+lognonspam             0       no      0       yes     1
+logmessageids          0       no      0       yes     1
 expandtnef             1       no      0       yes     1
 showscanner            0       no      0       yes     1
 spamassassinautowhitelist 1    no      0       yes     1
@@ -223,6 +228,8 @@
 ListSAScores           0       no      0       yes     1
 #LoadSpamAssassin      0       no      0       yes     1
 LogIFrameTags          0       no      0       yes     1
+LogFormTags            0       no      0       yes     1
+LogObjectTags          0       no      0       yes     1
 LogPermittedFilenames  0       no      0       yes     1
 LogPermittedFiletypes  0       no      0       yes     1
 MultipleHeaders                append  append  append  replace replace add     add


--- lib/perl5/MailScanner/MessageBatch.pm       4 Jul 2003 18:08:28 -0000       1.1.1.6
+++ lib/perl5/MailScanner/MessageBatch.pm       22 Jul 2003 09:45:04 -0000      1.11
@@ -140,6 +141,7 @@

   my($id, $message);
   my $counter = 0;
+  my $highcount = 0;

   #print STDERR "Starting spam checks\n";

@@ -148,10 +150,16 @@

   while(($id, $message) = each %{$this->{messages}}) {
     next if $message->{deleted};
+
+    # set default value in case we always add a spam report header
+    $message->{spamreport} =
+       MailScanner::Config::Value('unscannedheader', $this);
+
     next unless MailScanner::Config::Value('spamchecks', $message);

     #print STDERR "Spam checks for $id\n";
     $counter += $message->IsSpam();
+    $highcount += $message->{ishigh};

     if (!MailScanner::Config::Value('spamdetail', $message)) {
       $message->{spamreport} = MailScanner::Config::LanguageValue($message,
@@ -161,6 +169,8 @@
   }
   MailScanner::Log::InfoLog("Spam Checks: Found $counter spam messages")
     if $counter>0;
+  MailScanner::Log::InfoLog("Spam Checks: Found $highcount high-scoring spam messages")
+    if $highcount>0;
   #print STDERR "$counter messages were spam\n";
 }

@@ -231,9 +241,13 @@
       # or the HTML stripping.
       if ($message->{bodymodified}) {
         $message->DeliverModifiedBody('unscannedheader');
+        MailScanner::Log::InfoLog("Delivered modified message $id")
+             if MailScanner::Config::Value('logmessageids');
       } else {
         $OutQ = MailScanner::Config::Value('outqueuedir', $message);
         $message->DeliverUnscanned($OutQ);
+        MailScanner::Log::InfoLog("Delivered unscanned message $id")
+             if MailScanner::Config::Value('logmessageids');
       }
       $message->{deleted} = 1; # This marks it for purging from disk
       push @messages, $message;
@@ -274,12 +288,12 @@
   MailScanner::Log::InfoLog("Virus Scanning: Found %d viruses", $viruses+0)
     if defined $viruses && $viruses>0;

-  #MailScanner::Log::InfoLog("Other Checks: Starting");
+  MailScanner::Log::InfoLog("Other Checks: Starting");
   my $others  = MailScanner::SweepOther::ScanBatch($this, 'scan');
   MailScanner::Log::InfoLog("Other Checks: Found %d problems", $others+0)
     if defined $others && $others>0;

-  #MailScanner::Log::InfoLog("Content Checks: Starting");
+  MailScanner::Log::InfoLog("Content Checks: Starting");
   my $content  = MailScanner::SweepContent::ScanBatch($this, 'scan');
   MailScanner::Log::InfoLog("Content Checks: Found %d problems", $content+0)
     if defined $content && $content>0;
@@ -465,6 +479,8 @@
     next if $message->{infected};
     #print STDERR "Delivering uninfected message $id\n";
     $message->DeliverUninfected();
+    MailScanner::Log::InfoLog("Delivered uninfected message $id")
+           if MailScanner::Config::Value('logmessageids');
     $message->{deleted} = 1;
     push @messages, $message;
   }
@@ -531,6 +547,11 @@
       $message->DeliverCleaned();
       #print STDERR "Deleting silent-infected message " . $message->{id} . "\n";
       push @messages, $message;
+      MailScanner::Log::InfoLog("Delivering message $id with silent virus")
+          if MailScanner::Config::Value('logmessageids');
+    } else {
+      MailScanner::Log::InfoLog("DISCARDED message $id with silent virus")
+          if MailScanner::Config::Value('logmessageids');
     }
     $message->{deleted} = 1;
     $message->{stillwarn} = 1;


--- lib/perl5/MailScanner/Exim.pm       4 Jul 2003 18:08:28 -0000       1.1.1.8
+++ lib/perl5/MailScanner/Exim.pm       8 Jul 2003 16:25:12 -0000       1.20
@@ -1320,6 +1321,8 @@
        $HitLimit4 = 1
          if $DirtyBytes>=$MaxDirtyB;
        $newmessage->WriteHeaderFile(); # Write the file of headers
+       MailScanner::Log::InfoLog("New Message: $id to be scanned")
+               if MailScanner::Config::Value('logmessageids');
       } else {
        $newmessage->NeedsScanning(0);
        $CleanMsgs++;
@@ -1329,6 +1332,8 @@
        $HitLimit2 = 1
          if $CleanBytes>=$MaxCleanB;
        $newmessage->WriteHeaderFile(); # Write the file of headers
+       MailScanner::Log::InfoLog("New Message: $id to be forwarded")
+               if MailScanner::Config::Value('logmessageids');
       }
     }



--- lib/perl5/MailScanner/SweepContent.pm       4 Jul 2003 18:08:28 -0000       1.1.1.4
+++ lib/perl5/MailScanner/SweepContent.pm       22 Jul 2003 13:56:28 -0000      1.7
@@ -75,7 +76,7 @@
   # Can play with the MIME headers of a message using $mime.

   my($id,$message,$ent,$partialcount,$allowiframes,$allowobjects,$allowforms);
-  my($stripdangerous, $counter, $stripcounter);
+  my($logiframes,$logobjects,$logforms,$stripdangerous,$counter,$stripcounter);
   $counter = 0;
   $stripcounter = 0; # No. of messages we need to strip HTML from

@@ -114,7 +115,7 @@
     }

     # Search for Microsoft-specific attacks
-    # Disallow both by default. Allow them only if all addresses agree.
+    # Disallow by default. Allow them only if all addresses agree.
     $allowiframes = 0;
     $allowobjects = 0;
     $allowforms   = 0;
@@ -124,10 +125,15 @@
       if MailScanner::Config::Value('allowobjecttags', $message) =~ /^[1\s]+$/;
     $allowforms   = 1
       if MailScanner::Config::Value('allowformtags', $message) =~ /^[1\s]+$/;
+    # Log if any address requires that.
+    $logiframes  = MailScanner::Config::Value('logiframetags', $message);
+    $logobjects   = MailScanner::Config::Value('logobjecttags', $message);
+    $logforms      = MailScanner::Config::Value('logformtags', $message);
     $stripdangerous = MailScanner::Config::Value('stripdangeroustags',$message);
     # Shortcut the check completely if they want to allow everything
-    # and are not converting nasty tags to text
-    if (!($allowiframes && $allowforms && $allowobjects && !$stripdangerous) &&
+    # and are not converting nasty tags to text or logging
+    if (!($allowiframes && $allowforms && $allowobjects && !$stripdangerous
+         && !$logiframes && !$logobjects && !$logforms) &&
         FindHTMLExploits($message, $id, $ent, $allowiframes,
                          $allowobjects, $allowforms, $stripdangerous)) {
       $counter++;
@@ -356,10 +362,10 @@
       }
     }
     if ($formfound) {
-      ## Log the <IFrame>
-      #MailScanner::Log::InfoLog("HTML Form tag found in message %s from %s",
-      #  $id, $message->{from})
-      #  if MailScanner::Config::Value('logformtags', $message);
+      # Log the <Form>
+      MailScanner::Log::InfoLog("HTML Form tag found in message %s from %s",
+        $id, $message->{from})
+        if MailScanner::Config::Value('logformtags', $message);
       # Mark the message
       if ($allowforms) {
         if ($stripdangerous) {
@@ -377,6 +383,10 @@
       }
     }
     if ($codebasefound) {
+      # Log the object codebase
+      MailScanner::Log::InfoLog("HTML Object codebase tag found ".
+        "in message %s from %s", $id, $message->{from})
+        if MailScanner::Config::Value('logobjecttags', $message);
       if ($allowobjects) {
         if ($stripdangerous) {
           $message->{needsstripping} = 1;


--- lib/perl5/MailScanner/SweepOther.pm 4 Jul 2003 18:08:28 -0000       1.1.1.6
+++ lib/perl5/MailScanner/SweepOther.pm 4 Jul 2003 19:13:31 -0000       1.6
@@ -195,19 +196,20 @@
           $MatchFound = 1;
           if ($allowdeny eq 'deny') {
             # It's a rejection rule, so log the error.
-            MailScanner::Log::InfoLog("Filename Checks: %s (%s)",
-                                      $logtext, $attach);
+            MailScanner::Log::InfoLog("Filename Checks: %s (%s %s)",
+                                      $logtext, $id, $attach);
             $message->{namereports}{$safename} .= "$usertext ($safename)\n";
             $message->{nametypes}{$safename}   .= "f";
             $counter++;
             $message->{nameinfected}++;
           } else {
-            MailScanner::Log::InfoLog("Filename Checks: Allowing %s", $safename)
+            MailScanner::Log::InfoLog("Filename Checks: Allowing %s %s",
+                                     $id, $safename)
               if $LogNames;
           }
         }
-        MailScanner::Log::InfoLog("Filename Checks: Allowing %s " .
-                                  "(no rule matched)", $safename)
+        MailScanner::Log::InfoLog("Filename Checks: Allowing %s %s " .
+                                  "(no rule matched)", $id, $safename)
           if $LogNames && !$MatchFound;
       }
     }

From TGFurnish at HERFF-JONES.COM  Fri Jul 25 15:08:15 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:04 2006
Subject: Attachment vs Striphtml for tagged messages
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF8E1A29@inex1.herffjones.hj-int>

>-----Original Message-----
>From: Stijn Jonker [mailto:SJCJonker@SJC.NL]
>Sent: Tuesday, July 22, 2003 8:54 AM
>
>On Tue, 22 Jul 2003, Quentin Campbell wrote:
>> As a BTW we note that the "attachment" option works well
>> with Outlook,
>> Pine, Pegasus, etc, but in the case of Eudora the attachment
>> is opened
>> automatically when the message body is read. This is precisely the
>> opposite of what is wanted. It may well be a configurable
>> behaviour on
>> Eudora but we havn't found the option yet!

>Maybe you can help me here, i can't see to get pine to leave
>the attached
>message as it, it display the attachment here after the MailScanner
>notice. What option did you use to disable the behaviour to display the
>message inline?

And just as a "ditto", Mozilla's mail client does the same thing - displays
rfc822 message attachments inline automatically.  Except for the case where
the attachment is spam, I prefer that though - it makes it much easier to
read digests.

However, mozilla's handling of inline message attachments also is buggy imo
- attributes from the message body of the attachment (for example, font and
background colors) affect the parent message as well.

From ka at PACIFIC.NET  Fri Jul 25 17:15:37 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:04 2006
Subject: What do you monitor and alert on for your mailscanner system?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C073B@inex1.herffjones.hj-int>
References: <8FFC76593085ED4A80D3601BC41EFCDF0C073B@inex1.herffjones.hj-int>
Message-ID: <3F2157A9.9030807@pacific.net>

Furnish, Trever G wrote:

> I am wondering what the group generally monitors in order to detect problems
> with a mailscanner relay (ie things that should cause an alert to be sent to
> an admin).
>
> My system is probably a bit more isolated than most - my deployment
> (currently only testing) will *only* be intended for inbound mail filtering,
> no outbound delivery (not even for "no such user" bounces, if I can prevent
> it), so my list may not make sense in situations that handle outbound mail,
> but here are the conditions I'm planning to alert on so far - have I missed
> anything you monitor on you system?

Same here, with the exception that we have added previous 'no such user'
bounces with REJECT in sendmail access list. This keeps a lid on the
junk we are needlessly relaying to the mail hub, and the "Deferred" mail
that otherwise piles up in outgoing queues.

> Failure conditions to alert on:
> - Abnormally large inbound or outbound mailq.

Absolutely.
This is the first place some problems seem to be evident.

> - Deferred messages in the outbound mailq.  (I deliver only to an internal
> server over a lan link.)

Spam that is undeliverable (user unknown) to your mail hub will cause a
lot of "Deferred" and "Connection Refused" mail to pile up in your
outgoing gueues. We use the re-mqueue utility that comes with sendmail
to help with this issue, as well as some scripts that seek-and-destroy
these messages. That's why it's a good reason to either add all of your
users to the access db or REJECT common bad names ( previous users,
popular dictionary usernames ).

> - Deferred messages in the inbound mailq. (Not sure that even is possible.)

Never seen one. :-)

> - Old messages in the inbound or outbound mailqs (ie they haven't been
> accessed or modified in a while)

Rarely in the inbound queue, but those nasty "Deferred" and "Connection
Refused" emails will hang around for a while before sendmail deletes
them (4 days default) if you don't get them first.

> - MailScanner process count (too high or too low)

Never seen a problem with this.

> - Inbound sendmail process count.

On RedHat we do see old sendmail processes hanging around once in a
while. Not sure yet why this is..

> - Outbound sendmail queue runner (not sure how to differentiate in vs out
> yet though)

See /etc/rc.d/init.d/MailScanner if you installed via rpm. You'll see
the start sections for IN and OUT. That's a good place to get a handle
on it.

> - System unreachable via ping, smtp, http, or ssh (or whatever other methods
> are appropriate for your system)

Should have this as part of any system anyway...

> - Low disk space.

ditto.

> - High swap usage.

Avoid any. RAM is cheap.

> - High load average (especially anything nearing sendmail's deferal load
> average).

Should have this as part of any system anyway...

> - High process count.

How high is high? Never seen this be a problem. Load Avg will probably
be high before you reach "too high" a number of processes.

> - Dmesg errors (sends the dmesg output from the box to a monitoring device).

Should have this as part of any system anyway...

> - High filtering percentages (ie 100% spam).
> - Low filtering percentages (ie 10% spam).
> - Round trip of test messages - ie send a message to a bounceback address
> and expect it to return with X minutes.  Could also check to be sure a
> mailscanner header was found in the return message.

Use delay=x in maillog. It can be used to get an average & high time for
messages traveling through the system.

>
> Any suggestions for other things I could check?  If it breaks, I want to
> know *before* anyone else does. :-)
>

Security wise things can "break" too. Instead of just dmesg errors, run
a log analyzer (logwatch?) and tripwire if you have the time to
configure/update and read the reports. Logwatch will tell you what odd
error messages are showing up in the logs and tripwire will tell you if
anyone's been monkeying with your system.

Ken A.

From mailscanner at ecs.soton.ac.uk  Fri Jul 25 17:39:15 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:04 2006
Subject: Julain on Vacation?
In-Reply-To: <63155.129.80.22.133.1057587390.squirrel@tiger.dorfam.ca>
Message-ID: <5.2.1.1.2.20030725173808.06385390@imap.ecs.soton.ac.uk>

At 15:16 07/07/2003, you wrote:
>Has Julian left on his vacation yet?  I believe he said he was going to be
>gone all month without access to the list...I wonder if he'll survive?

Nearly 3 whole weeks without net access. Sheer bliss :-)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Fri Jul 25 17:41:23 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:04 2006
Subject: MS Performance
In-Reply-To: <Pine.LNX.4.44.0307091631400.9922-100000@mailbox.prolocatio n.net>
References: <67D9E7698329D411936E00508B6590B902773A10@neelix.lbsltd.co.uk>
Message-ID: <5.2.1.1.2.20030725174054.019c8d40@imap.ecs.soton.ac.uk>

At 15:32 09/07/2003, you wrote:
> > is there any chance of loosing mail by doing this if the
> > server runs out of memory??

No.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From shawn at ADVANCEDMANAGED.COM  Fri Jul 25 17:45:08 2003
From: shawn at ADVANCEDMANAGED.COM (Shawn)
Date: Thu Jan 12 21:19:04 2006
Subject: more white/black list ?s
In-Reply-To: <3F20F910.2060507@bangor.ac.uk>
Message-ID: <000601c352cc$1bbf3e30$0f00010a@station>

I just tag emails and deliver.  Obviously I could use just user specific
lists but adding a global rule would mean editing a lot of user files.
Is there an easier way?  I think my proposed way of using MS for per
user and SA for globals will work I just like things to be all in the
same place.

Also know that some users can not use the opt out feature successfully
for newsletters and such - they want to black list the newsletter. While
others want the same letter to show up without being tagged as spam.



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Martin Sapsed
Sent: Friday, July 25, 2003 2:32 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: more white/black list ?s

Shawn wrote:
> Thanks for the help so far, this list has been great.
>
> I am looking at mailscanner white\black listing now.  I want both
global
> and user specific lists. My servers are just relays.  So I if
implement
> byemail white/black lists in MailScanner and then use
> spam.assassin.prefs.conf for globals this looks like it will do what I
> want.  Is there a better way?
>
> Looks like ill have to implement the breaking up of recipients also.

I guess it depends on what options you want to use when you find spam.
Personally I think the simplest is to score it all, tag it at 2 levels
(striphtml on the higher one) and then give the user tools to deal with
it as they want.

I guess if you want to look at bouncing or deleteing or stuff like that
then you may need to break things up...

Cheers,

Martin

--
Martin Sapsed
Information Services               "Who do you say I am?"
University of Wales, Bangor             Jesus of Nazareth

From rzewnickie at RFA.ORG  Fri Jul 25 17:56:29 2003
From: rzewnickie at RFA.ORG (Eric Dantan Rzewnicki)
Date: Thu Jan 12 21:19:04 2006
Subject: uvscan on debian
Message-ID: <20030725165629.GA9680@rfa.org>

In case there are any other debian users working on setting up
mailscanner and using McAfee/NAI uvscan for linux, I just added this to
the FAQ-O-MATIC:

The old outdated version of libstdc++.so.2.8.0 against which uvscan for
linux v.4240 is compiled is available in Debian's old stable version,
potato. At your favorite debian archive mirror the path is:

debian/dists/potato/main/binary-i386/oldlibs/libstdc++2.8_2.90.29-2.deb

download the .deb and install it with dpkg -i libstdc++2.8_2.90.29-2.deb

uvscan will then run as expected.

It sucks that NAI is using such an ancient library version. How are we
supposed to trust a binary intended to be used as a security enhancement
when it is using a library so old?

From richard.lush at NTLWORLD.COM  Fri Jul 25 20:05:33 2003
From: richard.lush at NTLWORLD.COM (Richard Lush)
Date: Thu Jan 12 21:19:04 2006
Subject: MailScanner Webmin Module 0.7 Beta Released
Message-ID: <8C4A83966C27354C928048C4A1620EF8C0EF@lando.rebel.com>

Hi All,
 
Apologies for the lateness of this release - I've just swapped jobs and things are rather hectic at the moment.
 
Anyway, I am pleased to announce the release of Version 0.7 Beta of the MailScanner webmin module.
 
It can be downloaded from http://lushsoft.dyndns.org/mailscanner-webmin
 
Regards
 
Richard


From nejc.skoberne at guest.arnes.si  Fri Jul 25 20:47:05 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:19:04 2006
Subject: MS vs. Amavis
Message-ID: <786653281.20030725214705@guest.arnes.si>

Hi.

Can someone who used both virusscanners do a quick comparation between
these scanners - which is better for which function and why.

Thanks a lot!

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From rzewnickie at RFA.ORG  Fri Jul 25 20:59:23 2003
From: rzewnickie at RFA.ORG (Eric Dantan Rzewnicki)
Date: Thu Jan 12 21:19:04 2006
Subject: MS vs. Amavis
In-Reply-To: <786653281.20030725214705@guest.arnes.si>
References: <786653281.20030725214705@guest.arnes.si>
Message-ID: <20030725195923.GC9680@rfa.org>

I'm in the process of switching from amavisd to MS. In no particular
order, here are some of the reasons:

-amavis development is fragmented into various forks of the project.
 Along with that comes fragmentation of the user/support community.
-amavis doesn't do spam filtering
-amavis AFAIK calls an instance of your virus scanner for every single
 message whereas MS gathers mail up into batches and invokes the virus
 scanner for each batch.
-MS focuses on scanning mail. amavis tries to do smtp. it seems better
 to leave that to the MTA

Just a few reasons we're looking at switching. I'm sure others will have
more.

-Eric Rz.

On Fri 25/07/2003 21:47:05, Nejc Skoberne wrote:
> Hi.
>
> Can someone who used both virusscanners do a quick comparation between
> these scanners - which is better for which function and why.
>
> Thanks a lot!
>
> --
> Nejc Skoberne
> Grajska 5
> SI-5220 Tolmin
> E-mail: nejc.skoberne@guest.arnes.si

From jrudd at UCSC.EDU  Sat Jul 26 00:27:42 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
In-Reply-To: <5.2.1.1.0.20030724190341.01abbe50@xanadu.evi-inc.com>
Message-ID: <9665E3A8-BEF7-11D7-B951-003065F939FE@ucsc.edu>

On Thursday, Jul 24, 2003, at 16:16 US/Pacific, Matt Kettler wrote:
>
> It's also pretty well known that the ruleset in the 2.5x family is
> considerably weaker than the later part of the 2.4x family. But the
> ruleset
> weaknesses are largely made up for by the power of bayes, and are
> mostly a
> result of the developers focusing on getting bayes added instead of new
> rules while writing 2.50. If you're going to use 2.5x, train your
> bayes DB,
> it helps a lot.
>

I wonder when this is going to be resolved.  They haven't released 2.60
yet, but from things I've seen, it looks like 2.60 is already obsolete
(spammers have already trained themselves to it).  When will the base
rule system go back to being a strong set of its own that doesn't
depend upon you using bayes (since that's not really an option here)?

It looks to me like 2.55 is still rather weak, but that's because
MailScanner seems to have switched to defaulting to use_bayes, where
the last time I checked it defaulted to not using it.  I've just turned
it back off, to see if that helps my scores.

From ctrudeau at BELLSOUTH.NET  Sat Jul 26 01:07:35 2003
From: ctrudeau at BELLSOUTH.NET (Chris Trudeau)
Date: Thu Jan 12 21:19:04 2006
Subject: MS vs. Amavis
References: <786653281.20030725214705@guest.arnes.si> 
            <20030725195923.GC9680@rfa.org>
Message-ID: <00e001c35309$eb2d2000$23c8a8c0@SERV>

> -amavis development is fragmented into various forks of the project.

Amavisd-new is the most stable of the three general forks mentioned above,
while fragemented, amavisd is extremely well supported by the communitiy
which includes several notable names.

>  Along with that comes fragmentation of the user/support community.

While I somewhat agree, the support has been stellar from all included in
Amavisd-new mailings.

> -amavis doesn't do spam filtering

Neither does MS.  They both leverage outside support of SA which with all
external plugins is extremely accurate and configurable.

> -amavis AFAIK calls an instance of your virus scanner for every single
>  message whereas MS gathers mail up into batches and invokes the virus
>  scanner for each batch.

This is not entirely accurate.  Amavisd-new does support several of the
virus scanner which can run in daemon mode including clam and sophos to
mention a few.  While MS does a batched process, that could argueably NOT be
better as there COULD be performance related issues with batched jobs no
matter how long the timeout is between "checks" of the disk...although it
DOES appear to handle failures by MailScanner processes well as mail can
stillbe received, just not delivered. (depending on your MTA)

> -MS focuses on scanning mail. amavis tries to do smtp. it seems better
>  to leave that to the MTA

Seems a bit paritsan of an answer, the daemon that handles the listening for
mail is really small, slick and conforms with the applicable RFCs relative
to writing to disk and handling of messages...(from what I can tell)

>
> Just a few reasons we're looking at switching. I'm sure others will have
> more.

I am actually using both currently in test.  MS is handling initial receipt
of messages, hands them off to an amavisd-new implementation.  SA scores are
alomst identical and the accuracy is great.  I have had some problems with
MS dying on me though and have not had to restart amavisd yet...HOWEVER...

The configurable nature of MS with rules based processing is STELLAR.  I can
easily say that my need to support several domains with completely different
requirements is achieved with MailScanner hands down.  I would rather
seperate SA prefs for each domain...but that is antoher topic altogether.  I
like them both, but because of the rules-based config, I will probably go
with MailScanner.

I STRONGLY recommend trying both and determining which REALLY meets your
needs...they both have great strong qualities.

CT

From marc at CALIBREDIGITAL.COM  Fri Jul 25 20:58:19 2003
From: marc at CALIBREDIGITAL.COM (=?ISO-8859-1?Q?Marc Anthony P. Barrette=20?=)
Date: Thu Jan 12 21:19:04 2006
Subject: =?ISO-8859-1?Q?Automated Reply from Marc Anthony P. Barrette <marc>?=
Message-ID: <200307252358.h6PNwJ928101@co.calibre-dd.com>

I will be away from the studio attending SIGGRAPH Conference from July 26th. I will be returning August 6th. Please direct your immediate concerns to Pete Denomme peted@calibredigital.com for business needs and Technical to Greg Whynott gregw@calibredigital.com

Thanks in advance,

From ctrudeau at BELLSOUTH.NET  Sat Jul 26 01:21:42 2003
From: ctrudeau at BELLSOUTH.NET (Chris Trudeau)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
References: <9665E3A8-BEF7-11D7-B951-003065F939FE@ucsc.edu>
Message-ID: <01f201c3530b$e3833b80$23c8a8c0@SERV>

> I wonder when this is going to be resolved.  They haven't released 2.60
> yet, but from things I've seen, it looks like 2.60 is already obsolete
> (spammers have already trained themselves to it).  When will the base
> rule system go back to being a strong set of its own that doesn't
> depend upon you using bayes (since that's not really an option here)?

Why is this not an option???....learning the engine will yield a sizable
benefit even using pulicly available corpus if getting users to assist in
training is impossible.  I don't mean to beat the BYES drum too hard, but
you will be hard pressed to find a more effective solution than a bayes
based engine that evaluates multpile words, combined with the use of DCC and
razor as well as an integrated scoring system that is "tweakable" like SA.

> It looks to me like 2.55 is still rather weak, but that's because
> MailScanner seems to have switched to defaulting to use_bayes, where
> the last time I checked it defaulted to not using it.  I've just turned
> it back off, to see if that helps my scores.

Perhaps it will...the guys on the SA list are super helpful too...just a
thought.

CT

From jrudd at UCSC.EDU  Sat Jul 26 02:15:03 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
In-Reply-To: <01f201c3530b$e3833b80$23c8a8c0@SERV>
Message-ID: <95B70A84-BF06-11D7-B951-003065F939FE@ucsc.edu>

On Friday, Jul 25, 2003, at 17:21 US/Pacific, Chris Trudeau wrote:

>
>> I wonder when this is going to be resolved.  They haven't released
>> 2.60
>> yet, but from things I've seen, it looks like 2.60 is already obsolete
>> (spammers have already trained themselves to it).  When will the base
>> rule system go back to being a strong set of its own that doesn't
>> depend upon you using bayes (since that's not really an option here)?
>
> Why is this not an option???....

What process would you suggest I use for getting message feedback from
20,000 users when we don't have individual config files/directories for
users on our mail servers (and even if we did, how would that interact
with messages to multiple users or mailing lists, neither of which are
expanded before they get to mailscanner), we don't have anyone on staff
who can review user submissions of false positives/false negatives (we
are NOT going to blindly accept it when a user says 'this should have
been spam', partially because users will not always agree upon the
issue), and the things that auto-learning handles aren't the things I'm
worried about (auto-learning basically strengthens the system's resolve
about high scoring spam ... what I'm concerned about is changing the
scores of low-scoring spam; when I call sa-learn on my home machine, I
never call it on high scoring spam messages, for example -- I call it
upon messages that were _lower_ than my threshold)?

I just don't see how bayes would fit into our situation.

Down the road, I'm looking in to how to apply something I use at home
(where I have a "learn" and an "unlearn" folder, and my home mail
server automatically runs through those folders every night at 5am,
learning about things it did wrong) to our mail servers ... but at home
I've got _2_ users and at work I've got 10,000 times that many users.
At home, spamassassin is called out of my .forward, so there's never
confusion about whose bayes database to use, and there aren't any
non-user recipients like mailing lists.

I'm not sure that the mechanism will translate well to my production
servers at work.  There's the issue of server load as it tries to
update 20,000 bayes databases (hopefully the low-usage window will be
long enough to let all of those updates happen before usage picks  back
up), there's adding a front end that expands all messages to 1 end user
recipient per message before it gets submitted to mailscanner (which
means more work for mailscanner, as mailscanner will now see 10
messages instead of 1, if the message has 10 recipients), and there's
the issue of where to put the user data files.  If it does, then using
bayes will make sense.  Otherwise, I just don't see how it will fit my
environment.

From batucker at ICNET.NET  Sat Jul 26 02:57:27 2003
From: batucker at ICNET.NET (Brady A. Tucker)
Date: Thu Jan 12 21:19:04 2006
Subject: Whitelist for a single user...
In-Reply-To: <5.2.1.1.2.20030725174054.019c8d40@imap.ecs.soton.ac.uk>
Message-ID: <ILEGLLEHLGEPGCEHMOKNAEFJHIAD.batucker@icnet.net>

Is there a way to for a whitelist rule to apply to only a single local
address... like

FromAndTo:  Email1@Somewhere.com  MyUser@mydomain.com   yes

So that Email1@somewhere.com is only whitelisted for MyUser@mydomain.com,
for anyone else the regular scan/spam check process would apply.

The reason I want to do this is that we currently maintain a list of
addresses in a db,  that db is parsed output to our three mailservers many
times a day to the spam.whitelist.rules and spam.blacklist.rules.   What I
want to do is make this available to my users (within their secured login
area) so that they can administer their own whitelist WITHOUT calling our
techs.   However,  invariably one bonehead is going to put  From: * in
there, or whitelist other addresses the other 30,000+ email boxes don't want
whitelisted.  I would therefore like to be able to limit it to only that
user via their email address (which is known from the login they used to get
into the 'customer only' area).

                                      Brady A. Tucker
                                      Internet Complete! inc.
                                      http://www.icnet.net

From ctrudeau at BELLSOUTH.NET  Sat Jul 26 04:56:47 2003
From: ctrudeau at BELLSOUTH.NET (Chris Trudeau)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
References: <95B70A84-BF06-11D7-B951-003065F939FE@ucsc.edu>
Message-ID: <053f01c35329$efdc42a0$23c8a8c0@SERV>

> >
> > Why is this not an option???....
>
> What process would you suggest I use for getting message feedback from
> 20,000 users when we don't have individual config files/directories for
> users on our mail servers (and even if we did, how would that interact
> with messages to multiple users or mailing lists, neither of which are
> expanded before they get to mailscanner), we don't have anyone on staff
> who can review user submissions of false positives/false negatives (we
> are NOT going to blindly accept it when a user says 'this should have
> been spam', partially because users will not always agree upon the
> issue), and the things that auto-learning handles aren't the things I'm
> worried about (auto-learning basically strengthens the system's resolve
> about high scoring spam ... what I'm concerned about is changing the
> scores of low-scoring spam; when I call sa-learn on my home machine, I
> never call it on high scoring spam messages, for example -- I call it
> upon messages that were _lower_ than my threshold)?
>

WOW...ok...one at a time...I don't see why you would need feedback from 20K
employees.  If the challenge you are concerned with is stopping a LARGE
percentage of SPAM, then using a public corpus of spam to train a bayes
enabled SA implementation would do just that.  WITHOUT having to have
individual user interaction with anything..  With that said...creating a
bayes database doesn't HAVE to be user specific...as a matter of fact, you
are asking for a major headache to even think about it..  Create a single
one that is "relatively" accurate and slow the river to a stream as a first
step  :)

To deal with your multiple user issue is easy,create a dedicated email "hop"
with a standalone server (or cluster for you perhaps) that handles all email
inbound and/or outbound....your mailstore will send email to and from the
Internet (no matter how many users are included in the distribution) as
seperate messages...besides, if your organization is that large, I'm
guessing that you likely are not as concerned about SPAM going from user to
user on your mail infrastructure, you are likely more concerned about
inbound email from the Internet (or other untrusted network entity)

If there is nobody on staff to handle submissions of
false-positives/false-negatives, I'm curious how you might plan to handle
this WITHOUT a 90% accuracy ranking.  if you are concerned with users
polluting the bayes database, then simply don't allow them to learn messages
into it.  Read "A Plan for Spam" by Paul Graham (
http://www.paulgraham.com/spam.html ).  He very simplistically outlines the
concept and the math makes sense.  Users would have to do some SERIOUS work
to pollute a bayes database to the point where it causes a single false
positive, but again...if you're worried, then don't allow it..."teach" the
engine on a new public corpus once per month...and your accuracy will be
maintained pretty well.

If the auto-learning things aren't what you're worried about then, I'm
puzzled about why you mention it...I'm not sure I understand your concern
about low scoring SPAM...the bayes scores as part of SA are only a PART of
the overall score. (which is exaclty the right way to do it by the way)...so
if you are concerned about the bayes score affecting low (or high) scoring
spam the wrong way, then throttle the score for bayes and leverage the rest
of SA.


> I just don't see how bayes would fit into our situation.
>
> Down the road, I'm looking in to how to apply something I use at home
> (where I have a "learn" and an "unlearn" folder, and my home mail
> server automatically runs through those folders every night at 5am,
> learning about things it did wrong) to our mail servers ... but at home
> I've got _2_ users and at work I've got 10,000 times that many users.
> At home, spamassassin is called out of my .forward, so there's never
> confusion about whose bayes database to use, and there aren't any
> non-user recipients like mailing lists.
>
Your concern is valid.  I simply think that SA would solve a big part of
your problems if it were done in a "gateway" configuration.  Meaning, it
routes all mail internal and external, applies policy and checks for SPAM
with a single static bayes database.  You are doing things exactly right at
home making granular tuning and learning user-by-user...but the large
percentage of the benefit can be recognized by the greater group by using a
single bayes database that get supdated froma public corpus once per month
(or week as it is lekely easy to automate)  Since you KNOW what's being
learned in is definietly SPAM, it simply re-inforces the concetps in Paul's
paper.



> I'm not sure that the mechanism will translate well to my production
> servers at work.  There's the issue of server load as it tries to
> update 20,000 bayes databases (hopefully the low-usage window will be
> long enough to let all of those updates happen before usage picks  back
> up), there's adding a front end that expands all messages to 1 end user
> recipient per message before it gets submitted to mailscanner (which
> means more work for mailscanner, as mailscanner will now see 10
> messages instead of 1, if the message has 10 recipients), and there's
> the issue of where to put the user data files.  If it does, then using
> bayes will make sense.  Otherwise, I just don't see how it will fit my
> environment.

Load becomes less of an issue (doesn't totally go away) as you don't have
20,000 bayes databases, however a gateway implementation for a 20K mail
infrastructure may have to be relatively big...but instead of handling 20K
bayes databases...you are only really worrying about 1.  In addition, a
gateway is only going to scan the message as it sees it once...if you think
of the big picture, consider this:

a SPAm message comes into the gateway...if its addressed to 20 different
people SA only needs to scan it once with its OWN bayes db...it is either
SPAM or not...it then s ends the message on to your mail server
infrastructure for final delivery...

just an idea...seems an easy problem to solve.

:)

CT

From jrudd at UCSC.EDU  Sat Jul 26 07:33:36 2003
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:19:04 2006
Subject: More spam after spamassain upgrade
In-Reply-To: <053f01c35329$efdc42a0$23c8a8c0@SERV>
Message-ID: <15CF606A-BF33-11D7-B951-003065F939FE@ucsc.edu>

On Friday, Jul 25, 2003, at 20:56 US/Pacific, Chris Trudeau wrote:

>>> Why is this not an option???....
>>
>> What process would you suggest I use for getting message feedback from
>> 20,000 users when we don't have individual config files/directories
>> for
>> users on our mail servers (and even if we did, how would that interact
>> with messages to multiple users or mailing lists, neither of which are
>> expanded before they get to mailscanner), we don't have anyone on
>> staff
>> who can review user submissions of false positives/false negatives (we
>> are NOT going to blindly accept it when a user says 'this should have
>> been spam', partially because users will not always agree upon the
>> issue), and the things that auto-learning handles aren't the things
>> I'm
>> worried about (auto-learning basically strengthens the system's
>> resolve
>> about high scoring spam ... what I'm concerned about is changing the
>> scores of low-scoring spam; when I call sa-learn on my home machine, I
>> never call it on high scoring spam messages, for example -- I call it
>> upon messages that were _lower_ than my threshold)?
>>
>
> WOW...ok...one at a time...I don't see why you would need feedback
> from 20K
> employees.  If the challenge you are concerned with is stopping a LARGE
> percentage of SPAM, then using a public corpus of spam to train a bayes
> enabled SA implementation would do just that.  WITHOUT having to have
> individual user interaction with anything..  With that said...creating
> a
> bayes database doesn't HAVE to be user specific...as a matter of fact,
> you
> are asking for a major headache to even think about it..  Create a
> single
> one that is "relatively" accurate and slow the river to a stream as a
> first
> step  :)

Right, but what am I feeding that single large corpus with?  Just my
own mail feed?  That wont fit anyone but me.  Who will decide who puts
things into the "this is spam" and "this is ham" parts of the corpus?
And, this is a university, which means there are tons of political
issues that come up in just discussing those questions, much less
answering them and putting them into production.  AND we're in the
middle of the state of california budget crisis -- we're already
overworked, so there will be NO human resource for managing that
corpus.  And, as I've said, we will not allow a central corpus/database
to be unmanaged (meaning "blind user contributions") , either.

And even if I accept people's spam submissions for the corpus, where do
I get the ham part of the corpus?  It is _illegal_ for me to use
messages they haven't explicitly given to me, so I'll only have
messages that they think to submit ... which wont include all of those
messages that might contain private or confidential correspondences and
other things that would be really ideal for training.  So, it really
comes back to "just my own mail feed?"  which is a poor choice, IMO.
In that case, it's better to not do bayes at all, IMO.

But, even if I did think it was worth doing on that basis, it would
again be a political, policy, and perhaps legal, issue.  I would be
indirectly deciding how to mark other people's email based upon my own
personal biases (because _I_ am the one deciding what gets into the
spam and ham databases).  To a certain extent, the same can be said
about the people who build the spam assassin corpus, but there are
differences there (starting with "I work here, I work in central IT,
and therefore I'm 'the man'", and therefore always viewed with
suspicion when it comes to things that might be considered censorship
and the like).

The technical question is "do I have enough system power to allow users
to have their own bayes db's", and the political/social/practical
question is how do we build and manage a central bayes db.  And, of the
two issues, the technical question is by far the easier one to solve.
I'll even go so far as to say that the political/social/practical one
is not solvable.

But, until we have those technical resources in place (if we ever have
them in place), it doesn't make sense to move forward with bayes.

> To deal with your multiple user issue is easy

We've already got 2 server hops (SMTP servers, which also do the
mailing list expansion, and a POP server) that cause us headaches (mail
backing up in one place that may be caused by some other link in the
chain, managing when accounts show and up disappear in each place,
etc.).  Adding a third would be absolutely the wrong solution.

The way I was looking at doing it: We're moving to a CommuniGate Pro
dynamic cluster, so the part where the CommuniGate Pro processing rules
hand messages to MailScanner will be in the "domain" level rules (which
happens after mailing list expansion and such, but before user owned
rules).

How to solve the technical problem is actually easy.  The question is
how much system resources I'll need to have in order to do it without
making my machines grind to a halt.  Even if I run it at 5am, the
system still has to be doing transactions during that time frame
without much of a delay in service (for professors and students who are
abroad, and thus checking at off hours ... or for people like me who
are night owls, or for early risers, etc.)

>> I just don't see how bayes would fit into our situation.
>>
>> Down the road, I'm looking in to how to apply something I use at home
>> (where I have a "learn" and an "unlearn" folder, and my home mail
>> server automatically runs through those folders every night at 5am,
>> learning about things it did wrong) to our mail servers ... but at
>> home
>> I've got _2_ users and at work I've got 10,000 times that many users.
>> At home, spamassassin is called out of my .forward, so there's never
>> confusion about whose bayes database to use, and there aren't any
>> non-user recipients like mailing lists.
>
> Your concern is valid.  I simply think that SA would solve a big part
> of
> your problems if it were done in a "gateway" configuration.

Well, yes, but using SA isn't the question.  We already use SA (at home
and at work).  The question is using the bayes part of SA at work.

> You are doing things exactly right at
> home making granular tuning and learning user-by-user

Yes, I know I'm doing the right thing there :-)

My home email address is user@domain.org.  I get over 200 spam messages
per day.  On most days, I see maybe 1 or 2 of them, and I've had 1
false positive with SA in over a year*.  I'm very confident that I've
got the right solution for my home environment.  I never said that I
didn't think SA or bayes were useful, I just don't think bayes fits my
current work environment ... and even in the new environment, I'm not
sure we'll have the processing power to make it fit there, either.


(* it's actually more complex than I described.  I have 4 spam folders:
Spam/Learn, Spam/Unlearn, Spam/Blacklist and Spam/Whitelist.  Messages
that I manually drop into Learn go to bayes and razor2 and then get put
into the blacklist folder (Unlearn messages only get sent to bayes).
Messages that are in the blacklist and whitelist folders get
incorporated into the auto-whitelist facility.  Messages that are
getting marked as spam automatically by SA go into the blacklist folder
(making it unlikely that I'll ever see messages from that sender ever
again, which matters more for corporate product registration mailing
lists and unconfirmed mailing lists).  After the blacklist stage, those
messages go into a mail folder outside of my IMAP area, and I almost
never actually look in the that folder.  Instead, I have a cron job
that extracts information from my procmail log about who got
automatically blacklisted, and sends me a report every night.  If I see
a false positive, I can go fish it out of that external mail folder and
get them whitelisted.  I've only had to do that once.   Once every few
months, I'll look in my auto-whitelist to see who has both a high
message count and a very high score ... and I'll add them to my
sendmail access db's reject rules, so that I can lighten my processing
load.)

>> I'm not sure that the mechanism will translate well to my production
>> servers at work.  There's the issue of server load as it tries to
>> update 20,000 bayes databases (hopefully the low-usage window will be
>> long enough to let all of those updates happen before usage picks
>> back
>> up), there's adding a front end that expands all messages to 1 end
>> user
>> recipient per message before it gets submitted to mailscanner (which
>> means more work for mailscanner, as mailscanner will now see 10
>> messages instead of 1, if the message has 10 recipients), and there's
>> the issue of where to put the user data files.  If it does, then using
>> bayes will make sense.  Otherwise, I just don't see how it will fit my
>> environment.
>
> just an idea...seems an easy problem to solve.

Technically, it is easy to solve.  The question is do I have enough
CPU, memory, and disk power in order to have each of my 20,000 users
have their own bayes database.  Without individual user db's, bayes
doesn't make any sense for my environment due to entirely non-technical
issues with building the corpus that feeds the proposed central bayes
db.

From mailscanner at ecs.soton.ac.uk  Sat Jul 26 08:50:30 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:04 2006
Subject: MS vs. Amavis
In-Reply-To: <00e001c35309$eb2d2000$23c8a8c0@SERV>
References: <786653281.20030725214705@guest.arnes.si>
            <20030725195923.GC9680@rfa.org>
Message-ID: <5.2.1.1.2.20030726084647.02764cf0@imap.ecs.soton.ac.uk>

At 01:07 26/07/2003, you wrote:
> > -amavis AFAIK calls an instance of your virus scanner for every single
> >  message whereas MS gathers mail up into batches and invokes the virus
> >  scanner for each batch.
>
>This is not entirely accurate.  Amavisd-new does support several of the
>virus scanner which can run in daemon mode including clam and sophos to
>mention a few.  While MS does a batched process, that could argueably NOT be
>better as there COULD be performance related issues with batched jobs no
>matter how long the timeout is between "checks" of the disk...although it
>DOES appear to handle failures by MailScanner processes well as mail can
>stillbe received, just not delivered. (depending on your MTA)

MailScanner does not wait until there are several messages in the queue
before scanning them. It will always scan whatever is available. On a
normal setup the queue will be checked about once per second. And for large
batches the daemons are on the whole less efficient than using the
command-line scanners, I tested some.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Sat Jul 26 08:55:56 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:04 2006
Subject: Whitelist for a single user...
In-Reply-To: <ILEGLLEHLGEPGCEHMOKNAEFJHIAD.batucker@icnet.net>
References: <5.2.1.1.2.20030725174054.019c8d40@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030726085459.02762e98@imap.ecs.soton.ac.uk>

Read /usr/lib/MailScanner/MailScanner/CustomConfig.pm and you will find
there is support for per-user and per-domain spam white+black lists
implemented using Custom Functions.

At 02:57 26/07/2003, you wrote:
>Is there a way to for a whitelist rule to apply to only a single local
>address... like
>
>FromAndTo:  Email1@Somewhere.com  MyUser@mydomain.com   yes
>
>So that Email1@somewhere.com is only whitelisted for MyUser@mydomain.com,
>for anyone else the regular scan/spam check process would apply.
>
>The reason I want to do this is that we currently maintain a list of
>addresses in a db,  that db is parsed output to our three mailservers many
>times a day to the spam.whitelist.rules and spam.blacklist.rules.   What I
>want to do is make this available to my users (within their secured login
>area) so that they can administer their own whitelist WITHOUT calling our
>techs.   However,  invariably one bonehead is going to put  From: * in
>there, or whitelist other addresses the other 30,000+ email boxes don't want
>whitelisted.  I would therefore like to be able to limit it to only that
>user via their email address (which is known from the login they used to get
>into the 'customer only' area).
>
>                                       Brady A. Tucker
>                                       Internet Complete! inc.
>                                       http://www.icnet.net

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From gerry at DORFAM.CA  Sat Jul 26 14:40:25 2003
From: gerry at DORFAM.CA (Gerry Doris)
Date: Thu Jan 12 21:19:04 2006
Subject: Julian??
Message-ID: <Pine.LNX.4.44.0307260938100.7478-100000@tiger.dorfam.ca>

Hey, who's this new guy that knows everything?  Seems his name rings a
bell but I just can't place it.

In any case, welcome to the list Julian.  I'm sure you have lots more to
add!!!!

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer

From mailscanner at ecs.soton.ac.uk  Sat Jul 26 15:37:14 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:04 2006
Subject: Julian??
In-Reply-To: <Pine.LNX.4.44.0307260938100.7478-100000@tiger.dorfam.ca>
Message-ID: <5.2.1.1.2.20030726153007.024bc3b0@imap.ecs.soton.ac.uk>

At 14:40 26/07/2003, you wrote:
>Hey, who's this new guy that knows everything?

It's just a show, he makes it all up. Personally I wouldn't believe a word
of it.

>Seems his name rings a
>bell but I just can't place it.

Hmmm.... Google thinks he might be a barrister specialising in commercial
litigation. D**n lawyers get everywhere (allegedly!).

>In any case, welcome to the list Julian.  I'm sure you have lots more to
>add!!!!

I'm a clone, a newer improved version theoretically. Probably just as
broken as the previous one in reality
:-)

P.S. A note for new members of this list ---- you are probably really
confused by now! Don't worry, the list isn't usually this surreal :)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From Jan-Peter.Koopmann at SECEIDOS.DE  Sat Jul 26 15:58:32 2003
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
Message-ID: <B9D9BD71E387E24AB1D619FE4B748CC703CB99@ERWIN.intern.seceidos.de>

Hi,

Something seems wrong with the f-prot-autoupdate. All I get is


FTP address for retrieving files is ftp://us-2.updates.f-prot.com/pub/
F-Prot signature file update script
There is a new version of SIGN.DEF, starting download.
Download completed.
Could not find correct version of SIGN.DEF, exiting, 


Did they screw something up?

Regards,
  JP


From Antony at SOFT-SOLUTIONS.CO.UK  Sat Jul 26 16:11:10 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <B9D9BD71E387E24AB1D619FE4B748CC703CB99@ERWIN.intern.seceidos.de>
References: <B9D9BD71E387E24AB1D619FE4B748CC703CB99@ERWIN.intern.seceidos.de>
Message-ID: <200307261511.h6QFBE000641@agate.rockstone.co.uk>

On Saturday 26 July 2003 3:58 pm, Jan-Peter Koopmann wrote:

> Hi,
>
> Something seems wrong with the f-prot-autoupdate. All I get is
>
> FTP address for retrieving files is ftp://us-2.updates.f-prot.com/pub/
> F-Prot signature file update script
> There is a new version of SIGN.DEF, starting download.
> Download completed.
> Could not find correct version of SIGN.DEF, exiting,
>
> Did they screw something up?

Looks like it, yes.   I get the same here.

Antony.

--

Wanted: telepath.   You know where to apply.

From mailscanner at ecs.soton.ac.uk  Sat Jul 26 16:12:20 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <B9D9BD71E387E24AB1D619FE4B748CC703CB99@ERWIN.intern.seceid os.de>
Message-ID: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk>

At 15:58 26/07/2003, you wrote:
>Hi,
>
>Something seems wrong with the f-prot-autoupdate. All I get is

They have screwed up the signature checksums file. The checksum for
SIGN.DEF has had a "x" added at the front of it. This breaks the update
procedure as it thinks the checksum is wrong (which it is).

I can take 2 options:
1) Ignore the invalid checksum, thereby potentially installing a totally
broken SIGN.DEF file resulting in a complete failure of scanning
or
2) Refuse to install the downloaded SIGN.DEF file due to the bad checksum,
which means that the updates don't happen totally correctly until F-Prot
get their checksum file fixed.

Dangerously, in my opinion, F-Prot themselves take option 1.
I prefer to take option 2, as it fails a lot more gently. If they can make
a mistake in the checksums file, they can make mistakes in the SIGN.DEF
file. I don't want to completely break scanning due to a vendor screw-up.

I have submitted a tech support query raising this issue with F-Prot
already, hopefully they will fix it on Monday.

>FTP address for retrieving files is ftp://us-2.updates.f-prot.com/pub/
>F-Prot signature file update script
>There is a new version of SIGN.DEF, starting download.
>Download completed.
>Could not find correct version of SIGN.DEF, exiting,
>
>
>Did they screw something up?
>
>Regards,
>   JP

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From raymond at PROLOCATION.NET  Sat Jul 26 16:23:16 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk>
Message-ID: <Pine.LNX.4.44.0307261722480.25491-100000@mailbox.prolocation.net>

Hi!

> I have submitted a tech support query raising this issue with F-Prot
> already, hopefully they will fix it on Monday.

I also did that. Hopefully they can fix this asap :)

Bye,
Raymond.

From michele at BLACKNIGHTSOLUTIONS.COM  Sat Jul 26 18:41:56 2003
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon:: Blacknight Solutions)
Date: Thu Jan 12 21:19:04 2006
Subject: Julian??
In-Reply-To: <5.2.1.1.2.20030726153007.024bc3b0@imap.ecs.soton.ac.uk>
Message-ID: <200307261740.h6QHeeu23393@camelot.blacknightsolutions.com>

>
> P.S. A note for new members of this list ---- you are
> probably really confused by now! Don't worry, the list isn't
> usually this surreal :)

Ah come on Julian! We've all read your little comments in the Perl install
scripts.. Surreality reigns :-)


#########################################################
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance to it is prohibited.

From gerry at DORFAM.CA  Sat Jul 26 20:25:51 2003
From: gerry at DORFAM.CA (Gerry Doris)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk>
Message-ID: <Pine.LNX.4.44.0307261521270.7478-100000@tiger.dorfam.ca>

On Sat, 26 Jul 2003, Julian Field wrote:

> At 15:58 26/07/2003, you wrote:
> >Hi,
> >
> >Something seems wrong with the f-prot-autoupdate. All I get is
>
> They have screwed up the signature checksums file. The checksum for
> SIGN.DEF has had a "x" added at the front of it. This breaks the update
> procedure as it thinks the checksum is wrong (which it is).
>
> I can take 2 options:
> 1) Ignore the invalid checksum, thereby potentially installing a totally
> broken SIGN.DEF file resulting in a complete failure of scanning
> or
> 2) Refuse to install the downloaded SIGN.DEF file due to the bad checksum,
> which means that the updates don't happen totally correctly until F-Prot
> get their checksum file fixed.
>
> Dangerously, in my opinion, F-Prot themselves take option 1.
> I prefer to take option 2, as it fails a lot more gently. If they can make
> a mistake in the checksums file, they can make mistakes in the SIGN.DEF
> file. I don't want to completely break scanning due to a vendor screw-up.
>
> I have submitted a tech support query raising this issue with F-Prot
> already, hopefully they will fix it on Monday.

F-Prot did the same thing about a week ago.  Several updates failed the
same way and then it started working.  I guess they finally fixed the
problem...but it's back again!


--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer

From email at ace.net.au  Sat Jul 26 20:59:07 2003
From: email at ace.net.au (Peter Nitschke)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk>
Message-ID: <200307270529070409.0011A8F4@smtp1.ace.net.au>

Does this mean that f-prot isn't working at all leaving mail unscanned for
virus infections, or just that update is now broken?

Peter

*********** REPLY SEPARATOR  ***********

On 26/07/2003 at 4:12 PM Julian Field wrote:

>At 15:58 26/07/2003, you wrote:
>>Hi,
>>
>>Something seems wrong with the f-prot-autoupdate. All I get is
>
>They have screwed up the signature checksums file. The checksum for
>SIGN.DEF has had a "x" added at the front of it. This breaks the update
>procedure as it thinks the checksum is wrong (which it is).
>
>I can take 2 options:
>1) Ignore the invalid checksum, thereby potentially installing a totally
>broken SIGN.DEF file resulting in a complete failure of scanning
>or
>2) Refuse to install the downloaded SIGN.DEF file due to the bad checksum,
>which means that the updates don't happen totally correctly until F-Prot
>get their checksum file fixed.
>
>Dangerously, in my opinion, F-Prot themselves take option 1.
>I prefer to take option 2, as it fails a lot more gently. If they can make
>a mistake in the checksums file, they can make mistakes in the SIGN.DEF
>file. I don't want to completely break scanning due to a vendor screw-up.
>
>I have submitted a tech support query raising this issue with F-Prot
>already, hopefully they will fix it on Monday.
>
>>FTP address for retrieving files is ftp://us-2.updates.f-prot.com/pub/
>>F-Prot signature file update script
>>There is a new version of SIGN.DEF, starting download.
>>Download completed.
>>Could not find correct version of SIGN.DEF, exiting,
>>
>>
>>Did they screw something up?
>>
>>Regards,
>>   JP
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support

From Antony at SOFT-SOLUTIONS.CO.UK  Sat Jul 26 21:05:26 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <200307270529070409.0011A8F4@smtp1.ace.net.au>
References: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk>
            <200307270529070409.0011A8F4@smtp1.ace.net.au>
Message-ID: <200307262005.h6QK5V016825@agate.rockstone.co.uk>

On Saturday 26 July 2003 8:59 pm, Peter Nitschke wrote:

> Does this mean that f-prot isn't working at all leaving mail unscanned for
> virus infections, or just that update is now broken?

It means those of us using Julian's update script are working on the last
known good copy of the F-Prot database, without the latest signature(s).

Anyone using F-Prot's own update are either using a good database with the
latest signatures, or a bad database which won't work....   and they don't
know which until they see a virus :)


Antony.

--

I vote "no" to this proposal to form a committee to investigate whether we
should or should not hold a ballot on whether to vote yet.

From raymond at PROLOCATION.NET  Sat Jul 26 21:44:50 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:04 2006
Subject: Vexing problem
In-Reply-To: <1059072756.10225.10.camel@croithine>
Message-ID: <Pine.LNX.4.44.0307262244160.9850-100000@mailbox.prolocation.net>

Hi!

> I have been able to partial fix this issue.  I have set the:
> Restart Every = 3600
>
> This has helped a lot.  I any resource problems can't seem to wait the
> default 4 hours, so 1 hour will have to do.  Not that I like the idea,
> but it works.

I did the same here, also on 3600 now, but i think on my end it was more
the RH9 kernel upgrade thats helping. Crossing fingers...

Bye,
Raymond.

From ryanb at AACRAO.ORG  Sat Jul 26 22:50:01 2003
From: ryanb at AACRAO.ORG (Ryan Bingham)
Date: Thu Jan 12 21:19:04 2006
Subject: Julian??
References: <200307261740.h6QHeeu23393@camelot.blacknightsolutions.com>
Message-ID: <008401c353bf$e038e5b0$f8240340@kh06s9>

Julian,

So how was Canada, eh?  Have you managed to catch up on all the list traffic
since you've been away?

Ryan

From mailscanner at ecs.soton.ac.uk  Sun Jul 27 11:12:57 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:04 2006
Subject: Julian??
In-Reply-To: <008401c353bf$e038e5b0$f8240340@kh06s9>
References: <200307261740.h6QHeeu23393@camelot.blacknightsolutions.com>
Message-ID: <5.2.1.1.2.20030727110517.026ce5d0@imap.ecs.soton.ac.uk>

At 22:50 26/07/2003, you wrote:
>So how was Canada, eh?

Wonderful, thanks. Stayed in some very nice hotels along the way, e.g.
Royal York in Toronto. Breathtaking scenery, particularly through the
Rockies. Canadians are great people, really friendly and very "genuine" if
you get what I mean. When they say "you're welcome" it's because they mean
it, not because they are paid to say it. And they don't tell you to "have a
nice day" the whole time!
I've been to 13 different countries now and it's probably the first one I
would happily move to. And I saw a bear! Yay!

>   Have you managed to catch up on all the list traffic
>since you've been away?

I did "select all" then "mark as read". I had 21,000 new messages waiting
for me, so a certain amount of "bulk" operations had to take place.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From nejc.skoberne at guest.arnes.si  Sun Jul 27 11:28:14 2003
From: nejc.skoberne at guest.arnes.si (Nejc Skoberne)
Date: Thu Jan 12 21:19:04 2006
Subject: Julian??
In-Reply-To: <5.2.1.1.2.20030727110517.026ce5d0@imap.ecs.soton.ac.uk>
References: <200307261740.h6QHeeu23393@camelot.blacknightsolutions.com>
            <5.2.1.1.2.20030727110517.026ce5d0@imap.ecs.soton.ac.uk>
Message-ID: <861714156.20030727122814@guest.arnes.si>

Zdravo.

> I did "select all" then "mark as read". I had 21,000 new messages waiting

Don't you use MS with SA? ;-)

--
Nejc Skoberne
Grajska 5
SI-5220 Tolmin
E-mail: nejc.skoberne@guest.arnes.si

From Antony at SOFT-SOLUTIONS.CO.UK  Sun Jul 27 11:30:47 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:04 2006
Subject: Julian??
In-Reply-To: <5.2.1.1.2.20030727110517.026ce5d0@imap.ecs.soton.ac.uk>
References: <200307261740.h6QHeeu23393@camelot.blacknightsolutions.com>
            <5.2.1.1.2.20030727110517.026ce5d0@imap.ecs.soton.ac.uk>
Message-ID: <200307271030.h6RAUq017140@agate.rockstone.co.uk>

On Sunday 27 July 2003 11:12 am, Julian Field wrote:

> I had 21,000 new messages waiting for me, so a certain amount of "bulk"
> operations had to take place.

21,000 messages in three weeks!?

If that's your normal level of email traffic then I calculate that if you
spend 8 hours a day reading and replying to email, you get about 30 seconds
per message...?

Wow, that's some workload...

Welcome back, anyway.


Antony.
--

The truth is rarely pure, and never simple.

 - Oscar Wilde

From raymond at PROLOCATION.NET  Sun Jul 27 11:32:13 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:04 2006
Subject: Julian??
In-Reply-To: <200307271030.h6RAUq017140@agate.rockstone.co.uk>
Message-ID: <Pine.LNX.4.44.0307271231270.32711-100000@mailbox.prolocation.net>

Hi!

> > I had 21,000 new messages waiting for me, so a certain amount of "bulk"
> > operations had to take place.
>
> 21,000 messages in three weeks!?
>
> If that's your normal level of email traffic then I calculate that if you
> spend 8 hours a day reading and replying to email, you get about 30 seconds
> per message...?

Uhm i had around 8K when i skipped a week during vacation. Security lists
and so on take a lot of those 8k but still :))

Bye,
Raymond.

From raymond at PROLOCATION.NET  Sun Jul 27 21:27:13 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:04 2006
Subject: Whitelisted
In-Reply-To: <1059064283.29144.238.camel@speedy>
Message-ID: <Pine.LNX.4.44.0307272226110.14561-100000@mailbox.prolocation.net>

Hi!

> 1) Start the incoming sendmail with a different config file.
> Changes to /etc/rc.d/init.d/MailScanner (from rpm install on redhat)
> make this change to the incoming sendmail command line:
> ------ snip -------
>
>   $SENDMAIL -bd -OPrivacyOptions=noetrn \
>                        -ODeliveryMode=queueonly \
>                        -OQueueDirectory=$INQDIR \
>                        -OPidFile=$INPID \
>                        -C/etc/mail/sendmail_in.cf
>

Works perfectly, only thing is my load on the box itself allmost doubled.
So if you try this on a heavy loaded box, think twice :)

But besides that, perfect solution, works like advertised!

Thanks,
Raymond.

From mailscanner at ELKNET.NET  Mon Jul 28 03:03:55 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:19:04 2006
Subject: Spamassassin timeout results in MS 100% CPU and server lockup
Message-ID: <200307280203.h6S23uS31698@ori.rl.ac.uk>

Last night I got a number of emails into my MS/SA server that caused it to crash.

In my testing, here is what I discovered:

  Everything runs fine up until the maillog reports 'spamassassin timed out and was killed'.

  Using the PID in that error message, I check all the children of that parent process.

  One of the children will suddenly start climbing in memory size above the typical 22M, and likewise will start climbing in CPU usage.

  As memory and CPU continue to increase, all the other MS parents and their children get swapped out and go to sleep.

  Before too long, the child causing the problem will reach around 380+M of memory and 99% CPU. No other MS instances are running at all.

  Accordingly, the maillog no longer shows any processing of the incoming queue.

  If left alone, the machine eventually comes to its knees, and even the nic stops responding (can't ping the server) and the console is locked.

  If the bad child is reniced to a negative value (everything else is at 0), then everything else, including the other MS instances, start back up.

  If the bad child is killed, everything goes back to normal.


  ...that is of course until another one of the bad messages is picked up for scanning.


  My major concern here is not so much what was in the bad message that caused this, but more critically, why does the time out killing of a spamassassin instance cause its calling MS child to go ape and eat the server?

-Alan

From mailscanner at ELKNET.NET  Mon Jul 28 04:23:07 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:19:04 2006
Subject: Spamassassin timeout results in MS 100% CPU and server lockup (correction)
Message-ID: <200307280323.h6S3N8S03773@ori.rl.ac.uk>

A possible correction. I may have been wrong in my conclusion that it was a group of email sthat came in last night that caused this problem to manifest.
After running through the logs, I was quite surprised at how many SA timeout assasinations had started taking place in the early hours of the morning, right about the time of the first crash I described. Tonight I finished sanitizing the in queue, and started everything up again...

The problem came right back. I could not believe that it was more of the type of messages that came in last night, so perhaps my first conclusion was flawed. I started looking for what else might have changed on my server about the time all this started. I found it...

My Bayes finally hit 200 hams, and started working at 1:56 AM this morning. Prior to that time, my auto-learn had not accumulated enough hams for Bayes to start functioning. So, I just disabled Bayes, and viola! No more SA timeouts and deaths.

So, it wasn't some mysterious evil messages that caused the timeouts, but Bayes kicking in.

HOWEVER! Even with the cause of the timeouts figured out, I still have my PRIMARY concern: Why are MS children that encounter an SA timeout and death taking over my server with extrememly high ram and cpu usage, that eventually crowd out every other process and crash the server? THAT is my primary issue.

All help and insight is sure appreciated!
-Alan



>Last night I got a number of emails into my MS/SA server that caused it to crash.
>
>In my testing, here is what I discovered:
>
>  Everything runs fine up until the maillog reports 'spamassassin timed out and was killed'.
>
>  Using the PID in that error message, I check all the children of that parent process.
>
>  One of the children will suddenly start climbing in memory size above the typical 22M, and likewise will start climbing in CPU usage.
>
>  As memory and CPU continue to increase, all the other MS parents and their children get swapped out and go to sleep.
>
>  Before too long, the child causing the problem will reach around 380+M of memory and 99% CPU. No other MS instances are running at all.
>
>  Accordingly, the maillog no longer shows any processing of the incoming queue.
>
>  If left alone, the machine eventually comes to its knees, and even the nic stops responding (can't ping the server) and the console is locked.
>
>  If the bad child is reniced to a negative value (everything else is at 0), then everything else, including the other MS instances, start back up.
>
>  If the bad child is killed, everything goes back to normal.
>
>
>  ...that is of course until another one of the bad messages is picked up for scanning.
>
>
>  My major concern here is not so much what was in the bad message that caused this, but more critically, why does the time out killing of a spamassassin instance cause its calling MS child to go ape and eat the server?
>
>-Alan

From danieltan at shopnsave.com.sg  Mon Jul 28 04:32:42 2003
From: danieltan at shopnsave.com.sg (Daniel Tan)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
References: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk> 
            <200307270529070409.0011A8F4@smtp1.ace.net.au>
Message-ID: <003601c354b8$e77dc1c0$3900a8c0@Daniel>

i got this email frm cron....its not updating at all...what shld i do?

***************************************
* F-Prot signature file update script *
***************************************

There's a new version of:
"Application/Script viruses and Trojans" signatures on the web.
Starting to download...
Download completed.
The files are not identical and therefore, they will
not be installed. This could be caused by downloading
from a mirror which hasn't synced yet with the main
server. (This should not happen)




----- Original Message -----
From: "Peter Nitschke" <email@ace.net.au>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Sunday, July 27, 2003 3:59 AM
Subject: Re: f-prot-autoupdate not working


Does this mean that f-prot isn't working at all leaving mail unscanned for
virus infections, or just that update is now broken?

Peter

*********** REPLY SEPARATOR  ***********

On 26/07/2003 at 4:12 PM Julian Field wrote:

>At 15:58 26/07/2003, you wrote:
>>Hi,
>>
>>Something seems wrong with the f-prot-autoupdate. All I get is
>
>They have screwed up the signature checksums file. The checksum for
>SIGN.DEF has had a "x" added at the front of it. This breaks the update
>procedure as it thinks the checksum is wrong (which it is).
>
>I can take 2 options:
>1) Ignore the invalid checksum, thereby potentially installing a totally
>broken SIGN.DEF file resulting in a complete failure of scanning
>or
>2) Refuse to install the downloaded SIGN.DEF file due to the bad checksum,
>which means that the updates don't happen totally correctly until F-Prot
>get their checksum file fixed.
>
>Dangerously, in my opinion, F-Prot themselves take option 1.
>I prefer to take option 2, as it fails a lot more gently. If they can make
>a mistake in the checksums file, they can make mistakes in the SIGN.DEF
>file. I don't want to completely break scanning due to a vendor screw-up.
>
>I have submitted a tech support query raising this issue with F-Prot
>already, hopefully they will fix it on Monday.
>
>>FTP address for retrieving files is ftp://us-2.updates.f-prot.com/pub/
>>F-Prot signature file update script
>>There is a new version of SIGN.DEF, starting download.
>>Download completed.
>>Could not find correct version of SIGN.DEF, exiting,
>>
>>
>>Did they screw something up?
>>
>>Regards,
>>   JP
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support

--
This message has been scanned for viruses and
dangerous content by Email Virus Scanner, and is
believed to be clean.


--
This message has been scanned for viruses and
dangerous content by Email Virus Scanner, and is
believed to be clean.

From raymond at PROLOCATION.NET  Mon Jul 28 07:37:56 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:04 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <003601c354b8$e77dc1c0$3900a8c0@Daniel>
Message-ID: <Pine.LNX.4.44.0307280836510.24832-100000@mailbox.prolocation.net>

Hi!

> ***************************************
> * F-Prot signature file update script *
> ***************************************
>
> There's a new version of:
> "Application/Script viruses and Trojans" signatures on the web.
> Starting to download...
> Download completed.
> The files are not identical and therefore, they will
> not be installed. This could be caused by downloading
> from a mirror which hasn't synced yet with the main
> server. (This should not happen)

What version are you running? Just curious...

F-PROT should fix their files on the server, they havent been updates some
days anyway on their servers also i noticed.

Bye,
Raymond.

From mailscanner at ecs.soton.ac.uk  Mon Jul 28 09:25:42 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Spamassassin timeout results in MS 100% CPU and server lockup (correction)
In-Reply-To: <200307280323.h6S3N8S03773@ori.rl.ac.uk>
Message-ID: <5.2.1.1.2.20030728092448.037d5bd8@imap.ecs.soton.ac.uk>

Are you running SA 2.55? Sounds like it's a Perl bug somewhere. I don't
think there's any MS code that could loop in this situation...

At 04:23 28/07/2003, you wrote:
>A possible correction. I may have been wrong in my conclusion that it was
>a group of email sthat came in last night that caused this problem to manifest.
>After running through the logs, I was quite surprised at how many SA
>timeout assasinations had started taking place in the early hours of the
>morning, right about the time of the first crash I described. Tonight I
>finished sanitizing the in queue, and started everything up again...
>
>The problem came right back. I could not believe that it was more of the
>type of messages that came in last night, so perhaps my first conclusion
>was flawed. I started looking for what else might have changed on my
>server about the time all this started. I found it...
>
>My Bayes finally hit 200 hams, and started working at 1:56 AM this
>morning. Prior to that time, my auto-learn had not accumulated enough hams
>for Bayes to start functioning. So, I just disabled Bayes, and viola! No
>more SA timeouts and deaths.
>
>So, it wasn't some mysterious evil messages that caused the timeouts, but
>Bayes kicking in.
>
>HOWEVER! Even with the cause of the timeouts figured out, I still have my
>PRIMARY concern: Why are MS children that encounter an SA timeout and
>death taking over my server with extrememly high ram and cpu usage, that
>eventually crowd out every other process and crash the server? THAT is my
>primary issue.
>
>All help and insight is sure appreciated!
>-Alan
>
>
>
> >Last night I got a number of emails into my MS/SA server that caused it
> to crash.
> >
> >In my testing, here is what I discovered:
> >
> >  Everything runs fine up until the maillog reports 'spamassassin timed
> out and was killed'.
> >
> >  Using the PID in that error message, I check all the children of that
> parent process.
> >
> >  One of the children will suddenly start climbing in memory size above
> the typical 22M, and likewise will start climbing in CPU usage.
> >
> >  As memory and CPU continue to increase, all the other MS parents and
> their children get swapped out and go to sleep.
> >
> >  Before too long, the child causing the problem will reach around 380+M
> of memory and 99% CPU. No other MS instances are running at all.
> >
> >  Accordingly, the maillog no longer shows any processing of the
> incoming queue.
> >
> >  If left alone, the machine eventually comes to its knees, and even the
> nic stops responding (can't ping the server) and the console is locked.
> >
> >  If the bad child is reniced to a negative value (everything else is at
> 0), then everything else, including the other MS instances, start back up.
> >
> >  If the bad child is killed, everything goes back to normal.
> >
> >
> >  ...that is of course until another one of the bad messages is picked
> up for scanning.
> >
> >
> >  My major concern here is not so much what was in the bad message that
> caused this, but more critically, why does the time out killing of a
> spamassassin instance cause its calling MS child to go ape and eat the server?
> >
> >-Alan

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Mon Jul 28 09:27:32 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <003601c354b8$e77dc1c0$3900a8c0@Daniel>
References: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk>
            <200307270529070409.0011A8F4@smtp1.ace.net.au>
Message-ID: <5.2.1.1.2.20030728092702.037b60a0@imap.ecs.soton.ac.uk>

Please read the earlier messages in this thread. My posting from the
weekend should tell you what is happening here.

At 04:32 28/07/2003, you wrote:
>i got this email frm cron....its not updating at all...what shld i do?
>
>***************************************
>* F-Prot signature file update script *
>***************************************
>
>There's a new version of:
>"Application/Script viruses and Trojans" signatures on the web.
>Starting to download...
>Download completed.
>The files are not identical and therefore, they will
>not be installed. This could be caused by downloading
>from a mirror which hasn't synced yet with the main
>server. (This should not happen)
>
>
>
>
>----- Original Message -----
>From: "Peter Nitschke" <email@ace.net.au>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Sunday, July 27, 2003 3:59 AM
>Subject: Re: f-prot-autoupdate not working
>
>
>Does this mean that f-prot isn't working at all leaving mail unscanned for
>virus infections, or just that update is now broken?
>
>Peter
>
>*********** REPLY SEPARATOR  ***********
>
>On 26/07/2003 at 4:12 PM Julian Field wrote:
>
> >At 15:58 26/07/2003, you wrote:
> >>Hi,
> >>
> >>Something seems wrong with the f-prot-autoupdate. All I get is
> >
> >They have screwed up the signature checksums file. The checksum for
> >SIGN.DEF has had a "x" added at the front of it. This breaks the update
> >procedure as it thinks the checksum is wrong (which it is).
> >
> >I can take 2 options:
> >1) Ignore the invalid checksum, thereby potentially installing a totally
> >broken SIGN.DEF file resulting in a complete failure of scanning
> >or
> >2) Refuse to install the downloaded SIGN.DEF file due to the bad checksum,
> >which means that the updates don't happen totally correctly until F-Prot
> >get their checksum file fixed.
> >
> >Dangerously, in my opinion, F-Prot themselves take option 1.
> >I prefer to take option 2, as it fails a lot more gently. If they can make
> >a mistake in the checksums file, they can make mistakes in the SIGN.DEF
> >file. I don't want to completely break scanning due to a vendor screw-up.
> >
> >I have submitted a tech support query raising this issue with F-Prot
> >already, hopefully they will fix it on Monday.
> >
> >>FTP address for retrieving files is ftp://us-2.updates.f-prot.com/pub/
> >>F-Prot signature file update script
> >>There is a new version of SIGN.DEF, starting download.
> >>Download completed.
> >>Could not find correct version of SIGN.DEF, exiting,
> >>
> >>
> >>Did they screw something up?
> >>
> >>Regards,
> >>   JP
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >Professional Support Services at www.MailScanner.biz
> >MailScanner thanks transtec Computers for their support
>
>--
>This message has been scanned for viruses and
>dangerous content by Email Virus Scanner, and is
>believed to be clean.
>
>
>--
>This message has been scanned for viruses and
>dangerous content by Email Virus Scanner, and is
>believed to be clean.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From P.G.M.Peters at utwente.nl  Mon Jul 28 09:36:44 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:19:05 2006
Subject: Julain on Vacation?
In-Reply-To: <5.2.1.1.2.20030725173808.06385390@imap.ecs.soton.ac.uk>
References: <63155.129.80.22.133.1057587390.squirrel@tiger.dorfam.ca>
            <5.2.1.1.2.20030725173808.06385390@imap.ecs.soton.ac.uk>
Message-ID: <i4o9ivct071hnsglduj4f0tnc1v7jsjnoa@4ax.com>

On Fri, 25 Jul 2003 17:39:15 +0100, you wrote:

>>Has Julian left on his vacation yet?  I believe he said he was going to be
>>gone all month without access to the list...I wonder if he'll survive?
>
>Nearly 3 whole weeks without net access. Sheer bliss :-)

Welcome back.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From mailscanner at ecs.soton.ac.uk  Mon Jul 28 11:06:27 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <5.2.1.1.2.20030726160652.025c2008@imap.ecs.soton.ac.uk>
References: <B9D9BD71E387E24AB1D619FE4B748CC703CB99@ERWIN.intern.seceid os.de>
Message-ID: <5.2.1.1.2.20030728110510.03957eb8@imap.ecs.soton.ac.uk>

Response from Frisk this morning, they claim to have fixed it now.


>Dear Sir or Madam,
>
>Thank you for your mail.
>We apologize for the inconvenience. There was an error on our server
>regarding the latest virus signature files.
>This has now been fixed and the update process should now be back to normal.

At 16:12 26/07/2003, you wrote:
>At 15:58 26/07/2003, you wrote:
>>Hi,
>>
>>Something seems wrong with the f-prot-autoupdate. All I get is
>
>They have screwed up the signature checksums file. The checksum for
>SIGN.DEF has had a "x" added at the front of it. This breaks the update
>procedure as it thinks the checksum is wrong (which it is).
>
>I can take 2 options:
>1) Ignore the invalid checksum, thereby potentially installing a totally
>broken SIGN.DEF file resulting in a complete failure of scanning
>or
>2) Refuse to install the downloaded SIGN.DEF file due to the bad checksum,
>which means that the updates don't happen totally correctly until F-Prot
>get their checksum file fixed.
>
>Dangerously, in my opinion, F-Prot themselves take option 1.
>I prefer to take option 2, as it fails a lot more gently. If they can make
>a mistake in the checksums file, they can make mistakes in the SIGN.DEF
>file. I don't want to completely break scanning due to a vendor screw-up.
>
>I have submitted a tech support query raising this issue with F-Prot
>already, hopefully they will fix it on Monday.
>
>>FTP address for retrieving files is ftp://us-2.updates.f-prot.com/pub/
>>F-Prot signature file update script
>>There is a new version of SIGN.DEF, starting download.
>>Download completed.
>>Could not find correct version of SIGN.DEF, exiting,
>>
>>
>>Did they screw something up?
>>
>>Regards,
>>   JP
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From raymond at PROLOCATION.NET  Mon Jul 28 11:12:33 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:05 2006
Subject: f-prot-autoupdate not working
In-Reply-To: <5.2.1.1.2.20030728110510.03957eb8@imap.ecs.soton.ac.uk>
Message-ID: <Pine.LNX.4.44.0307281212000.16930-100000@mailbox.prolocation.net>

Hi!

> Response from Frisk this morning, they claim to have fixed it now.

Seems to work here :) I didnt get a reply on my helpdesk ticket however..

Thanks.
Raymond.

From dean.plant at ROKE.CO.UK  Mon Jul 28 11:24:19 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A7023674B@rsys004a.roke.co.uk>

Julian,

I hope you had a good holiday.

I am having a problem with pdf files corrupting when the disclaimer gets added to email passing through the MailScanner.

RH 8.0
Mailscanner 4.21-9
Spamassassin/dcc/razor2
F-prot 4.1.1

Our setup is internal MS exchange 5.5 / outlook 2000 clients with Mailscanner as a relay to the internet.

The problem only occurs when the mail is generated from MS exchange which sometimes encodes pdf files as quoted printable (looking on TechNet shows that MS exchange decides the encoding depending on the pdf file version). If the mail is generated with base64 the pdf file passes through correctly.

I have found discussions of the problem within mailing lists of similar products to Mailscanner which also seem to suffer from this problem, so I think it must be down to the MIME::QuotedPrint perl module and the ambiguity of the QP standard on different OS's.

http://mailtools.anomy.net/archives/anomy-bugs/2002-06/0003.shtml

As a quick fix I have advised users to zip all pdf files to ensure correct delivery. I have also discussed the possibility of the MS exchange people forcing the attachment encoding to base64 but they are cautious in case something else breaks. I think they are unwilling to change as it all worked before I put in the Mailscanner relay.

Is there any advice you can offer on this problem. (Suggestions of smashing up the MS exchange box can not be accepted).

Thanks in advance.

Dean Plant.

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

From mailscanner at ecs.soton.ac.uk  Mon Jul 28 11:33:40 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <EA943CD30BCB104E9D38F5B5DC2D9A7023674B@rsys004a.roke.co.uk >
Message-ID: <5.2.1.1.2.20030728113009.039495e0@imap.ecs.soton.ac.uk>

At 11:24 28/07/2003, you wrote:
>I hope you had a good holiday.

Yes, thankyou.

>I am having a problem with pdf files corrupting when the disclaimer gets
>added to email passing through the MailScanner.
>
>RH 8.0
>Mailscanner 4.21-9
>Spamassassin/dcc/razor2
>F-prot 4.1.1
>
>Our setup is internal MS exchange 5.5 / outlook 2000 clients with
>Mailscanner as a relay to the internet.
>
>The problem only occurs when the mail is generated from MS exchange which
>sometimes encodes pdf files as quoted printable (looking on TechNet shows
>that MS exchange decides the encoding depending on the pdf file version).
>If the mail is generated with base64 the pdf file passes through correctly.
>
>I have found discussions of the problem within mailing lists of similar
>products to Mailscanner which also seem to suffer from this problem, so I
>think it must be down to the MIME::QuotedPrint perl module and the
>ambiguity of the QP standard on different OS's.
>
>http://mailtools.anomy.net/archives/anomy-bugs/2002-06/0003.shtml
>
>As a quick fix I have advised users to zip all pdf files to ensure correct
>delivery. I have also discussed the possibility of the MS exchange people
>forcing the attachment encoding to base64 but they are cautious in case
>something else breaks. I think they are unwilling to change as it all
>worked before I put in the Mailscanner relay.

I don't see that forcing Exchange to always use Base64 should break
anything at all. The whole point of encoding using Base64 is that it will
preserve the exact original attachment contents.

Fundamentally Exchange is doing it wrong by encoding a binary data file
using an encoder that is only designed to handle text files. The QP
standard is designed for encoding international characters used in text
files, and that's about it. If you want to encode binary files (such as
PDF) then use a binary encoder such as Base64.

My advice would be to force Exchange to do it correctly.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Jul 28 11:34:10 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
Message-ID: <74BC2BBF06470148911E64E2B48FE13904995C@pinewood.ncl.ac.uk>

Julian

It appears that the "corrupted PDF file" problem is more extensive and
serious than described below. I said in a message to the list a few days
ago that:

"We are running MS 4.22-5 with SA 2.55 and users are suffering some
serious problems sending/receiving PDF files. The problem seems to have
started with MS 4.22-5. Most (all?) incoming PDF attachments are flagged
as corrupt.

"The problem is even apparent with a local sender who is using Pine on a
Unix system. Zipping the PDF file appears to make no difference. It thus
appears that it is within MS or one of the modules that is processing
the PDF file that the problem occurs." 

I have two sample PDF files that cannot be sent from this site because
of the behaviour of MS or my configuring of it.

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

> -----Original Message-----
> From: Plant, Dean [mailto:dean.plant@ROKE.CO.UK] 
> Sent: 28 July 2003 11:24
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Corrupt pdf files, any advice.
> 
> 
> Julian,
> 
> I hope you had a good holiday.
> 
> I am having a problem with pdf files corrupting when the 
> disclaimer gets added to email passing through the MailScanner.
> 
> RH 8.0
> Mailscanner 4.21-9
> Spamassassin/dcc/razor2
> F-prot 4.1.1
> 
> Our setup is internal MS exchange 5.5 / outlook 2000 clients 
> with Mailscanner as a relay to the internet.
> 
> The problem only occurs when the mail is generated from MS 
> exchange which sometimes encodes pdf files as quoted 
> printable (looking on TechNet shows that MS exchange decides 
> the encoding depending on the pdf file version). If the mail 
> is generated with base64 the pdf file passes through correctly.
> 
> I have found discussions of the problem within mailing lists 
> of similar products to Mailscanner which also seem to suffer 
> from this problem, so I think it must be down to the 
> MIME::QuotedPrint perl module and the ambiguity of the QP 
> standard on different OS's.
> 
http://mailtools.anomy.net/archives/anomy-bugs/2002-06/0003.shtml

As a quick fix I have advised users to zip all pdf files to ensure
correct delivery. I have also discussed the possibility of the MS
exchange people forcing the attachment encoding to base64 but they are
cautious in case something else breaks. I think they are unwilling to
change as it all worked before I put in the Mailscanner relay.

Is there any advice you can offer on this problem. (Suggestions of
smashing up the MS exchange box can not be accepted).

Thanks in advance.

Dean Plant.

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury,
Bracknell, Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is
confidential to Roke Manor Research Ltd and must not be passed to any
third party without permission. This communication is for information
only and shall not create or change any contractual relationship.


From mailscanner at ecs.soton.ac.uk  Mon Jul 28 11:44:36 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <74BC2BBF06470148911E64E2B48FE13904995C@pinewood.ncl.ac.uk>
Message-ID: <5.2.1.1.2.20030728114327.03a50ec8@imap.ecs.soton.ac.uk>

Did the problem exist in any earlier 4.22-x releases, or is that not known?
The more I can narrow down the point at which the problem started, the
better the chance I have of finding the problem.

At 11:34 28/07/2003, you wrote:
>Julian
>
>It appears that the "corrupted PDF file" problem is more extensive and
>serious than described below. I said in a message to the list a few days
>ago that:
>
>"We are running MS 4.22-5 with SA 2.55 and users are suffering some
>serious problems sending/receiving PDF files. The problem seems to have
>started with MS 4.22-5. Most (all?) incoming PDF attachments are flagged
>as corrupt.
>
>"The problem is even apparent with a local sender who is using Pine on a
>Unix system. Zipping the PDF file appears to make no difference. It thus
>appears that it is within MS or one of the modules that is processing
>the PDF file that the problem occurs."
>
>I have two sample PDF files that cannot be sent from this site because
>of the behaviour of MS or my configuring of it.
>
>Quentin
>---
>PHONE: +44 191 222 8209    Computing Service, University of Newcastle
>FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
>------------------------------------------------------------------------
>"Any opinion expressed above is mine. The University can get its own."
>
> > -----Original Message-----
> > From: Plant, Dean [mailto:dean.plant@ROKE.CO.UK]
> > Sent: 28 July 2003 11:24
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Corrupt pdf files, any advice.
> >
> >
> > Julian,
> >
> > I hope you had a good holiday.
> >
> > I am having a problem with pdf files corrupting when the
> > disclaimer gets added to email passing through the MailScanner.
> >
> > RH 8.0
> > Mailscanner 4.21-9
> > Spamassassin/dcc/razor2
> > F-prot 4.1.1
> >
> > Our setup is internal MS exchange 5.5 / outlook 2000 clients
> > with Mailscanner as a relay to the internet.
> >
> > The problem only occurs when the mail is generated from MS
> > exchange which sometimes encodes pdf files as quoted
> > printable (looking on TechNet shows that MS exchange decides
> > the encoding depending on the pdf file version). If the mail
> > is generated with base64 the pdf file passes through correctly.
> >
> > I have found discussions of the problem within mailing lists
> > of similar products to Mailscanner which also seem to suffer
> > from this problem, so I think it must be down to the
> > MIME::QuotedPrint perl module and the ambiguity of the QP
> > standard on different OS's.
> >
>http://mailtools.anomy.net/archives/anomy-bugs/2002-06/0003.shtml
>
>As a quick fix I have advised users to zip all pdf files to ensure
>correct delivery. I have also discussed the possibility of the MS
>exchange people forcing the attachment encoding to base64 but they are
>cautious in case something else breaks. I think they are unwilling to
>change as it all worked before I put in the Mailscanner relay.
>
>Is there any advice you can offer on this problem. (Suggestions of
>smashing up the MS exchange box can not be accepted).
>
>Thanks in advance.
>
>Dean Plant.
>
>--
>Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury,
>Bracknell, Berkshire. RG12 8FZ
>
>The information contained in this e-mail and any attachments is
>confidential to Roke Manor Research Ltd and must not be passed to any
>third party without permission. This communication is for information
>only and shall not create or change any contractual relationship.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Mon Jul 28 11:50:26 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <74BC2BBF06470148911E64E2B48FE13904995C@pinewood.ncl.ac.uk>
Message-ID: <5.2.1.1.2.20030728114828.0394b308@imap.ecs.soton.ac.uk>

The only relevant change to Message.pm was this:

@@ -1432,6 +1432,8 @@
    if (MailScanner::Config::Value('signalreadyscanned', $this) ||
        !$entity->head->count($scannerheader)) {
      $this->SignCleanEntity($entity);
+    $entity->head->add('MIME-Version', '1.0')
+      unless $entity->head->get('mime-version');
      $this->{bodymodified} = 1;
    }
  }

Fancy trying undoing that change to see if it makes any difference?
Also, if you could send me the badly-behaved PDF files, I could try them
out here. Hopefully I will be able to reproduce the problem...

At 11:34 28/07/2003, you wrote:
>Julian
>
>It appears that the "corrupted PDF file" problem is more extensive and
>serious than described below. I said in a message to the list a few days
>ago that:
>
>"We are running MS 4.22-5 with SA 2.55 and users are suffering some
>serious problems sending/receiving PDF files. The problem seems to have
>started with MS 4.22-5. Most (all?) incoming PDF attachments are flagged
>as corrupt.
>
>"The problem is even apparent with a local sender who is using Pine on a
>Unix system. Zipping the PDF file appears to make no difference. It thus
>appears that it is within MS or one of the modules that is processing
>the PDF file that the problem occurs."
>
>I have two sample PDF files that cannot be sent from this site because
>of the behaviour of MS or my configuring of it.
>
>Quentin
>---
>PHONE: +44 191 222 8209    Computing Service, University of Newcastle
>FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
>------------------------------------------------------------------------
>"Any opinion expressed above is mine. The University can get its own."
>
> > -----Original Message-----
> > From: Plant, Dean [mailto:dean.plant@ROKE.CO.UK]
> > Sent: 28 July 2003 11:24
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Corrupt pdf files, any advice.
> >
> >
> > Julian,
> >
> > I hope you had a good holiday.
> >
> > I am having a problem with pdf files corrupting when the
> > disclaimer gets added to email passing through the MailScanner.
> >
> > RH 8.0
> > Mailscanner 4.21-9
> > Spamassassin/dcc/razor2
> > F-prot 4.1.1
> >
> > Our setup is internal MS exchange 5.5 / outlook 2000 clients
> > with Mailscanner as a relay to the internet.
> >
> > The problem only occurs when the mail is generated from MS
> > exchange which sometimes encodes pdf files as quoted
> > printable (looking on TechNet shows that MS exchange decides
> > the encoding depending on the pdf file version). If the mail
> > is generated with base64 the pdf file passes through correctly.
> >
> > I have found discussions of the problem within mailing lists
> > of similar products to Mailscanner which also seem to suffer
> > from this problem, so I think it must be down to the
> > MIME::QuotedPrint perl module and the ambiguity of the QP
> > standard on different OS's.
> >
>http://mailtools.anomy.net/archives/anomy-bugs/2002-06/0003.shtml
>
>As a quick fix I have advised users to zip all pdf files to ensure
>correct delivery. I have also discussed the possibility of the MS
>exchange people forcing the attachment encoding to base64 but they are
>cautious in case something else breaks. I think they are unwilling to
>change as it all worked before I put in the Mailscanner relay.
>
>Is there any advice you can offer on this problem. (Suggestions of
>smashing up the MS exchange box can not be accepted).
>
>Thanks in advance.
>
>Dean Plant.
>
>--
>Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury,
>Bracknell, Berkshire. RG12 8FZ
>
>The information contained in this e-mail and any attachments is
>confidential to Roke Manor Research Ltd and must not be passed to any
>third party without permission. This communication is for information
>only and shall not create or change any contractual relationship.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From john at OFIZ.COM  Mon Jul 28 12:45:36 2003
From: john at OFIZ.COM (John Thewlis)
Date: Thu Jan 12 21:19:05 2006
Subject: MailScanner Webmin Module 0.7 Beta Released
In-Reply-To: <8C4A83966C27354C928048C4A1620EF8C0EF@lando.rebel.com>
Message-ID: <BB4ACB70.E167%john@ofiz.com>

Hi Richard

Thanks for the updated release.

Is there any possibility that you might include whitelist and blacklist
update facilities on a per user and/or a per domain basis using the webmin
mailscanner interface?

It would sure save a lot of manual file editing.

Thanks Richard

Kind regards

John


On 25/07/2003 20:05, "Richard Lush" <richard.lush@NTLWORLD.COM> wrote:

> Hi All,
> 
> Apologies for the lateness of this release - I've just swapped jobs and things
> are rather hectic at the moment.
> 
> Anyway, I am pleased to announce the release of Version 0.7 Beta of the
> MailScanner webmin module.
> 
> It can be downloaded from http://lushsoft.dyndns.org/mailscanner-webmin
> 
> Regards
> 
> Richard
> 

John Thewlis

ofiz.com ? Your Global Virtual Office - Where do you want to be today?

Tel: +353 86 6009176

Email: john@ofiz.com

IMPORTANT NOTICE:

This email may be confidential, may be legally privileged, and is for the
intended recipient only.  Access, disclosure, copying, distribution, or
reliance on any of it by anyone else is prohibited and may be a criminal
offence.  Please delete if obtained in error and email confirmation to the
sender. 

ofiz.com cannot guarantee that this e-mail and attachments are free of
viruses and you must ensure that you carry your own virus checks.  ofiz.com
accepts no liability for any loss or damage caused by software viruses.


From mhewryk at SYMCOR.COM  Mon Jul 28 13:57:11 2003
From: mhewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:19:05 2006
Subject: Permission on the quarantine directories
Message-ID: <LISTSERV%2003072813571134@JISCMAIL.AC.UK>

Hi,

Here is another good script.  You can run it from cron.
It detects emails qf/df in quarantine directory and emails to the
designated mailbox (e.g. on exchange or notes).  It can be modified to ssh
instead of emailing.


#!/bin/bash
#
# Purpose: - move quarantined qf/df files to the outbound queue, for
delivery
#          - edit the RECIPIENT field; all email goes to a single mailbox
#
PATH=/bin:/usr/bin; export PATH

OUTQ=/var/spool/mqueue
QUARANTINEDIR=/var/spool/MailScanner/quarantine
NEW_RECIP=attachment@notes.smpt.symcor.com

exec >/var/log/forward-attachments.log 2>&1

# The quarantined email is placed in directories with this format:
# $QUARANTINEDIR/YYYYMMDD/$MessageID/
# The files in the directory will be:
# - the qf file (which we will edit)
# - the df file (which contains the attachments(s))
# - one or more attachment files

# Algorithm:
#
# For each of the above type of directory, check that it has BOTH a
#   qf & df file; if it DOESN'T, ignore it (it's not ready). If it DOES,
then:
#
#   1) edit the qf (change the recipient field)
#   2) move the qf & df files into the OUTQ (for delivery)
#   3) delete the directory and any its contents (ie., attachments)
#   4) delete empty parent directories; this is
#      solely for the purpose of keeping QUARANTINEDIR tidy

cd $QUARANTINEDIR

# NOTE: We need to explicitly ignore the "./spam/" sub-directory,
# because we are only dealing with attachments here.
find ???????? -type d -mindepth 1 ! -name spam |
while read dir
do
   cd $QUARANTINEDIR/$dir
   if [ $? != 0 ]; then # couldn't chdir into that directory; that's bad
      continue
   fi
   echo "Current directory: $PWD"

   # verify that BOTH the df & qf files exist
   # ignore files that have a "." in the name
   qf_file=$(ls -1 qf* 2>/dev/null | grep -v "\.")
   df_file=$(ls -1 df* 2>/dev/null | grep -v "\.")
   if [ "$df_file" = "" -o "$qf_file" = "" ]; then
      echo -e "Skipping directory; it's not ready yet\n"
      continue
   fi
   echo "Directory $dir is ready to be processed..."

   echo "Changing recipient to '$NEW_RECIP'..."
   sed 's/^RPFD:<.*>/RPFD:<'$NEW_RECIP'>/' $qf_file > $qf_file.tmp
   mv $qf_file.tmp $qf_file

   echo "Moving the qf & df files into the OUTQ (for delivery)..."
   mv $qf_file $df_file $OUTQ

   echo "Removing any attachments left in directory..."
   rm *

   echo "Removing the directory, which should now be empty..."
   cd /
   rmdir $QUARANTINEDIR/$dir

   echo ""

done

# 4) Cleanup empty directories, where possible.
# Directories which aren't empty will generate errors; ignore these.
rmdir $QUARANTINEDIR/???????? 2>/dev/null

From mhewryk at SYMCOR.COM  Mon Jul 28 14:06:55 2003
From: mhewryk at SYMCOR.COM (Magda Hewryk)
Date: Thu Jan 12 21:19:05 2006
Subject: Permission on the quarantine directories
Message-ID: <LISTSERV%2003072814065552@JISCMAIL.AC.UK>

Hi,
I really would like to be able to change permissions on quarantine
directory and force MailScanner to drop attachments with the specific
permissions.
I've tried to set GID on quarantine directory and set group to Operations
(ops) but it doesn't help because  directories creates by MailScanner
inside the qurantine direcotory are created with "S" for group which means
to executable permission for group.
drwxrws---   40 root     ops          4096 Jul 28 08:20 quarantine

/var/spool/MailScanner/quarantine/
   4 drwx--S---   11 root     ops          4096 Jul 24 23:56 20030724
   4 drwx--S---   20 root     ops          4096 Jul 25 19:48 20030725
   4 drwx--S---    5 root     ops          4096 Jul 26 22:27 20030726
   4 drwx--S---    9 root     ops          4096 Jul 27 22:07 20030727
   4 drwx--S---    3 root     ops          4096 Jul 28 08:20 20030728

From Denis.Beauchemin at USHERBROOKE.CA  Mon Jul 28 14:30:24 2003
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:19:05 2006
Subject: Permission on the quarantine directories
In-Reply-To: <LISTSERV%2003072814065552@JISCMAIL.AC.UK>
References: <LISTSERV%2003072814065552@JISCMAIL.AC.UK>
Message-ID: <1059399023.13875.38.camel@dbeauchemin.sti.usherbrooke.ca>

Magda,

You could put something like this in root's crontab (that's what I did):
2-59/5 7-23 * * * (chown -R user.group /quarantine/*; chmod -R g+rx /quarantine/*)

Denis
Le lun 28/07/2003 ? 09:06, Magda Hewryk a ?crit :
> Hi,
> I really would like to be able to change permissions on quarantine
> directory and force MailScanner to drop attachments with the specific
> permissions.
> I've tried to set GID on quarantine directory and set group to Operations
> (ops) but it doesn't help because  directories creates by MailScanner
> inside the qurantine direcotory are created with "S" for group which means
> to executable permission for group.
> drwxrws---   40 root     ops          4096 Jul 28 08:20 quarantine
> 
> /var/spool/MailScanner/quarantine/
>    4 drwx--S---   11 root     ops          4096 Jul 24 23:56 20030724
>    4 drwx--S---   20 root     ops          4096 Jul 25 19:48 20030725
>    4 drwx--S---    5 root     ops          4096 Jul 26 22:27 20030726
>    4 drwx--S---    9 root     ops          4096 Jul 27 22:07 20030727
>    4 drwx--S---    3 root     ops          4096 Jul 28 08:20 20030728
-- 
Denis Beauchemin, analyste
Universit? de Sherbrooke, S.T.I.
T: 819.821.8000x2252 F: 819.821.8045


From Peter.Bates at LSHTM.AC.UK  Mon Jul 28 14:33:15 2003
From: Peter.Bates at LSHTM.AC.UK (Peter Bates)
Date: Thu Jan 12 21:19:05 2006
Subject: MS vs. Amavis
Message-ID: <sf25343d.003@s-nst5.lshtm.ac.uk>

Hello all...

>Can someone who used both virusscanners do a quick comparation 
>between these scanners - which is better for which function and why.

Others have answered, but I thought I'd stick my oar in.

We've pretty much now completed moving from amavisd(new) to MailScanner, and are very happy with MS. Being Postfix users, the main thing that triggered this move was, rather obviously, Postfix support in MS.

Prior to that we used amavis (the shell-script version), amavisd (the perl 'daemonized' version, and then 'amavisd-new' (one of 3 current forks but the only one to really add SpamAssassin support).

Although amavis (in its various incarnations) served us well for a number of years, I think it was mostly the Postfix support that kept us with it for so long...

Commonalities between the two:

- both written in Perl
- both reliant on external modules (but Julian's RPM installation process, for example, is a breeze/doddle/dream)
- both support a wide range of AV scanners
- both support/hook into SpamAssassin.

I can't really now think of many pros to using amavisd (which is unfortunate, but there you go!), but various cons:

- one large monolithic Perl script and a single configuration file (which also contained embedded chunks of Perl)
- dual-MTA setup left essentially two records of any message passing through the system, and more Received: headers
- reliance on acting as an MTA to reinject the messages - I have seen oddly formatted messages (generally spam, however!) that have failed to pass through.

In contrast, the main things I now like MS for:

- code and configuration split up into fairly logical chunks
- batch-based scanning (amavisd is strictly 'per message')
- extremely configurable with rulesets (amavisd does have support for this stuff, but often results in hand-patching the 'amavisd' main script)

... just my thoughts.

--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838 


From mailscanner at ELKNET.NET  Mon Jul 28 16:05:23 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:19:05 2006
Subject: Spamassassin timeout results in MS 100% CPU and server lockup (correction)
Message-ID: <200307281505.h6SF5PS09454@ori.rl.ac.uk>

Version 2.60 cvs

>Are you running SA 2.55? Sounds like it's a Perl bug somewhere. I don't
>think there's any MS code that could loop in this situation...

When this happens, TOP shows an MailScanner process at 70-80% of memory usage and 90+% of cpu usages

Let me know if you need any other stats etc, I can reenable bayes to cause the problem and capture whatever you need.

Thanks,
-Alan

From ka at PACIFIC.NET  Mon Jul 28 16:18:18 2003
From: ka at PACIFIC.NET (Ken Anderson)
Date: Thu Jan 12 21:19:05 2006
Subject: Whitelisted
In-Reply-To: <Pine.LNX.4.44.0307272226110.14561-100000@mailbox.prolocation.net>
References: <Pine.LNX.4.44.0307272226110.14561-100000@mailbox.prolocation.net>
Message-ID: <3F253EBA.7010401@pacific.net>

Raymond Dijkxhoorn wrote:

> Hi!
>
>
>>1) Start the incoming sendmail with a different config file.
>>Changes to /etc/rc.d/init.d/MailScanner (from rpm install on redhat)
>>make this change to the incoming sendmail command line:
>>------ snip -------
>>
>>  $SENDMAIL -bd -OPrivacyOptions=noetrn \
>>                       -ODeliveryMode=queueonly \
>>                       -OQueueDirectory=$INQDIR \
>>                       -OPidFile=$INPID \
>>                       -C/etc/mail/sendmail_in.cf
>>
>
>
> Works perfectly, only thing is my load on the box itself allmost doubled.
> So if you try this on a heavy loaded box, think twice :)

yep. Same here. I was able to gain the cost back by making some
performance adjustments.

1. Turn off fsync() on maillog in /etc/syslog.conf (on linux)
ie:
mail.*  -/var/log/maillog

2. Mount /var/spool/MailScanner/incoming as tmpfs

3. Because of #2 above, you can decrease the number of MailScanner
threads AND the frequency of batch runs. This pushes more mail into the
MailScanner/incoming directory so batches are larger. Since the incoming
directory is in memory now, mailscanner unpacks and scans message
batches faster. The price is a few seconds delay for messages traveling
through the system, but overall I/O is lower.

4. Sendmail's MaxRecipients = x is also a major factor, since each
message is cloned x times. I believe the default is 100 or 128... That's
probably too high if you are splitting all incoming mail into 1 recip
per message!

Ken A.
Pacific.Net


> But besides that, perfect solution, works like advertised!
>
> Thanks,
> Raymond.
>
>

From raymond at PROLOCATION.NET  Mon Jul 28 16:35:43 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:05 2006
Subject: Whitelisted
In-Reply-To: <3F253EBA.7010401@pacific.net>
Message-ID: <Pine.LNX.4.44.0307281722170.25597-100000@mailbox.prolocation.net>

Hi!

> yep. Same here. I was able to gain the cost back by making some
> performance adjustments.
>
> 1. Turn off fsync() on maillog in /etc/syslog.conf (on linux)
> ie:
> mail.*  -/var/log/maillog
>
> 2. Mount /var/spool/MailScanner/incoming as tmpfs

I allready did that before :)

> 3. Because of #2 above, you can decrease the number of MailScanner
> threads AND the frequency of batch runs. This pushes more mail into the
> MailScanner/incoming directory so batches are larger. Since the incoming
> directory is in memory now, mailscanner unpacks and scans message
> batches faster. The price is a few seconds delay for messages traveling
> through the system, but overall I/O is lower.

Thats why my number of MS processes was higher then usual.
>
> 4. Sendmail's MaxRecipients = x is also a major factor, since each
> message is cloned x times. I believe the default is 100 or 128... That's
> probably too high if you are splitting all incoming mail into 1 recip
> per message!

Put that on 50 allready. I also played with the load settings, the LA
settings in the .cf one.

Thanks,
Raymond.

From ejb at QL.ORG  Mon Jul 28 17:22:10 2003
From: ejb at QL.ORG (Jay Berkenbilt)
Date: Thu Jan 12 21:19:05 2006
Subject: Spam Action rules: first match vs. all match?
Message-ID: <200307281622.h6SGMAqN008015@soup.ads.apexinc.com>

My MailScanner version is 4.21-9, but, based on NEWS, I don't think
this issue has been addressed by 4.22-5.  I'm using SpamAssassin
2.55.  These are both installed on an Intel RedHat 9 box.  I have no
virus scanners activated and am using this only as a spam filter (for
which it is fabulous, by the way!).

The spammer technique of making putting the recipient of a message in
both the To and From fields of a message seems to be increasing in
popularity lately.  I've seen an explosion of these in the last two
weeks or so.  I'm talking about something like this (with : replaced
by ; in the headers below to avoid confusing any mail readers):

  To; Some Local User <someuser@some.domain>
  From; Random Spammer <someuser@some.domain>

We have the spam action "bounce" set for all spam.  This means that
our own users get a lot of bounce notices from MailScanner from spam
it looks like they sent to themselves.  A surprising number of users
get confused by this and think that they are getting notified of a
blocked message TO them instead.  Besides, it's annoying.

I tried to stop this from happening by having the following rules in
my spam actions rules file:

FromAndTo:      *@primary.domain        forward zzz@yyy
To:             *@primary.domain        bounce forward zzz@yyy
FromOrTo:       default                 deliver forward zzz@yyy

Note that our mail server handles mail for multiple domains, and I
only want bounces for primary.domain.  (primary.domain and zzz@yyy
are, of course, substitutions for the actual values.)

This doesn't work as hoped.  Our internal users are still getting
bounces.  After groveling through the code, it appears that rules
files can be configured as first match or all match.  In the "first"
match case, actions associated with the first matching rule are taken.
In the "all" match case, if any rules other than the default match,
the union of the actions in all matching rules other than the default
rule are taken, and if no rule (i.e., only the default rule) matches,
then the default rule's actions are used.  This would certainly
explain why the above rules don't work.  In fact, a FromAndTo rule
with any domain matched by any other rule can never have fewer actions
than a From or To rule.  It seems to me that I would either need
something like a FromAndNotTo rule or a different matching scheme.

I suppose I could just modify ConfigDefs.pl and move the SpamActions
line to a different category such as [First,YesNo], but I'm reluctant
to do that without studying the code a bit more to ensure that this
won't have any surprising side effects.

My questions:

 1.  Would it be safe for me to just move SpamActions into
     [First,YesNo] as I'm guessing?

 2.  With regular expressions, it seems like anything that you can do
     with an All rule you could do with a First rule, though it may be
     more cumbersome in some cases.  Maybe I could think of a
     counterexample, but I haven't so far.  Is there a compelling
     reason why SpamActions isn't a First rule or can't be configured
     at run-time to be a First rule?  (I could see backward
     compatibility as a significant factor here since previously valid
     files would remain valid but do something completely different.)

 3.  Is anyone thinking about making the rule specification more
     general to avoid this kind of problem?

 4.  Is having a special case to match the case of the From and the
     To address matching worth even considering?  This could open a
     Pandora's box of special cases, but it does seem possibly worthy
     of consideration, especially since you can't create a regular
     expression that says From = To.

Thanks for any assistance.

--
Jay Berkenbilt <ejb@ql.org>
http://www.ql.org/q/

From mailscanner at ecs.soton.ac.uk  Mon Jul 28 18:02:33 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Spam Action rules: first match vs. all match?
In-Reply-To: <200307281622.h6SGMAqN008015@soup.ads.apexinc.com>
Message-ID: <5.2.1.1.2.20030728175922.026a40a0@imap.ecs.soton.ac.uk>

What I thought about doing was adding a "STOP" entry in any of the "all
matches" rules, so that evaluation of the rules for that recipient/sender
would stop at that point and not carry on trying to match other rules in
the ruleset.

The rules would still be evaluated for all of the recipient(s) and the
sender, but this would enable you to stop the rule checking when you had
matched a previous rule.

Would that solve the problem, or indeed help at all?

At 17:22 28/07/2003, you wrote:
>My MailScanner version is 4.21-9, but, based on NEWS, I don't think
>this issue has been addressed by 4.22-5.  I'm using SpamAssassin
>2.55.  These are both installed on an Intel RedHat 9 box.  I have no
>virus scanners activated and am using this only as a spam filter (for
>which it is fabulous, by the way!).
>
>The spammer technique of making putting the recipient of a message in
>both the To and From fields of a message seems to be increasing in
>popularity lately.  I've seen an explosion of these in the last two
>weeks or so.  I'm talking about something like this (with : replaced
>by ; in the headers below to avoid confusing any mail readers):
>
>   To; Some Local User <someuser@some.domain>
>   From; Random Spammer <someuser@some.domain>
>
>We have the spam action "bounce" set for all spam.  This means that
>our own users get a lot of bounce notices from MailScanner from spam
>it looks like they sent to themselves.  A surprising number of users
>get confused by this and think that they are getting notified of a
>blocked message TO them instead.  Besides, it's annoying.
>
>I tried to stop this from happening by having the following rules in
>my spam actions rules file:
>
>FromAndTo:      *@primary.domain        forward zzz@yyy
>To:             *@primary.domain        bounce forward zzz@yyy
>FromOrTo:       default                 deliver forward zzz@yyy
>
>Note that our mail server handles mail for multiple domains, and I
>only want bounces for primary.domain.  (primary.domain and zzz@yyy
>are, of course, substitutions for the actual values.)
>
>This doesn't work as hoped.  Our internal users are still getting
>bounces.  After groveling through the code, it appears that rules
>files can be configured as first match or all match.  In the "first"
>match case, actions associated with the first matching rule are taken.
>In the "all" match case, if any rules other than the default match,
>the union of the actions in all matching rules other than the default
>rule are taken, and if no rule (i.e., only the default rule) matches,
>then the default rule's actions are used.  This would certainly
>explain why the above rules don't work.  In fact, a FromAndTo rule
>with any domain matched by any other rule can never have fewer actions
>than a From or To rule.  It seems to me that I would either need
>something like a FromAndNotTo rule or a different matching scheme.
>
>I suppose I could just modify ConfigDefs.pl and move the SpamActions
>line to a different category such as [First,YesNo], but I'm reluctant
>to do that without studying the code a bit more to ensure that this
>won't have any surprising side effects.
>
>My questions:
>
>  1.  Would it be safe for me to just move SpamActions into
>      [First,YesNo] as I'm guessing?
>
>  2.  With regular expressions, it seems like anything that you can do
>      with an All rule you could do with a First rule, though it may be
>      more cumbersome in some cases.  Maybe I could think of a
>      counterexample, but I haven't so far.  Is there a compelling
>      reason why SpamActions isn't a First rule or can't be configured
>      at run-time to be a First rule?  (I could see backward
>      compatibility as a significant factor here since previously valid
>      files would remain valid but do something completely different.)
>
>  3.  Is anyone thinking about making the rule specification more
>      general to avoid this kind of problem?
>
>  4.  Is having a special case to match the case of the From and the
>      To address matching worth even considering?  This could open a
>      Pandora's box of special cases, but it does seem possibly worthy
>      of consideration, especially since you can't create a regular
>      expression that says From = To.
>
>Thanks for any assistance.
>
>--
>Jay Berkenbilt <ejb@ql.org>
>http://www.ql.org/q/

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From nathan at TCPNETWORKS.NET  Mon Jul 28 18:09:47 2003
From: nathan at TCPNETWORKS.NET (Nathan Johanson)
Date: Thu Jan 12 21:19:05 2006
Subject: Question: Advanced SpamAssassin Settings
Message-ID: <CC6008BDBF458A4DB8456380C1BAB3800BA00D@server1.in.tcpnetworks.com>

Hello,

I'm getting ready to upgrade to 4.22-5 from 4.14-9 and I had a few
questions about the "new" Advanced SpamAssassin Settings. Before these
options were implemented, I added the following lines to
spam.assassin.prefs.conf in order to change the location of the bayes
database.

bayes_path      /var/spool/spamassassin/bayes
bayes_file_mode 0644

It looks like this setting is now deprecated in favor of

SpamAssassin User State Dir =

I'm assuming I can safely comment out the former settings in
spam.assassin.prefs.conf and define the following in MailScanner.conf to
get the same effect?

SpamAssassin User State Dir = /var/spool/spamassassin/bayes

Correct? Or if I leave the new "SpamAssassin User State Dir" value
empty, will MailScanner continue to use my bayes settings in
spam.assassin.prefs.conf?

If I'm using a vanilla SpamAssassin installation, I'm assuming the rest
of the Advanced SpamAssassin Settings (such as "SpamAssassin Local Rules
Dir" and "SpamAssassin Default Rules Dir") can be left alone. These two
options are used only if you prefer not to use
/etc/MailScanner/spam.assassin.prefs.conf for some reason? Right? I'm
guess I'm a little confused by the difference between these two
configuration options.

Also, the MailScanner FAQ suggested setting the bayes_file_mode to 0644
(my current setting), but other places suggest it should be 0600. Does
it matter? 

Thanks in advance!

Sincerely,

Nathan Johanson
Email: nathan@tcpnetworks.net


From ejb at QL.ORG  Mon Jul 28 18:37:17 2003
From: ejb at QL.ORG (Jay Berkenbilt)
Date: Thu Jan 12 21:19:05 2006
Subject: Spam Action rules: first match vs. all match?
Message-ID: <LISTSERV%2003072818371745@JISCMAIL.AC.UK>

On Mon, 28 Jul 2003 18:02:33 +0100, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>What I thought about doing was adding a "STOP" entry in any of the "all
>matches" rules, so that evaluation of the rules for that recipient/sender
>would stop at that point and not carry on trying to match other rules in
>the ruleset.
>
>The rules would still be evaluated for all of the recipient(s) and the
>sender, but this would enable you to stop the rule checking when you had
>matched a previous rule.
>
>Would that solve the problem, or indeed help at all?

How would that work?  If you mean something like this:

FromAndTo: *@primary.domain forward zzz@yyy
STOP
To:  *@primary.domain bounce forward zzz@yyy
FromOrTo: default   deliver forward zzz@yyy

meaning that when the STOP line is encountered, rule matching should
stop if any above rules had matched, that would work for me and would
actually add quite a bit of flexibility.  It would make it possible to
do things like have a specific list of users or subdomains in a domain
that get special treatment.  For example:

From:  user1@domain.com deliver
From:  user2@domain.com deliver
From:  user3@one.domain.com deliver
From:  user4@two.domain.com deliver
From:  *@two.domain.com forward zzz@yyy
STOP
From:  *@one.domain.com forward zzz@yyy
STOP
From:  *@*.domain.com  bounce forward zzz@yyy
From:  *@domain.com  bounce forward zzz@yyy

Semantics such as what would result from the above could be tricky to
achieve with either all or first rules.  If it weren't for user4, then
the above without STOP would be the same as if it were interpreted as
first match, but with the above as all with STOP implemented,
user4@two.domain.com's actions would be "deliver forward zzz@yyy".
(Okay, this example would be easy to make work with first, but
still...)

Another option I had been thinking about would be to able to mark a
single rule as exclusive, but I think the above is better.

--
Jay Berkenbilt <ejb@ql.org>
http://www.ql.org/q/

From dot at DOTAT.AT  Mon Jul 28 18:35:36 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:05 2006
Subject: Spam Action rules: first match vs. all match?
In-Reply-To: <m2n.19hBQq-000rP0@chiark.greenend.org.uk>
References: <200307281622.h6SGMAqN008015@soup.ads.apexinc.com>
Message-ID: <E19hBuK-00055n-00@chiark.greenend.org.uk>

Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>
>What I thought about doing was adding a "STOP" entry in any of the "all
>matches" rules, so that evaluation of the rules for that recipient/sender
>would stop at that point and not carry on trying to match other rules in
>the ruleset.

I think my soft rules idea could help with this kind of situation, but
you'd lose the behaviour of concatenating the results of all the rules
that match. I'm not particularly convinced of the value of that feature,
though -- you can achieve it by just being a bit more verbose in your
rules file, e.g. instead of

        To:     special@dotat.at        bounce
        To:     *@dotat.at              deliver

you would say

        To:     special@dotat.at        bounce deliver
        To:     *@dotat.at              deliver

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
MALIN: SOUTHEAST BECOMING CYCLONIC 4 OR 5, OCCASIONALLY 6. RAIN AT TIMES.
MODERATE OR GOOD.

From dot at DOTAT.AT  Mon Jul 28 18:37:32 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:05 2006
Subject: Question: Advanced SpamAssassin Settings
In-Reply-To: <m2n.19hBVf-000rRE@chiark.greenend.org.uk>
Message-ID: <E19hBwC-0005Er-00@chiark.greenend.org.uk>

Nathan Johanson <nathan@TCPNETWORKS.NET> wrote:
>
>Or if I leave the new "SpamAssassin User State Dir" value
>empty, will MailScanner continue to use my bayes settings in
>spam.assassin.prefs.conf?

Yes.

>If I'm using a vanilla SpamAssassin installation, I'm assuming the rest
>of the Advanced SpamAssassin Settings (such as "SpamAssassin Local Rules
>Dir" and "SpamAssassin Default Rules Dir") can be left alone.

Yes.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
LYME REGIS TO LANDS END INCLUDING THE ISLES OF SCILLY: SOUTHWEST 5 OR 6,
DECREASING 4 OR 5, LOCALLY INCREASING 6 AGAIN ON TUESDAY. OCCASIONAL RAIN OR
SHOWERS. MODERATE OR GOOD, BUT PERHAPS POOR FOR A TIME ON TUESDAY. MODERATE OR
ROUGH.

From cparker at SWATGEAR.COM  Mon Jul 28 20:23:34 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:19:05 2006
Subject: create stat report(s) on spam score stats
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE1AE168@ati-ex-01.ati.local>

Hello,

I've just had a good idea (well, *I* think it's a good idea) and I'd
like to survey the list to find out the feasibility of it and
usefulness.

One thing that I've just recently started doing was actually putting the
high-spam score (and it's related action) to use. Right now I have it
set that 9 points and greater get deleted. 4 to <9 get the regular
{Spam?} in the subject.

What I want to do is better decide what the best scores for our business
is. My idea is this. Each time a mail comes through it's spam score is
written to a database (or flat file, or whatever) along with the
recipient (each recipient above one will be treated as a separate email
and therefore get a record of it's own) and the sender.

Then a php page (or your script of choice) could be created to determine
the low spam score and the high spam score. This page would basically
just pull out the records, do some calculations based on the score and
find the average and standard deviations.

Here's why I'm thinking this is a good idea, the only way for me to get
the scores of the emails is by right-clicking them and looking at the
headers by choosing properties (I'm using Outlook 2000). Then I have to
scroll down to the spam score section and read the score.

After doing about 10 emails I can kind of get an idea of what the
average spam score is. Right now, although my high-spam score is at 9, I
think I may be able to move it down to 8. But these numbers don't take
into account other users spam mails. For example my boss gets a lot of
spam.

I'm thinking that a legitimate email that gets marked as spam
(false-positive) is most likely NOT going to get into the high-spam
score range.

What would it take to do this? Or more specifically, what would it take
to have a record written to a mysql db for each and every mail?


I will appreciate any/all feedback,
Chris.


From mailscanner at LISTS.COM.AR  Mon Jul 28 20:42:40 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:05 2006
Subject: create stat report(s) on spam score stats
In-Reply-To: <001BD19C96E6E64E8750D72C2EA0ECEE1AE168@ati-ex-01.ati.local>
Message-ID: <3F255280.4310.102E357C@localhost>

Take a look at the SQLLogging functions in CustomConfig.pm, it does what you 
want (log messages in a sql database).

It inserts one record/message in one table, plus one record/recipient in 
another table which you sould be able to join and get the results you want... 
if you're using Sendmail... that is, the id's used by Sendmail I think are 
expected to be unique (they are timestamp-based), whereas the id's in ZMailer 
(the ones I use) are only unique during a brief period, since they are only 
based in the inode number of the file and these get reused quite frequently 
(at least in Linux).

Anyway, you should be able to modify the code tu suit you.

El 28 Jul 2003 a las 12:23, Chris W. Parker escribi?:

> Hello,
> 
> I've just had a good idea (well, *I* think it's a good idea) and I'd
> like to survey the list to find out the feasibility of it and
> usefulness.
> 
> One thing that I've just recently started doing was actually putting the
> high-spam score (and it's related action) to use. Right now I have it
> set that 9 points and greater get deleted. 4 to <9 get the regular
> {Spam?} in the subject.
> 
> What I want to do is better decide what the best scores for our business
> is. My idea is this. Each time a mail comes through it's spam score is
> written to a database (or flat file, or whatever) along with the
> recipient (each recipient above one will be treated as a separate email
> and therefore get a record of it's own) and the sender.
> 
> Then a php page (or your script of choice) could be created to determine
> the low spam score and the high spam score. This page would basically
> just pull out the records, do some calculations based on the score and
> find the average and standard deviations.
> 
> Here's why I'm thinking this is a good idea, the only way for me to get
> the scores of the emails is by right-clicking them and looking at the
> headers by choosing properties (I'm using Outlook 2000). Then I have to
> scroll down to the spam score section and read the score.
> 
> After doing about 10 emails I can kind of get an idea of what the
> average spam score is. Right now, although my high-spam score is at 9, I
> think I may be able to move it down to 8. But these numbers don't take
> into account other users spam mails. For example my boss gets a lot of
> spam.
> 
> I'm thinking that a legitimate email that gets marked as spam
> (false-positive) is most likely NOT going to get into the high-spam
> score range.
> 
> What would it take to do this? Or more specifically, what would it take
> to have a record written to a mysql db for each and every mail?
> 
> 
> I will appreciate any/all feedback,
> Chris.


--
Mariano Absatz
El Baby
----------------------------------------------------------
Make yourself at home! Clean my kitchen.


From dot at DOTAT.AT  Mon Jul 28 20:37:47 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:05 2006
Subject: create stat report(s) on spam score stats
In-Reply-To: <m2n.19hDbE-000rWi@chiark.greenend.org.uk>
Message-ID: <E19hDoZ-0004RQ-00@chiark.greenend.org.uk>

"Chris W. Parker" <cparker@SWATGEAR.COM> wrote:
>
>What would it take to do this? Or more specifically, what would it take
>to have a record written to a mysql db for each and every mail?

My Log Non Spam option allows you to set things up so that all the scores
appear in the MailScanner log, so you can just grep them out.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
NORTH FORELAND TO SELSEY BILL: SOUTHWEST 4 OR 5. OCCASIONAL RAIN OR SHOWERS.
MODERATE OR GOOD. SLIGHT OR MODERATE.

From cparker at SWATGEAR.COM  Mon Jul 28 20:54:30 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:19:05 2006
Subject: create stat report(s) on spam score stats
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE2B7E11@ati-ex-01.ati.local>

Tony Finch <mailto:dot@DOTAT.AT>
    on Monday, July 28, 2003 12:38 PM said:

>> What would it take to do this? Or more specifically, what would it
>> take to have a record written to a mysql db for each and every mail?
> 
> My Log Non Spam option allows you to set things up so that all the
> scores appear in the MailScanner log, so you can just grep them out.

But then you still have to get it into a db somehow and I'm not familiar
with turning the results from grep into records in a db.


Chris.


From RKearney at AZERTY.COM  Mon Jul 28 20:56:33 2003
From: RKearney at AZERTY.COM (Kearney, Rob)
Date: Thu Jan 12 21:19:05 2006
Subject: create stat report(s) on spam score stats
Message-ID: <210DF55DED65B547896F728FB057F3B2019C44E9@seaver.ussco.com>

Yep, 
As Mariano stated, use the SQLLogging function, (we actually modified to do
this real-time, instead of "batch" with no real degradation of performance,
delivering 48k message of which 28k were spam).

use something like this to get avg.. 


mysql> select avg(sascore) from maillog_mail where time > '20030724' and
time < '20030725' and isspam = 1;
+--------------+
| avg(sascore) |
+--------------+
|    11.845470 |
+--------------+
1 row in set (0.38 sec)

-rob


-----Original Message-----
From: Mariano Absatz [mailto:mailscanner@LISTS.COM.AR]
Sent: Monday, July 28, 2003 3:43 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: create stat report(s) on spam score stats


Take a look at the SQLLogging functions in CustomConfig.pm, it does what you

want (log messages in a sql database).

It inserts one record/message in one table, plus one record/recipient in 
another table which you sould be able to join and get the results you
want... 
if you're using Sendmail... that is, the id's used by Sendmail I think are 
expected to be unique (they are timestamp-based), whereas the id's in
ZMailer 
(the ones I use) are only unique during a brief period, since they are only 
based in the inode number of the file and these get reused quite frequently 
(at least in Linux).

Anyway, you should be able to modify the code tu suit you.

El 28 Jul 2003 a las 12:23, Chris W. Parker escribi?:

> Hello,
> 
> I've just had a good idea (well, *I* think it's a good idea) and I'd
> like to survey the list to find out the feasibility of it and
> usefulness.
> 
> One thing that I've just recently started doing was actually putting the
> high-spam score (and it's related action) to use. Right now I have it
> set that 9 points and greater get deleted. 4 to <9 get the regular
> {Spam?} in the subject.
> 
> What I want to do is better decide what the best scores for our business
> is. My idea is this. Each time a mail comes through it's spam score is
> written to a database (or flat file, or whatever) along with the
> recipient (each recipient above one will be treated as a separate email
> and therefore get a record of it's own) and the sender.
> 
> Then a php page (or your script of choice) could be created to determine
> the low spam score and the high spam score. This page would basically
> just pull out the records, do some calculations based on the score and
> find the average and standard deviations.
> 
> Here's why I'm thinking this is a good idea, the only way for me to get
> the scores of the emails is by right-clicking them and looking at the
> headers by choosing properties (I'm using Outlook 2000). Then I have to
> scroll down to the spam score section and read the score.
> 
> After doing about 10 emails I can kind of get an idea of what the
> average spam score is. Right now, although my high-spam score is at 9, I
> think I may be able to move it down to 8. But these numbers don't take
> into account other users spam mails. For example my boss gets a lot of
> spam.
> 
> I'm thinking that a legitimate email that gets marked as spam
> (false-positive) is most likely NOT going to get into the high-spam
> score range.
> 
> What would it take to do this? Or more specifically, what would it take
> to have a record written to a mysql db for each and every mail?
> 
> 
> I will appreciate any/all feedback,
> Chris.


--
Mariano Absatz
El Baby
----------------------------------------------------------
Make yourself at home! Clean my kitchen.


From mailscanner at ecs.soton.ac.uk  Mon Jul 28 21:10:18 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <5.2.1.1.2.20030728114828.0394b308@imap.ecs.soton.ac.uk>
References: <74BC2BBF06470148911E64E2B48FE13904995C@pinewood.ncl.ac.uk>
Message-ID: <5.2.1.1.2.20030728210417.0411b120@imap.ecs.soton.ac.uk>

I have found a serious bug in the QuotedPrint.pm distributed with Perl 5.8,
among other versions. This will corrupt any file encoded using
quoted-printable encoding that should really have been encoded using Base64.

I found the file in
         /usr/lib/perl5/5.8.0/i386-linux-thread-multi/MIME
but you may find it in another location. On a Linux box do a
         locate QuotedPrint.pm
and see what it says.

The patch to fix (or at least work around) the bug is here:

--- QuotedPrint.pm.original     2003-07-28 21:03:37.000000000 +0100
+++ QuotedPrint.pm      2003-07-28 21:03:24.000000000 +0100
@@ -133,6 +133,7 @@
  {
      my $res = shift;
      $res =~ s/[ \t]+?(\r?\n)/$1/g;  # rule #3 (trailing space must be
deleted)
+    $res =~ s/=0A=\n/\n\r/g; # JKF handle PC encoding of CRLF
      $res =~ s/=\r?\n//g;            # rule #5 (soft line breaks)
      if (ord('A') == 193) { # EBCDIC style machine
          if (ord('[') == 173) {

This simply spots the end-of-line sequence that PC's use when Outlook
encodes files. The problem lies in the definition of \n on different OS-es.

Please try this out and let me know how you get on. If this fixes the
problem, I will incorporate the fix into the MailScanner distribution (via
function-overloading) and produce an August release as this needs fixing
a.s.a.p..

I don't think this problem was introduced necessarily in MailScanner 4.22
but is a fault in the QuotedPrint.pm decoder shipped with recent versions
of Perl as the file decoder is broken, so any attempts to rebuild the
original message from the attachment files will produce broken attachments.

At 11:50 28/07/2003, you wrote:
>The only relevant change to Message.pm was this:
>
>@@ -1432,6 +1432,8 @@
>    if (MailScanner::Config::Value('signalreadyscanned', $this) ||
>        !$entity->head->count($scannerheader)) {
>      $this->SignCleanEntity($entity);
>+    $entity->head->add('MIME-Version', '1.0')
>+      unless $entity->head->get('mime-version');
>      $this->{bodymodified} = 1;
>    }
>  }
>
>Fancy trying undoing that change to see if it makes any difference?
>Also, if you could send me the badly-behaved PDF files, I could try them
>out here. Hopefully I will be able to reproduce the problem...
>
>At 11:34 28/07/2003, you wrote:
>>Julian
>>
>>It appears that the "corrupted PDF file" problem is more extensive and
>>serious than described below. I said in a message to the list a few days
>>ago that:
>>
>>"We are running MS 4.22-5 with SA 2.55 and users are suffering some
>>serious problems sending/receiving PDF files. The problem seems to have
>>started with MS 4.22-5. Most (all?) incoming PDF attachments are flagged
>>as corrupt.
>>
>>"The problem is even apparent with a local sender who is using Pine on a
>>Unix system. Zipping the PDF file appears to make no difference. It thus
>>appears that it is within MS or one of the modules that is processing
>>the PDF file that the problem occurs."
>>
>>I have two sample PDF files that cannot be sent from this site because
>>of the behaviour of MS or my configuring of it.
>>
>>Quentin
>>---
>>PHONE: +44 191 222 8209    Computing Service, University of Newcastle
>>FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
>>------------------------------------------------------------------------
>>"Any opinion expressed above is mine. The University can get its own."
>>
>> > -----Original Message-----
>> > From: Plant, Dean [mailto:dean.plant@ROKE.CO.UK]
>> > Sent: 28 July 2003 11:24
>> > To: MAILSCANNER@JISCMAIL.AC.UK
>> > Subject: Corrupt pdf files, any advice.
>> >
>> >
>> > Julian,
>> >
>> > I hope you had a good holiday.
>> >
>> > I am having a problem with pdf files corrupting when the
>> > disclaimer gets added to email passing through the MailScanner.
>> >
>> > RH 8.0
>> > Mailscanner 4.21-9
>> > Spamassassin/dcc/razor2
>> > F-prot 4.1.1
>> >
>> > Our setup is internal MS exchange 5.5 / outlook 2000 clients
>> > with Mailscanner as a relay to the internet.
>> >
>> > The problem only occurs when the mail is generated from MS
>> > exchange which sometimes encodes pdf files as quoted
>> > printable (looking on TechNet shows that MS exchange decides
>> > the encoding depending on the pdf file version). If the mail
>> > is generated with base64 the pdf file passes through correctly.
>> >
>> > I have found discussions of the problem within mailing lists
>> > of similar products to Mailscanner which also seem to suffer
>> > from this problem, so I think it must be down to the
>> > MIME::QuotedPrint perl module and the ambiguity of the QP
>> > standard on different OS's.
>> >
>>http://mailtools.anomy.net/archives/anomy-bugs/2002-06/0003.shtml
>>
>>As a quick fix I have advised users to zip all pdf files to ensure
>>correct delivery. I have also discussed the possibility of the MS
>>exchange people forcing the attachment encoding to base64 but they are
>>cautious in case something else breaks. I think they are unwilling to
>>change as it all worked before I put in the Mailscanner relay.
>>
>>Is there any advice you can offer on this problem. (Suggestions of
>>smashing up the MS exchange box can not be accepted).
>>
>>Thanks in advance.
>>
>>Dean Plant.
>>
>>--
>>Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury,
>>Bracknell, Berkshire. RG12 8FZ
>>
>>The information contained in this e-mail and any attachments is
>>confidential to Roke Manor Research Ltd and must not be passed to any
>>third party without permission. This communication is for information
>>only and shall not create or change any contractual relationship.
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at LISTS.COM.AR  Mon Jul 28 21:33:43 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <5.2.1.1.2.20030728210417.0411b120@imap.ecs.soton.ac.uk>
References: <5.2.1.1.2.20030728114828.0394b308@imap.ecs.soton.ac.uk>
Message-ID: <3F255E77.15586.105CF08C@localhost>

Julian,

it seems there's an official patch for this in the newest release of the 
MIME::Base64 modules. See the top entries in
http://search.cpan.org/src/GAAS/MIME-Base64-2.20/Changes
note that the MIME::QuotedPrint module inside Perl 5.8.0 is 2.03, whereas the 
current (from 2003-05) is 2.20. I only see one public release inbetween 
(2.13).

Maybe the most sensible thing to do is to require the MIME-Base64 package 
with at least version 2.20...

El 28 Jul 2003 a las 21:10, Julian Field escribi?:

> I have found a serious bug in the QuotedPrint.pm distributed with Perl 5.8,
> among other versions. This will corrupt any file encoded using
> quoted-printable encoding that should really have been encoded using Base64.
> 
> I found the file in
>          /usr/lib/perl5/5.8.0/i386-linux-thread-multi/MIME
> but you may find it in another location. On a Linux box do a
>          locate QuotedPrint.pm
> and see what it says.
> 
> The patch to fix (or at least work around) the bug is here:
> 
> --- QuotedPrint.pm.original     2003-07-28 21:03:37.000000000 +0100
> +++ QuotedPrint.pm      2003-07-28 21:03:24.000000000 +0100
> @@ -133,6 +133,7 @@
>   {
>       my $res = shift;
>       $res =~ s/[ \t]+?(\r?\n)/$1/g;  # rule #3 (trailing space must be
> deleted)
> +    $res =~ s/=0A=\n/\n\r/g; # JKF handle PC encoding of CRLF
>       $res =~ s/=\r?\n//g;            # rule #5 (soft line breaks)
>       if (ord('A') == 193) { # EBCDIC style machine
>           if (ord('[') == 173) {
> 
> This simply spots the end-of-line sequence that PC's use when Outlook
> encodes files. The problem lies in the definition of \n on different OS-es.
> 
> Please try this out and let me know how you get on. If this fixes the
> problem, I will incorporate the fix into the MailScanner distribution (via
> function-overloading) and produce an August release as this needs fixing
> a.s.a.p..
> 
> I don't think this problem was introduced necessarily in MailScanner 4.22
> but is a fault in the QuotedPrint.pm decoder shipped with recent versions
> of Perl as the file decoder is broken, so any attempts to rebuild the
> original message from the attachment files will produce broken attachments.
> 
> At 11:50 28/07/2003, you wrote:
> >The only relevant change to Message.pm was this:
> >
> >@@ -1432,6 +1432,8 @@
> >    if (MailScanner::Config::Value('signalreadyscanned', $this) ||
> >        !$entity->head->count($scannerheader)) {
> >      $this->SignCleanEntity($entity);
> >+    $entity->head->add('MIME-Version', '1.0')
> >+      unless $entity->head->get('mime-version');
> >      $this->{bodymodified} = 1;
> >    }
> >  }
> >
> >Fancy trying undoing that change to see if it makes any difference?
> >Also, if you could send me the badly-behaved PDF files, I could try them
> >out here. Hopefully I will be able to reproduce the problem...
> >
> >At 11:34 28/07/2003, you wrote:
> >>Julian
> >>
> >>It appears that the "corrupted PDF file" problem is more extensive and
> >>serious than described below. I said in a message to the list a few days
> >>ago that:
> >>
> >>"We are running MS 4.22-5 with SA 2.55 and users are suffering some
> >>serious problems sending/receiving PDF files. The problem seems to have
> >>started with MS 4.22-5. Most (all?) incoming PDF attachments are flagged
> >>as corrupt.
> >>
> >>"The problem is even apparent with a local sender who is using Pine on a
> >>Unix system. Zipping the PDF file appears to make no difference. It thus
> >>appears that it is within MS or one of the modules that is processing
> >>the PDF file that the problem occurs."
> >>
> >>I have two sample PDF files that cannot be sent from this site because
> >>of the behaviour of MS or my configuring of it.
> >>
> >>Quentin
> >>---
> >>PHONE: +44 191 222 8209    Computing Service, University of Newcastle
> >>FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
> >>------------------------------------------------------------------------
> >>"Any opinion expressed above is mine. The University can get its own."
> >>
> >> > -----Original Message-----
> >> > From: Plant, Dean [mailto:dean.plant@ROKE.CO.UK]
> >> > Sent: 28 July 2003 11:24
> >> > To: MAILSCANNER@JISCMAIL.AC.UK
> >> > Subject: Corrupt pdf files, any advice.
> >> >
> >> >
> >> > Julian,
> >> >
> >> > I hope you had a good holiday.
> >> >
> >> > I am having a problem with pdf files corrupting when the
> >> > disclaimer gets added to email passing through the MailScanner.
> >> >
> >> > RH 8.0
> >> > Mailscanner 4.21-9
> >> > Spamassassin/dcc/razor2
> >> > F-prot 4.1.1
> >> >
> >> > Our setup is internal MS exchange 5.5 / outlook 2000 clients
> >> > with Mailscanner as a relay to the internet.
> >> >
> >> > The problem only occurs when the mail is generated from MS
> >> > exchange which sometimes encodes pdf files as quoted
> >> > printable (looking on TechNet shows that MS exchange decides
> >> > the encoding depending on the pdf file version). If the mail
> >> > is generated with base64 the pdf file passes through correctly.
> >> >
> >> > I have found discussions of the problem within mailing lists
> >> > of similar products to Mailscanner which also seem to suffer
> >> > from this problem, so I think it must be down to the
> >> > MIME::QuotedPrint perl module and the ambiguity of the QP
> >> > standard on different OS's.
> >> >
> >>http://mailtools.anomy.net/archives/anomy-bugs/2002-06/0003.shtml
> >>
> >>As a quick fix I have advised users to zip all pdf files to ensure
> >>correct delivery. I have also discussed the possibility of the MS
> >>exchange people forcing the attachment encoding to base64 but they are
> >>cautious in case something else breaks. I think they are unwilling to
> >>change as it all worked before I put in the Mailscanner relay.
> >>
> >>Is there any advice you can offer on this problem. (Suggestions of
> >>smashing up the MS exchange box can not be accepted).
> >>
> >>Thanks in advance.
> >>
> >>Dean Plant.
> >>
> >>--
> >>Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury,
> >>Bracknell, Berkshire. RG12 8FZ
> >>
> >>The information contained in this e-mail and any attachments is
> >>confidential to Roke Manor Research Ltd and must not be passed to any
> >>third party without permission. This communication is for information
> >>only and shall not create or change any contractual relationship.
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >Professional Support Services at www.MailScanner.biz
> >MailScanner thanks transtec Computers for their support
> 
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support


--
Mariano Absatz
El Baby
----------------------------------------------------------
Honey, I Formatted the Kid!


From dot at DOTAT.AT  Mon Jul 28 21:30:43 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <m2n.19hEKX-000rbB@chiark.greenend.org.uk>
References: <74BC2BBF06470148911E64E2B48FE13904995C@pinewood.ncl.ac.uk>
            <5.2.1.1.2.20030728114828.0394b308@imap.ecs.soton.ac.uk>
Message-ID: <E19hEdn-0007n8-00@chiark.greenend.org.uk>

Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>
>I have found a serious bug in the QuotedPrint.pm distributed with Perl 5.8,
>among other versions. This will corrupt any file encoded using
>quoted-printable encoding that should really have been encoded using Base64.

Which version of the module is that? I have version 2.16 and your patch
doesn't apply to it.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
LUNDY FASTNET IRISH SEA: SOUTHWEST 5 OR 6 OCCASIONALLY 7, PERHAPS GALE 8 LATER
IN FASTNET. OCCASIONAL RAIN. MODERATE OR POOR BECOMING GOOD.

From mailscanner at ecs.soton.ac.uk  Mon Jul 28 21:54:03 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <E19hEdn-0007n8-00@chiark.greenend.org.uk>
References: <m2n.19hEKX-000rbB@chiark.greenend.org.uk>
            <74BC2BBF06470148911E64E2B48FE13904995C@pinewood.ncl.ac.uk>
            <5.2.1.1.2.20030728114828.0394b308@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030728215345.024703e8@imap.ecs.soton.ac.uk>

At 21:30 28/07/2003, you wrote:
>Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
> >
> >I have found a serious bug in the QuotedPrint.pm distributed with Perl 5.8,
> >among other versions. This will corrupt any file encoded using
> >quoted-printable encoding that should really have been encoded using Base64.
>
>Which version of the module is that? I have version 2.16 and your patch
>doesn't apply to it.

2.3
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From rzewnickie at RFA.ORG  Mon Jul 28 22:04:17 2003
From: rzewnickie at RFA.ORG (Eric Dantan Rzewnicki)
Date: Thu Jan 12 21:19:05 2006
Subject: MS vs. Amavis
In-Reply-To: <00e001c35309$eb2d2000$23c8a8c0@SERV>
References: <786653281.20030725214705@guest.arnes.si>
            <20030725195923.GC9680@rfa.org>
            <00e001c35309$eb2d2000$23c8a8c0@SERV>
Message-ID: <20030728210417.GE11597@rfa.org>

Chris,

Thanks for clarifying and correcting my post.

-Eric Rz.

On Fri 25/07/2003 20:07:35, Chris Trudeau wrote:
> > -amavis development is fragmented into various forks of the project.
>
> Amavisd-new is the most stable of the three general forks mentioned above,
> while fragemented, amavisd is extremely well supported by the communitiy
> which includes several notable names.
>
> >  Along with that comes fragmentation of the user/support community.
>
> While I somewhat agree, the support has been stellar from all included in
> Amavisd-new mailings.

...

> I am actually using both currently in test.  MS is handling initial receipt
> of messages, hands them off to an amavisd-new implementation.  SA scores are
> alomst identical and the accuracy is great.  I have had some problems with
> MS dying on me though and have not had to restart amavisd yet...HOWEVER...
>
> The configurable nature of MS with rules based processing is STELLAR.  I can
> easily say that my need to support several domains with completely different
> requirements is achieved with MailScanner hands down.  I would rather
> seperate SA prefs for each domain...but that is antoher topic altogether.  I
> like them both, but because of the rules-based config, I will probably go
> with MailScanner.
>
> I STRONGLY recommend trying both and determining which REALLY meets your
> needs...they both have great strong qualities.
>
> CT

From moliveri at UTI.COM  Mon Jul 28 22:25:05 2003
From: moliveri at UTI.COM (Mike Oliveri)
Date: Thu Jan 12 21:19:05 2006
Subject: Exim spools followup
Message-ID: <5.2.0.9.0.20030728161922.00a7f538@mail211.pair.com>

Hey guys,

Just a quick question regarding Exim spools. I first brought this up a
couple weeks ago, but only am just now able to tackle it once again.
Anyway, I received an answer conflicted to the Exim installation guide on
the website, so I thought I'd just get a quick clarification.

The Exim install guide at
http://www.sng.ecs.soton.ac.uk/mailscanner/install/exim.shtml says:

"MailScanner also needs to be told where the Exim incoming and outgoing
spool directories are. In the simple case these settings will work; note
that MailScanner needs to be explicitly told the input subdirectory which
is implicit in the Exim configuration.

"Incoming Queue Dir = /var/spool/exim.in/input
Outgoing Queue Dir = /var/spool/exim/input
If you have split_spool_directory in your Exim configuration the
configuration is slightly different:

"Incoming Queue Dir = /var/spool/exim.in/input/*
Outgoing Queue Dir = /var/spool/exim/input
Split Exim Spool = yes"

However, I got a reply from this list saying MailScanner should look no
deeper than the main spool directory /var/spool/exim. How do the other Exim
users out there have it configured? Also, is this something that should be
updated on the website?

Thanks!

Take care,
Mike Oliveri
Systems Administrator
UTI Systems, Inc
moliveri@uti.com

From mailscanner at ecs.soton.ac.uk  Mon Jul 28 23:03:34 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Exim spools followup
In-Reply-To: <5.2.0.9.0.20030728161922.00a7f538@mail211.pair.com>
Message-ID: <5.2.1.1.2.20030728230300.04127e90@imap.ecs.soton.ac.uk>

At 22:25 28/07/2003, you wrote:
>Also, is this something that should be
>updated on the website?

Almost certainly.

Tony? (As resident Exim guru :-)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at LISTS.COM.AR  Mon Jul 28 23:47:34 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:05 2006
Subject: ZMailer update
Message-ID: <3F257DD6.15659.10D77EFF@localhost>

Hi Julian,

rather than make you search thru the recently "marked as already read" mail
pile, I'll write again :-)

I uploaded a modified init.d/MailScanner script sysconfig/MailScanner file so
that the rpm is a little more ZMailer aware.

I did the modifications following the spirit of the original files (I based
them on the 4.22-5 release).

As I know your development setup doesn't call for patches (at least for those
I can generate from a standard distribution), I uploaded everything to the
web.

In
http://baby.com.ar/MailScanner/ModifiedFilesForMailScannerDistribution/init.d/
MailScanner you'll find the init.d startup script and in
http://baby.com.ar/MailScanner/ModifiedFilesForMailScannerDistribution/sysconf
ig/MailScanner, the sysconfig file. Both are ready for distribution in the
sense that the variables are set up for Sendmail and you have to modify the
sysconfig file in order to use ZMailer.

Finally I updated the instructions for installing MailScanner+ZMailer, using
either RPM's (both for MS and ZM) or for doing it manually. I included a
patch for the init.d script but, if you include it in the future, I'll change
the instructions so that you just edit 2 or 3 lines and you're ready to go.

The instructions are at
http://baby.com.ar/MailScanner/ModifiedFilesForMailScannerDistribution/doc/ins
tall/zmailer.shtml (I copied your ecs.css so the look doesn't change).

The instructions include absolute links to an init.d script for MailScanner
standalone and for ZMailer standalone (for the manual installation). They
point to
http://baby.com.ar/MailScanner/ModifiedFilesForMailScannerDistribution/doc/zma
iler and
http://baby.com.ar/MailScanner/ModifiedFilesForMailScannerDistribution/doc/Mai
lScanner

Feel free to copy both to your site and edit the document accordingly, or
live it pointing there, as you prefer.

The later script should work with MailScanner standalone, in the sense that
you can start only MailScanner with this script and have independent scripts
for starting sendmail, exim, postfix or whatever mta you're using.

Regards, and welcome back.



--
Mariano Absatz
El Baby
----------------------------------------------------------
"Unix was not designed to stop people from doing stupid things,
because that would also stop them from doing clever things."
                       --Doug Gwyn

From mailscanner at ecs.soton.ac.uk  Tue Jul 29 01:53:26 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <5.2.1.1.2.20030728215345.024703e8@imap.ecs.soton.ac.uk>
References: <E19hEdn-0007n8-00@chiark.greenend.org.uk>
            <m2n.19hEKX-000rbB@chiark.greenend.org.uk>
            <74BC2BBF06470148911E64E2B48FE13904995C@pinewood.ncl.ac.uk>
            <5.2.1.1.2.20030728114828.0394b308@imap.ecs.soton.ac.uk>
Message-ID: <5.2.1.1.2.20030729015128.024e9d60@imap.ecs.soton.ac.uk>

I'm now not so sure, as I have just discovered that the original PDF file I
was testing with this displayed fine in Acrobat, but was declared corrupt
by Sophos.

I'm on the lookout for the qf+df files of a message including a PDF file
that Sophos is happy with, or a PDF file that Outlook XP will encode as
quoted-printable (I can only get Outlook to use Base64, which of course
works fine).

So still haven't resolved this, sorry.

At 21:54 28/07/2003, you wrote:
>At 21:30 28/07/2003, you wrote:
>>Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>> >
>> >I have found a serious bug in the QuotedPrint.pm distributed with Perl 5.8,
>> >among other versions. This will corrupt any file encoded using
>> >quoted-printable encoding that should really have been encoded using
>> Base64.
>>
>>Which version of the module is that? I have version 2.16 and your patch
>>doesn't apply to it.
>
>2.3
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From dot at DOTAT.AT  Tue Jul 29 09:20:27 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:05 2006
Subject: Exim spools followup
In-Reply-To: <m2n.19hFTO-000tfw@chiark.greenend.org.uk>
Message-ID: <E19hPid-00027U-00@chiark.greenend.org.uk>

Mike Oliveri <moliveri@UTI.COM> wrote:
>
>However, I got a reply from this list saying MailScanner should look no
>deeper than the main spool directory /var/spool/exim.

That's wrong.

>How do the other Exim users out there have it configured? Also, is
>this something that should be updated on the website?

The web site is correct.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
SOUTH UTSIRE FORTIES: SOUTH OR SOUTHEAST, BECOMING VARIABLE IN WEST FORTIES
LATER, 4 OR 5 OCCASIONALLY 6 IN EAST. OCCASIONAL RAIN. MODERATE OR GOOD.

From dot at DOTAT.AT  Tue Jul 29 09:26:27 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:05 2006
Subject: Julian??
In-Reply-To: <m2n.19giiK-000pb3@chiark.greenend.org.uk>
References: <200307261740.h6QHeeu23393@camelot.blacknightsolutions.com>
            <008401c353bf$e038e5b0$f8240340@kh06s9>
Message-ID: <E19hPoR-0002Kt-00@chiark.greenend.org.uk>

Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>At 22:50 26/07/2003, you wrote:
>
>>   Have you managed to catch up on all the list traffic
>>since you've been away?
>
>I did "select all" then "mark as read". I had 21,000 new messages waiting
>for me, so a certain amount of "bulk" operations had to take place.

http://news.bbc.co.uk/1/hi/technology/3104889.stm

"A week without e-mail is more traumatic than moving house or getting
divorced, say techies."

[...]

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
SOUTH UTSIRE FORTIES: SOUTH OR SOUTHEAST, BECOMING VARIABLE IN WEST FORTIES
LATER, 4 OR 5 OCCASIONALLY 6 IN EAST. OCCASIONAL RAIN. MODERATE OR GOOD.

From dean.plant at ROKE.CO.UK  Tue Jul 29 10:12:07 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A7023675E@rsys004a.roke.co.uk>

Julian Field wrote:
> I'm now not so sure, as I have just discovered that the original PDF
> file I was testing with this displayed fine in Acrobat, but was
> declared corrupt by Sophos.
>
> I'm on the lookout for the qf+df files of a message including a PDF
> file that Sophos is happy with, or a PDF file that Outlook XP will
> encode as quoted-printable (I can only get Outlook to use Base64,
> which of course works fine).
>
> So still haven't resolved this, sorry.
>
> At 21:54 28/07/2003, you wrote:
>> At 21:30 28/07/2003, you wrote:
>>> Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>>>>
>>>> I have found a serious bug in the QuotedPrint.pm distributed with
>>>> Perl 5.8, among other versions. This will corrupt any file encoded
>>>> using quoted-printable encoding that should really have been
>>>> encoded using Base64.
>>>
>>> Which version of the module is that? I have version 2.16 and your
>>> patch doesn't apply to it.
>>
>> 2.3
>> --
>> Julian Field
>> www.MailScanner.info
>> Professional Support Services at www.MailScanner.biz
>> MailScanner thanks transtec Computers for their support

I have a set of qf/df files with an quoted-printable encoded pdf file that I
have been testing with. I dont know if sophos will corrupt it because im
using f-prot. Do you have an offline address that I can sent it to. Its
about 2mb.

Dean Plant.

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

From P.G.M.Peters at utwente.nl  Tue Jul 29 11:32:02 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:19:05 2006
Subject: Using Bayes with spamtraps
Message-ID: <m1jcivcbo3e1cb7oujhipila01173dc62g@4ax.com>

Would it be possible to use spamtraps and sa-learn --single to teach the
bayes engine of SA?

I have thinking about the other possibilities (bouncing or public
folders) but they are not easily implemented at our situation. But we
have a spamtrap-domain with which i was planning to do something when I
generated it.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From mailscanner at ecs.soton.ac.uk  Tue Jul 29 12:22:55 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <EA943CD30BCB104E9D38F5B5DC2D9A70236760@rsys004a.roke.co.uk
 >
Message-ID: <5.2.0.9.2.20030729121104.043939e0@imap.ecs.soton.ac.uk>

Dean has kindly sent me the qf+df files from a message containing a PDF 
file that is corrupted. He has also sent me the original untouched PDF file 
to compare with the df file.

Well, whatever generated the original quoted-printable message
         X-Mailer: Internet Mail Service (5.5.2653.19)
did it wrong.

If you do an "od -c" on the test1.pdf file you get this:
0000000   %   P   D   F   -   1   .   2  \r   %   ?   ?   ?   ?  \r  \n
0000020   6   3   2   6       0       o   b   j  \r   <   <      \r   /
Note the \r\n at the end of the first line, just before the 6326.

but if you do an "od -c" of the quoted-printable message contents (so you 
can see any embedded newline characters and so on), you get this:
0000000   %   P   D   F   -   1   .   2   =   0   D   %   =   E   2   =
0000020   E   3   =   C   F   =   D   3  \n   6   3   2   6       0
0000040   o   b   j   =   0   D   <   <       =   0   D   /
Now look what has happened to the data just before the 6326. It has been 
squashed into 1 \n character, thereby destroying the \r in the original.

I can only imagine that Outlook/Exchange saw the \r\n sequence near the 
start of the file, and concluded that it was a text-based file. It 
therefore saw nothing wrong in squashing \r\n into just \n, which would 
work fine on a text file. Unfortunately its original decision about the 
file was wrong in this case :-(

This makes it
a) Microsoft's fault
and
b) Not a problem I can work around, as their software has destroyed data 
that I cannot reconstruct.

Outlook XP always appears to use Base64, so I suspect the problem may just 
exist in Exchange 5.5 and/or Outlook 97. Don't know about Outlook 2000.

Whether Acrobat Reader (on some platforms) will continue to be able to use 
the damaged file is another matter entirely, something over which I have no 
control.

All I can suggest is you request people using the particular troublesome 
versions always zip their PDF files to stop Outlook destroying them.

If anyone has any ideas about a software workaround I could implement, 
please let me know as I can't think of any way of doing it right now.
-- 
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support



From dot at DOTAT.AT  Tue Jul 29 12:20:17 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:05 2006
Subject: Exim spools followup
In-Reply-To: <m2n.19hRm5-000pla@chiark.greenend.org.uk>
References: <m2n.19hFTO-000tfw@chiark.greenend.org.uk>
            <E19hPid-00027U-00@chiark.greenend.org.uk>
            <E19hPid-00027U-00@chiark.greenend.org.uk>
Message-ID: <E19hSWf-0002CU-00@chiark.greenend.org.uk>

Nick Phillips <nwp@LEMON-COMPUTING.COM> wrote:
>
>I'm just horrendously out-of-date :-(

Yes, I did beat up the code a bit fter you had finished it :-)

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
SOUTH UTSIRE FORTIES: SOUTH OR SOUTHEAST, BECOMING VARIABLE IN WEST FORTIES
LATER, 4 OR 5 OCCASIONALLY 6 IN EAST. OCCASIONAL RAIN. MODERATE OR GOOD.

From mailscanner at ecs.soton.ac.uk  Tue Jul 29 12:31:14 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
Message-ID: <5.2.0.9.2.20030729123055.04f0a828@wheresmymailserver.com>

Dean has kindly sent me the qf+df files from a message containing a PDF 
file that is corrupted. He has also sent me the original untouched PDF file 
to compare with the df file.

Well, whatever generated the original quoted-printable message
         X-Mailer: Internet Mail Service (5.5.2653.19)
did it wrong.

If you do an "od -c" on the test1.pdf file you get this:
0000000   %   P   D   F   -   1   .   2  \r   %   ?   ?   ?   ?  \r  \n
0000020   6   3   2   6       0       o   b   j  \r   <   <      \r   /
Note the \r\n at the end of the first line, just before the 6326.

but if you do an "od -c" of the quoted-printable message contents (so you 
can see any embedded newline characters and so on), you get this:
0000000   %   P   D   F   -   1   .   2   =   0   D   %   =   E   2   =
0000020   E   3   =   C   F   =   D   3  \n   6   3   2   6       0
0000040   o   b   j   =   0   D   <   <       =   0   D   /
Now look what has happened to the data just before the 6326. It has been 
squashed into 1 \n character, thereby destroying the \r in the original.

I can only imagine that Outlook/Exchange saw the \r\n sequence near the 
start of the file, and concluded that it was a text-based file. It 
therefore saw nothing wrong in squashing \r\n into just \n, which would 
work fine on a text file. Unfortunately its original decision about the 
file was wrong in this case :-(

This makes it
a) Microsoft's fault
and
b) Not a problem I can work around, as their software has destroyed data 
that I cannot reconstruct.

Outlook XP always appears to use Base64, so I suspect the problem may just 
exist in Exchange 5.5 and/or Outlook 97. Don't know about Outlook 2000.

Whether Acrobat Reader (on some platforms) will continue to be able to use 
the damaged file is another matter entirely, something over which I have no 
control.

All I can suggest is you request people using the particular troublesome 
versions always zip their PDF files to stop Outlook destroying them.

If anyone has any ideas about a software workaround I could implement, 
please let me know as I can't think of any way of doing it right now.
-- 
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support


From P.G.M.Peters at utwente.nl  Tue Jul 29 12:39:17 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:19:05 2006
Subject: Using queue priorities to deliver normal messages faster
Message-ID: <d0ncivsa8pijnbe01dlg465mofbecr4r0a@4ax.com>

Julian,

Sendmail uses a priority to decide which messages should be processed
first. Could it be possible for MS to change the priority for messages
that are tagged as spam and/or virus so the normal messages get through
faster?

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From P.G.M.Peters at utwente.nl  Tue Jul 29 12:42:31 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:19:05 2006
Subject: permission problems
Message-ID: <ianciv0qfg7llidflpor3m2mbar8vqrbgs@4ax.com>

I run MailScanner as user and group mail for security reasons. But the
installation requires me to run install.sh as root.

This creates all files as root. So I have to change all ownerships back
to mail after installation. That I can understand.

But the installation also changes the ownership of /var/spool/mqueue.in.
Even when the ownership was correct (mail.mail). That is a problem
because when I forget to change this no e-mail is accepted.

The strange part is that the installation doesn't change
/var/spool/MailScanner nor /var/spool/mqueue. Can't the script be
changed as to leave the ownerships of files intact or to use the old
owner when overwriting a file?

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From moliveri at UTI.COM  Tue Jul 29 13:01:54 2003
From: moliveri at UTI.COM (Mike Oliveri)
Date: Thu Jan 12 21:19:05 2006
Subject: Exim spools followup
In-Reply-To: <E19hPid-00027U-00@chiark.greenend.org.uk>
References: <m2n.19hFTO-000tfw@chiark.greenend.org.uk>
Message-ID: <5.2.0.9.0.20030729065617.00a0be00@pop3.uti.com>

Thanks for clearing that up, I greatly appreciate it. When I first fired up
Mailscanner, it appeared to be accepting and delivering mail from the
outside world okay, but it would not allow us to send mail. This at least
rules out one culprit. I'll have to dig a bit more, perhaps into my startup
scripts. Or perhaps I'll just wait until I get Exim ver 4.20 installed
rather than still working with 3.36. Thanks!

Take care,
Mike


At 09:20 AM 7/29/03 +0100, you wrote:

>Mike Oliveri <moliveri@UTI.COM> wrote:
> >
> >However, I got a reply from this list saying MailScanner should look no
> >deeper than the main spool directory /var/spool/exim.
>
>That's wrong.
>
> >How do the other Exim users out there have it configured? Also, is
> >this something that should be updated on the website?
>
>The web site is correct.
>
>Tony.
>--
>f.a.n.finch  <dot@dotat.at>  http://dotat.at/
>SOUTH UTSIRE FORTIES: SOUTH OR SOUTHEAST, BECOMING VARIABLE IN WEST FORTIES
>LATER, 4 OR 5 OCCASIONALLY 6 IN EAST. OCCASIONAL RAIN. MODERATE OR GOOD.
From mailscanner at ecs.soton.ac.uk  Tue Jul 29 13:58:43 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: permission problems
In-Reply-To: <ianciv0qfg7llidflpor3m2mbar8vqrbgs@4ax.com>
Message-ID: <5.2.0.9.2.20030729135745.0508cee0@imap.ecs.soton.ac.uk>

At 12:42 29/07/2003, you wrote:
>I run MailScanner as user and group mail for security reasons. But the
>installation requires me to run install.sh as root.
>
>This creates all files as root. So I have to change all ownerships back
>to mail after installation. That I can understand.
>
>But the installation also changes the ownership of /var/spool/mqueue.in.
>Even when the ownership was correct (mail.mail). That is a problem
>because when I forget to change this no e-mail is accepted.
>
>The strange part is that the installation doesn't change
>/var/spool/MailScanner nor /var/spool/mqueue. Can't the script be
>changed as to leave the ownerships of files intact or to use the old
>owner when overwriting a file?

I'll take a look at this. The difficult bit is making sure it creates it
the first time correctly, that's a problem I have with the current code for
creating /var/spool/MailScanner.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Tue Jul 29 13:56:08 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Using queue priorities to deliver normal messages faster
In-Reply-To: <d0ncivsa8pijnbe01dlg465mofbecr4r0a@4ax.com>
Message-ID: <5.2.0.9.2.20030729135532.043c1b80@imap.ecs.soton.ac.uk>

At 12:39 29/07/2003, you wrote:
>Julian,
>
>Sendmail uses a priority to decide which messages should be processed
>first. Could it be possible for MS to change the priority for messages
>that are tagged as spam and/or virus so the normal messages get through
>faster?

How do they store the priority?
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From jkoetsier at CORP.HOME.NL  Tue Jul 29 14:23:49 2003
From: jkoetsier at CORP.HOME.NL (Jeffrey Koetsier)
Date: Thu Jan 12 21:19:05 2006
Subject: Syslog-ng + MailScanner
Message-ID: <3F267565.2040906@corp.home.nl>

Hi,

Currently I'm using syslog-ng and MailScanner. Each time syslog-ng gets
HUP'ed MailScanner stops logging. It will continue logging after the
periodical restart. This can be solved by using the keep alive flag in
syslog-ng. Unfortunately the version I am currently running, syslog-ng
1.5.15 (debian/stable) hasn't got this feature.

I found a workaround in the code of 'spamd' (SA v2.55, spamd, Line 977).
From sw at INTERNETX.DE  Tue Jul 29 14:44:26 2003
From: sw at INTERNETX.DE (Sebastian Wiesinger)
Date: Thu Jan 12 21:19:05 2006
Subject: Using queue priorities to deliver normal messages faster
In-Reply-To: <5.2.0.9.2.20030729135532.043c1b80@imap.ecs.soton.ac.uk>
References: <d0ncivsa8pijnbe01dlg465mofbecr4r0a@4ax.com>
            <5.2.0.9.2.20030729135532.043c1b80@imap.ecs.soton.ac.uk>
Message-ID: <20030729134426.GB13540@internetx.de>

* Julian Field <mailscanner@ECS.SOTON.AC.UK> [2003-07-29 15:09]:
> >Sendmail uses a priority to decide which messages should be processed
> >first. Could it be possible for MS to change the priority for messages
> >that are tagged as spam and/or virus so the normal messages get through
> >faster?
>
> How do they store the priority?

It's the P line in the qf file.
"P line - Priority when processed from queue"

P<integer>
e.g.:
P640561

Lowest Priority is delivered first.

Sebastian
--
InterNetX GmbH
Sebastian Wiesinger
System Administration
Maximilianstrasse 6
D-93047 Regensburg

Tel. +49 941 59559-0
Fax  +49 941 59559-50

eMail: sebastian.wiesinger@internetx.de
GPG-Key: 0x97F5A1D8 (0x8431335F97F5A1D8)

From sanjay.patel at REXWIRE.COM  Tue Jul 29 15:10:54 2003
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:19:05 2006
Subject: Dcc and dccm
Message-ID: <002901c355db$3a4512f0$6f01a8c0@Laptop1>

This is not a MailScanner issue. But if someone can help with it I will
appreciate it. We have installed new version of spamassassin (2.6).
Unfortunately it lets more spam through than the old one. So we decided to
use dcc to see if we get better results.

I have installed dcc and dccm but I get the following error when I try to
start sendmail
incoming sendmail: WARNING: Xdcc: local socket name @dcc_rundir@/dccm
missing

Where do I go to fix this?

SKP

From P.G.M.Peters at utwente.nl  Tue Jul 29 15:30:35 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:19:05 2006
Subject: Using queue priorities to deliver normal messages faster
In-Reply-To: <20030729134426.GB13540@internetx.de>
References: <d0ncivsa8pijnbe01dlg465mofbecr4r0a@4ax.com>
            <5.2.0.9.2.20030729135532.043c1b80@imap.ecs.soton.ac.uk>
            <20030729134426.GB13540@internetx.de>
Message-ID: <r61divs6sa6sl45429b0m821qsnsk9rthn@4ax.com>

On Tue, 29 Jul 2003 15:44:26 +0200, you wrote:

>* Julian Field <mailscanner@ECS.SOTON.AC.UK> [2003-07-29 15:09]:
>> >Sendmail uses a priority to decide which messages should be processed
>> >first. Could it be possible for MS to change the priority for messages
>> >that are tagged as spam and/or virus so the normal messages get through
>> >faster?
>>
>> How do they store the priority?
>
>It's the P line in the qf file.
>"P line - Priority when processed from queue"
>
>P<integer>
>e.g.:
>P640561
>
>Lowest Priority is delivered first.

Good information about sendmail queues is at
http://people.freenet.de/slgig/op_en/appendix_b.html

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From brent at WHITE-DEV.QUATRO.COM  Tue Jul 29 15:42:53 2003
From: brent at WHITE-DEV.QUATRO.COM (Brent)
Date: Thu Jan 12 21:19:05 2006
Subject: Whitelisted
In-Reply-To: <3F253EBA.7010401@pacific.net>
Message-ID: <200307291454.h6TEsCh02344@white-dev.quatro.com>

We have also recently been testing with /tmp mounted as tmpfs.  This was
done because sa writes out temp files to /tmp while processing.

/tmp/sa.427.BhnbyN  etc.

If anyone knows how to change the sa tmp directory they could be stored in a
subdirectory of the mailscanner tmpfs, but otherwise this has been working
well.

Brent

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Ken Anderson
Sent: Monday, July 28, 2003 11:18 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Whitelisted

Raymond Dijkxhoorn wrote:

> Hi!
>
>
>>1) Start the incoming sendmail with a different config file.
>>Changes to /etc/rc.d/init.d/MailScanner (from rpm install on redhat)
>>make this change to the incoming sendmail command line:
>>------ snip -------
>>
>>  $SENDMAIL -bd -OPrivacyOptions=noetrn \
>>                       -ODeliveryMode=queueonly \
>>                       -OQueueDirectory=$INQDIR \
>>                       -OPidFile=$INPID \
>>                       -C/etc/mail/sendmail_in.cf
>>
>
>
> Works perfectly, only thing is my load on the box itself allmost doubled.
> So if you try this on a heavy loaded box, think twice :)

yep. Same here. I was able to gain the cost back by making some
performance adjustments.

1. Turn off fsync() on maillog in /etc/syslog.conf (on linux)
ie:
mail.*  -/var/log/maillog

2. Mount /var/spool/MailScanner/incoming as tmpfs

3. Because of #2 above, you can decrease the number of MailScanner
threads AND the frequency of batch runs. This pushes more mail into the
MailScanner/incoming directory so batches are larger. Since the incoming
directory is in memory now, mailscanner unpacks and scans message
batches faster. The price is a few seconds delay for messages traveling
through the system, but overall I/O is lower.

4. Sendmail's MaxRecipients = x is also a major factor, since each
message is cloned x times. I believe the default is 100 or 128... That's
probably too high if you are splitting all incoming mail into 1 recip
per message!

Ken A.
Pacific.Net


> But besides that, perfect solution, works like advertised!
>
> Thanks,
> Raymond.
>
>

From dot at DOTAT.AT  Tue Jul 29 15:43:12 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files, any advice.
In-Reply-To: <m2n.19hSm0-000poC@chiark.greenend.org.uk>
Message-ID: <E19hVh2-0006VN-00@chiark.greenend.org.uk>

Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>
>Now look what has happened to the data just before the 6326. It has been
>squashed into 1 \n character, thereby destroying the \r in the original.

That was probably done by Sendmail, since the file would have had CRLF
line endings when transmitted over SMTP, and the Microsoft standard
line ending is also CRLF. Exim does the same thing. However the bug is
assuming that line ending format will be preserved, the bug is either
Adobe's or Microsoft's.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
FISHER GERMAN BIGHT: SOUTH 4 OR 5, BACKING SOUTHEAST 5 OR 6 LATER. RAIN LATER.
GOOD BECOMING MODERATE.

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Jul 29 16:00:29 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files - a cautionary tale.
Message-ID: <74BC2BBF06470148911E64E2B48FE1390499C7@pinewood.ncl.ac.uk>

> -----Original Message-----
> From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
> Sent: 29 July 2003 12:31
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Corrupt pdf files, any advice.
> 
[snip]
> Outlook XP always appears to use Base64, so I suspect the 
> problem may just 
> exist in Exchange 5.5 and/or Outlook 97. Don't know about 
> Outlook 2000.
> 
> Whether Acrobat Reader (on some platforms) will continue to 
> be able to use 
> the damaged file is another matter entirely, something over 
> which I have no 
> control.
> 
> All I can suggest is you request people using the particular 
> troublesome 
> versions always zip their PDF files to stop Outlook destroying them.

These PDF files will continue to be a problem for sites that are similar
to ourselves. BEWARE if your site shares the following characteristics:

(1) Uses Sophos as your A-V tool; (2) have upgraded or are about to
upgrade from an oldish version of MailScanner that does not have the
"Allowed Sophos Error Messages =" option in the configuration file, and
(3) receive and pass on lots of PDF files.

We were running MS 4.10-1 for many months and were processing scores of
PDF file attachments each day without any problems. Then two weeks ago I
upgraded to MS 4.22-5 and at that point most PDF file attachments
started to be rejected.

The common symptom was that Sophos reported the attachment as being
"corrupt". Sophos itself had not changed recently so the problem lay
either with MS 4.22-5 or the way in which I had configured it. After
some discussion with Julian it became clear that it was the latter. 

The fault lay with my ignoring a fairly new configuration file option
which is specific to Sophos: "Allowed Sophos Error Messages =". In fact
the potential problem with this option is highlighted by Julian in the
comments that prefix this option in the configuration file - I should
perhaps have read more carefully.

That said the default value for this new option is "unsafe" in
situations like ours because it has immediate and damaging operational
consequences that are not as apparent as they should be from Julian's
warning. The option's default value is "safe" from a security point of
view and can be ignored by sites that do not use Sophos.   

By default the value of this option is null which means that if Sophos
detects a corrupt attachment (which it thus cannot scan) then MS will
"fail safely" and flag the attachment as possibly containing a virus.

After the upgrade to MS 4.22-5 I had left this option with its default
value with the result that all the dodgy PDF files that Sophos and MS
4.10-1 had been quietly ignoring were suddenly being flagged as possible
viruses.

The fix was to set "Allowed Sophos Error Messages = corrupt" in the
configuration file which means that Sophos will simply ignore any
"damaged" attachment that generates the Sophos error string "(corrupt)".


Many of these PDF files had been received from other sites before I
upgraded MS so people were not aware of a problem with them since they
viewed OK. It was only later when they tried to send them on to other
people (after MS was upgraded) that the damage became apparent. 

It is no good of course zipping them once they are damaged but zipping
them before first mailing them would have prevented the problem, as
Julian suggests. However we have no control over the many sites that
send us PDF files so it is likely that this will be a continuing problem
for sites like ourselves for a long time to come.

Unfortunately the fix to this problem has the consequence that any
corrupt file, PDF or non-PDF, that Sophos cannot scan will potentially
be delivered. However since we also run with a second A-V product
(McAfee) and have the usual MS filename extension and file type blocks
in place I hope we will be reasonably protected.

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 


From mailscanner at ecs.soton.ac.uk  Tue Jul 29 16:25:33 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:05 2006
Subject: Corrupt pdf files - a cautionary tale.
In-Reply-To: <74BC2BBF06470148911E64E2B48FE1390499C7@pinewood.ncl.ac.uk>
Message-ID: <5.2.0.9.2.20030729162508.0410aea8@imap.ecs.soton.ac.uk>

At 16:00 29/07/2003, you wrote:
> > -----Original Message-----
> > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
> > Sent: 29 July 2003 12:31
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Corrupt pdf files, any advice.
> >
>[snip]
> > Outlook XP always appears to use Base64, so I suspect the
> > problem may just
> > exist in Exchange 5.5 and/or Outlook 97. Don't know about
> > Outlook 2000.
> >
> > Whether Acrobat Reader (on some platforms) will continue to
> > be able to use
> > the damaged file is another matter entirely, something over
> > which I have no
> > control.
> >
> > All I can suggest is you request people using the particular
> > troublesome
> > versions always zip their PDF files to stop Outlook destroying them.
>
>These PDF files will continue to be a problem for sites that are similar
>to ourselves. BEWARE if your site shares the following characteristics:
>
>(1) Uses Sophos as your A-V tool; (2) have upgraded or are about to
>upgrade from an oldish version of MailScanner that does not have the
>"Allowed Sophos Error Messages =" option in the configuration file, and
>(3) receive and pass on lots of PDF files.
>
>We were running MS 4.10-1 for many months and were processing scores of
>PDF file attachments each day without any problems. Then two weeks ago I
>upgraded to MS 4.22-5 and at that point most PDF file attachments
>started to be rejected.
>
>The common symptom was that Sophos reported the attachment as being
>"corrupt". Sophos itself had not changed recently so the problem lay
>either with MS 4.22-5 or the way in which I had configured it. After
>some discussion with Julian it became clear that it was the latter.
>
>The fault lay with my ignoring a fairly new configuration file option
>which is specific to Sophos: "Allowed Sophos Error Messages =". In fact
>the potential problem with this option is highlighted by Julian in the
>comments that prefix this option in the configuration file - I should
>perhaps have read more carefully.
>
>That said the default value for this new option is "unsafe" in
>situations like ours because it has immediate and damaging operational
>consequences that are not as apparent as they should be from Julian's
>warning. The option's default value is "safe" from a security point of
>view and can be ignored by sites that do not use Sophos.
>
>By default the value of this option is null which means that if Sophos
>detects a corrupt attachment (which it thus cannot scan) then MS will
>"fail safely" and flag the attachment as possibly containing a virus.
>
>After the upgrade to MS 4.22-5 I had left this option with its default
>value with the result that all the dodgy PDF files that Sophos and MS
>4.10-1 had been quietly ignoring were suddenly being flagged as possible
>viruses.
>
>The fix was to set "Allowed Sophos Error Messages = corrupt" in the
>configuration file which means that Sophos will simply ignore any
>"damaged" attachment that generates the Sophos error string "(corrupt)".
>
>
>Many of these PDF files had been received from other sites before I
>upgraded MS so people were not aware of a problem with them since they
>viewed OK. It was only later when they tried to send them on to other
>people (after MS was upgraded) that the damage became apparent.
>
>It is no good of course zipping them once they are damaged but zipping
>them before first mailing them would have prevented the problem, as
>Julian suggests. However we have no control over the many sites that
>send us PDF files so it is likely that this will be a continuing problem
>for sites like ourselves for a long time to come.
>
>Unfortunately the fix to this problem has the consequence that any
>corrupt file, PDF or non-PDF, that Sophos cannot scan will potentially
>be delivered. However since we also run with a second A-V product
>(McAfee) and have the usual MS filename extension and file type blocks
>in place I hope we will be reasonably protected.

Is there anything I can do to help other people to avoid this problem?
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Jul 29 16:48:35 2003
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:19:05 2006
Subject: Bayes training and header records
Message-ID: <74BC2BBF06470148911E64E2B48FE1390499CA@pinewood.ncl.ac.uk>

I have followed advice given earlier on this list for collecting
spam/ham to use for some additional training of the Bayes rules. In
particular I am keen to train SA to recognise the "false negatives" that
are currently getting through.

I am curious to know why it's considered necessary to remove the
"X-Newcastle-MailScanner..." headers but not the (X-)Received: headers
and the various "ReSent-..." headers that are added when I bounce
messages to my spam/ham mailboxes?

Specifically which headers should be removed and why?

What role do headers generally play in the Bayes scoring of spam and
non-spam messages?

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 


From zabriskw at ITECH.NET  Tue Jul 29 15:08:09 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:19:05 2006
Subject: Mqueue.in is filling up!
Message-ID: <000b01c355da$d74e4bd0$0c02a8c0@itech.dom>

I'm having a weird MailScanner problem.  Sendmail will sit there and start
tossing mail into the queue.in, not a problem with that.  However when I
look in the mail.log this is what I see:

Jul 29 10:06:03 mustang MailScanner[238072]: MailScanner E-Mail Virus
Scanner version 4.20-3 starting...
Jul 29 10:06:05 mustang MailScanner[244953]: Using locktype = flock
Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Found 1634 messages
waiting
Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Scanning 100
messages, 2816396 bytes
Jul 29 10:06:08 mustang MailScanner[245441]: Spam Checks: Starting

However, the messages are not getting delivers, so the queue.in is just
piling up!  Does anyone have any suggestions?

From cparker at SWATGEAR.COM  Tue Jul 29 17:31:22 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:19:06 2006
Subject: Julian??
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE2B7E1C@ati-ex-01.ati.local>

(from julian)
>> I did "select all" then "mark as read". I had 21,000 new messages
>> waiting for me, so a certain amount of "bulk" operations had to take
>> place. 

Looks like you need some spam protection. Can I recommend MailScanner?


;P !


My second response to that quote is:

WTF?! 21,000 emails?



chris.


From gsmithe at OFALLON90.NET  Tue Jul 29 17:32:05 2003
From: gsmithe at OFALLON90.NET (Gary Smithe)
Date: Thu Jan 12 21:19:06 2006
Subject: Mqueue.in is filling up!
Message-ID: <C29E3B0CE050834487A33CA4E8568EFA4DDD56@exchange.ofallon90.net>

Kris,
        I don't know if this will help, but I saw similar things when I had a typo in my spam whitelist.  Maybe check any changes you have made since it stopped working.

Gary

> -----Original Message-----
> From: Kris Zabriskie [mailto:zabriskw@ITECH.NET]
> Sent: Tuesday, July 29, 2003 9:08 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Mqueue.in is filling up!
> 
> 
> I'm having a weird MailScanner problem.  Sendmail will sit 
> there and start
> tossing mail into the queue.in, not a problem with that.  
> However when I
> look in the mail.log this is what I see:
> 
> Jul 29 10:06:03 mustang MailScanner[238072]: MailScanner E-Mail Virus
> Scanner version 4.20-3 starting...
> Jul 29 10:06:05 mustang MailScanner[244953]: Using locktype = flock
> Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Found 
> 1634 messages
> waiting
> Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Scanning 100
> messages, 2816396 bytes
> Jul 29 10:06:08 mustang MailScanner[245441]: Spam Checks: Starting
> 
> However, the messages are not getting delivers, so the 
> queue.in is just
> piling up!  Does anyone have any suggestions?
> 


From thomas_duvally at BROWN.EDU  Tue Jul 29 18:08:16 2003
From: thomas_duvally at BROWN.EDU (Thomas DuVally)
Date: Thu Jan 12 21:19:06 2006
Subject: Mqueue.in is filling up!
In-Reply-To: <000b01c355da$d74e4bd0$0c02a8c0@itech.dom>
References: <000b01c355da$d74e4bd0$0c02a8c0@itech.dom>
Message-ID: <1059498496.31185.50.camel@croithine>

Are the MS child processes really running?  I've seen where they log
like they started, but simply die with no error.  The parent even stays
running just to confuse you...  I think this was a typo in the config,
IIRC.

On Tue, 2003-07-29 at 10:08, Kris Zabriskie wrote:
> I'm having a weird MailScanner problem.  Sendmail will sit there and start
> tossing mail into the queue.in, not a problem with that.  However when I
> look in the mail.log this is what I see:
>
> Jul 29 10:06:03 mustang MailScanner[238072]: MailScanner E-Mail Virus
> Scanner version 4.20-3 starting...
> Jul 29 10:06:05 mustang MailScanner[244953]: Using locktype = flock
> Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Found 1634 messages
> waiting
> Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Scanning 100
> messages, 2816396 bytes
> Jul 29 10:06:08 mustang MailScanner[245441]: Spam Checks: Starting
>
> However, the messages are not getting delivers, so the queue.in is just
> piling up!  Does anyone have any suggestions?
--
Thomas J. DuVally
Lead Systems Prog.
CIS, Brown Univ.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x15F233F6

From gerry at dorfam.ca  Tue Jul 29 18:55:50 2003
From: gerry at dorfam.ca (Gerry Doris)
Date: Thu Jan 12 21:19:06 2006
Subject: Mqueue.in is filling up!
In-Reply-To: <000b01c355da$d74e4bd0$0c02a8c0@itech.dom>
References: <000b01c355da$d74e4bd0$0c02a8c0@itech.dom>
Message-ID: <36409.129.80.22.143.1059501350.squirrel@tiger.dorfam.ca>

> I'm having a weird MailScanner problem.  Sendmail will sit there and start
> tossing mail into the queue.in, not a problem with that.  However when I
> look in the mail.log this is what I see:
>
> Jul 29 10:06:03 mustang MailScanner[238072]: MailScanner E-Mail Virus
> Scanner version 4.20-3 starting...
> Jul 29 10:06:05 mustang MailScanner[244953]: Using locktype = flock
> Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Found 1634
> messages
> waiting
> Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Scanning 100
> messages, 2816396 bytes
> Jul 29 10:06:08 mustang MailScanner[245441]: Spam Checks: Starting
>
> However, the messages are not getting delivers, so the queue.in is just
> piling up!  Does anyone have any suggestions?

I had similar results when the update scripts for either ClamAV or F-Prot
(which I use)were unable to reach their respective sites.  When those
scripts run MailScanner is stopped using a lockfile.  If they don't exit
properly mail continues to be received in in.queue but MailScanner isn't
available to process the mail and move it out for delivery.

I modified my scripts with timeouts to prevent this.  I also noticed that
I had a series of timeouts with F-Prot the other day when they were having
problems with their site.

Gerry

From rherban at HYPERVINE.NET  Tue Jul 29 19:18:49 2003
From: rherban at HYPERVINE.NET (Randy Herban)
Date: Thu Jan 12 21:19:06 2006
Subject: create stat report(s) on spam score stats
Message-ID: <00FD7F04EA248947B8FBB971044379DB80E6@corpserv1.hvcorp.hypervine.net>

> -----Original Message-----
> From: Chris W. Parker [mailto:cparker@SWATGEAR.COM] 
> Sent: Monday, July 28, 2003 2:55 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: create stat report(s) on spam score stats
> 
> 
> Tony Finch <mailto:dot@DOTAT.AT>
>     on Monday, July 28, 2003 12:38 PM said:
> 
> >> What would it take to do this? Or more specifically, what would it 
> >> take to have a record written to a mysql db for each and 
> every mail?
> > 
> > My Log Non Spam option allows you to set things up so that all the 
> > scores appear in the MailScanner log, so you can just grep them out.
> 
> But then you still have to get it into a db somehow and I'm 
> not familiar with turning the results from grep into records in a db.
> 
> 
> Chris.
> 


There is a mailstats program that someone on this list released.  I
modified that code to start keeping track of the spamscore for me and
show the average on the stats page.
At this point it doesn't do standard deviation or anything else major,
but an average is perfect for me (so far avg has been between 10.1 and
10.2)
I could share my snippets if anyone wants.

-Randy


From zabriskw at ITECH.NET  Tue Jul 29 18:57:02 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:19:06 2006
Subject: Mqueue.in is filling up!
References: <C29E3B0CE050834487A33CA4E8568EFA4DDD56@exchange.ofallon90.net>
Message-ID: <000401c355fa$d1bd3990$0c02a8c0@itech.dom>

The only changes I made were to Sendmail to force 1 recipient / e-mail.
That was working fine all night! Slammed our Mail Server, but it helped with
the whitelisting problem I had.  So I undid those changes, and MS still
wasn't scanning.  It is up and running now, but I dont know what I did to
fix it, or what caused the problem.  We have had this problem a couple of
times.  Thank you very much for the suggestion though!

----- Original Message -----
From: "Gary Smithe" <gsmithe@OFALLON90.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 29, 2003 12:32 PM
Subject: Re: Mqueue.in is filling up!


> Kris,
>         I don't know if this will help, but I saw similar things when I
had a typo in my spam whitelist.  Maybe check any changes you have made
since it stopped working.
>
> Gary
>
> > -----Original Message-----
> > From: Kris Zabriskie [mailto:zabriskw@ITECH.NET]
> > Sent: Tuesday, July 29, 2003 9:08 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Mqueue.in is filling up!
> >
> >
> > I'm having a weird MailScanner problem.  Sendmail will sit
> > there and start
> > tossing mail into the queue.in, not a problem with that.
> > However when I
> > look in the mail.log this is what I see:
> >
> > Jul 29 10:06:03 mustang MailScanner[238072]: MailScanner E-Mail Virus
> > Scanner version 4.20-3 starting...
> > Jul 29 10:06:05 mustang MailScanner[244953]: Using locktype = flock
> > Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Found
> > 1634 messages
> > waiting
> > Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Scanning 100
> > messages, 2816396 bytes
> > Jul 29 10:06:08 mustang MailScanner[245441]: Spam Checks: Starting
> >
> > However, the messages are not getting delivers, so the
> > queue.in is just
> > piling up!  Does anyone have any suggestions?
> >
>
>

From richard.lush at NTLWORLD.COM  Tue Jul 29 19:38:32 2003
From: richard.lush at NTLWORLD.COM (Richard Lush)
Date: Thu Jan 12 21:19:06 2006
Subject: Announcement: MailScanner Front End has a new home
Message-ID: <8C4A83966C27354C928048C4A1620EF8C0F5@lando.rebel.com>

Hi All,

You'll be pleased to hear (hopefully) that the MailScanner Front End has
a new home on sourceforge.net.  I'm setting up some mailing lists as
well for announcements etc.  Those of you that do use the front end, I
hope that the sourceforge site will give a slightly better service as it
allows bug tracking, feature requests etc.

Anyway, the new location is https://sourceforge.net/projects/msfrontend/
(the old site http://lushsoft.dyndns.org/mailscanner-webmin will store
new versions and change logs only pretty much as it does now). 

Regards,

Richard


From cparker at SWATGEAR.COM  Tue Jul 29 19:41:08 2003
From: cparker at SWATGEAR.COM (Chris W. Parker)
Date: Thu Jan 12 21:19:06 2006
Subject: create stat report(s) on spam score stats
Message-ID: <001BD19C96E6E64E8750D72C2EA0ECEE2B7E25@ati-ex-01.ati.local>

Randy Herban <mailto:rherban@HYPERVINE.NET>
    on Tuesday, July 29, 2003 11:19 AM said:

> There is a mailstats program that someone on this list released.  I
> modified that code to start keeping track of the spamscore for me and
> show the average on the stats page.
[snip]
> I could share my snippets if anyone wants.

Please do.



chris.


From rabollinger at COMCAST.NET  Tue Jul 29 19:55:13 2003
From: rabollinger at COMCAST.NET (Richard Bollinger)
Date: Thu Jan 12 21:19:06 2006
Subject: Mqueue.in is filling up! - Autoupdate Scripts
References: <000b01c355da$d74e4bd0$0c02a8c0@itech.dom> 
            <36409.129.80.22.143.1059501350.squirrel@tiger.dorfam.ca>
Message-ID: <013a01c35602$f3ac8940$8b030180@elliottturbo.com>

Why are we delaying Mailscanner while waiting to retrieve files from the Internet?

We *should* be retrieving the files into a temporary location, verifying that the file transfers
succeeded, and only then locking Mailscanner for a few miliseconds while moving updated files in
place.

Of course, we should also try to fail gracefully for any reason including timeouts.

Rich B
----- Original Message -----
From: "Gerry Doris" <gerry@DORFAM.CA>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, July 29, 2003 1:55 PM
Subject: Re: Mqueue.in is filling up!


> > I'm having a weird MailScanner problem.  Sendmail will sit there and start
> > tossing mail into the queue.in, not a problem with that.  However when I
> > look in the mail.log this is what I see:
> >
> > Jul 29 10:06:03 mustang MailScanner[238072]: MailScanner E-Mail Virus
> > Scanner version 4.20-3 starting...
> > Jul 29 10:06:05 mustang MailScanner[244953]: Using locktype = flock
> > Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Found 1634
> > messages
> > waiting
> > Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Scanning 100
> > messages, 2816396 bytes
> > Jul 29 10:06:08 mustang MailScanner[245441]: Spam Checks: Starting
> >
> > However, the messages are not getting delivers, so the queue.in is just
> > piling up!  Does anyone have any suggestions?
>
> I had similar results when the update scripts for either ClamAV or F-Prot
> (which I use)were unable to reach their respective sites.  When those
> scripts run MailScanner is stopped using a lockfile.  If they don't exit
> properly mail continues to be received in in.queue but MailScanner isn't
> available to process the mail and move it out for delivery.
>
> I modified my scripts with timeouts to prevent this.  I also noticed that
> I had a series of timeouts with F-Prot the other day when they were having
> problems with their site.
>
> Gerry

From mailscanner at ecs.soton.ac.uk  Tue Jul 29 20:10:18 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: Mqueue.in is filling up! - Autoupdate Scripts
In-Reply-To: <013a01c35602$f3ac8940$8b030180@elliottturbo.com>
References: <000b01c355da$d74e4bd0$0c02a8c0@itech.dom>
            <36409.129.80.22.143.1059501350.squirrel@tiger.dorfam.ca>
Message-ID: <5.2.1.1.2.20030729200921.033ddb88@imap.ecs.soton.ac.uk>

Agreed, *we* probably should...

At 19:55 29/07/2003, you wrote:
>Why are we delaying Mailscanner while waiting to retrieve files from the
>Internet?
>
>We *should* be retrieving the files into a temporary location, verifying
>that the file transfers
>succeeded, and only then locking Mailscanner for a few miliseconds while
>moving updated files in
>place.
>
>Of course, we should also try to fail gracefully for any reason including
>timeouts.
>
>Rich B
>----- Original Message -----
>From: "Gerry Doris" <gerry@DORFAM.CA>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Tuesday, July 29, 2003 1:55 PM
>Subject: Re: Mqueue.in is filling up!
>
>
> > > I'm having a weird MailScanner problem.  Sendmail will sit there and
> start
> > > tossing mail into the queue.in, not a problem with that.  However when I
> > > look in the mail.log this is what I see:
> > >
> > > Jul 29 10:06:03 mustang MailScanner[238072]: MailScanner E-Mail Virus
> > > Scanner version 4.20-3 starting...
> > > Jul 29 10:06:05 mustang MailScanner[244953]: Using locktype = flock
> > > Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Found 1634
> > > messages
> > > waiting
> > > Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Scanning 100
> > > messages, 2816396 bytes
> > > Jul 29 10:06:08 mustang MailScanner[245441]: Spam Checks: Starting
> > >
> > > However, the messages are not getting delivers, so the queue.in is just
> > > piling up!  Does anyone have any suggestions?
> >
> > I had similar results when the update scripts for either ClamAV or F-Prot
> > (which I use)were unable to reach their respective sites.  When those
> > scripts run MailScanner is stopped using a lockfile.  If they don't exit
> > properly mail continues to be received in in.queue but MailScanner isn't
> > available to process the mail and move it out for delivery.
> >
> > I modified my scripts with timeouts to prevent this.  I also noticed that
> > I had a series of timeouts with F-Prot the other day when they were having
> > problems with their site.
> >
> > Gerry

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From greyhair at GREYHAIR.NET  Tue Jul 29 21:06:20 2003
From: greyhair at GREYHAIR.NET (Greyhair)
Date: Thu Jan 12 21:19:06 2006
Subject: Slight OT question: SuSE vs other RPM
Message-ID: <005301c3560c$e14270d0$ad0110ac@x173cpt>

Why is mailscanner-4.22-5.noarch.rpm from the SuSE package different?
SuSE:  mailscanner-4.22-5.noarch.rpm  MD5: eda5977cf2bf1e5e7f1c51e68a21cae5
RPM:  mailscanner-4.22-5.noarch.rpm  MD5: 0a61abb9224d371e99b51844d32a82d0

From raymond at PROLOCATION.NET  Tue Jul 29 21:08:38 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:06 2006
Subject: Slight OT question: SuSE vs other RPM
In-Reply-To: <005301c3560c$e14270d0$ad0110ac@x173cpt>
Message-ID: <Pine.LNX.4.44.0307292208100.21686-100000@mailbox.prolocation.net>

Hi!

> Why is mailscanner-4.22-5.noarch.rpm from the SuSE package different?
> SuSE:  mailscanner-4.22-5.noarch.rpm  MD5: eda5977cf2bf1e5e7f1c51e68a21cae5
> RPM:  mailscanner-4.22-5.noarch.rpm  MD5: 0a61abb9224d371e99b51844d32a82d0

Why are roses red, why is the sky blue ...

Bye,
Raymond.

From greyhair at GREYHAIR.NET  Tue Jul 29 21:11:53 2003
From: greyhair at GREYHAIR.NET (Greyhair)
Date: Thu Jan 12 21:19:06 2006
Subject: SuSE question
Message-ID: <005b01c3560d$a6f455a0$ad0110ac@x173cpt>

Will the SuSE mailscanner work on SuSE 8.2?

From mailscanner at ecs.soton.ac.uk  Tue Jul 29 21:11:19 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: Slight OT question: SuSE vs other RPM
In-Reply-To: <005301c3560c$e14270d0$ad0110ac@x173cpt>
Message-ID: <5.2.1.1.2.20030729211050.03309d78@imap.ecs.soton.ac.uk>

Different init.d script for starters.
noarch does not imply no-OS.

At 21:06 29/07/2003, you wrote:
>Why is mailscanner-4.22-5.noarch.rpm from the SuSE package different?
>SuSE:  mailscanner-4.22-5.noarch.rpm  MD5: eda5977cf2bf1e5e7f1c51e68a21cae5
>RPM:  mailscanner-4.22-5.noarch.rpm  MD5: 0a61abb9224d371e99b51844d32a82d0

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Tue Jul 29 21:21:48 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: SuSE question
In-Reply-To: <005b01c3560d$a6f455a0$ad0110ac@x173cpt>
Message-ID: <5.2.1.1.2.20030729212133.025b6570@imap.ecs.soton.ac.uk>

At 21:11 29/07/2003, you wrote:
>Will the SuSE mailscanner work on SuSE 8.2?

Should do, but please let me know how you get on.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Tue Jul 29 21:21:23 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: Very OT: Re: Slight OT question: SuSE vs other RPM
In-Reply-To: <Pine.LNX.4.44.0307292208100.21686-100000@mailbox.prolocati
              on.net>
References: <005301c3560c$e14270d0$ad0110ac@x173cpt>
Message-ID: <5.2.1.1.2.20030729212031.034fc220@imap.ecs.soton.ac.uk>

At 21:08 29/07/2003, you wrote:
>Hi!
>
> > Why is mailscanner-4.22-5.noarch.rpm from the SuSE package different?
> > SuSE:  mailscanner-4.22-5.noarch.rpm  MD5: eda5977cf2bf1e5e7f1c51e68a21cae5
> > RPM:  mailscanner-4.22-5.noarch.rpm  MD5: 0a61abb9224d371e99b51844d32a82d0
>
>Why are roses red, why is the sky blue ...

Not sure about the roses, but
http://www.why-is-the-sky-blue.org/why-is-the-sky-blue.html

Who would have guessed that someone registered why-is-the-sky-blue.org just
to answer this question...
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From greyhair at GREYHAIR.NET  Tue Jul 29 21:24:16 2003
From: greyhair at GREYHAIR.NET (Greyhair)
Date: Thu Jan 12 21:19:06 2006
Subject: Slight OT question: SuSE vs other RPM
References: <Pine.LNX.4.44.0307292208100.21686-100000@mailbox.prolocation.net>
Message-ID: <006101c3560f$62266f10$ad0110ac@x173cpt>

> Hi!
>
> > Why is mailscanner-4.22-5.noarch.rpm from the SuSE package different?
> > SuSE:  mailscanner-4.22-5.noarch.rpm  MD5:
eda5977cf2bf1e5e7f1c51e68a21cae5
> > RPM:  mailscanner-4.22-5.noarch.rpm  MD5:
0a61abb9224d371e99b51844d32a82d0
>
> Why are roses red, why is the sky blue ...
>
> Bye,
> Raymond.
>

Roses are red because pigment in the petals absorb all but red light.
redlight is reflected back to your eyes.  Reflection of light off the ocean
onto atmosphereic dust particles makes the sky blue. less particles makes
for darker blue (almost black) sky. more particles... lighter blues with
hint of smog... :(
now, kindly answer my question. (i did ask it first! :p  )

From greyhair at GREYHAIR.NET  Tue Jul 29 21:27:23 2003
From: greyhair at GREYHAIR.NET (Greyhair)
Date: Thu Jan 12 21:19:06 2006
Subject: Slight OT question: SuSE vs other RPM
References: <5.2.1.1.2.20030729211050.03309d78@imap.ecs.soton.ac.uk>
Message-ID: <006b01c3560f$d1949660$ad0110ac@x173cpt>

Thank you.  doh, i knew that. sorry.

> Different init.d script for starters.
> noarch does not imply no-OS.
>
> At 21:06 29/07/2003, you wrote:
> >Why is mailscanner-4.22-5.noarch.rpm from the SuSE package different?
> >SuSE:  mailscanner-4.22-5.noarch.rpm  MD5:
eda5977cf2bf1e5e7f1c51e68a21cae5
> >RPM:  mailscanner-4.22-5.noarch.rpm  MD5:
0a61abb9224d371e99b51844d32a82d0
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
>

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Jul 30 00:09:00 2003
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon:: Blacknight Solutions)
Date: Thu Jan 12 21:19:06 2006
Subject: Announcement: MailScanner Front End has a new home
In-Reply-To: <8C4A83966C27354C928048C4A1620EF8C0F5@lando.rebel.com>
Message-ID: <200307292307.h6TN7jx20751@camelot.blacknightsolutions.com>

Congratulations!! We've installed your webmin module on all our servers and
have had good results to date.

Mr. Michele Neylon
Blacknight Solutions
http://www.blacknightsolutions.com




#########################################################
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance to it is prohibited.

From john at TRADOC.FR  Wed Jul 30 07:06:16 2003
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:19:06 2006
Subject: Corrupt pdf files - a cautionary tale.
In-Reply-To: <5.2.0.9.2.20030729162508.0410aea8@imap.ecs.soton.ac.uk>
References: <74BC2BBF06470148911E64E2B48FE1390499C7@pinewood.ncl.ac.uk>
            <5.2.0.9.2.20030729162508.0410aea8@imap.ecs.soton.ac.uk>
Message-ID: <nkneivsqoabf9r6of7bh9qfslgoccd4i96@tradoc.fr>

On Tue, 29 Jul 2003 16:25:33 +0100, Julian Field wrote:
> >Unfortunately the fix to this problem has the consequence that any
> >corrupt file, PDF or non-PDF, that Sophos cannot scan will potentially
> >be delivered. However since we also run with a second A-V product
> >(McAfee) and have the usual MS filename extension and file type blocks
> >in place I hope we will be reasonably protected.
> 
> Is there anything I can do to help other people to avoid this problem?

How about adding an "Allowed Sophos Error Messages For PDF" option to
enable different settings for PDF and non-PDF?

John.

-- 
-- Over 2000 webcams from ski resorts around the world - http://www.snoweye.com/
-- Translate your technical documents and web pages    - http://www.tradoc.fr/


From s.kelly at ayrcoll.ac.uk  Wed Jul 30 09:19:31 2003
From: s.kelly at ayrcoll.ac.uk (Shane Kelly)
Date: Thu Jan 12 21:19:06 2006
Subject: SuSE question
In-Reply-To: <005b01c3560d$a6f455a0$ad0110ac@x173cpt>
References: <005b01c3560d$a6f455a0$ad0110ac@x173cpt>
Message-ID: <200307300919.31192.s.kelly@ayrcoll.ac.uk>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
On Tuesday 29 July 2003 9:11 pm, Greyhair wrote:
> Will the SuSE mailscanner work on SuSE 8.2?
        Currently, MailScanner 4.22-5 is running on SuSE 8.2 Professional on three 
boxes here without problems, but the following should be noted:

        1. All OS installs were clean installs, not updates.
        2. Instructions from the MailScanner website for installing were followed.
        3. Sendmail was used as the MTA - installed in place of postfix at install 
time.
        4. Sophos is the AV product, perl is 5.8.0 from the SuSE Disk, updated as per 
instructions on installing.
        5. Spamassassin is installed from the SuSE distibution media (V2.50)
        6. The rcMailScanner script invariably reports 'failed' when it hasn't. - 
check it is running using ps -axf
        7. You MUST remove the SuSE Firewall scripts (or allow the right ports 
through)
        8. Either set the mail variable in yast2 mail options to allow receiving 
external mail, or set it yourself in /etc/sysconfig if you don't use yast2.

        I think this is all I had to do (apart from the usual scrutiny of the conf 
file and set the appropriate settings).

Hope this helps. 

Many thanks to all the people on this list - saved my bacon more than once! 

Julian, welcome back!

Regards,
        Shane 
- -- 
Shane Kelly
Network Infrastructure Manager
Ayr College
01292 293577 (Direct line)

 I like kids, but I don't think I could eat a whole one.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)

iD8DBQE/J3+T/thVM7mR0ZYRAkTAAJ9pccHkGYJqGQSwCeiCsbtsQWX34ACffvL0
kLRUXKX056HOxwjcU0Dgmqg=
=CoEN
-----END PGP SIGNATURE-----


From David.While at UCE.AC.UK  Wed Jul 30 09:49:05 2003
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:19:06 2006
Subject: create stat report(s) on spam score stats
Message-ID: <107DE25EC0216C45AEF670016024245F6F03@exchangea.staff.uce.ac.uk>

If you let me have your changes I will look to incorporate them into the
next release.
-----------------------------------------------------------------
David While
Technical Development Manager
Faculty of Computing, Information & English
University of Central England
Tel: 0121 331 6211
-----------------------------------------------------------------



-----Original Message-----
From: Randy Herban [mailto:rherban@HYPERVINE.NET]
Sent: 29 July 2003 19:19
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: create stat report(s) on spam score stats


> -----Original Message-----
> From: Chris W. Parker [mailto:cparker@SWATGEAR.COM] 
> Sent: Monday, July 28, 2003 2:55 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: create stat report(s) on spam score stats
> 
> 
> Tony Finch <mailto:dot@DOTAT.AT>
>     on Monday, July 28, 2003 12:38 PM said:
> 
> >> What would it take to do this? Or more specifically, what would it 
> >> take to have a record written to a mysql db for each and 
> every mail?
> > 
> > My Log Non Spam option allows you to set things up so that all the 
> > scores appear in the MailScanner log, so you can just grep them out.
> 
> But then you still have to get it into a db somehow and I'm 
> not familiar with turning the results from grep into records in a db.
> 
> 
> Chris.
> 


There is a mailstats program that someone on this list released.  I
modified that code to start keeping track of the spamscore for me and
show the average on the stats page.
At this point it doesn't do standard deviation or anything else major,
but an average is perfect for me (so far avg has been between 10.1 and
10.2)
I could share my snippets if anyone wants.

-Randy


From andersjk at SOL-INVICTUS.ORG  Wed Jul 30 11:07:18 2003
From: andersjk at SOL-INVICTUS.ORG (Kevin Anderson)
Date: Thu Jan 12 21:19:06 2006
Subject: Mqueue.in is filling up!
In-Reply-To: <000b01c355da$d74e4bd0$0c02a8c0@itech.dom>
Message-ID: <Pine.LNX.4.33L2.0307301206380.2327-100000@iktinus.netmanage.de>

if on linux check /var/log/mail/warnings and errors this will tell you
exactly what is going on...

thanks,
kevin


On Tue, 29 Jul 2003, Kris Zabriskie wrote:

> I'm having a weird MailScanner problem.  Sendmail will sit there and start
> tossing mail into the queue.in, not a problem with that.  However when I
> look in the mail.log this is what I see:
>
> Jul 29 10:06:03 mustang MailScanner[238072]: MailScanner E-Mail Virus
> Scanner version 4.20-3 starting...
> Jul 29 10:06:05 mustang MailScanner[244953]: Using locktype = flock
> Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Found 1634 messages
> waiting
> Jul 29 10:06:08 mustang MailScanner[245441]: New Batch: Scanning 100
> messages, 2816396 bytes
> Jul 29 10:06:08 mustang MailScanner[245441]: Spam Checks: Starting
>
> However, the messages are not getting delivers, so the queue.in is just
> piling up!  Does anyone have any suggestions?
>

--
@
_____________________________________________
chaos, panic and disorder... my job is done...

From dot at dotat.at  Wed Jul 30 11:34:35 2003
From: dot at dotat.at (Tony Finch)
Date: Thu Jan 12 21:19:06 2006
Subject: Current Cambridge patchset [LONG]
In-Reply-To: <m2n.19g3AM-000psz@chiark.greenend.org.uk>
Message-ID: <E19hoHz-0001Di-00@chiark.greenend.org.uk>

Tony Finch <dot@DOTAT.AT> wrote:
>
>EximDiskStore.pm, PFDiskStore.pm, SMDiskStore.pm, ZMSiskStore.pm,
>SA.pm, Message.pm:
>
>        Instead of not scanning large messages, SpamAssassin scans
>        only the first part of messages up to the Max SpamAssassin Size
>        configuration.

Ooops, I screwed that part up. Revised patch:


--- SMDiskStore.pm	4 Jul 2003 18:08:28 -0000	1.1.1.7
+++ SMDiskStore.pm	30 Jul 2003 10:25:33 -0000	1.15
@@ -285,15 +286,15 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
-  my($dh) = $this->{indhandle};
+  my($body,$max) = @_;
+  my $size = 0;
+  my $dh = $this->{indhandle};
 
   seek($dh, 0, 0); # Rewind the file
-
-  while(<$dh>) {
-    # End of line characters are already there, so don't add them
-    #push @{$body}, $_ . "\n";
-    push @{$body}, $_;
+  my $line;
+  while(defined($line = <$dh>) and $size < $max) {
+    push @{$body}, $line;
+    $size += length $line;
   }
 }
 


--- EximDiskStore.pm	13 May 2003 17:32:25 -0000	1.1.1.5
+++ EximDiskStore.pm	30 Jul 2003 10:25:33 -0000	1.15
@@ -320,8 +321,8 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
-
+  my($body,$max) = @_;
+  my $size = 0;
   my $dh = $this->{indhandle};
 
   seek($dh, 0, 0); # Rewind the file
@@ -329,10 +330,9 @@
   my $line = <$dh>;
   # FIXME: check that id is correct here
 
-  while(<$dh>) {
-    # End of line characters are already there, so don't add them
-    #push @{$body}, $_ . "\n";
-    push @{$body}, $_;
+  while(defined($line = <$dh>) and $size < $max) {
+    push @{$body}, $line;
+    $size += length $line;
   }
 }
 

Tony.
-- 
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
CROMARTY FORTH TYNE: NORTHERLY 4 OR 5 BECOMING VARIABLE 3 THEN SOUTHERLY 4 OR
5. SHOWERS. MODERATE WITH FOG PATCHES.

From dot at DOTAT.AT  Wed Jul 30 11:34:35 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:06 2006
Subject: Current Cambridge patchset [LONG]
In-Reply-To: <m2n.19g3AM-000psz@chiark.greenend.org.uk>
Message-ID: <E19hoHz-0001Di-00@chiark.greenend.org.uk>

Tony Finch <dot@DOTAT.AT> wrote:
>
>EximDiskStore.pm, PFDiskStore.pm, SMDiskStore.pm, ZMSiskStore.pm,
>SA.pm, Message.pm:
>
>        Instead of not scanning large messages, SpamAssassin scans
>        only the first part of messages up to the Max SpamAssassin Size
>        configuration.

Ooops, I screwed that part up. Revised patch:


--- SMDiskStore.pm      4 Jul 2003 18:08:28 -0000       1.1.1.7
+++ SMDiskStore.pm      30 Jul 2003 10:25:33 -0000      1.15
@@ -285,15 +286,15 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
-  my($dh) = $this->{indhandle};
+  my($body,$max) = @_;
+  my $size = 0;
+  my $dh = $this->{indhandle};

   seek($dh, 0, 0); # Rewind the file
-
-  while(<$dh>) {
-    # End of line characters are already there, so don't add them
-    #push @{$body}, $_ . "\n";
-    push @{$body}, $_;
+  my $line;
+  while(defined($line = <$dh>) and $size < $max) {
+    push @{$body}, $line;
+    $size += length $line;
   }
 }



--- EximDiskStore.pm    13 May 2003 17:32:25 -0000      1.1.1.5
+++ EximDiskStore.pm    30 Jul 2003 10:25:33 -0000      1.15
@@ -320,8 +321,8 @@
 # Passed a ref to the array.
 sub ReadBody {
   my $this = shift;
-  my($body) = @_;
-
+  my($body,$max) = @_;
+  my $size = 0;
   my $dh = $this->{indhandle};

   seek($dh, 0, 0); # Rewind the file
@@ -329,10 +330,9 @@
   my $line = <$dh>;
   # FIXME: check that id is correct here

-  while(<$dh>) {
-    # End of line characters are already there, so don't add them
-    #push @{$body}, $_ . "\n";
-    push @{$body}, $_;
+  while(defined($line = <$dh>) and $size < $max) {
+    push @{$body}, $line;
+    $size += length $line;
   }
 }


Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
CROMARTY FORTH TYNE: NORTHERLY 4 OR 5 BECOMING VARIABLE 3 THEN SOUTHERLY 4 OR
5. SHOWERS. MODERATE WITH FOG PATCHES.

From Peter.Bates at LSHTM.AC.UK  Wed Jul 30 12:08:29 2003
From: Peter.Bates at LSHTM.AC.UK (Peter Bates)
Date: Thu Jan 12 21:19:06 2006
Subject: Dcc and dccm (and 'reporting' heavy spam)
Message-ID: <sf27b546.032@s-nst5.lshtm.ac.uk>

Hello all...

> sanjay.patel@REXWIRE.COM 29/07/03 15:10:54 >>>
>I have installed dcc and dccm but I get the following error when I try to
>start sendmail
>incoming sendmail: WARNING: Xdcc: local socket name 
>@dcc_rundir@/dccm missing

For DCC with SpamAssassin, you just need the dccproc part.
The SA installation notes are very specific about this.

To quote:
To install it, download
    http://www.rhyolite.com/anti-spam/dcc/source/dcc-dccproc.tar.Z and
    perform the following steps:

        # tar xfvz dcc-dccproc.tar.Z
        # cd dcc-dccproc-X.X.X
        # ./configure && make && make install
        # cdcc 'info'

... the bits you are attempting to are the Sendmail/MTA & DCC integration, which are probably best discussed on the DCC mailing list.

It might be nice in the future if MailScanner could actually support reporting particularly dodgy emails to Razor/DCC automatically, a la 'spamassassin -r' ... how, exactly, I'm not sure?

...

--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838 


From dean.plant at ROKE.CO.UK  Wed Jul 30 12:10:51 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:19:06 2006
Subject: Infinite-Monkeys
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A7023676A@rsys004a.roke.co.uk>

I am seeing timeouts for the Infinite-Monkeys RBL Check

RBL Check Infinite-Monkeys timed out and was killed, consecutive failure 6 of 7

How can I check the status of the service.

Thanks

Dean Plant

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

From Steve at swaney.com  Wed Jul 30 12:53:19 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:06 2006
Subject: Corrupt pdf files - a cautionary tale.
In-Reply-To: <nkneivsqoabf9r6of7bh9qfslgoccd4i96@tradoc.fr>
References: <74BC2BBF06470148911E64E2B48FE1390499C7@pinewood.ncl.ac.uk>
            <5.2.0.9.2.20030729162508.0410aea8@imap.ecs.soton.ac.uk>
            <nkneivsqoabf9r6of7bh9qfslgoccd4i96@tradoc.fr>
Message-ID: <1059565998.1460.1747.camel@speedy>

I have forwarded the details of this problem to a contact at Sophos.
I'll report back on any response.

Steve
Steve@Swaney.com


On Wed, 2003-07-30 at 02:06, John Wilcock wrote:

> On Tue, 29 Jul 2003 16:25:33 +0100, Julian Field wrote:
> > >Unfortunately the fix to this problem has the consequence that any
> > >corrupt file, PDF or non-PDF, that Sophos cannot scan will potentially
> > >be delivered. However since we also run with a second A-V product
> > >(McAfee) and have the usual MS filename extension and file type blocks
> > >in place I hope we will be reasonably protected.
> >
> > Is there anything I can do to help other people to avoid this problem?
>
> How about adding an "Allowed Sophos Error Messages For PDF" option to
> enable different settings for PDF and non-PDF?
>
> John.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030730/e12bef46/attachment.html
From mailscanner at ecs.soton.ac.uk  Wed Jul 30 14:39:23 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: Current Cambridge patchset [LONG]
In-Reply-To: <E19hoHz-0001Di-00@chiark.greenend.org.uk>
References: <m2n.19g3AM-000psz@chiark.greenend.org.uk>
Message-ID: <5.2.0.9.2.20030730143853.040aaa90@imap.ecs.soton.ac.uk>

I have incorporated this feature into the main code.
Very good idea Tony!

At 11:34 30/07/2003, you wrote:
>Tony Finch <dot@DOTAT.AT> wrote:
> >
> >EximDiskStore.pm, PFDiskStore.pm, SMDiskStore.pm, ZMSiskStore.pm,
> >SA.pm, Message.pm:
> >
> >        Instead of not scanning large messages, SpamAssassin scans
> >        only the first part of messages up to the Max SpamAssassin Size
> >        configuration.
>
>Ooops, I screwed that part up. Revised patch:
>
>
>--- SMDiskStore.pm      4 Jul 2003 18:08:28 -0000       1.1.1.7
>+++ SMDiskStore.pm      30 Jul 2003 10:25:33 -0000      1.15
>@@ -285,15 +286,15 @@
>  # Passed a ref to the array.
>  sub ReadBody {
>    my $this = shift;
>-  my($body) = @_;
>-  my($dh) = $this->{indhandle};
>+  my($body,$max) = @_;
>+  my $size = 0;
>+  my $dh = $this->{indhandle};
>
>    seek($dh, 0, 0); # Rewind the file
>-
>-  while(<$dh>) {
>-    # End of line characters are already there, so don't add them
>-    #push @{$body}, $_ . "\n";
>-    push @{$body}, $_;
>+  my $line;
>+  while(defined($line = <$dh>) and $size < $max) {
>+    push @{$body}, $line;
>+    $size += length $line;
>    }
>  }
>
>
>
>--- EximDiskStore.pm    13 May 2003 17:32:25 -0000      1.1.1.5
>+++ EximDiskStore.pm    30 Jul 2003 10:25:33 -0000      1.15
>@@ -320,8 +321,8 @@
>  # Passed a ref to the array.
>  sub ReadBody {
>    my $this = shift;
>-  my($body) = @_;
>-
>+  my($body,$max) = @_;
>+  my $size = 0;
>    my $dh = $this->{indhandle};
>
>    seek($dh, 0, 0); # Rewind the file
>@@ -329,10 +330,9 @@
>    my $line = <$dh>;
>    # FIXME: check that id is correct here
>
>-  while(<$dh>) {
>-    # End of line characters are already there, so don't add them
>-    #push @{$body}, $_ . "\n";
>-    push @{$body}, $_;
>+  while(defined($line = <$dh>) and $size < $max) {
>+    push @{$body}, $line;
>+    $size += length $line;
>    }
>  }
>
>
>Tony.
>--
>f.a.n.finch  <dot@dotat.at>  http://dotat.at/
>CROMARTY FORTH TYNE: NORTHERLY 4 OR 5 BECOMING VARIABLE 3 THEN SOUTHERLY 4 OR
>5. SHOWERS. MODERATE WITH FOG PATCHES.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Wed Jul 30 14:07:56 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: SuSE question
In-Reply-To: <200307300919.31192.s.kelly@ayrcoll.ac.uk>
References: <005b01c3560d$a6f455a0$ad0110ac@x173cpt>
            <005b01c3560d$a6f455a0$ad0110ac@x173cpt>
Message-ID: <5.2.0.9.2.20030730140600.0401d5a0@imap.ecs.soton.ac.uk>

At 09:19 30/07/2003, you wrote:
>On Tuesday 29 July 2003 9:11 pm, Greyhair wrote:
> > Will the SuSE mailscanner work on SuSE 8.2?
>         Currently, MailScanner 4.22-5 is running on SuSE 8.2 Professional
> on three
>boxes here without problems, but the following should be noted:
>
>         1. All OS installs were clean installs, not updates.
>         2. Instructions from the MailScanner website for installing were
> followed.
>         3. Sendmail was used as the MTA - installed in place of postfix
> at install
>time.
>         4. Sophos is the AV product, perl is 5.8.0 from the SuSE Disk,
> updated as per
>instructions on installing.
>         5. Spamassassin is installed from the SuSE distibution media (V2.50)

You really don't want to be using SA 2.50 as it has lots of nasty bugs that
were fixed in 2.55. I would replace that as soon as possible, if I were you.

>         6. The rcMailScanner script invariably reports 'failed' when it
> hasn't. -
>check it is running using ps -axf

I'll have to work on that.

>         7. You MUST remove the SuSE Firewall scripts (or allow the right
> ports
>through)
>         8. Either set the mail variable in yast2 mail options to allow
> receiving
>external mail, or set it yourself in /etc/sysconfig if you don't use yast2.

I don't consider them to be my problem :-)

>         I think this is all I had to do (apart from the usual scrutiny of
> the conf
>file and set the appropriate settings).
>
>Hope this helps.

Very helpful, thanks.
I'm going to be working on SuSE 8.2 very soon, so I should be able to get
the "failed" problem fixed.


>Many thanks to all the people on this list - saved my bacon more than once!
>
>Julian, welcome back!

Thanks!


>Regards,
>         Shane
>- --
>Shane Kelly
>Network Infrastructure Manager
>Ayr College
>01292 293577 (Direct line)
>
>  I like kids, but I don't think I could eat a whole one.
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)
>
>iD8DBQE/J3+T/thVM7mR0ZYRAkTAAJ9pccHkGYJqGQSwCeiCsbtsQWX34ACffvL0
>kLRUXKX056HOxwjcU0Dgmqg=
>=CoEN
>-----END PGP SIGNATURE-----

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From bnixon at NIXTECH.NET  Wed Jul 30 14:55:24 2003
From: bnixon at NIXTECH.NET (Brad |Nixon)
Date: Thu Jan 12 21:19:06 2006
Subject: skip spamassassin (again)
Message-ID: <LISTSERV%2003073014552429@JISCMAIL.AC.UK>

Can anyone tell me how to skip spamassassin test on specific domains?
I have set up the rules file as per the faq and it seems to stop virus
scanning only. Optimally I would like to do virus checks on all domains
And selective spamassassin checks on others.

I am using RH7.2 /mailscanner 4.21-9 and spamassassin 2.55


Thanks,
Brad Nixon

From mailscanner at ecs.soton.ac.uk  Wed Jul 30 15:06:08 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: skip spamassassin (again)
In-Reply-To: <LISTSERV%2003073014552429@JISCMAIL.AC.UK>
Message-ID: <5.2.0.9.2.20030730150428.0473a268@imap.ecs.soton.ac.uk>

At 14:55 30/07/2003, you wrote:
>Can anyone tell me how to skip spamassassin test on specific domains?
>I have set up the rules file as per the faq and it seems to stop virus
>scanning only. Optimally I would like to do virus checks on all domains
>And selective spamassassin checks on others.

Set
         Use SpamAssassin = /etc/MailScanner/rules/use.sa.rules

Then in use.sa.rules put stuff like this:
To:     *@checkme.com   yes
To:     *@dontcheck.com no
FromOrTo: default       no

That will do SpamAssassin checks on mail to checkme.com but no others. If
you change the "default" setting to "yes" then it would do checks on all
domains except dontcheck.com.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at LISTS.COM.AR  Wed Jul 30 15:42:32 2003
From: mailscanner at LISTS.COM.AR (Mariano Absatz)
Date: Thu Jan 12 21:19:06 2006
Subject: Current Cambridge patchset [LONG]
In-Reply-To: <5.2.0.9.2.20030730143853.040aaa90@imap.ecs.soton.ac.uk>
References: <E19hoHz-0001Di-00@chiark.greenend.org.uk>
Message-ID: <3F27AF28.11535.5206BF@localhost>

I didn't pay much attention, but it seemed quite trivial (once Tony did it, 
of course), but if you need a hand with the ZMailer part, just let me know.

El 30 Jul 2003 a las 14:39, Julian Field escribi?:

> I have incorporated this feature into the main code.
> Very good idea Tony!
> 
> At 11:34 30/07/2003, you wrote:
> >Tony Finch <dot@DOTAT.AT> wrote:
> > >
> > >EximDiskStore.pm, PFDiskStore.pm, SMDiskStore.pm, ZMSiskStore.pm,
> > >SA.pm, Message.pm:
> > >
> > >        Instead of not scanning large messages, SpamAssassin scans
> > >        only the first part of messages up to the Max SpamAssassin Size
> > >        configuration.
> >
> >Ooops, I screwed that part up. Revised patch:
> >
> >
> >--- SMDiskStore.pm      4 Jul 2003 18:08:28 -0000       1.1.1.7
> >+++ SMDiskStore.pm      30 Jul 2003 10:25:33 -0000      1.15
> >@@ -285,15 +286,15 @@
> >  # Passed a ref to the array.
> >  sub ReadBody {
> >    my $this = shift;
> >-  my($body) = @_;
> >-  my($dh) = $this->{indhandle};
> >+  my($body,$max) = @_;
> >+  my $size = 0;
> >+  my $dh = $this->{indhandle};
> >
> >    seek($dh, 0, 0); # Rewind the file
> >-
> >-  while(<$dh>) {
> >-    # End of line characters are already there, so don't add them
> >-    #push @{$body}, $_ . "\n";
> >-    push @{$body}, $_;
> >+  my $line;
> >+  while(defined($line = <$dh>) and $size < $max) {
> >+    push @{$body}, $line;
> >+    $size += length $line;
> >    }
> >  }
> >
> >
> >
> >--- EximDiskStore.pm    13 May 2003 17:32:25 -0000      1.1.1.5
> >+++ EximDiskStore.pm    30 Jul 2003 10:25:33 -0000      1.15
> >@@ -320,8 +321,8 @@
> >  # Passed a ref to the array.
> >  sub ReadBody {
> >    my $this = shift;
> >-  my($body) = @_;
> >-
> >+  my($body,$max) = @_;
> >+  my $size = 0;
> >    my $dh = $this->{indhandle};
> >
> >    seek($dh, 0, 0); # Rewind the file
> >@@ -329,10 +330,9 @@
> >    my $line = <$dh>;
> >    # FIXME: check that id is correct here
> >
> >-  while(<$dh>) {
> >-    # End of line characters are already there, so don't add them
> >-    #push @{$body}, $_ . "\n";
> >-    push @{$body}, $_;
> >+  while(defined($line = <$dh>) and $size < $max) {
> >+    push @{$body}, $line;
> >+    $size += length $line;
> >    }
> >  }
> >
> >
> >Tony.
> >--
> >f.a.n.finch  <dot@dotat.at>  http://dotat.at/
> >CROMARTY FORTH TYNE: NORTHERLY 4 OR 5 BECOMING VARIABLE 3 THEN SOUTHERLY 4 OR
> >5. SHOWERS. MODERATE WITH FOG PATCHES.
> 
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support


--
Mariano Absatz
El Baby
----------------------------------------------------------
It is now proved beyond doubt that smoking is one
of the leading causes of statistics.
        -- Fletcher Knebel


From andersan at LTKALMAR.SE  Wed Jul 30 15:57:36 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:19:06 2006
Subject: Regarding rules for more then one person
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE6A4@lkl63.ltkalmar.se>

Hi Julian
I know Ive asked this before but I havent seen anything that gives
a hint it works.
Will it be possible to add something like, I think it would make life
easier for alot of ppl

FromOrTo: /etc/MailScanner/techies.txt       /filename.rules

Kind regards
Anders

From raymond at PROLOCATION.NET  Wed Jul 30 15:59:16 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:06 2006
Subject: Regarding rules for more then one person
In-Reply-To: <9F18B7DDBA88E544AB1F1995148916661CE6A4@lkl63.ltkalmar.se>
Message-ID: <Pine.LNX.4.44.0307301658390.3800-100000@mailbox.prolocation.net>

Hi!

> Will it be possible to add something like, I think it would make life
> easier for alot of ppl
>
> FromOrTo: /etc/MailScanner/techies.txt       /filename.rules

Whats the use, if you can generate a techies.txt you can also generate a
script that spits out a rulefile to do this ? or ?

Bye,
Raymond.

From mailscanner at ecs.soton.ac.uk  Wed Jul 30 15:50:56 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: Current Cambridge patchset [LONG]
In-Reply-To: <3F27AF28.11535.5206BF@localhost>
References: <5.2.0.9.2.20030730143853.040aaa90@imap.ecs.soton.ac.uk>
            <E19hoHz-0001Di-00@chiark.greenend.org.uk>
Message-ID: <5.2.0.9.2.20030730155030.0478b2a0@imap.ecs.soton.ac.uk>

No, it's all sorted. The ZMailer bit is just like the Postfix version (for 
some funny reason :-)

At 15:42 30/07/2003, you wrote:
>I didn't pay much attention, but it seemed quite trivial (once Tony did it,
>of course), but if you need a hand with the ZMailer part, just let me know.
>
>El 30 Jul 2003 a las 14:39, Julian Field escribi?:
>
> > I have incorporated this feature into the main code.
> > Very good idea Tony!
> >
> > At 11:34 30/07/2003, you wrote:
> > >Tony Finch <dot@DOTAT.AT> wrote:
> > > >
> > > >EximDiskStore.pm, PFDiskStore.pm, SMDiskStore.pm, ZMSiskStore.pm,
> > > >SA.pm, Message.pm:
> > > >
> > > >        Instead of not scanning large messages, SpamAssassin scans
> > > >        only the first part of messages up to the Max SpamAssassin Size
> > > >        configuration.
> > >
> > >Ooops, I screwed that part up. Revised patch:
> > >
> > >
> > >--- SMDiskStore.pm      4 Jul 2003 18:08:28 -0000       1.1.1.7
> > >+++ SMDiskStore.pm      30 Jul 2003 10:25:33 -0000      1.15
> > >@@ -285,15 +286,15 @@
> > >  # Passed a ref to the array.
> > >  sub ReadBody {
> > >    my $this = shift;
> > >-  my($body) = @_;
> > >-  my($dh) = $this->{indhandle};
> > >+  my($body,$max) = @_;
> > >+  my $size = 0;
> > >+  my $dh = $this->{indhandle};
> > >
> > >    seek($dh, 0, 0); # Rewind the file
> > >-
> > >-  while(<$dh>) {
> > >-    # End of line characters are already there, so don't add them
> > >-    #push @{$body}, $_ . "\n";
> > >-    push @{$body}, $_;
> > >+  my $line;
> > >+  while(defined($line = <$dh>) and $size < $max) {
> > >+    push @{$body}, $line;
> > >+    $size += length $line;
> > >    }
> > >  }
> > >
> > >
> > >
> > >--- EximDiskStore.pm    13 May 2003 17:32:25 -0000      1.1.1.5
> > >+++ EximDiskStore.pm    30 Jul 2003 10:25:33 -0000      1.15
> > >@@ -320,8 +321,8 @@
> > >  # Passed a ref to the array.
> > >  sub ReadBody {
> > >    my $this = shift;
> > >-  my($body) = @_;
> > >-
> > >+  my($body,$max) = @_;
> > >+  my $size = 0;
> > >    my $dh = $this->{indhandle};
> > >
> > >    seek($dh, 0, 0); # Rewind the file
> > >@@ -329,10 +330,9 @@
> > >    my $line = <$dh>;
> > >    # FIXME: check that id is correct here
> > >
> > >-  while(<$dh>) {
> > >-    # End of line characters are already there, so don't add them
> > >-    #push @{$body}, $_ . "\n";
> > >-    push @{$body}, $_;
> > >+  while(defined($line = <$dh>) and $size < $max) {
> > >+    push @{$body}, $line;
> > >+    $size += length $line;
> > >    }
> > >  }
> > >
> > >
> > >Tony.
> > >--
> > >f.a.n.finch  <dot@dotat.at>  http://dotat.at/
> > >CROMARTY FORTH TYNE: NORTHERLY 4 OR 5 BECOMING VARIABLE 3 THEN 
> SOUTHERLY 4 OR
> > >5. SHOWERS. MODERATE WITH FOG PATCHES.
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > MailScanner thanks transtec Computers for their support
>
>
>--
>Mariano Absatz
>El Baby
>----------------------------------------------------------
>It is now proved beyond doubt that smoking is one
>of the leading causes of statistics.
>         -- Fletcher Knebel

-- 
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support


From Kevin_Miller at CI.JUNEAU.AK.US  Wed Jul 30 16:13:27 2003
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:19:06 2006
Subject: SuSE question
Message-ID: <08146035CA49D6119A36009027AC822A0264E5EB@CITY-EXCH-NTS>

Julian,

In case you missed the post earlier this month (July 9, RE: Starting
problems on SuSE 8.1) I tracked down the problem to /etc/rc.status and the
check_MailScanner script.  I can resend my post if you like, or it should be
readily available in the archives.  No elegant solutions in it, but it may
save you a few minutes up-front time when you get to looking at it.

Cheers...

...Kevin
-------------------
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Administrator, Mail
Administrator
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500


>-----Original Message-----
>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>Sent: Wednesday, July 30, 2003 5:08 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: SuSE question
snip
>>         6. The rcMailScanner script invariably reports
>'failed' when it
>> hasn't. -
>>check it is running using ps -axf
>
>I'll have to work on that.

From raymond at PROLOCATION.NET  Wed Jul 30 17:45:54 2003
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: Regarding rules for more then one person
In-Reply-To: <9F18B7DDBA88E544AB1F1995148916661CE6A6@lkl63.ltkalmar.se>
Message-ID: <Pine.LNX.4.44.0307301845260.20942-100000@mailbox.prolocation.net>

Hi!

> > Whats the use, if you can generate a techies.txt you can also
> > generate a script that spits out a rulefile to do this ? or ?

> Guess so but since Im not that a great I thought that being able to use a
> writing all my co-workers for each rule would be easier..... and if I need
> I only need to change in one place. Maybe Im just lazy or bad at scripting
> of problems for me. Since the only ppl that would be added are tech-ppl at
> use a single file with user for more rules like filname/filetype.

Ask one of those <haha> :)

Bye,
Raymond.

From andersan at LTKALMAR.SE  Wed Jul 30 17:44:13 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: Regarding rules for more then one person
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE6A6@lkl63.ltkalmar.se>

> -----Ursprungligt meddelande-----
> Fr?n: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET] 
> Skickat: den 30 juli 2003 16:59
> Till: MAILSCANNER@JISCMAIL.AC.UK
> ?mne: Re: Regarding rules for more then one person
> 
> 
> Hi!
> 
> > Will it be possible to add something like, I think it would 
> make life 
> > easier for alot of ppl
> >
> > FromOrTo: /etc/MailScanner/techies.txt       /filename.rules
> 
> Whats the use, if you can generate a techies.txt you can also 
> generate a script that spits out a rulefile to do this ? or ?

Guess so but since Im not that a great I thought that being able to use a
single txt.file instead
writing all my co-workers for each rule would be easier..... and if I need
to add/remove someone
I only need to change in one place. Maybe Im just lazy or bad at scripting
but it would solve a lot
of problems for me. Since the only ppl that would be added are tech-ppl at
work. That mean I could 
use a single file with user for more rules like filname/filetype.

/Anders


From andersan at LTKALMAR.SE  Wed Jul 30 17:49:10 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: SV: Regarding rules for more then one person
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE6A7@lkl63.ltkalmar.se>

> -----Ursprungligt meddelande-----
> Fr?n: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET] 
> Skickat: den 30 juli 2003 18:46
> Till: MAILSCANNER@JISCMAIL.AC.UK
> ?mne: Re: SV: Regarding rules for more then one person
> 
> 
> Hi!
> 
> > > Whats the use, if you can generate a techies.txt you can also 
> > > generate a script that spits out a rulefile to do this ? or ?
> 
> > Guess so but since Im not that a great I thought that being able to 
> > use a writing all my co-workers for each rule would be 
> easier..... and 
> > if I need I only need to change in one place. Maybe Im just lazy or 
> > bad at scripting of problems for me. Since the only ppl 
> that would be 
> > added are tech-ppl at use a single file with user for more 
> rules like 
> > filname/filetype.
> 
> Ask one of those <haha> :)

Now your being evil  ;)
Im trying to learn this but prolly never get the hang of it and Im pretty
sure Im not the only person in the world that sucks at scripting. So if its
not to difficult I want it on the wish list  :)


From mailscanner at ecs.soton.ac.uk  Wed Jul 30 18:50:12 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: SV: Regarding rules for more then one person
In-Reply-To: <9F18B7DDBA88E544AB1F1995148916661CE6A7@lkl63.ltkalmar.se>
Message-ID: <5.2.1.1.2.20030730184314.0260e3c8@imap.ecs.soton.ac.uk>

Attached is a diff to Config.pm that implements this.
You can now have rules that look like this:

To:     /etc/MailScanner/rules/techies.txt      yes

Note that it has to be a full path which starts with "/" and ends in 
something other than "/". The rule will be replicated for all the patterns 
in the techies.txt file, so you could put this in techies.txt

# This is the list of all our tech support staff.
jkf@ecs.soton.ac.uk
*@techies.soton.ac.uk
jkf@*
/etc/MailScanner/rules/nested-filename.txt

Note that the file format is like this:
1) One pattern or address per line. The allowable patterns are the same as 
the normal patterns in any normal ruleset file.
2) Comments start with # and continue until the end of the line.
3) Blank lines are ignored.
4) Leading and trailing white space is ignored.
5) Further filenames can be included, allowing you to nest these files if 
you really need to.
6) If you make a loop by having a file include itself, then you're silly 
and shouldn't do it.

At 17:49 30/07/2003, you wrote:
> > -----Ursprungligt meddelande-----
> > Fr?n: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET]
> > Skickat: den 30 juli 2003 18:46
> > Till: MAILSCANNER@JISCMAIL.AC.UK
> > ?mne: Re: SV: Regarding rules for more then one person
> >
> >
> > Hi!
> >
> > > > Whats the use, if you can generate a techies.txt you can also
> > > > generate a script that spits out a rulefile to do this ? or ?
> >
> > > Guess so but since Im not that a great I thought that being able to
> > > use a writing all my co-workers for each rule would be
> > easier..... and
> > > if I need I only need to change in one place. Maybe Im just lazy or
> > > bad at scripting of problems for me. Since the only ppl
> > that would be
> > > added are tech-ppl at use a single file with user for more
> > rules like
> > > filname/filetype.
> >
> > Ask one of those <haha> :)
>
>Now your being evil  ;)
>Im trying to learn this but prolly never get the hang of it and Im pretty
>sure Im not the only person in the world that sucks at scripting. So if its
>not to difficult I want it on the wish list  :)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Config.pm.diff
Type: application/octet-stream
Size: 4347 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030730/28089aae/Config.pm.obj
-------------- next part --------------
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
From michele at BLACKNIGHTSOLUTIONS.COM  Wed Jul 30 18:54:13 2003
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon:: Blacknight Solutions)
Date: Thu Jan 12 21:19:06 2006
Subject: Dumb question
Message-ID: <200307301752.h6UHqt728362@camelot.blacknightsolutions.com>

Sorry if this is a really dumb question, but is there a quick way of seeing
which version of MailScanner is running?


Mr. Michele Neylon
Blacknight Solutions
http://www.blacknightsolutions.com


#########################################################
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance to it is prohibited.

From mailscanner at ecs.soton.ac.uk  Wed Jul 30 18:56:27 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: Dumb question
In-Reply-To: <200307301752.h6UHqt728362@camelot.blacknightsolutions.com>
Message-ID: <5.2.1.1.2.20030730185557.0267fc08@imap.ecs.soton.ac.uk>

Grep your maillog for the "starting" message.

grep -i starting /var/log/maillog

At 18:54 30/07/2003, you wrote:
>Sorry if this is a really dumb question, but is there a quick way of seeing
>which version of MailScanner is running?
>
>
>Mr. Michele Neylon
>Blacknight Solutions
>http://www.blacknightsolutions.com
>
>
>#########################################################
>This message (and any attachment) is intended only for the
>recipient and may contain confidential and/or privileged
>material.  If you have received this in error, please contact the
>sender and delete this message immediately.  Disclosure, copying
>or other action taken in respect of this email or in
>reliance to it is prohibited.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

From andersan at LTKALMAR.SE  Wed Jul 30 19:38:59 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: SV: SV: Regarding rules for more then one person
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE6A8@lkl63.ltkalmar.se>

Thanks, I'll do test tomorrow as soon I figured out how to use and patch.
Like I said Im just administrate the server...
Thanks a lot from a confused guy  :)

-----Ursprungligt meddelande-----
Fr?n: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
Skickat: den 30 juli 2003 19:50
Till: MAILSCANNER@JISCMAIL.AC.UK
?mne: Re: SV: SV: Regarding rules for more then one person


Attached is a diff to Config.pm that implements this.
You can now have rules that look like this:

To:     /etc/MailScanner/rules/techies.txt      yes

Note that it has to be a full path which starts with "/" and ends in 
something other than "/". The rule will be replicated for all the patterns 
in the techies.txt file, so you could put this in techies.txt

# This is the list of all our tech support staff. jkf@ecs.soton.ac.uk
*@techies.soton.ac.uk
jkf@*
/etc/MailScanner/rules/nested-filename.txt

Note that the file format is like this:
1) One pattern or address per line. The allowable patterns are the same as 
the normal patterns in any normal ruleset file.
2) Comments start with # and continue until the end of the line.
3) Blank lines are ignored.
4) Leading and trailing white space is ignored.
5) Further filenames can be included, allowing you to nest these files if 
you really need to.
6) If you make a loop by having a file include itself, then you're silly 
and shouldn't do it.

At 17:49 30/07/2003, you wrote:
> > -----Ursprungligt meddelande-----
> > Fr?n: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET]
> > Skickat: den 30 juli 2003 18:46
> > Till: MAILSCANNER@JISCMAIL.AC.UK
> > ?mne: Re: SV: Regarding rules for more then one person
> >
> >
> > Hi!
> >
> > > > Whats the use, if you can generate a techies.txt you can also 
> > > > generate a script that spits out a rulefile to do this ? or ?
> >
> > > Guess so but since Im not that a great I thought that being able 
> > > to use a writing all my co-workers for each rule would be
> > easier..... and
> > > if I need I only need to change in one place. Maybe Im just lazy 
> > > or bad at scripting of problems for me. Since the only ppl
> > that would be
> > > added are tech-ppl at use a single file with user for more
> > rules like
> > > filname/filetype.
> >
> > Ask one of those <haha> :)
>
>Now your being evil  ;)
>Im trying to learn this but prolly never get the hang of it and Im 
>pretty sure Im not the only person in the world that sucks at 
>scripting. So if its not to difficult I want it on the wish list  :)


From mailscanner at ecs.soton.ac.uk  Wed Jul 30 19:55:23 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: SV: SV: Regarding rules for more then one person
In-Reply-To: <9F18B7DDBA88E544AB1F1995148916661CE6A8@lkl63.ltkalmar.se>
Message-ID: <5.2.1.1.2.20030730195451.026deea8@imap.ecs.soton.ac.uk>

At 19:38 30/07/2003, you wrote:
>Thanks, I'll do test tomorrow as soon I figured out how to use and patch.
>Like I said Im just administrate the server...
>Thanks a lot from a confused guy  :)

cd /usr/lib/MailScanner/MailScanner
patch < Config.pm.diff
service MailScanner restart


>-----Ursprungligt meddelande-----
>Fr?n: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>Skickat: den 30 juli 2003 19:50
>Till: MAILSCANNER@JISCMAIL.AC.UK
>?mne: Re: SV: SV: Regarding rules for more then one person
>
>
>Attached is a diff to Config.pm that implements this.
>You can now have rules that look like this:
>
>To:     /etc/MailScanner/rules/techies.txt      yes
>
>Note that it has to be a full path which starts with "/" and ends in
>something other than "/". The rule will be replicated for all the patterns
>in the techies.txt file, so you could put this in techies.txt
>
># This is the list of all our tech support staff. jkf@ecs.soton.ac.uk
>*@techies.soton.ac.uk
>jkf@*
>/etc/MailScanner/rules/nested-filename.txt
>
>Note that the file format is like this:
>1) One pattern or address per line. The allowable patterns are the same as
>the normal patterns in any normal ruleset file.
>2) Comments start with # and continue until the end of the line.
>3) Blank lines are ignored.
>4) Leading and trailing white space is ignored.
>5) Further filenames can be included, allowing you to nest these files if
>you really need to.
>6) If you make a loop by having a file include itself, then you're silly
>and shouldn't do it.
>
>At 17:49 30/07/2003, you wrote:
> > > -----Ursprungligt meddelande-----
> > > Fr?n: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET]
> > > Skickat: den 30 juli 2003 18:46
> > > Till: MAILSCANNER@JISCMAIL.AC.UK
> > > ?mne: Re: SV: Regarding rules for more then one person
> > >
> > >
> > > Hi!
> > >
> > > > > Whats the use, if you can generate a techies.txt you can also
> > > > > generate a script that spits out a rulefile to do this ? or ?
> > >
> > > > Guess so but since Im not that a great I thought that being able
> > > > to use a writing all my co-workers for each rule would be
> > > easier..... and
> > > > if I need I only need to change in one place. Maybe Im just lazy
> > > > or bad at scripting of problems for me. Since the only ppl
> > > that would be
> > > > added are tech-ppl at use a single file with user for more
> > > rules like
> > > > filname/filetype.
> > >
> > > Ask one of those <haha> :)
> >
> >Now your being evil  ;)
> >Im trying to learn this but prolly never get the hang of it and Im
> >pretty sure Im not the only person in the world that sucks at
> >scripting. So if its not to difficult I want it on the wish list  :)

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support


From TGFurnish at HERFF-JONES.COM  Wed Jul 30 23:47:32 2003
From: TGFurnish at HERFF-JONES.COM (Furnish, Trever G)
Date: Thu Jan 12 21:19:06 2006
Subject: contributing patches?
Message-ID: <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>

If one is considering implementing a change locally that may be of use to
the wider mailscanner community, is there a particular version that one
should work against?

Is there a cvs repository somewhere or a designation of one version as the
development version?

--
Trever

From ctrudeau at BELLSOUTH.NET  Thu Jul 31 02:50:41 2003
From: ctrudeau at BELLSOUTH.NET (Chris Trudeau)
Date: Thu Jan 12 21:19:06 2006
Subject: SQL Redux
References: <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>
Message-ID: <001401c35706$26403bf0$23c8a8c0@SERV>

All,

I have an installed implementation (in test) that looks like this:

Redhat 9.0
MailScanner 4.22.1 (couldn't get 4.22.5 running, so I backed out a couple of
versions)
SA 2.55
DCC
Razor2
MailWatch for MailScanner (for SQL logging and front-end PHP)

It works beautifully.

So I installed on 7.3 (because of MANY other RH9.0 issues)
MailScanner 4.22.5 (runs fine)
SA 2.55
DCC and Razor2
MailWatch for MailScanner

to try and prove my implementation.  After MUCH troubleshooting, I have a
working implementation that does everything but write to the database.  I
have proven connectivity and permissions to the database and have tried
running it locally and consistently get the same error:

Jul 29 05:50:47 mta01 MailScanner[10505]: Cannot insert row:

The message processes acurately and is delivered or not according to
rules...it works GREAT...but I need the db logging to work...and I'm not
sure which way to look...any help is appreciated.

CT

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 07:29:31 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: contributing patches?
In-Reply-To: <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj -int>
Message-ID: <5.2.0.9.2.20030731072751.04286c30@imap.ecs.soton.ac.uk>

At 23:47 30/07/2003, you wrote:
>If one is considering implementing a change locally that may be of use to
>the wider mailscanner community, is there a particular version that one
>should work against?

The latest published release.

>Is there a cvs repository somewhere or a designation of one version as the
>development version?

Not that anyone can access, no. Either mail your patch to me off-list or
mail it to the list (if it is short!). Please precede it with a posting
explaining what the patch does and why you think it's a good idea. Not
everyone's suggestions make it into the released code, and I may well
re-implement your patch entirely differently. I don't use very much of
anyone else's code (with a few notable exceptions!).
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From P.G.M.Peters at utwente.nl  Thu Jul 31 07:48:02 2003
From: P.G.M.Peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: SV: Regarding rules for more then one person
In-Reply-To: <5.2.1.1.2.20030730184314.0260e3c8@imap.ecs.soton.ac.uk>
References: <9F18B7DDBA88E544AB1F1995148916661CE6A7@lkl63.ltkalmar.se>
            <5.2.1.1.2.20030730184314.0260e3c8@imap.ecs.soton.ac.uk>
Message-ID: <0qehivgkiaagj30d9cagdigabbu5ju1u6b@4ax.com>

On Wed, 30 Jul 2003 18:50:12 +0100, you wrote:

>Attached is a diff to Config.pm that implements this.
>You can now have rules that look like this:
>
>To:     /etc/MailScanner/rules/techies.txt      yes
>
>Note that it has to be a full path which starts with "/" and ends in
>something other than "/". The rule will be replicated for all the patterns
>in the techies.txt file, so you could put this in techies.txt
>
># This is the list of all our tech support staff.
>jkf@ecs.soton.ac.uk
>*@techies.soton.ac.uk
>jkf@*
>/etc/MailScanner/rules/nested-filename.txt
>
>6) If you make a loop by having a file include itself, then you're silly
>and shouldn't do it.

Even if you include a filename in another file in the first file you're
silly.

But I wonder what will happen. MS just continues untill time or memory
runs out?

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/civ

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 07:46:58 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: SV: Regarding rules for more then one person
In-Reply-To: <0qehivgkiaagj30d9cagdigabbu5ju1u6b@4ax.com>
References: <5.2.1.1.2.20030730184314.0260e3c8@imap.ecs.soton.ac.uk>
            <9F18B7DDBA88E544AB1F1995148916661CE6A7@lkl63.ltkalmar.se>
            <5.2.1.1.2.20030730184314.0260e3c8@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030731074608.044bdff8@imap.ecs.soton.ac.uk>

At 07:48 31/07/2003, you wrote:
>On Wed, 30 Jul 2003 18:50:12 +0100, you wrote:
>
> >Attached is a diff to Config.pm that implements this.
> >You can now have rules that look like this:
> >
> >To:     /etc/MailScanner/rules/techies.txt      yes
> >
> >Note that it has to be a full path which starts with "/" and ends in
> >something other than "/". The rule will be replicated for all the patterns
> >in the techies.txt file, so you could put this in techies.txt
> >
> ># This is the list of all our tech support staff.
> >jkf@ecs.soton.ac.uk
> >*@techies.soton.ac.uk
> >jkf@*
> >/etc/MailScanner/rules/nested-filename.txt
> >
> >6) If you make a loop by having a file include itself, then you're silly
> >and shouldn't do it.
>
>Even if you include a filename in another file in the first file you're
>silly.
>
>But I wonder what will happen. MS just continues untill time or memory
>runs out?

Indeed, it will just recurse and not terminate. I could make it log the
current and new filenames whenever it hits an included file, which is
probably better...
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 08:57:00 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: SV: SV: Regarding rules for more then one person
In-Reply-To: <5.2.0.9.2.20030731074608.044bdff8@imap.ecs.soton.ac.uk>
References: <0qehivgkiaagj30d9cagdigabbu5ju1u6b@4ax.com>
            <5.2.1.1.2.20030730184314.0260e3c8@imap.ecs.soton.ac.uk>
            <9F18B7DDBA88E544AB1F1995148916661CE6A7@lkl63.ltkalmar.se>
            <5.2.1.1.2.20030730184314.0260e3c8@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030731085531.03db4a70@imap.ecs.soton.ac.uk>

At 07:46 31/07/2003, you wrote:
>At 07:48 31/07/2003, you wrote:
>>On Wed, 30 Jul 2003 18:50:12 +0100, you wrote:
>>
>> >Attached is a diff to Config.pm that implements this.
>> >You can now have rules that look like this:
>> >
>> >To:     /etc/MailScanner/rules/techies.txt      yes
>> >
>> >Note that it has to be a full path which starts with "/" and ends in
>> >something other than "/". The rule will be replicated for all the patterns
>> >in the techies.txt file, so you could put this in techies.txt
>> >
>> ># This is the list of all our tech support staff.
>> >jkf@ecs.soton.ac.uk
>> >*@techies.soton.ac.uk
>> >jkf@*
>> >/etc/MailScanner/rules/nested-filename.txt
>> >
>> >6) If you make a loop by having a file include itself, then you're silly
>> >and shouldn't do it.
>>
>>Even if you include a filename in another file in the first file you're
>>silly.
>>
>>But I wonder what will happen. MS just continues untill time or memory
>>runs out?

It now has a nesting limit of 4 levels, at which point it will complain and
skip the rest of the included file.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From Antony at SOFT-SOLUTIONS.CO.UK  Thu Jul 31 09:32:57 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:06 2006
Subject: How to set up sendmail to accept and discard all email?
Message-ID: <200307310833.h6V8Wx019059@agate.rockstone.co.uk>

Hi.

I want to set up a test network of three machines:

One standard mailserver which gets loaded up with a bunch of mails to send.

One MailScanner system which receives the mails, processes them, and sends
them on...

...to a third machine which accepts them and immediately discards the mail
(preferably without queueing it, storing it on disk, or anything).

I know I can get the MS machine to send all its mails to a single server
easily enough, either by using a smart relay, or by redirecting packets with
a firewall, but is there some simple way I can configure sendmail on the
third machine so that it appears as an open relay (that bit's easy) and
accepts all mail, but then immediately discards it?

Is it something as simple as specifying a queue directory of /dev/null
(something tells me sendmail would complain at this...), or is there another
trick I should use?


Hope someone out there can help,


Antony.

--

If at first you don't succeed, destroy all the evidence that you tried.

From maxsec at TOTALISE.CO.UK  Thu Jul 31 09:34:44 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:06 2006
Subject: SQL Redux
In-Reply-To: <001401c35706$26403bf0$23c8a8c0@SERV>
References: <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>
            <001401c35706$26403bf0$23c8a8c0@SERV>
Message-ID: <3F28D4A4.8090704@totalise.co.uk>

Chris

this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.

It seems that mysql won't insert default values if there's a NULL value
in the placeholder. ie insert into maillog values (something, somthing,
something,\
something,, something) won't work as there is no entry for the fifth
placeholder.

I'm working on an ugly hack to the whole SQL logging routine that checks
each variable to make sure it's not NULL and builds the insert SQL
statement on the fly with the correct number of place holders etc. ie
the statement will become..

insert into maillog set (time, messageid, mailfrom) values (sometime,
somemessageid, somemailfrom)

rather than trying to insert everything via the current query.

I've got a rough code outline for this, just need to find a couple of
hours to implement and test.

--
Martin

Chris Trudeau wrote:

> All,
>
> I have an installed implementation (in test) that looks like this:
>
> Redhat 9.0
> MailScanner 4.22.1 (couldn't get 4.22.5 running, so I backed out a couple of
> versions)
> SA 2.55
> DCC
> Razor2
> MailWatch for MailScanner (for SQL logging and front-end PHP)
>
> It works beautifully.
>
> So I installed on 7.3 (because of MANY other RH9.0 issues)
> MailScanner 4.22.5 (runs fine)
> SA 2.55
> DCC and Razor2
> MailWatch for MailScanner
>
> to try and prove my implementation.  After MUCH troubleshooting, I have a
> working implementation that does everything but write to the database.  I
> have proven connectivity and permissions to the database and have tried
> running it locally and consistently get the same error:
>
> Jul 29 05:50:47 mta01 MailScanner[10505]: Cannot insert row:
>
> The message processes acurately and is delivered or not according to
> rules...it works GREAT...but I need the db logging to work...and I'm not
> sure which way to look...any help is appreciated.
>
> CT

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 09:52:07 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:06 2006
Subject: How to set up sendmail to accept and discard all email?
In-Reply-To: <200307310833.h6V8Wx019059@agate.rockstone.co.uk>
Message-ID: <5.2.0.9.2.20030731095043.04336700@imap.ecs.soton.ac.uk>

Attached is the Perl script I use for doing exactly this. It doesn't
involve sendmail or any other external program at all.

It implements just enough SMTP protocol to be able to sink mail.

You should just be able to make it executable and then run it with
         ./smtpsinkd &

At 09:32 31/07/2003, you wrote:
>Hi.
>
>I want to set up a test network of three machines:
>
>One standard mailserver which gets loaded up with a bunch of mails to send.
>
>One MailScanner system which receives the mails, processes them, and sends
>them on...
>
>...to a third machine which accepts them and immediately discards the mail
>(preferably without queueing it, storing it on disk, or anything).
>
>I know I can get the MS machine to send all its mails to a single server
>easily enough, either by using a smart relay, or by redirecting packets with
>a firewall, but is there some simple way I can configure sendmail on the
>third machine so that it appears as an open relay (that bit's easy) and
>accepts all mail, but then immediately discards it?
>
>Is it something as simple as specifying a queue directory of /dev/null
>(something tells me sendmail would complain at this...), or is there another
>trick I should use?
>
>
>Hope someone out there can help,
>
>
>Antony.
>
>--
>
>If at first you don't succeed, destroy all the evidence that you tried.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smtpsinkd
Type: application/octet-stream
Size: 2677 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030731/7f9132b4/smtpsinkd.obj
-------------- next part --------------
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
From ctrudeau at BELLSOUTH.NET  Thu Jul 31 10:49:11 2003
From: ctrudeau at BELLSOUTH.NET (Chris Trudeau)
Date: Thu Jan 12 21:19:06 2006
Subject: SQL Redux
References: <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>   
            <001401c35706$26403bf0$23c8a8c0@SERV> 
            <3F28D4A4.8090704@totalise.co.uk>
Message-ID: <002c01c35748$fe7bbd90$23c8a8c0@SERV>

> this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.

CT:  OK, there seems to be a common thread...I haven't expanded test to
anything other than 4.22-5 or 4.22.1, but the older version I have working
beatifully, so either the logging function in 4.22-1 doesn't have the NULL
value problem or its addressed differently.  Perhaps I will try installing
4.22-1 or a between version to try and pinpoint where it breaks!

From steve.freegard at LBSLTD.CO.UK  Thu Jul 31 10:45:52 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:19:06 2006
Subject: SQL Redux
Message-ID: <67D9E7698329D411936E00508B6590B902773A48@neelix.lbsltd.co.uk>

Hi Martin/Chris,

I'm on a Cognos course this week so I haven't had much chance to check my
e-mail this week.

However I've just had a thought as to what could be causing this - are you
both running MySQL v4.x by any chance??

I'm running MySQL v3.x that comes with RH9 on both of my production boxes
and haven't seen this problem so far, so it could be a change in behaviour
with v4.

Does this happen intermittently (if so, which fields) or does it never
work??

Kind regards,
Steve.

-----Original Message-----
From: Martin Hepworth
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: 31/07/03 09:34
Subject: Re: SQL Redux

Chris

this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.

It seems that mysql won't insert default values if there's a NULL value
in the placeholder. ie insert into maillog values (something, somthing,
something,\
something,, something) won't work as there is no entry for the fifth
placeholder.

I'm working on an ugly hack to the whole SQL logging routine that checks
each variable to make sure it's not NULL and builds the insert SQL
statement on the fly with the correct number of place holders etc. ie
the statement will become..

insert into maillog set (time, messageid, mailfrom) values (sometime,
somemessageid, somemailfrom)

rather than trying to insert everything via the current query.

I've got a rough code outline for this, just need to find a couple of
hours to implement and test.

--
Martin

Chris Trudeau wrote:

> All,
>
> I have an installed implementation (in test) that looks like this:
>
> Redhat 9.0
> MailScanner 4.22.1 (couldn't get 4.22.5 running, so I backed out a
couple of
> versions)
> SA 2.55
> DCC
> Razor2
> MailWatch for MailScanner (for SQL logging and front-end PHP)
>
> It works beautifully.
>
> So I installed on 7.3 (because of MANY other RH9.0 issues)
> MailScanner 4.22.5 (runs fine)
> SA 2.55
> DCC and Razor2
> MailWatch for MailScanner
>
> to try and prove my implementation.  After MUCH troubleshooting, I
have a
> working implementation that does everything but write to the database.
I
> have proven connectivity and permissions to the database and have
tried
> running it locally and consistently get the same error:
>
> Jul 29 05:50:47 mta01 MailScanner[10505]: Cannot insert row:
>
> The message processes acurately and is delivered or not according to
> rules...it works GREAT...but I need the db logging to work...and I'm
not
> sure which way to look...any help is appreciated.
>
> CT

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From maxsec at TOTALISE.CO.UK  Thu Jul 31 10:56:36 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:06 2006
Subject: SQL Redux
In-Reply-To: <67D9E7698329D411936E00508B6590B902773A48@neelix.lbsltd.co.uk>
References: <67D9E7698329D411936E00508B6590B902773A48@neelix.lbsltd.co.uk>
Message-ID: <3F28E7D4.7000608@totalise.co.uk>

Steve

it never works.

you must supply all the fields in the placeholders (nulls must be
explicitly specified). ie , , won't work, but ,NULL, will

I'll try and get the code change done this week. I'll forward on patch
file, if you can test on mysql 3.x we can then ask Julian to put it into
the next release.

--
Martin

Steve Freegard wrote:

> Hi Martin/Chris,
>
> I'm on a Cognos course this week so I haven't had much chance to check my
> e-mail this week.
>
> However I've just had a thought as to what could be causing this - are you
> both running MySQL v4.x by any chance??
>
> I'm running MySQL v3.x that comes with RH9 on both of my production boxes
> and haven't seen this problem so far, so it could be a change in behaviour
> with v4.
>
> Does this happen intermittently (if so, which fields) or does it never
> work??
>
> Kind regards,
> Steve.
>
> -----Original Message-----
> From: Martin Hepworth
> To: MAILSCANNER@JISCMAIL.AC.UK
> Sent: 31/07/03 09:34
> Subject: Re: SQL Redux
>
> Chris
>
> this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>
> It seems that mysql won't insert default values if there's a NULL value
> in the placeholder. ie insert into maillog values (something, somthing,
> something,\
> something,, something) won't work as there is no entry for the fifth
> placeholder.
>
> I'm working on an ugly hack to the whole SQL logging routine that checks
> each variable to make sure it's not NULL and builds the insert SQL
> statement on the fly with the correct number of place holders etc. ie
> the statement will become..
>
> insert into maillog set (time, messageid, mailfrom) values (sometime,
> somemessageid, somemailfrom)
>
> rather than trying to insert everything via the current query.
>
> I've got a rough code outline for this, just need to find a couple of
> hours to implement and test.
>
> --
> Martin
>
> Chris Trudeau wrote:
>
>
>>All,
>>
>>I have an installed implementation (in test) that looks like this:
>>
>>Redhat 9.0
>>MailScanner 4.22.1 (couldn't get 4.22.5 running, so I backed out a
>
> couple of
>
>>versions)
>>SA 2.55
>>DCC
>>Razor2
>>MailWatch for MailScanner (for SQL logging and front-end PHP)
>>
>>It works beautifully.
>>
>>So I installed on 7.3 (because of MANY other RH9.0 issues)
>>MailScanner 4.22.5 (runs fine)
>>SA 2.55
>>DCC and Razor2
>>MailWatch for MailScanner
>>
>>to try and prove my implementation.  After MUCH troubleshooting, I
>
> have a
>
>>working implementation that does everything but write to the database.
>
> I
>
>>have proven connectivity and permissions to the database and have
>
> tried
>
>>running it locally and consistently get the same error:
>>
>>Jul 29 05:50:47 mta01 MailScanner[10505]: Cannot insert row:
>>
>>The message processes acurately and is delivered or not according to
>>rules...it works GREAT...but I need the db logging to work...and I'm
>
> not
>
>>sure which way to look...any help is appreciated.
>>
>>CT
>
>
> --
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the sender and delete the message from your mailbox.
>
> This footnote also confirms that this email message has been swept by
> MailScanner (www.mailscanner.info) for the presence of computer viruses.

From maxsec at TOTALISE.CO.UK  Thu Jul 31 11:04:18 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:06 2006
Subject: SQL Redux
In-Reply-To: <002c01c35748$fe7bbd90$23c8a8c0@SERV>
References: <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>   
            <001401c35706$26403bf0$23c8a8c0@SERV>            
            <3F28D4A4.8090704@totalise.co.uk>
            <002c01c35748$fe7bbd90$23c8a8c0@SERV>
Message-ID: <3F28E9A2.7010509@totalise.co.uk>

Chris Trudeau wrote:

>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>
>
> CT:  OK, there seems to be a common thread...I haven't expanded test to
> anything other than 4.22-5 or 4.22.1, but the older version I have working
> beatifully, so either the logging function in 4.22-1 doesn't have the NULL
> value problem or its addressed differently.  Perhaps I will try installing
> 4.22-1 or a between version to try and pinpoint where it breaks!
Chris

looking at the 4.22.1 code there's quite a big change on the whole SQL
logging setup. Infact the code is radically different.

in 4.22.1 it reads the logfile to get the info required. Slow...

in 4.22.5 it's using the values from the currently processed email to
drive the insert. It's a lot faster, but seems not to translate NULLs
etc very well.

--
Martin

From Antony at SOFT-SOLUTIONS.CO.UK  Thu Jul 31 11:05:55 2003
From: Antony at SOFT-SOLUTIONS.CO.UK (Antony Stone)
Date: Thu Jan 12 21:19:06 2006
Subject: How to set up sendmail to accept and discard all email?
In-Reply-To: <5.2.0.9.2.20030731095043.04336700@imap.ecs.soton.ac.uk>
References: <5.2.0.9.2.20030731095043.04336700@imap.ecs.soton.ac.uk>
Message-ID: <200307311005.h6VA5w019091@agate.rockstone.co.uk>

On Thursday 31 July 2003 9:52 am, Julian Field wrote:

> Attached is the Perl script I use for doing exactly this. It doesn't
> involve sendmail or any other external program at all.
>
> It implements just enough SMTP protocol to be able to sink mail.

Cool :)   Neat :)   Thanks Julian :)


Antony.

--

If you want to be happy for an hour, get drunk.
If you want to be happy for a year, get married.
If you want to be happy for a lifetime, get a garden.

From dot at DOTAT.AT  Thu Jul 31 11:02:52 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:06 2006
Subject: How to set up sendmail to accept and discard all email?
In-Reply-To: <m2n.19i8sG-000pbJ@chiark.greenend.org.uk>
Message-ID: <E19iAGq-0001ZB-00@chiark.greenend.org.uk>

Antony Stone <Antony@SOFT-SOLUTIONS.CO.UK> wrote:
>
>I know I can get the MS machine to send all its mails to a single server
>easily enough, either by using a smart relay, or by redirecting packets with
>a firewall, but is there some simple way I can configure sendmail on the
>third machine so that it appears as an open relay (that bit's easy) and
>accepts all mail, but then immediately discards it?

Apart from Julian's Perl program I believe there's an SMTP daemon that
is designed to throw away email, but I can't remember its name. Or you
can use the following five-line Exim configutation:

acl_smtp_rcpt = accept
begin routers
blackhole:
        driver = redirect
        data = :blackhole:

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
THE WASH TO NORTH FORELAND: VARIABLE MAINLY WEST 2 OR 3 BACKING SOUTH OR
SOUTHEAST 3 OCCASIONALLY 4 FOR A TIME BUT VEERING SOUTHWEST 3 OR 4 OVERNIGHT.
SOME MIST OR FOG PATCHES AT FIRST, BUT BECOMING MAINLY FAIR. MAINLY GOOD OR
MODERATE BUT POOR IN ANY MIST OR FOG. SLIGHT.

From steve.freegard at LBSLTD.CO.UK  Thu Jul 31 11:18:25 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:19:06 2006
Subject: SQL Redux
Message-ID: <67D9E7698329D411936E00508B6590B902773A4B@neelix.lbsltd.co.uk>

Chris/Martin,

Are you not applying the patches included with the MailWatch tarball to the
original CustomConfig.pm source first then??

The SQLLogging code that comes with MailScanner is totally different to the
SQLLogging code that I wrote to use with MailWatch - The table layouts are
different and I wanted to log directly to the database instead of using the
temporary log files.

If you've not applied these patches - then we've found the problem!

Cheers,
Steve.


-----Original Message-----
From: Martin Hepworth
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: 31/07/03 11:04
Subject: Re: SQL Redux

Chris Trudeau wrote:

>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>
>
> CT:  OK, there seems to be a common thread...I haven't expanded test
to
> anything other than 4.22-5 or 4.22.1, but the older version I have
working
> beatifully, so either the logging function in 4.22-1 doesn't have the
NULL
> value problem or its addressed differently.  Perhaps I will try
installing
> 4.22-1 or a between version to try and pinpoint where it breaks!
Chris

looking at the 4.22.1 code there's quite a big change on the whole SQL
logging setup. Infact the code is radically different.

in 4.22.1 it reads the logfile to get the info required. Slow...

in 4.22.5 it's using the values from the currently processed email to
drive the insert. It's a lot faster, but seems not to translate NULLs
etc very well.

--
Martin

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From maxsec at TOTALISE.CO.UK  Thu Jul 31 11:32:35 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
In-Reply-To: <67D9E7698329D411936E00508B6590B902773A4B@neelix.lbsltd.co.uk>
References: <67D9E7698329D411936E00508B6590B902773A4B@neelix.lbsltd.co.uk>
Message-ID: <3F28F043.1010402@totalise.co.uk>

Steve

no I applied the patched - hence the difference then..

anyway I'll try your suggestion with dhb->quote first, before I get the
big knife out. Hopefull will have some time this PM..


Steve Freegard wrote:

> Chris/Martin,
>
> Are you not applying the patches included with the MailWatch tarball to the
> original CustomConfig.pm source first then??
>
> The SQLLogging code that comes with MailScanner is totally different to the
> SQLLogging code that I wrote to use with MailWatch - The table layouts are
> different and I wanted to log directly to the database instead of using the
> temporary log files.
>
> If you've not applied these patches - then we've found the problem!
>
> Cheers,
> Steve.
>
>
> -----Original Message-----
> From: Martin Hepworth
> To: MAILSCANNER@JISCMAIL.AC.UK
> Sent: 31/07/03 11:04
> Subject: Re: SQL Redux
>
> Chris Trudeau wrote:
>
>
>>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>>
>>
>>CT:  OK, there seems to be a common thread...I haven't expanded test
>
> to
>
>>anything other than 4.22-5 or 4.22.1, but the older version I have
>
> working
>
>>beatifully, so either the logging function in 4.22-1 doesn't have the
>
> NULL
>
>>value problem or its addressed differently.  Perhaps I will try
>
> installing
>
>>4.22-1 or a between version to try and pinpoint where it breaks!
>
> Chris
>
> looking at the 4.22.1 code there's quite a big change on the whole SQL
> logging setup. Infact the code is radically different.
>
> in 4.22.1 it reads the logfile to get the info required. Slow...
>
> in 4.22.5 it's using the values from the currently processed email to
> drive the insert. It's a lot faster, but seems not to translate NULLs
> etc very well.
>
> --
> Martin
>
> --
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the sender and delete the message from your mailbox.
>
> This footnote also confirms that this email message has been swept by
> MailScanner (www.mailscanner.info) for the presence of computer viruses.

From dot at DOTAT.AT  Thu Jul 31 11:22:58 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:07 2006
Subject: How to set up sendmail to accept and discard all email?
In-Reply-To: <m2n.19iAQq-000pey@chiark.greenend.org.uk>
References: <m2n.19i8sG-000pbJ@chiark.greenend.org.uk>
Message-ID: <E19iAaI-0003Hc-00@chiark.greenend.org.uk>

Tony Finch <dot@DOTAT.AT> wrote:
>
>Apart from Julian's Perl program I believe there's an SMTP daemon that
>is designed to throw away email, but I can't remember its name.

It seems I can eventually: http://www.msg.net/utility/small/chuckmail/

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
PLYMOUTH: WEST 3 OR 4 BACKING SOUTHWEST 4 OR 5, OCCASIONALLY 6. RAIN LATER.
GOOD BECOMING MODERATE WITH FOG PATCHES.

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 11:21:11 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
In-Reply-To: <3F28E9A2.7010509@totalise.co.uk>
References: <002c01c35748$fe7bbd90$23c8a8c0@SERV>
            <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>
            <001401c35706$26403bf0$23c8a8c0@SERV>
            <3F28D4A4.8090704@totalise.co.uk>
            <002c01c35748$fe7bbd90$23c8a8c0@SERV>
Message-ID: <5.2.0.9.2.20030731111922.041cc458@imap.ecs.soton.ac.uk>

At 11:04 31/07/2003, you wrote:
>Chris Trudeau wrote:
>
>>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>>
>>
>>CT:  OK, there seems to be a common thread...I haven't expanded test to
>>anything other than 4.22-5 or 4.22.1, but the older version I have working
>>beatifully, so either the logging function in 4.22-1 doesn't have the NULL
>>value problem or its addressed differently.  Perhaps I will try installing
>>4.22-1 or a between version to try and pinpoint where it breaks!
>Chris
>
>looking at the 4.22.1 code there's quite a big change on the whole SQL
>logging setup. Infact the code is radically different.
>
>in 4.22.1 it reads the logfile to get the info required. Slow...
>
>in 4.22.5 it's using the values from the currently processed email to
>drive the insert. It's a lot faster, but seems not to translate NULLs
>etc very well.

This goes in CustomConfig.pm around line 373.
It goes in just before the "prepare" statement that inserts @fields into
the database table.
Note the additional bugfix when replacing ' with \'

   while(<$logfile1>) {
     chomp;
     @fields = split(/\t/);
     # Work through each field protecting any special characters such as '
     # The line below replaces ' with \'
     @fields = map { s/\'/\\'/g } @fields;

     # Set any empty strings to NULL so the SQL insert works correctly
     @fields = map { ($_ eq '')?'NULL':"$_" } @fields;


--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From maxsec at TOTALISE.CO.UK  Thu Jul 31 11:42:34 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
In-Reply-To: <5.2.0.9.2.20030731111922.041cc458@imap.ecs.soton.ac.uk>
References: <002c01c35748$fe7bbd90$23c8a8c0@SERV>           
            <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>   
            <001401c35706$26403bf0$23c8a8c0@SERV>           
            <3F28D4A4.8090704@totalise.co.uk>           
            <002c01c35748$fe7bbd90$23c8a8c0@SERV>
            <5.2.0.9.2.20030731111922.041cc458@imap.ecs.soton.ac.uk>
Message-ID: <3F28F29A.4040305@totalise.co.uk>

aha

I think the

@fields = map { ($_ eq '')?'NULL':"$_" } @fields;

bit is missing from Steve's patch. I'll try and plop a line or two in to
check the potential NULL's and mark the value correctly..

--
Martin

Julian Field wrote:

> At 11:04 31/07/2003, you wrote:
>
>> Chris Trudeau wrote:
>>
>>>> this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>>>
>>>
>>>
>>> CT:  OK, there seems to be a common thread...I haven't expanded test to
>>> anything other than 4.22-5 or 4.22.1, but the older version I have
>>> working
>>> beatifully, so either the logging function in 4.22-1 doesn't have the
>>> NULL
>>> value problem or its addressed differently.  Perhaps I will try
>>> installing
>>> 4.22-1 or a between version to try and pinpoint where it breaks!
>>
>> Chris
>>
>> looking at the 4.22.1 code there's quite a big change on the whole SQL
>> logging setup. Infact the code is radically different.
>>
>> in 4.22.1 it reads the logfile to get the info required. Slow...
>>
>> in 4.22.5 it's using the values from the currently processed email to
>> drive the insert. It's a lot faster, but seems not to translate NULLs
>> etc very well.
>
>
> This goes in CustomConfig.pm around line 373.
> It goes in just before the "prepare" statement that inserts @fields into
> the database table.
> Note the additional bugfix when replacing ' with \'
>
>   while(<$logfile1>) {
>     chomp;
>     @fields = split(/\t/);
>     # Work through each field protecting any special characters such as '
>     # The line below replaces ' with \'
>     @fields = map { s/\'/\\'/g } @fields;
>
>     # Set any empty strings to NULL so the SQL insert works correctly
>     @fields = map { ($_ eq '')?'NULL':"$_" } @fields;
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 11:47:54 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
In-Reply-To: <3F28F29A.4040305@totalise.co.uk>
References: <5.2.0.9.2.20030731111922.041cc458@imap.ecs.soton.ac.uk>
            <002c01c35748$fe7bbd90$23c8a8c0@SERV>
            <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>
            <001401c35706$26403bf0$23c8a8c0@SERV>
            <3F28D4A4.8090704@totalise.co.uk>
            <002c01c35748$fe7bbd90$23c8a8c0@SERV>
            <5.2.0.9.2.20030731111922.041cc458@imap.ecs.soton.ac.uk>
Message-ID: <5.2.0.9.2.20030731114702.0428a008@imap.ecs.soton.ac.uk>

You also need to make sure he does the
         @fields = map { s/\'/\\'/g } @fields;
line as otherwise people could inject SQL code using malicious email addresses.

At 11:42 31/07/2003, you wrote:
>aha
>
>I think the
>
>@fields = map { ($_ eq '')?'NULL':"$_" } @fields;
>
>bit is missing from Steve's patch. I'll try and plop a line or two in to
>check the potential NULL's and mark the value correctly..
>
>--
>Martin
>
>Julian Field wrote:
>
>>At 11:04 31/07/2003, you wrote:
>>
>>>Chris Trudeau wrote:
>>>
>>>>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>>>>
>>>>
>>>>
>>>>CT:  OK, there seems to be a common thread...I haven't expanded test to
>>>>anything other than 4.22-5 or 4.22.1, but the older version I have
>>>>working
>>>>beatifully, so either the logging function in 4.22-1 doesn't have the
>>>>NULL
>>>>value problem or its addressed differently.  Perhaps I will try
>>>>installing
>>>>4.22-1 or a between version to try and pinpoint where it breaks!
>>>
>>>Chris
>>>
>>>looking at the 4.22.1 code there's quite a big change on the whole SQL
>>>logging setup. Infact the code is radically different.
>>>
>>>in 4.22.1 it reads the logfile to get the info required. Slow...
>>>
>>>in 4.22.5 it's using the values from the currently processed email to
>>>drive the insert. It's a lot faster, but seems not to translate NULLs
>>>etc very well.
>>
>>
>>This goes in CustomConfig.pm around line 373.
>>It goes in just before the "prepare" statement that inserts @fields into
>>the database table.
>>Note the additional bugfix when replacing ' with \'
>>
>>   while(<$logfile1>) {
>>     chomp;
>>     @fields = split(/\t/);
>>     # Work through each field protecting any special characters such as '
>>     # The line below replaces ' with \'
>>     @fields = map { s/\'/\\'/g } @fields;
>>
>>     # Set any empty strings to NULL so the SQL insert works correctly
>>     @fields = map { ($_ eq '')?'NULL':"$_" } @fields;
>>
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From ctrudeau at BELLSOUTH.NET  Thu Jul 31 12:11:30 2003
From: ctrudeau at BELLSOUTH.NET (Chris-Bellsouth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
References: <5.2.0.9.2.20030731111922.041cc458@imap.ecs.soton.ac.uk>           
            <002c01c35748$fe7bbd90$23c8a8c0@SERV>           
            <8FFC76593085ED4A80D3601BC41EFCDF0C0748@inex1.herffjones.hj-int>   
            <001401c35706$26403bf0$23c8a8c0@SERV>           
            <3F28D4A4.8090704@totalise.co.uk>           
            <002c01c35748$fe7bbd90$23c8a8c0@SERV>           
            <5.2.0.9.2.20030731111922.041cc458@imap.ecs.soton.ac.uk> 
            <5.2.0.9.2.20030731114702.0428a008@imap.ecs.soton.ac.uk>
Message-ID: <002601c35754$812c4f60$5702010a@mscore.trusecure.net>

guys,

I'm certainly no perl guy, I did implement Steve's patch on both versions
and am looking forward to Martin's "aha" as I will be relying on you guys to
figure this out  :) (refer to my perl statement above)...

By the way...I believe this is a perfect model scenario for why Open Source
Software and mailing lists offer a support mechanism that commercial
companies simply can't compete with!  Great work!

CT

From sanjay.patel at REXWIRE.COM  Thu Jul 31 12:28:29 2003
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:19:07 2006
Subject: dcc
Message-ID: <010a01c35756$deaf72f0$6f01a8c0@Laptop1>

How can I verify that spamassassin is using dcc? When I do cdcc info I do
get a response but this is no guarantee that spamassassin is using dcc. I
call spamassassin through MailScanner

SKP

From dean.plant at ROKE.CO.UK  Thu Jul 31 12:34:18 2003
From: dean.plant at ROKE.CO.UK (Plant, Dean)
Date: Thu Jan 12 21:19:07 2006
Subject: Suggestion
Message-ID: <EA943CD30BCB104E9D38F5B5DC2D9A7023676D@rsys004a.roke.co.uk>

Julian,

I am using Mailscanner 4-21.9, please excuse me if this has already been implemented, I have checked the change log.

I use the "attachment deliver" option for low-scoring spam. If the user decides that the mail is not spam the mail is dropped into a public folder for processing with sa-learn. The  original message has now had the header information removed and placed into the encapsulating mail. This means that now a can no longer pass the encapsulated mail with its original header info back into sa-learn.

Would it be possible to leave the header information in place when encapsulating mail, it would make life easier when using with sa-learn.

Thanks

Dean Plant

--
Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
Berkshire. RG12 8FZ

The information contained in this e-mail and any attachments is confidential to
Roke Manor Research Ltd and must not be passed to any third party without
permission. This communication is for information only and shall not create or
change any contractual relationship.

From dot at DOTAT.AT  Thu Jul 31 12:31:43 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:07 2006
Subject: dcc
In-Reply-To: <m2n.19iBby-000qJt@chiark.greenend.org.uk>
Message-ID: <E19iBep-0000qc-00@chiark.greenend.org.uk>

"Sanjay K. Patel" <sanjay.patel@REXWIRE.COM> wrote:
>How can I verify that spamassassin is using dcc? When I do cdcc info I do
>get a response but this is no guarantee that spamassassin is using dcc. I
>call spamassassin through MailScanner

Look for DCC in the Spam Header of messages that have gone through
MailScanner, or do a test run of MailScanner with Debug and Debug
SpamAssassin both set to yes, and look through the output.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
NORTH FITZROY: SOUTHWEST VEERING NORTHWEST 4 OR 5 BECOMING VARIABLE 3. RAIN OR
DRIZZLE. MODERATE OR POOR.

From Steve at swaney.com  Thu Jul 31 13:01:09 2003
From: Steve at swaney.com (Stephen Swaney)
Date: Thu Jan 12 21:19:07 2006
Subject: Suggestion
In-Reply-To: <EA943CD30BCB104E9D38F5B5DC2D9A7023676D@rsys004a.roke.co.uk>
References: <EA943CD30BCB104E9D38F5B5DC2D9A7023676D@rsys004a.roke.co.uk>
Message-ID: <1059652868.1460.2001.camel@speedy>

Dean,

Sounds like your using an Outlook client. If so, the header mangling
you're seeing is a "Feature" of your outlook client, not MailScanner.

There is a lot of discussion on this Outlook feature / problem on the
mailing list.

Steve
Steve@Swaney.com

On Thu, 2003-07-31 at 07:34, Plant, Dean wrote:

> Julian,
>
> I am using Mailscanner 4-21.9, please excuse me if this has already been implemented, I have checked the change log.
>
> I use the "attachment deliver" option for low-scoring spam. If the user decides that the mail is not spam the mail is dropped into a public folder for processing with sa-learn. The  original message has now had the header information removed and placed into the encapsulating mail. This means that now a can no longer pass the encapsulated mail with its original header info back into sa-learn.
>
> Would it be possible to leave the header information in place when encapsulating mail, it would make life easier when using with sa-learn.
>
> Thanks
>
> Dean Plant
>
> --
> Registered Office: Roke Manor Research Ltd, Siemens House, Oldbury, Bracknell,
> Berkshire. RG12 8FZ
>
> The information contained in this e-mail and any attachments is confidential to
> Roke Manor Research Ltd and must not be passed to any third party without
> permission. This communication is for information only and shall not create or
> change any contractual relationship.

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

--
Postmaster@FSL.com
Fortress Systems, Ltd.
Email Gateways
info@FSL.com
www.FSL.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030731/39607ec7/attachment.html
From ctrudeau at BELLSOUTH.NET  Thu Jul 31 13:04:31 2003
From: ctrudeau at BELLSOUTH.NET (Chris-Bellsouth)
Date: Thu Jan 12 21:19:07 2006
Subject: dcc
References: <E19iBep-0000qc-00@chiark.greenend.org.uk>
Message-ID: <00e201c3575b$e6b2bde0$5702010a@mscore.trusecure.net>

> >How can I verify that spamassassin is using dcc? When I do cdcc info I do
> >get a response but this is no guarantee that spamassassin is using dcc. I
> >call spamassassin through MailScanner
>
> Look for DCC in the Spam Header of messages that have gone through
> MailScanner, or do a test run of MailScanner with Debug and Debug
> SpamAssassin both set to yes, and look through the output.

You can also try:

# spamassassin -D --lint

and look for lines like this in the output:

<SNIP>
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: DCC: got response: X-DCC-dmv.com-Metrics:
mta01.prod.messagedefense.com 1181; Body=50212
</SNIP>


CT

From andersan at LTKALMAR.SE  Thu Jul 31 13:37:41 2003
From: andersan at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:19:07 2006
Subject: SV: SV: SV: Regarding rules for more then one person
Message-ID: <9F18B7DDBA88E544AB1F1995148916661CE6B3@lkl63.ltkalmar.se>

One more stupid question..... will this patch work on all rules?

Forgot to say "thanks for all the help"

> -----Ursprungligt meddelande-----
> Fr?n: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
> Skickat: den 30 juli 2003 19:50
> Till: MAILSCANNER@JISCMAIL.AC.UK
> ?mne: Re: SV: SV: Regarding rules for more then one person
> 
> 
> Attached is a diff to Config.pm that implements this.
> You can now have rules that look like this:
> 
> To:     /etc/MailScanner/rules/techies.txt      yes
> 
> Note that it has to be a full path which starts with "/" and ends in 
> something other than "/". The rule will be replicated for all 
> the patterns 
> in the techies.txt file, so you could put this in techies.txt
> 
> # This is the list of all our tech support staff. 
> jkf@ecs.soton.ac.uk *@techies.soton.ac.uk
> jkf@*
> /etc/MailScanner/rules/nested-filename.txt
> 
> Note that the file format is like this:
> 1) One pattern or address per line. The allowable patterns 
> are the same as 
> the normal patterns in any normal ruleset file.
> 2) Comments start with # and continue until the end of the line.
> 3) Blank lines are ignored.
> 4) Leading and trailing white space is ignored.
> 5) Further filenames can be included, allowing you to nest 
> these files if 
> you really need to.
> 6) If you make a loop by having a file include itself, then 
> you're silly 
> and shouldn't do it.
> 
> At 17:49 30/07/2003, you wrote:
> > > -----Ursprungligt meddelande-----
> > > Fr?n: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET]
> > > Skickat: den 30 juli 2003 18:46
> > > Till: MAILSCANNER@JISCMAIL.AC.UK
> > > ?mne: Re: SV: Regarding rules for more then one person
> > >
> > >
> > > Hi!
> > >
> > > > > Whats the use, if you can generate a techies.txt you can also 
> > > > > generate a script that spits out a rulefile to do this ? or ?
> > >
> > > > Guess so but since Im not that a great I thought that 
> being able 
> > > > to use a writing all my co-workers for each rule would be
> > > easier..... and
> > > > if I need I only need to change in one place. Maybe Im 
> just lazy 
> > > > or bad at scripting of problems for me. Since the only ppl
> > > that would be
> > > > added are tech-ppl at use a single file with user for more
> > > rules like
> > > > filname/filetype.
> > >
> > > Ask one of those <haha> :)
> >
> >Now your being evil  ;)
> >Im trying to learn this but prolly never get the hang of it and Im 
> >pretty sure Im not the only person in the world that sucks at 
> >scripting. So if its not to difficult I want it on the wish list  :)
> 


From maxsec at TOTALISE.CO.UK  Thu Jul 31 14:24:24 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
In-Reply-To: <67D9E7698329D411936E00508B6590B902773A4B@neelix.lbsltd.co.uk>
References: <67D9E7698329D411936E00508B6590B902773A4B@neelix.lbsltd.co.uk>
Message-ID: <3F291888.2090508@totalise.co.uk>

Steve

ok I got code to look like

   # Sanitize reports
   my($reports) = map { ($_ eq '')?'NULL':"$_" } join(' ', @report_array);
   my($aplaces) = map { ($_ eq '')?'NULL':"$_" } join(',',
@{$message->{archiveplaces}});
   my($myspamreport) = map { ($_ eq '')?'NULL':"$_" } $spamreport;

   my($insmessage) = $message;
$insmessage->{to} = map { ($_ eq '')?'NULL':"$_" }
join(',',@{$message->{to}});
   $insmessage->{subject} = map { ($_ eq '')?'NULL':"$_" }
$message->{subject};
   $insmessage->{issaspam} = map { ($_ eq '')?'NULL':"$_" }
$message->{issaspam};

   $insmessage->{isrblspam} = map { ($_ eq '')?'NULL':"$_" }
$message->{isrblspam};

   # Insert the data
   MailScanner::Log::WarnLog("trying to insert row:  %s, %s, %s, %s, %s,
%s, %s,
%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s",  $timestamp,
$insmessage->{
id}, $insmessage->{size}, $insmessage->{from}, $insmessage->{to},
$insmessage->{subject}, $insmessage->{clientip}, $aplaces,
$insmessage->{isspam}
, $insmessage->{ishigh}, $insmessage->{issaspam},
$insmessage->{isrblspam}, $ins
message->{spamwhitelisted}, $insmessage->{sascore}, $myspamreport,
$insmessage->
{virusinfected}, $insmessage->{nameinfected},
$insmessage->{otherinfected}, $rep
orts, $hostname);
   $sth->execute(
    $timestamp,
    $dbh->quote($insmessage->{id}),
    $insmessage->{size},
    $dbh->quote($insmessage->{from}),
    $dbh->quote($insmessage->{to}),
    $dbh->quote($insmessage->{subject}),
    $dbh->quote($insmessage->{clientip}),
    $dbh->quote($aplaces),
    $insmessage->{isspam},
    $insmessage->{ishigh},
    $insmessage->{issaspam},
    $insmessage->{isrblspam},
    $insmessage->{spamwhitelisted},
    $insmessage->{sascore},
    $dbh->quote($myspamreport),
    $insmessage->{virusinfected},
    $insmessage->{nameinfected},
    $insmessage->{otherinfected},
    $dbh->quote($reports),
    $dbh->quote($hostname))
   or MailScanner::Log::WarnLog("Cannot insert row: %s", $DBI::errstr);


and it's still not inserting in the DB..maillog says...

Jul 31 14:17:02 soloman MailScanner[61293]: trying to insert row:
2003-07-31 14:17:02, h6VDGvXL061292, 1060,
martinh@soloman.solid-state-logic.com, martinh@solid-state-logic.com,
test7, 127.0.0.1, NULL, 0, 0, 1, 1, 0, 0, NULL, 0, 0, 0, NULL,
soloman.solid-state-logic.com
Jul 31 14:17:02 soloman MailScanner[61293]: Cannot insert row: MySQL
server has gone away

Anybody any clues - my perl isn't great so..

--
martin

From kyle at TEKHEAD.BIZ  Thu Jul 31 06:27:45 2003
From: kyle at TEKHEAD.BIZ (Kyle Pinkley)
Date: Thu Jan 12 21:19:07 2006
Subject: Allow File Extension
Message-ID: <000601c35724$7a4e5920$c901a8c0@sasha>

Hello,

I just installed Mailscanner yesterday.  In my
/usr/mailscanner/etc/filenamerules.conf file I need for it to allow the
two extensions:

.map
.atr

I have added the two lines towards the top of the file:

allow   \.map$                  -       -
allow   \.atr$                  -       -

However, when I kill all the PID's for Mailscanner and run
/usr/mailscanner/bin/check_mailscanner to restart, I'm still getting it
filtered (see bellow).   Any help you can give would be appreciated!

Jul 31 00:16:33 srv01 MailScanner[7674]: Filetype Checks: No executables
(FritoLay.atr)
Jul 31 00:16:33 srv01 MailScanner[7674]: Filetype Checks: No executables
(FritoLay.atr)
Jul 31 00:16:33 srv01 MailScanner[7674]: Saved infected "FritoLay.atr"
to /var/spool/MailScanner/quarantine/20030731/19i5nf-0001zl-FE
Jul 31 00:16:33 srv01 MailScanner[7674]: Saved infected "FritoLay.atr"
to /var/spool/MailScanner/quarantine/20030731/19i5nf-0001zl-FE
--
Kyle Pinkley
kyle@tekhead.biz


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030731/8138eff7/attachment.html
From maxsec at TOTALISE.CO.UK  Thu Jul 31 14:54:43 2003
From: maxsec at TOTALISE.CO.UK (Martin Hepworth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
In-Reply-To: <3F291888.2090508@totalise.co.uk>
References: <67D9E7698329D411936E00508B6590B902773A4B@neelix.lbsltd.co.uk>
            <3F291888.2090508@totalise.co.uk>
Message-ID: <3F291FA3.2010707@totalise.co.uk>

I think I'll try mysql 3.23 to see if that makes any difference...


--
Martin

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 14:43:38 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:07 2006
Subject: SV: SV: SV: Regarding rules for more then one person
In-Reply-To: <9F18B7DDBA88E544AB1F1995148916661CE6B3@lkl63.ltkalmar.se>
Message-ID: <5.2.0.9.2.20030731144334.042295e0@imap.ecs.soton.ac.uk>

At 13:37 31/07/2003, you wrote:
>One more stupid question..... will this patch work on all rules?

Yes.


>Forgot to say "thanks for all the help"
>
> > -----Ursprungligt meddelande-----
> > Fr?n: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
> > Skickat: den 30 juli 2003 19:50
> > Till: MAILSCANNER@JISCMAIL.AC.UK
> > ?mne: Re: SV: SV: Regarding rules for more then one person
> >
> >
> > Attached is a diff to Config.pm that implements this.
> > You can now have rules that look like this:
> >
> > To:     /etc/MailScanner/rules/techies.txt      yes
> >
> > Note that it has to be a full path which starts with "/" and ends in
> > something other than "/". The rule will be replicated for all
> > the patterns
> > in the techies.txt file, so you could put this in techies.txt
> >
> > # This is the list of all our tech support staff.
> > jkf@ecs.soton.ac.uk *@techies.soton.ac.uk
> > jkf@*
> > /etc/MailScanner/rules/nested-filename.txt
> >
> > Note that the file format is like this:
> > 1) One pattern or address per line. The allowable patterns
> > are the same as
> > the normal patterns in any normal ruleset file.
> > 2) Comments start with # and continue until the end of the line.
> > 3) Blank lines are ignored.
> > 4) Leading and trailing white space is ignored.
> > 5) Further filenames can be included, allowing you to nest
> > these files if
> > you really need to.
> > 6) If you make a loop by having a file include itself, then
> > you're silly
> > and shouldn't do it.
> >
> > At 17:49 30/07/2003, you wrote:
> > > > -----Ursprungligt meddelande-----
> > > > Fr?n: Raymond Dijkxhoorn [mailto:raymond@PROLOCATION.NET]
> > > > Skickat: den 30 juli 2003 18:46
> > > > Till: MAILSCANNER@JISCMAIL.AC.UK
> > > > ?mne: Re: SV: Regarding rules for more then one person
> > > >
> > > >
> > > > Hi!
> > > >
> > > > > > Whats the use, if you can generate a techies.txt you can also
> > > > > > generate a script that spits out a rulefile to do this ? or ?
> > > >
> > > > > Guess so but since Im not that a great I thought that
> > being able
> > > > > to use a writing all my co-workers for each rule would be
> > > > easier..... and
> > > > > if I need I only need to change in one place. Maybe Im
> > just lazy
> > > > > or bad at scripting of problems for me. Since the only ppl
> > > > that would be
> > > > > added are tech-ppl at use a single file with user for more
> > > > rules like
> > > > > filname/filetype.
> > > >
> > > > Ask one of those <haha> :)
> > >
> > >Now your being evil  ;)
> > >Im trying to learn this but prolly never get the hang of it and Im
> > >pretty sure Im not the only person in the world that sucks at
> > >scripting. So if its not to difficult I want it on the wish list  :)
> >

-- 
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support


From ctrudeau at BELLSOUTH.NET  Thu Jul 31 15:27:58 2003
From: ctrudeau at BELLSOUTH.NET (Chris-Bellsouth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
References: <67D9E7698329D411936E00508B6590B902773A4B@neelix.lbsltd.co.uk> 
            <3F28F043.1010402@totalise.co.uk>
Message-ID: <01ad01c3576f$f2ad0ec0$5702010a@mscore.trusecure.net>

OK...maybe I'm missing something LARGE!....

but it appears like the database schema I built as a result of the
create.sql that I obtained with the mailwatch package from Steve creates the
following table: (just an example)

CREATE TABLE maillog (
  timestamp timestamp(14) NOT NULL,
  id text,
  size bigint(20) default '0',
  from_address text,
  to_address text,
  subject text,
  clientip text,
  archive text,
  isspam tinyint(1) default '0',
  ishighspam tinyint(1) default '0',
  issaspam tinyint(1) default '0',
  isrblspam tinyint(1) default '0',
  spamwhitelisted tinyint(1) default '0',
  sascore decimal(7,2) default '0.00',
  spamreport text,
  virusinfected tinyint(1) default '0',
  nameinfected tinyint(1) default '0',
  otherinfected tinyint(1) default '0',
  report text,
  hostname text


But the INSERT code in the current 4.22-5 CustomConfig.pm:

my($sth) = $dbh->prepare("INSERT INTO maillog_mail (time, msg_id, size,
from_user, from_domain, subject, clientip, archives, isspam, ishighspam,
sascore, spamreport) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)");

my($sth) = $dbh->prepare("INSERT INTO maillog_report (msg_id, filename,
filereport) VALUES (?,?,?)");
$sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);

not only do the maillog_mail and maillog_report tables not exist, the schema
that CustomConfig is attempting to insert data into doesn;t appear to be
formatted approrpriately for the inserts..

Not sure I see any references to sql builds anywhere in
documentation/site/FAQ...so I'm stumped...

Now it is likely that I'm missing something obvious...so please guide me to
the light  :)

CT

From john.hanks at USU.EDU  Thu Jul 31 15:28:51 2003
From: john.hanks at USU.EDU (John B. Hanks)
Date: Thu Jan 12 21:19:07 2006
Subject: Disabling Content Checks
Message-ID: <08531A708F65984C98D25F308B1113A4660A@exchange.usu.edu>

 
After upgrading to 4.22-5 yesterday, MailScanner is suddenly very
paranoid about HTML. It is stripping a lot of messages and giving this
error in the logs:

Jul 31 06:11:31 ms1 MailScanner[30039]: Content Checks: Detected
HTML-specific exploits in h6VCBTM3011790

How can I disable these checks without disabling virus scanning? I don't
see an obvious option in the conf file for turning this off, if someone
could point out what I am overlooking, I'd appreciate it.

Thanks,

jbh


From steve.freegard at LBSLTD.CO.UK  Thu Jul 31 15:32:11 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <67D9E7698329D411936E00508B6590B902773A4D@neelix.lbsltd.co.uk>

Hey Martin,

That error message looks like the MySQL server is barfing at the data coming
in (which does look okay from the log).  Can you try again - when you get
the 'Gone away' message in the logs, run 'mysqladmin version' and check the
server uptime to make sure that it isn't crashing out.

Have a look at http://www.mysql.com/doc/en/Gone_away.html to see if any of
the solutions posted there work for you.

Cheers,
Steve.


-----Original Message-----
From: Martin Hepworth
To: Steve Freegard
Cc: 'MAILSCANNER@JISCMAIL.AC.UK '
Sent: 31/07/03 14:24
Subject: Re: SQL Redux


Steve

ok I got code to look like

   # Sanitize reports
   my($reports) = map { ($_ eq '')?'NULL':"$_" } join(' ',
@report_array);
   my($aplaces) = map { ($_ eq '')?'NULL':"$_" } join(',',
@{$message->{archiveplaces}});
   my($myspamreport) = map { ($_ eq '')?'NULL':"$_" } $spamreport;

   my($insmessage) = $message;
$insmessage->{to} = map { ($_ eq '')?'NULL':"$_" }
join(',',@{$message->{to}});
   $insmessage->{subject} = map { ($_ eq '')?'NULL':"$_" }
$message->{subject};
   $insmessage->{issaspam} = map { ($_ eq '')?'NULL':"$_" }
$message->{issaspam};

   $insmessage->{isrblspam} = map { ($_ eq '')?'NULL':"$_" }
$message->{isrblspam};

   # Insert the data
   MailScanner::Log::WarnLog("trying to insert row:  %s, %s, %s, %s, %s,

%s, %s,
%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s",  $timestamp,
$insmessage->{
id}, $insmessage->{size}, $insmessage->{from}, $insmessage->{to},
$insmessage->{subject}, $insmessage->{clientip}, $aplaces,
$insmessage->{isspam}
, $insmessage->{ishigh}, $insmessage->{issaspam},
$insmessage->{isrblspam}, $ins
message->{spamwhitelisted}, $insmessage->{sascore}, $myspamreport,
$insmessage->
{virusinfected}, $insmessage->{nameinfected},
$insmessage->{otherinfected}, $rep
orts, $hostname);
   $sth->execute(
    $timestamp,
    $dbh->quote($insmessage->{id}),
    $insmessage->{size},
    $dbh->quote($insmessage->{from}),
    $dbh->quote($insmessage->{to}),
    $dbh->quote($insmessage->{subject}),
    $dbh->quote($insmessage->{clientip}),
    $dbh->quote($aplaces),
    $insmessage->{isspam},
    $insmessage->{ishigh},
    $insmessage->{issaspam},
    $insmessage->{isrblspam},
    $insmessage->{spamwhitelisted},
    $insmessage->{sascore},
    $dbh->quote($myspamreport),
    $insmessage->{virusinfected},
    $insmessage->{nameinfected},
    $insmessage->{otherinfected},
    $dbh->quote($reports),
    $dbh->quote($hostname))
   or MailScanner::Log::WarnLog("Cannot insert row: %s", $DBI::errstr);


and it's still not inserting in the DB..maillog says...

Jul 31 14:17:02 soloman MailScanner[61293]: trying to insert row:
2003-07-31 14:17:02, h6VDGvXL061292, 1060,
martinh@soloman.solid-state-logic.com, martinh@solid-state-logic.com,
test7, 127.0.0.1, NULL, 0, 0, 1, 1, 0, 0, NULL, 0, 0, 0, NULL,
soloman.solid-state-logic.com
Jul 31 14:17:02 soloman MailScanner[61293]: Cannot insert row: MySQL
server has gone away

Anybody any clues - my perl isn't great so..

--
martin


--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From john.hanks at USU.EDU  Thu Jul 31 15:39:03 2003
From: john.hanks at USU.EDU (John B. Hanks)
Date: Thu Jan 12 21:19:07 2006
Subject: Disabling Content Checks
Message-ID: <08531A708F65984C98D25F308B1113A4660B@exchange.usu.edu>

I think I found it, Allow Form Tags = yes. Just hadn't read
MailScanner.conf.rpmnew quite carefully enough yet.

Sorry for the noise.

jbh 

> -----Original Message-----
> From: John B. Hanks 
> Sent: Thursday, July 31, 2003 8:29 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Disabling Content Checks
> 
>  
> After upgrading to 4.22-5 yesterday, MailScanner is suddenly 
> very paranoid about HTML. It is stripping a lot of messages 
> and giving this error in the logs:
> 
> Jul 31 06:11:31 ms1 MailScanner[30039]: Content Checks: 
> Detected HTML-specific exploits in h6VCBTM3011790
> 
> How can I disable these checks without disabling virus 
> scanning? I don't see an obvious option in the conf file for 
> turning this off, if someone could point out what I am 
> overlooking, I'd appreciate it.
> 
> Thanks,
> 
> jbh
> 


From steve.freegard at lbsltd.co.uk  Thu Jul 31 15:43:28 2003
From: steve.freegard at lbsltd.co.uk (Steve Freegard)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <67D9E7698329D411936E00508B6590B902773A4E@neelix.lbsltd.co.uk>

Hi Julian,

Thanks very much for this.

I'm 99.9% sure that I kept the code below - the only changes I made to your
original code was to log directly to MySQL bypassing the temporary files.

I'm presuming that the NULL mapping code was added recently (which is why I
don't have it in my patches)??

Do you think it would be easier as there are now two branches of this code
for me to distribute a MailWatch.pm instead of patches to CustomConfig.pm
and call the MailWatch logging routine something different (something like
&MailWatchSQLLogging) - then all that would need to be done is to include
the MailWatch.pm from CustomConfig.pm.

That would save on the confusion between the two versions at least - does
this sound like a good idea??

Cheers,
Steve.

-----Original Message-----
From: Julian Field
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: 31/07/03 11:47
Subject: Re: SQL Redux

You also need to make sure he does the
         @fields = map { s/\'/\\'/g } @fields;
line as otherwise people could inject SQL code using malicious email
addresses.

At 11:42 31/07/2003, you wrote:
>aha
>
>I think the
>
>@fields = map { ($_ eq '')?'NULL':"$_" } @fields;
>
>bit is missing from Steve's patch. I'll try and plop a line or two in
to
>check the potential NULL's and mark the value correctly..
>
>--
>Martin
>
>Julian Field wrote:
>
>>At 11:04 31/07/2003, you wrote:
>>
>>>Chris Trudeau wrote:
>>>
>>>>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>>>>
>>>>
>>>>
>>>>CT:  OK, there seems to be a common thread...I haven't expanded test
to
>>>>anything other than 4.22-5 or 4.22.1, but the older version I have
>>>>working
>>>>beatifully, so either the logging function in 4.22-1 doesn't have
the
>>>>NULL
>>>>value problem or its addressed differently.  Perhaps I will try
>>>>installing
>>>>4.22-1 or a between version to try and pinpoint where it breaks!
>>>
>>>Chris
>>>
>>>looking at the 4.22.1 code there's quite a big change on the whole
SQL
>>>logging setup. Infact the code is radically different.
>>>
>>>in 4.22.1 it reads the logfile to get the info required. Slow...
>>>
>>>in 4.22.5 it's using the values from the currently processed email to
>>>drive the insert. It's a lot faster, but seems not to translate NULLs
>>>etc very well.
>>
>>
>>This goes in CustomConfig.pm around line 373.
>>It goes in just before the "prepare" statement that inserts @fields
into
>>the database table.
>>Note the additional bugfix when replacing ' with \'
>>
>>   while(<$logfile1>) {
>>     chomp;
>>     @fields = split(/\t/);
>>     # Work through each field protecting any special characters such
as '
>>     # The line below replaces ' with \'
>>     @fields = map { s/\'/\\'/g } @fields;
>>
>>     # Set any empty strings to NULL so the SQL insert works correctly
>>     @fields = map { ($_ eq '')?'NULL':"$_" } @fields;
>>
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.


From steve.freegard at lbsltd.co.uk  Thu Jul 31 15:43:28 2003
From: steve.freegard at lbsltd.co.uk (Steve Freegard)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <67D9E7698329D411936E00508B6590B902773A4E@neelix.lbsltd.co.uk>

Hi Julian,

Thanks very much for this.

I'm 99.9% sure that I kept the code below - the only changes I made to your
original code was to log directly to MySQL bypassing the temporary files.

I'm presuming that the NULL mapping code was added recently (which is why I
don't have it in my patches)??

Do you think it would be easier as there are now two branches of this code
for me to distribute a MailWatch.pm instead of patches to CustomConfig.pm
and call the MailWatch logging routine something different (something like
&MailWatchSQLLogging) - then all that would need to be done is to include
the MailWatch.pm from CustomConfig.pm.

That would save on the confusion between the two versions at least - does
this sound like a good idea??

Cheers,
Steve.

-----Original Message-----
From: Julian Field
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: 31/07/03 11:47
Subject: Re: SQL Redux

You also need to make sure he does the
         @fields = map { s/\'/\\'/g } @fields;
line as otherwise people could inject SQL code using malicious email
addresses.

At 11:42 31/07/2003, you wrote:
>aha
>
>I think the
>
>@fields = map { ($_ eq '')?'NULL':"$_" } @fields;
>
>bit is missing from Steve's patch. I'll try and plop a line or two in
to
>check the potential NULL's and mark the value correctly..
>
>--
>Martin
>
>Julian Field wrote:
>
>>At 11:04 31/07/2003, you wrote:
>>
>>>Chris Trudeau wrote:
>>>
>>>>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
>>>>
>>>>
>>>>
>>>>CT:  OK, there seems to be a common thread...I haven't expanded test
to
>>>>anything other than 4.22-5 or 4.22.1, but the older version I have
>>>>working
>>>>beatifully, so either the logging function in 4.22-1 doesn't have
the
>>>>NULL
>>>>value problem or its addressed differently.  Perhaps I will try
>>>>installing
>>>>4.22-1 or a between version to try and pinpoint where it breaks!
>>>
>>>Chris
>>>
>>>looking at the 4.22.1 code there's quite a big change on the whole
SQL
>>>logging setup. Infact the code is radically different.
>>>
>>>in 4.22.1 it reads the logfile to get the info required. Slow...
>>>
>>>in 4.22.5 it's using the values from the currently processed email to
>>>drive the insert. It's a lot faster, but seems not to translate NULLs
>>>etc very well.
>>
>>
>>This goes in CustomConfig.pm around line 373.
>>It goes in just before the "prepare" statement that inserts @fields
into
>>the database table.
>>Note the additional bugfix when replacing ' with \'
>>
>>   while(<$logfile1>) {
>>     chomp;
>>     @fields = split(/\t/);
>>     # Work through each field protecting any special characters such
as '
>>     # The line below replaces ' with \'
>>     @fields = map { s/\'/\\'/g } @fields;
>>
>>     # Set any empty strings to NULL so the SQL insert works correctly
>>     @fields = map { ($_ eq '')?'NULL':"$_" } @fields;
>>
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From steve.freegard at LBSLTD.CO.UK  Thu Jul 31 15:44:42 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <67D9E7698329D411936E00508B6590B902773A4F@neelix.lbsltd.co.uk>

Hi Chris,

You need to patch CustomConfig.pm using the diffs included with MailWatch as
per the INSTALL doc.

Cheers,
Steve.

-----Original Message-----
From: Chris-Bellsouth
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: 31/07/03 15:27
Subject: Re: SQL Redux

OK...maybe I'm missing something LARGE!....

but it appears like the database schema I built as a result of the
create.sql that I obtained with the mailwatch package from Steve creates
the
following table: (just an example)

CREATE TABLE maillog (
  timestamp timestamp(14) NOT NULL,
  id text,
  size bigint(20) default '0',
  from_address text,
  to_address text,
  subject text,
  clientip text,
  archive text,
  isspam tinyint(1) default '0',
  ishighspam tinyint(1) default '0',
  issaspam tinyint(1) default '0',
  isrblspam tinyint(1) default '0',
  spamwhitelisted tinyint(1) default '0',
  sascore decimal(7,2) default '0.00',
  spamreport text,
  virusinfected tinyint(1) default '0',
  nameinfected tinyint(1) default '0',
  otherinfected tinyint(1) default '0',
  report text,
  hostname text


But the INSERT code in the current 4.22-5 CustomConfig.pm:

my($sth) = $dbh->prepare("INSERT INTO maillog_mail (time, msg_id, size,
from_user, from_domain, subject, clientip, archives, isspam, ishighspam,
sascore, spamreport) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)");

my($sth) = $dbh->prepare("INSERT INTO maillog_report (msg_id, filename,
filereport) VALUES (?,?,?)");
$sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);

not only do the maillog_mail and maillog_report tables not exist, the
schema
that CustomConfig is attempting to insert data into doesn;t appear to be
formatted approrpriately for the inserts..

Not sure I see any references to sql builds anywhere in
documentation/site/FAQ...so I'm stumped...

Now it is likely that I'm missing something obvious...so please guide me
to
the light  :)

CT

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 15:40:50 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:07 2006
Subject: Disabling Content Checks
In-Reply-To: <08531A708F65984C98D25F308B1113A4660A@exchange.usu.edu>
Message-ID: <5.2.0.9.2.20030731154014.043a2310@imap.ecs.soton.ac.uk>

Allow IFrame Tags = yes
Allow Form Tags = yes
Allow Object Codebase Tags = yes

At 15:28 31/07/2003, you wrote:
>
>After upgrading to 4.22-5 yesterday, MailScanner is suddenly very
>paranoid about HTML. It is stripping a lot of messages and giving this
>error in the logs:
>
>Jul 31 06:11:31 ms1 MailScanner[30039]: Content Checks: Detected
>HTML-specific exploits in h6VCBTM3011790
>
>How can I disable these checks without disabling virus scanning? I don't
>see an obvious option in the conf file for turning this off, if someone
>could point out what I am overlooking, I'd appreciate it.
>
>Thanks,
>
>jbh

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From mailscanner at ecs.soton.ac.uk  Thu Jul 31 15:45:30 2003
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
In-Reply-To: <67D9E7698329D411936E00508B6590B902773A4E@neelix.lbsltd.co. uk>
Message-ID: <5.2.0.9.2.20030731154315.04211df0@imap.ecs.soton.ac.uk>

At 15:43 31/07/2003, you wrote:
>Hi Julian,
>
>Thanks very much for this.
>
>I'm 99.9% sure that I kept the code below - the only changes I made to your
>original code was to log directly to MySQL bypassing the temporary files.
>
>I'm presuming that the NULL mapping code was added recently (which is why I
>don't have it in my patches)??

Yes, I added it this morning.

>Do you think it would be easier as there are now two branches of this code
>for me to distribute a MailWatch.pm instead of patches to CustomConfig.pm
>and call the MailWatch logging routine something different (something like
>&MailWatchSQLLogging) - then all that would need to be done is to include
>the MailWatch.pm from CustomConfig.pm.
>
>That would save on the confusion between the two versions at least - does
>this sound like a good idea??

This sounds like a great idea. Having 2 branches of the code is a nightmare
to maintain. This way all your bugs remain yours, and all mine remain mine :-)
That way you can just distribute your extra file and give a very simple
modification that people need to make to CustomConfig.pm when installing
MailWatch, e.g.
         require MailWatch.pm;


>-----Original Message-----
>From: Julian Field
>To: MAILSCANNER@JISCMAIL.AC.UK
>Sent: 31/07/03 11:47
>Subject: Re: SQL Redux
>
>You also need to make sure he does the
>          @fields = map { s/\'/\\'/g } @fields;
>line as otherwise people could inject SQL code using malicious email
>addresses.
>
>At 11:42 31/07/2003, you wrote:
> >aha
> >
> >I think the
> >
> >@fields = map { ($_ eq '')?'NULL':"$_" } @fields;
> >
> >bit is missing from Steve's patch. I'll try and plop a line or two in
>to
> >check the potential NULL's and mark the value correctly..
> >
> >--
> >Martin
> >
> >Julian Field wrote:
> >
> >>At 11:04 31/07/2003, you wrote:
> >>
> >>>Chris Trudeau wrote:
> >>>
> >>>>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
> >>>>
> >>>>
> >>>>
> >>>>CT:  OK, there seems to be a common thread...I haven't expanded test
>to
> >>>>anything other than 4.22-5 or 4.22.1, but the older version I have
> >>>>working
> >>>>beatifully, so either the logging function in 4.22-1 doesn't have
>the
> >>>>NULL
> >>>>value problem or its addressed differently.  Perhaps I will try
> >>>>installing
> >>>>4.22-1 or a between version to try and pinpoint where it breaks!
> >>>
> >>>Chris
> >>>
> >>>looking at the 4.22.1 code there's quite a big change on the whole
>SQL
> >>>logging setup. Infact the code is radically different.
> >>>
> >>>in 4.22.1 it reads the logfile to get the info required. Slow...
> >>>
> >>>in 4.22.5 it's using the values from the currently processed email to
> >>>drive the insert. It's a lot faster, but seems not to translate NULLs
> >>>etc very well.
> >>
> >>
> >>This goes in CustomConfig.pm around line 373.
> >>It goes in just before the "prepare" statement that inserts @fields
>into
> >>the database table.
> >>Note the additional bugfix when replacing ' with \'
> >>
> >>   while(<$logfile1>) {
> >>     chomp;
> >>     @fields = split(/\t/);
> >>     # Work through each field protecting any special characters such
>as '
> >>     # The line below replaces ' with \'
> >>     @fields = map { s/\'/\\'/g } @fields;
> >>
> >>     # Set any empty strings to NULL so the SQL insert works correctly
> >>     @fields = map { ($_ eq '')?'NULL':"$_" } @fields;
> >>
> >>
> >>--
> >>Julian Field
> >>www.MailScanner.info
> >>MailScanner thanks transtec Computers for their support
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>
>--
>This email and any files transmitted with it are confidential and
>intended solely for the use of the individual or entity to whom they
>are addressed. If you have received this email in error please notify
>the sender and delete the message from your mailbox.
>
>This footnote also confirms that this email message has been swept by
>MailScanner (www.mailscanner.info) for the presence of computer viruses.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

From RKearney at AZERTY.COM  Thu Jul 31 15:56:39 2003
From: RKearney at AZERTY.COM (Kearney, Rob)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <210DF55DED65B547896F728FB057F3B2019C4512@seaver.ussco.com>

here is what we did for SQL logging, to bypass temp-file stuff.

Just took the SQLLogging and made SQLRTLogging, to write directly to DB, We
have not noticed any degradation in performance
Basically, we took the functions of SQLLogging and EndSQLLogging and put
them together.
(dont forget Init and End scripts also

---
sub SQLRTLogging {
  my($message) = @_;
  my($dbh);
  $dbh =
DBI->connect("DBI:mysql:mailscanner:localhost:mysql_socket=/var/database/mys
ql/mysql.sock",
                      "mailscanner", "mailscanner",
                      {'PrintError' => 0})
   or MailScanner::Log::DieLog("Cannot connect to the database: %s",
                                $DBI::errstr);

  my $id = $message->{id};
  my $size = $message->{size};
  my $from = $message->{from};
  my ($from_user, $from_domain);

  # split the from address into user and domain bits.
  # This may be unnecessary for you; we use it to more easily determine
  # inbound vs outbound email in a multi-domain environment.
  # HINT: refine queries using SQL 'join' with a table containing local
  # domains.

  ($from_user, $from_domain) = split /\@/, $from;

  my @to   = @{$message->{to}};
  my $subject = $message->{subject};
  my $clientip = $message->{clientip};
  my $archives = join(',', @{$message->{archiveplaces}});
  my $isspam = $message->{isspam};
  my $ishighspam = $message->{ishigh};
  my $sascore = $message->{sascore};
  my $spamreport = $message->{spamreport};

  # Get rid of control chars and tidy-up SpamAssassin report
  $spamreport =~ s/\n/ /g;
  $spamreport =~ s/\t//g;

  # Get timestamp, and format it so it is suitable to use with MySQL
  my($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
  my($timestamp) = sprintf("%d-%02d-%02d %02d:%02d:%02d",
                           $year+1900,$mon+1,$mday,$hour,$min,$sec);

# maillog_mail insert
    my @fields=($timestamp, $id, $size, $from_user, $from_domain,
                $subject, $clientip, $archives, $isspam, $ishighspam,
                $sascore, $spamreport);
    map { s/\'/\\'/g } @fields;

    # Insert @fields into a database table
    my($sth) = $dbh->prepare("INSERT INTO maillog_mail (time, msg_id, size,
from_user, from_domain, subject, clientip, archives, isspam, ishighspam,
sascore, spamreport) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)");

$sth->execute($fields[0],$fields[1],$fields[2],$fields[3],$fields[4],$fields
[5],$fields[6],$fields[7],$fields[8],$fields[9],$fields[10],$fields[11]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);


  my($file, $text);
  while(($file, $text) = each %{$message->{allreports}}) {
    $file = "the entire message" if $file eq "";
    # Use the sanitised filename to avoid problems caused by people forcing
    # logging of attachment filenames which contain nasty SQL instructions.
    $file = $message->{file2safefile}{$file} or $file;
    $text =~ s/\n/ /;  # Make sure text report only contains 1 line
    $text =~ s/\t/ /; # and no tab characters

    my @fields = ($id, $file, $text);
    map { s/\'/\\'/g } @fields;

    my($sth) = $dbh->prepare("INSERT INTO maillog_report (msg_id, filename,
filereport) VALUES (?,?,?)");
    $sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);

  }

  for (@to) {
    # again, split the recipient's email into user and domain halves first.
    # see comment above about splitting the email like this.

    my ($to_user, $to_domain);
    ($to_user, $to_domain) = split /\@/, $_;
    my @fields = ($id, $to_user, $to_domain);
    map { s/\'/\\'/g } @fields;
    my($sth) = $dbh->prepare("INSERT INTO maillog_recipient (msg_id,
to_user, to_domain) VALUES (?,?,?)");
    $sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);
  }

  # Close database connection
  $dbh->disconnect();

}

  MailScanner::Log::InfoLog("Ending SQL Real-Time Logging");
}

1;



-rob

From sanjay.patel at REXWIRE.COM  Thu Jul 31 16:02:34 2003
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:19:07 2006
Subject: dcc
In-Reply-To: <00e201c3575b$e6b2bde0$5702010a@mscore.trusecure.net>
Message-ID: <011901c35774$c67efde0$6f01a8c0@Laptop1>

# spamassassin -D --lint output does show 
DCC is available: /usr/local/bin/dccproc 
But I do not see DCC in the spam headers. Does it just write it on spam
mails or all e-mails checked?

-SKP
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Chris-Bellsouth
Sent: Thursday, July 31, 2003 8:05 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: dcc


> >How can I verify that spamassassin is using dcc? When I do cdcc info I do
> >get a response but this is no guarantee that spamassassin is using dcc. I
> >call spamassassin through MailScanner
>
> Look for DCC in the Spam Header of messages that have gone through
> MailScanner, or do a test run of MailScanner with Debug and Debug
> SpamAssassin both set to yes, and look through the output.

You can also try:

# spamassassin -D --lint

and look for lines like this in the output:

<SNIP>
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: DCC: got response: X-DCC-dmv.com-Metrics:
mta01.prod.messagedefense.com 1181; Body=50212
</SNIP>


CT


From dwinkler at ALGORITHMICS.COM  Thu Jul 31 16:03:39 2003
From: dwinkler at ALGORITHMICS.COM (Derek Winkler)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <06EE2C86D3DAD5119A6C0060943F3C97055E70CF@tormail1.algorithmics.com>

I added a counter so it would write to DB after n emails and then remaining
when shutdown.

Seemed like a good compromise.

-----Original Message-----
From: Kearney, Rob [mailto:RKearney@AZERTY.COM]
Sent: Thursday, July 31, 2003 10:57 AM
To: MAILSCANNER@jiscmail.ac.uk
Subject: Re: SQL Redux


here is what we did for SQL logging, to bypass temp-file stuff.

Just took the SQLLogging and made SQLRTLogging, to write directly to DB, We
have not noticed any degradation in performance
Basically, we took the functions of SQLLogging and EndSQLLogging and put
them together.
(dont forget Init and End scripts also

---
sub SQLRTLogging {
  my($message) = @_;
  my($dbh);
  $dbh =
DBI->connect("DBI:mysql:mailscanner:localhost:mysql_socket=/var/database/mys
ql/mysql.sock",
                      "mailscanner", "mailscanner",
                      {'PrintError' => 0})
   or MailScanner::Log::DieLog("Cannot connect to the database: %s",
                                $DBI::errstr);

  my $id = $message->{id};
  my $size = $message->{size};
  my $from = $message->{from};
  my ($from_user, $from_domain);

  # split the from address into user and domain bits.
  # This may be unnecessary for you; we use it to more easily determine
  # inbound vs outbound email in a multi-domain environment.
  # HINT: refine queries using SQL 'join' with a table containing local
  # domains.

  ($from_user, $from_domain) = split /\@/, $from;

  my @to   = @{$message->{to}};
  my $subject = $message->{subject};
  my $clientip = $message->{clientip};
  my $archives = join(',', @{$message->{archiveplaces}});
  my $isspam = $message->{isspam};
  my $ishighspam = $message->{ishigh};
  my $sascore = $message->{sascore};
  my $spamreport = $message->{spamreport};

  # Get rid of control chars and tidy-up SpamAssassin report
  $spamreport =~ s/\n/ /g;
  $spamreport =~ s/\t//g;

  # Get timestamp, and format it so it is suitable to use with MySQL
  my($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
  my($timestamp) = sprintf("%d-%02d-%02d %02d:%02d:%02d",
                           $year+1900,$mon+1,$mday,$hour,$min,$sec);

# maillog_mail insert
    my @fields=($timestamp, $id, $size, $from_user, $from_domain,
                $subject, $clientip, $archives, $isspam, $ishighspam,
                $sascore, $spamreport);
    map { s/\'/\\'/g } @fields;

    # Insert @fields into a database table
    my($sth) = $dbh->prepare("INSERT INTO maillog_mail (time, msg_id, size,
from_user, from_domain, subject, clientip, archives, isspam, ishighspam,
sascore, spamreport) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)");

$sth->execute($fields[0],$fields[1],$fields[2],$fields[3],$fields[4],$fields
[5],$fields[6],$fields[7],$fields[8],$fields[9],$fields[10],$fields[11]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);


  my($file, $text);
  while(($file, $text) = each %{$message->{allreports}}) {
    $file = "the entire message" if $file eq "";
    # Use the sanitised filename to avoid problems caused by people forcing
    # logging of attachment filenames which contain nasty SQL instructions.
    $file = $message->{file2safefile}{$file} or $file;
    $text =~ s/\n/ /;  # Make sure text report only contains 1 line
    $text =~ s/\t/ /; # and no tab characters

    my @fields = ($id, $file, $text);
    map { s/\'/\\'/g } @fields;

    my($sth) = $dbh->prepare("INSERT INTO maillog_report (msg_id, filename,
filereport) VALUES (?,?,?)");
    $sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);

  }

  for (@to) {
    # again, split the recipient's email into user and domain halves first.
    # see comment above about splitting the email like this.

    my ($to_user, $to_domain);
    ($to_user, $to_domain) = split /\@/, $_;
    my @fields = ($id, $to_user, $to_domain);
    map { s/\'/\\'/g } @fields;
    my($sth) = $dbh->prepare("INSERT INTO maillog_recipient (msg_id,
to_user, to_domain) VALUES (?,?,?)");
    $sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);
  }

  # Close database connection
  $dbh->disconnect();

}

  MailScanner::Log::InfoLog("Ending SQL Real-Time Logging");
}

1;



-rob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030731/18dbab8d/attachment.html
From DHarding at GILATLA.COM  Thu Jul 31 15:58:18 2003
From: DHarding at GILATLA.COM (Devon Harding - GTHLA)
Date: Thu Jan 12 21:19:07 2006
Subject: spam.whitelist.rules
Message-ID: <97D0DDFA3C2F5B44AAC0960B99E96213C977E3@VMX.gilatla.com>

What is the correct format for spam.whitelist.rules for domain names and
email addresses?

_____________________
Devon Harding
System Administrator
Gilat Latin America
954-858-1600
dharding@gilatla.com

This e-mail is intended for the above named addressee(s), and may
contain information which is confidential or privileged. If you are not
the intended recipient, please inform us immediately: you should not
copy or use this e-mail for any purpose nor disclose its contents to any
person.


From steve.freegard at LBSLTD.CO.UK  Thu Jul 31 16:10:54 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:19:07 2006
Subject: MailWatch.pm (was RE: SQL Redux)
Message-ID: <67D9E7698329D411936E00508B6590B902773A50@neelix.lbsltd.co.uk>

Thanks Julian,

I'll sort this out for the next version.

As an aside - I'm concerned that MailWatch has been taking up a fair bit of
bandwidth on the MailScanner list at times and don't want to get on anyones
nerves with off-topic posts, so I'll be setting it up as a project on
Sourceforge at the weekend and I'll create the necessary mailing-lists to
move the traffic there.

Cheers,
Steve.

-----Original Message-----
From: Julian Field
To: Steve Freegard
Cc: mailscanner@jiscmail.ac.uk
Sent: 31/07/03 15:45
Subject: RE: SQL Redux

At 15:43 31/07/2003, you wrote:
>Hi Julian,
>
>Thanks very much for this.
>
>I'm 99.9% sure that I kept the code below - the only changes I made to
your
>original code was to log directly to MySQL bypassing the temporary
files.
>
>I'm presuming that the NULL mapping code was added recently (which is
why I
>don't have it in my patches)??

Yes, I added it this morning.

>Do you think it would be easier as there are now two branches of this
code
>for me to distribute a MailWatch.pm instead of patches to
CustomConfig.pm
>and call the MailWatch logging routine something different (something
like
>&MailWatchSQLLogging) - then all that would need to be done is to
include
>the MailWatch.pm from CustomConfig.pm.
>
>That would save on the confusion between the two versions at least -
does
>this sound like a good idea??

This sounds like a great idea. Having 2 branches of the code is a
nightmare
to maintain. This way all your bugs remain yours, and all mine remain
mine :-)
That way you can just distribute your extra file and give a very simple
modification that people need to make to CustomConfig.pm when installing

MailWatch, e.g.
         require MailWatch.pm;


>-----Original Message-----
>From: Julian Field
>To: MAILSCANNER@JISCMAIL.AC.UK
>Sent: 31/07/03 11:47
>Subject: Re: SQL Redux
>
>You also need to make sure he does the
>          @fields = map { s/\'/\\'/g } @fields;
>line as otherwise people could inject SQL code using malicious email
>addresses.
>
>At 11:42 31/07/2003, you wrote:
> >aha
> >
> >I think the
> >
> >@fields = map { ($_ eq '')?'NULL':"$_" } @fields;
> >
> >bit is missing from Steve's patch. I'll try and plop a line or two in
>to
> >check the potential NULL's and mark the value correctly..
> >
> >--
> >Martin
> >
> >Julian Field wrote:
> >
> >>At 11:04 31/07/2003, you wrote:
> >>
> >>>Chris Trudeau wrote:
> >>>
> >>>>>this is exactly the problem I'm seeing with 4.22.5 on FreeBSD.
> >>>>
> >>>>
> >>>>
> >>>>CT:  OK, there seems to be a common thread...I haven't expanded
test
>to
> >>>>anything other than 4.22-5 or 4.22.1, but the older version I have
> >>>>working
> >>>>beatifully, so either the logging function in 4.22-1 doesn't have
>the
> >>>>NULL
> >>>>value problem or its addressed differently.  Perhaps I will try
> >>>>installing
> >>>>4.22-1 or a between version to try and pinpoint where it breaks!
> >>>
> >>>Chris
> >>>
> >>>looking at the 4.22.1 code there's quite a big change on the whole
>SQL
> >>>logging setup. Infact the code is radically different.
> >>>
> >>>in 4.22.1 it reads the logfile to get the info required. Slow...
> >>>
> >>>in 4.22.5 it's using the values from the currently processed email
to
> >>>drive the insert. It's a lot faster, but seems not to translate
NULLs
> >>>etc very well.
> >>
> >>
> >>This goes in CustomConfig.pm around line 373.
> >>It goes in just before the "prepare" statement that inserts @fields
>into
> >>the database table.
> >>Note the additional bugfix when replacing ' with \'
> >>
> >>   while(<$logfile1>) {
> >>     chomp;
> >>     @fields = split(/\t/);
> >>     # Work through each field protecting any special characters
such
>as '
> >>     # The line below replaces ' with \'
> >>     @fields = map { s/\'/\\'/g } @fields;
> >>
> >>     # Set any empty strings to NULL so the SQL insert works
correctly
> >>     @fields = map { ($_ eq '')?'NULL':"$_" } @fields;
> >>
> >>
> >>--
> >>Julian Field
> >>www.MailScanner.info
> >>MailScanner thanks transtec Computers for their support
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>
>--
>This email and any files transmitted with it are confidential and
>intended solely for the use of the individual or entity to whom they
>are addressed. If you have received this email in error please notify
>the sender and delete the message from your mailbox.
>
>This footnote also confirms that this email message has been swept by
>MailScanner (www.mailscanner.info) for the presence of computer
viruses.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From zabriskw at ITECH.NET  Thu Jul 31 16:11:51 2003
From: zabriskw at ITECH.NET (Kris Zabriskie)
Date: Thu Jan 12 21:19:07 2006
Subject: spam.whitelist.rules
References: <97D0DDFA3C2F5B44AAC0960B99E96213C977E3@VMX.gilatla.com>
Message-ID: <001001c35776$1206aa50$0c02a8c0@itech.dom>

To: | From: | FromTo:     *@domain-name.com | user@domainname.com        Yes
| No

My poor attempt at BNF


----- Original Message -----
From: "Devon Harding - GTHLA" <DHarding@GILATLA.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 31, 2003 10:58 AM
Subject: spam.whitelist.rules


> What is the correct format for spam.whitelist.rules for domain names and
> email addresses?
>
> _____________________
> Devon Harding
> System Administrator
> Gilat Latin America
> 954-858-1600
> dharding@gilatla.com
>
> This e-mail is intended for the above named addressee(s), and may
> contain information which is confidential or privileged. If you are not
> the intended recipient, please inform us immediately: you should not
> copy or use this e-mail for any purpose nor disclose its contents to any
> person.
>
>

From steve.freegard at LBSLTD.CO.UK  Thu Jul 31 16:19:16 2003
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <67D9E7698329D411936E00508B6590B902773A51@neelix.lbsltd.co.uk>

Hi Rob,

I'm not really much good with Perl (maybe Julian can back me up on this) -
but my understanding is that in calling your SQLRTLogging procedure without
the Init & End procedures will mean that the
connection/disconnection/prepare and execution of the SQL will happen for
every message batch processed by MailScanner which would slow things up
quite considerably depending on the volume of messages you processes.

The most expensive processes are connecting and preparing the statement, so
it's better only to do this once (per child), then running the prepared
statements once per message batch.

A better way is to have:

InitSQLRTLogging:  (this is done once per MailScanner child)
 - Connect to the database
 - Prepare each SQL statement required

SQLRTLogging: (done once for each message batch)
 - Tidy-up the data to make it suitable for SQL
 - Execute the prepared statements

EndSQLRTLogging: (done once as each child dies)
 - Disconnect from the database

Cheers,
Steve.

-----Original Message-----
From: Kearney, Rob
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: 31/07/03 15:56
Subject: Re: SQL Redux

here is what we did for SQL logging, to bypass temp-file stuff.

Just took the SQLLogging and made SQLRTLogging, to write directly to DB,
We
have not noticed any degradation in performance
Basically, we took the functions of SQLLogging and EndSQLLogging and put
them together.
(dont forget Init and End scripts also

---
sub SQLRTLogging {
  my($message) = @_;
  my($dbh);
  $dbh =
DBI->connect("DBI:mysql:mailscanner:localhost:mysql_socket=/var/database
/mys
ql/mysql.sock",
                      "mailscanner", "mailscanner",
                      {'PrintError' => 0})
   or MailScanner::Log::DieLog("Cannot connect to the database: %s",
                                $DBI::errstr);

  my $id = $message->{id};
  my $size = $message->{size};
  my $from = $message->{from};
  my ($from_user, $from_domain);

  # split the from address into user and domain bits.
  # This may be unnecessary for you; we use it to more easily determine
  # inbound vs outbound email in a multi-domain environment.
  # HINT: refine queries using SQL 'join' with a table containing local
  # domains.

  ($from_user, $from_domain) = split /\@/, $from;

  my @to   = @{$message->{to}};
  my $subject = $message->{subject};
  my $clientip = $message->{clientip};
  my $archives = join(',', @{$message->{archiveplaces}});
  my $isspam = $message->{isspam};
  my $ishighspam = $message->{ishigh};
  my $sascore = $message->{sascore};
  my $spamreport = $message->{spamreport};

  # Get rid of control chars and tidy-up SpamAssassin report
  $spamreport =~ s/\n/ /g;
  $spamreport =~ s/\t//g;

  # Get timestamp, and format it so it is suitable to use with MySQL
  my($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
  my($timestamp) = sprintf("%d-%02d-%02d %02d:%02d:%02d",
                           $year+1900,$mon+1,$mday,$hour,$min,$sec);

# maillog_mail insert
    my @fields=($timestamp, $id, $size, $from_user, $from_domain,
                $subject, $clientip, $archives, $isspam, $ishighspam,
                $sascore, $spamreport);
    map { s/\'/\\'/g } @fields;

    # Insert @fields into a database table
    my($sth) = $dbh->prepare("INSERT INTO maillog_mail (time, msg_id,
size,
from_user, from_domain, subject, clientip, archives, isspam, ishighspam,
sascore, spamreport) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)");

$sth->execute($fields[0],$fields[1],$fields[2],$fields[3],$fields[4],$fi
elds
[5],$fields[6],$fields[7],$fields[8],$fields[9],$fields[10],$fields[11])
or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);


  my($file, $text);
  while(($file, $text) = each %{$message->{allreports}}) {
    $file = "the entire message" if $file eq "";
    # Use the sanitised filename to avoid problems caused by people
forcing
    # logging of attachment filenames which contain nasty SQL
instructions.
    $file = $message->{file2safefile}{$file} or $file;
    $text =~ s/\n/ /;  # Make sure text report only contains 1 line
    $text =~ s/\t/ /; # and no tab characters

    my @fields = ($id, $file, $text);
    map { s/\'/\\'/g } @fields;

    my($sth) = $dbh->prepare("INSERT INTO maillog_report (msg_id,
filename,
filereport) VALUES (?,?,?)");
    $sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);

  }

  for (@to) {
    # again, split the recipient's email into user and domain halves
first.
    # see comment above about splitting the email like this.

    my ($to_user, $to_domain);
    ($to_user, $to_domain) = split /\@/, $_;
    my @fields = ($id, $to_user, $to_domain);
    map { s/\'/\\'/g } @fields;
    my($sth) = $dbh->prepare("INSERT INTO maillog_recipient (msg_id,
to_user, to_domain) VALUES (?,?,?)");
    $sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);
  }

  # Close database connection
  $dbh->disconnect();

}

  MailScanner::Log::InfoLog("Ending SQL Real-Time Logging");
}

1;



-rob

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From ctrudeau at BELLSOUTH.NET  Thu Jul 31 16:05:55 2003
From: ctrudeau at BELLSOUTH.NET (Chris-Bellsouth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <01c801c35775$3e09ddd0$5702010a@mscore.trusecure.net>

NEVERMIND...

found doc and sql in the docs dir...

Everything works beautifully now...

had an issue with the "binary" entries in the sql, so I removed them and all
is well...

NOW...it appears that writes to the database are ONLY executed when child
dies, anyway to "flow" these events into the database?

CT

----- Original Message -----
From: "Chris-Bellsouth" <ctrudeau@bellsouth.net>
To: "MailScanner mailing list" <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 31, 2003 10:27 AM
Subject: Re: SQL Redux


> OK...maybe I'm missing something LARGE!....
>
> but it appears like the database schema I built as a result of the
> create.sql that I obtained with the mailwatch package from Steve creates
the
> following table: (just an example)
>
> CREATE TABLE maillog (
>   timestamp timestamp(14) NOT NULL,
>   id text,
>   size bigint(20) default '0',
>   from_address text,
>   to_address text,
>   subject text,
>   clientip text,
>   archive text,
>   isspam tinyint(1) default '0',
>   ishighspam tinyint(1) default '0',
>   issaspam tinyint(1) default '0',
>   isrblspam tinyint(1) default '0',
>   spamwhitelisted tinyint(1) default '0',
>   sascore decimal(7,2) default '0.00',
>   spamreport text,
>   virusinfected tinyint(1) default '0',
>   nameinfected tinyint(1) default '0',
>   otherinfected tinyint(1) default '0',
>   report text,
>   hostname text
>
>
> But the INSERT code in the current 4.22-5 CustomConfig.pm:
>
> my($sth) = $dbh->prepare("INSERT INTO maillog_mail (time, msg_id, size,
> from_user, from_domain, subject, clientip, archives, isspam, ishighspam,
> sascore, spamreport) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)");
>
> my($sth) = $dbh->prepare("INSERT INTO maillog_report (msg_id, filename,
> filereport) VALUES (?,?,?)");
> $sth->execute($fields[0],$fields[1],$fields[2]) or
> MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);
>
> not only do the maillog_mail and maillog_report tables not exist, the
schema
> that CustomConfig is attempting to insert data into doesn;t appear to be
> formatted approrpriately for the inserts..
>
> Not sure I see any references to sql builds anywhere in
> documentation/site/FAQ...so I'm stumped...
>
> Now it is likely that I'm missing something obvious...so please guide me
to
> the light  :)
>
> CT
>
>

From ctrudeau at BELLSOUTH.NET  Thu Jul 31 16:24:43 2003
From: ctrudeau at BELLSOUTH.NET (Chris-Bellsouth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
References: <67D9E7698329D411936E00508B6590B902773A4F@neelix.lbsltd.co.uk>
Message-ID: <01fc01c35777$deddd2f0$5702010a@mscore.trusecure.net>

> You need to patch CustomConfig.pm using the diffs included with MailWatch
as
> per the INSTALL doc.

Yeah i tried that and the patch with the CustomConfig.diff barfed on a
couple of chunks.  In analyzing the diff, appears as if version of the diff
included in mailwatch is "before" the version of CustiomConfig.pm enclosed
with 4.22-5:

<SNIP FROM MAILWATCH DIFF>
5c5
< #   $Id: CustomConfig.pm,v 1.3.2.7 2003/05/31 12:08:51 jkf Exp $
---
> #   $Id: CustomConfig.pm,v 1.3.2.5 2003/03/26 22:38:28 jkf Exp $
</SNIP>

and here is the CustomConfig.pm lines from the general distribution:

<SNIP FROM 4.22-5 DIST>

#   $Id: CustomConfig.pm,v 1.3.2.8 2003/06/26 16:54:19 jkf Exp $

</SNIP>

In analyzing the rest of the diff file I noticed that much of the code
changed to include the same code you use in the mailwatch distribution.
hence the sequence of version numbers:  Many of the line numbered
assignments in the diff file were significantly so the patch failed.

In addition, it appears that the diff included in the mailwatch distribution
includes INSERT statements pursuant to my last post:

<SNIP FROM MAILWATCH DIFF FILE>
<     # Insert @fields into a database table
<     my($sth) = $dbh->prepare("INSERT INTO maillog_mail (time, msg_id,
size, from_user, from_domain, subject, clientip, archives, isspam,
ishighspam, sascore, spamreport) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)");
<
$sth->execute($fields[0],$fields[1],$fields[2],$fields[3],$fields[4],$fields
[5],$fields[6],$fields[7],$fields[8],$fields[9],$fields[10],$fields[11]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);
<   }
</SNIP>

where it appears that mailwatch patch code is trying to insert into a table
called "maillog_mail" which doesn't exist in the "create.sql" distributed
with the mailwatch (or seperately in my case) code.

I was able to get it working, but I'm not sure that the mailwatch front end
will be able to call appropriate values from the db (since I changed the
query pursuant to the documentation in the 4.22-5 distribution) but I'll
worry about that later.

CT

From ctrudeau at BELLSOUTH.NET  Thu Jul 31 16:26:18 2003
From: ctrudeau at BELLSOUTH.NET (Chris-Bellsouth)
Date: Thu Jan 12 21:19:07 2006
Subject: dcc
References: <011901c35774$c67efde0$6f01a8c0@Laptop1>
Message-ID: <020501c35778$16f43120$5702010a@mscore.trusecure.net>

Hey Sanjay,

DCC in my experience ONLY shows up in headers as part of a detailed
SpamAssassin report...it doesn;t get processed seperately from within
MailScanner from what I can tell, thus it wouldn't have a dedicated header
line.

I could be wrong...

CT


----- Original Message -----
From: "Sanjay K. Patel" <sanjay.patel@REXWIRE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, July 31, 2003 11:02 AM
Subject: Re: dcc


# spamassassin -D --lint output does show
DCC is available: /usr/local/bin/dccproc
But I do not see DCC in the spam headers. Does it just write it on spam
mails or all e-mails checked?

-SKP
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Chris-Bellsouth
Sent: Thursday, July 31, 2003 8:05 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: dcc


> >How can I verify that spamassassin is using dcc? When I do cdcc info I do
> >get a response but this is no guarantee that spamassassin is using dcc. I
> >call spamassassin through MailScanner
>
> Look for DCC in the Spam Header of messages that have gone through
> MailScanner, or do a test run of MailScanner with Debug and Debug
> SpamAssassin both set to yes, and look through the output.

You can also try:

# spamassassin -D --lint

and look for lines like this in the output:

<SNIP>
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: DCC: got response: X-DCC-dmv.com-Metrics:
mta01.prod.messagedefense.com 1181; Body=50212
</SNIP>


CT

From ryanw at FALSEHOPE.COM  Thu Jul 31 17:25:51 2003
From: ryanw at FALSEHOPE.COM (Ryan Weaver)
Date: Thu Jan 12 21:19:07 2006
Subject: Allow Form Tags ??
Message-ID: <LISTSERV%2003073117255190@JISCMAIL.AC.UK>

On Fri, 4 Jul 2003 11:00:27 +0100, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>At 10:33 04/07/2003, you wrote:
>>Since the upgrade to the latest version of MailScanner I seem to be
>>getting some legitimate messages from customers that use HTML Form Tags
>>which are now being blocked.
>>
>>Rather than opening up everything to these form tags wouldn't it be
>>possible to convert the form tags to a 'normal' html message
>>thereby 'cleaning' the message of any unwanted crap?
>
>Allow the Form tags but set "Strip Dangerous HTML".

Does this just strip the <form> tags or strip tags from the entire html?

If the later, is it possible to strip 'just' the form tag leaving the rest
of the HTML intact?

Also, is it possible to allow forms but attach a warning to the email
warning the end user of the dangers of forms in emails?

From RKearney at AZERTY.COM  Thu Jul 31 16:46:30 2003
From: RKearney at AZERTY.COM (Kearney, Rob)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
Message-ID: <210DF55DED65B547896F728FB057F3B2019C4516@seaver.ussco.com>

oh.. and yes..

thanks for the code tippets.. I'll have to change this. as I'm not good with
perl  either.

-rob

-----Original Message-----
From: Steve Freegard [mailto:steve.freegard@lbsltd.co.uk]
Sent: Thursday, July 31, 2003 11:19 AM
To: 'Kearney, Rob '; 'MAILSCANNER@JISCMAIL.AC.UK '
Subject: RE: SQL Redux


Hi Rob,

I'm not really much good with Perl (maybe Julian can back me up on this) -
but my understanding is that in calling your SQLRTLogging procedure without
the Init & End procedures will mean that the
connection/disconnection/prepare and execution of the SQL will happen for
every message batch processed by MailScanner which would slow things up
quite considerably depending on the volume of messages you processes.

The most expensive processes are connecting and preparing the statement, so
it's better only to do this once (per child), then running the prepared
statements once per message batch.

A better way is to have:

InitSQLRTLogging:  (this is done once per MailScanner child)
 - Connect to the database
 - Prepare each SQL statement required

SQLRTLogging: (done once for each message batch)
 - Tidy-up the data to make it suitable for SQL
 - Execute the prepared statements

EndSQLRTLogging: (done once as each child dies)
 - Disconnect from the database

Cheers,
Steve.

-----Original Message-----
From: Kearney, Rob
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: 31/07/03 15:56
Subject: Re: SQL Redux

here is what we did for SQL logging, to bypass temp-file stuff.

Just took the SQLLogging and made SQLRTLogging, to write directly to DB,
We
have not noticed any degradation in performance
Basically, we took the functions of SQLLogging and EndSQLLogging and put
them together.
(dont forget Init and End scripts also

---
sub SQLRTLogging {
  my($message) = @_;
  my($dbh);
  $dbh =
DBI->connect("DBI:mysql:mailscanner:localhost:mysql_socket=/var/database
/mys
ql/mysql.sock",
                      "mailscanner", "mailscanner",
                      {'PrintError' => 0})
   or MailScanner::Log::DieLog("Cannot connect to the database: %s",
                                $DBI::errstr);

  my $id = $message->{id};
  my $size = $message->{size};
  my $from = $message->{from};
  my ($from_user, $from_domain);

  # split the from address into user and domain bits.
  # This may be unnecessary for you; we use it to more easily determine
  # inbound vs outbound email in a multi-domain environment.
  # HINT: refine queries using SQL 'join' with a table containing local
  # domains.

  ($from_user, $from_domain) = split /\@/, $from;

  my @to   = @{$message->{to}};
  my $subject = $message->{subject};
  my $clientip = $message->{clientip};
  my $archives = join(',', @{$message->{archiveplaces}});
  my $isspam = $message->{isspam};
  my $ishighspam = $message->{ishigh};
  my $sascore = $message->{sascore};
  my $spamreport = $message->{spamreport};

  # Get rid of control chars and tidy-up SpamAssassin report
  $spamreport =~ s/\n/ /g;
  $spamreport =~ s/\t//g;

  # Get timestamp, and format it so it is suitable to use with MySQL
  my($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
  my($timestamp) = sprintf("%d-%02d-%02d %02d:%02d:%02d",
                           $year+1900,$mon+1,$mday,$hour,$min,$sec);

# maillog_mail insert
    my @fields=($timestamp, $id, $size, $from_user, $from_domain,
                $subject, $clientip, $archives, $isspam, $ishighspam,
                $sascore, $spamreport);
    map { s/\'/\\'/g } @fields;

    # Insert @fields into a database table
    my($sth) = $dbh->prepare("INSERT INTO maillog_mail (time, msg_id,
size,
from_user, from_domain, subject, clientip, archives, isspam, ishighspam,
sascore, spamreport) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)");

$sth->execute($fields[0],$fields[1],$fields[2],$fields[3],$fields[4],$fi
elds
[5],$fields[6],$fields[7],$fields[8],$fields[9],$fields[10],$fields[11])
or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);


  my($file, $text);
  while(($file, $text) = each %{$message->{allreports}}) {
    $file = "the entire message" if $file eq "";
    # Use the sanitised filename to avoid problems caused by people
forcing
    # logging of attachment filenames which contain nasty SQL
instructions.
    $file = $message->{file2safefile}{$file} or $file;
    $text =~ s/\n/ /;  # Make sure text report only contains 1 line
    $text =~ s/\t/ /; # and no tab characters

    my @fields = ($id, $file, $text);
    map { s/\'/\\'/g } @fields;

    my($sth) = $dbh->prepare("INSERT INTO maillog_report (msg_id,
filename,
filereport) VALUES (?,?,?)");
    $sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);

  }

  for (@to) {
    # again, split the recipient's email into user and domain halves
first.
    # see comment above about splitting the email like this.

    my ($to_user, $to_domain);
    ($to_user, $to_domain) = split /\@/, $_;
    my @fields = ($id, $to_user, $to_domain);
    map { s/\'/\\'/g } @fields;
    my($sth) = $dbh->prepare("INSERT INTO maillog_recipient (msg_id,
to_user, to_domain) VALUES (?,?,?)");
    $sth->execute($fields[0],$fields[1],$fields[2]) or
MailScanner::Log::DieLog("Cannot insert row: %s", $DBI::errstr);
  }

  # Close database connection
  $dbh->disconnect();

}

  MailScanner::Log::InfoLog("Ending SQL Real-Time Logging");
}

1;



-rob

--
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender and delete the message from your mailbox.

This footnote also confirms that this email message has been swept by
MailScanner (www.mailscanner.info) for the presence of computer viruses.

From mailscanner at ELKNET.NET  Thu Jul 31 17:53:53 2003
From: mailscanner at ELKNET.NET (Alan Fiebig)
Date: Thu Jan 12 21:19:07 2006
Subject: spam.whitelist.rules
Message-ID: <200307311549.h6VFnWs24506@custmail0.corp.aus.wayport.net>

As I understand the spam whitelist rules, I can whitelist a given sender, or a given recepient.

Is there a means to whitelist a given sender/recepient pair?

I have a number of customers who request to receive emailings from a given company. But not everyone wants the 'mail' being sent by this company.

If I whitelist the sender, then all my customers are open to their 'junk mail' messages.
If I whitelist the customer who wants this company's mail, then they get all spam and no filtering.

What I need is the ability to create a rule that says mail from THIS sender to THIS recepient is whitelisted.

Can this be done now?
Could it be done?

Thanks,
-Alan

From lbergman at wtxs.net  Thu Jul 31 18:52:24 2003
From: lbergman at wtxs.net (Lewis Bergman)
Date: Thu Jan 12 21:19:07 2006
Subject: spam.whitelist.rules
In-Reply-To: <001001c35776$1206aa50$0c02a8c0@itech.dom>
References: <97D0DDFA3C2F5B44AAC0960B99E96213C977E3@VMX.gilatla.com>
            <001001c35776$1206aa50$0c02a8c0@itech.dom>
Message-ID: <200307311252.28509.lbergman@wtxs.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday 31 July 2003 10:11 am, Kris Zabriskie wrote:
> To: | From: | FromTo:     *@domain-name.com | user@domainname.com
Don't forget
FromorTo:
- --
Lewis Bergman
Texas Communications
4309 Maple St.
Abilene, TX 79602-8044
915-695-6962 ext 115
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE/KVdcpT00mQjG01gRAnHSAJ0dAdY3IW3FmiIAFrHIVTiKmy3KLgCeIshX
iGhzOkFBnzM6SjK3Qc8VcHA=
=S1Rl
-----END PGP SIGNATURE-----

From dot at DOTAT.AT  Thu Jul 31 19:55:01 2003
From: dot at DOTAT.AT (Tony Finch)
Date: Thu Jan 12 21:19:07 2006
Subject: new mcafee-autoupdate
Message-ID: <20030731185501.GT20675@chiark.greenend.org.uk>

I've added a couple of features to the McAfee dat file update script.
It now puts the datfiles in a subdirectory of the uvscan install
directory, so that a non-privileged user can be given write access to the
subdirectory, i.e. you don't have to be root to do datfile updates. I've
also added a -d delete old files option, which someone asked for on this
list recently. Enjoy.

Tony.
--
f.a.n.finch  <dot@dotat.at>  http://dotat.at/
NORTH FITZROY: SOUTHWEST VEERING NORTHWEST 4 OR 5, BECOMING VARIABLE 3.
DRIZZLE AT FIRST. MODERATE BECOMING GOOD.
-------------- next part --------------
#!/bin/sh -e
#
# Update the McAfee data files.
#
# $Cambridge: hermes/build/bin/uvscan-update,v 1.27 2003/07/31 18:45:02 fanf2 Exp $

# $PREFIX is the directory where the uvscan binary is (NOT a symlink to
# the binary), which is where it looks for its dat files. You may run
# uvscan via a symlink to this place (e.g. from /usr/local/bin/uvscan)
# and it will still look for the dat files here. If uvscan's library
# dependencies can be found in a standard place (e.g. /usr/local/lib)
# then you don't need a wrapper script to set LD_LIBRARY_PATH before
# running it.
#
# The dat files are installed in a subdirectory of $DATDIR named
# according to their version number, with symlinks from $PREFIX into
# the subdirectory via a current link. The current link is updated
# without locking on the assumption that this is sufficiently unlikely
# to cause a problem.
#
PREFIX=/usr/local/uvscan
DATDIR=$PREFIX/datfiles
SUBDIR=datfiles/current
LINK=$PREFIX/$SUBDIR

FTPDIR=ftp://ftpeur.nai.com/pub/antivirus/datfiles/4.x

# ensure the path is plausible
PATH=$PREFIX:/usr/local/bin:/usr/bin:/bin
export PATH

# handle the command line
OPTS="$*"
option () {
        case $OPTS in
        -*$1*)  eval $2=yes
        esac
}
case $OPTS in
[!-]*|*[!-dfrtv]*)
        echo "usage: $0 [-dfrtv]"
        echo "  -d      delete old files"
        echo "  -f      force update"
        echo "  -r      show README"
        echo "  -t      timestamp output"
        echo "  -v      verbose"
        exit 1
        ;;
esac
option d DELETE
option f FORCE
option r README
option t TIME
option v VERBOSE
case $FORCE in
yes)    VERBOSE=yes
esac

# wrapper functions for echo etc.
timestamp () {
        case $TIME in
        yes)    date "+%Y-%m-%d %H:%M:%S "
        esac
}
say () {
        case $VERBOSE in
        yes)    echo "`timestamp`$*"
        esac
}
run () {
        say "> $*"
        "$@"
}
say Starting $0

if [ ! -L $LINK ]
then
        INIT=yes
        VERBOSE=yes
        say Initial setup of $0
        run mkdir -p $DATDIR
fi
run cd $DATDIR

# version number pattern
MATCH="[0-9][0-9][0-9][0-9]"

# work out latest dat version
CMD="wget --passive-ftp $FTPDIR/update.ini 2>update.err"
say "> $CMD"
if eval "$CMD"
then
        VERSION=`cat update.ini | sed "/^DATVersion=\($MATCH\).$/!d;s//\1/;q"`
else
        cat update.err
        VERSION=UNKNOWN
fi
run rm -f update.*

badversion () {
        VERBOSE=yes
        say "Failed to get McAfee datfile update from $FTPDIR"
        say "FTP version number \"$VERSION\" $*"
        run exit 1
}

# check the format of the version number
case $VERSION in
$MATCH) : ok
        ;;
*)      badversion does not match "$MATCH"
        ;;
esac

# already got it?
if [ -d $VERSION ]
then
        case $FORCE in
        yes)    say Forced removal of $VERSION
                run rm -rf $VERSION
                ;;
        *)      say Already have $VERSION
                run exit 0
                ;;
        esac
fi

# work out installed dat version
PREVIOUS=`(ls -d $MATCH 2>/dev/null || echo 0000) | tail -1`

# check new version is actually newer
if [ $PREVIOUS -gt $VERSION ]
then
        badversion older than installed $PREVIOUS
fi

VERBOSE=yes

say Installed dat file is $PREVIOUS
say Latest dat file is $VERSION

# fetch and extract dat files
TARFILE=dat-$VERSION.tar
run mkdir $VERSION
run cd $VERSION
run wget --passive-ftp --progress=dot:mega $FTPDIR/$TARFILE
run tar xvf $TARFILE

# verify the contents
fail () {
        trap EXIT
        echo "$OUT"
        say Test run failed -- removing bad McAfee data files
        run cd $DATDIR
        run rm -rf $VERSION
        run exit 1
}
trap fail EXIT
CMD="uvscan --version --dat ."
say "> $CMD"
OUT=`$CMD 2>&1`
case "$OUT" in
*"Missing or invalid DAT"* | \
*"Data file not found"* | \
*"Removal datafile clean.dat not found"* | \
*"Unable to remove viruses"* )
        fail
esac
trap EXIT

echo "$OUT"
say Update OK

# show information on this update?
case $README in
yes)    run sed 's/[[:cntrl:]]//g
                1,/^NEW VIRUSES DETECTED/d
                /^UNDERSTANDING VIRUS NAMES/,$d
                s/^/# /' readme.txt
esac
# remove some crap
run rm -f *.diz *.exe *.ini *.lst *.tar *.txt

# do remaining part of initial setup
case $INIT in
yes)    for file in *.dat
        do
                run rm -f $PREFIX/$file
                run ln -s $SUBDIR/$file $PREFIX/$file
        done
esac

# update the current version link
run rm -f $LINK
run ln -s $VERSION $LINK

# maybe delete old dat files
case $DELETE in
yes)    run cd $DATDIR
        run rm -rf $PREVIOUS
esac

say Completed OK
run exit 0

# done
From ctrudeau at BELLSOUTH.NET  Thu Jul 31 21:41:36 2003
From: ctrudeau at BELLSOUTH.NET (Chris-Bellsouth)
Date: Thu Jan 12 21:19:07 2006
Subject: SQL Redux
References: <5.2.0.9.2.20030731154315.04211df0@imap.ecs.soton.ac.uk>
Message-ID: <02d201c357a4$2392eb70$5702010a@mscore.trusecure.net>

I was able to get the batched SQL inserts to work finally.

only problem is that now the maillog_recipient table is having duplicate
entries processed per message.  has anyone seen this before?


mysql> select * from maillog_recipient;

+----+------------+---------+-------------+
| id | msg_id     | to_user | to_domain   |
+----+------------+---------+-------------+
|  1 | 420DD1C00E | chris   | trudeau.org |
|  2 | 420DD1C00E | chris   | trudeau.org |
|  3 | D4D6C1C00E | chris   | trudeau.org |
|  4 | D4D6C1C00E | chris   | trudeau.org |
|  5 | 671581C00D | chris   | trudeau.org |
|  6 | 671581C00D | chris   | trudeau.org |
+----+------------+---------+-------------+

Not sure why this could be happening...any pointers is helpful

CT

From denis at CROOMBS.ORG  Thu Jul 31 21:57:19 2003
From: denis at CROOMBS.ORG (Denis Croombs)
Date: Thu Jan 12 21:19:07 2006
Subject: Spamassassin not working except when called manually. Perl problem ?
Message-ID: <00cc01c357a6$5524f960$85b8fea9@Laptop>

I have been asked to look at a RedHat 7.3 Mail server for someone that is
using Mailscanner 4.22-5, Spamassassin 2.55, with DCC & the Bayers is loaded
with over 4000 spams, but the only entry in the processed mail header is
normally that the mail has been blacklisted or
like:-X-MailScanner-SpamCheck: not spam, SpamAssassin (score=0, required
5.0,  USER_AGENT_PINE)
If I run the spamassassin -D <input_file it does a DCC & bayers check &
gives the mail a score of over 14 !
I have also done a spamassassin -D -lint and double checked that both the
DCC & bayers are listed OK.
The only thing I can find that is wrong is that there are 2 copies of perl
installed,
1)    in /usr/lib/perl5/5.6.0/
2)    in /usr/local/lib/perl6/5.8.0/

The spamassassin appears to be installed into the second one.
I believe I need to get rid of the second copy of perl but do not know how
to do that.

I have 2 questions,
1)    Am I correct in believing the problem relates to the 2 copies of perl
?
2)    How do I remove the second copy of perl ?

Thanks

Denis

From mike at CAMAROSS.NET  Thu Jul 31 22:11:30 2003
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:19:07 2006
Subject: Spamassassin not working except when called manually. Perl problem ?
In-Reply-To: <00cc01c357a6$5524f960$85b8fea9@Laptop>
Message-ID: <009201c357a8$50b669c0$9c01a8c0@home.middlefinger.net>

I'd do:

rpm -qa |grep perl

And then remove the perl version you don't want.  Be careful though...you
may break something if it is pointed to /usr/bin/perl and that perl gets
uninstalled.

Mike

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Denis Croombs
Sent: Thursday, July 31, 2003 3:57 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Spamassassin not working except when called manually. Perl problem
?


I have been asked to look at a RedHat 7.3 Mail server for someone that is
using Mailscanner 4.22-5, Spamassassin 2.55, with DCC & the Bayers is loaded
with over 4000 spams, but the only entry in the processed mail header is
normally that the mail has been blacklisted or
like:-X-MailScanner-SpamCheck: not spam, SpamAssassin (score=0, required
5.0,  USER_AGENT_PINE) If I run the spamassassin -D <input_file it does a
DCC & bayers check & gives the mail a score of over 14 ! I have also done a
spamassassin -D -lint and double checked that both the DCC & bayers are
listed OK. The only thing I can find that is wrong is that there are 2
copies of perl installed,
1)    in /usr/lib/perl5/5.6.0/
2)    in /usr/local/lib/perl6/5.8.0/

The spamassassin appears to be installed into the second one.
I believe I need to get rid of the second copy of perl but do not know how
to do that.

I have 2 questions,
1)    Am I correct in believing the problem relates to the 2 copies of perl
?
2)    How do I remove the second copy of perl ?

Thanks

Denis


From kyle at TEKHEAD.BIZ  Thu Jul 31 20:53:01 2003
From: kyle at TEKHEAD.BIZ (Kyle Pinkley)
Date: Thu Jan 12 21:19:08 2006
Subject: Allow File Extension/E-Mail Address
Message-ID: <001601c3579d$5a91ea60$c901a8c0@sasha>

Hello,

I just installed Mailscanner yesterday.  In my
/usr/mailscanner/etc/filenamerules.conf file I need for it to allow the
two extensions:

.map
.atr

I have added the two lines towards the top of the file:

allow   \.map$                  -       -
allow   \.atr$                  -       -

However, when I kill all the PID's for Mailscanner and run
/usr/mailscanner/bin/check_mailscanner to restart, I'm still getting it
filtered (see bellow).   Any help you can give would be appreciated!

Jul 31 00:16:33 srv01 MailScanner[7674]: Filetype Checks: No executables
(FritoLay.atr)
Jul 31 00:16:33 srv01 MailScanner[7674]: Filetype Checks: No executables
(FritoLay.atr)
Jul 31 00:16:33 srv01 MailScanner[7674]: Saved infected "FritoLay.atr"
to /var/spool/MailScanner/quarantine/20030731/19i5nf-0001zl-FE
Jul 31 00:16:33 srv01 MailScanner[7674]: Saved infected "FritoLay.atr"
to /var/spool/MailScanner/quarantine/20030731/19i5nf-0001zl-FE

Also, is there a way to allow E-Mail's from a certain address not to be
scanned?

Thanks,
--
Kyle Pinkley
Tekhead, LLC
OFFICE: (800)370-3032
FAX: (337)769-1083
WEB:  <http://www.tekhead.biz> http://www.tekhead.biz
E-MAIL:  <mailto:kyle@tekhead.biz> kyle@tekhead.biz

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20030731/21ad2c94/attachment.html