_THIRD_ CommuniGate Pro - MailScanner update

Wed Jul 23 01:40:01 IST 2003

Well, there's two problems:

1) when you disabled that check in the mailscanner code (that I said 
you shouldn't do), it caused mailscanner to accept messages that aren't 
valid, and then pass them on to communigate pro, which then makes .bad 
files out of them.  If you hadn't done that to mailscanner, they would 
be being built up in the /var/spool/mqueue.in directory for 
mailscanner, and mail scanner would be putting messages into your 
syslog.  You should re-enable the default mailscanner code.

2) my cgp2ms script depended upon receiving a "Received:" header before 
printing out certain qf file variables ($_ the relay host, which it 
extracts from the Received header; S the sender; and the RPFD lines, 
the recipients).  The problem is that for localhost senders, such as 
messages created by CommuniGate Pro's rules, it never triggered this 
because there are no Received headers at all, creating a message with 
no relay, no sender, and no recipients.  I've re-worked my logic in the 
cgp2ms script so that when it moves from the headers to the body, if it 
still hasn't printed those variables, it does so (using localhost for 
the relay).  I also re-wrote the regexp logic for extracting the relay 
host from the Received header (it worked for some received headers, 
that have both the hostname and the ip addr, but not for received 
headers which only list the relay's ip addr; I fixed that).

So, my third update release in 2 days.  Hopefully that fixes everything 
:-)

I also re-formatted my update announcements at the top of the page.

http://people.ucsc.edu/~jrudd/MailScanner

John

On Tuesday, Jul 22, 2003, at 15:37 US/Pacific, Boulytchev, Vasiliy 
wrote:

> John,
>      Your guess was correct.  It is an autoreply rule on account 
> "autoreply" on "mailsvc.com" domain, in CommunigatePro.  By the way, 
> You can cross the other errors off the list.  I have tested BCC, RPFD: 
> and all, the fix worked great that you release earlier.  So we just 
> have one left, hopefully.
>  
> THANKS!!!!!!!!!!!!!!!!!!!!!
>  
>  
>  
>
> Vasiliy Boulytchev
>
> Colorado Information Technologies Inc.
>
> (719) 473-2800 x15
>
>
>
>  
>
>  
>
>
> -----Original Message-----
> From: John Rudd [mailto:jrudd at UCSC.EDU]
> Sent: Tuesday, July 22, 2003 4:20 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: CommuniGate Pro - MailScanner update
>
> How was that bad message generated?  It would appear that it was
> generated without any recipients (hence the lack of lines that start
> RPFD:, the sendmail queue file line indicating each recipient).  Is it
> being generated by CommuniGate Pro's rules? or something else?
>
> On Tuesday, Jul 22, 2003, at 14:56 US/Pacific, Boulytchev, Vasiliy
> wrote:
>
> > Yet another .bad :))))))))))))))))))))
> >  
> > Here is the qf-blah file
> >  
> > V4
> > T1058909914
> > K0
> > N0
> > P150900
> > HFrom: <autoreply at mailsvc.com> (Automatic Reply mailbox for testing)
> > HDate: Tue, 22 Jul 2003 15:38:33 -0600
> > HMessage-ID: <react-12399218 at mailsvc.com>
> > HX-Autogenerated: Reply
> > HTo: "vasiliy boulytchev" <virus at boulytcheva.com>
> > HSubject: Re:
> > HIn-Reply-To: <003601c3509a$4af6f4b0$3700000a at office.coinfotech.com>
> > autoreply at mailsvc.com  is just a mailbox on Communigate Mail Server 
> to
> > autoreply to the message for testing purposes.
> >  
> >  
> > How about messages from Daemons on Listservers?
> >  
> > Here is a copy of a good qf-blah
> >  
> > V4
> > T1058910524
> > K0
> > N0
> > P150900
> > $_
> > S<vboulytchev at coinfotech.com>
> > RPFD:<virus at boulytcheva.com>
> > HReceived: from [209.12.32.66] (HELO willow.office.coinfotech.com)
> >   by mailsvc.com (CommuniGate Pro SMTP 4.0.6)
> >   with ESMTP id 12399741 for virus at boulytcheva.com; Tue, 22 Jul 2003
> > 15:48:43 -0600
> > HMIME-Version: 1.0
> > HContent-Type: multipart/alternative;
> >         boundary="----_=_NextPart_001_01C3509B.93B4BFAB"
> > Hcontent-class: urn:content-classes:message
> > HX-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
> > HSubject:
> > HDate: Tue, 22 Jul 2003 15:52:42 -0600
> > HMessage-ID:
> > <1958DE295D9656499ECAAD3642822DE0033FD7 at willow.office.coinfotech.com>
> > HX-MS-Has-Attach:
> > HX-MS-TNEF-Correlator:
> > HThread-Index: AcNQm5OBeCvE5aXeTmW62LdyGyY1eQ==
> > HFrom: "Boulytchev, Vasiliy" <vboulytchev at coinfotech.com>
> > HTo: "vasiliy boulytchev" <virus at boulytcheva.com>
> >  
> >  
> >
> > Vasiliy Boulytchev
> >
> > Colorado Information Technologies Inc.
> >
> > (719) 473-2800 x15
> >
> >
> >
> >  
> >
> >  
> >
> >
> > -----Original Message-----
> > From: John Rudd [mailto:jrudd at UCSC.EDU]
> > Sent: Monday, July 21, 2003 4:37 PM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: CommuniGate Pro - MailScanner update
> >
> > I have made an update to my scripts for using MailScanner with
> > CommuniGate Pro.  I have also updated the text of the CommuniGate Pro
> > rule instructions (the Execute rule no longer needs the [RETPATH] nor
> > [RCPT] options).
> >
> > This should change the problem some people noticed with ".bad" files
> > showing up in the CommuniGate Pro Queue directory, due to "RPFD:" 
> being
> > prepended to sender's addresses.  This shouldn't happen any more.
> >
> >
> > You can get the new scripts and information from:
> >
> > http://people.ucsc.edu/~jrudd/MailScanner
> >
> >
> > If you have any questions, or notice any new bugs, please let me 
> know.
> >
> > (And be sure to edit your path to perl in the first line of each
> > script;
> > it changed in the downloads because my testing platform changed from
> > Solaris to Linux)
> >
> >
> > John Rudd
> >
> >
> > (ps: one person has mentioned that they see some messages being cross
> > delivered, but I haven't had anyone else mention this problem to me,
> > nor
> > have I seen it on my own servers; if you do see such a behavior, 
> please
> > let me know right away, and try to give me plenty of context
> > information)
> >
>