From housey at SME-ECOM.CO.UK Wed Dec 1 09:15:59 2004 From: housey at SME-ECOM.CO.UK (Paul Houselander - SME) Date: Thu Jan 12 21:27:46 2006 Subject: Kaspersky 5.0.4.0 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Im using kaspersky 5.0.4.0 with MailScanner version 4.35.11 on Fedora Core 2. I set Virus Scanners = kaspersky in MailScanner.conf but the virus scanner does not get called. I sent the test eicar virus and it only got blocked due to filename/type checking. I checked virus.scanners.conf and the path is correct /opt/kav, I also ran /usr/lib/MailScanner/kaspersky-wrapper /opt/kav /tmp from the command line and the scanner was called and worked. Now if I change Virus Scanners = kaspersky-4.5 in MailScanner.conf the virus scanner is called and detects the eicar virus? The path in virus.scanners.conf is also /opt/kav Not a major prob as I can just set to kaspersky-4.5 but was a little concerned, is there anything ive done wrong? I saw some mention on the list of getting it to work with the kaspersky daemon? has anyone got this working - point me to some instructions? Thanks Paul ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From housey at SME-ECOM.CO.UK Wed Dec 1 09:38:14 2004 From: housey at SME-ECOM.CO.UK (Paul Houselander - SME) Date: Thu Jan 12 21:27:46 2006 Subject: Only allow mail from 1 server Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi I have a machine running Mailscanner/Sendmail where users also pop there mail off. I want to move MailScanner to a couple of machines that scan the mail then forward onto the box where the users actually pop there mail off. Ill get rid of the current MX record for the POP machine and create MX records for the 2 MailScanner Machines. I want to ensure the POP machine can only recieve mail from the 2 front end MailScanner Machines. I guess I can use a firewall to only allowing incomming connections from the 2 machines but is there a way you can achieve this within sendmail? Thanks Paul ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Wed Dec 1 11:01:47 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:46 2006 Subject: {Virus} new phishing (fwd) Message-ID: Hi there, on my system the Mail from Peter Peters with subject "New Phishing" was found to be infected?? Greetings Marcel ---------- Forwarded message ---------- Date: Wed, 1 Dec 2004 11:33:13 +0100 From: Peter Peters Reply-To: peter.peters@utwente.nl To: MAILSCANNER@JISCMAIL.AC.UK Subject: {Virus} new phishing Warning: This message has had one or more attachments removed Warning: (the entire message). Warning: Please read the "irc-addicts.de-Attachment-Warning.txt" attachment(s) for more information. This is a message from the MailScanner E-Mail Virus Protection Service ---------------------------------------------------------------------- The original e-mail attachment "the entire message" was believed to be infected by a virus and has been replaced by this warning message. If you wish to receive a copy of the *infected* attachment, please e-mail your Sysadmins and include the whole of this message in your request. Alternatively, you can call them, with the contents of this message to hand when you call. At Wed Dec 1 11:36:31 2004 the virus scanner said: AntiVir: ALERT: [TR/Phish.Bankfr.eml7 virus] msg-16089-9.txt <<< The Trojan horse TR/Phish.Bankfr.eml7 Again for Info: Date: 20041201 Message: iB1AaOYS017815 -- Postmaster ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joakim at CEFALK.COM Wed Dec 1 11:57:54 2004 From: joakim at CEFALK.COM (Joakim Cefalk) Date: Thu Jan 12 21:27:46 2006 Subject: {Virus} new phishing (fwd) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On my system too, but only antivir found a infection not f-prot. Marcel Blenkers wrote: >Hi there, > >on my system the Mail from Peter Peters with subject "New Phishing" was >found to be infected?? > >Greetings > >Marcel > >---------- Forwarded message ---------- >Date: Wed, 1 Dec 2004 11:33:13 +0100 >From: Peter Peters >Reply-To: peter.peters@utwente.nl >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: {Virus} new phishing > >Warning: This message has had one or more attachments removed >Warning: (the entire message). >Warning: Please read the "irc-addicts.de-Attachment-Warning.txt" attachment(s) for more information. > >This is a message from the MailScanner E-Mail Virus Protection Service >---------------------------------------------------------------------- >The original e-mail attachment "the entire message" >was believed to be infected by a virus and has been replaced by this warning >message. > >If you wish to receive a copy of the *infected* attachment, please >e-mail your Sysadmins and include the whole of this message >in your request. Alternatively, you can call them, with >the contents of this message to hand when you call. > >At Wed Dec 1 11:36:31 2004 the virus scanner said: > AntiVir: ALERT: [TR/Phish.Bankfr.eml7 virus] msg-16089-9.txt <<< The Trojan horse TR/Phish.Bankfr.eml7 > > >Again for Info: >Date: 20041201 >Message: iB1AaOYS017815 > >-- >Postmaster > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Joakim Cefalk Fredentorpsgatan 10A 281 47 HÄSSLEHOLM Epost: joakim@cefalk.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Dec 1 12:22:09 2004 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:27:46 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "iso-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I have a problem with the "Remove These Headers" option. When I specify "Remove These Headers = X-Mozilla-Status: X-Mozilla-Status2:" in MailScanner.conf, everything works fine (i.e. headers /are/ removed as should be), however, when I specify a filename (such as "Remove These Headers = %rules-dir%/RemoveTheseHeaders", no headers whatsoever are being removed. Even the most basic entry does not work at all: FromOrTo: default X-Mozilla-Status: X-Mozilla-Status2: The %rules-dir% is set to the correct directory (since I use plenty of other rulesets) and the file "RemoveTheseHeaders" also exists with the same permissions as other rulesets. There should not be a problem there. Does anyone else use a filename as a ruleset for this option (and are headers being removed properly)? The reason for using a ruleset, is to differentiate between mail coming in from the Internet and from the LAN and removing different headers accordingly. I'm using the latest stable version of MailScanner: 4.35.9. Regards, Mike Klinkert. PS: kudos for this excellent piece of software! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 12:44:22 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:46 2006 Subject: Kaspersky 5.0.4.0 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The kaspersky-4.5 setting applies to kaspersky 4.5 and newer. Sorry that isn't clear, my bad docs :-( Paul Houselander - SME wrote: > Hi > > Im using kaspersky 5.0.4.0 with MailScanner version 4.35.11 on Fedora > Core 2. > > I set > > Virus Scanners = kaspersky > > in MailScanner.conf but the virus scanner does not get called. I sent > the test eicar virus and it only got blocked due to filename/type > checking. > > I checked virus.scanners.conf and the path is correct /opt/kav, I also ran > > /usr/lib/MailScanner/kaspersky-wrapper /opt/kav /tmp > > from the command line and the scanner was called and worked. > > Now if I change > > Virus Scanners = kaspersky-4.5 > > in MailScanner.conf the virus scanner is called and detects the eicar > virus? The path in virus.scanners.conf is also /opt/kav > > Not a major prob as I can just set to kaspersky-4.5 but was a little > concerned, is there anything ive done wrong? > > I saw some mention on the list of getting it to work with the > kaspersky daemon? has anyone got this working - point me to some > instructions? > > Thanks > > Paul > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 12:45:30 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:46 2006 Subject: Only allow mail from 1 server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] No, not as far as I know. You need a firewall to protect it. If it's a Linux box then this is easy using IPtables (but don't ask me how). Paul Houselander - SME wrote: > Hi > > I have a machine running Mailscanner/Sendmail where users also pop > there mail off. > > I want to move MailScanner to a couple of machines that scan the mail > then forward onto the box where the users actually pop there mail off. > > Ill get rid of the current MX record for the POP machine and create MX > records for the 2 MailScanner Machines. I want to ensure the POP > machine can only recieve mail from the 2 front end MailScanner > Machines. I guess I can use a firewall to only allowing incomming > connections from the 2 machines but is there a way you can achieve > this within sendmail? > -- -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 12:47:25 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:46 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike wrote: >Hi, > >I have a problem with the "Remove These Headers" option. When I specify "Remove These Headers = X-Mozilla-Status: X-Mozilla-Status2:" in MailScanner.conf, everything works fine (i.e. headers /are/ removed as should be), however, when I specify a filename (such as "Remove These Headers = %rules-dir%/RemoveTheseHeaders", no headers whatsoever are being removed. > Try renaming RemoveTheseHeaders to RemoveTheseHeaders.rule Then it should spot that you are putting in a ruleset filename. Without that, there is no way to distinguish between the name of a header and the name of a ruleset file. > Even the most basic entry does not work at all: > >FromOrTo: default X-Mozilla-Status: X-Mozilla-Status2: > >The %rules-dir% is set to the correct directory (since I use plenty of other rulesets) and the file "RemoveTheseHeaders" also exists with the same permissions as other rulesets. There should not be a problem there. > >Does anyone else use a filename as a ruleset for this option (and are headers being removed properly)? The reason for using a ruleset, is to differentiate between mail coming in from the Internet and from the LAN and removing different headers accordingly. > >I'm using the latest stable version of MailScanner: 4.35.9. > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Dec 1 12:57:58 2004 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:27:46 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "iso-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >Try renaming RemoveTheseHeaders to RemoveTheseHeaders.rule >Then it should spot that you are putting in a ruleset filename. Without >that, there is no way to distinguish between the name of a header and >the name of a ruleset file. Strange but true. This indeed seems to work. Strange, because all other rules also do /not/ have a ".rules" appended to it and work perfectly! I will however append ".rules" to all other rulesets, to avoid problems in the futher. Thanks very much! >Julian Field Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at LISTS.COM.AR Wed Dec 1 12:49:36 2004 From: mailscanner at LISTS.COM.AR (Leonardo Helman) Date: Thu Jan 12 21:27:46 2006 Subject: Increase spaminess for a set of domains Message-ID: If you are useing SA 3+ you have the plugin stuff, you shouldn't have to patch EvalTests any more. look in Mail::SpamAssassin::Plugin nice feature, you write (cut&paste) a few lines of .pm, a little .cf put both archives in localrules directory, and you don't have to patch EvalTest, every new spamassassin version. Saludos -- Leonardo Helman Pert Consultores Argentina On Tue, Nov 30, 2004 at 08:49:12PM +0530, Dhawal Doshy wrote: > Thanks Julian and Marcin, > > I tried fooling around with a sub in > /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/EvalTests.pm but failed > miserably.. the lint test failed to recognize my rules.. will try again > at leisure. > > sub in EvalTests.pm: > -------------------- > sub check_to_in_mylist { > my ($self) = @_; > local ($_); > foreach $_ ($self->all_to_addrs()) { > if ($self->_check_whitelist ($self->{conf}->{mylist_to}, $_)) { > return 1; > } > } > } > > my 70_something.cf file: > ------------ > header USER_IN_MYLIST eval:check_from_in_mylist() > describe USER_IN_MYLIST From: address is in the user's my-list > tflags USER_IN_MYLIST userconf noautolearn > > SCORE USER_IN_MYLIST -1.000 > mylist_from *@yahoo.co.in > > Error: > ------ > config: SpamAssassin failed to parse line, skipping: mylist_from > *@yahoo.co.in > > Anyways thanks again.. the spam.assassin.prefs.conf hack worked. > > cheers, > - dhawal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 13:10:40 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:46 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike wrote: >>Try renaming RemoveTheseHeaders to RemoveTheseHeaders.rule >>Then it should spot that you are putting in a ruleset filename. Without >>that, there is no way to distinguish between the name of a header and >>the name of a ruleset file. >> >> > >Strange but true. This indeed seems to work. Strange, because all other rules also do /not/ have a ".rules" appended to it and work perfectly! I will however append ".rules" to all other rulesets, to avoid problems in the futher. > > If it can work out what you mean without any filename matching, it will do so. But as the header names are just arbitrary pieces of text, there is no way for it to know what you meant. It's as intelligent as I could make it, but in this case there is no way to tell. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Dec 1 13:22:06 2004 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:27:46 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "iso-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field > >If it can work out what you mean without any filename matching, it will >do so. But as the header names are just arbitrary pieces of text, there >is no way for it to know what you meant. > >It's as intelligent as I could make it, but in this case there is no way >to tell. It seems a bit strange to be dependent on the ".rules" extension to determine if it's a file/ruleset. Isn't it possible to determine that it's a file when the argument of the option starts with "%rules-dir%", or "/", or whatever? Or maybe just a simple "[ -f ] && read-from-file" (obviously not in perl, but bash notation ;-)? >Julian Field Thanks for the fast response! Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 13:29:43 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:46 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike wrote: >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Julian Field >> >>If it can work out what you mean without any filename matching, it will >>do so. But as the header names are just arbitrary pieces of text, there >>is no way for it to know what you meant. >> >>It's as intelligent as I could make it, but in this case there is no way >>to tell. >> >> > >It seems a bit strange to be dependent on the ".rules" extension to determine if it's a file/ruleset. Isn't it possible to determine that it's a file when the argument of the option starts with "%rules-dir%", or "/", or whatever? Or maybe just a simple "[ -f ] && read-from-file" (obviously not in perl, but bash notation ;-)? > > And for options which can take a filename? Or for options that take a string which could start with "/" or could happen to be the name of a file on your system? (e.g. Silent Viruses). There are lots of reasons why this doesn't work in practice. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Dec 1 13:36:32 2004 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:27:46 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "iso-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field > >And for options which can take a filename? Or for options that take a >string which could start with "/" or could happen to be the name of a >file on your system? (e.g. Silent Viruses). There are lots of reasons >why this doesn't work in practice. All options with "# This can also be the filename of a ruleset." can be put in a special class (array?). Only for options which are an element/part of that class/array will the argument be tested to see if it's a file (test -f $argument) and if so, use the settings in that file. I can see that it can cause problems as you describe it, but it's just a thought! ;-) >Julian Field Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From p.g.m.peters at utwente.nl Wed Dec 1 13:46:56 2004 From: p.g.m.peters at utwente.nl (Peter Peters) Date: Thu Jan 12 21:27:46 2006 Subject: {Virus} new phishing (fwd) Message-ID: On Wed, 1 Dec 2004 12:57:54 +0100, you wrote: >On my system too, but only antivir found a infection not f-prot. I didn't have any virus. But I included an IP address from a phishing spam. |It seems phishers read or use MailScanner. Instead of www.your-favorite-bank.com they start |using signon. And the phishing test |doesn't recognize this one. | |Some people suggested inserting an ALT with something like "The host |http://x.x.x.x/s, is a numerical IP address; most legitimate sites |use names not addresses." | |Would this be possible? I replaced the IP-address. -- Peter Peters, senior netwerkbeheerder Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 13:51:49 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:46 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike wrote: >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Julian Field >> >>And for options which can take a filename? Or for options that take a >>string which could start with "/" or could happen to be the name of a >>file on your system? (e.g. Silent Viruses). There are lots of reasons >>why this doesn't work in practice. >> >> > >All options with "# This can also be the filename of a ruleset." can be put in a special class (array?). Only for options which are an element/part of that class/array will the argument be tested to see if it's a file (test -f $argument) and if so, use the settings in that file. > > I guess I could. It's never been an issue in the past. Also, how do I tell the difference when the option takes a filename as its argument? Then the file has to exist anyway, but it's not a ruleset. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 13:53:50 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:46 2006 Subject: {Virus} new phishing (fwd) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Peter Peters wrote: >On Wed, 1 Dec 2004 12:57:54 +0100, you wrote: > > > >>On my system too, but only antivir found a infection not f-prot. >> >> > >I didn't have any virus. But I included an IP address from a phishing >spam. > >|It seems phishers read or use MailScanner. Instead of |href="http://x.x.x.x/s">www.your-favorite-bank.com they start >|using signon. And the phishing test >|doesn't recognize this one. >| >|Some people suggested inserting an ALT with something like "The host >|http://x.x.x.x/s, is a numerical IP address; most legitimate sites >|use names not addresses." >| >|Would this be possible? > >I replaced the IP-address. > > There is already a SpamAssassin rule which detects these, you might want to increase its score. score NORMAL_HTTP_TO_IP 4 is what I use. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mspieth at NEOD.NET Wed Dec 1 14:09:06 2004 From: mspieth at NEOD.NET (Mark Spieth) Date: Thu Jan 12 21:27:46 2006 Subject: Only allow mail from 1 server Message-ID: Not really. Sendmail will accept mail generally from any box as long as the mail is destined for that server. Firewalling is the best route to go. Mark Spieth - Director of Internet Services Northeast Ohio Digital Inc. http://www.neod.net mspieth@neod.net 330-830-6551 CONFIDENTIALITY NOTICE: The materials attached hereto are confidential and the property of the sender. The information contained in the attached materials is privileged and/or confidential and is intended only for the use of the above-named individual(s) or entity(ies). If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution or the taking of any action in reliance on the contents of the attached information is strictly prohibited. If you have received this transmission in error, please discard the information immediately -----Original Message----- From: Paul Houselander - SME [mailto:housey@SME-ECOM.CO.UK] Sent: Wednesday, December 01, 2004 4:38 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Only allow mail from 1 server Hi I have a machine running Mailscanner/Sendmail where users also pop there mail off. I want to move MailScanner to a couple of machines that scan the mail then forward onto the box where the users actually pop there mail off. Ill get rid of the current MX record for the POP machine and create MX records for the 2 MailScanner Machines. I want to ensure the POP machine can only recieve mail from the 2 front end MailScanner Machines. I guess I can use a firewall to only allowing incomming connections from the 2 machines but is there a way you can achieve this within sendmail? Thanks Paul ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website!^@------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Dec 1 14:31:13 2004 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:27:46 2006 Subject: Only allow mail from 1 server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mark Spieth wrote: > Not really. Sendmail will accept mail generally from any box as long as > the mail is destined for that server. Firewalling is the best route to go. > > > > Mark Spieth - Director of Internet Services Some OSes like RH9, FC or RHEL3 seem to have sendmail compiled with tcp wrappers support.. if you are using one of these your job is done.. simply use the hosts.allow to allow connections to sendmail and yeah make sure you have also have the restricitons in your hosts.deny - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From G.Pentland at SOTON.AC.UK Wed Dec 1 14:35:39 2004 From: G.Pentland at SOTON.AC.UK (Pentland G.) Date: Thu Jan 12 21:27:46 2006 Subject: Only allow mail from 1 server Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes there is... You can do it with the access map feature (Read the o'reilly book or www.sendmail.org) or here is some custom code I wrote and have copied in here from an earlier thread on this list. I use this code (or something very similar) in production but unless you know sendmail very well I'd suggest the firewall route is the easiest. Hope this helps, Gary Pentland G. > Try this... > > LOCAL_CONFIG > # If email is bound to the local domain, what will do local delivery > for us? dnl D{DefaultLocalDeliveryHost}YOURHOST.DOMAIN.COM > > LOCAL_RULE_0 > # Allocate a slot for the domain name > R$+ $: < > $1 > # Addresses qualified with the local machine name - unqualify them > R< > $+ < @ $j . > $: < > $1 > # Addresses qualified with a local domain - unqualify them > R< > $+ < @ $=w . > $: < > $1 > # Anything else on the qualification is non-local so return and parse normally > R< > $* @ $* $@ $1 @ $2 > # Anything unqualified qualify with the local domain > R< > $+ $: < $M > $1 > # Now send these local emails to the default local delivery servers > R< $+ > $+ $#esmtp $@ ${DefaultLocalDeliveryHost} $: $2 < @ $1 . > > > Hope that helps. > > -----Original Message----- > From: Daniel Gercke [mailto:gercke@HNM.DE] > Sent: Wed 3/3/2004 11:39 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Cc: > Subject: # SENDMAIL_RELAY Question > > > > Hello, > > i have a problem. im running a mailserver with a lot of domains and > users. now i hav setup another server with mailscanner. now for some > domains i want incoming mails will go through mailscanner and > mailscanner should relay this to the old mailserver. > for mail coming for world this works fine. but wenn a lokal domain form > mailserver sends to another lokal account this mail wouldn´t send > through mailscanner this mail will localy delivered. > Now my question: > What would happen if i add SENDMAIL_RELAY="mailscanner" to > sendmailconfig of mailserver ? Will there be a mailloop between these > machines? > > > > > > -- > Diese Nachricht wurde auf Viren und andere gefaerliche Inhalte untersucht > und ist - aktuelle Virenscanner vorausgesetzt - sauber. > MailScanner dankt transtec fur die freundliche Unterstutzung. > > > Mark Spieth wrote: > Not really. Sendmail will accept mail generally from any box as long > as the mail is destined for that server. Firewalling is the best > route to go. > > Mark Spieth - Director of Internet Services > Northeast Ohio Digital Inc. > http://www.neod.net > mspieth@neod.net > 330-830-6551 > > CONFIDENTIALITY NOTICE: The materials attached hereto are > confidential and the property of the sender. The information > contained in the attached materials is privileged and/or confidential > and is intended only for the use of the above-named individual(s) or > entity(ies). If you are not the intended recipient, be advised that > any unauthorized disclosure, copying, distribution or the taking of > any action in reliance on the contents of the attached information is > strictly prohibited. If you have received this transmission in error, > please discard the information immediately > -----Original Message----- > From: Paul Houselander - SME [mailto:housey@SME-ECOM.CO.UK] > Sent: Wednesday, December 01, 2004 4:38 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Only allow mail from 1 server > > Hi > > I have a machine running Mailscanner/Sendmail where users also pop > there mail off. > > I want to move MailScanner to a couple of machines that scan the mail > then forward onto the box where the users actually pop there mail > off. > > Ill get rid of the current MX record for the POP machine and create > MX records for the 2 MailScanner Machines. I want to ensure the POP > machine can only recieve mail from the 2 front end MailScanner > Machines. I guess I can use a firewall to only allowing incomming > connections from the 2 machines but is there a way you can achieve > this within sendmail? > > Thanks > > Paul > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the > website!------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the > body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Wed Dec 1 14:43:16 2004 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:27:46 2006 Subject: phishkill: skip mailto stuff? Message-ID: Julian, Running 4.36.1 with version 1.126.2.172 of Message.pm. I got a complaint about this: > If you are having problems, please email myself (Ronald.Aho@jenzabar.net > <MailScanner has detected a possible fraud > attempt from "ronald.aho@jenzabar.net" claiming to > be mailto:Ronald.Aho@jenzabar.net>) and Shirley > High (shirley.high@jenzabar.net <MailScanner > has detected a possible fraud attempt from "shirley.high@jenzabar.net" claiming > to be mailto:shirley.high@jenzabar.net>) > directly and we will forward it to the appropriate people. We will respond I thought that later versions of anti-phishing were supposed to ignore mailto URLs? Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 14:49:16 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:47 2006 Subject: phishkill: skip mailto stuff? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] But this appears to be mailto:address I don't currently look for < or > characters, I guess I could add that. Then it would start mailto: and so be spotted. Jeff A. Earickson wrote: > Julian, > > Running 4.36.1 with version 1.126.2.172 of Message.pm. I got a > complaint about this: > >> If you are having problems, please email myself (Ronald.Aho@jenzabar.net >> <MailScanner has detected a possible >> fraud >> attempt from "ronald.aho@jenzabar.net" claiming to >> be mailto:Ronald.Aho@jenzabar.net>) >> and Shirley >> High (shirley.high@jenzabar.net >> <MailScanner >> has detected a possible fraud attempt from >> "shirley.high@jenzabar.net" claiming >> to be >> mailto:shirley.high@jenzabar.net>) >> directly and we will forward it to the appropriate people. We will >> respond > > > I thought that later versions of anti-phishing were supposed to ignore > mailto URLs? > > Jeff Earickson > Colby College > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 14:54:13 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:47 2006 Subject: phishkill: skip mailto stuff? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It actually looks like they have got the link and the text totally the wrong way round. The link target URL should contain the mailto, and not the text displayed in the link. So I don't see what I can do about this at all, sorry. Julian Field wrote: > But this appears to be > mailto:address > I don't currently look for < or > characters, I guess I could add that. > Then it would start mailto: and so be spotted. > > Jeff A. Earickson wrote: > >> Julian, >> >> Running 4.36.1 with version 1.126.2.172 of Message.pm. I got a >> complaint about this: >> >>> If you are having problems, please email myself >>> (Ronald.Aho@jenzabar.net >>> <MailScanner has detected a possible >>> fraud >>> attempt from "ronald.aho@jenzabar.net" claiming to >>> be mailto:Ronald.Aho@jenzabar.net>) >>> and Shirley >>> High (shirley.high@jenzabar.net >>> <MailScanner >>> has detected a possible fraud attempt from >>> "shirley.high@jenzabar.net" claiming >>> to be >>> mailto:shirley.high@jenzabar.net>) >>> directly and we will forward it to the appropriate people. We will >>> respond >> >> >> >> I thought that later versions of anti-phishing were supposed to ignore >> mailto URLs? >> >> Jeff Earickson >> Colby College >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From G.Pentland at soton.ac.uk Wed Dec 1 15:00:33 2004 From: G.Pentland at soton.ac.uk (Pentland G.) Date: Thu Jan 12 21:27:47 2006 Subject: Feature Request - Phishing Modify Subject and Phishing Actions - Any comments? Message-ID: All, Would anyone else out there want to tag the subject line of a Phishing mail e.g.. Phishing Modify Subject = yes Phishing Subject Text = {Phishing?} So you'd get something like "{Phishing?} Important information from your bank?" And also possibly have.. Phishing Actions = deliver / delete / ruleset equivalent to Spam actions but independent of them? Julian, How hard do you think this would be to implement? Thanks, Gary ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 15:09:16 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:47 2006 Subject: Feature Request - Phishing Modify Subject and Phishing Actions - Any comments? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It's not going to happen today, but I will take a look. It's going to require quite a significant expansion of the phishing net code, as currently it just edits the message and doesn't have the ability to pass any status information back up. I originally thought about doing this, but didn't as it causes false positives and I don't want to cry wolf. Would people like any numeric IP address to be considered a phishing attack? That one's easy :-) Pentland G. wrote: >All, > >Would anyone else out there want to tag the subject line of a Phishing >mail e.g.. > >Phishing Modify Subject = yes > >Phishing Subject Text = {Phishing?} > >So you'd get something like "{Phishing?} Important information from your >bank?" > >And also possibly have.. > >Phishing Actions = deliver / delete / ruleset > >equivalent to Spam actions but independent of them? > > >Julian, > >How hard do you think this would be to implement? > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Wed Dec 1 15:20:21 2004 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:27:47 2006 Subject: Feature Request - Phishing Modify Subject and Phishing Actions - Any comments? Message-ID: On Wed, 1 Dec 2004, Julian Field wrote: > Would people like any numeric IP address to be considered a phishing > attack? That one's easy :-) Yes! Per your hint this morning, I raised the score on NORMAL_HTTP_TO_IP in my spamassassin.prefs.conf. Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 15:29:08 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:47 2006 Subject: Feature Request - Phishing Modify Subject and Phishing Actions - Any comments? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jeff A. Earickson wrote: > On Wed, 1 Dec 2004, Julian Field wrote: > >> Would people like any numeric IP address to be considered a phishing >> attack? That one's easy :-) > > > Yes! Per your hint this morning, I raised the score on NORMAL_HTTP_TO_IP > in my spamassassin.prefs.conf. > I've already had a well-founded "no" vote too, from an ISP who regularly does this for their users (don't know why, but he was very definitely against it). I don't want to add yet another option for this, when all it takes is a new score for a SpamAssassin rule. I'll add a comment about the NORMAL_HTTP_TO_IP rule into the shipped spam.assassin.prefs.conf, so it's easy to find. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 1 15:45:40 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:47 2006 Subject: MailScanner.conf and spam.assassin.prefs.conf on upgrade Message-ID: Julian maybe I've missed something on the recent upgrades, but on the instructions it talks about using the upgrade_MailScanner_conf script to merge in your config with the new Mailscanner.conf options. I've seen a few changes needed for SA3.0 for spam.assassin.prefs.conf (on the fsl.com support pages) and you've just mentioned a change to the file as shipped. How easy would it be to make a upgrade_spam_assassin_prefs_conf script so any recent updates to this script are handled more automagically too?? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 15:49:49 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:47 2006 Subject: MailScanner.conf and spam.assassin.prefs.conf on upgrade Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: > Julian > > maybe I've missed something on the recent upgrades, but on the > instructions it talks about using the upgrade_MailScanner_conf script to > merge in your config with the new Mailscanner.conf options. > > I've seen a few changes needed for SA3.0 for spam.assassin.prefs.conf > (on the fsl.com support pages) and you've just mentioned a change to the > file as shipped. > > How easy would it be to make a upgrade_spam_assassin_prefs_conf script > so any recent updates to this script are handled more automagically too?? Not half so easily. I can spot the real lines in MailScanner.conf far more easily due to my simple key = value syntax. Note that you can use upgrade_MailScanner_conf on languages.conf files as well! One of these days I'll get around to documenting that. I don't want to do it now as it will need some testing, as I want the script to automatically work out what it's been asked to do and print different help accordingly. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 1 15:54:58 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:47 2006 Subject: MailScanner.conf and spam.assassin.prefs.conf on upgrade Message-ID: Julian Field wrote: > Martin Hepworth wrote: > >> Julian >> >> maybe I've missed something on the recent upgrades, but on the >> instructions it talks about using the upgrade_MailScanner_conf script to >> merge in your config with the new Mailscanner.conf options. >> >> I've seen a few changes needed for SA3.0 for spam.assassin.prefs.conf >> (on the fsl.com support pages) and you've just mentioned a change to the >> file as shipped. >> >> How easy would it be to make a upgrade_spam_assassin_prefs_conf script >> so any recent updates to this script are handled more automagically too?? > > > Not half so easily. I can spot the real lines in MailScanner.conf far > more easily due to my simple key = value syntax. > > Note that you can use upgrade_MailScanner_conf on languages.conf files > as well! > One of these days I'll get around to documenting that. I don't want to > do it now as it will need some testing, as I want the script to > automatically work out what it's been asked to do and print different > help accordingly. > > -- > Julian Field Fair enough.... might be worth while documenting a 'diff' style approach and getting the person doing the upgrade to check out changes.. or what about a little CVS style change log at the top of the file so we can track changes better??? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Wed Dec 1 16:08:00 2004 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:27:47 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: Mike wrote: Try renaming RemoveTheseHeaders to RemoveTheseHeaders.rule Then it should spot that you are putting in a ruleset filename. Without that, there is no way to distinguish between the name of a header and the name of a ruleset file. Strange but true. This indeed seems to work. Strange, because all other rules also do /not/ have a ".rules" appended to it and work perfectly! I will however append ".rules" to all other rulesets, to avoid problems in the futher. Thanks very much! Julian Field Mike. Ok. Julian says "*.rule" and Mike says "*.rules". Does it matter which or do both work, 'cause when I installed MS I was confused by this and so some of my files have ".rules" and others ".rule". -- Ed Bruce -- This message, including any attachments, is intended solely for the use of the named recipients(s) and may contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution of this communication is expressly prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy any and all copies of the original message. Thank you for your cooperation. -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Dec 1 16:25:15 2004 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:27:47 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "iso-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Ed Bruce > >Ok. Julian says "*.rule" and Mike says "*.rules". Does it matter which >or do both work, 'cause when I installed MS I was confused by this and >so some of my files have ".rules" and others ".rule". I can only find reference in MailScanner.conf for .rules. I assumed Julian made a typo and appended .rules to all my rules and everything works flawlessly. Doing a recursive grep in /opt/MailScanner does not come up with any .rule reference, so I suppose it shoule be .rules. >Ed Bruce Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 16:40:42 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:47 2006 Subject: MailScanner.conf and spam.assassin.prefs.conf on upgrade Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: > Julian Field wrote: > >> Martin Hepworth wrote: >> >>> Julian >>> >>> maybe I've missed something on the recent upgrades, but on the >>> instructions it talks about using the upgrade_MailScanner_conf >>> script to >>> merge in your config with the new Mailscanner.conf options. >>> >>> I've seen a few changes needed for SA3.0 for spam.assassin.prefs.conf >>> (on the fsl.com support pages) and you've just mentioned a change to >>> the >>> file as shipped. >>> >>> How easy would it be to make a upgrade_spam_assassin_prefs_conf script >>> so any recent updates to this script are handled more automagically >>> too?? >> >> >> >> Not half so easily. I can spot the real lines in MailScanner.conf far >> more easily due to my simple key = value syntax. >> >> Note that you can use upgrade_MailScanner_conf on languages.conf files >> as well! >> One of these days I'll get around to documenting that. I don't want to >> do it now as it will need some testing, as I want the script to >> automatically work out what it's been asked to do and print different >> help accordingly. >> >> -- >> Julian Field > > > Fair enough.... > > might be worth while documenting a 'diff' style approach and getting the > person doing the upgrade to check out changes.. > > or what about a little CVS style change log at the top of the file so we > can track changes better??? > Eek, documentation? There's that nasty little "d" word again :-) A decent change log at the top of it would be a very good idea. An auto-upgrader would be even better. All the distributions now contain an upgrade_languages_conf script to maintain the languages.conf files better, as this appears to be a common problem. It's a symlink to upgrade_MailScanner_conf with some extra logic added to the script to work out how it was invoked and therefore what text it should print. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 1 16:42:59 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:47 2006 Subject: Problem with filename ruleset for "Remove These Headers" Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ed Bruce wrote: > > > Mike wrote: > >>>Try renaming RemoveTheseHeaders to RemoveTheseHeaders.rule >>>Then it should spot that you are putting in a ruleset filename. Without >>>that, there is no way to distinguish between the name of a header and >>>the name of a ruleset file. >>> >>> >> >>Strange but true. This indeed seems to work. Strange, because all other rules also do /not/ have a ".rules" appended to it and work perfectly! I will however append ".rules" to all other rulesets, to avoid problems in the futher. >> >>Thanks very much! >> >> >> >>>Julian Field >>> >>> >> >>Mike. >> >> >> > Ok. Julian says "*.rule" and Mike says "*.rules". Does it matter which > or do both work, 'cause when I installed MS I was confused by this and > so some of my files have ".rules" and others ".rule". Both work just fine. I like doing very fuzzy matching where I can so that people aren't caught out by silly typos in their setups. I like parsers to be as imprecise and "accept everything" wherever I can. More effort on my part, but it makes your lives a lot easier as you can get away with just about anything that looks sensible. Where that's possible of course. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 1 17:11:21 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:47 2006 Subject: MailScanner.conf and spam.assassin.prefs.conf on upgrade Message-ID: > Eek, documentation? There's that nasty little "d" word again :-) > A decent change log at the top of it would be a very good idea. An > auto-upgrader would be even better. > Tell me about it. Finally (4 years in the job) getting around to doing a semi-decent job of documenting the config of all the kit here. Disk layouts, mount points etc etc. Might get a DR document together as a next step :-0 -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dpowell at LSSI.NET Wed Dec 1 19:14:16 2004 From: dpowell at LSSI.NET (Darrin) Date: Thu Jan 12 21:27:47 2006 Subject: Rule to block spoofed email Message-ID: Does anyone have an example of a rule or rules to only allow a specific email address from a specified source IP? We are getting a lot of SPAM with the sending address of a user on the mail server, this in turn white lists the SPAM. Thanks -- Darrin Powell LSSi Corp (919) 466-6803 www.lssi.net/~dpowell ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Wed Dec 1 19:32:13 2004 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:27:47 2006 Subject: Mqueue getting huge - MailScanner problem Message-ID: Any input,here ? On Tue, 30 Nov 2004 21:09:31 +0000, Venkata Achanta wrote: >1) what is your bayes_path set to (I'd assume in spam.assassin.prefs.conf). > >bayes_path /etc/MailScanner/bayes/bayes > >2) ls -l /etc/MailScanner/ | grep bayes >drwxrwsr-x 2 root apache 12288 Nov 30 13:05 bayes > >3) ls -l /etc/MailScanner/bayes/ > >total 162748 >-rw------- 1 root apache 217 Nov 30 13:00 bayes.lock >-rw------- 1 root apache 192 Nov 30 09:59 >bayes.lock.host.10489 >-rw------- 1 root apache 128 Nov 30 13:04 >bayes.lock.host.11919 >-rw------- 1 root apache 32 Nov 30 11:21 >bayes.lock.host.16401 >-rw------- 1 root apache 32 Nov 30 09:59 >bayes.lock.host.16649 >-rw------- 1 root apache 128 Nov 30 11:41 >bayes.lock.host.16992 >-rw------- 1 root apache 160 Nov 30 11:21 >bayes.lock.host.17390 >-rw------- 1 root apache 128 Nov 30 09:59 >bayes.lock.host.19125 >-rw------- 1 root apache 288 Nov 30 11:56 >bayes.lock.host.21598 >-rw------- 1 root apache 32 Nov 30 13:04 >bayes.lock.host.23474 >-rw------- 1 root apache 217 Nov 30 11:51 bayes.lock.host.2353 >-rw------- 1 root apache 96 Nov 30 11:56 >bayes.lock.host.24141 >-rw------- 1 root apache 192 Nov 30 13:04 >bayes.lock.host.25992 >-rw------- 1 root apache 93 Nov 30 11:41 bayes.lock.host.2779 >-rw------- 1 root apache 288 Nov 30 11:51 >bayes.lock.host.28571 >-rw------- 1 root apache 288 Nov 30 09:59 >bayes.lock.host.29698 >-rw------- 1 root apache 62 Nov 30 11:56 bayes.lock.host.3096 >-rw------- 1 root apache 64 Nov 30 11:41 >bayes.lock.host.31386 >-rw------- 1 root apache 128 Nov 30 11:56 >bayes.lock.host.31595 >-rw------- 1 root apache 124 Nov 30 09:59 bayes.lock.host.5129 >-rw------- 1 root apache 62 Nov 30 11:41 bayes.lock.host.7721 >-rw-rw---- 1 root apache 276048 Nov 30 13:04 bayes_journal >-rw-rw---- 1 root apache 5226496 Nov 30 12:43 bayes_seen >-rw-rw---- 1 root apache 10231808 Nov 30 12:57 bayes_toks >-rw-rw---- 1 root apache 4923392 Nov 27 10:49 >bayes_toks.expire10006 >-rw-rw---- 1 root apache 2781184 Nov 27 09:56 >bayes_toks.expire11318 >-rw-rw---- 1 root apache 4390912 Nov 27 11:29 >bayes_toks.expire11567 >-rw-rw---- 1 root apache 1449984 Nov 30 07:10 >bayes_toks.expire12993 >-rw-rw---- 1 root apache 2560000 Nov 30 00:51 >bayes_toks.expire13261 >-rw-rw---- 1 root apache 2752512 Nov 27 09:42 bayes_toks.expire133 >-rw-rw---- 1 root apache 5337088 Nov 27 09:02 >bayes_toks.expire13471 >-rw-rw---- 1 root apache 3059712 Nov 27 09:29 >bayes_toks.expire14351 >-rw-rw---- 1 root apache 12288 Nov 30 12:33 >bayes_toks.expire14793 >-rw-rw---- 1 root apache 2142208 Nov 30 04:11 >bayes_toks.expire15432 >-rw-rw---- 1 root apache 274432 Nov 30 11:08 >bayes_toks.expire15436 >-rw-rw---- 1 root apache 4927488 Nov 29 01:12 >bayes_toks.expire15914 >-rw-rw---- 1 root apache 2355200 Nov 29 02:06 >bayes_toks.expire15974 >-rw-rw---- 1 root apache 2699264 Nov 29 22:53 >bayes_toks.expire16419 >-rw-rw---- 1 root apache 163840 Nov 29 15:40 >bayes_toks.expire16507 >-rw-rw---- 1 root apache 4653056 Nov 30 05:39 >bayes_toks.expire16517 >-rw-rw---- 1 root apache 4935680 Nov 29 00:58 >bayes_toks.expire1711 >-rw-rw---- 1 root apache 5029888 Nov 29 00:45 >bayes_toks.expire17414 >-rw-rw---- 1 root apache 1122304 Nov 30 08:32 >bayes_toks.expire17539 >-rw-rw---- 1 root apache 5148672 Nov 27 10:36 >bayes_toks.expire18943 >-rw-rw---- 1 root apache 5357568 Nov 30 08:05 >bayes_toks.expire1969 >-rw-rw---- 1 root apache 1056768 Nov 30 09:26 >bayes_toks.expire20392 >-rw-rw---- 1 root apache 544768 Nov 30 00:25 >bayes_toks.expire2084 >-rw-rw---- 1 root apache 2461696 Nov 29 01:26 >bayes_toks.expire21259 >-rw-rw---- 1 root apache 4739072 Nov 27 11:16 >bayes_toks.expire22344 >-rw-rw---- 1 root apache 2510848 Nov 29 21:53 >bayes_toks.expire2275 >-rw-rw---- 1 root apache 2551808 Nov 30 08:18 >bayes_toks.expire23256 >-rw-rw---- 1 root apache 569344 Nov 30 05:52 >bayes_toks.expire24113 >-rw-rw---- 1 root apache 2351104 Nov 27 10:23 >bayes_toks.expire24319 >-rw-rw---- 1 root apache 2310144 Nov 29 23:07 >bayes_toks.expire24365 >-rw-rw---- 1 root apache 2363392 Nov 29 01:52 >bayes_toks.expire24667 >-rw-rw---- 1 root apache 2170880 Nov 27 11:43 >bayes_toks.expire25214 >-rw-rw---- 1 root apache 2211840 Nov 27 12:10 >bayes_toks.expire25267 >-rw-rw---- 1 root apache 1093632 Nov 30 00:38 >bayes_toks.expire26364 >-rw-rw---- 1 root apache 5324800 Nov 27 08:09 >bayes_toks.expire26535 >-rw-rw---- 1 root apache 4608000 Nov 29 02:19 >bayes_toks.expire28737 >-rw-rw---- 1 root apache 4771840 Nov 30 12:46 >bayes_toks.expire28786 >-rw-rw---- 1 root apache 5132288 Nov 27 10:09 >bayes_toks.expire28875 >-rw-rw---- 1 root apache 5341184 Nov 27 08:35 >bayes_toks.expire29113 >-rw-rw---- 1 root apache 303104 Nov 29 22:30 >bayes_toks.expire29845 >-rw-rw---- 1 root apache 2658304 Nov 29 23:20 bayes_toks.expire305 >-rw-rw---- 1 root apache 5296128 Nov 27 09:16 >bayes_toks.expire31065 >-rw-rw---- 1 root apache 2486272 Nov 30 10:55 >bayes_toks.expire31238 >-rw-rw---- 1 root apache 4923392 Nov 27 11:03 >bayes_toks.expire31526 >-rw-rw---- 1 root apache 1085440 Nov 29 22:06 >bayes_toks.expire31582 >-rw-rw---- 1 root apache 5062656 Nov 29 00:31 >bayes_toks.expire32174 >-rw-rw---- 1 root apache 1093632 Nov 30 10:41 >bayes_toks.expire32193 >-rw-rw---- 1 root apache 2199552 Nov 30 11:21 >bayes_toks.expire32422 >-rw-rw---- 1 root apache 4739072 Nov 29 02:32 >bayes_toks.expire5172 >-rw-rw---- 1 root apache 2396160 Nov 30 09:39 >bayes_toks.expire5634 >-rw-rw---- 1 root apache 4751360 Nov 30 13:00 >bayes_toks.expire6021 >-rw-rw---- 1 root apache 4325376 Nov 27 11:56 bayes_toks.expire604 >-rw-rw---- 1 root apache 2351104 Nov 29 21:39 >bayes_toks.expire6040 >-rw-rw---- 1 root apache 4632576 Nov 29 01:39 >bayes_toks.expire6310 >-rw-rw---- 1 root apache 4734976 Nov 30 05:26 >bayes_toks.expire6626 >-rw-rw---- 1 root apache 2588672 Nov 27 08:49 bayes_toks.expire674 >-rw-rw---- 1 root apache 2691072 Nov 30 11:39 >bayes_toks.expire6846 >-rw-rw---- 1 root apache 4751360 Nov 30 02:30 >bayes_toks.expire8590 >-rw-rw---- 1 root apache 4526080 Nov 30 02:16 >bayes_toks.expire8627 >-rw-rw---- 1 root apache 5353472 Nov 27 08:22 >bayes_toks.expire8718 >-rw-rw---- 1 root apache 5570560 Nov 30 03:58 >bayes_toks.expire9099 >-rw-rw---- 1 root apache 3006464 Nov 30 06:57 bayes_toks.expire922 >-rw-rw---- 1 root apache 5242880 Nov 30 10:07 >bayes_toks.expire9426 >-rw-rw---- 1 root apache 5341184 Nov 30 02:43 bayes_toks.expire958 > > > >i replace my fqdn with host here for anonymity. Let me know if you need any >other info > >Thanks for responding, > >Venkata Achanta > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Wed Dec 1 19:40:05 2004 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:27:47 2006 Subject: /var/mail filling up Message-ID: Hello all, I have a bit of an issue building on my main mail server. I hope these are appropriate to this list because I am thinking that it has something to do with MailScanner/MailWatch. If it is not, my apologies. My /var/ partition is filled almost to capacity and so I am trying to resolve this issue for very obvious reasons. A couple of things that perhaps someone here can help with. Problem #1:: When I run the command mailq, it says that /var/spool/mqueue is empty. However, there is 182 mb of mail in that directory. When I run mailq -OQueueDirectory=/var/spool/mqueue.in it says that the mqueue.in directory is also empty. but there is 44k worth of mail in there. So my questions is why the commands show these to be empty when they are not and how can I resolve this? Problem #2:: The server was never initially set up with quotas and so there are a good number of my email clients that leave messages on the server and fail to practice good housekeeping. So my question is: Is there a way to initiate directory quotas on the mail spool (or file size quotas perhaps being more correct?) after the fact? Is it considered ethical to delete mail in users mailboxes that are older than say 2 or three months? I have less than 5% space left on this partition and so this is a matter of some urgency. Again, if this is inappropriate for this list, please accept my apologies in advance. Dave ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marco at XSSNET.COM Wed Dec 1 19:54:24 2004 From: marco at XSSNET.COM (Marco Benton - BOFH) Date: Thu Jan 12 21:27:47 2006 Subject: Mqueue getting huge - MailScanner problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Venkata Achanta wrote: | Any input,here ? | <...snip...> have you tried blowing away all the lock files and restarting MS? you cant have a lock on the bayes dB when no bayes, spamd, or MS processes are running. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBriFv6T7cCxJsGOIRApCdAJ0U1uJkGP1QUQ2D4nl/e4xUDd6AGgCg0kM+ 3CPthHbjLm3cXE/R1CDgMx8= =uRMG -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cstone at AXINT.NET Wed Dec 1 20:26:24 2004 From: cstone at AXINT.NET (Chris Stone) Date: Thu Jan 12 21:27:47 2006 Subject: Only allow mail from 1 server Message-ID: I have this setup using qmail on the primary servers with qmail-spp patch and a script (plugin through qmail-spp) to check the sending mail server and if the connection if from an SMTP AUTH connection - works quite well and keeps the spammers and viruses from doing an 'end-around' the filtering servers running MailScanner. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Wednesday, December 01, 2004 5:45 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Only allow mail from 1 server No, not as far as I know. You need a firewall to protect it. If it's a Linux box then this is easy using IPtables (but don't ask me how). Paul Houselander - SME wrote: > Hi > > I have a machine running Mailscanner/Sendmail where users also pop > there mail off. > > I want to move MailScanner to a couple of machines that scan the mail > then forward onto the box where the users actually pop there mail off. > > Ill get rid of the current MX record for the POP machine and create MX > records for the 2 MailScanner Machines. I want to ensure the POP > machine can only recieve mail from the 2 front end MailScanner > Machines. I guess I can use a firewall to only allowing incomming > connections from the 2 machines but is there a way you can achieve > this within sendmail? > -- -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From andy at TIRESWING.NET Wed Dec 1 20:46:37 2004 From: andy at TIRESWING.NET (Andy Norris) Date: Thu Jan 12 21:27:47 2006 Subject: High Scoring Spam Actions not firing Message-ID: Hi, I upgraded MailScanner several days ago (to previous version), and since, it seems my high scoring actions are not firing. I have spam scoring higher than 10 going to another address (spamgreylist@...) and nothing is going there. Everyone is getting all the spam that's coming to them... Just marked with the report... Anything I should look at first? The header report is included... clearly high scoring! Thanks, Andy Content analysis details: (26.7 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 2.8 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary 0.1 HTML_60_70 BODY: Message is 60% to 70% HTML 0.1 HTML_MESSAGE BODY: HTML included in message 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100% [score: 1.0000] 0.3 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.6 MIME_HTML_NO_CHARSET RAW: Message text in HTML without charset 1.6 NO_DNS_FOR_FROM Domain in From header has no MX or A DNS records 1.2 RCVD_IN_SORBS_HTTP RBL: SORBS: sender is open HTTP proxy server [220.126.114.111 listed in dnsbl.sorbs.net] 2.3 RCVD_IN_NJABL_PROXY RBL: NJABL: sender is an open proxy [220.126.114.111 listed in combined.njabl.org] 0.0 RCVD_IN_SORBS_MISC RBL: SORBS: sender is open proxy server [220.126.114.111 listed in dnsbl.sorbs.net] 4.9 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL [220.126.114.111 listed in sbl-xbl.spamhaus.org] 0.4 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web server [220.126.114.111 listed in dnsbl.sorbs.net] 0.1 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address [220.126.114.111 listed in dnsbl.sorbs.net] 0.7 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org [] 1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see ] 1.7 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP [220.126.114.111 listed in combined.njabl.org] 1.2 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag 1.1 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts 0.7 MSGID_FROM_MTA_HEADER Message-Id was added by a relay ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Dec 1 21:22:23 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:47 2006 Subject: High Scoring Spam Actions not firing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Andy Norris wrote: > Hi, > > I upgraded MailScanner several days ago (to previous version), and since, > it seems my high scoring actions are not firing. I have spam scoring higher > than 10 going to another address (spamgreylist@...) and nothing is going > there. Everyone is getting all the spam that's coming to them... Just > marked with the report... > > Anything I should look at first? > > The header report is included... clearly high scoring! Please show us relevant entries in MailScanner.conf Thanks, Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Dec 1 21:23:04 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:47 2006 Subject: Subject not modified Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Andy Norris wrote: > Here's an email that's clearly spam, but this one did not have the subject > modified..? > > To: ... > Subject: Our little sceret > > Spam detection software, running on the system "...", has > identified this incoming email as possible spam. The original message > has been attached to this so you can view it (if it isn't spam) or block > similar future email. If you have any questions, see > for details. > Are you sure spamassassin isn't running by itself as well? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From andy at TIRESWING.NET Wed Dec 1 22:04:17 2004 From: andy at TIRESWING.NET (Andy Norris) Date: Thu Jan 12 21:27:47 2006 Subject: High Scoring Spam Actions not firing Message-ID: Hi Ugo, High Scoring Spam Modify Subject = yes High Scoring Spam Subject Text = [SPAM:_SCORE_] High SpamAssassin Score = 9 High Scoring Spam Actions = forward spamgreylist@tireswing.net And, to answer your other question... No. No I'm not sure spamassassin isn't running on its own as well. We've not had this kind of behavior before. Thanks Ugo, Andy At 03:22 pm 2004-12-01, you wrote: >Andy Norris wrote: >>Hi, >> >>I upgraded MailScanner several days ago (to previous version), and since, >>it seems my high scoring actions are not firing. I have spam scoring higher >>than 10 going to another address (spamgreylist@...) and nothing is going >>there. Everyone is getting all the spam that's coming to them... Just >>marked with the report... >> >>Anything I should look at first? >> >>The header report is included... clearly high scoring! > >Please show us relevant entries in MailScanner.conf >Thanks, > >Ugo > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From tony.johansson at SVENSKAKYRKAN.SE Wed Dec 1 22:07:25 2004 From: tony.johansson at SVENSKAKYRKAN.SE (Tony Johansson) Date: Thu Jan 12 21:27:47 2006 Subject: STRIPHTML CSS and Script problem Message-ID: The striphtml function lacks in one area. Javascript code and css is shown in emails when striphtml is active. I guess MailScanner assumes that everything betveen and is text, but with Last I heard, robot harvesters don't grok java. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Wed Dec 8 20:58:49 2004 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:27:53 2006 Subject: divert email, like archive, possible? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis, Thank you, this worked. My MailScanner.conf changes were: %localrules-dir% = /etc/MailScanner/rules Non Spam Actions = %localrules-dir%/nonspam.rules and my ruleset was: #---non-spam email delivery rules From: joeblow@colby.edu and To: testbot@colby.edu forward jaearick@colby.edu FromOrTo: default deliver With this ruleset, if joeblow sends testbot email, then it goes to me and does not end up in testbot's mailbox. If I send testbot email, it gets delivered. This is what I wanted. I knew MailScanner could do this... Julian, maybe this is worthy of the rules EXAMPLES file. Jeff Earickson Colby College On Wed, 8 Dec 2004, Denis Beauchemin wrote: > Date: Wed, 8 Dec 2004 14:52:43 -0500 > From: Denis Beauchemin > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: divert email, like archive, possible? > > Jeff A. Earickson wrote: > >> Julian, >> >> The boss just asked me if I can divert all email inbound from >> a badguy to a certain account here, and save it to an alternate >> mailbox. We have a case of a nasty divorce, where the harasser is >> elsewhere and the harassee works here. We want to divert and save >> the messages from the harasser and not have the harassee see them. >> And we want other messages to the harassee flow normally. >> >> Thinking that the Archive feature would do the trick, I set up an >> archive ruleset for testing: >> >> From: joeblow@colby.edu and To: jaearick@colby.edu /var/mail/a/archive >> default no >> >> Then I logged on as joeblow and sent a test email to myself. Archiving >> worked beautifully -- it snagged the test message to the archive file, and >> let everything else pass on. BUT it also delivered the test message into >> my mailbox; not what I wanted in this case. Any way to divert specific >> to/from email messages with MailScanner? >> >> Jeff Earickson >> Colby College >> > Jeff, > > I think you should use the "Non Spam Actions" rule instead of the archiving > one: > From: joeblow@colby.edu and To: jaearick@colby.edu forward someone@colby.edu > default deliver > > Denis > PS: I'm not sure if you also need "delete" before the forward clause... > > -- > _ > °v° Denis Beauchemin, analyste > /(_)\ Université de Sherbrooke, S.T.I. > ^ ^ T: 819.821.8000x2252 F: 819.821.8045 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Wed Dec 8 20:59:23 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:27:53 2006 Subject: divert email, like archive, possible? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Jeff, > > I think you should use the "Non Spam Actions" rule instead of the > archiving one: > From: joeblow@colby.edu and To: jaearick@colby.edu forward > someone@colby.edu > default deliver > > Denis > PS: I'm not sure if you also need "delete" before the forward clause... I agree with this approach. I was asked the same question by a client and thought of this but for different reasons it's not been implemented yet. It should work though. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From csweeney at OSUBUCKS.ORG Thu Dec 9 03:20:25 2004 From: csweeney at OSUBUCKS.ORG (Chris Sweeney) Date: Thu Jan 12 21:27:53 2006 Subject: Problems with SpamAssassin 3.0.1 timing out Message-ID: That means SPamAssassin was taking to long to process the message and it was killed for that reason. You can adjust this setting in your conf. But you probly have a more serious problem to figure out why SpamAssassin is taking so long to process a message. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Paul Welsh Sent: Wednesday, December 08, 2004 8:31 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Problems with SpamAssassin 3.0.1 timing out Can someone tell me how to get MailScanner to kill SpamAssassin reliably? I am seeing this kind of thing: SpamAssassin timed out and was killed, failure 11 of 10 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Wed Dec 8 23:59:03 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:27:53 2006 Subject: Header infomration appearing in body of emails Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michael Freeman wrote: > Thank you, that worked! Julian told you so (from the comments directly above %org-name%): # RULE: It must not contain any spaces! ;-) -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paul at WELSHFAMILY.COM Thu Dec 9 01:31:07 2004 From: paul at WELSHFAMILY.COM (Paul Welsh) Date: Thu Jan 12 21:27:53 2006 Subject: Problems with SpamAssassin 3.0.1 timing out Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Can someone tell me how to get MailScanner to kill SpamAssassin reliably? I am seeing this kind of thing: SpamAssassin timed out and was killed, failure 11 of 10 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From admin at thenamegame.com Wed Dec 8 23:24:09 2004 From: admin at thenamegame.com (Michael Freeman) Date: Thu Jan 12 21:27:53 2006 Subject: Header infomration appearing in body of emails Message-ID: I cant seem to track down this issue; All msgs arriving have the following tagged in the body of every email; X-Cpanel Server-MailScanner-Information: Please contact the ISP for more information X-Cpanel Server-MailScanner: Found to be clean X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname – test.net X-AntiAbuse: Original Domain – test.com X-AntiAbuse: Originator/Caller UID/GID - [32003 32004] / [0 0] X-AntiAbuse: Sender Address Domain – test.net X-Source: X-Source-Args: X-Source-Dir: Test msg I just copied the identical MailScanenr.conf from one of my other servers to my new installation and the MS version are identical. Why is this happening and how can I turn it off? Iv looked at the options and can find why this is happening. NOTE: The header information appears in the body of each message and not in the header as it should. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Wed Dec 8 23:30:43 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:53 2006 Subject: Header infomration appearing in body of emails Message-ID: ________________________________________ From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Michael Freeman Sent: Wednesday, December 08, 2004 6:24 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Header infomration appearing in body of emails I cant seem to track down this issue; All msgs arriving have the following tagged in the body of every email; X-Cpanel Server-MailScanner-Information: Please contact the ISP for more information X-Cpanel Server-MailScanner: Found to be clean X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - test.net X-AntiAbuse: Original Domain - test.com X-AntiAbuse: Originator/Caller UID/GID - [32003 32004] / [0 0] X-AntiAbuse: Sender Address Domain - test.net X-Source: X-Source-Args: X-Source-Dir: Test msg I just copied the identical MailScanenr.conf from one of my other servers to my new installation and the MS version are identical. Why is this happening and how can I turn it off? Iv looked at the options and can find why this is happening. NOTE: The header information appears in the body of each message and not in the header as it should. Are you running c-panel? :>( What does MailScanner -V report on the sick and well systems? Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Dec 8 23:36:22 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:53 2006 Subject: Header infomration appearing in body of emails Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] At 06:24 PM 12/8/2004, Michael Freeman wrote: >I cant seem to track down this issue; > >All msgs arriving have the following tagged in the body of every email; > >X-Cpanel Server-MailScanner-Information: Please contact the ISP for more >information X-Cpanel Server-MailScanner: Found to be clean >X-AntiAbuse: This header was added to track abuse, please include it with >any abuse report >X-AntiAbuse: Primary Hostname ^Ö test.net >X-AntiAbuse: Original Domain ^Ö test.com >X-AntiAbuse: Originator/Caller UID/GID - [32003 32004] / [0 0] >X-AntiAbuse: Sender Address Domain ^Ö test.net >X-Source: >X-Source-Args: >X-Source-Dir: > >Test msg > >I just copied the identical MailScanenr.conf from one of my other servers >to my new installation and the MS version are identical. Why is this >happening and how can I turn it off? Iv looked at the options and can find >why this is happening. > >NOTE: The header information appears in the body of each message and not >in the header as it should. Is your %org-name% in mailscanner.conf set to: %org-name%=Cpanel Server If so, change it to Cpanel-Server. No spaces are allowed in header names, and org-name is used to generate headers. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Wed Dec 8 23:35:51 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:27:53 2006 Subject: Header infomration appearing in body of emails Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michael Freeman wrote: > X-Cpanel Server-MailScanner-Information: Please contact the ISP for more > information X-Cpanel Server-MailScanner: Found to be clean For one thing, if it's your server adding the "headers" you can't have spaces in your org name: Cpanel Server. Change it to one word. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Wed Dec 8 23:34:07 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:53 2006 Subject: Problems with SpamAssassin 3.0.1 timing out Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Paul Welsh > Sent: Wednesday, December 08, 2004 5:46 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Problems with SpamAssassin 3.0.1 timing out > > ----- Original Message ----- > From: "Martin Hepworth" > To: > Sent: Wednesday, December 08, 2004 11:36 AM > Subject: Re: Problems with SpamAssassin 3.0.1 timing out > > > > Paul > > have you got the latest version of Net::DNS installed? > > > Yes, I installed the latest Net::DNS (version 0.48). > > I think it's a network problem. Others with co-located servers in the > same > location are having problems, apparently. > This is almost always a network or connectivity issue. Since none of the Pyzor, razor, dcc, etc servers are down right now I'd bet big money that it's a localized problem. Please let us know the resolution so the thread will have an answer. Thanks, Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From admin at thenamegame.com Wed Dec 8 23:53:16 2004 From: admin at thenamegame.com (Michael Freeman) Date: Thu Jan 12 21:27:53 2006 Subject: Header infomration appearing in body of emails Message-ID: Thank you, that worked! -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Peter Bonivart Sent: Wednesday, December 08, 2004 6:36 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Header infomration appearing in body of emails Michael Freeman wrote: > X-Cpanel Server-MailScanner-Information: Please contact the ISP for more > information X-Cpanel Server-MailScanner: Found to be clean For one thing, if it's your server adding the "headers" you can't have spaces in your org name: Cpanel Server. Change it to one word. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Dec 8 22:00:22 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:53 2006 Subject: inconsistent SPF warning Message-ID: At 01:48 PM 12/8/2004, Mark Nienberg wrote: > > Mark Nienberg wrote: > > > >> It appeared that SA wasn't always using the value of > >> "envelope_sender_header". (I assume MailScanner really does pass the > >> correct value to SA, because I'm pretty sure Julian is infallible). > > > > > > It uses the "Envelope From Header" from your MailScanner.conf, which by > > default is "X-MailScanner-From". And it puts it as the first header in > > what is passed to SA, so that SA trusts it. > > >Yes. After which SA apparently sometimes chooses to use an address form >some other header instead. Something worth testing might be to move the envelope_sender_header setting out of spam.assassin.prefs.conf and into local.cf. It could be that some of the new spamd semantics that reset the user_prefs after each message might be tripping up MailScanner. If it happened,the result would be that a given MailScanner child only uses the spam.assassin.prefs.conf for the first message it handles, then reverts to local.cf only until it was killed and respawned. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paul at WELSHFAMILY.COM Wed Dec 8 22:45:37 2004 From: paul at WELSHFAMILY.COM (Paul Welsh) Date: Thu Jan 12 21:27:53 2006 Subject: Problems with SpamAssassin 3.0.1 timing out Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ----- Original Message ----- From: "Martin Hepworth" To: Sent: Wednesday, December 08, 2004 11:36 AM Subject: Re: Problems with SpamAssassin 3.0.1 timing out > Paul > have you got the latest version of Net::DNS installed? Yes, I installed the latest Net::DNS (version 0.48). I think it's a network problem. Others with co-located servers in the same location are having problems, apparently. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 9 09:33:54 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:53 2006 Subject: inconsistent SPF warning Message-ID: On 8/12/04 10:00 pm, "Matt Kettler" wrote: > At 01:48 PM 12/8/2004, Mark Nienberg wrote: >>> Mark Nienberg wrote: >>> >>>> It appeared that SA wasn't always using the value of >>>> "envelope_sender_header". (I assume MailScanner really does pass the >>>> correct value to SA, because I'm pretty sure Julian is infallible). >>> >>> >>> It uses the "Envelope From Header" from your MailScanner.conf, which by >>> default is "X-MailScanner-From". And it puts it as the first header in >>> what is passed to SA, so that SA trusts it. >>> >> Yes. After which SA apparently sometimes chooses to use an address form >> some other header instead. > > Something worth testing might be to move the envelope_sender_header setting > out of spam.assassin.prefs.conf and into local.cf. > > It could be that some of the new spamd semantics that reset the user_prefs > after each message might be tripping up MailScanner. If it happened,the > result would be that a given MailScanner child only uses the > spam.assassin.prefs.conf for the first message it handles, then reverts to > local.cf only until it was killed and respawned. But MailScanner doesn't use spamd... -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From andreas.svensson at HALLSBERG.SE Thu Dec 9 13:38:15 2004 From: andreas.svensson at HALLSBERG.SE (Andreas Svensson) Date: Thu Jan 12 21:27:53 2006 Subject: Mailscanner and Panda-wrapper. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi. I'm installing Mailscanner and have some problems with panda-wrapper. The clamav-wrapper works great but i want both. I have read the mailinglist and found one with similar problems. It takes very long time when issuing command: /opt/MailScanner/lib/panda-wrapper /usr -AEX -CMP -AUT -NSO -HEU . But if i add -ESP i get: Virus: 0 Even though it is viruses in . I think it has something to do with the language. If i run pavcl with the -ESP i get some strange chars: Tiempo empleado para analizar .............: 00:00:00 Número de ficheros analizados .............: 211 Número de ficheros infectados .............: 2 Número de ficheros desinfectados ..........: 0 Número de ficheros renombrados ............: 0 Número de ficheros borrados ...............: 0 Maybe because i have swedish/english on my server. The server by the way is a SLES 9. So it would probably work with the -ESP if i changes some language settings. But it still takes like several minutes to scan only a few files. Thanks in advance. Sincerely, Andreas Svensson ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mspieth at NEOD.NET Thu Dec 9 14:49:04 2004 From: mspieth at NEOD.NET (Mark Spieth) Date: Thu Jan 12 21:27:53 2006 Subject: quarantined message Message-ID: We had a message quarantined today with the following message. At Wed Dec 8 15:54:53 2004 the virus scanner said: Too many attachments in message Too many attachments in message Note to Help Desk: Look on mx2.neod.net in /var/spool/MailScanner/quarantine/20041208 (message iB8KrYDb012998). I have the file that mailscanner placed in the above directory. It looks like an mbox format, but it will not actually open, Any ideas? Thanks Mark Mark Spieth - Director of Internet Services Northeast Ohio Digital Inc. http://www.neod.net mspieth@neod.net 330-830-6551 CONFIDENTIALITY NOTICE: The materials attached hereto are confidential and the property of the sender. The information contained in the attached materials is privileged and/or confidential and is intended only for the use of the above-named individual(s) or entity(ies). If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution or the taking of any action in reliance on the contents of the attached information is strictly prohibited. If you have received this transmission in error, please discard the information immediately ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From derek at ADCATANZARO.COM Thu Dec 9 15:21:18 2004 From: derek at ADCATANZARO.COM (Derek Catanzaro) Date: Thu Jan 12 21:27:53 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Fedora Core 1 mailscanner-4.31.6-1 sendmail-8.12.10-1.1.1 Recently I have been receiving the following in the mailq "Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL". The email is trying to be delivered locally to root. I'm receiving anywhere from 300-500 of these on a daily basis and it seems to be effecting mail routing as a whole if I don't go thru and delete the emails in the queue. Sendmail is my MTA. Any suggestions I can get would be great. Thanks for your time. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KShortt at AZERTY.COM Thu Dec 9 15:51:05 2004 From: KShortt at AZERTY.COM (Shortt, Kevin) Date: Thu Jan 12 21:27:53 2006 Subject: No subject Message-ID: Hi Everyone, I just did an emergency rebuild of a server and pulled configs from backup and fired things up. Mail is flowing, yet some weirdness is occurring. See my header entry below. It declares it as spam yet scores it below the required number. Is this an easy diagnosis for any one on this list? X-MailScanner-SpamCheck: spam, SBL+XBL, SpamAssassin (score=3.5, required 6, FORGED_MUA_OUTLOOK 3.48) mailscanner-4.36.4-1 spamassassin-2.55-3.1 Red Hat Enterprise Linux ES release 3 (Taroon) Linux 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 GNU/Linux Thanks.. -k ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Dec 9 15:56:51 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:53 2006 Subject: Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Thu, December 9, 2004 15:51, Shortt, Kevin said: > It declares it as spam yet scores it below the required number. Is this an > easy diagnosis for any one on this list? > > X-MailScanner-SpamCheck: spam, SBL+XBL, SpamAssassin (score=3.5, required The clue is here ---------------^^^^^^^^ MailScanner has run RBL checks and the sending IP address is lised in the Spamhous RBL. SA has either not checked (Have you got Net::DNS installed?) or you have turned off DNS checks so has not flagged this. Check MailScanner.conf for spam list settings. HTH Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Thu Dec 9 15:59:29 2004 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:27:53 2006 Subject: No subject Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Shortt, Kevin wrote: > Hi Everyone, > > I just did an emergency rebuild of a server and pulled configs from backup > and fired things up. > Mail is flowing, yet some weirdness is occurring. See my header entry below. > It declares it as spam yet scores it below the required number. Is this an > easy diagnosis for any one on this list? > > X-MailScanner-SpamCheck: spam, SBL+XBL, SpamAssassin (score=3.5, required 6, > FORGED_MUA_OUTLOOK 3.48) > > > > mailscanner-4.36.4-1 > spamassassin-2.55-3.1 > Red Hat Enterprise Linux ES release 3 (Taroon) > Linux 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 > GNU/Linux > > > Thanks.. > > -k Are you checking rbls at the mailscanner level, the mail probably returned positive for a few rbls (3 or more is spam by default), what rbls are you using in MailScanner.conf? Also check the originating IP in openrbl.org or dnsstuff.com for rbl listings. Check the following in MailScanner.conf Spam List Definitions Spam List Spam Domain List Spam Lists To Reach High Score - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ELIQUID.COM Thu Dec 9 16:03:33 2004 From: mailscanner at ELIQUID.COM (Wess) Date: Thu Jan 12 21:27:53 2006 Subject: quarantined message Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mark, This is what happens when MailScanner stops dangerous content, and in this case, too many attachments. The file you see is actually a queue file for the message. You should see the attachments stored with the queue file. Use this command to send the message to a recipient. sendmail -i email@domain.tld < queue_file On Thu, 2004-12-09 at 09:49, Mark Spieth wrote: We had a message quarantined today with the following message. At Wed Dec 8 15:54:53 2004 the virus scanner said: Too many attachments in message Too many attachments in message Note to Help Desk: Look on mx2.neod.net in /var/spool/MailScanner/quarantine/20041208 (message iB8KrYDb012998). I have the file that mailscanner placed in the above directory. It looks like an mbox format, but it will not actually open, Any ideas? Thanks Mark Mark Spieth - Director of Internet Services Northeast Ohio Digital Inc. http://www.neod.net mspieth@neod.net 330-830-6551 CONFIDENTIALITY NOTICE: The materials attached hereto are confidential and the property of the sender. The information contained in the attached materials is privileged and/or confidential and is intended only for the use of the above-named individual(s) or entity(ies). If you are not the intended recipient, be advised that any unauthorized disclosure, copying, distribution or the taking of any action in reliance on the contents of the attached information is strictly prohibited. If you have received this transmission in error, please discard the information immediately ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! MailScanner on IRC Community Support irc.freenode.net #mailscanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From davidj at synaq.com Thu Dec 9 15:38:16 2004 From: davidj at synaq.com (David Jacobson) Date: Thu Jan 12 21:27:53 2006 Subject: quarantined message Message-ID: Hi, Try and edit the file and see any inconsistencies, generally a whitespace at the top or a missing From line or something like that, remove the offending line(s) and all should be ok. On Thu, 2004-12-09 at 09:49 -0500, Mark Spieth wrote: > We had a message quarantined today with the following message. > > At Wed Dec 8 15:54:53 2004 the virus scanner said: > Too many attachments in message > Too many attachments in message > > Note to Help Desk: Look on mx2.neod.net in > /var/spool/MailScanner/quarantine/20041208 (message iB8KrYDb012998). > > I have the file that mailscanner placed in the above directory. It looks > like an mbox format, but it will not actually open, Any ideas? > > > Thanks > > Mark > > Mark Spieth - Director of Internet Services > > Northeast Ohio Digital Inc. > > http://www.neod.net > > mspieth@neod.net > > 330-830-6551 > > > > CONFIDENTIALITY NOTICE: The materials attached hereto are confidential > and the property of the sender. The information contained in the > attached materials is privileged and/or confidential and is intended > only for the use of the above-named individual(s) or entity(ies). If you > are not the intended recipient, be advised that any unauthorized > disclosure, copying, distribution or the taking of any action in > reliance on the contents of the attached information is strictly > prohibited. If you have received this transmission in error, please > discard the information immediately > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Regards, David Jacobson Technical Director SYNAQ (Pty) Ltd Tel: 011 290 6388 Fax: 011 290 6389 Cell: 083 235 0760 Mail: davidj@synaq.com Web: http://www.synaq.com Key Fingerprint 8246 FCE1 3C22 7EFB E61B 18DF 6E8B 65E8 BD50 78A1 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 196bytes. ] [ Unable to print this part. ] From MailScanner at OMNICOMP.ORG Thu Dec 9 16:49:54 2004 From: MailScanner at OMNICOMP.ORG (Alan Dobkin) Date: Thu Jan 12 21:27:53 2006 Subject: Duplicate emails - same smtp id processed by different MS processes. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 12/7/2004 12:34 PM, Julian Field wrote: > With sendmail-8.13 on Linux systems, you need to set > "Lock Type = posix" in MailScanner.conf. FWIW, I upgraded my server from Fedora Core 2 to Fedora Core 3 and around the same time upgraded MailScanner to version 4.36.1-1. Fedora Core 3 included sendmail 8.13 (previously 8.12 in Core 2), and I didn't realize that the locking method had changed. Around the same time, the MailScanner.conf file, which used to default to "Lock Type = flock" was changed to just "Lock Type = " (blank), so I suspected MailScanner may be causing the problem, but making the change to "Lock Type = posix" seems to do the trick. In retrospect, I now see that the sendmail release notes warned about this change over 2 years ago, back in release 8.12.5: 8.12.5/8.12.5 2002/06/25 NOTE: Linux appears to have broken flock() again. Unless the bug is fixed before sendmail 8.13 is shipped, 8.13 will change the default locking method to fcntl() for Linux kernel 2.4 and later. You may want to do this in 8.12 by compiling with -DHASFLOCK=0. Be sure to update other sendmail related programs to match locking techniques. So, this begs the question, why not set "Lock Type = fcntl" instead of posix in MailScanner? Does it not understand this method? Thanks, Alan -- Reclaim Your Inbox - Get Thunderbird! http://www.Mozilla.org/products/thunderbird/ Rediscover the Web - Get Firefox! http://www.SpreadFirefox.com/?q=affiliates&id=21548&t=68 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at OMNICOMP.ORG Thu Dec 9 16:55:39 2004 From: MailScanner at OMNICOMP.ORG (Alan Dobkin) Date: Thu Jan 12 21:27:53 2006 Subject: MailScanner: Beta release 4.37.1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 12/8/2004 6:39 AM, Julian Field wrote: > I have just released the a new beta 4.37.1. I don't see this release on the web site, only 4.36.4. Is it hidden somewhere, or has it been pulled? Thanks, Alan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ccampbell at BRUEGGERS.COM Thu Dec 9 17:05:11 2004 From: ccampbell at BRUEGGERS.COM (Christian Campbell) Date: Thu Jan 12 21:27:53 2006 Subject: No subject Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > I just did an emergency rebuild of a server and pulled > configs from backup > and fired things up. > Mail is flowing, yet some weirdness is occurring. See my > header entry below. > It declares it as spam yet scores it below the required > number. Is this an > easy diagnosis for any one on this list? > > X-MailScanner-SpamCheck: spam, SBL+XBL, SpamAssassin > (score=3.5, required 6, > FORGED_MUA_OUTLOOK 3.48) It looks like it's hitting on SBL+XBL. I assume then that you have SBL+XBL in your "Spam List" in MailScanner.conf. Wouldn't that be why it's tagged as spam? Christian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 9 17:57:50 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:53 2006 Subject: No subject Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It was found to be in the SBL+XBL blacklist (see your "Spam List = " setting in MailScanner.conf) and so was marked as spam. Shortt, Kevin wrote: >Hi Everyone, > >I just did an emergency rebuild of a server and pulled configs from backup >and fired things up. >Mail is flowing, yet some weirdness is occurring. See my header entry below. >It declares it as spam yet scores it below the required number. Is this an >easy diagnosis for any one on this list? > >X-MailScanner-SpamCheck: spam, SBL+XBL, SpamAssassin (score=3.5, required 6, >FORGED_MUA_OUTLOOK 3.48) > > > >mailscanner-4.36.4-1 >spamassassin-2.55-3.1 >Red Hat Enterprise Linux ES release 3 (Taroon) >Linux 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 >GNU/Linux > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 9 18:00:39 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:53 2006 Subject: MailScanner: Beta release 4.37.1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alan Dobkin wrote: > On 12/8/2004 6:39 AM, Julian Field wrote: > >> I have just released the a new beta 4.37.1. > > > I don't see this release on the web site, only 4.36.4. > Is it hidden somewhere, or has it been pulled? > Ah, that would explain why no-one has downloaded it. I forgot to copy the new index and downloads web pages onto the web server. Strange how no-one else bothered to report it... Fixed now, sorry! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at OMNICOMP.ORG Thu Dec 9 18:04:38 2004 From: MailScanner at OMNICOMP.ORG (Alan Dobkin) Date: Thu Jan 12 21:27:53 2006 Subject: MailScanner: Beta release 4.37.1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On 12/9/2004 1:00 PM, Julian Field wrote: > Alan Dobkin wrote: > >> On 12/8/2004 6:39 AM, Julian Field wrote: >> >>> I have just released the a new beta 4.37.1. >> >> I don't see this release on the web site, only 4.36.4. >> Is it hidden somewhere, or has it been pulled? >> > Ah, that would explain why no-one has downloaded it. I forgot to copy > the new index and downloads web pages onto the web server. Strange how > no-one else bothered to report it... > > Fixed now, sorry! No problem, thanks! I actually managed to download it just after I sent my message to the list, simply by using the previous download URL and changing the version manually. :-) Alan -- Reclaim Your Inbox - Get Thunderbird! Rediscover the Web - Get Firefox! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Dec 9 19:48:40 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:53 2006 Subject: inconsistent SPF warning Message-ID: At 04:33 AM 12/9/2004, Julian Field wrote: > >> Yes. After which SA apparently sometimes chooses to use an address form > >> some other header instead. > > > > Something worth testing might be to move the envelope_sender_header setting > > out of spam.assassin.prefs.conf and into local.cf. > > > > It could be that some of the new spamd semantics that reset the user_prefs > > after each message might be tripping up MailScanner. If it happened,the > > result would be that a given MailScanner child only uses the > > spam.assassin.prefs.conf for the first message it handles, then reverts to > > local.cf only until it was killed and respawned. > >But MailScanner doesn't use spamd... This is true, and I'm well aware of it. I chose poor wording. The problem I'm speaking to would not affect anyone actually using spamd, it only affects those using the perl API. ie: MailScanner. MailScanner does not use spamd, however, MailScanner uses the SA Perl API. That API is also used by spamd, and there are aspects of the API which are intentionally designed to support the needs of spamd. These spamd-specific semantics of the API can impact MailScanner when they change. I was specifically referring to semantics in the perl API that accommodate spamd's need to have the user_prefs unloaded after each message. I've not studied how they are implemented in SA 3.0, but they are in fact new to 3.0 (older spamd's didn't prefork thus didn't need clearing, 3.0 does prefork and re-use children.) If MailScanner doesn't reload spam.assassin.prefs.conf each time a message is fed to the API, those settings could be unloaded automaticaly by the APIs internals. Of course, this is all speculation, I've not checked the code, but it's based on a reasonably good knowledge of how spamd and MailScanner work. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 9 19:55:45 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:53 2006 Subject: inconsistent SPF warning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Matt Kettler wrote: > At 04:33 AM 12/9/2004, Julian Field wrote: > >> >> Yes. After which SA apparently sometimes chooses to use an >> address form >> >> some other header instead. >> > >> > Something worth testing might be to move the envelope_sender_header >> setting >> > out of spam.assassin.prefs.conf and into local.cf. >> > >> > It could be that some of the new spamd semantics that reset the >> user_prefs >> > after each message might be tripping up MailScanner. If it >> happened,the >> > result would be that a given MailScanner child only uses the >> > spam.assassin.prefs.conf for the first message it handles, then >> reverts to >> > local.cf only until it was killed and respawned. >> >> But MailScanner doesn't use spamd... > > > This is true, and I'm well aware of it. I chose poor wording. > > The problem I'm speaking to would not affect anyone actually using spamd, > it only affects those using the perl API. ie: MailScanner. > > MailScanner does not use spamd, however, MailScanner uses the SA Perl > API. > That API is also used by spamd, and there are aspects of the API which > are > intentionally designed to support the needs of spamd. These > spamd-specific > semantics of the API can impact MailScanner when they change. > > I was specifically referring to semantics in the perl API that > accommodate > spamd's need to have the user_prefs unloaded after each message. I've not > studied how they are implemented in SA 3.0, but they are in fact new > to 3.0 > (older spamd's didn't prefork thus didn't need clearing, 3.0 does prefork > and re-use children.) If MailScanner doesn't reload > spam.assassin.prefs.conf each time a message is fed to the API, those > settings could be unloaded automaticaly by the APIs internals. > > Of course, this is all speculation, I've not checked the code, but it's > based on a reasonably good knowledge of how spamd and MailScanner work. How, in the SA 3.0 API, do I stop it from unloading spam.assassin.prefs.conf after each message? Or, if I can't do that, how do I make it re-read it? I would obviously rather do the former. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Dec 9 20:21:55 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:53 2006 Subject: inconsistent SPF warning Message-ID: At 02:55 PM 12/9/2004, Julian Field wrote: >How, in the SA 3.0 API, do I stop it from unloading >spam.assassin.prefs.conf after each message? Or, if I can't do that, how >do I make it re-read it? I would obviously rather do the former. I'm looking at the code now. Looking at spamd, they use SpamAssassin.pm's copy_config() to save, then later restore the base configuration, so I *think* MailScanner is safe on this, but I'm not sure if there's no clearing of the conf object after it's been used... However, it's still worth testing if anybody who uses SA 3.0 can... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ka at PACIFIC.NET Thu Dec 9 20:56:23 2004 From: ka at PACIFIC.NET (Ken A) Date: Thu Jan 12 21:27:53 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Is root over quota? Does procmail have permission to write to /var/mail/root ? Or, turn sendmail logging up to 14 to see more info. Ken Derek Catanzaro wrote: > Fedora Core 1 > mailscanner-4.31.6-1 > sendmail-8.12.10-1.1.1 > > Recently I have been receiving the following in the mailq "Deferred: > local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL". The email is > trying to be delivered locally to root. I'm receiving anywhere from > 300-500 of these on a daily basis and it seems to be effecting mail > routing as a whole if I don't go thru and delete the emails in the > queue. Sendmail is my MTA. Any suggestions I can get would be great. > Thanks for your time. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mbowman at UDCOM.COM Thu Dec 9 20:57:16 2004 From: mbowman at UDCOM.COM (Matthew Bowman) Date: Thu Jan 12 21:27:53 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Message-ID: Is the root mailbox over 2GB? Matthew K Bowman Systems Administrator Ken A Sent by: MailScanner mailing list 12/09/2004 03:56 PM Please respond to MailScanner mailing list To: MAILSCANNER@JISCMAIL.AC.UK cc: Subject: Re: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Is root over quota? Does procmail have permission to write to /var/mail/root ? Or, turn sendmail logging up to 14 to see more info. Ken Derek Catanzaro wrote: > Fedora Core 1 > mailscanner-4.31.6-1 > sendmail-8.12.10-1.1.1 > > Recently I have been receiving the following in the mailq "Deferred: > local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL". The email is > trying to be delivered locally to root. I'm receiving anywhere from > 300-500 of these on a daily basis and it seems to be effecting mail > routing as a whole if I don't go thru and delete the emails in the > queue. Sendmail is my MTA. Any suggestions I can get would be great. > Thanks for your time. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at LISTS.COM.AR Thu Dec 9 18:04:13 2004 From: mailscanner at LISTS.COM.AR (Leonardo Helman) Date: Thu Jan 12 21:27:53 2006 Subject: MailScanner: Beta release 4.37.1 Message-ID: Same place as stable releases Look in: -- Leonardo Helman Pert Consultores Argentina On Thu, Dec 09, 2004 at 11:55:17AM -0500, Alan Dobkin wrote: > On 12/8/2004 6:39 AM, Julian Field wrote: > >I have just released the a new beta 4.37.1. > > I don't see this release on the web site, only 4.36.4. > Is it hidden somewhere, or has it been pulled? > > Thanks, > Alan > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at LISTS.COM.AR Thu Dec 9 18:05:49 2004 From: mailscanner at LISTS.COM.AR (Leonardo Helman) Date: Thu Jan 12 21:27:53 2006 Subject: MailScanner: Beta release 4.37.1 Message-ID: I've downloaded. ZMailer.pm have \s* instead of \s+, but InHeader is the old one. On Thu, Dec 09, 2004 at 06:00:17PM +0000, Julian Field wrote: > Alan Dobkin wrote: > > >On 12/8/2004 6:39 AM, Julian Field wrote: > > > >>I have just released the a new beta 4.37.1. > > > > > >I don't see this release on the web site, only 4.36.4. > >Is it hidden somewhere, or has it been pulled? > > > Ah, that would explain why no-one has downloaded it. I forgot to copy > the new index and downloads web pages onto the web server. Strange how > no-one else bothered to report it... > > Fixed now, sorry! > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 9 21:11:39 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:53 2006 Subject: MailScanner: Beta release 4.37.1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What file and line are you talking about? Leonardo Helman wrote: >I've downloaded. > >ZMailer.pm have \s* instead of \s+, but InHeader is the old one. > > > > >On Thu, Dec 09, 2004 at 06:00:17PM +0000, Julian Field wrote: > > >>Alan Dobkin wrote: >> >> >> >>>On 12/8/2004 6:39 AM, Julian Field wrote: >>> >>> >>> >>>>I have just released the a new beta 4.37.1. >>>> >>>> >>>I don't see this release on the web site, only 4.36.4. >>>Is it hidden somewhere, or has it been pulled? >>> >>> >>> >>Ah, that would explain why no-one has downloaded it. I forgot to copy >>the new index and downloads web pages onto the web server. Strange how >>no-one else bothered to report it... >> >>Fixed now, sorry! >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Fri Dec 10 04:57:02 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:53 2006 Subject: inconsistent SPF warning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris Picciotto wrote: > Sorry -- I seem unable to post to the list. I registered... but > perhaps it takes some time to reflect the registration. > > Anyway - thought you might be interested. > Chris I'll post it for you. Mark Nienberg > > Just a couple thoughts here. > > After going through this whole SpamAssassin 3.0.1 with SPF posts and > all the > recommended header structures, I found the following. > > Turning OFF MailScanner's added header. > Turning ON Sendmail's Envelope-From header > > This worked just fine. Then, I turned OFF the sendmail header, and turned > OFF spamassassins envelope-from config - and it works perfectly. > SpamAssassin 3.0.1 has pretty smart header parsing, and finds the > appropriate "From". All SPF checks are working great. > Hmm. On my system with both OFF, I don't get any SPF checks at all. (Except the SPF_HELLO stuff). I don't think there is an appropriate "from" in the headers when sendmail's X-Envelope-From is off (except for the one that MailScanner adds). Mark > With respect to below - I am not sure it is related, but AWL (I assume > Auto > WhiteList) is still being "scored", even though I have that config set to > "no" in MailScanner.conf. That is odd... but may be related to how > SpamAssassin is getting its configuration. > > Chris For SA 3 you need to add use_auto_whitelist 0 to your spam.assassin.prefs.conf. The setting in MailScanner.conf doesn't work with SA3. Mark Nienberg ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billox at BILLOX.COM Fri Dec 10 07:14:50 2004 From: billox at BILLOX.COM (James Page) Date: Thu Jan 12 21:27:53 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, Sorry to hijack this thread but I'm having a problem with SA 3.0.1 and MailScanner 4.36.4-1 on Fedora Core 3 (Postfix) I installed MailScanner when SA 2.55 was installed, I subseqently used yum to upgrade SA to version 3.0.1 It would start with no errors but the X flags in processed mail still indicated it was using 2.55 I then installed the rpm version of install-Clam-SA.tar.gz - it did all the perl stuff then told me SA 3.0.1 was already installed Now when I start MailScanner I get the following errors..... Dec 10 17:12:30 mars MailScanner[9300]: MailScanner E-Mail Virus Scanner version 4.36.4 starting... Dec 10 17:12:30 mars MailScanner[9300]: Could not read Custom Functions directory Dec 10 17:12:30 mars MailScanner[9260]: Spam Checks: Starting Dec 10 17:12:30 mars MailScanner[9300]: Syntax error in line 1291, value "" for checksaifonspamlist is not one of allowed values "yes","no" Dec 10 17:12:30 mars MailScanner[9300]: Syntax error in line 1303, value "" for logpermittedfilenames is not one of allowed values "yes","no" Dec 10 17:12:30 mars MailScanner[9300]: Syntax error in line 1304, value "" for logpermittedfiletypes is not one of allowed values "yes","no" Dec 10 17:12:30 mars MailScanner[9300]: Syntax error in line 1292, value "" for spamstars is not one of allowed values "yes","no" It still works, albeit still using SA 2.55 I can't seem to find anywhere to tell MailScanner where to get SA from. I'm also thinking that MailScanner has it's own internel version of SA? Totally confused, any pointers would be greatly appreciated. Thanks James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Dec 10 07:23:32 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:53 2006 Subject: New Installer questions Sorry :-) Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, We had Steve install at our office and things are working fine. I like it so much I want to run it for my own email system. I have two questions. 1. Which LInux Flavour is the best to install onto? I have SUSE 9.1 SUSE 9.2 And can get Fedora. My limited skills are on SUSE but it redhat is the better one I am willing to learn. 2. What is the install order if one wants to install everything mailscanner smapassassin razor2 pyzor dcc clamav bitdefender sendmail mailwatch Thanks for the help Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From zhangm at R3.SANYOSHK.COM Fri Dec 10 08:30:36 2004 From: zhangm at R3.SANYOSHK.COM (Zhang(MIS)) Date: Thu Jan 12 21:27:53 2006 Subject: Some Attachments corrupt when enable Dangerous Content Scanning Message-ID: Hi All, I got complaint from our HR staff that their attachments in email was corrupt. (the example is simple txt file : http://210.177.17.196/mis/temp/04120915.53r which is download from our absent time recorder ) when use diff to compare the orignal file and the emailed one : # diff 04120915.53r after/04120915.53r 1,5c1,5 < 1000002371015501209D0A < 1000002371015501209D1A ... --- > 1000002371015501209D0A > 1000002371015501209D1A ... after many testing I noted the way to avoid this problem is 1.disable Content Scanning (Dangerous Content Scanning = no) 2. use text format to send the email 3. change the file name with xxxx.txt * we are using 4.36.4 MS Our staff said no problem before alst week (we upgraded to 4.36.4 last week), any idea for this? Regards Z. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From m.sapsed at BANGOR.AC.UK Fri Dec 10 08:57:12 2004 From: m.sapsed at BANGOR.AC.UK (Martin Sapsed) Date: Thu Jan 12 21:27:53 2006 Subject: Whitelist / blacklist interactions question Message-ID: Quentin Campbell wrote: >>Why not just add >> From: fred@oxfam.org.uk no >>to your whitelist rules or am I missing something? > > Yes, you can do that. However it does not necessarily mean that it will > always be marked as spam. > > I want _all_ message from the "fred" address to be marked as high > scoring spam. That is what adding it to the blacklist should do. Sorry - should have been an "as well" in there. If you explicitly exclude the address from being whitelisted, then the blacklisting must work mustn't it? Cheers, Martin -- Martin Sapsed "I've got 8 little fingers and only 2 thumbs, Microcomputer Support won't you leave me in peace Information Services while I get the job done?" University of Wales, Bangor Chris Rea, "I'm working on it" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Dec 10 09:27:14 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:53 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: Oliver you need to install the latest MS (or at least 4.34) for it to work with SA3.x. The SA 3.x API is different from the 2.x so you'll need to upgrade. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Oliver Hookins wrote: > Hi all, > > I've just installed SpamAssassin 3.0.1 on MailScanner 4.21 and > configured MailScanner to use it, but after restarting MailScanner all > hell broke loose. The following messages were in the /var/log/maillog: > > Dec 9 16:42:08 gw1 MailScanner[24601]: MailScanner child caught a SIGHUP > Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end > function InternalActions > Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts > list > Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end > function InternalActions > Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts > list > Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end > function InternalActions > Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts > list > Dec 9 16:42:08 gw1 MailScanner[24535]: MailScanner child caught a SIGHUP > Dec 9 16:42:08 gw1 MailScanner[24576]: MailScanner child caught a SIGHUP > > I am not the one who set up MailScanner originally so I don't know what > this InternalActions function is or what it should be doing. The > following was in the /var/log/messages: > > Dec 9 16:42:12 gw1 MailScanner: MailScanner shutdown succeeded > Dec 9 16:42:13 gw1 MailScanner: sendmail shutdown succeeded > Dec 9 16:42:14 gw1 MailScanner: sendmail shutdown succeeded > Dec 9 16:42:16 gw1 MailScanner: succeeded > Dec 9 16:42:19 gw1 last message repeated 2 times > Dec 9 16:45:48 gw1 root: Process did not exit cleanly, returned 29 with > signal 0 > Dec 9 16:46:28 gw1 last message repeated 4 times > Dec 9 16:47:38 gw1 last message repeated 7 times > Dec 9 16:48:48 gw1 last message repeated 7 times > Dec 9 16:49:58 gw1 last message repeated 7 times > Dec 9 16:51:08 gw1 last message repeated 7 times > Dec 9 16:52:18 gw1 last message repeated 7 times > Dec 9 16:53:29 gw1 last message repeated 7 times > Dec 9 16:54:39 gw1 last message repeated 7 times > Dec 9 16:55:49 gw1 last message repeated 7 times > Dec 9 16:56:59 gw1 last message repeated 7 times > Dec 9 16:58:09 gw1 last message repeated 7 times > Dec 9 16:59:19 gw1 last message repeated 7 times > Dec 9 17:00:29 gw1 last message repeated 7 times > > Can anyone tell me why this might be happening? I had to unconfigure > SpamAssassin from the MailScanner.conf and restart it before it would > work again. It was producing these errors constantly between when > MailScanner restarted and when the problem was discovered the next day. > > Regards, > Oliver > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paul at WELSHFAMILY.COM Thu Dec 9 23:47:36 2004 From: paul at WELSHFAMILY.COM (Paul Welsh) Date: Thu Jan 12 21:27:53 2006 Subject: Problems with SpamAssassin 3.0.1 timing out Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Sorry, I was wondering why MailScanner gets the count wrong, eg, failure 11 of 10. ----- Original Message ----- From: "Chris Sweeney" To: Sent: Thursday, December 09, 2004 3:20 AM Subject: Re: Problems with SpamAssassin 3.0.1 timing out > That means SPamAssassin was taking to long to process the message and it > was > killed for that reason. You can adjust this setting in your conf. But > you > probly have a more serious problem to figure out why SpamAssassin is > taking > so long to process a message. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Fri Dec 10 03:42:24 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:53 2006 Subject: inconsistent SPF warning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Matt Kettler wrote: > At 02:55 PM 12/9/2004, Julian Field wrote: > >> How, in the SA 3.0 API, do I stop it from unloading >> spam.assassin.prefs.conf after each message? Or, if I can't do that, how >> do I make it re-read it? I would obviously rather do the former. > > > > I'm looking at the code now. Looking at spamd, they use SpamAssassin.pm's > copy_config() to save, then later restore the base configuration, so I > *think* MailScanner is safe on this, but I'm not sure if there's no > clearing of the conf object after it's been used... > > However, it's still worth testing if anybody who uses SA 3.0 can... > I have custom scores for some tests in spam.assassin.prefs.conf and they don't revert to default scores after the first message. Is this an adequate test? Alternatively, maybe MailScanner should just pass the header "X-Envelope-From" at the top of the message (if it hasn't already been added by the MTA). Then the configuration parameter "envelope_sender_header" would not be needed. You don't have to tell SA to use "X-Envelope-From", it already knows. Or avoid the whole issue and tell people to get their MTA to add the appropriate header, as recommended by the SA docs. Mark Nienberg ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ohookins at GMAIL.COM Fri Dec 10 04:01:49 2004 From: ohookins at GMAIL.COM (Oliver Hookins) Date: Thu Jan 12 21:27:53 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi all, I've just installed SpamAssassin 3.0.1 on MailScanner 4.21 and configured MailScanner to use it, but after restarting MailScanner all hell broke loose. The following messages were in the /var/log/maillog: Dec 9 16:42:08 gw1 MailScanner[24601]: MailScanner child caught a SIGHUP Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end function InternalActions Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts list Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end function InternalActions Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts list Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end function InternalActions Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts list Dec 9 16:42:08 gw1 MailScanner[24535]: MailScanner child caught a SIGHUP Dec 9 16:42:08 gw1 MailScanner[24576]: MailScanner child caught a SIGHUP I am not the one who set up MailScanner originally so I don't know what this InternalActions function is or what it should be doing. The following was in the /var/log/messages: Dec 9 16:42:12 gw1 MailScanner: MailScanner shutdown succeeded Dec 9 16:42:13 gw1 MailScanner: sendmail shutdown succeeded Dec 9 16:42:14 gw1 MailScanner: sendmail shutdown succeeded Dec 9 16:42:16 gw1 MailScanner: succeeded Dec 9 16:42:19 gw1 last message repeated 2 times Dec 9 16:45:48 gw1 root: Process did not exit cleanly, returned 29 with signal 0 Dec 9 16:46:28 gw1 last message repeated 4 times Dec 9 16:47:38 gw1 last message repeated 7 times Dec 9 16:48:48 gw1 last message repeated 7 times Dec 9 16:49:58 gw1 last message repeated 7 times Dec 9 16:51:08 gw1 last message repeated 7 times Dec 9 16:52:18 gw1 last message repeated 7 times Dec 9 16:53:29 gw1 last message repeated 7 times Dec 9 16:54:39 gw1 last message repeated 7 times Dec 9 16:55:49 gw1 last message repeated 7 times Dec 9 16:56:59 gw1 last message repeated 7 times Dec 9 16:58:09 gw1 last message repeated 7 times Dec 9 16:59:19 gw1 last message repeated 7 times Dec 9 17:00:29 gw1 last message repeated 7 times Can anyone tell me why this might be happening? I had to unconfigure SpamAssassin from the MailScanner.conf and restart it before it would work again. It was producing these errors constantly between when MailScanner restarted and when the problem was discovered the next day. Regards, Oliver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Fri Dec 10 04:18:29 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:53 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: I don't recall if MS 4.21 supports SA3.x You might consider upgrading your MS to the latest stable and see if the problem persists. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Oliver Hookins Sent: Thursday, December 09, 2004 10:02 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Problem after installing SpamAssassin on MailScanner Hi all, I've just installed SpamAssassin 3.0.1 on MailScanner 4.21 and configured MailScanner to use it, but after restarting MailScanner all hell broke loose. The following messages were in the /var/log/maillog: Dec 9 16:42:08 gw1 MailScanner[24601]: MailScanner child caught a SIGHUP Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end function InternalActions Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts list Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end function InternalActions Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts list Dec 9 16:42:08 gw1 MailScanner[24601]: Config: calling custom end function InternalActions Dec 9 16:42:08 gw1 MailScanner[24601]: Shutting down internal accounts list Dec 9 16:42:08 gw1 MailScanner[24535]: MailScanner child caught a SIGHUP Dec 9 16:42:08 gw1 MailScanner[24576]: MailScanner child caught a SIGHUP I am not the one who set up MailScanner originally so I don't know what this InternalActions function is or what it should be doing. The following was in the /var/log/messages: Dec 9 16:42:12 gw1 MailScanner: MailScanner shutdown succeeded Dec 9 16:42:13 gw1 MailScanner: sendmail shutdown succeeded Dec 9 16:42:14 gw1 MailScanner: sendmail shutdown succeeded Dec 9 16:42:16 gw1 MailScanner: succeeded Dec 9 16:42:19 gw1 last message repeated 2 times Dec 9 16:45:48 gw1 root: Process did not exit cleanly, returned 29 with signal 0 Dec 9 16:46:28 gw1 last message repeated 4 times Dec 9 16:47:38 gw1 last message repeated 7 times Dec 9 16:48:48 gw1 last message repeated 7 times Dec 9 16:49:58 gw1 last message repeated 7 times Dec 9 16:51:08 gw1 last message repeated 7 times Dec 9 16:52:18 gw1 last message repeated 7 times Dec 9 16:53:29 gw1 last message repeated 7 times Dec 9 16:54:39 gw1 last message repeated 7 times Dec 9 16:55:49 gw1 last message repeated 7 times Dec 9 16:56:59 gw1 last message repeated 7 times Dec 9 16:58:09 gw1 last message repeated 7 times Dec 9 16:59:19 gw1 last message repeated 7 times Dec 9 17:00:29 gw1 last message repeated 7 times Can anyone tell me why this might be happening? I had to unconfigure SpamAssassin from the MailScanner.conf and restart it before it would work again. It was producing these errors constantly between when MailScanner restarted and when the problem was discovered the next day. Regards, Oliver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Dec 10 09:30:34 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:53 2006 Subject: New Installer questions Sorry :-) Message-ID: Lance 1. opinion varies, there have been issues with all distributions at one point or another. You could look at whitebox or toa linux which are RHES clones, as alot of people seem to like those. 2. a better order is... sendmail clamav bitdefender razor2 dcc pyzor spamassassin mailscanner mailwatch -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Lance Haig wrote: > Hi, > > We had Steve install at our office and things are working fine. > > I like it so much I want to run it for my own email system. > > I have two questions. > > 1. Which LInux Flavour is the best to install onto? I have SUSE 9.1 SUSE > 9.2 And can get Fedora. My limited skills are on SUSE but it redhat is > the better one I am willing to learn. > > 2. What is the install order if one wants to install everything > mailscanner > smapassassin > razor2 > pyzor > dcc > clamav > bitdefender > sendmail > mailwatch > > Thanks for the help > > Lance ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Fri Dec 10 09:42:21 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:53 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: Run a few simple sanity checks: 1. MailScanner -v What version does this report? 2. spamassassin -D --lint Does that give any errors? And NO MS does not have its own version of SA. Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at OMEGADATA.NO Fri Dec 10 10:14:14 2004 From: john at OMEGADATA.NO (John Berntsen) Date: Thu Jan 12 21:27:53 2006 Subject: SV: New Installer questions Sorry :-) Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have it in use on several suse9.1 machines and it works like a charm. Med vennlig hilsen / Regards John Berntsen Omegadata AS Leangbukta 31 1392 Vettre Mobil 99 43 07 79 Telefon 66 76 61 00 Faks 66 76 61 01 ________________________________________________________________________________ Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] På vegne av Lance Haig Sendt: 10. desember 2004 08:24 Til: MAILSCANNER@JISCMAIL.AC.UK Emne: New Installer questions Sorry :-) Hi, We had Steve install at our office and things are working fine. I like it so much I want to run it for my own email system. I have two questions. 1. Which LInux Flavour is the best to install onto? I have SUSE 9.1 SUSE 9.2 And can get Fedora. My limited skills are on SUSE but it redhat is the better one I am willing to learn. 2. What is the install order if one wants to install everything mailscanner smapassassin razor2 pyzor dcc clamav bitdefender sendmail mailwatch Thanks for the help Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Dec 10 10:15:06 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:53 2006 Subject: New Installer questions Sorry :-) Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Fri, December 10, 2004 7:23, Lance Haig said: > 1. Which LInux Flavour is the best to install onto? I have SUSE 9.1 SUSE > 9.2 And can get Fedora. My limited skills are on SUSE but it redhat is > the better one I am willing to learn. You might want to look FreeBSD. It's not hugely different to Linux and comes with the excellent ports system. You also don't have to worry about dependencies as the ports system does this for you (We had no problems when MIME::tools changed and rpm databases getting confused). JP does an excellent job of maintaining the MS port. If you can manage to change directory and type make install you can work FreeBSD :-) > > 2. What is the install order if one wants to install everything > mailscanner > smapassassin > razor2 > pyzor > dcc > clamav > bitdefender > sendmail > mailwatch Apart from putting Sendmail at the top (Make sure it works) but most distros come with this installed by default at installation, the rst of the list is fine. Don't forget you will need Apache to view the webstats on Mailwatch. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From andreas.svensson at HALLSBERG.SE Fri Dec 10 10:31:40 2004 From: andreas.svensson at HALLSBERG.SE (Andreas Svensson) Date: Thu Jan 12 21:27:53 2006 Subject: Anyone running Panda? Message-ID: Hello again. Anyone of you Mailscanner users running Panda Antivirus? If so, please mail me your current pavcl file so I can test it with the Panda wrapper. I still can't get Panda to run with Mailscanner Panda wrapper... Sincerely Andreas Svensson, Hallsberg, Sweden. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Dec 10 10:39:50 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:53 2006 Subject: SV: New Installer questions Sorry :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John, I might ask you some questions then :-) As I would prefer to use my SUSE Lance Lance John Berntsen wrote: I have it in use on several suse9.1 machines and it works like a charm. Med vennlig hilsen / Regards John Berntsen Omegadata AS Leangbukta 31 1392 Vettre Mobil 99 43 07 79 Telefon 66 76 61 00 Faks 66 76 61 01 ________________________________________________________________________________ Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Pa vegne av Lance Haig Sendt: 10. desember 2004 08:24 Til: MAILSCANNER@JISCMAIL.AC.UK Emne: New Installer questions Sorry :-) Hi, We had Steve install at our office and things are working fine. I like it so much I want to run it for my own email system. I have two questions. 1. Which LInux Flavour is the best to install onto? I have SUSE 9.1 SUSE 9.2 And can get Fedora. My limited skills are on SUSE but it redhat is the better one I am willing to learn. 2. What is the install order if one wants to install everything mailscanner smapassassin razor2 pyzor dcc clamav bitdefender sendmail mailwatch Thanks for the help Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Dec 10 10:39:05 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:54 2006 Subject: New Installer questions Sorry :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin, Thanks for the notes I will have a look at those versions. Lance Martin Hepworth wrote: > Lance > > 1. opinion varies, there have been issues with all distributions at one > point or another. You could look at whitebox or toa linux which are RHES > clones, as alot of people seem to like those. > > 2. a better order is... > sendmail > clamav > bitdefender > razor2 > dcc > pyzor > spamassassin > mailscanner > mailwatch > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Lance Haig wrote: > >> Hi, >> >> We had Steve install at our office and things are working fine. >> >> I like it so much I want to run it for my own email system. >> >> I have two questions. >> >> 1. Which LInux Flavour is the best to install onto? I have SUSE 9.1 SUSE >> 9.2 And can get Fedora. My limited skills are on SUSE but it redhat is >> the better one I am willing to learn. >> >> 2. What is the install order if one wants to install everything >> mailscanner >> smapassassin >> razor2 >> pyzor >> dcc >> clamav >> bitdefender >> sendmail >> mailwatch >> >> Thanks for the help >> >> Lance ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> *Support MailScanner development - buy the book off the website!* > > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Dec 10 10:41:35 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:54 2006 Subject: New Installer questions Sorry :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew, I have tried FreeBSD a while ago and I am not fluent enough in Linux to use that yet. As soon as get better I will have a look at it again Thanks for that though Lance Drew Marshall wrote: On Fri, December 10, 2004 7:23, Lance Haig said: 1. Which LInux Flavour is the best to install onto? I have SUSE 9.1 SUSE 9.2 And can get Fedora. My limited skills are on SUSE but it redhat is the better one I am willing to learn. You might want to look FreeBSD. It's not hugely different to Linux and comes with the excellent ports system. You also don't have to worry about dependencies as the ports system does this for you (We had no problems when MIME::tools changed and rpm databases getting confused). JP does an excellent job of maintaining the MS port. If you can manage to change directory and type make install you can work FreeBSD :-) 2. What is the install order if one wants to install everything mailscanner smapassassin razor2 pyzor dcc clamav bitdefender sendmail mailwatch Apart from putting Sendmail at the top (Make sure it works) but most distros come with this installed by default at installation, the rst of the list is fine. Don't forget you will need Apache to view the webstats on Mailwatch. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at OMEGADATA.NO Fri Dec 10 10:51:47 2004 From: john at OMEGADATA.NO (John Berntsen) Date: Thu Jan 12 21:27:54 2006 Subject: SV: SV: New Installer questions Sorry :-) Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ofcourse :) Med vennlig hilsen / regards John Berntsen Omegadata AS Leangbukta 31 1392 Vettre Mobil 99 43 07 79 Telefon 66 76 61 00 Faks 66 76 61 01 ________________________________________________________________________________ Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] På vegne av Lance Haig Sendt: 10. desember 2004 11:40 Til: MAILSCANNER@JISCMAIL.AC.UK Emne: Re: SV: New Installer questions Sorry :-) John, I might ask you some questions then :-) As I would prefer to use my SUSE Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Dec 10 10:55:03 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:54 2006 Subject: SV: SV: New Installer questions Sorry :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Do you want to do it off line or through the list? Lance John Berntsen wrote: Ofcourse :) Med vennlig hilsen / regards John Berntsen Omegadata AS Leangbukta 31 1392 Vettre Mobil 99 43 07 79 Telefon 66 76 61 00 Faks 66 76 61 01 ________________________________________________________________________________ Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Pa vegne av Lance Haig Sendt: 10. desember 2004 11:40 Til: MAILSCANNER@JISCMAIL.AC.UK Emne: Re: SV: New Installer questions Sorry :-) John, I might ask you some questions then :-) As I would prefer to use my SUSE Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Dec 10 11:06:56 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:54 2006 Subject: New Installer questions Sorry :-) Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Fri, December 10, 2004 10:41, Lance Haig said: > I have tried FreeBSD a while ago and I am not fluent enough in Linux to > use that yet. It's has improved of late but that is the beauty of open source. You can pick and chose to your own preferences. What is great for one may not suit another :-) If it's a home system, you might want to try a few distros before settling on your favourite. Good luck! Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Dec 10 11:13:03 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:54 2006 Subject: New Installer questions Sorry :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew, I have about 6 different versions of distributions and I have tried almost all of them at one time. I even have the original Lindows and the new linspire ( I am a life member) So choice I have but my skills are limited :-) I want to get it working on one first to get to grips with it and then try out different versions Lance Drew Marshall wrote: On Fri, December 10, 2004 10:41, Lance Haig said: I have tried FreeBSD a while ago and I am not fluent enough in Linux to use that yet. It's has improved of late but that is the beauty of open source. You can pick and chose to your own preferences. What is great for one may not suit another :-) If it's a home system, you might want to try a few distros before settling on your favourite. Good luck! Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at LISTS.COM.AR Fri Dec 10 12:10:25 2004 From: mailscanner at LISTS.COM.AR (Leonardo Helman) Date: Thu Jan 12 21:27:54 2006 Subject: MailScanner: Beta release 4.37.1 Message-ID: In ZMailer.pm file, line 259 Here is the patch. --- ZMailer.pm.ORI Wed Dec 8 07:28:04 2004 +++ ZMailer.pm Fri Dec 10 09:06:46 2004 @@ -256,7 +256,7 @@ next; } - last if( $InHeader && /^\s*$/ ); # One blank line ends whith the header part + last if( $InHeader && /^$/ ); # One blank line ends whith the header part $Line = $_; unless( $InHeader ) { On Thu, Dec 09, 2004 at 09:11:17PM +0000, Julian Field wrote: > What file and line are you talking about? > > Leonardo Helman wrote: > > >I've downloaded. > > > >ZMailer.pm have \s* instead of \s+, but InHeader is the old one. > > > > > > > > > >On Thu, Dec 09, 2004 at 06:00:17PM +0000, Julian Field wrote: > > > > > >>Alan Dobkin wrote: > >> > >> > >> > >>>On 12/8/2004 6:39 AM, Julian Field wrote: > >>> > >>> > >>> > >>>>I have just released the a new beta 4.37.1. > >>>> > >>>> > >>>I don't see this release on the web site, only 4.36.4. > >>>Is it hidden somewhere, or has it been pulled? > >>> > >>> > >>> > >>Ah, that would explain why no-one has downloaded it. I forgot to copy > >>the new index and downloads web pages onto the web server. Strange how > >>no-one else bothered to report it... > >> > >>Fixed now, sorry! > >> > >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From denis at CROOMBS.ORG Fri Dec 10 14:03:28 2004 From: denis at CROOMBS.ORG (Denis Croombs) Date: Thu Jan 12 21:27:54 2006 Subject: Win32::TieRegistry module Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am using the Install-Clam-SA.tar.gz which I have used many times now, BUT on a Redhat 9.0 system it fails because of this gives an error (I have installed it on redhat 7.3 & 9.0 before with no problems) I have even tried to install the Perl module Win32::TieRegistry manually and even then it will not install. Anyone had this problem before ? Thanks Denis -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. Marvin the E-Mail scanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Fri Dec 10 13:15:42 2004 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:27:54 2006 Subject: Win32::TieRegistry module Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I had the same problem, causing the DNS stuff to fail, which caused the RBL junk to not be called. I downloaded and installed a version 34 of perl::Net I found on the internet somewhere, which is all that SA requires, and all was fine. I then reran the script. Although is still failed, it gave me a recent enough version of perl::DNS to allow SA to run the DNS checks. I never did find a perl Win32 that would work. Just google for perl::DNS and select at least version 34 Steve Campbell campbell@cnpapers.com Charleston Newspapers ----- Original Message ----- From: "Denis Croombs" To: Sent: Friday, December 10, 2004 9:03 AM Subject: Win32::TieRegistry module > I am using the Install-Clam-SA.tar.gz which I have used many times now, BUT > on a Redhat 9.0 system it fails because of this gives an error (I have > installed it on redhat 7.3 & 9.0 before with no problems) > I have even tried to install the Perl module Win32::TieRegistry manually and > even then it will not install. > > Anyone had this problem before ? > > Thanks > > Denis > > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > Marvin the E-Mail scanner > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ohookins at gmail.com Fri Dec 10 12:02:01 2004 From: ohookins at gmail.com (Oliver Hookins) Date: Thu Jan 12 21:27:54 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: On Fri, 10 Dec 2004 09:27:14 +0000, Martin Hepworth wrote: > Oliver > > you need to install the latest MS (or at least 4.34) for it to work with > SA3.x. The SA 3.x API is different from the 2.x so you'll need to upgrade. Thanks Martin and Mike for the heads-up with versions. I'll try upgrading the MailScanner and see how it goes. Regards, Oliver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Fri Dec 10 14:06:06 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:54 2006 Subject: New Installer questions Sorry :-) Message-ID: You might want to look into clamav-milter when installing clamav, if you want to scan for viruses first; you'll also want to use milter-ahead, for example, if you're receiving mail for someone else and relaying it to them. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth Sent: Friday, December 10, 2004 4:31 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: New Installer questions Sorry :-) Lance 1. opinion varies, there have been issues with all distributions at one point or another. You could look at whitebox or toa linux which are RHES clones, as alot of people seem to like those. 2. a better order is... sendmail clamav bitdefender razor2 dcc pyzor spamassassin mailscanner mailwatch -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Lance Haig wrote: > Hi, > > We had Steve install at our office and things are working fine. > > I like it so much I want to run it for my own email system. > > I have two questions. > > 1. Which LInux Flavour is the best to install onto? I have SUSE 9.1 > SUSE > 9.2 And can get Fedora. My limited skills are on SUSE but it redhat is > the better one I am willing to learn. > > 2. What is the install order if one wants to install everything > mailscanner > smapassassin > razor2 > pyzor > dcc > clamav > bitdefender > sendmail > mailwatch > > Thanks for the help > > Lance ------------------------ MailScanner list > ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Fri Dec 10 14:25:58 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:54 2006 Subject: New Installer questions Sorry :-) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > Drew, > > I have about 6 different versions of distributions and I have tried > almost all of them at one time. > > I even have the original Lindows and the new linspire ( I am a life member) > > So choice I have but my skills are limited :-) > > I want to get it working on one first to get to grips with it and then > try out different versions > Since most of the documentation (manual from FSL, MAQ) is based on redhat, I suggest you get a Red Hat Enterprise Linux 3.0 clone like Whitebox , CentOS or Tao Linux, read the manual and you should get a working box really quickly. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From denis at CROOMBS.ORG Fri Dec 10 16:04:51 2004 From: denis at CROOMBS.ORG (Denis Croombs) Date: Thu Jan 12 21:27:54 2006 Subject: Win32::TieRegistry module Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > I had the same problem, causing the DNS stuff to fail, which caused the > RBL junk to not be called. I downloaded and installed a version 34 of > perl::Net I found on the internet somewhere, which is all that SA > requires, and all was fine. I then reran the script. Although is still > failed, it gave me a recent enough version of perl::DNS to allow SA to > run the DNS checks. I never did find a perl Win32 that would work. > > Just google for perl::DNS and select at least version 34 > >> I am using the Install-Clam-SA.tar.gz which I have used many times >> now, > BUT >> on a Redhat 9.0 system it fails because of this gives an error (I have >> installed it on redhat 7.3 & 9.0 before with no problems) >> I have even tried to install the Perl module Win32::TieRegistry >> manually > and >> even then it will not install. >> >> Anyone had this problem before ? >> Thanks for that, I have not got the error below:- Starting "make" Stage make[1]: Entering directory `/usr/src/redhat/BUILD/Mail-ClamAV-0.13/_Inline/build/Mail/ClamAV' /usr/bin/perl /usr/lib/perl5/5.8.0/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8.0/ExtUtils/typemap ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c gcc -c -I/usr/src/redhat/BUILD/Mail-ClamAV-0.13 -I/usr/include -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -march=i386 -mcpu=i686 -DVERSION=\"0.13\" -DXS_VERSION=\"0.13\" -fPIC "-I/usr/lib/perl5/5.8.0/i386-linux-thread-multi/CORE" ClamAV.c Running Mkbootstrap for Mail::ClamAV () chmod 644 ClamAV.bs rm -f blib/arch/auto/Mail/ClamAV/ClamAV.so LD_RUN_PATH="/usr/lib:/usr/kerberos/lib" gcc -shared -L/usr/local/lib ClamAV.o -o blib/arch/auto/Mail/ClamAV/ClamAV.so -L/usr/lib -lz -lbz2 -lgmp -lcurl -L/usr/kerberos/lib -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv -ldl -lz -L/usr/kerberos/lib -lz -lssl -lcrypto -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv -ldl -lz -lz -lpthread -lclamav /usr/bin/ld: cannot find -lbz2 collect2: ld returned 1 exit status make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 make[1]: Leaving directory `/usr/src/redhat/BUILD/Mail-ClamAV-0.13/_Inline/build/Mail/ClamAV' A problem was encountered while attempting to compile and install your Inline C code. The command that failed was: make The build directory was: /usr/src/redhat/BUILD/Mail-ClamAV-0.13/_Inline/build/Mail/ClamAV To debug the problem, cd to the build directory, and inspect the output files. at /usr/src/redhat/BUILD/Mail-ClamAV-0.13/blib/lib/Mail/ClamAV.pm line 190 BEGIN failed--compilation aborted at /usr/src/redhat/BUILD/Mail-ClamAV-0.13/blib/lib/Mail/ClamAV.pm line 529. Compilation failed in require. BEGIN failed--compilation aborted. make: *** [ClamAV.inl] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.57697 (%build) Any clue on how to solve this one ? Thanks Denis -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. Marvin the E-Mail scanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Fri Dec 10 14:50:29 2004 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:27:54 2006 Subject: Win32::TieRegistry module Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] My guess is that you need the bzip2-devel package. I'm also guessing it is in the install package somewhere as I don't have it on machines not running MS/SA. I am just guessing, mind you. Steve Campbell campbell@cnpapers.com Charleston Newspapers ----- Original Message ----- From: "Denis Croombs" To: Sent: Friday, December 10, 2004 11:04 AM Subject: Re: Win32::TieRegistry module > > I had the same problem, causing the DNS stuff to fail, which caused the > > RBL junk to not be called. I downloaded and installed a version 34 of > > perl::Net I found on the internet somewhere, which is all that SA > > requires, and all was fine. I then reran the script. Although is still > > failed, it gave me a recent enough version of perl::DNS to allow SA to > > run the DNS checks. I never did find a perl Win32 that would work. > > > > Just google for perl::DNS and select at least version 34 > > > >> I am using the Install-Clam-SA.tar.gz which I have used many times > >> now, > > BUT > >> on a Redhat 9.0 system it fails because of this gives an error (I have > >> installed it on redhat 7.3 & 9.0 before with no problems) > >> I have even tried to install the Perl module Win32::TieRegistry > >> manually > > and > >> even then it will not install. > >> > >> Anyone had this problem before ? > >> > Thanks for that, I have not got the error below:- > Starting "make" Stage > make[1]: Entering directory > `/usr/src/redhat/BUILD/Mail-ClamAV-0.13/_Inline/build/Mail/ClamAV' > /usr/bin/perl /usr/lib/perl5/5.8.0/ExtUtils/xsubpp -typemap > /usr/lib/perl5/5.8.0/ExtUtils/typemap ClamAV.xs > ClamAV.xsc && mv > ClamAV.xsc ClamAV.c > gcc -c -I/usr/src/redhat/BUILD/Mail-ClamAV-0.13 -I/usr/include -D_REENTRANT > -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing > -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 > -I/usr/include/gdbm -O2 -g -pipe -march=i386 -mcpu=i686 -DVERSION=\"0.13 \" > -DXS_VERSION=\"0.13\" -fPIC > "-I/usr/lib/perl5/5.8.0/i386-linux-thread-multi/CORE" ClamAV.c > Running Mkbootstrap for Mail::ClamAV () > chmod 644 ClamAV.bs > rm -f blib/arch/auto/Mail/ClamAV/ClamAV.so > LD_RUN_PATH="/usr/lib:/usr/kerberos/lib" gcc -shared -L/usr/local/lib > ClamAV.o -o blib/arch/auto/Mail/ClamAV/ClamAV.so -L/usr/lib -lz -lbz2 > -lgmp -lcurl -L/usr/kerberos/lib -lssl -lcrypto -lgssapi_krb5 -lkrb5 > -lcom_err -lk5crypto -lresolv -ldl -lz -L/usr/kerberos/lib -lz -lssl > -lcrypto -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv > -ldl -lz -lz -lpthread -lclamav > /usr/bin/ld: cannot find -lbz2 > collect2: ld returned 1 exit status > make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 > make[1]: Leaving directory > `/usr/src/redhat/BUILD/Mail-ClamAV-0.13/_Inline/build/Mail/ClamAV' > > A problem was encountered while attempting to compile and install your Inline > C code. The command that failed was: > make > > The build directory was: > /usr/src/redhat/BUILD/Mail-ClamAV-0.13/_Inline/build/Mail/ClamAV > > To debug the problem, cd to the build directory, and inspect the output > files. > at /usr/src/redhat/BUILD/Mail-ClamAV-0.13/blib/lib/Mail/ClamAV.pm line 190 > BEGIN failed--compilation aborted at > /usr/src/redhat/BUILD/Mail-ClamAV-0.13/blib/lib/Mail/ClamAV.pm line 529. > Compilation failed in require. > BEGIN failed--compilation aborted. > make: *** [ClamAV.inl] Error 2 > error: Bad exit status from /var/tmp/rpm-tmp.57697 (%build) > > Any clue on how to solve this one ? > > Thanks > > Denis > > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > Marvin the E-Mail scanner > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Fri Dec 10 15:01:28 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: MailScanner: Beta release 4.37.1 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Many thanks. It will be correct in the next release. Leonardo Helman wrote: >In ZMailer.pm file, line 259 > > >Here is the patch. > > >--- ZMailer.pm.ORI Wed Dec 8 07:28:04 2004 >+++ ZMailer.pm Fri Dec 10 09:06:46 2004 >@@ -256,7 +256,7 @@ > next; > } > >- last if( $InHeader && /^\s*$/ ); # One blank line ends whith the header part >+ last if( $InHeader && /^$/ ); # One blank line ends whith the header part > > $Line = $_; > unless( $InHeader ) { > > > >On Thu, Dec 09, 2004 at 09:11:17PM +0000, Julian Field wrote: > > >>What file and line are you talking about? >> >>Leonardo Helman wrote: >> >> >> >>>I've downloaded. >>> >>>ZMailer.pm have \s* instead of \s+, but InHeader is the old one. >>> >>> >>> >>> >>>On Thu, Dec 09, 2004 at 06:00:17PM +0000, Julian Field wrote: >>> >>> >>> >>> >>>>Alan Dobkin wrote: >>>> >>>> >>>> >>>> >>>> >>>>>On 12/8/2004 6:39 AM, Julian Field wrote: >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>I have just released the a new beta 4.37.1. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>I don't see this release on the web site, only 4.36.4. >>>>>Is it hidden somewhere, or has it been pulled? >>>>> >>>>> >>>>> >>>>> >>>>> >>>>Ah, that would explain why no-one has downloaded it. I forgot to copy >>>>the new index and downloads web pages onto the web server. Strange how >>>>no-one else bothered to report it... >>>> >>>>Fixed now, sorry! >>>> >>>> >>>> >>>> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From piper at HRZ.UNI-MARBURG.DE Fri Dec 10 15:47:21 2004 From: piper at HRZ.UNI-MARBURG.DE (Andreas Piper) Date: Thu Jan 12 21:27:54 2006 Subject: How to block delivery of MAILER-DAEMON (<>) messages? Message-ID: Hello all, On my MailScanner-host I am getting a lot of messages from external sites, which contain non-delivery notifications for spam-messages originally sent using faked from-adresses from our domain. As I have set 'Allow Partial Messages = no' and these messages contain 'Content-Type: message/partial', they are cleaned by MailScanner. As I have further set 'Deliver Cleaned Messages = yes', they are delivered to the (faked) recipients. I am tried to define a ruleset for 'Deliver Cleaned Messages' to exclude these messages from delivery, but I did not succeed, because the envelope-from in these messages is <>, and the rule From: /^$/ no seems not to be working. How can I solve this problem? My system parameters are:: Debian/testing MailScanner 4.35.11 sendmail 8.13.1 perl 5.8.4 Thanks, Andreas -- ________________________________________________________________________ Dr. Andreas Piper, Hochschulrechenzentrum der Philipps-Univ. Marburg Hans-Meerwein-Strasse, 35032 Marburg, Germany Phone: +49 6421 28-23521 Fax: -26994 Email: piper@HRZ.Uni-Marburg.DE ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ccaaarb at UCL.AC.UK Fri Dec 10 16:09:21 2004 From: ccaaarb at UCL.AC.UK (Adrian Barker) Date: Thu Jan 12 21:27:54 2006 Subject: inconsistent SPF warning Message-ID: Mark Nienberg wrote: > Chris Picciotto wrote: > >> Sorry -- I seem unable to post to the list. I registered... but >> perhaps it takes some time to reflect the registration. >> >> Anyway - thought you might be interested. >> Chris > > > > I'll post it for you. > Mark Nienberg > >> >> Just a couple thoughts here. >> >> After going through this whole SpamAssassin 3.0.1 with SPF posts and >> all the >> recommended header structures, I found the following. >> >> Turning OFF MailScanner's added header. >> Turning ON Sendmail's Envelope-From header >> >> This worked just fine. Then, I turned OFF the sendmail header, and turned >> OFF spamassassins envelope-from config - and it works perfectly. >> SpamAssassin 3.0.1 has pretty smart header parsing, and finds the >> appropriate "From". All SPF checks are working great. >> > Hmm. On my system with both OFF, I don't get any SPF checks at all. > (Except the SPF_HELLO stuff). > I don't think there is an appropriate "from" in the headers when > sendmail's X-Envelope-From is off (except for the one that MailScanner > adds). > Mark > >> With respect to below - I am not sure it is related, but AWL (I assume >> Auto >> WhiteList) is still being "scored", even though I have that config set to >> "no" in MailScanner.conf. That is odd... but may be related to how >> SpamAssassin is getting its configuration. >> >> Chris > > > For SA 3 you need to add > > use_auto_whitelist 0 > > to your spam.assassin.prefs.conf. The setting in MailScanner.conf > doesn't work with SA3. > > Mark Nienberg > Does anyone have the SPF checks working with exim ? Since upgrading to SA 3.0.1, we have not seen any messages with SPF scores, and we receive large volumes of email, so would expect to see some. This is with MailScanner 4.35.10. Adrian Barker, University College London. > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! - ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! - --SKUYRWVINLSLKRaDTAbXBLcYEHIAZH-- ------- End of Forwarded Message ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Fri Dec 10 17:36:34 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:54 2006 Subject: How to block delivery of MAILER-DAEMON (<>) messages? Message-ID: At 10:47 AM 12/10/2004, Andreas Piper wrote: > am tried to define a ruleset for 'Deliver Cleaned Messages' to exclude these >messages from delivery, but I did not succeed, because the envelope-from in >these messages is <>, and the rule >From: /^$/ no >seems not to be working. > >How can I solve this problem? First, read the RFCs and understand that by inhibiting the null return path you are violating RFC 822. It's a requirement to accept bounces in the general case. Inhibiting them will also prevent any real bounce messages from reaching your network. If you fully understand the implications of what you are doing, and intend to only block these messages for a short period of time to alleviate the problem, go on. If you have read the RFCs and still intend to block permanently, please find a replacement admin and resign your position. Second, the "deliver cleaned messages" option only applies to virus infected emails that have been cleaned. It won't affect non-virus messages. Your best bet is to use the "Is Definitely Spam" ruleset, coupled with "Definite Spam Is High Scoring = yes", and "High Scoring Spam Actions=store" to quarantine them, or forward them to a common "bounces" user account so you can review them. I'd strongly recommend not using delete here, but it is possible. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Fri Dec 10 17:59:48 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:54 2006 Subject: How to block delivery of MAILER-DAEMON (<>) messages? Message-ID: At 12:36 PM 12/10/2004, Matt Kettler wrote: >First, read the RFCs and understand that by inhibiting the null return path >you are violating RFC 822. Self correction, it's RFC 1123 section 5.2.9 in this case, refining RFC 821, not 822. 5.2.9 Command Syntax: RFC-821 Section 4.1.2 The syntax shown in RFC-821 for the MAIL FROM: command omits the case of an empty path: "MAIL FROM: <>" (see RFC-821 Page 15). An empty reverse path MUST be supported. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From derek at ADCATANZARO.COM Fri Dec 10 18:58:17 2004 From: derek at ADCATANZARO.COM (Derek Catanzaro) Date: Thu Jan 12 21:27:54 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes, it is over 2 GB. I am going to clean it up and see if that helps. This is a relay server so I really don't check mail on this server. I never set a quota for root, is 2 GB a standard limit for mail files? Thanks for your response Matthew Bowman wrote: >Is the root mailbox over 2GB? > >Matthew K Bowman >Systems Administrator > > > > > >Ken A >Sent by: MailScanner mailing list >12/09/2004 03:56 PM >Please respond to MailScanner mailing list > > To: MAILSCANNER@JISCMAIL.AC.UK > cc: > Subject: Re: OT: Deferred: local mailer (/usr/bin/procmail) >exited with EX_TEMPFAIL > > >Is root over quota? >Does procmail have permission to write to /var/mail/root ? >Or, turn sendmail logging up to 14 to see more info. >Ken > > >Derek Catanzaro wrote: > > >>Fedora Core 1 >>mailscanner-4.31.6-1 >>sendmail-8.12.10-1.1.1 >> >>Recently I have been receiving the following in the mailq "Deferred: >>local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL". The email is >>trying to be delivered locally to root. I'm receiving anywhere from >>300-500 of these on a daily basis and it seems to be effecting mail >>routing as a whole if I don't go thru and delete the emails in the >>queue. Sendmail is my MTA. Any suggestions I can get would be great. >>Thanks for your time. >> >> ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brose at MED.WAYNE.EDU Fri Dec 10 19:05:22 2004 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:27:54 2006 Subject: How to block delivery of MAILER-DAEMON (<>) messages? Message-ID: We use milter-sender to do call-backs and it even checks for <> violations and will reject if the system is in violation. Also, there are many people that used the RFC Ignorant DNSBL (including Spamassassin) so if you do reject <> then you will most likely end up on that list. Relevant RFC references concerning the requirement for the Null Address (<>) used for Delivery Status Notification: RFC 2821 Simple Mail Transfer Protocol section 4.1.1.2 MAIL, BNF grammar section 6.1 Reliable Delivery and Replies by Email, paragraph 2 RFC 2505 Anti-Spam Recommendations for SMTP MTAs section 2. Recommendations 6a. section 2.6.1. "MAIL From: <>" RFC 1123 Requirements for Internet Hosts -- Application and Support section 5.2.9 Command Syntax: RFC-821 Section 4.1.2 RFC 821 Simple Mail Transfer Protocol (obsoleted by RFC 2821) section 3.6 section 4.1.1 -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Matt Kettler Sent: Friday, December 10, 2004 12:37 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: How to block delivery of MAILER-DAEMON (<>) messages? At 10:47 AM 12/10/2004, Andreas Piper wrote: > am tried to define a ruleset for 'Deliver Cleaned Messages' to >exclude these messages from delivery, but I did not succeed, because >the envelope-from in these messages is <>, and the rule >From: /^$/ no >seems not to be working. > >How can I solve this problem? First, read the RFCs and understand that by inhibiting the null return path you are violating RFC 822. It's a requirement to accept bounces in the general case. Inhibiting them will also prevent any real bounce messages from reaching your network. If you fully understand the implications of what you are doing, and intend to only block these messages for a short period of time to alleviate the problem, go on. If you have read the RFCs and still intend to block permanently, please find a replacement admin and resign your position. Second, the "deliver cleaned messages" option only applies to virus infected emails that have been cleaned. It won't affect non-virus messages. Your best bet is to use the "Is Definitely Spam" ruleset, coupled with "Definite Spam Is High Scoring = yes", and "High Scoring Spam Actions=store" to quarantine them, or forward them to a common "bounces" user account so you can review them. I'd strongly recommend not using delete here, but it is possible. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Dec 10 19:05:09 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:27:54 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Derek Catanzaro wrote: > Yes, it is over 2 GB. I am going to clean it up and see if that helps. > This is a relay server so I really don't check mail on this server. I > never set a quota for root, is 2 GB a standard limit for mail files? > No. It's a limit of 32-bit filesystems. You can't have files over 2GB unless you use a 64-bit filesystem which is not common. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From michael at NOMENNESCIO.NET Fri Dec 10 19:16:52 2004 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:27:54 2006 Subject: How to block delivery of MAILER-DAEMON (<>) messages? Message-ID: [ The following text is in the "iso-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Andreas Piper > >Hello all, > >On my MailScanner-host I am getting a lot of messages from external sites, >which contain non-delivery notifications for spam-messages originally sent >using faked from-adresses from our domain. As I have set 'Allow Partial >Messages = no' and these messages contain 'Content-Type: message/partial', >they are cleaned by MailScanner. As I have further set 'Deliver Cleaned >Messages = yes', they are delivered to the (faked) recipients. > >How can I solve this problem? Use SPF (see http://spf.pobox.com) and make sure that ALL outgoing e-mail is SRS signed (see same website). I'm using the sendmail perl script with the "-S" option, which checks the recipient of a message which has a "MAIL FROM: <>". If the recipient is postmaster or abuse, accept the message. If the recipient is someone else, only accept the e-mail when the recipient is SRS signed AND is signed by your mailserver (i.e. your MTA can translate the SRS signed recipient into it's unsigned form). >Thanks, Andreas Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Fri Dec 10 19:16:59 2004 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:27:54 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX _TEMPFAIL Message-ID: Derek Catanzaro wrote: > Yes, it is over 2 GB. I am going to clean it up and see if that > helps. This is a relay server so I really don't check mail on this > server. I never set a quota for root, is 2 GB a standard limit for > mail files? > > Thanks for your response If you don't want to have to check the root mailbox on relay servers, you can put a .forward file in the root's home dir. In it just put the address to forward the messages to. In mine, I have: postmaster@ci.juneau.ak.us and all mail is forwarded to our exchange server where I can see it at the same time I look at my regular mail rather than building up in mbox on the Linux server... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From andy at TIRESWING.NET Fri Dec 10 19:58:01 2004 From: andy at TIRESWING.NET (Andy Norris) Date: Thu Jan 12 21:27:54 2006 Subject: sendmail / spamassassin services Message-ID: I'm running MailScanner 4.36.4. Last week the list educated me that sendmail should not be running on its own, and neither should spamassassin. I upgraded to spamassassin 3.0.1, but what I'm seeing in the maillog is the connection to spamd being refused. So we're back to virtually no spam filtering... Dec 10 13:44:40 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 failed, retrying (1/3): Connection refused Dec 10 13:44:41 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 failed, retrying (2/3): Connection refused Dec 10 13:44:42 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 failed, retrying (3/3): Connection refused This from the logs. What am I missing? thanks, Andy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Dec 10 21:26:35 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:27:54 2006 Subject: sendmail / spamassassin services Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Andy Norris wrote: > I'm running MailScanner 4.36.4. > > Last week the list educated me that sendmail should not be running on its > own, and neither should spamassassin. I upgraded to spamassassin > 3.0.1, but > what I'm seeing in the maillog is the connection to spamd being refused. > > So we're back to virtually no spam filtering... > > Dec 10 13:44:40 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 > failed, retrying (1/3): Connection refused > Dec 10 13:44:41 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 > failed, retrying (2/3): Connection refused > Dec 10 13:44:42 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 > failed, retrying (3/3): Connection refused > > This from the logs. > > What am I missing? > Andy, MailScanner does not use spamc/spamd. If you are running those pleas stop them. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From andy at TIRESWING.NET Fri Dec 10 21:32:27 2004 From: andy at TIRESWING.NET (Andy Norris) Date: Thu Jan 12 21:27:54 2006 Subject: sendmail / spamassassin services Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Denis, I rebooted the server. Spamd is not running, and I find this in the logs: Dec 10 15:38:28 tireswing spamc[6529]: connect() to spamd at 127.0.0.1 failed, retrying (1/3): Connection refused Should I just ignore this? Is it working okay? Thanks for your help, Andy At 03:26 pm 2004-12-10, Denis Beauchemin wrote: >Andy Norris wrote: > >>I'm running MailScanner 4.36.4. >> >>Last week the list educated me that sendmail should not be running on its >>own, and neither should spamassassin. I upgraded to spamassassin 3.0.1, but >>what I'm seeing in the maillog is the connection to spamd being refused. >> >>So we're back to virtually no spam filtering... >> >>Dec 10 13:44:40 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 >>failed, retrying (1/3): Connection refused >>Dec 10 13:44:41 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 >>failed, retrying (2/3): Connection refused >>Dec 10 13:44:42 tireswing spamc[22597]: connect() to spamd at 127.0.0.1 >>failed, retrying (3/3): Connection refused >> >>This from the logs. >> >>What am I missing? > >Andy, > >MailScanner does not use spamc/spamd. If you are running those pleas stop >them. > >Denis > >-- > _ > °v° Denis Beauchemin, analyste >/(_)\ Université de Sherbrooke, S.T.I. > ^ ^ T: 819.821.8000x2252 F: 819.821.8045 > > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Fri Dec 10 21:41:04 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:27:54 2006 Subject: sendmail / spamassassin services Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Andy Norris wrote: > Dec 10 15:38:28 tireswing spamc[6529]: connect() to spamd at 127.0.0.1 > failed, retrying (1/3): Connection refused > > Should I just ignore this? Is it working okay? Spamc is the client part of spamd. Find what is running spamc and stop it. What software other than MS and SA do you have on the server? Do you run procmail? I have seen Linux systems come with SA configured to filter mail for Mozilla and other mail clients. Sorry for not reading all your posts but I'll take a guess and assume you have an RPM system. If you can't solve it, remove the SA RPMs and build new ones from SA source (spec file is included). -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Dec 10 21:51:08 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:27:54 2006 Subject: sendmail / spamassassin services Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Andy Norris wrote: > Hi Denis, > > I rebooted the server. Spamd is not running, and I find this in the logs: > > Dec 10 15:38:28 tireswing spamc[6529]: connect() to spamd at 127.0.0.1 > failed, retrying (1/3): Connection refused > > Should I just ignore this? Is it working okay? > Andy, It os not OK. Looks like you got SpamAssassin called by something else from MailScanner... did you do anything to make sendmail call SA? If so you shouldn't have. Good luck (week-end is just starting) Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From xterm1 at TATORZ.COM Fri Dec 10 21:58:30 2004 From: xterm1 at TATORZ.COM (xterm1) Date: Thu Jan 12 21:27:54 2006 Subject: sendmail / spamassassin services Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] | |Spamc is the client part of spamd. Find what is running spamc and stop |it. What software other than MS and SA do you have on the server? Do you |run procmail? I have seen Linux systems come with SA configured to |filter mail for Mozilla and other mail clients. Could it possibly be a procmail or /etc/procmail .. just a thought! Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From andy at TIRESWING.NET Fri Dec 10 22:11:32 2004 From: andy at TIRESWING.NET (Andy Norris) Date: Thu Jan 12 21:27:54 2006 Subject: sendmail / spamassassin services Message-ID: This is on a server running Ensim, so I have no doubt that it's buried somewhere... It may take the weekend to find it! Thanks for all your suggestions. Andy At 03:58 pm 2004-12-10, xterm1 wrote: >| >|Spamc is the client part of spamd. Find what is running spamc and stop >|it. What software other than MS and SA do you have on the server? Do you >|run procmail? I have seen Linux systems come with SA configured to >|filter mail for Mozilla and other mail clients. > > >Could it possibly be a procmail or /etc/procmail .. >just a thought! > >Brian > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sat Dec 11 00:36:22 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:54 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Derek Catanzaro wrote: > >> Yes, it is over 2 GB. I am going to clean it up and see if that helps. >> This is a relay server so I really don't check mail on this server. I >> never set a quota for root, is 2 GB a standard limit for mail files? >> > > No. It's a limit of 32-bit filesystems. You can't have files over > 2GB unless you use a 64-bit filesystem which is not common You could look at aliasing root to a real address as suggested in the generic aliases file and have all mail for root forwarded to an address off the server. Alternatively use maildir :-) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Matt_Montes at TSTNA.COM Sat Dec 11 01:55:56 2004 From: Matt_Montes at TSTNA.COM (Matt Montes) Date: Thu Jan 12 21:27:54 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Actually all Redhat distributions since 8 have large file support and can write and read files over 2 GB. At work we are using all redhat so my experience with the other distros has been limited for a few years but I would think that almost any modern distro would support this also. -----Original Message----- From: MailScanner mailing list on behalf of Denis Beauchemin Sent: Fri 12/10/2004 2:05 PM To: MAILSCANNER@JISCMAIL.AC.UK Cc: Subject: Re: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jrudd at UCSC.EDU Sat Dec 11 04:00:10 2004 From: jrudd at UCSC.EDU (John Rudd) Date: Thu Jan 12 21:27:54 2006 Subject: OT: Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Message-ID: IIRC, it's not just the file system, but the local mailer, which has to be 64bit aware. Otherwise it wont have a pointer that's large enough to address the file. Part of that should be having proper include files and libraries, so it may just be a recompile. Or a build flag for sendmail (where the local mailer is coming from, I assume). Not being a linux user, I don't know how well it abstracts those types of things from end programs. On Dec 10, 2004, at 5:55 PM, Matt Montes wrote: > Actually all Redhat distributions since 8 have large file support and > can write and read files over 2 GB. At work we are using all redhat > so my experience with the other distros has been limited for a few > years but I would think that almost any modern distro would support > this also. > > > > > -----Original Message----- > From: MailScanner mailing list on behalf of Denis Beauchemin > Sent: Fri 12/10/2004 2:05 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Cc: > Subject: Re: OT: Deferred: local mailer (/usr/bin/procmail) > exited with EX_TEMPFAIL > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at pdscc.com Sat Dec 11 19:00:32 2004 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Jan 12 21:27:54 2006 Subject: send all virus messages to one account Message-ID: Presently at one client we have things setup so that all messages marked as spam get sent to one specific mailbox that is monitored by the admin, now I've been asked to send messages tagged with {Virus?} to also be sent to this same mailbox. I've browsed the conf file, but don't see the option for this. Basically I am looking for something like the "Spam Actions" directive. Currently running MS 4.25-14. Why do they want this? Well as it was put to me, they'd rather the office admin at $15 or $20/hr be dealing with and deleting these messages than the engineers who are paid $50/hr. -- Harondel J. Sibble Sibble Computer Consulting Creating solutions for the small business and home computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com (604) 739-3709 (voice/fax) (604) 686-2253 (pager) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sat Dec 11 19:12:38 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: send all virus messages to one account Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] How about they set "Deliver Cleaned Messages = no" and have MailScanner do the job for $0/hr ? Harondel J. Sibble wrote: >Presently at one client we have things setup so that all messages marked as >spam get sent to one specific mailbox that is monitored by the admin, now >I've been asked to send messages tagged with {Virus?} to also be sent to this >same mailbox. I've browsed the conf file, but don't see the option for this. >Basically I am looking for something like the "Spam Actions" directive. > >Currently running MS 4.25-14. > >Why do they want this? Well as it was put to me, they'd rather the office >admin at $15 or $20/hr be dealing with and deleting these messages than the >engineers who are paid $50/hr. > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paul at WELSHFAMILY.COM Sat Dec 11 22:11:52 2004 From: paul at WELSHFAMILY.COM (Paul Welsh) Date: Thu Jan 12 21:27:54 2006 Subject: Using rbl lists Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quick question about spam blacklists (RBLs). I've added a few lists to the "Spam List" setting but what determines whether a message gets classified as spam? If the sending server, for example, is on one RBL then is this sufficient? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sat Dec 11 22:16:09 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: Using rbl lists Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Paul Welsh wrote: > Quick question about spam blacklists (RBLs). > > I've added a few lists to the "Spam List" setting but what determines > whether a message gets classified as spam? If the sending server, for > example, is on one RBL then is this sufficient? It gets classified as spam if any of the lists match. So it is sufficient if the sending server is on one RBL. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sat Dec 11 22:18:22 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:54 2006 Subject: Using rbl lists Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Paul Welsh wrote: > Quick question about spam blacklists (RBLs). > > I've added a few lists to the "Spam List" setting but what determines > whether a message gets classified as spam? If the sending server, for > example, is on one RBL then is this sufficient? The look up is made against the sending (Connecting) server. A better option (IMHO) is to use the RBL's in SpamAssassin possibly with some (a) very conservative list on your MTA. For example, don't reject at MTA using SpamCop for example. A good list but can provide FPs due to it's more aggressive nature. I look to all the RBLs to add to the overall points score in SA where a more balanced view can be taken (And it looks up all hops the message has taken not just the last one!). HTH Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at BARENDSE.TO Sun Dec 12 07:33:51 2004 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:27:54 2006 Subject: New challenge : ok_languages allow and disallow per user Message-ID: Hi List! I have a new challenge. We got lot and lots (and lots) of chinese spam mails even though nobody in the company could read Chinese. So I blocked all messages in Chinese and all was fine. However, we now do have some Chinese people within the company and they would like to e-mail in Chinese too. What are my options without bothering everyone else in the company with Chinese e-mails again, I guess we cannot differentiate in the ok_languages and ok_locales rules from s.a.prefs per user? I would still ike to do spam scanning on the Chinese mails too but not just block them because they are in Chinese? I would prefer to keep them on the general mail domain that the rest of the company is using too. I could register a new .cn domain name and exempt that from spam scanning at all. Alternatively I could reg a new .cn domain name and hopefully apply a different set of spam.assassin.prefs for that particular domain. Use an entirely different server for their e-mail so I can apply different MailScanner and SA rulesets (really ugly because I will have to maintain yet another server). Or does anybody know any pretty solutions to this? Thanks list and happy holidays!! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Sun Dec 12 13:53:10 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:54 2006 Subject: Using rbl lists Message-ID: MailScanner mailing list wrote: > Quick question about spam blacklists (RBLs). > > I've added a few lists to the "Spam List" setting but what > determines whether a message gets classified as spam? If the > sending server, for example, is on one RBL then is this sufficient? As already mentioned one RBL is enough to block the mail. The problem with the RBLs being used in this way is that it is a very blunt tool and your FP rate can be very high. Using the RBLs via SA gives a better result. Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sun Dec 12 16:33:19 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: Keep viruses out of spam quarantine Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released beta version 4.37.2. The main new feature is one that some of you have been waiting for a long time, and I hope I have come up with a resonable solution to the problem you were hitting, while not solving it the way you suggested (bit of lateral thinking went on here :-) If you quarantine spam, you end up with the quarantine containing virus-infected spam as well. Bad news if you want to give your users access to be able to retrieve messages from the quarantine. They can retrieve viruses as well. There is a new option: Keep Spam And MCP Archive Clean If you set this to yes, then all spam will be virus-scanned, and removed from the quarantine if it was found to be infected in any way. This way, your users can't infect themselves. I hope this is to your liking, it's not the most elegant implementation, but doing it elegantly was such a big job it was never going to happen. Please let me know what you think. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sun Dec 12 16:45:41 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released beta version 4.37.2. The main new feature is one that some of you have been waiting for a long time, and I hope I have come up with a resonable solution to the problem you were hitting, while not solving it the way you suggested (bit of lateral thinking went on here :-) If you quarantine spam, you end up with the quarantine containing virus-infected spam as well. Bad news if you want to give your users access to be able to retrieve messages from the quarantine. They can retrieve viruses as well. There is a new option: Keep Spam And MCP Archive Clean If you set this to yes, then all spam will be virus-scanned, and removed from the quarantine if it was found to be infected in any way. This way, your users can't infect themselves. I hope this is to your liking, it's not the most elegant implementation, but doing it elegantly was such a big job it was never going to happen. Please let me know what you think. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cpicciotto at KALISYSTEMS.COM Sun Dec 12 18:06:22 2004 From: cpicciotto at KALISYSTEMS.COM (Chris Picciotto) Date: Thu Jan 12 21:27:54 2006 Subject: Using rbl lists Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I don't agree 100% with this approach. Using BL at the MTA has some very significant benefits. The most significant is that rejecting at the MTA prevents any further downstream processing by either MS or SA (and virus scanner) which are all resource intensive. On server where there is a lot of incoming spam, this will make a huge difference. I do agree that not all lists are appropriate for rejection at the MTA, but certainly ORDB is. I also use Spamcop at the gateway, and find few (to no) FP's. Others, such as SORBS, are effective but have a tendency to occasionally list major smtp servers such as AOL etc., so more care needs to be taken. Chris ----- Original Message ----- From: "Michele Neylon :: Blacknight Solutions" To: Sent: Sunday, December 12, 2004 3:53 AM Subject: Re: Using rbl lists > MailScanner mailing list wrote: >> Quick question about spam blacklists (RBLs). >> >> I've added a few lists to the "Spam List" setting but what >> determines whether a message gets classified as spam? If the >> sending server, for example, is on one RBL then is this sufficient? > > As already mentioned one RBL is enough to block the mail. The problem with > the RBLs being used in this way is that it is a very blunt tool and your > FP > rate can be very high. Using the RBLs via SA gives a better result. > > > > Mr Michele Neylon > Blacknight Internet Solutions Ltd > Hosting, co-location & domains > http://www.blacknight.ie/ > Tel. +353 59 9137101 > http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at BARENDSE.TO Sun Dec 12 19:52:54 2004 From: mailscanner at BARENDSE.TO (Remco Barendse) Date: Thu Jan 12 21:27:54 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: On Sun, 12 Dec 2004, Julian Field wrote: > I have just released beta version 4.37.2. > > The main new feature is one that some of you have been waiting for a > long time, and I hope I have come up with a resonable solution to the > problem you were hitting, while not solving it the way you suggested > (bit of lateral thinking went on here :-) > > If you quarantine spam, you end up with the quarantine containing > virus-infected spam as well. > Bad news if you want to give your users access to be able to retrieve > messages from the quarantine. They can retrieve viruses as well. > > There is a new option: > Keep Spam And MCP Archive Clean > If you set this to yes, then all spam will be virus-scanned, and removed > from the quarantine if it was found to be infected in any way. This way, > your users can't infect themselves. > > I hope this is to your liking, it's not the most elegant implementation, > but doing it elegantly was such a big job it was never going to happen. > Please let me know what you think. Great option! Just one question, will this keep the quarantine clean of bad stuff that was reported by clamav or also of mails that contain insecure / scripts etc? Thanks! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sun Dec 12 20:39:35 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remco Barendse wrote: > On Sun, 12 Dec 2004, Julian Field wrote: > >> I have just released beta version 4.37.2. >> >> The main new feature is one that some of you have been waiting for a >> long time, and I hope I have come up with a resonable solution to the >> problem you were hitting, while not solving it the way you suggested >> (bit of lateral thinking went on here :-) >> >> If you quarantine spam, you end up with the quarantine containing >> virus-infected spam as well. >> Bad news if you want to give your users access to be able to retrieve >> messages from the quarantine. They can retrieve viruses as well. >> >> There is a new option: >> Keep Spam And MCP Archive Clean >> If you set this to yes, then all spam will be virus-scanned, and removed >> from the quarantine if it was found to be infected in any way. This way, >> your users can't infect themselves. >> >> I hope this is to your liking, it's not the most elegant implementation, >> but doing it elegantly was such a big job it was never going to happen. >> Please let me know what you think. > > > Great option! Just one question, will this keep the quarantine clean of > bad stuff that was reported by clamav or also of mails that contain > insecure / scripts etc? Clean of anything deemed to be an infection. Bad filenames, viruses, etc. That includes messages that have scripts in them, all that stuff. The aim is to leave the quarantine harmless. But the messages in there won't be "disarmed" they will just be removed if dangerous content was found in them. That's due to the way I implemented it (i.e. not perfect but it did happen at all :) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sun Dec 12 20:40:32 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: Cleaned up website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have cleaned up the website quite a bit to try to make it easier to navigate. Please let me know your thoughts, and any extra suggestions you have. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Sun Dec 12 21:14:02 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele) Date: Thu Jan 12 21:27:54 2006 Subject: Cleaned up website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have cleaned up the website quite a bit to try to make it easier to > navigate. > Please let me know your thoughts, and any extra suggestions you have. For the IRC section you left out the ipv6 hostname :( ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From xterm1 at TATORZ.COM Sun Dec 12 23:52:42 2004 From: xterm1 at TATORZ.COM (xterm1) Date: Thu Jan 12 21:27:54 2006 Subject: Virus Scanners! Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just a simple question. I have 3 Virus scanners running with MailScanner. Would I be wasting Resources, or is it not such a bad Idea! I feel that if 1 or maybe 2 out of the 3 miss a virus the other will catch it! I by no means have a critical setup IE Corporate/Business But I despise the incoming spam and Virus's! Thoughts or rants Welcome! Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From test at NEXTMILL.NET Mon Dec 13 03:56:10 2004 From: test at NEXTMILL.NET (Brian Lewis) Date: Thu Jan 12 21:27:54 2006 Subject: Mqueue getting huge - MailScanner problem Message-ID: We found after upgrading to SA 3.x that the sa-learn cron job that is ran nightly didn't pick up the correct path to the bayes databases, so we modified our cron script to execute the following: sa-learn --force-expire -- siteconfigpath=/etc/MailScanner/spam.assassin.prefs.conf This way it could parse the correct spam.assassin.prefs.conf file for the correct bayes database location. Previously it worked on 2.6x but after the 3.x upgrade it would use the sa pref conf and not the one used by mailscanner, so our bayes database grew out of control, something like 300+ megs! It took a few hours for it to expire it back down to 10 megs. We also moved DNS to a dedicated DNS machine, it runs both the mysql database for mailwatch and named for dns cache because our service provider was blocking our dns requests from our mailscanners! They say they weren't but its pretty obvious when you can nslookup for any machine except from your mailscanners. Next step is to move towards using RBLDNSD to keep most RBL lookups local and prevent the latency involved in querying the public database servers that can have problems at times. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at PELLEYS.COM Mon Dec 13 07:04:03 2004 From: mike at PELLEYS.COM (Mike Pelley) Date: Thu Jan 12 21:27:54 2006 Subject: LogWatch being marked as spam Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Folks - I've googled and can't find a solution that works. I have added to my /etc/MailScanner/rules/spam.whitelist.rules file (this is the order) FromOrTo: default no FromOrTo: root@zeus.pelleys.com yes but every now and then my LogWatch logs are being bounced back to me (in truncated form!) as being spam. A typical header is: This is the Postfix program at host zeus.pelleys.com. I'm sorry to have to inform you that the message returned below could not be delivered to one or more destinations. For further assistance, please send mail to If you do so, please include this problem report. You can delete your own text from the message returned below. The Postfix program : SecuritySage SPAM-ID: b20030701-288001 Your email had spam-like body contents. To report this message as non-spam, please follow the instructions available at http://www.securitysage.com/spam.html ________________________________________________________________________ Reporting-MTA: dns; zeus.pelleys.com Arrival-Date: Sun, 12 Dec 2004 04:02:13 -0330 (NST) Final-Recipient: rfc822; root@zeus.pelleys.com Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; SecuritySage SPAM-ID: b20030701-288001 Your email had spam-like body contents. To report this message as non-spam, please follow the instructions available at http://www.securitysage.com/spam.html Suggestion? Thanks! Cheers, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Mon Dec 13 07:22:08 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:27:54 2006 Subject: LogWatch being marked as spam Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike Pelley wrote: > Folks - I've googled and can't find a solution that works. I have > added to my /etc/MailScanner/rules/spam.whitelist.rules file (this is > the order) > > FromOrTo: default no > FromOrTo: root@zeus.pelleys.com yes > afaik "default" shoud be the last rule $ grep -1 default /etc/MailScanner/rules/EXAMPLES From: /^192\.168\.13[4567]\./ yes FromOrTo: default no -- From: 123.231.3. yes FromOrTo: default no -- From: 192.168. yes FromOrTo: default no where your network is the whole of 192.168.xxx.xxx. -- FromOrTo: *@scanme-too.com yes FromOrTo: default no -- To: @def.com postmaster@me.com bill@def.com FromOrTo: default postmaster@me.com -- Virus: sobig no Virus: default yes -- FromOrTo: domain.com and FromOrTo: domain2.com deliver FromOrTo: default store notify -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at pdscc.com Mon Dec 13 07:23:18 2004 From: mailscanner at pdscc.com (Harondel J. Sibble) Date: Thu Jan 12 21:27:54 2006 Subject: send all virus messages to one account Message-ID: On 11 Dec 2004 at 19:12, Julian Field wrote: > How about they set "Deliver Cleaned Messages = no" and have MailScanner > do the job for $0/hr ? Thought of that and they said they'd rather go throught the "chaff" manually on the chance that something important would be missed. -- Harondel J. Sibble Sibble Computer Consulting Creating solutions for the small business and home computer user. help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com (604) 739-3709 (voice/fax) (604) 686-2253 (pager) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Mon Dec 13 09:11:19 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: Virus Scanners! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] 3 is quite reasonable, a lot of people do that. xterm1 wrote: > I have just a simple question. I have 3 Virus scanners running with >MailScanner. Would >I be wasting Resources, or is it not such a bad Idea! I feel that if 1 or >maybe 2 out of the 3 >miss a virus the other will catch it! I by no means have a critical setup >IE Corporate/Business >But I despise the incoming spam and Virus's! > > Thoughts or rants Welcome! > >Brian > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Mon Dec 13 09:13:17 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: send all virus messages to one account Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] In which case they will have to use some other means to access the virus quarantine. There isn't a "Virus Actions" option, sorry. Your best bet is to archive the viruses in a quarantine area and them give them access to the quarantine via some other route. Harondel J. Sibble wrote: >On 11 Dec 2004 at 19:12, Julian Field wrote: > > > >>How about they set "Deliver Cleaned Messages = no" and have MailScanner >>do the job for $0/hr ? >> >> > >Thought of that and they said they'd rather go throught the "chaff" manually >on the chance that something important would be missed. > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From admin at thenamegame.com Mon Dec 13 09:14:51 2004 From: admin at thenamegame.com (Michael Freeman) Date: Thu Jan 12 21:27:54 2006 Subject: Autoupdate always runs a generic update for virus updates Message-ID: Im running F-Secure. When Autoupdate runs on the hour there are 4 messages as shown. Dec 13 04:07:39 srv08 update.virus.scanners: Found f-secure installed Dec 13 04:07:39 srv08 update.virus.scanners: Running autoupdate for f-secure Dec 13 04:07:47 srv08 update.virus.scanners: Found generic installed Dec 13 04:07:47 srv08 update.virus.scanners: Running autoupdate for generic Autoupdate for f-secure is fine, but why does MS also run an autoupdate for generic? I would think that if autoupdate for f-secure runs then the second or at least generic version should not be running. How can this be fixed? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Mon Dec 13 09:58:15 2004 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:27:54 2006 Subject: Duplicate emails - same smtp id processed by different MS processes. Message-ID: The situation appears even more confused. I also have to specify "Lock Type = posix" to stop the duplication on our Red Hat Enterprise Linux AS release 3 (Taroon Update 1) but it is running with its own Sendmail 8.12.10. Quentin --- PHONE: +44 191 222 8209 Information Systems and Services (ISS), University of Newcastle, Newcastle upon Tyne, FAX: +44 191 222 8765 United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." >-----Original Message----- >From: MailScanner mailing list >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alan Dobkin >Sent: 09 December 2004 16:50 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Duplicate emails - same smtp id processed by >different MS processes. > >On 12/7/2004 12:34 PM, Julian Field wrote: >> With sendmail-8.13 on Linux systems, you need to set > > "Lock Type = posix" in MailScanner.conf. > >FWIW, I upgraded my server from Fedora Core 2 to Fedora Core 3 >and around the same time upgraded MailScanner to version 4.36.1-1. >Fedora Core 3 included sendmail 8.13 (previously 8.12 in Core 2), >and I didn't realize that the locking method had changed. Around >the same time, the MailScanner.conf file, which used to default >to "Lock Type = flock" was changed to just "Lock Type = " (blank), >so I suspected MailScanner may be causing the problem, but making >the change to "Lock Type = posix" seems to do the trick. > >In retrospect, I now see that the sendmail release notes warned >about this change over 2 years ago, back in release 8.12.5: > >8.12.5/8.12.5 2002/06/25 > NOTE: Linux appears to have broken flock() again. Unless > the bug is fixed before sendmail 8.13 is shipped, > 8.13 will change the default locking method to > fcntl() for Linux kernel 2.4 and later. You may > want to do this in 8.12 by compiling with > -DHASFLOCK=0. Be sure to update other sendmail > related programs to match locking techniques. > >So, this begs the question, why not set "Lock Type = fcntl" instead >of posix in MailScanner? Does it not understand this method? > >Thanks, >Alan > >-- >Reclaim Your Inbox - Get Thunderbird! >http://www.Mozilla.org/products/thunderbird/ > >Rediscover the Web - Get Firefox! >http://www.SpreadFirefox.com/?q=affiliates&id=21548&t=68 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chuck.foster at STREAMSHIELD.COM Mon Dec 13 11:09:58 2004 From: chuck.foster at STREAMSHIELD.COM (Chuck Foster) Date: Thu Jan 12 21:27:54 2006 Subject: virus scanning quarantine spam (MailScanner ANNOUNCE 4.37.2) Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I took a quick look at this, but I'm not sure how it does it in the code? I can see a $VirusBeforeSpamMCP variable being set in the MailScanner binary, but couldn't see where it actually gets used so that RemoveInfectedSpam() does something useful. Probably just a Monday morning thing! The way I'd originally envisaged resolving this pre-this-release was to look at swapping over the AV and AS calls, on the basis that if something is flagged as a virus people aren't really going to care that it is spam as well ... we're working in a situation where customers may want to quarantine spam messages or not, and I couldn't really see the point of virus-scanning something that is to be thrown away, but also didn't want it stored without being checked. Your method probably sorts that dilemma out, though a ruleset to determine whether to remove the infected message or not would be useful! Best Wishes, Chuck -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Julian Field Sent: 12 December 2004 16:46 To: MAILSCANNER@JISCMAIL.AC.UK Subject: MailScanner ANNOUNCE 4.37.2 I have just released beta version 4.37.2. The main new feature is one that some of you have been waiting for a long time, and I hope I have come up with a resonable solution to the problem you were hitting, while not solving it the way you suggested (bit of lateral thinking went on here :-) If you quarantine spam, you end up with the quarantine containing virus-infected spam as well. Bad news if you want to give your users access to be able to retrieve messages from the quarantine. They can retrieve viruses as well. There is a new option: Keep Spam And MCP Archive Clean If you set this to yes, then all spam will be virus-scanned, and removed from the quarantine if it was found to be infected in any way. This way, your users can't infect themselves. I hope this is to your liking, it's not the most elegant implementation, but doing it elegantly was such a big job it was never going to happen. Please let me know what you think. This message should be regarded as confidential. If you have received this email in error please notify the sender and destroy it immediately. Statements of intent shall only become binding when confirmed in hard copy by an authorized signatory. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chuck.foster at STREAMSHIELD.COM Mon Dec 13 11:14:12 2004 From: chuck.foster at STREAMSHIELD.COM (Chuck Foster) Date: Thu Jan 12 21:27:54 2006 Subject: signed message corruption Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hmm, noticed with Denis Beachemin's signed messages that (Outlook) winges about the message body having been modified in transit. What I'm not so sure about is whether this is down to the MailScanner list or my own local MailScanner implementation, and in either case what can be done about it. I'm assuming its the addition of a signature that is causing this message ... C:> This message should be regarded as confidential. If you have received this email in error please notify the sender and destroy it immediately. Statements of intent shall only become binding when confirmed in hard copy by an authorized signatory. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Mon Dec 13 11:22:30 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:54 2006 Subject: virus scanning quarantine spam (MailScanner ANNOUNCE 4.37.2) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Swappin over the AV and AS calls is a huge job, believe me. There are a million subtle interactions between these two. Look in MessageBatch.pm for your answer. As I say, it's not elegant, but it works, and it was about the only way it was going to happen in the medium term. Chuck Foster wrote: > Hi, > > I took a quick look at this, but I'm not sure how it does it in the > code? I can see a $VirusBeforeSpamMCP variable being set in the > MailScanner binary, but couldn't see where it actually gets used so > that RemoveInfectedSpam() does something useful. > > Probably just a Monday morning thing! > > > The way I'd originally envisaged resolving this pre-this-release was > to look at swapping over the AV and AS calls, on the basis that if > something is flagged as a virus people aren't really going to care > that it is spam as well ... we're working in a situation where > customers may want to quarantine spam messages or not, and I couldn't > really see the point of virus-scanning something that is to be thrown > away, but also didn't want it stored without being checked. Your > method probably sorts that dilemma out, though a ruleset to determine > whether to remove the infected message or not would be useful! > > Best Wishes, > Chuck > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Julian Field > Sent: 12 December 2004 16:46 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: MailScanner ANNOUNCE 4.37.2 > > > I have just released beta version 4.37.2. > > The main new feature is one that some of you have been waiting for a > long time, and I hope I have come up with a resonable solution to the > problem you were hitting, while not solving it the way you suggested > (bit of lateral thinking went on here :-) > > If you quarantine spam, you end up with the quarantine containing > virus-infected spam as well. > Bad news if you want to give your users access to be able to retrieve > messages from the quarantine. They can retrieve viruses as well. > > There is a new option: > Keep Spam And MCP Archive Clean > If you set this to yes, then all spam will be virus-scanned, and removed > from the quarantine if it was found to be infected in any way. This way, > your users can't infect themselves. > > I hope this is to your liking, it's not the most elegant implementation, > but doing it elegantly was such a big job it was never going to happen. > Please let me know what you think. > > > > This message should be regarded as confidential. If you have received > this > email in error please notify the sender and destroy it immediately. > Statements of intent shall only become binding when confirmed in hard > copy > by an authorized signatory. > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From xterm1 at TATORZ.COM Mon Dec 13 11:26:43 2004 From: xterm1 at TATORZ.COM (xterm1) Date: Thu Jan 12 21:27:54 2006 Subject: Virus Scanners! Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] |-----Original Message----- |From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On |Behalf Of Julian Field |Sent: Monday, December 13, 2004 4:11 AM |To: MAILSCANNER@JISCMAIL.AC.UK |Subject: Re: Virus Scanners! | | |3 is quite reasonable, a lot of people do that. Thanks Julian for your reply! |xterm1 wrote: | |> I have just a simple question. I have 3 Virus scanners |running with |>MailScanner. Would |>I be wasting Resources, or is it not such a bad Idea! I feel that if 1 or |>maybe 2 out of the 3 |>miss a virus the other will catch it! I by no means have a critical setup |>IE Corporate/Business |>But I despise the incoming spam and Virus's! |> |> Thoughts or rants Welcome! |> |>Brian |> |>------------------------ MailScanner list ------------------------ |>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: |>'leave mailscanner' in the body of the email. |>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and |>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). |> |>Support MailScanner development - buy the book off the website! |> |> |> | |-- |Julian Field |www.MailScanner.info |Buy the MailScanner book at www.MailScanner.info/store | |PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 | |------------------------ MailScanner list ------------------------ |To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: |'leave mailscanner' in the body of the email. |Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and |the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). | |Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Mon Dec 13 12:42:54 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:54 2006 Subject: LogWatch being marked as spam Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Mon, December 13, 2004 7:04, Mike Pelley said: > Folks - I've googled and can't find a solution that works. I have added > to my /etc/MailScanner/rules/spam.whitelist.rules file (this is the order) > > FromOrTo: default no > FromOrTo: root@zeus.pelleys.com yes > > > : SecuritySage SPAM-ID: b20030701-288001 Your email > had > spam-like body contents. To report this message as non-spam, please > follow > the instructions available at http://www.securitysage.com/spam.html > > ------------------------------------------------------------------------ > > Reporting-MTA: dns; zeus.pelleys.com > Arrival-Date: Sun, 12 Dec 2004 04:02:13 -0330 (NST) > > Final-Recipient: rfc822; root@zeus.pelleys.com > Action: failed > Status: 5.0.0 > Diagnostic-Code: X-Postfix; SecuritySage SPAM-ID: b20030701-288001 Your > email > had spam-like body contents. To report this message as non-spam, > please > follow the instructions available at > http://www.securitysage.com/spam.html > > > > Suggestion? This is not a MailScanner bounce. Have you got header/ body checks running in Postfix? More the point have you looked at the link in the bounce message (http://www.securitysage.com/spam.html)? I think that will give you the answers you are looking for! Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From piper at HRZ.UNI-MARBURG.DE Mon Dec 13 13:09:12 2004 From: piper at HRZ.UNI-MARBURG.DE (Andreas Piper) Date: Thu Jan 12 21:27:55 2006 Subject: wrong "message/partial", was: How to block delivery of MAILER-DAEMON (<>) messages? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks for your answers, > period of time to alleviate the problem, go on. If you have read the RFCs > and still intend to block permanently, please find a replacement admin and > resign your position. > I will honour the RFC (I really didn't think of the legitimate non-delivery-reports when I saw the flood of messages for faked recipients). > Second, the "deliver cleaned messages" option only applies to virus > infected emails that have been cleaned. It won't affect non-virus messages. Some further analysis shows, that all these messages are from MAILER-DAEMON@bigfoot.com These messages are not virus-infected, but they are cleaned by MailScanner, as they contain the line Content-Type: message/partial in the message-body and my MailScanner.conf contains Allow Partial Messages = no As I have further set Dangerous Content Scanning = yes and Deliver Cleaned Messages = yes the message-body is replaced by the Deleted Bad Content Message Report and the cleaned message is delivered (which creates some confusion with my users). The main problem here seems to be, that the line Content-Type: message/partial is not used correctly in these messages, as RFC 2046 states that 'Three parameters must be specified in the Content-Type field of type "message/partial":' (which are "id", "number" and "total"). These parameters are not existing in these messages. I now made a small change in SweepContent.pm (find attached) to get MailScanner to check for the existence of these parameters, and only clean the message if they exist. With such a change, the messages will contain their original content, and can therefore more easily be recognized by the users, whereas true partial messages will still be recognized. Any comments on this? Andreas -- ________________________________________________________________________ Dr. Andreas Piper, Hochschulrechenzentrum der Philipps-Univ. Marburg Hans-Meerwein-Strasse, 35032 Marburg, Germany Phone: +49 6421 28-23521 Fax: -26994 Email: piper@HRZ.Uni-Marburg.DE ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Text/X-DIFF (charset: ISO-8859-1 "Latin 1 (Western ] [ Europe)") (Name: "SweepContent.patch") 19 lines. ] [ Unable to print this part. ] From Glenn.Steen at AP1.SE Mon Dec 13 13:23:13 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:55 2006 Subject: Some Attachments corrupt when enable Dangerous Content Scanning Message-ID: From yoloits at YCOE.ORG Mon Dec 13 13:31:21 2004 From: yoloits at YCOE.ORG (yoloits) Date: Thu Jan 12 21:27:55 2006 Subject: procmailrc question Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am currently running MailScanner with SpamAssassin 3.0.1 on Red Hat Linux 3.0 as my primary mail server for about 2,000 PCs with great results. I have some experience with Linux. I am working with Linux more. My question is would using procmailrc be a benefit to SPAM filtering along with MailScanner and SpamAssassin or is it for sorting email? I don't need to sort the email I am just interested in good SPAM filtering. Thanks Jay ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Mon Dec 13 13:48:14 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:55 2006 Subject: OT : Mailing list etiquette / RTFM Message-ID: Just my usual rant: - please don't post HTML emails. They may seem appropriate for marketing but they are not appropriate for a technical mailing list. - please don't put in 40 line disclaimers. We aren't going to read them and as you are posting to a public mailing list they are a kind of pointless - when replying to previous emails try "snipping". There's no point in reposting several hundred lines of logs etc., to simply say two words - Subject lines serve a purpose. Please use them and DO NOT hijack threads. - Please read the MAQ/FAQ and other documentation. The most common issues have been covered many times in the past. - Wording your questions properly will help avoid getting "larted". Please read http://www.catb.org/~esr/faqs/smart-questions.html if you are unsure what this means. - The output of MailScanner -v is useful. - Help us help you. We cannot "guess" what you are doing or using. (see above) Michele Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Mon Dec 13 13:50:42 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: Um, is this to say it'll behave the same as having the "spam actions deliver to /dev/null", or will it just drop the dangerous messages? (Yeah, I've been to lazy to DL it yet:-) -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: den 12 december 2004 21:40 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner ANNOUNCE 4.37.2 > > > Remco Barendse wrote: > > > On Sun, 12 Dec 2004, Julian Field wrote: > > > >> I have just released beta version 4.37.2. > >> > >> The main new feature is one that some of you have been > waiting for a > >> long time, and I hope I have come up with a resonable > solution to the > >> problem you were hitting, while not solving it the way you > suggested > >> (bit of lateral thinking went on here :-) > >> > >> If you quarantine spam, you end up with the quarantine containing > >> virus-infected spam as well. > >> Bad news if you want to give your users access to be able > to retrieve > >> messages from the quarantine. They can retrieve viruses as well. > >> > >> There is a new option: > >> Keep Spam And MCP Archive Clean > >> If you set this to yes, then all spam will be > virus-scanned, and removed > >> from the quarantine if it was found to be infected in any > way. This way, > >> your users can't infect themselves. > >> > >> I hope this is to your liking, it's not the most elegant > implementation, > >> but doing it elegantly was such a big job it was never > going to happen. > >> Please let me know what you think. > > > > > > Great option! Just one question, will this keep the > quarantine clean of > > bad stuff that was reported by clamav or also of mails that contain > > insecure / scripts etc? > > Clean of anything deemed to be an infection. Bad filenames, viruses, > etc. That includes messages that have scripts in them, all that stuff. > The aim is to leave the quarantine harmless. > But the messages in there won't be "disarmed" they will just > be removed > if dangerous content was found in them. That's due to the way I > implemented it (i.e. not perfect but it did happen at all :) > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Dec 13 14:52:18 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:27:55 2006 Subject: signed message corruption Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chuck Foster wrote: > Hmm, noticed with Denis Beachemin's signed messages that (Outlook) > winges about the message body having been modified in transit. > > > What I'm not so sure about is whether this is down to the MailScanner > list or my own local MailScanner implementation, and in either case > what can be done about it. I'm assuming its the addition of a > signature that is causing this message ... > > C:> > I believe the signature is the culprit because it works just fine here (and I don't add a signature to the emails). Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From marco at XSSNET.COM Mon Dec 13 16:12:59 2004 From: marco at XSSNET.COM (Marco Benton - BOFH) Date: Thu Jan 12 21:27:55 2006 Subject: OT : Mailing list etiquette / RTFM Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Michele Neylon :: Blacknight Solutions wrote: | Just my usual rant: - please don't post HTML emails. | They may seem appropriate for marketing but they are not | appropriate for a technical mailing list. | | - please don't put in 40 line disclaimers. We aren't going to read | them and as you are posting to a public mailing list they are a | kind of pointless | | - when replying to previous emails try "snipping". There's no point | in reposting several hundred lines of logs etc., to simply say two | words | | - Subject lines serve a purpose. Please use them and DO NOT hijack | threads. and i want to reiterate "HIJACKING" threads! that should be in BOLD and underlined. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBvb9W6T7cCxJsGOIRAhKnAJ4+5gEanTBfquBs0DHAVJuPqwUQRgCgta9y 8XawmdqZy3KPm25v522gKAw= =yhxv -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Mon Dec 13 16:35:42 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:55 2006 Subject: OT : Mailing list etiquette / RTFM Message-ID: > and i want to reiterate "HIJACKING" threads! that should be in BOLD > and underlined. One of my "pet hates" too :) I forgot to mention "top posting" .. ... :( Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Mon Dec 13 16:40:49 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:55 2006 Subject: procmailrc question Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi there, > I am currently running MailScanner with SpamAssassin 3.0.1 on Red Hat Linux > 3.0 as my primary mail server for about 2,000 PCs with great results. > I have some experience with Linux. I am working with Linux more. > My question is would using procmailrc be a benefit to SPAM filtering along > with MailScanner and SpamAssassin or is it for sorting email? I don't need > to sort the email I am just interested in good SPAM filtering. > i am using your idea ;) Why? Somehow some of my mails slip through MS and i don´t know why.. So at least the SA called via global procmailrc catches the bad stuff.. but.. as i installed the RulesDuJour-Script from fls (see the archive for more info) it moved my global local.cf, which was in /etc/mail/spamassassin, and so the options within this cf are gone too :( But i don´t want the user to get their own rules, as some of them do not have a shell on the maschine..(ok..i do have one..but that should be clear ;) Now i copied the local.cf from old_cf_files, which was generated with the install-script, back to the upper dir..i hope now everything will work fine..with my options ;) Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Mon Dec 13 16:42:48 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:55 2006 Subject: send all virus messages to one account Message-ID: Hi there, > Presently at one client we have things setup so that all messages marked as > spam get sent to one specific mailbox that is monitored by the admin, now > I've been asked to send messages tagged with {Virus?} to also be sent to this > same mailbox. I've browsed the conf file, but don't see the option for this. > Basically I am looking for something like the "Spam Actions" directive. > how about catching those mails with the "report" via global procmail and move it that way to the account needed? Or did i got it all wrong here?? Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Mon Dec 13 16:45:22 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:55 2006 Subject: sendmail / spamassassin services Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi there, > Andy Norris wrote: > > > Hi Denis, > > > > I rebooted the server. Spamd is not running, and I find this in the logs: > > > > Dec 10 15:38:28 tireswing spamc[6529]: connect() to spamd at 127.0.0.1 > > failed, retrying (1/3): Connection refused > > > > Should I just ignore this? Is it working okay? > > > maybe i am too late for an answer.. but aren´t these entries not generated via the installation via cpan or makefile with spamassassin? While it is running those tests if everything is working right? Marcel ok..i know my luck..someone will already have this answer out there.. ;) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Mon Dec 13 16:46:56 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:55 2006 Subject: Virus Scanners! Message-ID: Hi there, > I have just a simple question. I have 3 Virus scanners running with > MailScanner. Would > I be wasting Resources, or is it not such a bad Idea! I feel that if 1 or > maybe 2 out of the 3 > miss a virus the other will catch it! I by no means have a critical setup > IE Corporate/Business > But I despise the incoming spam and Virus's! > beware.. ;) i am using 4 scanners ;) and ms itself.. Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Mon Dec 13 16:47:44 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:55 2006 Subject: sendmail / spamassassin services Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > maybe i am too late for an answer.. > > but aren´t these entries not generated via the installation > via cpan or makefile with spamassassin? While it is running > those tests if everything is working right? > Any mention of spamc/spamd is an error MailScanner does not use spamassassin (as has been explained on umpteen occassions in the past) it makes calls to its libraries etc., If spamd/spamc is running you have a problem Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KShortt at AZERTY.COM Mon Dec 13 16:56:31 2004 From: KShortt at AZERTY.COM (Shortt, Kevin) Date: Thu Jan 12 21:27:55 2006 Subject: procmailrc question Message-ID: > I am currently running MailScanner with SpamAssassin 3.0.1 on Red Hat > Linux 3.0 as my primary mail server for about 2,000 PCs with great > results. > I have some experience with Linux. I am working with Linux more. > My question is would using procmailrc be a benefit to SPAM filtering > along with MailScanner and SpamAssassin or is it for sorting email? > I don't need to sort the email I am just interested in good SPAM > filtering. > procmail is primarily for local deliver and filtering locally delivered email. It is versatile and can be used for many things, but it has some limitations. If your server is only a gateway scanner, then procmail is probably not much use to you. If you are in a scenario where you deliver mail locally after it has been scanned by MS or SA, you can use it to filter spam tagged email. I use it in a variety of ways as it pertains it MS and SA. - backup every message that comes into the server into hourly files that get purged with a retention of 5 days. This is not really SA/MS related, but it has saved some users many times. - filter all tagged spam and spool into daily folders and retain spam mail for 10 days. This protects against false positives. I hope this helps.. -k ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Mon Dec 13 17:15:40 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:55 2006 Subject: Virus Scanners! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > > xterm1 wrote: > >> I have just a simple question. I have 3 Virus scanners running >> with >> MailScanner. Would >> I be wasting Resources, or is it not such a bad Idea! I feel that if >> 1 or >> maybe 2 out of the 3 >> miss a virus the other will catch it! I by no means have a critical >> setup >> IE Corporate/Business >> But I despise the incoming spam and Virus's! >> >> Thoughts or rants Welcome! >> I run a small site too and for a long time I just ran Sophos, thinking that it wasn't really worth the effort to add a second scanner. Finally, I added the free ClamAV scanner and now I'm glad I did. There have been a few instances where Clam caught things that Sophos did not, and it provides more protection in case a scanner update ever messes up or something. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Mon Dec 13 18:03:04 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:55 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, I think I've tracked down the problem with inconsistent SPF test results. In the following discussion I will assume that MailScanner is set up with the defaults of : Envelope From Header = X-MailScanner-From: (in MailScanner.conf) envelope_sender_header X-MailScanner-From (in spam.assassin.prefs.conf) Bad SPF results seem to come from messages that have passed through another MailScanner server and already had the X-MailScanner-From header added. In "SA.pm" you construct the message to pass to SA by starting with an X-MailScanner-From header at the top, then addding the original headers (which might include an X-MailScanner-From header), and then adding the message body. Spamassassin then extracts the envelope information from the headers by looking for X-MailScanner-From. If there is more than one such header, SA joins the values rather than using the first one, as you might expect. See SA's "get_envelope_from" subroutine in "PerMsgStatus.pm" for the procedure it uses. I haven't invetigated what SPF does with the mess it receives, but I suspect it throws away everything before the final @, so that it performs the check using the domain that was in the final X-MailScanner-From header instead of the one that you added at the top of the message. I think the solution is for MailScanner to delete any X-MailScanner-From headers (or whatever is specified in envelope_sender_header) from the original message headers before adding them to the message that will be passed to SpamAssassin. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Mon Dec 13 19:00:50 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:55 2006 Subject: Autoupdate always runs a generic update for virus updates Message-ID: At 04:14 AM 12/13/2004, Michael Freeman wrote: >Im running F-Secure. When Autoupdate runs on the hour there are 4 messages >as shown. > >Dec 13 04:07:39 srv08 update.virus.scanners: Found f-secure installed >Dec 13 04:07:39 srv08 update.virus.scanners: Running autoupdate for f-secure >Dec 13 04:07:47 srv08 update.virus.scanners: Found generic installed >Dec 13 04:07:47 srv08 update.virus.scanners: Running autoupdate for generic > >Autoupdate for f-secure is fine, but why does MS also run an autoupdate >for generic? I would think that if autoupdate for f-secure runs then the >second or at least generic version should not be running. How can this be >fixed? Ignore it. It's not doing anything unless you've modified the generic update script. Basicaly "generic" is an empty shell for you to add anything you want. However, until you modify it, it doesn't do anything. Search the archives if you need more info, but below is one message from Julian on the subject... --------------------------------------------------- At 17:10 06/10/2004, you wrote: >Hi there, > >i just installed the latest MailScanner-Version. > >and now i found the following alongside with the other updates from the >virus-scanners: > >Oct 6 18:05:00 mail update.virus.scanners: Running autoupdate for generic >Oct 6 18:05:00 mail Generic-autoupdate[4140]: Generic scanner >successfully updated > > >Where does this come from? > >It says in the generic-autoupdate and -wrapper-script soemthing about own >virus-scanners.. > >but i never did one on my own.. In which case the generic-autoupdate won't do anything. Don't worry about it, just ignore it. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Mon Dec 13 19:11:34 2004 From: dnsadmin at 1BIGTHINK.COM (DNSAdmin) Date: Thu Jan 12 21:27:55 2006 Subject: Using rbl lists Message-ID: At 01:06 PM 12/12/2004, you wrote: >I don't agree 100% with this approach. Using BL at the MTA has some very >significant benefits. The most significant is that rejecting at the MTA >prevents any further downstream processing by either MS or SA (and virus >scanner) which are all resource intensive. On server where there is a lot of >incoming spam, this will make a huge difference. > >I do agree that not all lists are appropriate for rejection at the MTA, but >certainly ORDB is. I also use Spamcop at the gateway, and find few (to no) >FP's. Others, such as SORBS, are effective but have a tendency to >occasionally list major smtp servers such as AOL etc., so more care needs to >be taken. I found SpamCop to be too liberal, and found that it blocked wanted mail. I quarantined during the tests. You should try testing with that BL! >Chris > >----- Original Message ----- >From: "Michele Neylon :: Blacknight Solutions" > >To: >Sent: Sunday, December 12, 2004 3:53 AM >Subject: Re: Using rbl lists > > >>MailScanner mailing list wrote: >>>Quick question about spam blacklists (RBLs). >>> >>>I've added a few lists to the "Spam List" setting but what >>>determines whether a message gets classified as spam? If the >>>sending server, for example, is on one RBL then is this sufficient? >> >>As already mentioned one RBL is enough to block the mail. The problem with >>the RBLs being used in this way is that it is a very blunt tool and your >>FP >>rate can be very high. Using the RBLs via SA gives a better result. >> >> >> >>Mr Michele Neylon >>Blacknight Internet Solutions Ltd >>Hosting, co-location & domains >>http://www.blacknight.ie/ >>Tel. +353 59 9137101 >>http://www.blacknight.ie/specialoffers.html > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >-- >This message has been scanned for viruses and >dangerous content by MailScanner, and is >believed to be clean. >http://www.sng.ecs.soton.ac.uk/mailscanner/ >Configuration by Glenn Parsons dnsadmin-at-1bigthink.com > > > > > >--- >Incoming mail is certified Virus Free. >Checked by AVG anti-virus system (http://www.grisoft.com). >Version: 6.0.809 / Virus Database: 551 - Release Date: 12/9/2004 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. http://www.sng.ecs.soton.ac.uk/mailscanner/ Configuration by Glenn Parsons dnsadmin-at-1bigthink.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 13 19:36:59 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:55 2006 Subject: Duplicate emails - same smtp id processed by different MS processes. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jeff Falgout wrote: |>>>mailscanner@ECS.SOTON.AC.UK 12/7/2004 11:22:43 AM >>> | | Jeff Falgout wrote: | | |>Ah, the Wise one has spoken. I see the option in the conf file. |> |> | | Bow, you unworthy mortal :-))) | | Please, Please oh Wise One - accept my most humble gratitude | | | - /Hmmmm the Blue Pill or the Red Pill???? With computers it would be the Purple Pill, the one for acid reflux!! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBve9bRADw9lziUqQRAo1NAJ0dy1bjhmISVJ5h0NkAPwVMMac3nwCfVMDa pnzCGl462aGVpHiUUqjpDEY= =WZac -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jwilliams at COURTESYMORTGAGE.COM Mon Dec 13 20:08:41 2004 From: jwilliams at COURTESYMORTGAGE.COM (Jason Williams) Date: Thu Jan 12 21:27:55 2006 Subject: phising question Message-ID: Hello everyone. Currently running a FreeBSD mailserver with MS 4.29-7, with plans on upgrading the server this week if time permits. Also, SA 2.63. Recently, I have been concerned with the phising attacks that have been going on lately and was wondering what people on this list recommend to go about combating this. Is there anything I can do from now, until the time I upgrade, to stop phising attacks? I've been trying to keep up with all the updates and changes recently and plan to take full advantage of some of the new features the latest MS provides. but in the meantime, was hoping to get some suggestions or ideas on how to go about protecting my network from these types of attacks. I appreciate the help. Cheers, Jason ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 13 20:17:14 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:55 2006 Subject: Off Topic Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dave Filchak wrote: | Perhaps, | | "Change .. it happens all around the world. | Not so in our world!" | | or perhaps | | "Change .. it happens all around the world, | But not in ours!" | | Is it poetry or AD copy. | The difference is that poets die of starvation, while copywriters die of heart attacks. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBvfjKRADw9lziUqQRAlObAJ0TTyTp5m9ke9e98s/QJX47lHIi7ACbBYPL U7AdjlC94+GuaFsABCi3LkQ= =R+MR -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 13 20:23:39 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:55 2006 Subject: Hiding email addresses Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fractal IT Dept. wrote: | Alex Neuman van der Hans wrote: | |> Also you may want to look into using a tarpit. |> |> | I'm sorry...what is a tarpit? | A tarpit is a system that sits on your network and looks at connection attemps that shouldn't be happening, like portscans or connection attemps on ports you don't use. It then opens the TCP dialog but then silently dies out, letting the connecting system use up its resources trying to connect, but not getting any kind of errors or drops. I think you could also use a discard in your MTA to loose mails for certain addresses without sending any errors or other messages. Kind of how a teenager just seems to be listening when you talk. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBvfpLRADw9lziUqQRAnADAJ9zeVyELQmibIdWKx5P+RVwsNDr0QCfQMhK m9XXky2ccPCxgwA5oI7FRHg= =ZFhf -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 13 20:26:37 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:55 2006 Subject: inconsistent SPF warning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Matt Kettler wrote: | At 01:48 PM 12/8/2004, Mark Nienberg wrote: | |> > Mark Nienberg wrote: |> > |> >> It appeared that SA wasn't always using the value of |> >> "envelope_sender_header". (I assume MailScanner really does pass the |> >> correct value to SA, because I'm pretty sure Julian is infallible). |> > |> > |> > It uses the "Envelope From Header" from your MailScanner.conf, which by |> > default is "X-MailScanner-From". And it puts it as the first header in |> > what is passed to SA, so that SA trusts it. |> > |> Yes. After which SA apparently sometimes chooses to use an address form |> some other header instead. | | | Something worth testing might be to move the envelope_sender_header setting | out of spam.assassin.prefs.conf and into local.cf. | Could you just link spam.assassin.prefs.conf to local.cf? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBvfr9RADw9lziUqQRAoV/AJ9EspNmyYeeQ06LosWGuBNEkt5nEQCeON/D srPZUs68cm2kFvq+qZJXJaI= =YwLF -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 13 21:13:45 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:55 2006 Subject: Virus Scanners! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 xterm1 wrote: | I have just a simple question. I have 3 Virus scanners running with | MailScanner. Would | I be wasting Resources, or is it not such a bad Idea! I feel that if 1 or | maybe 2 out of the 3 | miss a virus the other will catch it! I by no means have a critical setup | IE Corporate/Business | But I despise the incoming spam and Virus's! | | Thoughts or rants Welcome! I am also using 3 -- McAfee, Clam and BitDefender. Spamassassin seems to use more resources than the virus scanners IMHO -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBvgYJRADw9lziUqQRAiXAAJ4tH2OQz9J3GJmM/fvz7fVklRd2TQCfZgsL b9J4cJyfEb7ylJlbcw95r5I= =Yc/2 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcin.rozek at IOS.EDU.PL Mon Dec 13 21:34:20 2004 From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Ro¿ek) Date: Thu Jan 12 21:27:55 2006 Subject: OT: fetching e-mails to local server Message-ID: [ The following text is in the "ISO-8859-2" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, this is a bit off-topic, but i don't know where to ask this question... The story: small firm have an e-mail server provided by their ISP. They have few aliases eg. aaa@firm.pl bbb@firm.pl etc. that points to one real account on that server. They also want to have their local e-mail server to send e-mails (and that works ok) but also want to have their e-mails fetched from ISP-server to their local server. I'm not sure how i can do this. I tried fetchmail, but it downloads all e-mails to one account. But they want to download all e-mails from that one real account and place it into real accounts on local server. aaa@firm.pl and bbb@firm.pl goes to realaccount@firm.pl I have to get all e-mails from realaccount and put e-mails that were sent to eg. aaa@firm.pl to box aaa on local server. Someone have an idea how to do that? I appreciate any help. ps. i was thinking about changing MX record to point to that 'local' server but its IP is dynamic:( ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Mon Dec 13 21:35:45 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:27:55 2006 Subject: sendmail / spamassassin services Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michele Neylon :: Blacknight Solutions wrote: >>maybe i am too late for an answer.. >> >>but aren´t these entries not generated via the installation >>via cpan or makefile with spamassassin? While it is running >>those tests if everything is working right? > > Any mention of spamc/spamd is an error He's right that it's shown during install via cpan to test all components. You're installing SA on it's own so it doesn't know how you're going to use it later on. > MailScanner does not use spamassassin (as has been explained on umpteen > occassions in the past) it makes calls to its libraries etc., > > If spamd/spamc is running you have a problem You're right there. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Mon Dec 13 21:51:36 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks for that, I will work on this tomorrow. Mark Nienberg wrote: > Julian, > > I think I've tracked down the problem with inconsistent SPF test > results. In the following discussion I will assume that MailScanner is > set up with the defaults of : > > Envelope From Header = X-MailScanner-From: (in MailScanner.conf) > envelope_sender_header X-MailScanner-From (in spam.assassin.prefs.conf) > > Bad SPF results seem to come from messages that have passed through > another MailScanner server and already had the X-MailScanner-From > header added. > > In "SA.pm" you construct the message to pass to SA by starting with > an X-MailScanner-From header at the top, then addding the original > headers (which might include an X-MailScanner-From header), and then > adding the message body. Spamassassin then extracts the envelope > information from the headers by looking for X-MailScanner-From. If > there is more than one such header, SA joins the values rather than > using the first one, as you might expect. See SA's "get_envelope_from" > subroutine in "PerMsgStatus.pm" for the procedure it uses. I haven't > invetigated what SPF does with the mess it receives, but I suspect it > throws away everything before the final @, so that it performs the check > using the domain that was in the final X-MailScanner-From header instead > of the one that you added at the top of the message. > > I think the solution is for MailScanner to delete any X-MailScanner-From > headers (or whatever is specified in envelope_sender_header) from the > original message headers before adding them to the message that will > be passed to SpamAssassin. > > -- > Mark Nienberg, SE > Tipping Mar + associates > 1906 Shattuck Ave > Berkeley, CA 94704 > http://www.tippingmar.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dmehler26 at woh.rr.com Mon Dec 13 21:50:37 2004 From: dmehler26 at woh.rr.com (dave) Date: Thu Jan 12 21:27:55 2006 Subject: tar pit? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, I was wondering if you had a howto on setting up a tar pit? I'm using FreeBSD 5.x machines, my primary goal for doing this is i'm getting ssh connections as well as many people trying to relay mail through me. I've got discard rules and they don't succeed, but i'd rather cut them off before they can sap my band width. Any help appreciated. Thanks. Dave. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From clicknow at SWIFTDSL.COM.AU Mon Dec 13 21:51:23 2004 From: clicknow at SWIFTDSL.COM.AU (Brian Parish) Date: Thu Jan 12 21:27:55 2006 Subject: OT: fetching e-mails to local server Message-ID: [ The following text is in the "iso-8859-2" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Tue, 14 Dec 2004 08:34 am, Marcin Ro¿ek wrote: > Hello, > this is a bit off-topic, but i don't know where to ask this question... > The story: small firm have an e-mail server provided by their ISP. They > have few aliases eg. aaa@firm.pl bbb@firm.pl etc. that points to one > real account on that server. They also want to have their local e-mail > server to send e-mails (and that works ok) but also want to have their > e-mails fetched from ISP-server to their local server. I'm not sure how > i can do this. I tried fetchmail, but it downloads all e-mails to one > account. But they want to download all e-mails from that one real > account and place it into real accounts on local server. > > aaa@firm.pl and bbb@firm.pl goes to realaccount@firm.pl > I have to get all e-mails from realaccount and put e-mails that were > sent to eg. aaa@firm.pl to box aaa on local server. > > Someone have an idea how to do that? > I appreciate any help. > > ps. i was thinking about changing MX record to point to that 'local' > server but its IP is dynamic:( > This is what the: user 'xyz' with pass ''abc' to * here syntax is for in your fetchmailrc. This works, but is unreliable in some circumstances. I have one site where it works seemingly faultlessly and another where it won't work at all - probably depends on the mailserver being polled. If you have no alternative though... HTH Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Mon Dec 13 21:58:27 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:55 2006 Subject: inconsistent SPF warning Message-ID: At 03:26 PM 12/13/2004, Scott Silva wrote: >| Something worth testing might be to move the envelope_sender_header >setting >| out of spam.assassin.prefs.conf and into local.cf. >| >Could you just link spam.assassin.prefs.conf to local.cf? NO.. definitely DO NOT do that. SA will handle it, but it would be quite reasonable for it to crash in that case. The two files are supposed to be different, and spam.assassin.prefs.conf is intended to over-ride settings in local.cf, not duplicate them. There are also some administrative config options which are legal in local.cf and not allowed in spam.assassin.prefs.conf, so the files are handled differently. There is certainly an implicit expectation that they are not the same file. If nothing else, by linking them, you're forcing SA to parse the same settings twice, which is silly. Either put settings in your local.cf, or in your spam.assassin.prefs.conf, but do not link the files. There's no point to doing that other than wasting the parser's time. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 13 22:01:37 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:55 2006 Subject: tar pit? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 dave wrote: | Hello, | I was wondering if you had a howto on setting up a tar pit? I'm using | FreeBSD 5.x machines, my primary goal for doing this is i'm getting ssh | connections as well as many people trying to relay mail through me. I've got | discard rules and they don't succeed, but i'd rather cut them off before | they can sap my band width. | Any help appreciated. | Thanks. | Dave. A tarpit would not help with connections to a service you use. A tarpit is usually used on ports you DON'T use. But some reading and a very good tarpit is here; http://labrea.sourceforge.net/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBvhFBRADw9lziUqQRAtLXAJ9RrP0w9NeQqm2GiaqzDK8aee1/OwCggiwT EDXB8ePMFgg5VLiamQHMQfU= =pejL -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Mon Dec 13 23:39:05 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:55 2006 Subject: tar pit? Message-ID: At 04:50 PM 12/13/2004, dave wrote: >Hello, > I was wondering if you had a howto on setting up a tar pit? I'm using >FreeBSD 5.x machines, my primary goal for doing this is i'm getting ssh >connections as well as many people trying to relay mail through me. I've got >discard rules and they don't succeed, but i'd rather cut them off before >they can sap my band width. Actually, doing a discard of the syn packet is generally much lower bandwidth than doing a tarpit. In a tarpit you've got to accept (or at least pretend to accept) the connection, and keep feeding keep-alive packets back to the person you are tarpitting. This, at the very minimum, doubles the bandwidth required per connection. The only case where a tarpit saves you bandwidth is if a single source is spewing huge numbers of connections (At least 10 a second, probably much more), then tarpitting will, eventually, bog down the source, and you'll see fewer connections. Really, if you're worried about syn packets sucking up your bandwidth, you've either got thousands of connections per second, or a very small pipe. (a syn packet is about 40-60 bytes, depending on tcp options. Assuming 60 bytes, it would take 1,000 connections/sec to be 600,000 bits/sec, half a typical t1 or downstream 1.5mbit DSL line.) Generaly speaking you can use pf's rdr to redirect the packets to another port, and have that port running a tarpit app. Another way is to use LaBrea... LaBrea is a good tarpit app, but be careful, it's designed to tarpit whole destination IPs at a time by default, but if you use a bpf filter, you can tell LaBrea what ports/hosts to tarpit manually. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From test at NEXTMILL.NET Tue Dec 14 00:12:24 2004 From: test at NEXTMILL.NET (Brian Lewis) Date: Thu Jan 12 21:27:55 2006 Subject: System capacity Message-ID: Hardware: MailScanners: 3 X Athlon XP 2400+, 512 MB RAM Each, 10gb hard drives each MySQL/Cached Named Server : 1 x Athlon XP 2100+, 512mb RAM, 10gb Hard Drive Software: Red Hat Fedora Core 2, Sendmail, SpamAssassin 3.x, ClamAV .80, Pyzor, DCC, Razor2, MailWatch Caching Named on separate server with MySQL RBLs: None in MTA, None in MailScanner, All in SpamAssassin Virus Scanners: ClamAV 0.80 Volume: 200,000 messages/day (Each Scanner does roughly 66,000 messages a day) Load : average 2-4, sometimes higher depending on time of day Notes: I probably don't expect any more out of this setup, I'll need to add a 4th scanner to handle more load. My other idea was to implement RBLDNSD and run the RBL lookups locally which I think will increase my capacity. Filtering for about 60 domains to about 20 different target mailservers using Sendmail MailerTable ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From William.Burns at AEROFLEX.COM Tue Dec 14 00:29:09 2004 From: William.Burns at AEROFLEX.COM (William Burns) Date: Thu Jan 12 21:27:55 2006 Subject: [Fwd: Re: tar pit?] Message-ID: ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2: "Included Message" ] Date: Mon, 13 Dec 2004 19:27:26 -0500 From: William Burns To: dave Subject: Re: tar pit? Dave: Here's another one. Possibly simpler. http://pfortin.com/Linux/HoneyPort/ -Bill dave wrote: >Hello, > I was wondering if you had a howto on setting up a tar pit? I'm using >FreeBSD 5.x machines, my primary goal for doing this is i'm getting ssh >connections as well as many people trying to relay mail through me. I've got >discard rules and they don't succeed, but i'd rather cut them off before >they can sap my band width. > Any help appreciated. >Thanks. >Dave. > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 3: "Included Message" ] Date: Mon, 13 Dec 2004 18:45:25 -0500 From: William Burns To: dave Subject: Re: tar pit? Dave: The trick here is how to tarpit only the bad-guys while still accepting mail from every-one else. The idea of a tarpit is to create a bogus mail port/service to waste spammers time so that you help the next victim out more than yourself, however, w/ a list of known spammer IPs, you *could* tarpit the known spammers while they were trying to SPAM you. Here's one approach for OpenBSD users that might work for you: http://www.benzedrine.cx/relaydb.html http://undeadly.org/cgi?action=article&sid=20041117210044 This PF+spamd approach is very similar to what I describe below. PF is similar to linux-iptables. spamd is similar to Labrea. someone mentioned Labrea.... I thought that the author was no longer working on that project. Maybe work has been resumed. regardless... Labrea should be a great tarpit 'cause it's also a honeypot, knowing how to keep a spammer machine thinking that it's talking to a real mail server. Later versions of the linux "iptables" firewall have a less intelligent TARPIT tag/label that you can "-j" (jump) over to. So... on a linux mail/mailscanner machine, you *could* have an iptables firewall that you update w/ a list of known spammer IP addresses, and tarpit just those IP addresses, while letting all other mail through normally. You could also do this w/ an additional linux-based firewall/gateway on another machine. If you do take that approach, you should be able to selectively NAT known spammer IPs to another (Labrea?) tarpit machine. (or Labrea running on a different port of the local firewall machine) iptables TARPIT http://www.securityfocus.com/infocus/1723 -Bill dave wrote: >Hello, > I was wondering if you had a howto on setting up a tar pit? I'm using >FreeBSD 5.x machines, my primary goal for doing this is i'm getting ssh >connections as well as many people trying to relay mail through me. I've got >discard rules and they don't succeed, but i'd rather cut them off before >they can sap my band width. > Any help appreciated. >Thanks. >Dave. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From info at ASI.CC Tue Dec 14 01:00:11 2004 From: info at ASI.CC (Jon D.) Date: Thu Jan 12 21:27:55 2006 Subject: Email Forwarding Message-ID: I have a Cpanel server with Mailscanner and ClamAV installed, I need to set up forwarding that is hidden to the user, the company needs to monitor emails to certain employee's without it showing in Cpanel's forwarding screen. I noticed there is a place in the mailscanner config file for this but no instructions on how to set it up. Can someone help me out with a rule template for the Mail Archiving and Monitoring Section. Along with instructions on how to tell mailscanner how to use the rule. Thanks in advance. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Tue Dec 14 01:41:04 2004 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:27:55 2006 Subject: Off Topic Message-ID: yes ... true enough. Dave Scott Silva wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Dave Filchak wrote: > | Perhaps, > | > | "Change .. it happens all around the world. > | Not so in our world!" > | > | or perhaps > | > | "Change .. it happens all around the world, > | But not in ours!" > | > | Is it poetry or AD copy. > | > The difference is that poets die of starvation, > while copywriters die of heart attacks. > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.1 (MingW32) > Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org > > iD8DBQFBvfjKRADw9lziUqQRAlObAJ0TTyTp5m9ke9e98s/QJX47lHIi7ACbBYPL > U7AdjlC94+GuaFsABCi3LkQ= > =R+MR > -----END PGP SIGNATURE----- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From davidj at synaq.com Tue Dec 14 06:48:56 2004 From: davidj at synaq.com (David Jacobson) Date: Thu Jan 12 21:27:55 2006 Subject: MS Book Message-ID: Hi, I noticed a while ago on the list someone said the MS book had incorrect indexes etc, I want to buy the book, to support Julian of course and was just wondering if the inconsistencies had been addressed? Many thanks.. -- Regards, David Jacobson Technical Director SYNAQ (Pty) Ltd Tel: 011 290 6388 Fax: 011 290 6389 Cell: 083 235 0760 Mail: davidj@synaq.com Web: http://www.synaq.com Key Fingerprint 8246 FCE1 3C22 7EFB E61B 18DF 6E8B 65E8 BD50 78A1 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "This is a digitally signed message part" ] [ Application/PGP-SIGNATURE 196bytes. ] [ Unable to print this part. ] From john at TRADOC.FR Tue Dec 14 08:17:35 2004 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Clean of anything deemed to be an infection. Bad filenames, viruses, > etc. That includes messages that have scripts in them, all that stuff. > The aim is to leave the quarantine harmless. Installed this beta yesterday. It seems that messages destined for the quarantine are indeed getting scanned for viruses, but they are not deleted, just flagged. That is actually the behaviour that I would prefer, as it provides a means of recovering false positives that may fall foul of MailScanner's filename/filetype checks. Not that I've ever seen a false positive get a high spam score, but it could theoretically happen. The risk of having an "unclean" quarantine is in any case mitigated, for MailWatch users, by MW's built-in checks to stop you releasing viruses from the quarantine. Still, the beta isn't behaving as announced for some reason. How about adding another option to control whether or not messages are deleted? John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bernd_holzinger at T-ONLINE.DE Tue Dec 14 07:37:04 2004 From: bernd_holzinger at T-ONLINE.DE (Bernd Holzinger) Date: Thu Jan 12 21:27:55 2006 Subject: all mails are whitelisted Message-ID: Hello all, my mailscanner marks all mails as "not spam (whitelisted)" X-company-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=23.067, required 5, ..... My configuration parameters are: /etc/MailScanner/MailScanner.conf: SpamAssassin Auto Whitelist = no /etc/MailScanner/rules/spam.whitelist.rules: FromOrTo: *@test.de yes ..... FromOrTo: default no /etc/mail/spamassassin/local.cf: use_auto_whitelist 0 user_prefs: use_auto_whitelist 0 My system parameters are: Debian/testing MailScanner 4.36.1 SpamAssassin 3.0.1 (perl module) perl 5.8.4 Thanks in advance for your help, -- Bernd Holzinger email: bho-nospam-@sns.dnsalias.org please remove "-nospam-" from email address ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 08:39:30 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: MS Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It was corrected the very hour someone first reported it. Don't worry. David Jacobson wrote: >Hi, > >I noticed a while ago on the list someone said the MS book had incorrect >indexes etc, I want to buy the book, to support Julian of course and was >just wondering if the inconsistencies had been addressed? > >Many thanks.. > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 08:40:37 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: Email Forwarding Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Look at the "Archive Mail" setting, and read about rulesets in /etc/MailScanner/rules/*, the MAQ, the FAQ and the book. Jon D. wrote: >I have a Cpanel server with Mailscanner and ClamAV installed, I need to set up forwarding that is >hidden to the user, the company needs to monitor emails to certain employee's without it showing >in Cpanel's forwarding screen. > >I noticed there is a place in the mailscanner config file for this but no instructions on how to set it >up. > >Can someone help me out with a rule template for the Mail Archiving and Monitoring Section. >Along with instructions on how to tell mailscanner how to use the rule. > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 08:43:01 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Wilcock wrote: > Julian Field wrote: > >> Clean of anything deemed to be an infection. Bad filenames, viruses, >> etc. That includes messages that have scripts in them, all that stuff. >> The aim is to leave the quarantine harmless. > > > Installed this beta yesterday. It seems that messages destined for the > quarantine are indeed getting scanned for viruses, but they are not > deleted, just flagged. So they are being put in the spam quarantine? What MTA are you using? This only applies if you have "store" amongst your "Spam Actions" and/or "High Scoring Spam Actions". > > Still, the beta isn't behaving as announced for some reason. How about > adding another option to control whether or not messages are deleted? There is one, it was in the announcement notices and the Change Log. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Tue Dec 14 08:55:01 2004 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:27:55 2006 Subject: Duplicate emails (STILL OCCURING) - same smtp id processed by different MS processes. Message-ID: Julian I am _still_ seeing some duplicate processing by MailScanner when I set "Lock Type = posix" although not as many as when I let "Lock Type" default. The setup is: Red Hat Enterprise Linux AS release 3 (Taroon Update 1) - its own Sendmail 8.12.10 - have not applied most recent kernel updates MailScanner-4.35.11-1 - with a more recent Message.pm MailScanner.conf - Lock Type = posix Quentin --- PHONE: +44 191 222 8209 Information Systems and Services (ISS), University of Newcastle, Newcastle upon Tyne, FAX: +44 191 222 8765 United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." >-----Original Message----- >From: MailScanner mailing list >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell >Sent: 13 December 2004 09:58 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Duplicate emails - same smtp id processed by >different MS processes. > >The situation appears even more confused. > >I also have to specify "Lock Type = posix" to stop the duplication on >our Red Hat Enterprise Linux AS release 3 (Taroon Update 1) but it is >running with its own Sendmail 8.12.10. > >Quentin >--- >PHONE: +44 191 222 8209 Information Systems and Services (ISS), > University of Newcastle, > Newcastle upon Tyne, >FAX: +44 191 222 8765 United Kingdom, NE1 7RU. >--------------------------------------------------------------- >--------- >"Any opinion expressed above is mine. The University can get >its own." > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alan Dobkin >>Sent: 09 December 2004 16:50 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: Duplicate emails - same smtp id processed by >>different MS processes. >> >>On 12/7/2004 12:34 PM, Julian Field wrote: >>> With sendmail-8.13 on Linux systems, you need to set >> > "Lock Type = posix" in MailScanner.conf. >> >>FWIW, I upgraded my server from Fedora Core 2 to Fedora Core 3 >>and around the same time upgraded MailScanner to version 4.36.1-1. >>Fedora Core 3 included sendmail 8.13 (previously 8.12 in Core 2), >>and I didn't realize that the locking method had changed. Around >>the same time, the MailScanner.conf file, which used to default >>to "Lock Type = flock" was changed to just "Lock Type = " (blank), >>so I suspected MailScanner may be causing the problem, but making >>the change to "Lock Type = posix" seems to do the trick. >> >>In retrospect, I now see that the sendmail release notes warned >>about this change over 2 years ago, back in release 8.12.5: >> >>8.12.5/8.12.5 2002/06/25 >> NOTE: Linux appears to have broken flock() again. Unless >> the bug is fixed before sendmail 8.13 is shipped, >> 8.13 will change the default locking method to >> fcntl() for Linux kernel 2.4 and later. You may >> want to do this in 8.12 by compiling with >> -DHASFLOCK=0. Be sure to update other sendmail >> related programs to match locking techniques. >> >>So, this begs the question, why not set "Lock Type = fcntl" instead >>of posix in MailScanner? Does it not understand this method? >> >>Thanks, >>Alan >> >>-- >>Reclaim Your Inbox - Get Thunderbird! >>http://www.Mozilla.org/products/thunderbird/ >> >>Rediscover the Web - Get Firefox! >>http://www.SpreadFirefox.com/?q=affiliates&id=21548&t=68 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 09:09:38 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please try the attached (short) patch to SA.pm and let me know what happens. Julian Field wrote: > Thanks for that, I will work on this tomorrow. > > Mark Nienberg wrote: > >> Julian, >> >> I think I've tracked down the problem with inconsistent SPF test >> results. In the following discussion I will assume that MailScanner is >> set up with the defaults of : >> >> Envelope From Header = X-MailScanner-From: (in MailScanner.conf) >> envelope_sender_header X-MailScanner-From (in spam.assassin.prefs.conf) >> >> Bad SPF results seem to come from messages that have passed through >> another MailScanner server and already had the X-MailScanner-From >> header added. >> >> In "SA.pm" you construct the message to pass to SA by starting with >> an X-MailScanner-From header at the top, then addding the original >> headers (which might include an X-MailScanner-From header), and then >> adding the message body. Spamassassin then extracts the envelope >> information from the headers by looking for X-MailScanner-From. If >> there is more than one such header, SA joins the values rather than >> using the first one, as you might expect. See SA's "get_envelope_from" >> subroutine in "PerMsgStatus.pm" for the procedure it uses. I haven't >> invetigated what SPF does with the mess it receives, but I suspect it >> throws away everything before the final @, so that it performs the check >> using the domain that was in the final X-MailScanner-From header instead >> of the one that you added at the top of the message. >> >> I think the solution is for MailScanner to delete any X-MailScanner-From >> headers (or whatever is specified in envelope_sender_header) from the >> original message headers before adding them to the message that will >> be passed to SpamAssassin. >> >> -- >> Mark Nienberg, SE >> Tipping Mar + associates >> 1906 Shattuck Ave >> Berkeley, CA 94704 >> http://www.tippingmar.com >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2: "Attached Text" ] --- SA.pm.old 2004-10-16 15:23:15.000000000 +0100 +++ SA.pm 2004-12-14 09:07:59.000000000 +0000 @@ -323,10 +323,18 @@ # For SpamAssassin 3 we add the "EnvelopeFrom" header to make SPF work my $fromheader = MailScanner::Config::Value('envfromheader', $message); $fromheader =~ s/:$//; + + # Build a list of all the headers, so we can remove any $fromheader that + # is already in there. + my @SAheaders = $global::MS->{mta}->OriginalMsgHeaders($message, "\n"); + @SAheaders = grep !/^$fromheader\:/i, @SAheaders; + @SAheaders = grep !/^\s*$/, @SAheaders; # ditch blank lines + push(@WholeMessage, $fromheader . ': ' . $message->{from} . "\n") if $fromheader; - push(@WholeMessage, $global::MS->{mta}->OriginalMsgHeaders($message, "\n")); + #push(@WholeMessage, $global::MS->{mta}->OriginalMsgHeaders($message, "\n")); + push(@WholeMessage, @SAheaders); #print STDERR "Headers are : " . join(', ', @WholeMessage) . "\n"; unless (@WholeMessage) { flock($RebuildLockH, $LOCK_UN) if $BayesIsLocked; ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 09:21:34 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: Duplicate emails (STILL OCCURING) - same smtp id processed by different MS processes. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please try the attached patch to SMDiskStore.pm and let me know if it helps. Quentin Campbell wrote: >Julian > >I am _still_ seeing some duplicate processing by MailScanner when I set >"Lock Type = posix" although not as many as when I let "Lock Type" >default. > >The setup is: > >Red Hat Enterprise Linux AS release 3 (Taroon Update 1) > - its own Sendmail 8.12.10 > - have not applied most recent kernel updates > >MailScanner-4.35.11-1 > - with a more recent Message.pm > >MailScanner.conf > - Lock Type = posix > > >Quentin >--- >PHONE: +44 191 222 8209 Information Systems and Services (ISS), > University of Newcastle, > Newcastle upon Tyne, >FAX: +44 191 222 8765 United Kingdom, NE1 7RU. >------------------------------------------------------------------------ >"Any opinion expressed above is mine. The University can get its own." > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell >>Sent: 13 December 2004 09:58 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: Duplicate emails - same smtp id processed by >>different MS processes. >> >>The situation appears even more confused. >> >>I also have to specify "Lock Type = posix" to stop the duplication on >>our Red Hat Enterprise Linux AS release 3 (Taroon Update 1) but it is >>running with its own Sendmail 8.12.10. >> >>Quentin >>--- >>PHONE: +44 191 222 8209 Information Systems and Services (ISS), >> University of Newcastle, >> Newcastle upon Tyne, >>FAX: +44 191 222 8765 United Kingdom, NE1 7RU. >>--------------------------------------------------------------- >>--------- >>"Any opinion expressed above is mine. The University can get >>its own." >> >> >> >>>-----Original Message----- >>>From: MailScanner mailing list >>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alan Dobkin >>>Sent: 09 December 2004 16:50 >>>To: MAILSCANNER@JISCMAIL.AC.UK >>>Subject: Re: Duplicate emails - same smtp id processed by >>>different MS processes. >>> >>>On 12/7/2004 12:34 PM, Julian Field wrote: >>> >>> >>>>With sendmail-8.13 on Linux systems, you need to set >>>>"Lock Type = posix" in MailScanner.conf. >>>> >>>> >>>FWIW, I upgraded my server from Fedora Core 2 to Fedora Core 3 >>>and around the same time upgraded MailScanner to version 4.36.1-1. >>>Fedora Core 3 included sendmail 8.13 (previously 8.12 in Core 2), >>>and I didn't realize that the locking method had changed. Around >>>the same time, the MailScanner.conf file, which used to default >>>to "Lock Type = flock" was changed to just "Lock Type = " (blank), >>>so I suspected MailScanner may be causing the problem, but making >>>the change to "Lock Type = posix" seems to do the trick. >>> >>>In retrospect, I now see that the sendmail release notes warned >>>about this change over 2 years ago, back in release 8.12.5: >>> >>>8.12.5/8.12.5 2002/06/25 >>> NOTE: Linux appears to have broken flock() again. Unless >>> the bug is fixed before sendmail 8.13 is shipped, >>> 8.13 will change the default locking method to >>> fcntl() for Linux kernel 2.4 and later. You may >>> want to do this in 8.12 by compiling with >>> -DHASFLOCK=0. Be sure to update other sendmail >>> related programs to match locking techniques. >>> >>>So, this begs the question, why not set "Lock Type = fcntl" instead >>>of posix in MailScanner? Does it not understand this method? >>> >>>Thanks, >>>Alan >>> >>>-- >>>Reclaim Your Inbox - Get Thunderbird! >>>http://www.Mozilla.org/products/thunderbird/ >>> >>>Rediscover the Web - Get Firefox! >>>http://www.SpreadFirefox.com/?q=affiliates&id=21548&t=68 >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2: "Attached Text" ] --- SMDiskStore.pm.old 2004-12-12 16:17:24.000000000 +0000 +++ SMDiskStore.pm 2004-12-14 09:19:43.000000000 +0000 @@ -125,9 +125,10 @@ print STDERR "Got hlock\n"; # If locking the dfile fails, then must close and unlock the qffile too - #JKF unless (MailScanner::Lock::openlock($this->{indhandle}, - #JKF '+<' . $this->{dpath}, 'w', 'quiet')) { - unless (open($this->{indhandle}, '+<' . $this->{dpath})) { + # 14/12/2004 Try putting this back in for now. + unless (MailScanner::Lock::openlock($this->{indhandle}, + '+<' . $this->{dpath}, 'w', 'quiet')) { + #JKF 14/12/2004 open($this->{indhandle}, '+<' . $this->{dpath})) { MailScanner::Lock::unlockclose($this->{inhhandle}); return undef; } ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Tue Dec 14 09:26:08 2004 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > John Wilcock wrote: > >> Installed this beta yesterday. It seems that messages destined for the >> quarantine are indeed getting scanned for viruses, but they are not >> deleted, just flagged. > > So they are being put in the spam quarantine? What MTA are you using? > This only applies if you have "store" amongst your "Spam Actions" and/or > "High Scoring Spam Actions". MTA = postfix Quarantine Infections = yes Quarantine Silent Viruses = yes Quarantine Whole Message = yes Quarantine Whole Messages As Queue Files = no Keep Spam And MCP Archive Clean = yes Spam Actions = store deliver High Scoring Spam Actions = store A high-scoring-spam message with a virus ends up with the message and attachment in the normal quarantine *and* a second copy of the message in the spam quarantine. > >> >> Still, the beta isn't behaving as announced for some reason. How about >> adding another option to control whether or not messages are deleted? > > > There is one, it was in the announcement notices and the Change Log. Yep. I've set it, see above. What I meant was to have one option for controlling whether messages entering the quarantine are scanned for viruses, and a second option to control whether they are deleted. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From denis at CROOMBS.ORG Tue Dec 14 09:28:28 2004 From: denis at CROOMBS.ORG (Denis Croombs) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner, Spamassassin & Clam on Centos/Whitebox Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am trying to use the install-clam-sa.tar.gz which I have used on Redhat 7.3 & 9.0 with no problems, but on Centos/Whitebox but just keep getting errors:- error: Failed dependencies: perl(Win32::TieRegistry) is needed by perl-Sys-Hostname-Long-1.2-1 I have found an rpm and have tried installing that but get:- [root@localhost rpms]# rpm -Uvh perl-Sys-Hostname-Long-1.2-1.n0i.2.noarch.rpm error: Failed dependencies: perl(:MODULE_COMPAT_5.8.6) is needed by perl-Sys-Hostname-Long-1.2-1.n0i.2 Does anyone have a solution for these ? Thanks Denis --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.809 / Virus Database: 551 - Release Date: 09/12/2004 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. Marvin the E-Mail scanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Tue Dec 14 09:36:35 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner, Spamassassin & Clam on Centos/Whitebox Message-ID: > Does anyone have a solution for these ? Two options: - cpan - which should automagically resolve the dependencies - manual install of each module The problem is that Whitebox does not ship with the exact same set of modules installed, so there will be differences. On the plus side Whitebox doesn't suffer from some of the niggly Perl issues that deadrat 9 did... :) Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Tue Dec 14 09:41:26 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:55 2006 Subject: Rant part deux Message-ID: Out of office replies - If you do not know how to disable them why do you think you are qualified to admin an email server????? Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 11:27:58 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Wilcock wrote: > Julian Field wrote: > >> John Wilcock wrote: >> >>> Installed this beta yesterday. It seems that messages destined for the >>> quarantine are indeed getting scanned for viruses, but they are not >>> deleted, just flagged. >> >> >> So they are being put in the spam quarantine? What MTA are you using? >> This only applies if you have "store" amongst your "Spam Actions" and/or >> "High Scoring Spam Actions". > > > MTA = postfix > Quarantine Infections = yes > Quarantine Silent Viruses = yes > Quarantine Whole Message = yes > Quarantine Whole Messages As Queue Files = no > Keep Spam And MCP Archive Clean = yes > Spam Actions = store deliver > High Scoring Spam Actions = store > > A high-scoring-spam message with a virus ends up with the message and > attachment in the normal quarantine *and* a second copy of the message > in the spam quarantine. I have just tried this setup (though with Is Definitely Spam = yes and Definite Spam Is High Scoring = yes) and I can't reproduce the problem with sendmail. I can't make reproduce it with Definite Spam Is High Scoring = no either. Which MTA are you using? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Tue Dec 14 12:17:48 2004 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > John Wilcock wrote: >> MTA = postfix > > Which MTA are you using? See above :-) John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Tue Dec 14 12:53:22 2004 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:27:55 2006 Subject: Would it be a good idea to learn viruses as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It struck me that most of the Bagle variants we receive here get highish Bayes scores (90+) whereas most of the Sober.Js still get lowish Bayes (20 or 30 at most). As new variants of viruses often retain at least some of the message text from previous variants, it seems to me that it might be a good idea to teach them to Bayes in the hopes of adding yet another line of defense to MailScanner's many talents. What does the combined wisdom of the list reckon on this one? Would it be a good idea for Julian to implement an option to automatically feed confirmed viruses to sa-learn --spam? John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chris at TRUDEAU.ORG Tue Dec 14 13:14:32 2004 From: chris at TRUDEAU.ORG (Chris Trudeau) Date: Thu Jan 12 21:27:55 2006 Subject: ClamAV Perl module not found Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] List, Installing ClamAV module via CPAN on machine running MailScanner 4.36-4 stable. The install of the module goes fine, but when starting MailScanner with Virus Scanners = clamavmodule the log returns the message: ClamAV Perl module not found, did you install it? I verified using CPAN install that it is in fact installed and uptodate. Any ideas? CT -- This message has been scanned for viruses and dangerous content by DefendMail, and is believed to be clean. From mailscanner at ecs.soton.ac.uk Tue Dec 14 13:41:02 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Wilcock wrote: > Julian Field wrote: > >> John Wilcock wrote: >> >>> MTA = postfix >> >> >> Which MTA are you using? > > > See above :-) Good point! Can you try with Quarantine Whole Messages As Queue Files = yes for me please? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Tue Dec 14 14:00:53 2004 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Can you try with > Quarantine Whole Messages As Queue Files = yes > for me please? Will do briefly as an experiment, though this will break the ability to release files and learn spam via MailWatch so I won't be leaving it that way for too long. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Tue Dec 14 14:22:31 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:55 2006 Subject: ClamAV Perl module not found Message-ID: > I verified using CPAN install that it is in fact installed and > uptodate. > Try installing it manually :) Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Tue Dec 14 14:34:39 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:55 2006 Subject: ClamAV Perl module not found Message-ID: Chris Trudeau wrote: > List, > > Installing ClamAV module via CPAN on machine running MailScanner > 4.36-4 stable. The install of the module goes fine, but when > starting MailScanner with Virus Scanners = clamavmodule the log > returns the message: > > ClamAV Perl module not found, did you install it? > > I verified using CPAN install that it is in fact installed and > uptodate. > > Any ideas? > > CT Do you have more than one version of perl installed? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Tue Dec 14 14:41:31 2004 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Wilcock wrote: > Julian Field wrote: > >> Can you try with >> Quarantine Whole Messages As Queue Files = yes >> for me please? > > > Will do briefly as an experiment, though this will break the ability to > release files and learn spam via MailWatch so I won't be leaving it that > way for too long. OK, I changed the setting and sent myself a copy of a high-scoring virus message. The behaviour was essentially the same, with one copy of the message and attachment in the normal quarantine and a second copy of the message in the spam quarantine. The only difference is that the message file was raw postfix format, of course. As an aside, I believe I may have spotted a bug in the fix for uniqueness of quarantine file names. With Quarantine Whole Messages As Queue Files = yes the name of the raw postfix message file is just the 10 hex digits of postfix's internal id, whereas with it set to no the filename has the extra five digits on the end. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Tue Dec 14 14:46:45 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:55 2006 Subject: fetching e-mails to local server Message-ID: Fetchmail can be set to do what you need. And the MX record can be changed to a dynamic DNS so that it always gets updated. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Marcin Rozek Sent: Monday, December 13, 2004 4:34 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: OT: fetching e-mails to local server Hello, this is a bit off-topic, but i don't know where to ask this question... The story: small firm have an e-mail server provided by their ISP. They have few aliases eg. aaa@firm.pl bbb@firm.pl etc. that points to one real account on that server. They also want to have their local e-mail server to send e-mails (and that works ok) but also want to have their e-mails fetched from ISP-server to their local server. I'm not sure how i can do this. I tried fetchmail, but it downloads all e-mails to one account. But they want to download all e-mails from that one real account and place it into real accounts on local server. aaa@firm.pl and bbb@firm.pl goes to realaccount@firm.pl I have to get all e-mails from realaccount and put e-mails that were sent to eg. aaa@firm.pl to box aaa on local server. Someone have an idea how to do that? I appreciate any help. ps. i was thinking about changing MX record to point to that 'local' server but its IP is dynamic:( ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Tue Dec 14 14:49:09 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:55 2006 Subject: all mails are whitelisted Message-ID: If you are in "test.de", and all your users are in "test.de", it seems you've told MS to whitelist them. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Bernd Holzinger Sent: Tuesday, December 14, 2004 2:37 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: all mails are whitelisted Hello all, my mailscanner marks all mails as "not spam (whitelisted)" X-company-MailScanner-SpamCheck: not spam (whitelisted), SpamAssassin (score=23.067, required 5, ..... My configuration parameters are: /etc/MailScanner/MailScanner.conf: SpamAssassin Auto Whitelist = no /etc/MailScanner/rules/spam.whitelist.rules: FromOrTo: *@test.de yes ..... FromOrTo: default no /etc/mail/spamassassin/local.cf: use_auto_whitelist 0 user_prefs: use_auto_whitelist 0 My system parameters are: Debian/testing MailScanner 4.36.1 SpamAssassin 3.0.1 (perl module) perl 5.8.4 Thanks in advance for your help, -- Bernd Holzinger email: bho-nospam-@sns.dnsalias.org please remove "-nospam-" from email address ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From thom at CUSTOMNETWORKS.CA Tue Dec 14 14:44:12 2004 From: thom at CUSTOMNETWORKS.CA (Thom Paine) Date: Thu Jan 12 21:27:55 2006 Subject: OT: fetching e-mails to local server Message-ID: > This is what the: > > user 'xyz' with pass ''abc' to * here > > syntax is for in your fetchmailrc. This works, but is unreliable in some > circumstances. I have one site where it works seemingly faultlessly and > another where it won't work at all - probably depends on the mailserver being > polled. If you have no alternative though... > I don't like this syntax as it's a little confusing. The catch is you need a localdomains line in your .fetchmailrc file. Here is an example of mine. set daemon 300 poll "domain.com" proto pop3 localdomains yourdomain.com user "popusername" pass "poppassword" to * You need to run this as root on the mailserver that is fetching the email. The set daemon checks every 300 seconds. The caveat is that BCC messages don't get delivered to the recipient. They get bounced to root. I also have the server load the /usr/bin/fetchmail command in the /etc/rc.d/rc.local file so it's started at bootup. Hope this is helpful. -=/>Thom ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Dec 14 14:52:42 2004 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:27:55 2006 Subject: Rant part deux Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Who says we think that. I know I'm not qualified but I'm all there be. I am what I am. Michele Neylon :: Blacknight Solutions wrote: > > >Out of office replies - If you do not know how to disable them why do you >think you are qualified to admin an email server????? > > > >Mr Michele Neylon > > -- Ed Bruce Health Plan of Michigan Senior Programmer Phone: 248.226.1512 FAX: 248.204.6569 -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Tue Dec 14 15:08:55 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: Well John, that wouldn't really matter for MW, since you'd never set it to store the queue files... Further, for viruses the directory in the quarantine would still be correct: [root@mail root]# ls -ltr /var/spool/MailScanner/quarantine/20041214/1A3DA23DE9.31C13/ totalt 8 -rw-rw---- 1 postfix apache 1584 dec 14 16:04 1A3DA23DE9 -rw-rw---- 1 postfix apache 69 dec 14 16:04 eicar.com [root@mail root]# The only problem seem to be with the spam quarantine. -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of John Wilcock > Sent: den 14 december 2004 15:42 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner ANNOUNCE 4.37.2 > > > John Wilcock wrote: > > Julian Field wrote: > > > >> Can you try with > >> Quarantine Whole Messages As Queue Files = yes > >> for me please? > > > > > > Will do briefly as an experiment, though this will break > the ability to > > release files and learn spam via MailWatch so I won't be > leaving it that > > way for too long. > > OK, I changed the setting and sent myself a copy of a > high-scoring virus > message. The behaviour was essentially the same, with one copy of the > message and attachment in the normal quarantine and a second > copy of the > message in the spam quarantine. The only difference is that > the message > file was raw postfix format, of course. > > As an aside, I believe I may have spotted a bug in the fix for > uniqueness of quarantine file names. With Quarantine Whole Messages As > Queue Files = yes the name of the raw postfix message file is just the > 10 hex digits of postfix's internal id, whereas with it set to no the > filename has the extra five digits on the end. > > > > John. > > -- > -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Howard at HARPER-ADAMS.AC.UK Tue Dec 14 15:08:25 2004 From: Howard at HARPER-ADAMS.AC.UK (Howard Robinson) Date: Thu Jan 12 21:27:55 2006 Subject: Rant part deux Message-ID: May be it was dropped on him/her without adequate training and as part of an over long job list which is added too faster than jobs get completed - meaning that some jobs 'less important' to the company, get left? I know that's how I got it here with more jobs than I can cope with outstanding. Not everyone has dedicated email admin staff. Off to make the tea and sweet the floor now and, whilst the kettles boiling, set up an MS server. Okay I am jesting but some days it feels like that! Day off tomorrow - Helping Santa - Really In same boat as below and sinking! > Who says we think that. I know I'm not qualified but I'm all there be. I > am what I am. > > Michele Neylon :: Blacknight Solutions wrote: > Snipped rest Regards Howard Robinson (Senior Technical Development Officer) Harper Adams University College Edgmond Newport Shropshire TF10 8NB UK E-mail: hrobinson@harper-adams.ac.uk Tel. : +44(0)1952 820280 Via switchboard : +44(0)1952 815253 Direct line Fax. : +44(0)1952 814783 College Web site http://www.harper-adams.ac.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Tue Dec 14 15:30:29 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:55 2006 Subject: Rant part deux Message-ID: Howard Robinson wrote: > May be it was dropped on him/her without adequate training and as > part of an over long job list which is added too faster than jobs get > completed - meaning that some jobs 'less important' to the company, > get left? I know that's how I got it here with more jobs than I can > cope with outstanding. > Not everyone has dedicated email admin staff. > Off to make the tea and sweet the floor now and, whilst the kettles > boiling, set up an MS server. Okay I am jesting but some days it > feels like that! > Day off tomorrow - Helping Santa - Really > > In same boat as below and sinking! > >> Who says we think that. I know I'm not qualified but I'm all there >> be. I am what I am. >> >> Michele Neylon :: Blacknight Solutions wrote: >> > Snipped rest > > > > Regards > > Howard Robinson > (Senior Technical Development Officer) > Harper Adams University College > Edgmond > Newport > Shropshire > TF10 8NB UK > What's a kettle? :) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Tue Dec 14 15:55:01 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:55 2006 Subject: Quarantine Report Cron Job Script Message-ID: Hi there, just downloaded the QuarantineReport-Script from the fls-site. I walked through the INSTALL-File, and did everything as needed.. After i tried to run the cronjob (or the script itself) the ln-procedere worked fine.. But.. then it needed the Net::LDAP, even if i did not turned that feature on.. ok..but installed it then ;) Now my problem.. There was no mail generated.. :( Maybe because of my system-conf.. The Webserver is running as: User: www group:www I was able to change the Group-Rights within the script..but the links are not readable, as my Quarantine-File are created with the user root:root. :( Maybe i should change the command for linking the file into a copy?? Any ideas for me here? I hope someone is able to understand me ;) Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bernd_holzinger at T-ONLINE.DE Tue Dec 14 15:33:11 2004 From: bernd_holzinger at T-ONLINE.DE (Bernd Holzinger) Date: Thu Jan 12 21:27:55 2006 Subject: all mails are whitelisted Message-ID: >If you are in "test.de", and all your users are in "test.de", it seems >you've told MS to whitelist them. you are right, I must be blind. At least 10 times checked but always read over this. Sorry for wasting your time. Thanks for opening my eyes, -- Bernd Holzinger email: bho-nospam-@sns.dnsalias.org please remove "-nospam-" from email address ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 16:37:02 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Wilcock wrote: > John Wilcock wrote: > >> Julian Field wrote: >> >>> Can you try with >>> Quarantine Whole Messages As Queue Files = yes >>> for me please? >> >> >> >> Will do briefly as an experiment, though this will break the ability to >> release files and learn spam via MailWatch so I won't be leaving it that >> way for too long. > > > OK, I changed the setting and sent myself a copy of a high-scoring virus > message. The behaviour was essentially the same, with one copy of the > message and attachment in the normal quarantine and a second copy of the > message in the spam quarantine. The only difference is that the message > file was raw postfix format, of course. > > As an aside, I believe I may have spotted a bug in the fix for > uniqueness of quarantine file names. With Quarantine Whole Messages As > Queue Files = yes the name of the raw postfix message file is just the > 10 hex digits of postfix's internal id, whereas with it set to no the > filename has the extra five digits on the end. Try 4.37.3. Just released it. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 17:15:43 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:55 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released 4.37.3. This is a bugfix release: - Postfix problems with keeping spam quarantine clean are fixed. - SA problems with SPF checking are (hopefully!) fixed. Please let me or the list know how you get on with this release. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Tue Dec 14 17:31:18 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:56 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Please try the attached (short) patch to SA.pm and let me know what > happens. > Thanks, I've got the patch installed and will let you know how it works out. In fact, this message is a test, as the problem reveals itself quickly with messages forwarded from this list. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From G.Pentland at SOTON.AC.UK Tue Dec 14 17:40:55 2004 From: G.Pentland at SOTON.AC.UK (Pentland G.) Date: Thu Jan 12 21:27:56 2006 Subject: The worst Phishing false positive ever? Message-ID: BODY { FONT-SIZE: 9pt; FONT-FAMILY: Verdana, Arial, san serif } P { FONT-SIZE: 9pt; FONT-FAMILY: Verdana, Arial, san serif } TD { FONT-SIZE: 9pt; FONT-FAMILY: Verdana, Arial, san serif } H2 { FONT-WEIGHT: bold; FONT-SIZE: 13pt } H3 { FONT-WEIGHT: bold; FONT-SIZE: 11pt } A { TEXT-DECORATION: none } A:hover { TEXT-DECORATION: underline } .desc { FONT-SIZE: 8pt; COLOR: #333333 } Is this the worst Phishing false positive ever? I think that perhaps it thinks ".net", that Microsoft technology is in fact a part of a domain name. Any ideas? [newsletter_header.gif] For comments or enquiries please contact webmaster@codeproject.com | Monday 13th December, 2004 Welcome to this week's CodeProject newsletter. SITE NEWS .NET is finding its feet in the Windows desktop and server world along with some nice inroads into the land of Smart Devices, but less attention has been given to other .NET implementations such as Mono, MailScanner has detected a possible fraud attempt from "www.dotgnu.org" claiming to be MailScanner has detected a possible fraud attempt from "www.dotgnu.org" claiming to be Portable.NET and Rotor. Cross-Platform development is something many of us have grappled with over the years. While most major platforms support most popular languages there are always issues with availability of libraries and the pain of getting the UI to look and act the same on all platforms without looking 90's retro. We'd like to see if Cross-Platform .NET can solve some of this pain (or just allow a wider field of developer to experience it) so we've launched a new section dedicated to MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Cross-Platform .NET Development. As an incentive we've got 3 copies of MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Cross-Platform .NET Development to give away to the top 3 articles posted between now and January 30. Cross platform development articles can be code, components or just tips on how to avoid pain when developing .NET apps on multiple platforms. Good luck! CODEPROJECT OFFERS * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be VS.NET 2003 and MSDN Subscriptions from CodeProject Prices start at $2499 for MSDN Universal, MSDN Enterprise from $1599, and $899 for Visual Studio .NET 2003. Save some cash and help support your favourite site. Click here for our online store. * FarPoint's Spread for Web Forms/Spread for Windows Forms. When you need high-performance, fully-customizable grid/spreadsheet components for ASP.NET or Windows Forms development, join the professional developers who continually turn to the leader in grid/spreadsheet component technology. Download Now. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Data Dynamics SharpUI for .NET presents a complete toolkit of user interface controls to give your Visual Studio .NET. applications a sharp and consistent look and feel. The components include Office-style toolbars, menus, dockable tool windows, a set of databound input controls, panel controls, and a StyleManager. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Supercharge your C# productivity in Visual Studio .NET + Refactoring: improve code quality, safely and fast + Get all syntax errors highlighted as you type + Quickly find all references to any symbol + Easily navigate to declarations, usages, inheritors, and more Download free 30-day trial * Build Better Web Applications. The new Microsoft(R) Visual Studio(R) .NET 2003 Professional Special Edition has tools to help you build high-performance Web applications. + SQL Server™ 2000 + Windows Server™ 2003 + Upgrade now for $549 ERP Visit MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be msdn.microsoft.com/vstudio/se * Dundas WinWeb Combos on 'till December 31st - Get both Windows Forms and ASP.NET versions of either Dundas Chart or Dundas Gauge for .NET and save up to 50%. Choose from 3 available combos but only until December 31st, 2004. Click here for more information LATEST ADDITIONS 60 articles overall. 43 new, 19 updated, 7 moved. 36 articles were edited, 24 unedited. Article types listed: New, Updated, Moved, edited, unedited Article categories listed: General, MFC/C++, C#, .NET Articles posted in the last week MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be .NET Compact Framework * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be XrossOne Mobile GDI+ for .NET CF - Xinjie ZHANG [moved.gif] XrossOne Mobile GDI+ is an open source 2D graphics engine, written with 100% C# managed code. It helps .NET Compact Framework developers to create high quality 2D graphics output. MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be ASP.NET * Another look at Dynamic Content Rendering focusing on Images and JScript - varnk Information and examples about rendering dynamic content using ASP.NET. * An intelligent 404 page - Tim_Mackey This article explains how to enhance your 404 page by providing links to pages with a similar name to the requested page. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Link Asp.net Data Grid to Microsoft Excel in the client side - mohammed barqawi Link asp Data grid to Microsoft excel in the client side (Unedited) * Server side Control/Value Validation - Ritesh Mehrotra This code block can be used to perform server side validation on the web controls(TextBox, CheckBox, DataGrid, DropDownList) (Unedited) C# Database * Wrapper Code Generator for MS SQL Server Databases - Nirosh [moved.gif] The application generates database wrapper classes for MS SQL Server databases automatically. I got lots of good reviews and comments as I discussed about this with my colleagues. Now that the application is built, let's see what you have to say about this. C# WebServices * Pushing HTML content to a Blackberry - Steven Berkovitz How to push HTML content to a blackberry handheld using MDS Managed C++ * Using generics in C++/CLI - Nishant S,James T. Johnson Introduces generics and compares it with templates MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be VB.NET * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Introduction to TreeView Drag and Drop (VB.NET) - Tom John [moved.gif] Provide drag and drop functionalitly to TreeView controls. * Accessing Remote Exchange Server To read/delete mails using WEBDAV - amit.arora Accessing Remote Exchange Server To read/delete mails using WEBDAV * Automated Object Schema Migration - Jason Abbott [moved.gif] Use reflection and a serialization surrogate in .NET to automate basic object schema migration. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Printing Report Services Reports Landscape from within .Net - beeeen A workaround for printing Report Services reports in Landscape orientation (Unedited) C# Controls * Runtime Editable Control - Miljenko Cvjetko Inheritable (super class) UserForm that enables runtime moving of controls (editing). * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Extended web browser control for .NET 1.0/1.1 - smallguy78 Provides enhanced functionality for the windows inbuilt web browser (active-x) control (Unedited) List Controls * C function to export text from a ListView into a text file with separators - Bruno Challier Win32 API using C - no MFC (Unedited) * Large Address book in MAPI - Muthukumar Explains how to display the list of users in a Global Address Book in a large organization using a Virtual List Control. (Unedited) Miscellaneous Controls * Customizing the Appearance of CSliderCtrl Using Custom Draw - Mike O'Neill How to use custom draw to change the appearance of a Track Bar control and CSliderCtrl. C# Programming * Drawing POSTNET Barcodes with C# - rainman_63 [updated.gif] [moved.gif] This article demonstrates a method to draw POSTNET barcodes. * Batch Converting Linux ASCII Files to Windows - GroovyInAz This article explains using the Drag and Drop events to filter for files from the system. It also converts line ends from Linux (or other operating systems) to Windows style \n (new line) \r (carriage return) line ends. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Push And Run .NET Code on Remote Machine - Spunk [moved.gif] Execute an assembly on a remote machine without any special hooks - works on existing assemblies! * Compiling and Executing Code at Runtime - patsissons [moved.gif] This article describes how easy it is to run uncompiled code at runtime. * A Simple Drag And Drop How To Example - Marc Clifton The basics, along with some things I learned along the way. (Unedited) * A Text Template Class for C# - Darren Pruitt A simple Text Template class for .NET using a RegEx callback function. (Unedited) * Commenter - Writing a CodeRush plugin which helps you to comment your code - exDreamDuck Writing a CodeRush plugin: Commenter will help you to comment your code and make it easier to navigate through your code. (Unedited) * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be VS.NET Version Resource Auto-Increment Add-in - Brandon Sneed A VS.NET version resource auto-increment add-in. * Instantly Changing Language in the Form - Julijan Sribar How to switch language on the form instantly. * Using Cache in Your WinForms Applications - Kirby Turner The article talks about using the System.Web.Caching.Cache object in WinForms applications. C++ / MFC * Bits’ Array Encapsulation - HatemMostafa Encapsulate all bits stream operations in a class to handle all or most of bits stream functions. (Unedited) * Changes file & folder dates - T.YogaRamanan This is a simple tool to change created, modified and accessed dates of any file/folder (Unedited) * Simple and fast Huffman coding - HatemMostafa An article on fast huffman coding technique (Unedited) * ProcessTime - A tool to get start & end time of any process - tyramanan This tool uses PSAPI to list kernel & user processes. Also It can log start & end time of user level processes (Unedited) COM/DCOM/COM+ * Understanding COM Event Handling - Lim Bio Liong Learn the fundamental principles of COM Event Handling via a C++ template class that allows for generic handling of dispinterface COM events. (Unedited) DLLs * Makes any windows "Always On Top" - T.YogaRamanan This is a simple tool places PushPin button on all windows through system wide hook. (Unedited) Internet & Network * Tool to traverse MIB tree using SNMP - T.YogaRamanan This is a simple tool to walk MIB tree. It also demonstrates receiving traps along with client side SNMP requests. (Unedited) * How to install SNMP extension agent DLL? - T.YogaRamanan This tutorial is all about installing the developed extension agent DLL. (Unedited) * How to develop a SNMP extension agent DLL? - T.YogaRamanan This is a simple tool to walk MIB tree. It also demonstrates receiving traps along with client side SNMP requests. (Unedited) Macros and Add-ins * Visual Studio event macro to repair messed up DreamWeaver comments - Charles Windhausen A macro for Visual Studio 7 to repair DreamWeaver comments when a file is saved (Unedited) Multimedia * Rotating Sprite Objects on DirectDraw Wrapper for C# - smachado2004 Evaluate C# on delivering more than 1000 animated sprites on fullscreen 1280x1024. * Convert Mp3, MPEG, AVI to Windows Media Formats i.e. WMV, WMA, using Windows Media Encoder - Bluetears76 Video conversion has never been that simple. Use new Windows Media Encoder to convert different Video and Audio formats to WMV and WMA (Unedited) Programming Tips * Quick and Dirty Series: C++ FileSize() function - cdiggins Finding the size of the file in C++ is not trivial! (Unedited) Product Showcase * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be The Most Intelligent Add-In To Visual Studio .NET - Alexander Morozov [updated.gif] ReSharper is a VS.NET add-in with features such as intelligent coding assistance, on-the-fly error highlighting and quick error correction, unmatched support for code refactoring, and a whole lot more. Updated Articles MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be .NET * NTime - Performance unit testing tool - AdamSlosarski [updated.gif] An article on a performance testing tool to test an application against its performance. MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be ASP.NET * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be One click ASP.NET export button control for Excel/CSV file - Prashant Nayak (.Net Lover) [updated.gif] An extended ASP.NET button control for exporting/downloading Excel or CSV file. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Browser Detection using ASP.NET - Chris Maunder [updated.gif] Using and updating your machine.config file to better detect browser type in ASP.NET C# Controls * Drag and Drop support for column reordering in DataGrid control - Elvin Cheng [updated.gif] Enhance the DataGrid control with drag and drop support for column reordering C# Programming * DrawTools - Alex Farber [updated.gif] Sample Windows Forms application for drawing graphic objects in a window client area using drawing tools and mouse. C++ / MFC * Using Interfaces for Object Oriented Primitives - cdiggins [updated.gif] An introduction to the OOTL (Object Oriented Template Library). Describes how the OOTL uses a bleeding-edge technique of defining interface types in C++ to provide lightweight object-oriented primitives with run-time polymorphism through an IObject interface. * CHTMLViewer - Karl Runmo [updated.gif] An article on parsing and displaying HTML. * An extensible math expression parser with plug-ins - Mathieu Jacques [updated.gif] Design and code for an extensible, maintainable, robust and easy to use math parser. * CDfaRegEx: A DFA Implementation of a Regular Expression Compiler - Ben Hanson [updated.gif] A complete regular expression compiler. COM/DCOM/COM+ * ATL COM Based Addin / Plugin Framework With Dynamic Toolbars and Menus - thomas_tom99 [updated.gif] An article on ATL COM Based Addin / Plugin Framework With Dynamic Toolbars and Menus, based on VC++ Addin Architecture. (Unedited) Free Tools * ToDoList 3.10 RC5 - A simple and effective way to keep on top of your programming tasks - .dan.g. [updated.gif] A tree-based task manager with native XML support for easy web site integration. * Sourcecode Control Switcher - Soenke Schau [updated.gif] A tool to switch the Sourcecode Control Provider which is used in a development environment. Macros and Add-ins * WTL Helper - Sergey Solozhentsev [updated.gif] Add-in for MSVC++.NET 2003 that helps insert message handlers for WTL. String * Patricia and Huffman, Sitting in a Trie - Michael Jaworski [updated.gif] Article demonstrates a text-based Patricia trie and adds new text-compression features. System * MFS Service Manger - ThatsAlok [updated.gif] A fully functional replica of Windows Service Manager, With Some extra feature like Enumerating, Deleting and Updating the Services. (Unedited) Win32 / SDK * Lock Windows Desktop - afeijao [updated.gif] Restricting Windows access by hiding desktop windows and disabling special keys. cheers, Chris Maunder The Code Project ________________________________________________________________________________ This email was sent to ish@soton.ac.uk. To stop receiving this newsletter click here. The Code Project. 500-250 Ferrand Dr, Toronto ON. M3C 3G8 Canada. 416.642.1998 ^@ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From prandal at HEREFORDSHIRE.GOV.UK Tue Dec 14 17:55:02 2004 From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil) Date: Thu Jan 12 21:27:56 2006 Subject: The worst Phishing false positive ever? Message-ID: BODY { FONT-SIZE: 9pt; FONT-FAMILY: Verdana, Arial, san serif } P { FONT-SIZE: 9pt; FONT-FAMILY: Verdana, Arial, san serif } TD { FONT-SIZE: 9pt; FONT-FAMILY: Verdana, Arial, san serif } H2 { FONT-WEIGHT: bold; FONT-SIZE: 13pt } H3 { FONT-WEIGHT: bold; FONT-SIZE: 11pt } A { TEXT-DECORATION: none } A:hover { TEXT-DECORATION: underline } .desc { FONT-SIZE: 8pt; COLOR: #333333 } Yes, I reported MailScanner's misidentification of .NET as phishing a little while back. Phil ---- Phil Randal Network Engineer Herefordshire Council Hereford, UK ________________________________________________________________________________ From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Pentland G. Sent: 14 December 2004 17:41 To: MAILSCANNER@JISCMAIL.AC.UK Subject: The worst Phishing false positive ever? Is this the worst Phishing false positive ever? I think that perhaps it thinks ".net", that Microsoft technology is in fact a part of a domain name. Any ideas? [newsletter_header.gif] For comments or enquiries please contact webmaster@codeproject.com | Monday 13th December, 2004 Welcome to this week's CodeProject newsletter. SITE NEWS .NET is finding its feet in the Windows desktop and server world along with some nice inroads into the land of Smart Devices, but less attention has been given to other .NET implementations such as Mono, MailScanner has detected a possible fraud attempt from "www.dotgnu.org" claiming to be MailScanner has detected a possible fraud attempt from "www.dotgnu.org" claiming to be Portable.NET and Rotor. Cross-Platform development is something many of us have grappled with over the years. While most major platforms support most popular languages there are always issues with availability of libraries and the pain of getting the UI to look and act the same on all platforms without looking 90's retro. We'd like to see if Cross-Platform .NET can solve some of this pain (or just allow a wider field of developer to experience it) so we've launched a new section dedicated to MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Cross-Platform .NET Development. As an incentive we've got 3 copies of MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Cross-Platform .NET Development to give away to the top 3 articles posted between now and January 30. Cross platform development articles can be code, components or just tips on how to avoid pain when developing .NET apps on multiple platforms. Good luck! CODEPROJECT OFFERS * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be VS.NET 2003 and MSDN Subscriptions from CodeProject Prices start at $2499 for MSDN Universal, MSDN Enterprise from $1599, and $899 for Visual Studio .NET 2003. Save some cash and help support your favourite site. Click here for our online store. * FarPoint's Spread for Web Forms/Spread for Windows Forms. When you need high-performance, fully-customizable grid/spreadsheet components for ASP.NET or Windows Forms development, join the professional developers who continually turn to the leader in grid/spreadsheet component technology. Download Now. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Data Dynamics SharpUI for .NET presents a complete toolkit of user interface controls to give your Visual Studio .NET. applications a sharp and consistent look and feel. The components include Office-style toolbars, menus, dockable tool windows, a set of databound input controls, panel controls, and a StyleManager. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Supercharge your C# productivity in Visual Studio .NET + Refactoring: improve code quality, safely and fast + Get all syntax errors highlighted as you type + Quickly find all references to any symbol + Easily navigate to declarations, usages, inheritors, and more Download free 30-day trial * Build Better Web Applications. The new Microsoft(R) Visual Studio(R) .NET 2003 Professional Special Edition has tools to help you build high-performance Web applications. + SQL Server™ 2000 + Windows Server™ 2003 + Upgrade now for $549 ERP Visit MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be msdn.microsoft.com/vstudio/se * Dundas WinWeb Combos on 'till December 31st - Get both Windows Forms and ASP.NET versions of either Dundas Chart or Dundas Gauge for .NET and save up to 50%. Choose from 3 available combos but only until December 31st, 2004. Click here for more information LATEST ADDITIONS 60 articles overall. 43 new, 19 updated, 7 moved. 36 articles were edited, 24 unedited. Article types listed: New, Updated, Moved, edited, unedited Article categories listed: General, MFC/C++, C#, .NET Articles posted in the last week MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be .NET Compact Framework * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be XrossOne Mobile GDI+ for .NET CF - Xinjie ZHANG [moved.gif] XrossOne Mobile GDI+ is an open source 2D graphics engine, written with 100% C# managed code. It helps .NET Compact Framework developers to create high quality 2D graphics output. MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be ASP.NET * Another look at Dynamic Content Rendering focusing on Images and JScript - varnk Information and examples about rendering dynamic content using ASP.NET. * An intelligent 404 page - Tim_Mackey This article explains how to enhance your 404 page by providing links to pages with a similar name to the requested page. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Link Asp.net Data Grid to Microsoft Excel in the client side - mohammed barqawi Link asp Data grid to Microsoft excel in the client side (Unedited) * Server side Control/Value Validation - Ritesh Mehrotra This code block can be used to perform server side validation on the web controls(TextBox, CheckBox, DataGrid, DropDownList) (Unedited) C# Database * Wrapper Code Generator for MS SQL Server Databases - Nirosh [moved.gif] The application generates database wrapper classes for MS SQL Server databases automatically. I got lots of good reviews and comments as I discussed about this with my colleagues. Now that the application is built, let's see what you have to say about this. C# WebServices * Pushing HTML content to a Blackberry - Steven Berkovitz How to push HTML content to a blackberry handheld using MDS Managed C++ * Using generics in C++/CLI - Nishant S,James T. Johnson Introduces generics and compares it with templates MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be VB.NET * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Introduction to TreeView Drag and Drop (VB.NET) - Tom John [moved.gif] Provide drag and drop functionalitly to TreeView controls. * Accessing Remote Exchange Server To read/delete mails using WEBDAV - amit.arora Accessing Remote Exchange Server To read/delete mails using WEBDAV * Automated Object Schema Migration - Jason Abbott [moved.gif] Use reflection and a serialization surrogate in .NET to automate basic object schema migration. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Printing Report Services Reports Landscape from within .Net - beeeen A workaround for printing Report Services reports in Landscape orientation (Unedited) C# Controls * Runtime Editable Control - Miljenko Cvjetko Inheritable (super class) UserForm that enables runtime moving of controls (editing). * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Extended web browser control for .NET 1.0/1.1 - smallguy78 Provides enhanced functionality for the windows inbuilt web browser (active-x) control (Unedited) List Controls * C function to export text from a ListView into a text file with separators - Bruno Challier Win32 API using C - no MFC (Unedited) * Large Address book in MAPI - Muthukumar Explains how to display the list of users in a Global Address Book in a large organization using a Virtual List Control. (Unedited) Miscellaneous Controls * Customizing the Appearance of CSliderCtrl Using Custom Draw - Mike O'Neill How to use custom draw to change the appearance of a Track Bar control and CSliderCtrl. C# Programming * Drawing POSTNET Barcodes with C# - rainman_63 [updated.gif] [moved.gif] This article demonstrates a method to draw POSTNET barcodes. * Batch Converting Linux ASCII Files to Windows - GroovyInAz This article explains using the Drag and Drop events to filter for files from the system. It also converts line ends from Linux (or other operating systems) to Windows style \n (new line) \r (carriage return) line ends. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Push And Run .NET Code on Remote Machine - Spunk [moved.gif] Execute an assembly on a remote machine without any special hooks - works on existing assemblies! * Compiling and Executing Code at Runtime - patsissons [moved.gif] This article describes how easy it is to run uncompiled code at runtime. * A Simple Drag And Drop How To Example - Marc Clifton The basics, along with some things I learned along the way. (Unedited) * A Text Template Class for C# - Darren Pruitt A simple Text Template class for .NET using a RegEx callback function. (Unedited) * Commenter - Writing a CodeRush plugin which helps you to comment your code - exDreamDuck Writing a CodeRush plugin: Commenter will help you to comment your code and make it easier to navigate through your code. (Unedited) * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be VS.NET Version Resource Auto-Increment Add-in - Brandon Sneed A VS.NET version resource auto-increment add-in. * Instantly Changing Language in the Form - Julijan Sribar How to switch language on the form instantly. * Using Cache in Your WinForms Applications - Kirby Turner The article talks about using the System.Web.Caching.Cache object in WinForms applications. C++ / MFC * Bits’ Array Encapsulation - HatemMostafa Encapsulate all bits stream operations in a class to handle all or most of bits stream functions. (Unedited) * Changes file & folder dates - T.YogaRamanan This is a simple tool to change created, modified and accessed dates of any file/folder (Unedited) * Simple and fast Huffman coding - HatemMostafa An article on fast huffman coding technique (Unedited) * ProcessTime - A tool to get start & end time of any process - tyramanan This tool uses PSAPI to list kernel & user processes. Also It can log start & end time of user level processes (Unedited) COM/DCOM/COM+ * Understanding COM Event Handling - Lim Bio Liong Learn the fundamental principles of COM Event Handling via a C++ template class that allows for generic handling of dispinterface COM events. (Unedited) DLLs * Makes any windows "Always On Top" - T.YogaRamanan This is a simple tool places PushPin button on all windows through system wide hook. (Unedited) Internet & Network * Tool to traverse MIB tree using SNMP - T.YogaRamanan This is a simple tool to walk MIB tree. It also demonstrates receiving traps along with client side SNMP requests. (Unedited) * How to install SNMP extension agent DLL? - T.YogaRamanan This tutorial is all about installing the developed extension agent DLL. (Unedited) * How to develop a SNMP extension agent DLL? - T.YogaRamanan This is a simple tool to walk MIB tree. It also demonstrates receiving traps along with client side SNMP requests. (Unedited) Macros and Add-ins * Visual Studio event macro to repair messed up DreamWeaver comments - Charles Windhausen A macro for Visual Studio 7 to repair DreamWeaver comments when a file is saved (Unedited) Multimedia * Rotating Sprite Objects on DirectDraw Wrapper for C# - smachado2004 Evaluate C# on delivering more than 1000 animated sprites on fullscreen 1280x1024. * Convert Mp3, MPEG, AVI to Windows Media Formats i.e. WMV, WMA, using Windows Media Encoder - Bluetears76 Video conversion has never been that simple. Use new Windows Media Encoder to convert different Video and Audio formats to WMV and WMA (Unedited) Programming Tips * Quick and Dirty Series: C++ FileSize() function - cdiggins Finding the size of the file in C++ is not trivial! (Unedited) Product Showcase * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be The Most Intelligent Add-In To Visual Studio .NET - Alexander Morozov [updated.gif] ReSharper is a VS.NET add-in with features such as intelligent coding assistance, on-the-fly error highlighting and quick error correction, unmatched support for code refactoring, and a whole lot more. Updated Articles MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be .NET * NTime - Performance unit testing tool - AdamSlosarski [updated.gif] An article on a performance testing tool to test an application against its performance. MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be ASP.NET * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be One click ASP.NET export button control for Excel/CSV file - Prashant Nayak (.Net Lover) [updated.gif] An extended ASP.NET button control for exporting/downloading Excel or CSV file. * MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be MailScanner has detected a possible fraud attempt from "www.codeproject.com" claiming to be Browser Detection using ASP.NET - Chris Maunder [updated.gif] Using and updating your machine.config file to better detect browser type in ASP.NET C# Controls * Drag and Drop support for column reordering in DataGrid control - Elvin Cheng [updated.gif] Enhance the DataGrid control with drag and drop support for column reordering C# Programming * DrawTools - Alex Farber [updated.gif] Sample Windows Forms application for drawing graphic objects in a window client area using drawing tools and mouse. C++ / MFC * Using Interfaces for Object Oriented Primitives - cdiggins [updated.gif] An introduction to the OOTL (Object Oriented Template Library). Describes how the OOTL uses a bleeding-edge technique of defining interface types in C++ to provide lightweight object-oriented primitives with run-time polymorphism through an IObject interface. * CHTMLViewer - Karl Runmo [updated.gif] An article on parsing and displaying HTML. * An extensible math expression parser with plug-ins - Mathieu Jacques [updated.gif] Design and code for an extensible, maintainable, robust and easy to use math parser. * CDfaRegEx: A DFA Implementation of a Regular Expression Compiler - Ben Hanson [updated.gif] A complete regular expression compiler. COM/DCOM/COM+ * ATL COM Based Addin / Plugin Framework With Dynamic Toolbars and Menus - thomas_tom99 [updated.gif] An article on ATL COM Based Addin / Plugin Framework With Dynamic Toolbars and Menus, based on VC++ Addin Architecture. (Unedited) Free Tools * ToDoList 3.10 RC5 - A simple and effective way to keep on top of your programming tasks - .dan.g. [updated.gif] A tree-based task manager with native XML support for easy web site integration. * Sourcecode Control Switcher - Soenke Schau [updated.gif] A tool to switch the Sourcecode Control Provider which is used in a development environment. Macros and Add-ins * WTL Helper - Sergey Solozhentsev [updated.gif] Add-in for MSVC++.NET 2003 that helps insert message handlers for WTL. String * Patricia and Huffman, Sitting in a Trie - Michael Jaworski [updated.gif] Article demonstrates a text-based Patricia trie and adds new text-compression features. System * MFS Service Manger - ThatsAlok [updated.gif] A fully functional replica of Windows Service Manager, With Some extra feature like Enumerating, Deleting and Updating the Services. (Unedited) Win32 / SDK * Lock Windows Desktop - afeijao [updated.gif] Restricting Windows access by hiding desktop windows and disabling special keys. cheers, Chris Maunder The Code Project ________________________________________________________________________________ This email was sent to ish@soton.ac.uk. To stop receiving this newsletter click here. The Code Project. 500-250 Ferrand Dr, Toronto ON. M3C 3G8 Canada. 416.642.1998 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Tue Dec 14 18:18:26 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:56 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Please try the attached (short) patch to SA.pm and let me know what > happens. > I'm afraid the patched version isn't working for me. I don't see anything wrong with your patch. More clues: If I set Envelope From Header = X-test-From: envelope_sender_header X-test-From then all messages posted to this list receive SPF_PASS except those from me, which show SPF_FAIL. This is what started me thinking that duplicate headers were the problem. But if I use the default MailScanner settings, then most messages still show no SPF at all or SPF_FAIL. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 18:28:46 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: Google Suggest Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] http://www.google.com/webhp?complete=1&hl=en If you type in "mails" you get MailScanner at the top of the list. Yay! Interestingly, I beat "MailSweeper" (commercial product that used to be really popular when it was called MIMESweeper) by a factor of 10 in the number of search results. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Tue Dec 14 18:29:12 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:56 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Please try the attached (short) patch to SA.pm and let me know what > happens. Hold on a minute. After patching I did a MailScanner reload. Maybe I should have done a MailScanner restart. Let me try again. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 18:34:18 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mark Nienberg wrote: > Julian Field wrote: > >> Please try the attached (short) patch to SA.pm and let me know what >> happens. > > > Hold on a minute. After patching I did a MailScanner reload. Maybe I > should have done a MailScanner restart. Let me try again. > New code, so it would have to be a restart. Note that it will only work if the Envelope-From headers it is looking for are ones that match your definition of the envelope-from header in MailScanner.conf. It can only remove the headers if it knows what it is looking for. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Tue Dec 14 18:53:22 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:56 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Please try the attached (short) patch to SA.pm and let me know what > happens. > I'm pleased to report success with the patch! Thank you. In the interest of completeness, thanks also Chris Picciotto for lots of testing and ideas. Also, note that the workaround I suggested in an earlier message of using sendmail to add an "X-Envelope-From" header (also suggested in the SpamAssassin USAGE document) doesn't work 100% of the time. The problem is that sendmail won't add the header if it already exists in the incoming message. Chris developed a working method of using sendmail by adding a uniquely named header instead, and then specifying it with "envelope_sender_header". The patched version of MailScanner appears to overcome these problems. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 14 20:16:49 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: inconsistent SPF - bug Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mark Nienberg wrote: > Julian Field wrote: > >> Please try the attached (short) patch to SA.pm and let me know what >> happens. >> > I'm pleased to report success with the patch! Thank you. Yay! :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcin.rozek at IOS.EDU.PL Tue Dec 14 20:59:31 2004 From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Ro¿ek) Date: Thu Jan 12 21:27:56 2006 Subject: OT: fetching e-mails to local server Message-ID: [ The following text is in the "ISO-8859-2" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thom Paine wrote: >>This is what the: >> >>user 'xyz' with pass ''abc' to * here >> >>syntax is for in your fetchmailrc. This works, but is unreliable in some >>circumstances. I have one site where it works seemingly faultlessly and >>another where it won't work at all - probably depends on the mailserver being >>polled. If you have no alternative though... >> > I don't like this syntax as it's a little confusing. > > The catch is you need a localdomains line in your .fetchmailrc file. > > Here is an example of mine. I'll try that. Thank you, Guys! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Carl.Andrews at CRACKERBARREL.COM Wed Dec 15 00:25:38 2004 From: Carl.Andrews at CRACKERBARREL.COM (Andrews Carl 448) Date: Thu Jan 12 21:27:56 2006 Subject: High CPU Utilization Message-ID: [ The following text is in the "iso-8859-2" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am using a 3GHZ Compaq/HP DL380 with 1G RAM, running MailScanner 4.35.11, Spamassassin 3.0.1, RedHat 9.0 (download version) and clamav 0.80. At any given point I have one copy of /usr/sbin/MailScanner running at 50% -97% CPU. As I am writting this there are 23 instances running, one is at 60% and the rest do not even appear on the (top -c ) output. Anyone got any ideas on why this would be? Anything I can do to correct? Output from sar shows: "Average: all 60.23 0.00 15.97 23.80". This server is for email filtering only. No other software (except a full install of the OS) Thanks! Carl ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billox at BILLOX.COM Wed Dec 15 01:31:01 2004 From: billox at BILLOX.COM (James Page) Date: Thu Jan 12 21:27:56 2006 Subject: Using MailScanner to quarantine large files Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, My employer has a fat pipe into head office and a bunch of smaller branch offices around Australia and New Zealand on the end of little thin pipes. Like many others, we have a block on anything over a certain size so as to not put the squeeze on the smaller site's links. This is not ideal, as although the 90% of large, generally not work related inbound emails, are blocked, the 10% of them are important work related files. After recently implementing MailScanner and Mailwatch, it dawned on me how nice it would be able to use the quarantining system in MailScanner to hold anything over a certain size, to be released if deemed important. This would prevent abuse and yet still allow legitimate email to flow through if required. Has anyone implemented anything similar to this? If so, how? Any docs? :) Thanks James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Wed Dec 15 02:01:58 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:56 2006 Subject: Using MailScanner to quarantine large files Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of James Page > Sent: Tuesday, December 14, 2004 8:31 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Using MailScanner to quarantine large files > > Hi, > > > My employer has a fat pipe into head office and a bunch of smaller > branch offices around Australia and New Zealand on the end of little > thin pipes. > > Like many others, we have a block on anything over a certain size so as > to not put the squeeze on the smaller site's links. This is not ideal, > as although the 90% of large, generally not work related inbound emails, > are blocked, the 10% of them are important work related files. > > After recently implementing MailScanner and Mailwatch, it dawned on me > how nice it would be able to use the quarantining system in MailScanner > to hold anything over a certain size, to be released if deemed > important. This would prevent abuse and yet still allow legitimate email > to flow through if required. > > Has anyone implemented anything similar to this? If so, how? Any docs? :) > What you might want to consider implementing is holding large messages for "small pipes" for transmission at off hours. Julian has implemented this approach at a few sites and I seem to remember a few threads in the list archives that dealt with this type of problem. I'd suggest searching the list archives for delayed queues. Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com > > Thanks > > > > James > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and dangerous content by The > MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be > clean. > > -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Wed Dec 15 02:29:41 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:56 2006 Subject: High CPU Utilization Message-ID: What SpamAssassin rulesets are you using? Any besides the defaults such as bigevil.cf? Mike ________________________________ From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Andrews Carl 448 Sent: Tuesday, December 14, 2004 6:26 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: High CPU Utilization I am using a 3GHZ Compaq/HP DL380 with 1G RAM, running MailScanner 4.35.11, Spamassassin 3.0.1, RedHat 9.0 (download version) and clamav 0.80. At any given point I have one copy of /usr/sbin/MailScanner running at 50% -97% CPU. As I am writting this there are 23 instances running, one is at 60% and the rest do not even appear on the (top -c ) output. Anyone got any ideas on why this would be? Anything I can do to correct? Output from sar shows: "Average: all 60.23 0.00 15.97 23.80". This server is for email filtering only. No other software (except a full install of the OS) Thanks! Carl ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Carl.Andrews at CRACKERBARREL.COM Wed Dec 15 05:50:35 2004 From: Carl.Andrews at CRACKERBARREL.COM (Andrews Carl 448) Date: Thu Jan 12 21:27:56 2006 Subject: High CPU Utilization Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just the defaults. I just searched the server, bigevil.cf does not even exist. That is something I would have to add myself correct? So far this is a default install, only changed what was necessary to make it go :-> -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Mike Kercher Sent: Tuesday, December 14, 2004 8:30 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: High CPU Utilization What SpamAssassin rulesets are you using? Any besides the defaults such as bigevil.cf? Mike ________________________________ From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Andrews Carl 448 Sent: Tuesday, December 14, 2004 6:26 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: High CPU Utilization I am using a 3GHZ Compaq/HP DL380 with 1G RAM, running MailScanner 4.35.11, Spamassassin 3.0.1, RedHat 9.0 (download version) and clamav 0.80. At any given point I have one copy of /usr/sbin/MailScanner running at 50% -97% CPU. As I am writting this there are 23 instances running, one is at 60% and the rest do not even appear on the (top -c ) output. Anyone got any ideas on why this would be? Anything I can do to correct? Output from sar shows: "Average: all 60.23 0.00 15.97 23.80". This server is for email filtering only. No other software (except a full install of the OS) Thanks! Carl ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Howard at HARPER-ADAMS.AC.UK Wed Dec 15 09:27:47 2004 From: Howard at HARPER-ADAMS.AC.UK (Howard Robinson) Date: Thu Jan 12 21:27:56 2006 Subject: High CPU Utilization Message-ID: Hmm I have just done a top -c and it shows CPU states: cpu user nice system irq softirq iowait idle total 2.4% 0.0% 0.6% 0.0% 0.0% 0.0% 197.0% cpu00 1.6% 0.0% 0.2% 0.0% 0.0% 0.0% 98.2% cpu01 0.8% 0.0% 0.4% 0.0% 0.0% 0.0% 98.8% That's 197% idle!!! Does that throw a suspision that top may be flawed On 14 Dec 04, at 18:25, Andrews Carl 448 wrote: > I am using a 3GHZ Compaq/HP DL380 with 1G RAM, running MailScanner 4.35.11, > Spamassassin 3.0.1, RedHat 9.0 (download version) and clamav 0.80. At any > given point I have one copy of /usr/sbin/MailScanner running at 50% -97% > CPU. As I am writting this there are 23 instances running, one is at 60% and > the rest do not even appear on the (top -c ) output. Anyone got any ideas on > why this would be? Anything I can do to correct? Output from sar shows: > "Average: all 60.23 0.00 15.97 23.80". This server > is for email filtering only. No other software (except a full install of the > OS) > > > Thanks! > Carl > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > Regards Howard Robinson (Senior Technical Development Officer) Harper Adams University College Edgmond Newport Shropshire TF10 8NB UK E-mail: hrobinson@harper-adams.ac.uk Tel. : +44(0)1952 820280 Via switchboard : +44(0)1952 815253 Direct line Fax. : +44(0)1952 814783 College Web site http://www.harper-adams.ac.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 15 09:03:39 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:56 2006 Subject: Google Suggest Message-ID: Julian Field wrote: > http://www.google.com/webhp?complete=1&hl=en > > If you type in "mails" you get MailScanner at the top of the list. Yay! > > Interestingly, I beat "MailSweeper" (commercial product that used to be > really popular when it was called MIMESweeper) by a factor of 10 in the > number of search results. > > -- > Julian Field Julian about the same factor that SA/MS combination beats MailSweeper in Spam trapping etc then. Nice and consistent :-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 15 09:07:27 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:56 2006 Subject: High CPU Utilization Message-ID: Carl what MTA? how many emails per day on average? How many MailScanner Children and what batch size have you defined in MailScanner.conf? Are you running any RBL's in SA? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Andrews Carl 448 wrote: > I am using a 3GHZ Compaq/HP DL380 with 1G RAM, running MailScanner > 4.35.11, Spamassassin 3.0.1, RedHat 9.0 (download version) and clamav > 0.80. At any given point I have one copy of /usr/sbin/MailScanner > running at 50% -97% CPU. As I am writting this there are 23 instances > running, one is at 60% and the rest do not even appear on the (top -c ) > output. Anyone got any ideas on why this would be? Anything I can do to > correct? Output from sar shows: "Average: all 60.23 > 0.00 15.97 23.80". This server is for email filtering only. No > other software (except a full install of the OS) > > > Thanks! > Carl > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 15 10:07:06 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:56 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: > -----Original Message----- > From: John Wilcock [mailto:john@tradoc.fr] > Sent: den 14 december 2004 16:22 > To: Steen, Glenn > Subject: Re: MailScanner ANNOUNCE 4.37.2 > > > Steen, Glenn wrote: > > Well John, that wouldn't really matter for MW, since you'd never set > > it to store the queue files... > > Yes, I realise that. I was just pointing out a potential bug that may > affect non-MW users. True John, and I in turn just point to it just being a problem in the spam quarantine, for two reasons: 1) The directory of the virus quarantine keep the "id.5-randoms" bit, and 2) Since you keep the queue file (and thus the inode, unless one has done something foolish (like have the postfix spool and the quarantine on separate filesystems)) you run no risk of reusing that particular id. I realize I could have been more clear on this:-) So... the problem is either a cosmetic one in the quarantines, or a "will never be setup that way" for MW. I see Julian has released a new beta, so I'll be looking at that ASAP. -- Glenn > > John. > > -- > -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From clicknow at SWIFTDSL.COM.AU Wed Dec 15 10:18:13 2004 From: clicknow at SWIFTDSL.COM.AU (Brian Parish) Date: Thu Jan 12 21:27:56 2006 Subject: High CPU Utilization Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wed, 15 Dec 2004 08:27 pm, Howard Robinson wrote: > Hmm > I have just done a top -c and it shows > CPU states: cpu user nice system irq softirq iowait idle > total 2.4% 0.0% 0.6% 0.0% 0.0% 0.0% 197.0% > cpu00 1.6% 0.0% 0.2% 0.0% 0.0% 0.0% 98.2% > cpu01 0.8% 0.0% 0.4% 0.0% 0.0% 0.0% 98.8% > > That's 197% idle!!! > Does that throw a suspision that top may be flawed > Well there are days when I am at least 197% idle ;-) No, that just means you have two CPU's and it doesn't average. cheers Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From roger at RUDNICK.COM.BR Wed Dec 15 10:23:47 2004 From: roger at RUDNICK.COM.BR (Roger Jochem) Date: Thu Jan 12 21:27:56 2006 Subject: High CPU Utilization Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Or one cpu with hyper-threading. ----- Original Message ----- From: "Brian Parish" To: Sent: Wednesday, December 15, 2004 8:18 AM Subject: Re: High CPU Utilization > On Wed, 15 Dec 2004 08:27 pm, Howard Robinson wrote: > > Hmm > > I have just done a top -c and it shows > > CPU states: cpu user nice system irq softirq iowait idle > > total 2.4% 0.0% 0.6% 0.0% 0.0% 0.0% 197.0% > > cpu00 1.6% 0.0% 0.2% 0.0% 0.0% 0.0% 98.2% > > cpu01 0.8% 0.0% 0.4% 0.0% 0.0% 0.0% 98.8% > > > > That's 197% idle!!! > > Does that throw a suspision that top may be flawed > > > Well there are days when I am at least 197% idle ;-) > > No, that just means you have two CPU's and it doesn't average. > > cheers > Brian > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jose at TREELOGIC.COM Wed Dec 15 11:30:29 2004 From: jose at TREELOGIC.COM ([iso-8859-1] José Angel Blanco González) Date: Thu Jan 12 21:27:56 2006 Subject: Block mail by subject content Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Is it possible to block mails based on subject content. For example I want to block or mark as Spam all mails with certain subjects. How can I do this Thank you ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve at NETWAYNETWORKS.COM.AU Wed Dec 15 12:05:35 2004 From: steve at NETWAYNETWORKS.COM.AU (Steven Evans) Date: Thu Jan 12 21:27:56 2006 Subject: Quarantine specific file types/extensions to email address Message-ID: Hi Guys, I've been asked to configure mailscanner so that it quarantines and forwards specific file types to the internal Network Administration help desk. I've checked the faq and maq and cant find anything useful there. The idea is to forward all jpgs, movies, zips etc to the administrator so they can view them and verify their validity for work. Cheers, Steve ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marco at XSSNET.COM Wed Dec 15 13:30:28 2004 From: marco at XSSNET.COM (Marco Benton - BOFH) Date: Thu Jan 12 21:27:56 2006 Subject: High CPU Utilization Message-ID: [ The following text is in the "ISO-8859-2" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Andrews Carl 448 wrote: | High CPU Utilization | | I am using a 3GHZ Compaq/HP DL380 with 1G RAM, running MailScanner | 4.35.11, Spamassassin 3.0.1, RedHat 9.0 (download version) and | clamav 0.80. At any given point I have one copy of | /usr/sbin/MailScanner running at 50% -97% CPU. As I am writting | this there are 23 instances running, one is at 60% and the rest do | not even appear on the (top -c ) output. Anyone got any ideas on | why this would be? Anything I can do to correct? Output from sar | shows: "Average:          all     60.23      0.00     15.97 | 23.80". This server is for email filtering only. No other software | (except a full install of the OS) | you mention you have 23 other instances running.  do you mean you configured 23-25 "Max Children" in MailScanner.conf? that's not a good thing.  that mat be causing you load too go high and excessive I/O. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBwDxz6T7cCxJsGOIRAhVPAKCohI1vcg2Ete2Um2tL7sGBTia8EQCfVZik DfAJzwFdqWpLcz9+DGgIgVo= =oVXl -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Wed Dec 15 13:33:50 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:56 2006 Subject: Block mail by subject content Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] José Angel Blanco González wrote: > Is it possible to block mails based on subject content. For example I > want to block or mark as Spam all mails with certain subjects. How > can I do this > > Thank you > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! You could either write a SpamAssassin rule or block them at the MTA. Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 15 13:39:23 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:56 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: Hm, looking at the latest (4.37.3) ... Nice Julian. I might have spoken to soon about the preservation of inodes (below) though... It's a copy into the quarantine, regardless, right? -- Glenn (not really friendly with the code yet, but getting there:-) > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn > Sent: den 15 december 2004 11:07 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner ANNOUNCE 4.37.2 > > > > -----Original Message----- > > From: John Wilcock [mailto:john@tradoc.fr] > > Sent: den 14 december 2004 16:22 > > To: Steen, Glenn > > Subject: Re: MailScanner ANNOUNCE 4.37.2 > > > > > > Steen, Glenn wrote: > > > Well John, that wouldn't really matter for MW, since > you'd never set > > > it to store the queue files... > > > > Yes, I realise that. I was just pointing out a potential > bug that may > > affect non-MW users. > True John, and I in turn just point to it just being a problem in the > spam quarantine, for two reasons: 1) The directory of the virus > quarantine > keep the "id.5-randoms" bit, and 2) Since you keep the queue file (and > thus > the inode, unless one has done something foolish (like have > the postfix > spool > and the quarantine on separate filesystems)) you run no risk > of reusing > that > particular id. > I realize I could have been more clear on this:-) > > So... the problem is either a cosmetic one in the quarantines, or a > "will never > be setup that way" for MW. > > I see Julian has released a new beta, so I'll be looking at that ASAP. > > -- Glenn > > > > > John. > > > > -- > > -- Over 2500 webcams from ski resorts around the world - > www.snoweye.com > -- Translate your technical documents and web pages - www.tradoc.fr > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jose at TREELOGIC.COM Wed Dec 15 14:50:42 2004 From: jose at TREELOGIC.COM ([iso-8859-1] José Angel Blanco González) Date: Thu Jan 12 21:27:56 2006 Subject: Block mail by subject content with MCP Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am trying to block mails based on subject with MCP I modified a 10_example.cf header SAMPLE_RULE3 Subject =~ /merry christmas/i describe SAMPLE_RULE3 Banned Subject score SAMPLE_RULE3 11 header SAMPLE_RULE4 Subject =~ /feliz navidad/i describe SAMPLE_RULE4 Banned Subject score SAMPLE_RULE4 11 header SAMPLE_RULE5 Subject =~ /Delivery Status Notification (Failure)/i describe SAMPLE_RULE5 Banned Subject score SAMPLE_RULE5 11 header SAMPLE_RULE6 Subject =~ /Mail delivery :returning message to sender/i describe SAMPLE_RULE6 Banned Subject score SAMPLE_RULE6 11 header SAMPLE_RULE7 Subject =~ /failure notice/i describe SAMPLE_RULE7 Banned Subject score SAMPLE_RULE7 11 but is not working, here is a extract of header from a message: Message-ID: Subject: Delivery Status Notification (Failure) X-Treelogic-MailScanner: Found to be clean, Found to be clean X-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (puntaje=0, requerido 1) X-Treelogic-MailScanner-SpamCheck: no es spam, SpamAssassin (punta... How can I resolve this? With this rules how can I search for word cuts? example 'Notif* failure' Thank you ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 15 14:57:46 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:56 2006 Subject: Block mail by subject content with MCP Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of José Angel > Blanco González > Sent: den 15 december 2004 15:51 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Block mail by subject content with MCP > > > I am trying to block mails based on subject with MCP > I modified a 10_example.cf > (snip) > header SAMPLE_RULE5 Subject =~ /Delivery Status > Notification (Failure)/i > describe SAMPLE_RULE5 Banned Subject > score SAMPLE_RULE5 11 (snip) > but is not working, here is a extract of header from a message: > > Message-ID: > Subject: Delivery Status Notification (Failure) > X-Treelogic-MailScanner: Found to be clean, Found to be clean > X-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (puntaje=0, > requerido 1) > X-Treelogic-MailScanner-SpamCheck: no es spam, SpamAssassin (punta... > Problem is with the RE above. In perl the "unescaped ()" are special so you need escape them like: header SAMPLE_RULE5 Subject =~ /Delivery Status Notification \(Failure\)/i ... else it'll look for "Delivery Status Notification Failure" and, if found, will assign "Failure" to $1 ... Probably not what you want:-) -- Glenn ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Dec 15 15:10:25 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:56 2006 Subject: Quarantine specific file types/extensions to email address Message-ID: Have you looked at MCP? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steven Evans Sent: Wednesday, December 15, 2004 7:06 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Quarantine specific file types/extensions to email address Hi Guys, I've been asked to configure mailscanner so that it quarantines and forwards specific file types to the internal Network Administration help desk. I've checked the faq and maq and cant find anything useful there. The idea is to forward all jpgs, movies, zips etc to the administrator so they can view them and verify their validity for work. Cheers, Steve ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Dec 15 15:12:55 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:56 2006 Subject: Block mail by subject content with MCP Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You should Google around for "regular expressions". -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn Sent: Wednesday, December 15, 2004 9:58 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Block mail by subject content with MCP > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of José Angel Blanco > González > Sent: den 15 december 2004 15:51 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Block mail by subject content with MCP > > > I am trying to block mails based on subject with MCP I modified a > 10_example.cf > (snip) > header SAMPLE_RULE5 Subject =~ /Delivery Status > Notification (Failure)/i > describe SAMPLE_RULE5 Banned Subject > score SAMPLE_RULE5 11 (snip) > but is not working, here is a extract of header from a message: > > Message-ID: > Subject: Delivery Status Notification (Failure) > X-Treelogic-MailScanner: Found to be clean, Found to be clean > X-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (puntaje=0, requerido > 1) > X-Treelogic-MailScanner-SpamCheck: no es spam, SpamAssassin (punta... > Problem is with the RE above. In perl the "unescaped ()" are special so you need escape them like: header SAMPLE_RULE5 Subject =~ /Delivery Status Notification \(Failure\)/i ... else it'll look for "Delivery Status Notification Failure" and, if found, will assign "Failure" to $1 ... Probably not what you want:-) -- Glenn ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 15 15:26:48 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:56 2006 Subject: Block mail by subject content with MCP Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You think? IMHO I'm pretty proficient with both REs and PCREs:-). BTW, if one should google for it one should probably look for "perl compatible regular expressions"... ;) -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alex Neuman > van der Hans > Sent: den 15 december 2004 16:13 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Block mail by subject content with MCP > > > You should Google around for "regular expressions". > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 15, 2004 9:58 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Block mail by subject content with MCP > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of José Angel Blanco > > González > > Sent: den 15 december 2004 15:51 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Block mail by subject content with MCP > > > > > > I am trying to block mails based on subject with MCP I modified a > > 10_example.cf > > > (snip) > > header SAMPLE_RULE5 Subject =~ /Delivery Status > > Notification (Failure)/i > > describe SAMPLE_RULE5 Banned Subject > > score SAMPLE_RULE5 11 > (snip) > > but is not working, here is a extract of header from a message: > > > > Message-ID: > > Subject: Delivery Status Notification (Failure) > > X-Treelogic-MailScanner: Found to be clean, Found to be clean > > X-MailScanner-MCPCheck: MCP-Clean, MCP-Checker (puntaje=0, > requerido > > 1) > > X-Treelogic-MailScanner-SpamCheck: no es spam, SpamAssassin > (punta... > > > Problem is with the RE above. In perl the "unescaped ()" are > special so you > need escape them like: > header SAMPLE_RULE5 Subject =~ /Delivery Status Notification > \(Failure\)/i > ... else it'll look for "Delivery Status Notification Failure" and, if > found, will assign "Failure" to $1 ... Probably not what you want:-) > > -- Glenn > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From public at RUCH-T.DE Wed Dec 15 15:31:00 2004 From: public at RUCH-T.DE (Sebastian G. Ruchti) Date: Thu Jan 12 21:27:56 2006 Subject: Spamassassin Timeouts Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi there, since yesterday (14th) at about two a.m. messages received on my debian box with mailscanner 4.35.11 that had been running stable for quite some time now are no longer beeing handled by Spamassassin (3.001) as Spamassassin always times out (no matter how high I set the timeout setting in Mailscanner.conf). Has anyone experience sth. similar? Has some URL for SURBL or configuration changed? I'd appreciate any hint. Thanks in advance. .sebastian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 15 15:50:41 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:56 2006 Subject: Spamassassin Timeouts Message-ID: Not that I'm aware of, at least... Could it be that you (or your provider, if you use their forwaders) have a lookup problem? Can you do the bl lookup manually on the box? -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Sebastian G. Ruchti > Sent: den 15 december 2004 16:31 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Spamassassin Timeouts > > > Hi there, > > since yesterday (14th) at about two a.m. messages received on > my debian box > with mailscanner 4.35.11 that had been running stable for > quite some time > now are no longer beeing handled by Spamassassin (3.001) as > Spamassassin > always times out (no matter how high I set the timeout setting in > Mailscanner.conf). > > Has anyone experience sth. similar? Has some URL for SURBL or > configuration > changed? > > I'd appreciate any hint. > > Thanks in advance. > .sebastian > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 15 15:53:32 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: MailScanner ANNOUNCE 4.37.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Correct. It's a copy. Steen, Glenn wrote: >Hm, looking at the latest (4.37.3) ... Nice Julian. >I might have spoken to soon about the preservation of inodes (below) >though... It's a copy into the quarantine, regardless, right? > >-- Glenn (not really friendly with the code yet, but getting there:-) > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn >>Sent: den 15 december 2004 11:07 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: MailScanner ANNOUNCE 4.37.2 >> >> >> >> >>>-----Original Message----- >>>From: John Wilcock [mailto:john@tradoc.fr] >>>Sent: den 14 december 2004 16:22 >>>To: Steen, Glenn >>>Subject: Re: MailScanner ANNOUNCE 4.37.2 >>> >>> >>>Steen, Glenn wrote: >>> >>> >>>>Well John, that wouldn't really matter for MW, since >>>> >>>> >>you'd never set >> >> >>>>it to store the queue files... >>>> >>>> >>>Yes, I realise that. I was just pointing out a potential >>> >>> >>bug that may >> >> >>>affect non-MW users. >>> >>> >>True John, and I in turn just point to it just being a problem in the >>spam quarantine, for two reasons: 1) The directory of the virus >>quarantine >>keep the "id.5-randoms" bit, and 2) Since you keep the queue file (and >>thus >>the inode, unless one has done something foolish (like have >>the postfix >>spool >>and the quarantine on separate filesystems)) you run no risk >>of reusing >>that >>particular id. >>I realize I could have been more clear on this:-) >> >>So... the problem is either a cosmetic one in the quarantines, or a >>"will never >>be setup that way" for MW. >> >>I see Julian has released a new beta, so I'll be looking at that ASAP. >> >>-- Glenn >> >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Wed Dec 15 15:55:07 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:56 2006 Subject: Spamassassin Timeouts Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Sebastian G. Ruchti > Sent: Wednesday, December 15, 2004 10:31 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Spamassassin Timeouts > > Hi there, > > since yesterday (14th) at about two a.m. messages received on my debian > box > with mailscanner 4.35.11 that had been running stable for quite some time > now are no longer beeing handled by Spamassassin (3.001) as Spamassassin > always times out (no matter how high I set the timeout setting in > Mailscanner.conf). > > Has anyone experience sth. similar? Has some URL for SURBL or > configuration > changed? > > I'd appreciate any hint. > > Thanks in advance. > .sebastian This is almost always a network connectivity, DNS or other type of network problem. Try running: spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint \ 2>&1 | more And check for errors or connection problems. Note that your path to spam.assassin.prefs.conf might be different in your not running a Linux distribution. Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Dec 15 16:31:58 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:56 2006 Subject: MS Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 David Jacobson wrote: | Hi, | | I noticed a while ago on the list someone said the MS book had incorrect | indexes etc, I want to buy the book, to support Julian of course and was | just wondering if the inconsistencies had been addressed? | | Many thanks.. | The book is printed "on demand". So as soon as Julian posts an updated version, that is the version that you get when you order. As fast as he is on bugs and fixes to MailScanner, I am sure he jumped on the book fix just as fast. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBwGb+RADw9lziUqQRAu5TAJ4n5LH48TJ/tgHX+yP/ND4jF2DHDwCfXOqb dBVsU5X7PJcUJFRzS/mQz/Y= =+rmT -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Dec 15 16:44:57 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:56 2006 Subject: Spamassassin Timeouts Message-ID: In my experience, under MailScanner, it's almost never a network test, as SA times those out fast enough to not be timed out by MailScanner. Generaly speaking, its a bayes opportunistic expiry. Check for bayes "expire" files floating about near your bayes DB. Short-term cleanup of the problem can be done by running sa-learn --force-expire, and using the command line options to point it at your bayes DB if it's not in the current user's home directory. Longer term solutions involve disabling bayes_auto_expire in local.cf (not spam.assassin.prefs.conf, local.cf), enabling MailScanners "Rebuild Bayes Every=" option, and a cron-job to run the sa-learn --force-expire once a day as a safety. At 10:50 AM 12/15/2004, Steen, Glenn wrote: >Not that I'm aware of, at least... Could it be that you (or your >provider, >if you use their forwaders) have a lookup problem? Can you do the bl >lookup >manually on the box? > >-- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Sebastian G. Ruchti > > Sent: den 15 december 2004 16:31 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Spamassassin Timeouts > > > > > > Hi there, > > > > since yesterday (14th) at about two a.m. messages received on > > my debian box > > with mailscanner 4.35.11 that had been running stable for > > quite some time > > now are no longer beeing handled by Spamassassin (3.001) as > > Spamassassin > > always times out (no matter how high I set the timeout setting in > > Mailscanner.conf). > > > > Has anyone experience sth. similar? Has some URL for SURBL or > > configuration > > changed? > > > > I'd appreciate any hint. > > > > Thanks in advance. > > .sebastian > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Dec 15 16:41:04 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:56 2006 Subject: Rant part deux Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mike Kercher wrote: | Howard Robinson wrote: | |>May be it was dropped on him/her without adequate training and as |>part of an over long job list which is added too faster than jobs get |>completed - meaning that some jobs 'less important' to the company, |>get left? I know that's how I got it here with more jobs than I can |>cope with outstanding. |>Not everyone has dedicated email admin staff. |>Off to make the tea and sweet the floor now and, whilst the kettles |>boiling, set up an MS server. Okay I am jesting but some days it |>feels like that! |>Day off tomorrow - Helping Santa - Really |> |>In same boat as below and sinking! |> |> |>>Who says we think that. I know I'm not qualified but I'm all there |>>be. I am what I am. |>> |>>Michele Neylon :: Blacknight Solutions wrote: |>> |> |>Snipped rest |> |> |> |>Regards |> |>Howard Robinson |>(Senior Technical Development Officer) |>Harper Adams University College |>Edgmond |>Newport |>Shropshire |>TF10 8NB UK |> | | | What's a kettle? :) Thats the only thing that can whistle at you without a smack from the spouse. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBwGkgRADw9lziUqQRAl3hAJwMrdxvGnpJLoUMWT0dZQCmIUOIkgCeJDfq 3A2Xk92cFd/qXS1WR5Ryfoo= =tEFG -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From public at RUCH-T.DE Wed Dec 15 17:21:30 2004 From: public at RUCH-T.DE (sebastian g. ruchti) Date: Thu Jan 12 21:27:56 2006 Subject: Spamassassin Timeouts Message-ID: Seems like Matt got the right clue..... Thanks for all your help! .sebastian > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Matt Kettler > Sent: Wednesday, December 15, 2004 5:45 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Spamassassin Timeouts > > > In my experience, under MailScanner, it's almost never a network test, as > SA times those out fast enough to not be timed out by MailScanner. > > Generaly speaking, its a bayes opportunistic expiry. Check for bayes > "expire" files floating about near your bayes DB. > > Short-term cleanup of the problem can be done by running sa-learn > --force-expire, and using the command line options to point it at your > bayes DB if it's not in the current user's home directory. > > Longer term solutions involve disabling bayes_auto_expire in local.cf (not > spam.assassin.prefs.conf, local.cf), enabling MailScanners "Rebuild Bayes > Every=" option, and a cron-job to run the sa-learn --force-expire once a > day as a safety. > > > At 10:50 AM 12/15/2004, Steen, Glenn wrote: > >Not that I'm aware of, at least... Could it be that you (or your > >provider, > >if you use their forwaders) have a lookup problem? Can you do the bl > >lookup > >manually on the box? > > > >-- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Sebastian G. Ruchti > > > Sent: den 15 december 2004 16:31 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Spamassassin Timeouts > > > > > > > > > Hi there, > > > > > > since yesterday (14th) at about two a.m. messages received on > > > my debian box > > > with mailscanner 4.35.11 that had been running stable for > > > quite some time > > > now are no longer beeing handled by Spamassassin (3.001) as > > > Spamassassin > > > always times out (no matter how high I set the timeout setting in > > > Mailscanner.conf). > > > > > > Has anyone experience sth. similar? Has some URL for SURBL or > > > configuration > > > changed? > > > > > > I'd appreciate any hint. > > > > > > Thanks in advance. > > > .sebastian > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From roger at RUDNICK.COM.BR Wed Dec 15 17:25:43 2004 From: roger at RUDNICK.COM.BR (Roger Jochem) Date: Thu Jan 12 21:27:56 2006 Subject: A new kind of spam Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm receiving hundreds of this new kind of spam (message below)... There is a part of the message there, then another part comes from the web, then the message continues... The written part of the message is always different, but then comes the fix part, always from this site sakkama.info. Today spam, spamhaus-XBL, SBL+XBL, CBL, are all saying this is Spam. But my concern is when another sites start using the same kind of stuff... Any way of stopping this localy in MailScanner? ----- Original Message ----- From: Clausewitz Q. Xylophone To: Fernando Sent: Wednesday, December 15, 2004 3:11 PM Subject: {Spam?} HS ** 0 ** Buenos tardes! Hi there! Appleseed Drambuie [O61HEg.gif] Diplallu Being too good is apt to be uninteresting. Love is like quicksilver in the hand. Leave the fingers open and it stays. Clutch is, and it darts away. Old age, especially an honored old age, has so great authority, that this is of more value than all the pleasures of youth.For parlor use, the vague generality is a life saver. Do not judge, and you will never be mistaken. Everything in the world exists to end up in a book. Grief, and an estate, is joy understood, Faith is much better than belief. Belief is when someone else does the thinking. True leadership must be for the benefit of the followers, not the enrichment of the leaders. All great novels, all true novels, are bisexual. When it comes to life the critical thing is whether you take things for granted or take them with gratitude.We may not be able to offer long-term employment, but we should try to offer long-term employability. A work of art that contains theories is like an object on which the price tag has been left. Goals allow you to control the direction of change in your favor. The motto of chivalry is also the motto of wisdom to serve all, but love only one. I never failed to convince an audience that the best thing they could do was to go away. Limitations live only in our minds. But if we use our imaginations, our possibilities become limitless. They talk about their Pilgrim blood, their birthright high and holy! a mountain-stream that ends in mud thinks is melancholy.intimidation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Wed Dec 15 17:50:48 2004 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:27:56 2006 Subject: SA autowhitelisting revisited Message-ID: Was checking up on the bayes stuff on one of my mailscanners and noticed the auto-whitelist was quite large. Did a search in the archives and found Steve Swaney's post that said: ============================================================================ = "The defaults appear to have changed. I noticed the same thing until I added: #################### # The --auto-whitelist and -a options for "spamd" and "spamassassin" to # turn on the auto-whitelist have been removed and replaced by the # "use_auto_whitelist" configuration option which is also now turned on by # default use_auto_whitelist 0 #################### To my spam.assassin.prefs.conf" ============================================================================ = (Thanks Steve!) I added the change but I'm wondering now though if I should blow away the auto-whitelist file? Can I just delete it? Should I 'touch' a new file afterwards or will SA automatically recreate it (but not populate it) if it needs one? Also noticed a couple of odd files: bayes.mutex and auto-whitelist.mutex. What are those? Never noticed them before. Thanks... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 15 18:22:16 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: MS Book Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > David Jacobson wrote: > | Hi, > | > | I noticed a while ago on the list someone said the MS book had > incorrect > | indexes etc, I want to buy the book, to support Julian of course and > was > | just wondering if the inconsistencies had been addressed? > | > | Many thanks.. > | > The book is printed "on demand". So as soon as Julian posts an updated > version, that is the version that you get when you order. > > As fast as he is on bugs and fixes to MailScanner, I am sure he jumped > on the book fix just as fast. I fixed the index within about an hour of someone first finding it was wrong. Only about 20 copies ever went out with the incorrect index. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Wed Dec 15 18:33:50 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:56 2006 Subject: Rant part deux Message-ID: Scott Silva wrote: >>> >> >> >> What's a kettle? :) > Thats the only thing that can whistle at you without a smack from the > spouse. > hahaha...touche'! Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Dec 15 18:29:10 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:56 2006 Subject: A new kind of spam Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Roger Jochem wrote: > I'm receiving hundreds of this new kind of spam (message below)... There > is a part of the message there, then another part comes from the web, > then the message continues... The written part of the message is always > different, but then comes the fix part, always from this site sakkama.info. > > Today spam, spamhaus-XBL, SBL+XBL, CBL, are all saying this is Spam. But > my concern is when another sites start using the same kind of stuff... > Any way of stopping this localy in MailScanner? SURBL should get rid of it. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Dec 15 18:42:42 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:56 2006 Subject: Would it be a good idea to learn viruses as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Wilcock wrote: > It struck me that most of the Bagle variants we receive here get highish > Bayes scores (90+) whereas most of the Sober.Js still get lowish Bayes > (20 or 30 at most). As new variants of viruses often retain at least > some of the message text from previous variants, it seems to me that it > might be a good idea to teach them to Bayes in the hopes of adding yet > another line of defense to MailScanner's many talents. > > What does the combined wisdom of the list reckon on this one? Would it > be a good idea for Julian to implement an option to automatically feed > confirmed viruses to sa-learn --spam? They usually get caught by the digest checks (pyzor, razor, dcc), so it might not be useful if you use those. > > > John. > > -- > -- Over 2500 webcams from ski resorts around the world - www.snoweye.com > -- Translate your technical documents and web pages - www.tradoc.fr > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Dec 15 19:04:33 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:27:56 2006 Subject: 710 messages waiting Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Hickel wrote: >All, > >I notice in my maillog viewer that I have 710 messages waiting but then >it only processes a few messages. Not sure how to kick those 710 >messages loose. Any thoughts? (they got then when I took my exchange box >off-line for a few minutes). > > > Steve, If you are using sendmail, try: sendmail -qRsearch_string (and put a part of the destination addresses where search_string is). Denis PS: they should be automatically be processed at some point but the command above will process them immediately. -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From mikes at HARTWELLCORP.COM Wed Dec 15 19:18:55 2004 From: mikes at HARTWELLCORP.COM (Michael St. Laurent) Date: Thu Jan 12 21:27:56 2006 Subject: Help installing SpamCopURI Message-ID: Hello, When I try to install SpamCopURI the "perl Makefile.PL" step complains as follows: Warning: prerequisite URI 1.28 not found. We have 1.21. Could someone advise me? I'm assuming this means that I need to upgrade one of the Perl modules, yes? -- Michael St. Laurent Hartwell Corporation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Dec 15 19:20:15 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:27:56 2006 Subject: Help installing SpamCopURI Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michael St. Laurent wrote: >Hello, > >When I try to install SpamCopURI the "perl Makefile.PL" step complains as >follows: > >Warning: prerequisite URI 1.28 not found. We have 1.21. > >Could someone advise me? I'm assuming this means that I need to upgrade one >of the Perl modules, yes? > > > Michael, SpamCopURI is only needed with SA 2.x. If you are using SA 3 it is not needed because it is built in. The message says that you need to upgrade URI. Try perl -MCPAN -e shell and then install URI. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From mikes at HARTWELLCORP.COM Wed Dec 15 19:37:21 2004 From: mikes at HARTWELLCORP.COM (Michael St. Laurent) Date: Thu Jan 12 21:27:56 2006 Subject: Help installing SpamCopURI Message-ID: Denis Beauchemin <> wrote: >> When I try to install SpamCopURI the "perl Makefile.PL" step >> complains as follows: >> >> Warning: prerequisite URI 1.28 not found. We have 1.21. >> >> Could someone advise me? I'm assuming this means that I need to >> upgrade one of the Perl modules, yes? > > SpamCopURI is only needed with SA 2.x. If you are using SA 3 it is > not needed because it is built in. > > The message says that you need to upgrade URI. Try perl -MCPAN -e > shell and then install URI. Ah, yes. That did the trick. Thanks! ;-D -- Michael St. Laurent Hartwell Corporation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Dec 15 19:44:04 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:56 2006 Subject: SA autowhitelisting revisited Message-ID: At 12:50 PM 12/15/2004, Kevin Miller wrote: >(Thanks Steve!) I added the change but I'm wondering now though if I should >blow away the auto-whitelist file? Can I just delete it? Should I 'touch' >a new file afterwards or will SA automatically recreate it (but not populate >it) if it needs one? SA will recreate it if you obliterate the file. Be sure to obliterate the mutex and/or lock file with it (see below) >Also noticed a couple of odd files: bayes.mutex and auto-whitelist.mutex. >What are those? Never noticed them before. Those are files that are used synchronization locks. They make sure that only one copy of SA is writing to the file at a time, because if two did so it would corrupt the file. (The term mutex is programmer shorthand for "MUTual EXclusion".) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Wed Dec 15 19:46:20 2004 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:27:56 2006 Subject: MS Book Message-ID: Wow..you have a copy that was sent out at no longer than the 20th copy. -----Original Message----- From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] Sent: Wednesday, December 15, 2004 1:22 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: MS Book Scott Silva wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > David Jacobson wrote: > | Hi, > | > | I noticed a while ago on the list someone said the MS book had > incorrect > | indexes etc, I want to buy the book, to support Julian of course and > was > | just wondering if the inconsistencies had been addressed? > | > | Many thanks.. > | > The book is printed "on demand". So as soon as Julian posts an updated > version, that is the version that you get when you order. > > As fast as he is on bugs and fixes to MailScanner, I am sure he jumped > on the book fix just as fast. I fixed the index within about an hour of someone first finding it was wrong. Only about 20 copies ever went out with the incorrect index. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Wed Dec 15 19:51:17 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:56 2006 Subject: 710 messages waiting Message-ID: Denis, My bad. I did the original message from memory. Here is the actual message. I don't believe it is a sendmail issue, but could be wrong. I think I have 710 messages stuck in the in queue. Mailscanner appears not to be processing them. Sorry for the confusion. Steve New Batch: Scanning 1 messages, 4455 bytes Dec1514:33:51 -MailScanner New Batch: Found 710 messages waiting On Wed, 2004-12-15 at 14:04, Denis Beauchemin wrote: > Steve Hickel wrote: > > >All, > > > >I notice in my maillog viewer that I have 710 messages waiting but then > >it only processes a few messages. Not sure how to kick those 710 > >messages loose. Any thoughts? (they got then when I took my exchange box > >off-line for a few minutes). > > > > > > > > Steve, > > If you are using sendmail, try: sendmail -qRsearch_string (and put a > part of the destination addresses where search_string is). > > Denis > PS: they should be automatically be processed at some point but the > command above will process them immediately. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 15 20:02:01 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: 710 messages waiting Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Check they all have their df file as well as their qf file. If they have no df file, you can just delete them. Steve Hickel wrote: >Denis, > >My bad. I did the original message from memory. Here is the actual >message. I don't believe it is a sendmail issue, but could be wrong. I >think I have 710 messages stuck in the in queue. Mailscanner appears not >to be processing them. Sorry for the confusion. > >Steve > >New Batch: Scanning 1 messages, 4455 bytes Dec1514:33:51 -MailScanner > >New Batch: Found 710 messages waiting > > > > >On Wed, 2004-12-15 at 14:04, Denis Beauchemin wrote: > > >>Steve Hickel wrote: >> >> >> >>>All, >>> >>>I notice in my maillog viewer that I have 710 messages waiting but then >>>it only processes a few messages. Not sure how to kick those 710 >>>messages loose. Any thoughts? (they got then when I took my exchange box >>>off-line for a few minutes). >>> >>> >>> >>> >>> >>Steve, >> >>If you are using sendmail, try: sendmail -qRsearch_string (and put a >>part of the destination addresses where search_string is). >> >>Denis >>PS: they should be automatically be processed at some point but the >>command above will process them immediately. >> >> > > >-- >This message has been scanned for viruses and >dangerous content by MailScanner, and is >believed to be clean. >MailScanner thanks transtec Computers for their support. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Dec 15 19:54:42 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:56 2006 Subject: 710 messages waiting Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Steve Hickel wrote: | Denis, | | My bad. I did the original message from memory. Here is the actual | message. I don't believe it is a sendmail issue, but could be wrong. I | think I have 710 messages stuck in the in queue. Mailscanner appears not | to be processing them. Sorry for the confusion. | | Steve | | New Batch: Scanning 1 messages, 4455 bytes Dec1514:33:51 -MailScanner | | New Batch: Found 710 messages waiting Look and see if you have a bunch of qf files without matching df files. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBwJaBRADw9lziUqQRAqIfAJ0YR3+Nyj8bbcy9cnf9YfpcFBI5GACdHbaQ +edQuYty7/abfHN2QyMePzk= =g86Y -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Wed Dec 15 20:08:33 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:56 2006 Subject: 710 messages waiting Message-ID: Thanks. Will check. Steve On Wed, 2004-12-15 at 15:02, Julian Field wrote: > Check they all have their df file as well as their qf file. If they have > no df file, you can just delete them. > > Steve Hickel wrote: > > >Denis, > > > >My bad. I did the original message from memory. Here is the actual > >message. I don't believe it is a sendmail issue, but could be wrong. I > >think I have 710 messages stuck in the in queue. Mailscanner appears not > >to be processing them. Sorry for the confusion. > > > >Steve > > > >New Batch: Scanning 1 messages, 4455 bytes Dec1514:33:51 -MailScanner > > > >New Batch: Found 710 messages waiting > > > > > > > > > >On Wed, 2004-12-15 at 14:04, Denis Beauchemin wrote: > > > > > >>Steve Hickel wrote: > >> > >> > >> > >>>All, > >>> > >>>I notice in my maillog viewer that I have 710 messages waiting but then > >>>it only processes a few messages. Not sure how to kick those 710 > >>>messages loose. Any thoughts? (they got then when I took my exchange box > >>>off-line for a few minutes). > >>> > >>> > >>> > >>> > >>> > >>Steve, > >> > >>If you are using sendmail, try: sendmail -qRsearch_string (and put a > >>part of the destination addresses where search_string is). > >> > >>Denis > >>PS: they should be automatically be processed at some point but the > >>command above will process them immediately. > >> > >> > > > > > >-- > >This message has been scanned for viruses and > >dangerous content by MailScanner, and is > >believed to be clean. > >MailScanner thanks transtec Computers for their support. > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Dec 15 20:28:50 2004 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:27:56 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Julian, > - Postfix problems with keeping spam quarantine clean are fixed. I have to get back to this point. If I understand the new option correctly the following should happen: If a message is considered spam it is nonetheless scanned for viruses/bad filenames etc. If this message has a virus or a bad filename in it, it is not send to the quarantine but simply deleted. Correct? If so, could you please make this configurable so that we can choose whether or not the mail is deleted or simply flagged as a virus? I can already see my customers receiving a badly worded mail with an .exe in it that is considered to be spam and then deleted. Personally I would prefer a setting that is behaving exactly as the good old spam actions deliver to /dev/null is... Works perfectly with MailWatch. I can see situations in which you will simply want to delete the entire mail but in my environments this is a no go. I could not delete a mail I already accepted just because SpamAssassin gives it a 6.01 (with 6 being low scoring spam) and having a perfectly valid .exe in it that the administrator might choose to release. Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 15 20:35:03 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: >Hi Julian, > > > >>- Postfix problems with keeping spam quarantine clean are fixed. >> >> >I have to get back to this point. If I understand the new option correctly the following should happen: > >If a message is considered spam it is nonetheless scanned for viruses/bad filenames etc. If this message has a virus or a bad filename in it, it is not send to the quarantine but simply deleted. Correct? > > It is still put into the "nasties" quarantine (if Quarantine Infections = yes), but it is not put into the spam quarantine. >If so, could you please make this configurable so that we can choose whether or not the mail is deleted or simply flagged as a virus? I can already see my customers receiving a badly worded mail with an .exe in it that is considered to be spam and then deleted. Personally I would prefer a setting that is behaving exactly as the good old > >spam actions deliver to /dev/null > >is... Works perfectly with MailWatch. I can see situations in which you will simply want to delete the entire mail but in my environments this is a no go. I could not delete a mail I already accepted just because SpamAssassin gives it a 6.01 (with 6 being low scoring spam) and having a perfectly valid .exe in it that the administrator might choose to release. > > And yes, it is configurable anyway. The name of the config option was in my announcement. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at DFI-INTL.COM Wed Dec 15 20:34:11 2004 From: eneal at DFI-INTL.COM (Errol Neal) Date: Thu Jan 12 21:27:56 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: Hi everyone. Been a long time since I posted to this list since I switched jobs. Happy holidays and hope everyone is doing well. I've been looking into implementing a hierarchy of service levels for mail delivery using the queuing capabilities of Sendmail and the multiple outbound queue groups found in the custom functions of MailScanner. What I'd like to do on the inbound side is to drop mail in one of several queues based upon the recipient domain and other stuff. This capability is already available to me through the use of the extended queue groups. So, to realize my ambitions, I'd like MailScanner to do the following: 1. Pick up mail dropped in multiple queues/* Since the dx and qx files will be split into separate directories, I need to know if MailScanner can handle this. The directory structure will be something like this /var/spool/mqueue /highpriority /dx /qx /lowpriority /dx /qx 2. Drop processed mail into multiple outgoing queues. I'm already using the feature &MultipleQueueDir to drop spam into a slow queue, however I want to prioritize outbound mail on the basis of it's final destination as well. Now I've tried using the following in CustomConfig.pm: return '/var/spool/mqueue.outbound.fast' if $messages->{fromdomain}, veryimportantclient.com; However, that did not work (If you are laughing at me, please do not.. I have very little programming ability). Now, when I say "it did not work", I did not get an error and the queue was actually used, however the messages that went into the queue were not those that I wanted to. Is what I want to do possible? Secondly, does how does MailScanner determine which message to process first in a batch of say 100 messages? Is it FIFO based upon the time stamp on the file, or does it honor the message priority assigned to the queue file by sendmail? Thanks in advance. Errol Neal __________________________________________ Errol Uriel Neal Jr. Network Administrator DFI International, Inc. 1717 Pennsylvania Ave NW, Suite 1300 Washington, DC 20006 Tel (202)452-6955 Fax (202)452-6910 Eneal at dfi-intl.com www.dfi-intl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Dec 15 20:45:19 2004 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:27:56 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wednesday, December 15, 2004 9:35 PM MailScanner mailing list wrote: > It is still put into the "nasties" quarantine (if Quarantine > Infections = yes), but it is not put into the spam quarantine. I see... Sorry. Missed this. Makes a lot of sense. > And yes, it is configurable anyway. The name of the config > option was in my announcement. Wounderful. However I re-read your announcement and I cannot find the correct option. Can you resend this to me so I can adjust the man pages accordingly? Thanks, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From james_gray at ocs.com Wed Dec 15 20:50:09 2004 From: james_gray at ocs.com (James Gray) Date: Thu Jan 12 21:27:56 2006 Subject: Block mail by subject content Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wed, 15 Dec 2004 10:30 pm, José Angel Blanco González wrote: > Is it possible to block mails based on subject content. For example I want > to block or mark as Spam all mails with certain subjects. > How can I do this > > Thank you SpamAssassin or MCP rule: header SUITABLE_RULE_NAME Subject =~ /This is a Perl Regex/i describe SUITABLE_RULE_NAME This trailing 'i' makes it case insenstive score SUITABLE_RULE_NAME 100.00 That shoud score anything that matches "This is a Perl Regex" in the subject and score it as 100 - well and truely spam. (Hint: these questions have been answered many times in the archives. Do a search on creating custom SpamAssassin rules) Cheers, James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at DFI-INTL.COM Wed Dec 15 20:53:46 2004 From: eneal at DFI-INTL.COM (Errol Neal) Date: Thu Jan 12 21:27:56 2006 Subject: 710 messages waiting Message-ID: Don't know if this has been mentioned, but check the load on the system. If you have sendmail configured to only queue mail when the la reaches a certain number (but continue to accept messages for processing), then that could lead to this problem where you may have a queue that is backed up. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steve Hickel Sent: Wednesday, December 15, 2004 3:09 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: 710 messages waiting Thanks. Will check. Steve On Wed, 2004-12-15 at 15:02, Julian Field wrote: > Check they all have their df file as well as their qf file. If they > have no df file, you can just delete them. > > Steve Hickel wrote: > > >Denis, > > > >My bad. I did the original message from memory. Here is the actual > >message. I don't believe it is a sendmail issue, but could be wrong. > >I think I have 710 messages stuck in the in queue. Mailscanner > >appears not to be processing them. Sorry for the confusion. > > > >Steve > > > >New Batch: Scanning 1 messages, 4455 bytes Dec1514:33:51 > >-MailScanner > > > >New Batch: Found 710 messages waiting > > > > > > > > > >On Wed, 2004-12-15 at 14:04, Denis Beauchemin wrote: > > > > > >>Steve Hickel wrote: > >> > >> > >> > >>>All, > >>> > >>>I notice in my maillog viewer that I have 710 messages waiting but > >>>then it only processes a few messages. Not sure how to kick those > >>>710 messages loose. Any thoughts? (they got then when I took my > >>>exchange box off-line for a few minutes). > >>> > >>> > >>> > >>> > >>> > >>Steve, > >> > >>If you are using sendmail, try: sendmail -qRsearch_string (and put a > >>part of the destination addresses where search_string is). > >> > >>Denis > >>PS: they should be automatically be processed at some point but the > >>command above will process them immediately. > >> > >> > > > > > >-- > >This message has been scanned for viruses and dangerous content by > >MailScanner, and is believed to be clean. > >MailScanner thanks transtec Computers for their support. > > > >------------------------ MailScanner list ------------------------ To > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store Professional > Support Services at www.MailScanner.biz MailScanner thanks transtec > Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 15 21:06:07 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is probably one for me :-) You need to call your dx and qx directories df and qf, but otherwise the latest version will do this. If you tell it the incoming queue dirs are /var/spool/mqueue/* then it should do the rest of the incoming side automatically for you. On the outbound side, you need to say return '/var/spool/mqueue.outbound.fast' if $messages->{fromdomain} =~ /veryimportantclient\.com/i; In a reasonable size queue, it will work on the messages in strict date order. If the queue starts to get very large, it will temporarily abandon this sorting as it gets very expensive in most filesystems when directories get large. Instead it will start on the first ones it reads in the directory, as this is a lot faster. Once the queue has got small enough, it stays in this mode for a while longer to get the queue clear if at all possible, then it will revert to normal date-order processing. Inevitably, this is all configurable. Hopefully that answers most of your questions :) Errol Neal wrote: >Hi everyone. Been a long time since I posted to this list since I >switched jobs. Happy holidays and hope everyone is doing well. > >I've been looking into implementing a hierarchy of service levels for >mail delivery using the queuing capabilities of Sendmail and the >multiple outbound queue groups found in the custom functions of >MailScanner. What I'd like to do on the inbound side is to drop mail in >one of several queues based upon the recipient domain and other stuff. >This capability is already available to me through the use of the >extended queue groups. So, to realize my ambitions, I'd like >MailScanner to do the following: > >1. Pick up mail dropped in multiple queues/* > >Since the dx and qx files will be split into separate directories, I >need to know if MailScanner can handle this. The directory structure >will be something like this > > /var/spool/mqueue > /highpriority > >/dx > >/qx > /lowpriority > >/dx > >/qx > >2. Drop processed mail into multiple outgoing queues. > >I'm already using the feature &MultipleQueueDir to drop spam into a slow >queue, however I want to prioritize outbound mail on the basis of it's >final destination as well. Now I've tried using the following in >CustomConfig.pm: > > return '/var/spool/mqueue.outbound.fast' >if $messages->{fromdomain}, veryimportantclient.com; > >However, that did not work (If you are laughing at me, please do not.. I >have very little programming ability). Now, when I say "it did not >work", I did not get an error and the queue was actually used, however >the messages that went into the queue were not those that I wanted to. > >Is what I want to do possible? Secondly, does how does MailScanner >determine which message to process first in a batch of say 100 messages? >Is it FIFO based upon the time stamp on the file, or does it honor the >message priority assigned to the queue file by sendmail? > >Thanks in advance. > >Errol Neal > >__________________________________________ >Errol Uriel Neal Jr. >Network Administrator >DFI International, Inc. >1717 Pennsylvania Ave NW, Suite 1300 >Washington, DC 20006 >Tel (202)452-6955 >Fax (202)452-6910 >Eneal at dfi-intl.com >www.dfi-intl.com > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 15 21:11:09 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: >On Wednesday, December 15, 2004 9:35 PM MailScanner mailing list wrote: > > > >>It is still put into the "nasties" quarantine (if Quarantine >>Infections = yes), but it is not put into the spam quarantine. >> >> > >I see... Sorry. Missed this. Makes a lot of sense. > > > >>And yes, it is configurable anyway. The name of the config >>option was in my announcement. >> >> > >Wounderful. However I re-read your announcement and I cannot find the correct option. Can you resend this to me so I can adjust the man pages accordingly? > Good point. Many thanks for maintaining the man pages, particularly when I forget to tell you about new stuff :) # Do you want to stop any virus-infected spam getting into the spam or MCP # archives? If you have a system where users can release messages from the # spam or MCP archives, then you probably want to stop them being able to # release any infected messages, so set this to yes. # It is set to no by default as it causes a small hit in performance, and # many people don't allow users to access the spam quarantine, so don't # need it. # This can also be the filename of a ruleset. Keep Spam And MCP Archive Clean = no -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at DFI-INTL.COM Wed Dec 15 21:12:08 2004 From: eneal at DFI-INTL.COM (Errol Neal) Date: Thu Jan 12 21:27:56 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: Thanks Julian. You are always very helpful. Last question. Is it possible to set Incoming Queue Dir to /var/spool/mqueue.in.ciient1/* and /var/spool/mqueue.in.client2/* -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Wednesday, December 15, 2004 4:06 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Classes of service using advanced queuing techniques. This is probably one for me :-) You need to call your dx and qx directories df and qf, but otherwise the latest version will do this. If you tell it the incoming queue dirs are /var/spool/mqueue/* then it should do the rest of the incoming side automatically for you. On the outbound side, you need to say return '/var/spool/mqueue.outbound.fast' if $messages->{fromdomain} =~ /veryimportantclient\.com/i; In a reasonable size queue, it will work on the messages in strict date order. If the queue starts to get very large, it will temporarily abandon this sorting as it gets very expensive in most filesystems when directories get large. Instead it will start on the first ones it reads in the directory, as this is a lot faster. Once the queue has got small enough, it stays in this mode for a while longer to get the queue clear if at all possible, then it will revert to normal date-order processing. Inevitably, this is all configurable. Hopefully that answers most of your questions :) Errol Neal wrote: >Hi everyone. Been a long time since I posted to this list since I >switched jobs. Happy holidays and hope everyone is doing well. > >I've been looking into implementing a hierarchy of service levels for >mail delivery using the queuing capabilities of Sendmail and the >multiple outbound queue groups found in the custom functions of >MailScanner. What I'd like to do on the inbound side is to drop mail in >one of several queues based upon the recipient domain and other stuff. >This capability is already available to me through the use of the >extended queue groups. So, to realize my ambitions, I'd like >MailScanner to do the following: > >1. Pick up mail dropped in multiple queues/* > >Since the dx and qx files will be split into separate directories, I >need to know if MailScanner can handle this. The directory structure >will be something like this > > /var/spool/mqueue > /highpriority > >/dx > >/qx > /lowpriority > >/dx > >/qx > >2. Drop processed mail into multiple outgoing queues. > >I'm already using the feature &MultipleQueueDir to drop spam into a >slow queue, however I want to prioritize outbound mail on the basis of >it's final destination as well. Now I've tried using the following in >CustomConfig.pm: > > return '/var/spool/mqueue.outbound.fast' >if $messages->{fromdomain}, veryimportantclient.com; > >However, that did not work (If you are laughing at me, please do not.. >I have very little programming ability). Now, when I say "it did not >work", I did not get an error and the queue was actually used, however >the messages that went into the queue were not those that I wanted to. > >Is what I want to do possible? Secondly, does how does MailScanner >determine which message to process first in a batch of say 100 messages? >Is it FIFO based upon the time stamp on the file, or does it honor the >message priority assigned to the queue file by sendmail? > >Thanks in advance. > >Errol Neal > >__________________________________________ >Errol Uriel Neal Jr. >Network Administrator >DFI International, Inc. >1717 Pennsylvania Ave NW, Suite 1300 >Washington, DC 20006 >Tel (202)452-6955 >Fax (202)452-6910 >Eneal at dfi-intl.com >www.dfi-intl.com > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brose at MED.WAYNE.EDU Wed Dec 15 21:21:55 2004 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:27:56 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: Speaking of extended queue groups, has anyone created a sendmail ruleset to allow queue groups to be based on IP address instead of the sender or recipient? I'm using queue groups with MailScanner with the advice of another MS user. What I had to do was create a copy of the MailScanner.conf (etc), check_mailscanner (bin) script and the MailScanner script (bin) with different names and check_mailscanner script is modified to call the copied MailScanner script in bin. The second MailScanner.conf is modified to look at a different queue level and uses a different pid file name. The end result is two separate MailScanner processes each looking at different queues. Sendmail handles the queuing using the extended groups. For us, the end result is one queue is for virus & spam checking and the other queue is just for virus checking. This helped our performance a lot because messages from the university's list server aren't being checked for spam. Before we'd have large backups when "all user" type messages were sent out forcing us to stop spamassassin checking in MS until the queues cleared. It would be nice if the queue groups could use IP addresses though. -=B -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Errol Neal Sent: Wednesday, December 15, 2004 3:34 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Classes of service using advanced queuing techniques. Hi everyone. Been a long time since I posted to this list since I switched jobs. Happy holidays and hope everyone is doing well. I've been looking into implementing a hierarchy of service levels for mail delivery using the queuing capabilities of Sendmail and the multiple outbound queue groups found in the custom functions of MailScanner. What I'd like to do on the inbound side is to drop mail in one of several queues based upon the recipient domain and other stuff. This capability is already available to me through the use of the extended queue groups. So, to realize my ambitions, I'd like MailScanner to do the following: 1. Pick up mail dropped in multiple queues/* Since the dx and qx files will be split into separate directories, I need to know if MailScanner can handle this. The directory structure will be something like this /var/spool/mqueue /highpriority /dx /qx /lowpriority /dx /qx 2. Drop processed mail into multiple outgoing queues. I'm already using the feature &MultipleQueueDir to drop spam into a slow queue, however I want to prioritize outbound mail on the basis of it's final destination as well. Now I've tried using the following in CustomConfig.pm: return '/var/spool/mqueue.outbound.fast' if $messages->{fromdomain}, veryimportantclient.com; However, that did not work (If you are laughing at me, please do not.. I have very little programming ability). Now, when I say "it did not work", I did not get an error and the queue was actually used, however the messages that went into the queue were not those that I wanted to. Is what I want to do possible? Secondly, does how does MailScanner determine which message to process first in a batch of say 100 messages? Is it FIFO based upon the time stamp on the file, or does it honor the message priority assigned to the queue file by sendmail? Thanks in advance. Errol Neal __________________________________________ Errol Uriel Neal Jr. Network Administrator DFI International, Inc. 1717 Pennsylvania Ave NW, Suite 1300 Washington, DC 20006 Tel (202)452-6955 Fax (202)452-6910 Eneal at dfi-intl.com www.dfi-intl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 15 21:26:10 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:56 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Errol Neal wrote: >Thanks Julian. You are always very helpful. > >Last question. Is it possible to set Incoming Queue Dir to >/var/spool/mqueue.in.ciient1/* and /var/spool/mqueue.in.client2/* > > I assume you are trying to say /var/spool/mqueue.in.client1 (or the df and qf dirs inside them if they exist) and /var/spool/mqueue.in.client2 (or the df and qf dirs inside them if they exist) In that case, set Incoming Queue Dir = /var/spool/mqueue.in.client* and it should all just work it out for you. The comments for this option in MailScanner.conf say this (for your reference :-) # Set location of incoming mail queue # # This can be any one of # 1. A directory name # Example: /var/spool/mqueue.in # 2. A wildcard giving directory names # Example: /var/spool/mqueue.in/* # 3. The name of a file containing a list of directory names, # which can in turn contain wildcards. # Example: /opt/MailScanner/etc/mqueue.in.list.conf # # If you are using sendmail and have your queues split into qf, df, xf # directories, then just specify the main directory, do not give me the # directory names of the qf,df,xf directories. # Example: if you have /var/spool/mqueue.in/qf # /var/spool/mqueue.in/df # /var/spool/mqueue.in/xf # then just tell me /var/spool/mqueue.in. I will find the subdirectories # automatically. P.S. you should drop in on Steve Swaney at Fortress Systems for a coffee. He's 2.67 miles away from you :-) >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: Wednesday, December 15, 2004 4:06 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Classes of service using advanced queuing techniques. > >This is probably one for me :-) > >You need to call your dx and qx directories df and qf, but otherwise the >latest version will do this. If you tell it the incoming queue dirs are >/var/spool/mqueue/* then it should do the rest of the incoming side >automatically for you. > >On the outbound side, you need to say > >return '/var/spool/mqueue.outbound.fast' if $messages->{fromdomain} =~ >/veryimportantclient\.com/i; > >In a reasonable size queue, it will work on the messages in strict date >order. If the queue starts to get very large, it will temporarily >abandon this sorting as it gets very expensive in most filesystems when >directories get large. Instead it will start on the first ones it reads >in the directory, as this is a lot faster. Once the queue has got small >enough, it stays in this mode for a while longer to get the queue clear >if at all possible, then it will revert to normal date-order processing. > >Inevitably, this is all configurable. > >Hopefully that answers most of your questions :) > >Errol Neal wrote: > > > >>Hi everyone. Been a long time since I posted to this list since I >>switched jobs. Happy holidays and hope everyone is doing well. >> >>I've been looking into implementing a hierarchy of service levels for >>mail delivery using the queuing capabilities of Sendmail and the >>multiple outbound queue groups found in the custom functions of >>MailScanner. What I'd like to do on the inbound side is to drop mail in >> >> > > > >>one of several queues based upon the recipient domain and other stuff. >>This capability is already available to me through the use of the >>extended queue groups. So, to realize my ambitions, I'd like >>MailScanner to do the following: >> >>1. Pick up mail dropped in multiple queues/* >> >>Since the dx and qx files will be split into separate directories, I >>need to know if MailScanner can handle this. The directory structure >>will be something like this >> >> /var/spool/mqueue >> /highpriority >> >>/dx >> >>/qx >> /lowpriority >> >>/dx >> >>/qx >> >>2. Drop processed mail into multiple outgoing queues. >> >>I'm already using the feature &MultipleQueueDir to drop spam into a >>slow queue, however I want to prioritize outbound mail on the basis of >>it's final destination as well. Now I've tried using the following in >>CustomConfig.pm: >> >> return '/var/spool/mqueue.outbound.fast' >>if $messages->{fromdomain}, veryimportantclient.com; >> >>However, that did not work (If you are laughing at me, please do not.. >>I have very little programming ability). Now, when I say "it did not >>work", I did not get an error and the queue was actually used, however >>the messages that went into the queue were not those that I wanted to. >> >>Is what I want to do possible? Secondly, does how does MailScanner >>determine which message to process first in a batch of say 100 >> >> >messages? > > >>Is it FIFO based upon the time stamp on the file, or does it honor the >>message priority assigned to the queue file by sendmail? >> >>Thanks in advance. >> >>Errol Neal >> >>__________________________________________ >>Errol Uriel Neal Jr. >>Network Administrator >>DFI International, Inc. >>1717 Pennsylvania Ave NW, Suite 1300 >>Washington, DC 20006 >>Tel (202)452-6955 >>Fax (202)452-6910 >>Eneal at dfi-intl.com >>www.dfi-intl.com >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Wed Dec 15 21:26:25 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:57 2006 Subject: 710 messages waiting Message-ID: Neil, I won't be able to check it until later. What is "la?" R, Steve On Wed, 2004-12-15 at 15:53, Errol Neal wrote: > Don't know if this has been mentioned, but check the load on the system. > If you have sendmail configured to only queue mail when the la reaches a > certain number (but continue to accept messages for processing), then > that could lead to this problem where you may have a queue that is > backed up. > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Steve Hickel > Sent: Wednesday, December 15, 2004 3:09 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: 710 messages waiting > > Thanks. Will check. > > Steve > > On Wed, 2004-12-15 at 15:02, Julian Field wrote: > > Check they all have their df file as well as their qf file. If they > > have no df file, you can just delete them. > > > > Steve Hickel wrote: > > > > >Denis, > > > > > >My bad. I did the original message from memory. Here is the actual > > >message. I don't believe it is a sendmail issue, but could be wrong. > > >I think I have 710 messages stuck in the in queue. Mailscanner > > >appears not to be processing them. Sorry for the confusion. > > > > > >Steve > > > > > >New Batch: Scanning 1 messages, 4455 bytes Dec1514:33:51 > > >-MailScanner > > > > > >New Batch: Found 710 messages waiting > > > > > > > > > > > > > > >On Wed, 2004-12-15 at 14:04, Denis Beauchemin wrote: > > > > > > > > >>Steve Hickel wrote: > > >> > > >> > > >> > > >>>All, > > >>> > > >>>I notice in my maillog viewer that I have 710 messages waiting but > > >>>then it only processes a few messages. Not sure how to kick those > > >>>710 messages loose. Any thoughts? (they got then when I took my > > >>>exchange box off-line for a few minutes). > > >>> > > >>> > > >>> > > >>> > > >>> > > >>Steve, > > >> > > >>If you are using sendmail, try: sendmail -qRsearch_string (and put a > > > >>part of the destination addresses where search_string is). > > >> > > >>Denis > > >>PS: they should be automatically be processed at some point but the > > >>command above will process them immediately. > > >> > > >> > > > > > > > > >-- > > >This message has been scanned for viruses and dangerous content by > > >MailScanner, and is believed to be clean. > > >MailScanner thanks transtec Computers for their support. > > > > > >------------------------ MailScanner list ------------------------ To > > > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > >'leave mailscanner' in the body of the email. > > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > >Support MailScanner development - buy the book off the website! > > > > > > > > > > > > > -- > > Julian Field > > www.MailScanner.info > > Buy the MailScanner book at www.MailScanner.info/store Professional > > Support Services at www.MailScanner.biz MailScanner thanks transtec > > Computers for their support > > > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > > ------------------------ MailScanner list ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > -- > This message has been scanned for viruses and dangerous content by > MailScanner, and is believed to be clean. > MailScanner thanks transtec Computers for their support. > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at DFI-INTL.COM Wed Dec 15 21:28:16 2004 From: eneal at DFI-INTL.COM (Errol Neal) Date: Thu Jan 12 21:27:57 2006 Subject: 710 messages waiting Message-ID: I'm sorry. It's load average. You can check it using top or uptime. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steve Hickel Sent: Wednesday, December 15, 2004 4:26 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: 710 messages waiting Neil, I won't be able to check it until later. What is "la?" R, Steve On Wed, 2004-12-15 at 15:53, Errol Neal wrote: > Don't know if this has been mentioned, but check the load on the system. > If you have sendmail configured to only queue mail when the la reaches > a certain number (but continue to accept messages for processing), > then that could lead to this problem where you may have a queue that > is backed up. > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Steve Hickel > Sent: Wednesday, December 15, 2004 3:09 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: 710 messages waiting > > Thanks. Will check. > > Steve > > On Wed, 2004-12-15 at 15:02, Julian Field wrote: > > Check they all have their df file as well as their qf file. If they > > have no df file, you can just delete them. > > > > Steve Hickel wrote: > > > > >Denis, > > > > > >My bad. I did the original message from memory. Here is the actual > > >message. I don't believe it is a sendmail issue, but could be wrong. > > >I think I have 710 messages stuck in the in queue. Mailscanner > > >appears not to be processing them. Sorry for the confusion. > > > > > >Steve > > > > > >New Batch: Scanning 1 messages, 4455 bytes Dec1514:33:51 > > >-MailScanner > > > > > >New Batch: Found 710 messages waiting > > > > > > > > > > > > > > >On Wed, 2004-12-15 at 14:04, Denis Beauchemin wrote: > > > > > > > > >>Steve Hickel wrote: > > >> > > >> > > >> > > >>>All, > > >>> > > >>>I notice in my maillog viewer that I have 710 messages waiting > > >>>but then it only processes a few messages. Not sure how to kick > > >>>those 710 messages loose. Any thoughts? (they got then when I > > >>>took my exchange box off-line for a few minutes). > > >>> > > >>> > > >>> > > >>> > > >>> > > >>Steve, > > >> > > >>If you are using sendmail, try: sendmail -qRsearch_string (and put > > >>a > > > >>part of the destination addresses where search_string is). > > >> > > >>Denis > > >>PS: they should be automatically be processed at some point but > > >>the command above will process them immediately. > > >> > > >> > > > > > > > > >-- > > >This message has been scanned for viruses and dangerous content by > > >MailScanner, and is believed to be clean. > > >MailScanner thanks transtec Computers for their support. > > > > > >------------------------ MailScanner list ------------------------ > > >To > > > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > >'leave mailscanner' in the body of the email. > > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > >Support MailScanner development - buy the book off the website! > > > > > > > > > > > > > -- > > Julian Field > > www.MailScanner.info > > Buy the MailScanner book at www.MailScanner.info/store Professional > > Support Services at www.MailScanner.biz MailScanner thanks transtec > > Computers for their support > > > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the > > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > -- > This message has been scanned for viruses and dangerous content by > MailScanner, and is believed to be clean. > MailScanner thanks transtec Computers for their support. > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 15 21:29:36 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:57 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This sounds pretty good. Fancy putting together a FAQ on what you can achieve by doing this, what extra facilities it provides and why it is useful, together with how you actually do it. It never occurred to me someone would do this. You guys really impress me (occasionally ;-) Rose, Bobby wrote: >Speaking of extended queue groups, has anyone created a sendmail ruleset >to allow queue groups to be based on IP address instead of the sender or >recipient? > >I'm using queue groups with MailScanner with the advice of another MS >user. What I had to do was create a copy of the MailScanner.conf (etc), >check_mailscanner (bin) script and the MailScanner script (bin) with >different names and check_mailscanner script is modified to call the >copied MailScanner script in bin. The second MailScanner.conf is >modified to look at a different queue level and uses a different pid >file name. The end result is two separate MailScanner processes each >looking at different queues. Sendmail handles the queuing using the >extended groups. > >For us, the end result is one queue is for virus & spam checking and the >other queue is just for virus checking. This helped our performance a >lot because messages from the university's list server aren't being >checked for spam. Before we'd have large backups when "all user" type >messages were sent out forcing us to stop spamassassin checking in MS >until the queues cleared. > >It would be nice if the queue groups could use IP addresses though. > > >-=B > > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Errol Neal >Sent: Wednesday, December 15, 2004 3:34 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Classes of service using advanced queuing techniques. > >Hi everyone. Been a long time since I posted to this list since I >switched jobs. Happy holidays and hope everyone is doing well. > >I've been looking into implementing a hierarchy of service levels for >mail delivery using the queuing capabilities of Sendmail and the >multiple outbound queue groups found in the custom functions of >MailScanner. What I'd like to do on the inbound side is to drop mail in >one of several queues based upon the recipient domain and other stuff. >This capability is already available to me through the use of the >extended queue groups. So, to realize my ambitions, I'd like MailScanner >to do the following: > >1. Pick up mail dropped in multiple queues/* > >Since the dx and qx files will be split into separate directories, I >need to know if MailScanner can handle this. The directory structure >will be something like this > > /var/spool/mqueue > /highpriority > >/dx > >/qx > /lowpriority > >/dx > >/qx > >2. Drop processed mail into multiple outgoing queues. > >I'm already using the feature &MultipleQueueDir to drop spam into a slow >queue, however I want to prioritize outbound mail on the basis of it's >final destination as well. Now I've tried using the following in >CustomConfig.pm: > > return '/var/spool/mqueue.outbound.fast' >if $messages->{fromdomain}, veryimportantclient.com; > >However, that did not work (If you are laughing at me, please do not.. I >have very little programming ability). Now, when I say "it did not >work", I did not get an error and the queue was actually used, however >the messages that went into the queue were not those that I wanted to. > >Is what I want to do possible? Secondly, does how does MailScanner >determine which message to process first in a batch of say 100 messages? >Is it FIFO based upon the time stamp on the file, or does it honor the >message priority assigned to the queue file by sendmail? > >Thanks in advance. > >Errol Neal > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Wed Dec 15 18:46:47 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:57 2006 Subject: 710 messages waiting Message-ID: All, I notice in my maillog viewer that I have 710 messages waiting but then it only processes a few messages. Not sure how to kick those 710 messages loose. Any thoughts? (they got then when I took my exchange box off-line for a few minutes). thanks, Steve Hickel -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Carl.Andrews at CRACKERBARREL.COM Wed Dec 15 21:44:45 2004 From: Carl.Andrews at CRACKERBARREL.COM (Andrews Carl 448) Date: Thu Jan 12 21:27:57 2006 Subject: High CPU Utilization Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] MTA: sendmail Average # of email: 50,000 - mostly(80% or better) spam RBL's enables SA 3.0.1 Max Children = 5 Max Unscanned Bytes Per Scan = 100000000 Max Unsafe Bytes Per Scan = 50000000 Max Unscanned Messages Per Scan = 30 Max Unsafe Messages Per Scan = 30 Thanks! -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Martin Hepworth Sent: Wednesday, December 15, 2004 3:07 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: High CPU Utilization Carl what MTA? how many emails per day on average? How many MailScanner Children and what batch size have you defined in MailScanner.conf? Are you running any RBL's in SA? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Andrews Carl 448 wrote: > I am using a 3GHZ Compaq/HP DL380 with 1G RAM, running MailScanner > 4.35.11, Spamassassin 3.0.1, RedHat 9.0 (download version) and clamav > 0.80. At any given point I have one copy of /usr/sbin/MailScanner > running at 50% -97% CPU. As I am writting this there are 23 instances > running, one is at 60% and the rest do not even appear on the (top -c ) > output. Anyone got any ideas on why this would be? Anything I can do to > correct? Output from sar shows: "Average: all 60.23 > 0.00 15.97 23.80". This server is for email filtering only. No > other software (except a full install of the OS) > > > Thanks! > Carl > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Carl.Andrews at CRACKERBARREL.COM Wed Dec 15 21:46:12 2004 From: Carl.Andrews at CRACKERBARREL.COM (Andrews Carl 448) Date: Thu Jan 12 21:27:57 2006 Subject: High CPU Utilization Message-ID: [ The following text is in the "iso-8859-2" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] MAX Children is set at = 5. Thanks, Carl -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Marco Benton - BOFH Sent: Wednesday, December 15, 2004 7:30 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: High CPU Utilization -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Andrews Carl 448 wrote: | High CPU Utilization | | I am using a 3GHZ Compaq/HP DL380 with 1G RAM, running MailScanner | 4.35.11, Spamassassin 3.0.1, RedHat 9.0 (download version) and | clamav 0.80. At any given point I have one copy of | /usr/sbin/MailScanner running at 50% -97% CPU. As I am writting | this there are 23 instances running, one is at 60% and the rest do | not even appear on the (top -c ) output. Anyone got any ideas on | why this would be? Anything I can do to correct? Output from sar | shows: "Average: all 60.23 0.00 15.97 | 23.80". This server is for email filtering only. No other software | (except a full install of the OS) | you mention you have 23 other instances running. do you mean you configured 23-25 "Max Children" in MailScanner.conf? that's not a good thing. that mat be causing you load too go high and excessive I/O. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBwDxz6T7cCxJsGOIRAhVPAKCohI1vcg2Ete2Um2tL7sGBTia8EQCfVZik DfAJzwFdqWpLcz9+DGgIgVo= =oVXl -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Wed Dec 15 22:04:03 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:57 2006 Subject: 710 messages waiting Message-ID: Steve Hickel wrote: > All, > > I notice in my maillog viewer that I have 710 messages waiting but > then it only processes a few messages. Not sure how to kick those 710 > messages loose. Any thoughts? (they got then when I took my exchange > box off-line for a few minutes). > > thanks, > > Steve Hickel I had a similar issue on machines running Sendmail 8.13.x on RHEL Julian's suggestion was to use posix locking rather than the default flock (in MailScanner.conf) Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at dfi-intl.com Wed Dec 15 00:00:00 2004 From: eneal at dfi-intl.com (Errol Uriel Neal Jr.) Date: Thu Jan 12 21:27:57 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: Julian, When using this feature is the list of outgoing queue directories fetched and stored in ram when mailscanner starts? Or are calls to the function made for each message? -----Original Message----- From: Julian Field Date: Wed, 15 Dec 2004 21:26:10 To:MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Classes of service using advanced queuing techniques. Errol Neal wrote: >Thanks Julian. You are always very helpful. > >Last question. Is it possible to set Incoming Queue Dir to >/var/spool/mqueue.in.ciient1/* and /var/spool/mqueue.in.client2/* > > I assume you are trying to say /var/spool/mqueue.in.client1 (or the df and qf dirs inside them if they exist) and /var/spool/mqueue.in.client2 (or the df and qf dirs inside them if they exist) In that case, set Incoming Queue Dir = /var/spool/mqueue.in.client* and it should all just work it out for you. The comments for this option in MailScanner.conf say this (for your reference :-) # Set location of incoming mail queue # # This can be any one of # 1. A directory name # Example: /var/spool/mqueue.in # 2. A wildcard giving directory names # Example: /var/spool/mqueue.in/* # 3. The name of a file containing a list of directory names, # which can in turn contain wildcards. # Example: /opt/MailScanner/etc/mqueue.in.list.conf # # If you are using sendmail and have your queues split into qf, df, xf # directories, then just specify the main directory, do not give me the # directory names of the qf,df,xf directories. # Example: if you have /var/spool/mqueue.in/qf # /var/spool/mqueue.in/df # /var/spool/mqueue.in/xf # then just tell me /var/spool/mqueue.in. I will find the subdirectories # automatically. P.S. you should drop in on Steve Swaney at Fortress Systems for a coffee. He's 2.67 miles away from you :-) >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: Wednesday, December 15, 2004 4:06 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Classes of service using advanced queuing techniques. > >This is probably one for me :-) > >You need to call your dx and qx directories df and qf, but otherwise the >latest version will do this. If you tell it the incoming queue dirs are >/var/spool/mqueue/* then it should do the rest of the incoming side >automatically for you. > >On the outbound side, you need to say > >return '/var/spool/mqueue.outbound.fast' if $messages->{fromdomain} =~ >/veryimportantclient\.com/i; > >In a reasonable size queue, it will work on the messages in strict date >order. If the queue starts to get very large, it will temporarily >abandon this sorting as it gets very expensive in most filesystems when >directories get large. Instead it will start on the first ones it reads >in the directory, as this is a lot faster. Once the queue has got small >enough, it stays in this mode for a while longer to get the queue clear >if at all possible, then it will revert to normal date-order processing. > >Inevitably, this is all configurable. > >Hopefully that answers most of your questions :) > >Errol Neal wrote: > > > >>Hi everyone. Been a long time since I posted to this list since I >>switched jobs. Happy holidays and hope everyone is doing well. >> >>I've been looking into implementing a hierarchy of service levels for >>mail delivery using the queuing capabilities of Sendmail and the >>multiple outbound queue groups found in the custom functions of >>MailScanner. What I'd like to do on the inbound side is to drop mail in >> >> > > > >>one of several queues based upon the recipient domain and other stuff. >>This capability is already available to me through the use of the >>extended queue groups. So, to realize my ambitions, I'd like >>MailScanner to do the following: >> >>1. Pick up mail dropped in multiple queues/* >> >>Since the dx and qx files will be split into separate directories, I >>need to know if MailScanner can handle this. The directory structure >>will be something like this >> >> /var/spool/mqueue >> /highpriority >> >>/dx >> >>/qx >> /lowpriority >> >>/dx >> >>/qx >> >>2. Drop processed mail into multiple outgoing queues. >> >>I'm already using the feature &MultipleQueueDir to drop spam into a >>slow queue, however I want to prioritize outbound mail on the basis of >>it's final destination as well. Now I've tried using the following in >>CustomConfig.pm: >> >> return '/var/spool/mqueue.outbound.fast' >>if $messages->{fromdomain}, veryimportantclient.com; >> >>However, that did not work (If you are laughing at me, please do not.. >>I have very little programming ability). Now, when I say "it did not >>work", I did not get an error and the queue was actually used, however >>the messages that went into the queue were not those that I wanted to. >> >>Is what I want to do possible? Secondly, does how does MailScanner >>determine which message to process first in a batch of say 100 >> >> >messages? > > >>Is it FIFO based upon the time stamp on the file, or does it honor the >>message priority assigned to the queue file by sendmail? >> >>Thanks in advance. >> >>Errol Neal >> >>__________________________________________ >>Errol Uriel Neal Jr. >>Network Administrator >>DFI International, Inc. >>1717 Pennsylvania Ave NW, Suite 1300 >>Washington, DC 20006 >>Tel (202)452-6955 >>Fax (202)452-6910 >>Eneal at dfi-intl.com >>www.dfi-intl.com >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! __________________________________________ Errol Uriel Neal Jr. Network Administrator DFI International, Inc. 1717 Pennsylvania Ave NW, Suite 1300 Washington, DC 20006 Tel (202)452-6955 Fax (202)452-6910 eneal@dfi-intl.com www.dfi-intl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ohookins at GMAIL.COM Thu Dec 16 00:54:40 2004 From: ohookins at GMAIL.COM (Oliver Hookins) Date: Thu Jan 12 21:27:57 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: > Oliver > > you need to install the latest MS (or at least 4.34) for it to work with > SA3.x. The SA 3.x API is different from the 2.x so you'll need to upgrade. OK I have now installed MS 4.36.4-1, and SpamAssassin and I believe configured it all to work properly. Incoming emails appear to trigger virus and content filtering, and there aren't any error messages about exiting processes like there were before However now that the sendmail processes are split up into receiving mail and processing the queue I am finding that the queue runner is not touching anything in /var/spool/mqueue. Any ideas? Here's the directory listing: root@web:/opt/MailScanner # ls -la /var/spool/mqueue total 56 drwxr-s--- 2 smmsp smmsp 4096 2004-12-16 11:11 . drwxr-xr-x 9 root root 4096 2004-12-15 14:08 .. -rw-rw---- 1 smmsp smmsp 14 2004-12-15 14:40 dfiBF3dOYm020026 -rw-rw---- 1 smmsp smmsp 6 2004-12-15 14:45 dfiBF3jCEV020094 -rw-rw---- 1 smmsp smmsp 154 2004-12-15 15:45 dfiBF4i0HU023251 -rw-rw---- 1 smmsp smmsp 125 2004-12-15 16:53 dfiBF5qlAS023679 -rw-rw---- 1 smmsp smmsp 46 2004-12-16 10:59 dfiBFNvx58032373 -rw-rw---- 1 smmsp smmsp 157 2004-12-16 11:10 dfiBG09HUG032463 -rw------- 1 root smmsp 955 2004-12-15 16:44 qfiBF3dOYm020026 -rw------- 1 root smmsp 817 2004-12-15 16:44 qfiBF3jCEV020094 -rw------- 1 root smmsp 895 2004-12-15 16:44 qfiBF4i0HU023251 -rw------- 1 root smmsp 882 2004-12-16 10:57 qfiBF5qlAS023679 -rw------- 1 root smmsp 941 2004-12-16 10:59 qfiBFNvx58032373 -rw------- 1 root smmsp 928 2004-12-16 11:11 qfiBG09HUG032463 Regards, Oliver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Thu Dec 16 00:56:54 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:57 2006 Subject: 710 messages waiting Message-ID: I looked and found 100's of files but is there a way to compare these easily???? r, Steve On Wed, 2004-12-15 at 15:02, Julian Field wrote: > Check they all have their df file as well as their qf file. If they have > no df file, you can just delete them. > > Steve Hickel wrote: > > >Denis, > > > >My bad. I did the original message from memory. Here is the actual > >message. I don't believe it is a sendmail issue, but could be wrong. I > >think I have 710 messages stuck in the in queue. Mailscanner appears not > >to be processing them. Sorry for the confusion. > > > >Steve > > > >New Batch: Scanning 1 messages, 4455 bytes Dec1514:33:51 -MailScanner > > > >New Batch: Found 710 messages waiting > > > > > > > > > >On Wed, 2004-12-15 at 14:04, Denis Beauchemin wrote: > > > > > >>Steve Hickel wrote: > >> > >> > >> > >>>All, > >>> > >>>I notice in my maillog viewer that I have 710 messages waiting but then > >>>it only processes a few messages. Not sure how to kick those 710 > >>>messages loose. Any thoughts? (they got then when I took my exchange box > >>>off-line for a few minutes). > >>> > >>> > >>> > >>> > >>> > >>Steve, > >> > >>If you are using sendmail, try: sendmail -qRsearch_string (and put a > >>part of the destination addresses where search_string is). > >> > >>Denis > >>PS: they should be automatically be processed at some point but the > >>command above will process them immediately. > >> > >> > > > > > >-- > >This message has been scanned for viruses and > >dangerous content by MailScanner, and is > >believed to be clean. > >MailScanner thanks transtec Computers for their support. > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Thu Dec 16 02:17:32 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:57 2006 Subject: 710 messages waiting Message-ID: Mike, I made the change you suggested. It still processes mail. When I do a ls |ws on /var/spool/mqueue.in it say there are 2777 files. It does not increase. I no longer see the batch message, but it doesn't appear to be processing any of the files in the mqueue.in folder. Further I see this message in the log: iBG2Av1c002397: [192.168.0.6] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA on a frequent and regular basis. .0.6 is the first scanner I am using. r, Steve On Wed, 2004-12-15 at 17:04, Mike Kercher wrote: > Steve Hickel wrote: > > All, > > > > I notice in my maillog viewer that I have 710 messages waiting but > > then it only processes a few messages. Not sure how to kick those 710 > > messages loose. Any thoughts? (they got then when I took my exchange > > box off-line for a few minutes). > > > > thanks, > > > > Steve Hickel > > I had a similar issue on machines running Sendmail 8.13.x on RHEL Julian's > suggestion was to use posix locking rather than the default flock (in > MailScanner.conf) > > Mike > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ius at IUS.RBRANA.CO.ID Thu Dec 16 02:28:51 2004 From: ius at IUS.RBRANA.CO.ID (Montana M) Date: Thu Jan 12 21:27:57 2006 Subject: clamav problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, This morning i checked my clamav, i got this dns error message. freshclam ClamAV update process started at Thu Dec 16 16:25:49 2004 WARNING: DNS record is older than 3 hours. WARNING: Invalid DNS reply. Reading CVD header (main.cvd): OK main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: tomek) WARNING: DNS record is older than 3 hours. WARNING: Invalid DNS reply. Reading CVD header (daily.cvd): OK daily.cvd is up to date (version: 631, sigs: 1750, f-level: 3, builder: trog) is there something's wrong with my clamav ? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Thu Dec 16 03:52:28 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:57 2006 Subject: 710 messages waiting Message-ID: Steve Hickel wrote: > Mike, > > I made the change you suggested. It still processes mail. When I do a > ls >> ws on /var/spool/mqueue.in it say there are 2777 files. It does not >> increase. > > I no longer see the batch message, but it doesn't appear to be > processing any of the files in the mqueue.in folder. Further I see > this message in the log: > > iBG2Av1c002397: [192.168.0.6] did not issue MAIL/EXPN/VRFY/ETRN > during connection to MTA on a frequent and regular basis. > > .0.6 is the first scanner I am using. > > r, > > Steve > > On Wed, 2004-12-15 at 17:04, Mike Kercher wrote: >> Steve Hickel wrote: >>> All, >>> >>> I notice in my maillog viewer that I have 710 messages waiting but >>> then it only processes a few messages. Not sure how to kick those >>> 710 messages loose. Any thoughts? (they got then when I took my >>> exchange box off-line for a few minutes). >>> >>> thanks, >>> >>> Steve Hickel >> >> I had a similar issue on machines running Sendmail 8.13.x on RHEL >> Julian's suggestion was to use posix locking rather than the default >> flock (in MailScanner.conf) >> >> Mike >> >> ------------------------ MailScanner list ------------------------ To >> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! More than likely these are orphans from incomplete mail transactions. I safely deleted all of mine. Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From davidb at UNIQUEPHOTO.COM Thu Dec 16 04:09:15 2004 From: davidb at UNIQUEPHOTO.COM (David Ballengee) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] After I start Mailscanner, then check the status. I get a failed message for incoming sendmail. when I loook at var/log/maillog/ i get this Dec 15 22:44:10 email sendmail[18499]: daemon MTA: problem creating SMTP socket Dec 15 22:44:15 email sendmail[18499]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use any ideas ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ohookins at GMAIL.COM Thu Dec 16 04:00:21 2004 From: ohookins at GMAIL.COM (Oliver Hookins) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] David Ballengee wrote: > After I start Mailscanner, then check the status. I get a failed > message for incoming sendmail. > > when I loook at > > var/log/maillog/ i get this > > Dec 15 22:44:10 email sendmail[18499]: daemon MTA: problem creating SMTP > socket > Dec 15 22:44:15 email sendmail[18499]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use > > any ideas You must still have a sendmail process running that is listening on port 25. Check it with 'ps -aux' and stop the appropriate process. Regards, Oliver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Dec 16 04:01:19 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: You are running sendmail. Do a: chkconfig sendmail off Chkconfig MailScanner on killall -9 sendmail killall -9 MailScanner service MailScanner start If sendmail runs before MailScanner, MailScanner can't run it's own sendmail process to get the mail, because the lone, unprotected sendmail binds to port 25. Oh, and remember to tell sendmail to listen on other interfaces, not just 127.0.0.1 (stock RH/FC install). Check your sendmail.mc for "127.0.0.1" and delete that line, then make -C /etc/mail -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of David Ballengee Sent: Wednesday, December 15, 2004 11:09 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: just installed MailScanner 4.36 on Fedora core 2 After I start Mailscanner, then check the status. I get a failed message for incoming sendmail. when I loook at var/log/maillog/ i get this Dec 15 22:44:10 email sendmail[18499]: daemon MTA: problem creating SMTP socket Dec 15 22:44:15 email sendmail[18499]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon MTA: cannot bind: Address already in use any ideas ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billox at BILLOX.COM Thu Dec 16 04:02:55 2004 From: billox at BILLOX.COM (James Page) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Have a look for a program called system-switch-mail and make sure the correct MTA is selected If you dont have it you should be bale to get it with yum install system-switch-mail James ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Thu Dec 16 04:15:49 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:57 2006 Subject: 710 messages waiting Message-ID: thanks Mike! On Wed, 2004-12-15 at 22:52, Mike Kercher wrote: > Steve Hickel wrote: > > Mike, > > > > I made the change you suggested. It still processes mail. When I do a > > ls > >> ws on /var/spool/mqueue.in it say there are 2777 files. It does not > >> increase. > > > > I no longer see the batch message, but it doesn't appear to be > > processing any of the files in the mqueue.in folder. Further I see > > this message in the log: > > > > iBG2Av1c002397: [192.168.0.6] did not issue MAIL/EXPN/VRFY/ETRN > > during connection to MTA on a frequent and regular basis. > > > > .0.6 is the first scanner I am using. > > > > r, > > > > Steve > > > > On Wed, 2004-12-15 at 17:04, Mike Kercher wrote: > >> Steve Hickel wrote: > >>> All, > >>> > >>> I notice in my maillog viewer that I have 710 messages waiting but > >>> then it only processes a few messages. Not sure how to kick those > >>> 710 messages loose. Any thoughts? (they got then when I took my > >>> exchange box off-line for a few minutes). > >>> > >>> thanks, > >>> > >>> Steve Hickel > >> > >> I had a similar issue on machines running Sendmail 8.13.x on RHEL > >> Julian's suggestion was to use posix locking rather than the default > >> flock (in MailScanner.conf) > >> > >> Mike > >> > >> ------------------------ MailScanner list ------------------------ To > >> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > > More than likely these are orphans from incomplete mail transactions. I > safely deleted all of mine. > > Mike > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dmehler26 at woh.rr.com Thu Dec 16 04:42:14 2004 From: dmehler26 at woh.rr.com (dave) Date: Thu Jan 12 21:27:57 2006 Subject: spam still getting through Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, I've got a freebsd 5.3 box that seems i can not stop the spam. I thought i was doing well then i checked an account and it's still flodding in. It's running postfix 2.1.5, authenticated smtp over tls, and courier imap for pop/imap and pops/imaps access. I've installed MailScanner, 4.35.11, dcc 1.2.58, and sa 3.01, and razor 2.67. I know MailScanner and sa are running, but i believe i've got a config error, the spam still comes in. I am using an rhbl as well. In the headers of a spam message i see: X-davemehler.com-MailScanner: Found to be clean X-davemehler.com-MailScanner-SpamScore: ss I've got razor and dcc on, i am uncertain why this isn't working. I'd rather not post my configs as they are quite large, but if someone offlist wants to check them over i'd appreciate the help. Thanks. Dave. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dh at UPTIME.AT Thu Dec 16 07:08:30 2004 From: dh at UPTIME.AT ([ISO-8859-1] David Höhn) Date: Thu Jan 12 21:27:57 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Errol Neal wrote: | Hi everyone. Been a long time since I posted to this list since I | switched jobs. Happy holidays and hope everyone is doing well. | | I've been looking into implementing a hierarchy of service levels for | mail delivery using the queuing capabilities of Sendmail and the | multiple outbound queue groups found in the custom functions of | MailScanner. What I'd like to do on the inbound side is to drop mail in | one of several queues based upon the recipient domain and other stuff. | This capability is already available to me through the use of the | extended queue groups. So, to realize my ambitions, I'd like | MailScanner to do the following: | | 1. Pick up mail dropped in multiple queues/* | | Since the dx and qx files will be split into separate directories, I | need to know if MailScanner can handle this. The directory structure | will be something like this | | /var/spool/mqueue | /highpriority | | /dx | | /qx | /lowpriority | | /dx | | /qx | Just out of curiosity, where is the /xf ? Remeber to mount it in tmpfs. Make sure you Adjust the maxrunnersperqueue and maxchildren for the runners according to the queue priority. If you need any help, let me know - -d - -- nee anata wo mitsukete soshite nidoto wasurezu ~ donna ni munega itakutemo soba ni iru no ~ zutto...zutto...zutto Key fingerprint = FD77 F0B7 5C65 F546 EB08 A4EC 3CCA 1A32 7E24 291E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (Darwin) iD8DBQFBwTRuPMoaMn4kKR4RA+TPAJ43pGJmZw0AUEPtx/Y08vwWVuq6owCghY0g Kph0CdeoLEA5IrW1xO7rvXs= =0Vbo -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Thu Dec 16 07:58:38 2004 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: Hi! > when I loook at > > var/log/maillog/ i get this > > Dec 15 22:44:10 email sendmail[18499]: daemon MTA: problem creating SMTP > socket > Dec 15 22:44:15 email sendmail[18499]: NOQUEUE: SYSERR(root): > opendaemonsocket: daemon MTA: cannot bind: Address already in use Sendmail allready running? Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 16 08:45:06 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:57 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Oliver Hookins wrote: > Martin Hepworth wrote: > >> Oliver >> >> you need to install the latest MS (or at least 4.34) for it to work with >> SA3.x. The SA 3.x API is different from the 2.x so you'll need to >> upgrade. > > > OK I have now installed MS 4.36.4-1, and SpamAssassin and I believe > configured it all to work properly. Incoming emails appear to trigger > virus and content filtering, and there aren't any error messages about > exiting processes like there were before > > However now that the sendmail processes are split up into receiving mail > and processing the queue I am finding that the queue runner is not > touching anything in /var/spool/mqueue. > > Any ideas? Here's the directory listing: > > root@web:/opt/MailScanner # ls -la /var/spool/mqueue > total 56 > drwxr-s--- 2 smmsp smmsp 4096 2004-12-16 11:11 . > drwxr-xr-x 9 root root 4096 2004-12-15 14:08 .. > -rw-rw---- 1 smmsp smmsp 14 2004-12-15 14:40 dfiBF3dOYm020026 > -rw-rw---- 1 smmsp smmsp 6 2004-12-15 14:45 dfiBF3jCEV020094 > -rw-rw---- 1 smmsp smmsp 154 2004-12-15 15:45 dfiBF4i0HU023251 > -rw-rw---- 1 smmsp smmsp 125 2004-12-15 16:53 dfiBF5qlAS023679 > -rw-rw---- 1 smmsp smmsp 46 2004-12-16 10:59 dfiBFNvx58032373 > -rw-rw---- 1 smmsp smmsp 157 2004-12-16 11:10 dfiBG09HUG032463 > -rw------- 1 root smmsp 955 2004-12-15 16:44 qfiBF3dOYm020026 > -rw------- 1 root smmsp 817 2004-12-15 16:44 qfiBF3jCEV020094 > -rw------- 1 root smmsp 895 2004-12-15 16:44 qfiBF4i0HU023251 > -rw------- 1 root smmsp 882 2004-12-16 10:57 qfiBF5qlAS023679 > -rw------- 1 root smmsp 941 2004-12-16 10:59 qfiBFNvx58032373 > -rw------- 1 root smmsp 928 2004-12-16 11:11 qfiBG09HUG032463 > The ownership of these files is wrong. The clientmqueue version of sendmail should be putting hem into /var/spool/clientmqueue instead of here. Check your startup script to ensure the right queues are being used for the right sendmails. All the files in mqueue should be owned by root. Set that, and these files should be delivered. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 16 08:47:16 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:57 2006 Subject: Classes of service using advanced queuing techniques. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] David Höhn wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: RIPEMD160 > > Errol Neal wrote: > | Hi everyone. Been a long time since I posted to this list since I > | switched jobs. Happy holidays and hope everyone is doing well. > | > | I've been looking into implementing a hierarchy of service levels for > | mail delivery using the queuing capabilities of Sendmail and the > | multiple outbound queue groups found in the custom functions of > | MailScanner. What I'd like to do on the inbound side is to drop mail in > | one of several queues based upon the recipient domain and other stuff. > | This capability is already available to me through the use of the > | extended queue groups. So, to realize my ambitions, I'd like > | MailScanner to do the following: > | > | 1. Pick up mail dropped in multiple queues/* > | > | Since the dx and qx files will be split into separate directories, I > | need to know if MailScanner can handle this. The directory structure > | will be something like this > | > | /var/spool/mqueue > | /highpriority > | > | /dx > | > | /qx > | /lowpriority > | > | /dx > | > | /qx > | > > > Just out of curiosity, where is the /xf ? Remeber to mount it in tmpfs. > Make sure you Adjust the maxrunnersperqueue and maxchildren for the > runners according to the queue priority. If you need any help, let me > know I didn't mention the xf as MailScanner doesn't use it itself. But there does need to be an xf directory if you already have df and qf dirs. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Thu Dec 16 09:05:59 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:57 2006 Subject: spam still getting through Message-ID: A lot would depend on which version of SA you have, which rules, if Bayes is working properly etc. etc. M Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dmehler26 at woh.rr.com Thu Dec 16 09:09:04 2004 From: dmehler26 at woh.rr.com (dave) Date: Thu Jan 12 21:27:57 2006 Subject: spam still getting through Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, I'm using sa 3.0.1, and the default rules that came with it. I'm not getting any errors from Bayes, so i'm assuming it's working fine. Dave. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Dec 16 09:19:17 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:57 2006 Subject: spam still getting through Message-ID: If I remember correctly Dave, you're using MailWatch, right? In the "Other->SpamAssassin Lint (Test)" you have a very convenient way of checking your SA setup...With nice timing and all. Or just run spamassassin -D -p /path/to/spam.assassin.prefs.conf --lint and look for anything ... erroneous:). I could probably find the time to look at the files today, if you'd want me to. -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of dave > Sent: den 16 december 2004 10:09 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: spam still getting through > > > Hello, > I'm using sa 3.0.1, and the default rules that came with it. > I'm not getting > any errors from Bayes, so i'm assuming it's working fine. > Dave. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Dec 16 09:29:22 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:57 2006 Subject: spam still getting through Message-ID: Dave Have you got the surbl.org plugin installed (check the init.pre in /etc/mail/spamassassin)? This is really good... What extra rules have you loaded into /etc/mail/spamassassin ? There are some really good ones in www.rulesemporium.com/rules.htm and a script call rulesdujour that will help keep them up to date. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 dave wrote: > Hello, > I've got a freebsd 5.3 box that seems i can not stop the spam. I thought > i was doing well then i checked an account and it's still flodding in. > It's running postfix 2.1.5, authenticated smtp over tls, and courier > imap for pop/imap and pops/imaps access. I've installed MailScanner, > 4.35.11, dcc 1.2.58, and sa 3.01, and razor 2.67. > I know MailScanner and sa are running, but i believe i've got a config > error, the spam still comes in. I am using an rhbl as well. In the headers > of a spam message i see: > X-davemehler.com-MailScanner: Found to be clean > X-davemehler.com-MailScanner-SpamScore: ss > I've got razor and dcc on, i am uncertain why this isn't working. I'd rather > not post my configs as they are quite large, but if someone offlist wants to > check them over i'd appreciate the help. > Thanks. > Dave. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Thu Dec 16 09:57:36 2004 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:27:57 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > It is still put into the "nasties" quarantine (if Quarantine Infections > = yes), but it is not put into the spam quarantine. That sounds ideal. How about adding a note to that effect to the comments in MailScanner.conf for the Keep Spam And MCP Archive Clean option - I'm sure I'm not the only one who didn't realise the subtleties of the two quarantines. BTW, I can confirm that it this now working correctly for postfix with the fix in 4.37.3. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 16 10:40:37 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:57 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Wilcock wrote: > Julian Field wrote: > >> It is still put into the "nasties" quarantine (if Quarantine Infections >> = yes), but it is not put into the spam quarantine. > > > That sounds ideal. How about adding a note to that effect to the > comments in MailScanner.conf for the Keep Spam And MCP Archive Clean > option - I'm sure I'm not the only one who didn't realise the subtleties > of the two quarantines. Will do. > BTW, I can confirm that it this now working correctly for postfix with > the fix in 4.37.3. Yay! Another bug bites the dust :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Dec 16 13:55:02 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:57 2006 Subject: Quarantine Report - Remarks.. Message-ID: Hi there, just tested a bit around with the Quarantine Report-Script, taken from fsl.com.. And i have some remarks for the INSTALL-File ;) Maybe it should be made clear, that someone has to change the URL within the Emails.pm, because, if you dont do so, the Link to the QuarantineRelease.php would be wrong.. as in the original script the link would be something like: http://osiris.co.douglas.or.us/spam/20041214/iBELg3WM003969.mht And you cannot change this link in the Config-File..as it is hardcoded in the Emails.pm.. 2. It should be made clear, that you should create an Alias within the httpd.conf ;) And now a question about that script.. I hope i got it right, when i thought, that, if i turn on the flat-file-user-verification, i should create a file, in which the Script will find the mail-address from those users, who should receive a spam report,right? so..if i just put for example marcel-ml@irc-addicts.de within this file, only the stated addresse will receive one report? :) Because some spams are containing other users who are not on my system, but the users on my system are within the bcc-field.. and so the script created a spamreport for the other users also.. maybe it would be great, if the script could check the Local Domains within my sendmail? ;) As within this file all local domains to catch the mails for are found.. That should be it.. greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Dec 16 14:05:24 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:57 2006 Subject: Quarantine Report - Remarks.. Message-ID: Hi again... got some questions for some rulesets for the upper stated Script.. As MS in combination with SpamAssassin seems to catch the mails as spam, and puts them into the quarantine what ruleset should be set within MS not so scan those mails for spam, after releasing those via the html-link?? Just stated From: 127.0.0.1 No as the Maschine is localhost.. but for me this is to big.. ;) now everyone on the maschine itself could send spam-Mails.. should be an From: postmaster@ No be enough? Thanks for the answer Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From davidb at UNIQUEPHOTO.COM Thu Dec 16 14:51:09 2004 From: davidb at UNIQUEPHOTO.COM (David Ballengee) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: OK I changed configuration so Mailscanner starts on bootup. Also made sure line DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl was commented out. Anyway I rebooted the box. MailScanner starts, but no sendmail. MailScanner is supposed to start sendmail? Any ideas?? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Dec 16 15:04:51 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: David how did you install MS? If you installed the RPM way then yes it should start sendmail... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 David Ballengee wrote: > OK I changed configuration so Mailscanner starts on bootup. > > Also made sure line > > DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl > > was commented out. > > Anyway I rebooted the box. MailScanner starts, but no sendmail. > > MailScanner is supposed to start sendmail? > > Any ideas?? > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Dec 16 16:05:37 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:57 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: Too bad you can't do a "keep 'Archive Mail' Archive clean"... -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of John Wilcock Sent: Thursday, December 16, 2004 4:58 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: ANNOUNCE: Beta 4.37.3 released Julian Field wrote: > It is still put into the "nasties" quarantine (if Quarantine > Infections = yes), but it is not put into the spam quarantine. That sounds ideal. How about adding a note to that effect to the comments in MailScanner.conf for the Keep Spam And MCP Archive Clean option - I'm sure I'm not the only one who didn't realise the subtleties of the two quarantines. BTW, I can confirm that it this now working correctly for postfix with the fix in 4.37.3. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Thu Dec 16 16:07:01 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: And if it hadn't, you wouldn't have had the "two sendmails fighting for port 25" problem show up in your log files. Can you telnet to port 25 on the box? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth Sent: Thursday, December 16, 2004 10:05 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: just installed MailScanner 4.36 on Fedora core 2 David how did you install MS? If you installed the RPM way then yes it should start sendmail... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 David Ballengee wrote: > OK I changed configuration so Mailscanner starts on bootup. > > Also made sure line > > DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl > > was commented out. > > Anyway I rebooted the box. MailScanner starts, but no sendmail. > > MailScanner is supposed to start sendmail? > > Any ideas?? > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From davidb at UNIQUEPHOTO.COM Thu Dec 16 16:23:51 2004 From: davidb at UNIQUEPHOTO.COM (David Ballengee) Date: Thu Jan 12 21:27:57 2006 Subject: installing again fedora core 2 Message-ID: With all the recent problems, I am going to attempt a fresh install. how should I go about this. I would like to use Webmin with the install this is what I am thinking 1. install os (fedora core 2) 2. install mailscanner 3. install virus scanning software 4. install webmin 5. install webmin module for mailscanner 6. install qpopper. any thoughts?? -- David Ballengee IT Supervisor Unique Photo (973)377-5555x259 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Dec 16 16:35:08 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:27:57 2006 Subject: Vispan - updated.. Message-ID: Hi there, i installed the latest Vispan-Version just to check if the antivir-version is now handled correct.. But..after a few days running the latest version, there is still no antivir-information under config.. :( should i delete the old vispan.data? As on another system, with the latest release and just started the system..everything seems to work fine :) Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Dec 16 16:13:03 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 David Ballengee wrote: | OK I changed configuration so Mailscanner starts on bootup. | | Also made sure line | | DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl | | was commented out. | I didn't have to comment out that line, just remove the relevant parts as below DAEMON_OPTIONS(`Port=smtp, Name=MTA')dnl and don't forget to run -- make -C /etc/mail to remake your sendmail.cf file -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBwbQPRADw9lziUqQRAnE7AJ0TYXgL5dw2k07N3XOOUrkVnYDFWQCeKhN2 VdoZy8f/05XU/o6Ex+EqUs8= =2nzR -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From davidb at UNIQUEPHOTO.COM Thu Dec 16 16:39:29 2004 From: davidb at UNIQUEPHOTO.COM (David Ballengee) Date: Thu Jan 12 21:27:57 2006 Subject: i get this message right after I start mail scanner Message-ID: MailScanner[3905]: Cannot read queue directory /var/spool/mqueue thanks -- David Ballengee IT Supervisor Unique Photo (973)377-5555x259 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From merlin at OPHELAN.COM Thu Dec 16 16:33:52 2004 From: merlin at OPHELAN.COM (Daniel Whelan) Date: Thu Jan 12 21:27:57 2006 Subject: Question - Filtering EXEs, but not in zip files? Message-ID: It seems our Mailscanner implementation is filtering executables attached to messages (which is good), as well as executables within zip files attached to messages (which is bad). Is there any way we can direct Mailscanner to allow the zipped EXEs, but not the ones that are directly attached? Thanks! Daniel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Dec 16 16:33:00 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:57 2006 Subject: installing again fedora core 2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] David Ballengee wrote: > With all the recent problems, I am going to attempt a fresh install. > > how should I go about this. I would like to use Webmin with the install > > this is what I am thinking > > 1. install os (fedora core 2) > 2. install mailscanner > 3. install virus scanning software > 4. install webmin > 5. install webmin module for mailscanner > 6. install qpopper. > > > any thoughts?? Makes sense. However, I personnaly don't find much use of the webmin module. I would add a step 0: Read the MailScanner Manual from www.fsl.com/support (if not done already), or the book. Another thing: I'd suggest using a more 'static' linux distribution, like a clone of Red Hat Enterprise Linux 3. Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sailer at BNL.GOV Thu Dec 16 16:45:43 2004 From: sailer at BNL.GOV (Tim Sailer) Date: Thu Jan 12 21:27:57 2006 Subject: i get this message right after I start mail scanner Message-ID: On Thu, Dec 16, 2004 at 11:39:29AM -0500, David Ballengee wrote: > MailScanner[3905]: Cannot read queue directory /var/spool/mqueue Make sure it exists, and that the perms are set right. Tim -- Tim Sailer Information and Special Technologies Program Office of CounterIntelligence Brookhaven National Laboratory (631) 344-3001 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From prandal at HEREFORDSHIRE.GOV.UK Thu Dec 16 17:02:56 2004 From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil) Date: Thu Jan 12 21:27:57 2006 Subject: Vispan - updated.. Message-ID: I'm not geting any virus definitions info out of Vispan 2.01 either: clamavmodule, bitdefender, and mcafee uvscan. Probably best to post this to the message board at http://www.while.homeunix.net/phpBB2/index.php Cheers, Phil ---- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Marcel Blenkers > Sent: 16 December 2004 16:35 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Vispan - updated.. > > Hi there, > > i installed the latest Vispan-Version just to check if the > antivir-version is now handled correct.. > > But..after a few days running the latest version, there is > still no antivir-information under config.. :( > > should i delete the old vispan.data? > > As on another system, with the latest release and just > started the system..everything seems to work fine :) > > Greetings > > Marcel > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Dec 16 17:23:29 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:57 2006 Subject: Question - Filtering EXEs, but not in zip files? Message-ID: At 11:33 AM 12/16/2004, Daniel Whelan wrote: >It seems our Mailscanner implementation is filtering executables attached >to messages (which is good), as well as executables within zip files >attached to messages (which is bad). Is there any way we can direct >Mailscanner to allow the zipped EXEs, but not the ones that are directly >attached? Thanks! Set in your MailScanner.conf: Maximum Archive Depth = 0 Note this does not impact virus scanning, just filename and filetype rule checking... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chardlist at CHARD.NET Thu Dec 16 17:47:16 2004 From: chardlist at CHARD.NET (Brendan Chard) Date: Thu Jan 12 21:27:57 2006 Subject: Auto White List working backwards? Message-ID: I've just done an upgrade to MS 4.35.11 and SA 3.0.1 on my FreeBSD box. I'm noticing that in the spamassassin score reports that the AWL scores appear to be flip-flopped. I restarted by bayes DB and auto-whitelist file from scratch and a lot of my valid users are scoring positive scores in the AWL portion of the scan. Some as high as 7 points. Here's a sample report from MailWatch on a message that was sent from one good person to a user on my system: 5.24 AWL From: address is in the auto white-list -15.00 BAYES_00 Bayesian spam probability is 0 to 1% 0.14 HTML_FONT_BIG HTML tag for a big font size 0.00 HTML_MESSAGE HTML included in message 0.06 HTML_TEXT_AFTER_BODY HTML contains text after BODY close tag 0.03 HTML_TEXT_AFTER_HTML HTML contains text after HTML close tag 1.02 MIME_HTML_MOSTLY Multipart message mostly text/html MIME 1.30 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" Now, that user should be in the auto whitelist, buy why are they accruing a positive score instead of a negative one? How can I fix this? -Brendan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From David.While at UCE.AC.UK Thu Dec 16 18:10:25 2004 From: David.While at UCE.AC.UK (David While) Date: Thu Jan 12 21:27:57 2006 Subject: Vispan - updated.. Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The version information and update time in Vispan is dependent on 2 things: 1. That I know what option the virus scanner uses to produce a version listing - currently not all AV scanners have this feature supported. 2. The autoupdate script differentiates between an update and when there is no update. The current scripts shipped with mailScanner don't all do this. e.g. Bitdefender and antivir don't they simply report that the updater has finished without any indication of whether an update actually occurred. David While -----Original Message----- From: MailScanner mailing list on behalf of Randal, Phil Sent: Thu 16/12/2004 17:02 To: MAILSCANNER@JISCMAIL.AC.UK Cc: Subject: Re: Vispan - updated.. I'm not geting any virus definitions info out of Vispan 2.01 either: clamavmodule, bitdefender, and mcafee uvscan. Probably best to post this to the message board at http://www.while.homeunix.net/phpBB2/index.php Cheers, Phil ---- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Marcel Blenkers > Sent: 16 December 2004 16:35 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Vispan - updated.. > > Hi there, > > i installed the latest Vispan-Version just to check if the > antivir-version is now handled correct.. > > But..after a few days running the latest version, there is > still no antivir-information under config.. :( > > should i delete the old vispan.data? > > As on another system, with the latest release and just > started the system..everything seems to work fine :) > > Greetings > > Marcel > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 16 19:17:57 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:57 2006 Subject: Question - Filtering EXEs, but not in zip files? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Set "Maximum Archive Depth = 0" Daniel Whelan wrote: > It seems our Mailscanner implementation is filtering executables attached > to messages (which is good), as well as executables within zip files > attached to messages (which is bad). Is there any way we can direct > Mailscanner to allow the zipped EXEs, but not the ones that are directly > attached? Thanks! > > Daniel > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Thu Dec 16 19:27:49 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:57 2006 Subject: FW: SpamAssassin 3.0.2 is released! Message-ID: Michael Parker wrote: > SpamAssassin 3.0.2 is released! 3.0.2 contains some > important bugfixes, and is recommended. > > Highlights: > > - Detect legitimate SMTP AUTH submission, to avoid false positives > on Dynablock-style rules > - Fix URIDNSBL plugin to honor uridnsbl_max_domains config option > - Various documentation and rule fixes > - Deal with 'rewrite_header Subject' markup when no Subject header > exists > - Fix 'make test' failure on Solaris > > Pick it up at http://spamassassin.apache.org/ > > You can also find it on your favorite CPAN mirror, you may > need to wait a day or so for the release to propagate. > > md5sum of archive files: > b373bc48c4f50b70cb784f40d88868bf > Mail-SpamAssassin-3.0.2.tar.bz2 > 2a654d0819a730aab3fbbba83da62bc0 Mail-SpamAssassin-3.0.2.tar.gz > 600ac98a22768321680df8a6c0bb1982 Mail-SpamAssassin-3.0.2.zip > > sha1sum of archive files: > 1e23f36a0820a6e9e7d9d43262607f3984db2724 > Mail-SpamAssassin-3.0.2.tar.bz2 > be69e72c7351df46de3eeed811219adf35b2964d > Mail-SpamAssassin-3.0.2.tar.gz > 56512e5ef1e7740c61d4e2870081931e42e46f41 Mail-SpamAssassin-3.0.2.zip > > The release files also have a .asc accompanying them. The > file serves as an external GPG signature for the given > release file. The signing key is available via the > wwwkeys.pgp.net key server, as well as > http://spamassassin.apache.org/released/GPG-SIGNING-KEY > > The key information is: > > pub 1024D/265FA05B 2003-06-09 SpamAssassin Signing Key > Key fingerprint =3D 26C9 00A4 6DD4 > 0CD5 AD24 F6D7 DEE0 1987 265F A05B > > SpamAssassin Developers ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Dec 16 19:36:59 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:27:57 2006 Subject: Auto White List working backwards? Message-ID: At 12:47 PM 12/16/2004, Brendan Chard wrote: >5.24 AWL From: address is in the auto white-list >-15.00 BAYES_00 Bayesian spam probability is 0 to 1% >0.14 HTML_FONT_BIG HTML tag for a big font size >0.00 HTML_MESSAGE HTML included in message >0.06 HTML_TEXT_AFTER_BODY HTML contains text after BODY close tag >0.03 HTML_TEXT_AFTER_HTML HTML contains text after HTML close tag >1.02 MIME_HTML_MOSTLY Multipart message mostly text/html MIME >1.30 UNDISC_RECIPS Valid-looking To "undisclosed-recipients" > >Now, that user should be in the auto whitelist, buy why are they accruing a >positive score instead of a negative one? How can I fix this? Don't try to fix it, this is NOT a bug, NOR a problem. It's as designed, perfectly acceptable behavior, as the message still wound up with a large negative total score.. Please read: http://wiki.apache.org/spamassassin/AwlWrongWay ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From derek at ADCATANZARO.COM Thu Dec 16 20:53:47 2004 From: derek at ADCATANZARO.COM (Derek Catanzaro) Date: Thu Jan 12 21:27:57 2006 Subject: Mail not moving from /var/spool/mqueue.in to /var/spool/mqueue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] FC1 MailScanner 4.63 spamassassin 2.63 sendmail 8.12.10 I had a complaint of a delayed email. I checked /var/spool/mqueue.in and there were no recent files. I checked /var/spool/mqueue and it was empty as well. I restarted MS a few times by doing "service MailScanner restart" after about the third time email started accumulating in /var/spool/mqueue.in however, nothing was getting sent to /var/spool/mqueue. I then tried to restart MS again by using the following: service sendmail stop chkconfig sendmail off chkconfig --level 2345 MailScanner on service MailScanner start Same thing, nothing was getting sent to /var/spool/mqueue I decided to bounce the server. After the reboot everything seems to be working. This is not the first time this has happened and I was wondering if anyone has any idea as to what could cause this or how to prevent these instances. At the time I checked the server I was not having any DNS issues and the services said that MailScanner was running. I am sure I'm do for another upgrade (probably go to FC3, use the latest MS, and use spamassassin 3.0). Does anyone know if an upgrade is going to help or has anyone experienced the same issue with the latest and greatest releases? Any suggestions are appreciated. Thanks for your time. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Thu Dec 16 21:23:17 2004 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:27:57 2006 Subject: Mail not moving from /var/spool/mqueue.in to /var/spool/mqueue Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm usually way off base with my answers, so take all of this with a grain of salt. ----- Original Message ----- From: "Derek Catanzaro" To: Sent: Thursday, December 16, 2004 3:53 PM Subject: Mail not moving from /var/spool/mqueue.in to /var/spool/mqueue > FC1 > MailScanner 4.63 This is a future alpha release Mr. Field is working on that will stop all viruses, spam, and rootkits and make updates of kernels obsolete. MS is truly a wonderful product. You probably mean 4.36. > spamassassin 2.63 > sendmail 8.12.10 > > I had a complaint of a delayed email. I checked /var/spool/mqueue.in > and there were no recent files. I checked /var/spool/mqueue and it was > empty as well. I restarted MS a few times by doing "service MailScanner > restart" after about the third time email started accumulating in > /var/spool/mqueue.in however, nothing was getting sent to > /var/spool/mqueue. > What is the amount of mail usually received in any given time? Is there usually a constant flow of mail into the input queue or was this mail just an isolated incident. Most of the time here, not always, expected mail is held upstream for some reason. > I then tried to restart MS again by using the following: > service sendmail stop > chkconfig sendmail off > chkconfig --level 2345 MailScanner on > service MailScanner start > I don't believe you are required to reset the chkconfig levels every time you restart MailScanner. Try issuing "chkconfig --list MailScanner" and "chkconfig --list sendmail" to verify that they are set properly. Your maillog is your friend here. Check to see that sendmail really stopped before you restarted MailScanner. I would suggest using the init script to do all of your MS stopping/starting and always wait for sendmail to tidy up in between the two. > Same thing, nothing was getting sent to /var/spool/mqueue > > I decided to bounce the server. After the reboot everything seems to be > working. This is not the first time this has happened and I was > wondering if anyone has any idea as to what could cause this or how to > prevent these instances. At the time I checked the server I was not > having any DNS issues and the services said that MailScanner was > running. I am sure I'm do for another upgrade (probably go to FC3, use > the latest MS, and use spamassassin 3.0). Does anyone know if an > upgrade is going to help or has anyone experienced the same issue with > the latest and greatest releases? Any suggestions are appreciated. > Newer is probably best, but I don't think this is your problem. Sorry I can't be more specific to provide an answer without more details being provided. > Thanks for your time. > Steve Campbell campbell@cnpapers.com Charleston Newspapers ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Thu Dec 16 22:56:40 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:27:57 2006 Subject: clamav problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Montana M wrote: > This morning i checked my clamav, i got this dns error message. > > freshclam > ClamAV update process started at Thu Dec 16 16:25:49 2004 > WARNING: DNS record is older than 3 hours. > WARNING: Invalid DNS reply. > Reading CVD header (main.cvd): OK > main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: > tomek) > WARNING: DNS record is older than 3 hours. > WARNING: Invalid DNS reply. > Reading CVD header (daily.cvd): OK > daily.cvd is up to date (version: 631, sigs: 1750, f-level: 3, builder: > trog) > > is there something's wrong with my clamav ? No, it's not an error, it's a warning. When DNS records are older than 3 hours it will fall back to checking with the old style GET so there's nothing to worry about. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From itdept at FRACTALWEB.COM Thu Dec 16 23:35:02 2004 From: itdept at FRACTALWEB.COM (Fractal IT Dept.) Date: Thu Jan 12 21:27:57 2006 Subject: outlook meeting requests? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi everyone, Is there anything in MailScanner that might prevent Outlook meeting requests from working properly? I've had our first complaint moments ago, and I'm not sure where to start. Thanks, Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at dfi-intl.com Thu Dec 16 00:00:00 2004 From: eneal at dfi-intl.com (Errol Uriel Neal Jr.) Date: Thu Jan 12 21:27:57 2006 Subject: outlook meeting requests? Message-ID: I'd say the first place to start looking is your mail logs. If the system ate anything, the logs would record the action the logic behind it. Ask your user the basic questions: Who What When And with that, you should be able to determine the why. Errol -----Original Message----- From: "Fractal IT Dept." Date: Thu, 16 Dec 2004 15:35:02 To:MAILSCANNER@JISCMAIL.AC.UK Subject: outlook meeting requests? Hi everyone, Is there anything in MailScanner that might prevent Outlook meeting requests from working properly? I've had our first complaint moments ago, and I'm not sure where to start. Thanks, Chris __________________________________________ Errol Uriel Neal Jr. Network Administrator DFI International, Inc. 1717 Pennsylvania Ave NW, Suite 1300 Washington, DC 20006 Tel (202)452-6955 Fax (202)452-6910 eneal@dfi-intl.com www.dfi-intl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cpicciotto at KALISYSTEMS.COM Thu Dec 16 23:39:33 2004 From: cpicciotto at KALISYSTEMS.COM (Chris Picciotto) Date: Thu Jan 12 21:27:57 2006 Subject: outlook meeting requests? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Have you configured MS to delete (or disarm) email containing scripts? ----- Original Message ----- From: Fractal IT Dept. To: MAILSCANNER@JISCMAIL.AC.UK Sent: Thursday, December 16, 2004 1:35 PM Subject: outlook meeting requests? Hi everyone, Is there anything in MailScanner that might prevent Outlook meeting requests from working properly? I've had our first complaint moments ago, and I'm not sure where to start. Thanks, Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gdoris at ROGERS.COM Fri Dec 17 01:30:01 2004 From: gdoris at ROGERS.COM (Gerry Doris) Date: Thu Jan 12 21:27:57 2006 Subject: just installed MailScanner 4.36 on Fedora core 2 Message-ID: On Thu, 2004-12-16 at 09:51, David Ballengee wrote: > OK I changed configuration so Mailscanner starts on bootup. > > Also made sure line > > DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')dnl > > was commented out. > > Anyway I rebooted the box. MailScanner starts, but no sendmail. > > MailScanner is supposed to start sendmail? > > Any ideas?? MailScanner calls sendmail as required to process mail. Read the MailScanner.conf file to see all the options. -- Gerry Doris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Fri Dec 17 02:35:03 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:57 2006 Subject: installing again fedora core 2 Message-ID: I would do fedora, then; update fedora install clamav user install clamav install webmin install webmin mailscanner module install mailscanner turn on spamassasin What is qpopper? On Thu, 2004-12-16 at 11:23, David Ballengee wrote: > With all the recent problems, I am going to attempt a fresh install. > > how should I go about this. I would like to use Webmin with the install > > this is what I am thinking > > 1. install os (fedora core 2) > 2. install mailscanner > 3. install virus scanning software > 4. install webmin > 5. install webmin module for mailscanner > 6. install qpopper. > > > any thoughts?? > -- > David Ballengee > IT Supervisor > Unique Photo > (973)377-5555x259 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brad at BECKENHAUER.COM Fri Dec 17 04:02:35 2004 From: brad at BECKENHAUER.COM (Brad Beckenhauer) Date: Thu Jan 12 21:27:57 2006 Subject: installing again fedora core 2 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quick google seach on "qpopper" http://www.eudora.com/products/unsupported/qpopper/index.html Qpopper is the most widely-used server for the POP3 protocol (this allows users to access their mail using any POP3 client). Qpopper supports the latest standards, and includes a large number of optional features. Qpopper is normally used with standard UNIX mail transfer and delivery agents such as sendmail or smail. Enjoy! Everything should be as simple as possible but not one bit simpler - Albert Einstein >>> Steve Hickel 12/16/2004 8:35:03 PM >>> I would do fedora, then; update fedora install clamav user install clamav install webmin install webmin mailscanner module install mailscanner turn on spamassasin What is qpopper? On Thu, 2004-12-16 at 11:23, David Ballengee wrote: > With all the recent problems, I am going to attempt a fresh install. > > how should I go about this. I would like to use Webmin with the install > > this is what I am thinking > > 1. install os (fedora core 2) > 2. install mailscanner > 3. install virus scanning software > 4. install webmin > 5. install webmin module for mailscanner > 6. install qpopper. > > > any thoughts?? > -- > David Ballengee > IT Supervisor > Unique Photo > (973)377-5555x259 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Dec 17 12:50:18 2004 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:27:57 2006 Subject: Cleaned up website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have cleaned up the website quite a bit to try to make it easier to > navigate. > Please let me know your thoughts, and any extra suggestions you have. > > -- > Julian Field This one gives a 404 http://www.mailscanner.biz/maq/whatisbayes (referred from http://www.mailscanner.biz/maq/#optimize) regards, - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Fri Dec 17 13:23:28 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:57 2006 Subject: installing again fedora core 2 Message-ID: Thanks Brad! Steve On Thu, 2004-12-16 at 23:02, Brad Beckenhauer wrote: > Quick google seach on "qpopper" > http://www.eudora.com/products/unsupported/qpopper/index.html > > Qpopper is the most widely-used server for the POP3 protocol (this allows users to access their mail using any POP3 client). Qpopper supports the latest standards, and includes a large number of optional features. Qpopper is normally used with standard UNIX mail transfer and delivery agents such as sendmail or smail. > > Enjoy! > > > Everything should be as simple as possible > but not one bit simpler > > - Albert Einstein > > > > >>> Steve Hickel 12/16/2004 8:35:03 PM >>> > I would do fedora, then; > update fedora > install clamav user > install clamav > install webmin > install webmin mailscanner module > install mailscanner > turn on spamassasin > > What is qpopper? > > On Thu, 2004-12-16 at 11:23, David Ballengee wrote: > > With all the recent problems, I am going to attempt a fresh install. > > > > how should I go about this. I would like to use Webmin with the install > > > > this is what I am thinking > > > > 1. install os (fedora core 2) > > 2. install mailscanner > > 3. install virus scanning software > > 4. install webmin > > 5. install webmin module for mailscanner > > 6. install qpopper. > > > > > > any thoughts?? > > -- > > David Ballengee > > IT Supervisor > > Unique Photo > > (973)377-5555x259 > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > MailScanner thanks transtec Computers for their support. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkehler at WRHA.MB.CA Fri Dec 17 14:33:38 2004 From: mkehler at WRHA.MB.CA (Matt Kehler) Date: Thu Jan 12 21:27:57 2006 Subject: MS 'doublespacing' messages? Message-ID: It seems as though Mailscanner is doublespacing certain emails. Initial HTML emails coming in or out of my system are fine, but as soon as a reply happens, from then on seemingly *any* additional reply will doublespace the entire email. So basically, after 4 or 5 replies (lets say with only 2 additional lines of email each), the emails end up being a few pages long; almost all empty spaces. I don't use HTML email so I never really noticed it until people complained, so I'm not sure exactly when it started. I DO have signing rules on to append a signature to outgoing emails. On that note, it will append a signature on EVERY reply going out, even if there already is one. So again, after 5 replies, the email contains 5 (15line) signatures. Combine that with everything being doublespaced...it gets very annyoying. Any ideas? Running MailScanner version 4.33.3 thanks Matt This email and/or any documents in this transmission is intended for the addressee(s) only and may contain legally privileged or confidential information. Any unauthorized use, disclosure, distribution, copying or dissemination is strictly prohibited. If you receive this transmission in error, please notify the sender immediately and return the original. Ce courriel et tout document dans cette transmission est destiné à la personne ou aux personnes à qui il est adressé. Il peut contenir des informations privilégiées ou confidentielles. Toute utilisation, divulgation, distribution, copie, ou diffusion non autorisée est strictement défendue. Si vous n'êtes pas le destinataire de ce message, veuillez en informer l'expéditeur immédiatement et lui remettre l'original. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chuck.foster at STREAMSHIELD.COM Fri Dec 17 14:56:44 2004 From: chuck.foster at STREAMSHIELD.COM (Chuck Foster) Date: Thu Jan 12 21:27:57 2006 Subject: MS 'doublespacing' messages? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Could be a quoted-printable issue? I did notice that the raw files seem to gain an additional =0D=0A at the end of some lines (which seems fine for PDFs) but might impact straight text? Chuck -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Matt Kehler Sent: 17 December 2004 14:34 To: MAILSCANNER@JISCMAIL.AC.UK Subject: MS 'doublespacing' messages? It seems as though Mailscanner is doublespacing certain emails. Initial HTML emails coming in or out of my system are fine, but as soon as a reply happens, from then on seemingly *any* additional reply will doublespace the entire email. So basically, after 4 or 5 replies (lets say with only 2 additional lines of email each), the emails end up being a few pages long; almost all empty spaces. I don't use HTML email so I never really noticed it until people complained, so I'm not sure exactly when it started. I DO have signing rules on to append a signature to outgoing emails. On that note, it will append a signature on EVERY reply going out, even if there already is one. So again, after 5 replies, the email contains 5 (15line) signatures. Combine that with everything being doublespaced...it gets very annyoying. Any ideas? Running MailScanner version 4.33.3 thanks Matt This email and/or any documents in this transmission is intended for the addressee(s) only and may contain legally privileged or confidential information. Any unauthorized use, disclosure, distribution, copying or dissemination is strictly prohibited. If you receive this transmission in error, please notify the sender immediately and return the original. Ce courriel et tout document dans cette transmission est destiné à la personne ou aux personnes à qui il est adressé. Il peut contenir des informations privilégiées ou confidentielles. Toute utilisation, divulgation, distribution, copie, ou diffusion non autorisée est strictement défendue. Si vous n'êtes pas le destinataire de ce message, veuillez en informer l'expéditeur immédiatement et lui remettre l'original. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for all known viruses and dangerous content by StreamShield Protector, and has been found to be clean. This message should be regarded as confidential. If you have received this email in error please notify the sender and destroy it immediately. Statements of intent shall only become binding when confirmed in hard copy by an authorized signatory. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkehler at WRHA.MB.CA Fri Dec 17 15:22:39 2004 From: mkehler at WRHA.MB.CA (Matt Kehler) Date: Thu Jan 12 21:27:57 2006 Subject: MS 'doublespacing' messages? Message-ID: I don't see quoted print installed..should I? This is Perl version 5.006001 (5.6.1) This is MailScanner version 4.33.3 Module versions are: 1.13 Archive::Zip 1.119 Convert::BinHex 1.03 Fcntl 2.6 File::Basename 2.03 File::Copy 2.00 FileHandle 1.0404 File::Path 0.12 File::Temp 1.27 HTML::Entities 3.36 HTML::Parser 2.28 HTML::TokeParser 1.20 IO 1.08 IO::File 1.121 IO::Pipe 3.05 MIME::Base64 5.413 MIME::Decoder 5.413 MIME::Decoder::UU 5.413 MIME::Head 5.413 MIME::Parser 5.413 MIME::Tools 0.09 Net::CIDR 1.03 POSIX 1.72 Socket 0.01 Sys::Syslog 1.01 Time::localtime Optional module versions are: 3.000000 Mail::SpamAssassin 0.29 Net::LDAP missing SAVI 0.13 Mail::ClamAV 0.48 Net::DNS Matt >>> chuck.foster@STREAMSHIELD.COM 12/17/04 08:56AM >>> Could be a quoted-printable issue? I did notice that the raw files seem to gain an additional =0D=0A at the end of some lines (which seems fine for PDFs) but might impact straight text? Chuck -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Matt Kehler Sent: 17 December 2004 14:34 To: MAILSCANNER@JISCMAIL.AC.UK Subject: MS 'doublespacing' messages? It seems as though Mailscanner is doublespacing certain emails. Initial HTML emails coming in or out of my system are fine, but as soon as a reply happens, from then on seemingly *any* additional reply will doublespace the entire email. So basically, after 4 or 5 replies (lets say with only 2 additional lines of email each), the emails end up being a few pages long; almost all empty spaces. I don't use HTML email so I never really noticed it until people complained, so I'm not sure exactly when it started. I DO have signing rules on to append a signature to outgoing emails. On that note, it will append a signature on EVERY reply going out, even if there already is one. So again, after 5 replies, the email contains 5 (15line) signatures. Combine that with everything being doublespaced...it gets very annyoying. Any ideas? Running MailScanner version 4.33.3 thanks Matt This email and/or any documents in this transmission is intended for the addressee(s) only and may contain legally privileged or confidential information. Any unauthorized use, disclosure, distribution, copying or dissemination is strictly prohibited. If you receive this transmission in error, please notify the sender immediately and return the original. Ce courriel et tout document dans cette transmission est destiné à la personne ou aux personnes à qui il est adressé. Il peut contenir des informations privilégiées ou confidentielles. Toute utilisation, divulgation, distribution, copie, ou diffusion non autorisée est strictement défendue. Si vous n'êtes pas le destinataire de ce message, veuillez en informer l'expéditeur immédiatement et lui remettre l'original. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Fri Dec 17 15:36:35 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:57 2006 Subject: MS 'doublespacing' messages? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It comes with MIME::Base64. Matt Kehler wrote: >I don't see quoted print installed..should I? > >This is Perl version 5.006001 (5.6.1) >This is MailScanner version 4.33.3 >Module versions are: >1.13 Archive::Zip >1.119 Convert::BinHex >1.03 Fcntl >2.6 File::Basename >2.03 File::Copy >2.00 FileHandle >1.0404 File::Path >0.12 File::Temp >1.27 HTML::Entities >3.36 HTML::Parser >2.28 HTML::TokeParser >1.20 IO >1.08 IO::File >1.121 IO::Pipe >3.05 MIME::Base64 >5.413 MIME::Decoder >5.413 MIME::Decoder::UU >5.413 MIME::Head >5.413 MIME::Parser >5.413 MIME::Tools >0.09 Net::CIDR >1.03 POSIX >1.72 Socket >0.01 Sys::Syslog >1.01 Time::localtime >Optional module versions are: >3.000000 Mail::SpamAssassin >0.29 Net::LDAP >missing SAVI >0.13 Mail::ClamAV >0.48 Net::DNS > >Matt > > > >>>>chuck.foster@STREAMSHIELD.COM 12/17/04 08:56AM >>> >>>> >>>> > >Could be a quoted-printable issue? I did notice that the raw files seem to gain an additional =0D=0A at the end of some lines (which seems fine for PDFs) but might impact straight text? >Chuck >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On >Behalf Of Matt Kehler >Sent: 17 December 2004 14:34 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: MS 'doublespacing' messages? > >It seems as though Mailscanner is doublespacing certain emails. Initial HTML emails coming in or out of my system are fine, but as soon as a reply happens, from then on seemingly *any* additional reply will doublespace the entire email. So basically, after 4 or 5 replies (lets say with only 2 additional lines of email each), the emails end up being a few pages long; almost all empty spaces. > > >I don't use HTML email so I never really noticed it until people complained, so I'm not sure exactly when it started. I DO have signing rules on to append a signature to outgoing emails. On that note, it will append a signature on EVERY reply going out, even if there already is one. So again, after 5 replies, the email contains 5 (15line) signatures. > > >Combine that with everything being doublespaced...it gets very annyoying. Any ideas? > > >Running MailScanner version 4.33.3 > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brichter at INTERACCESS.COM Fri Dec 17 16:50:48 2004 From: brichter at INTERACCESS.COM (brichter) Date: Thu Jan 12 21:27:57 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: So which product would be the one to be used with Sendmail? The easiest to intigrate. I would really be interested in doing this. We use Sendmail + Mailscanner. I get at least 10,000 messages every 3 days that have to have bounces because of spammers trolling for email addresses. Thanks for any links On Fri, 17 Dec 2004, Errol Neal wrote: > MailScanner would not be the component of the mail gateway to do this. > This job would be the responsibility of the MTA. > If you are using Sendmail, you can use LDAP, or milter-sender. I choose > milter-sender because Imail's LDAP interface is screwy. Minimally > configured, it [milter-sender] can check the destination MTA to verify > that the mailbox actually exists. This is done before the message is > even queued for processing by MailScanner. If the mailbox does not > exists, it rejects the incoming message. When I implemented this some > time ago, I say a 50% drop in the amount of Spam coming into the system > I help manage. > I'm not sure what the other MTA's like Postfix or Exim provide. > > Errol > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Casanova, Chase > Sent: Friday, December 17, 2004 10:48 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Share real email addresses between MailScanner and Exchange > > Is there a way for Exchange and MailScanner to share their "address > books?" That way MailScanner could tell the difference between real and > fake addresses and just stop processing emails that Exchange does not > have a mailbox for? This would be a nice thing to have. > > Thanks, > Chase > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brichter at INTERACCESS.COM Fri Dec 17 16:56:44 2004 From: brichter at INTERACCESS.COM (brichter) Date: Thu Jan 12 21:27:57 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: I should also note that the 10,000 messages are the dead messages I can account fo.r. And I am hoping that their is something I can integrate with Sendmail without re-compiling anything. I can have whatever it is communicate back to an exchange 2003 server or an AD server if need be. On Fri, 17 Dec 2004, brichter wrote: > So which product would be the one to be used with Sendmail? > > The easiest to intigrate. I would really be interested in doing this. We > use Sendmail + Mailscanner. I get at least 10,000 messages every 3 days > that have to have bounces because of spammers trolling for email > addresses. > > Thanks for any links > > > On Fri, 17 Dec 2004, Errol Neal wrote: > > > MailScanner would not be the component of the mail gateway to do this. > > This job would be the responsibility of the MTA. > > If you are using Sendmail, you can use LDAP, or milter-sender. I choose > > milter-sender because Imail's LDAP interface is screwy. Minimally > > configured, it [milter-sender] can check the destination MTA to verify > > that the mailbox actually exists. This is done before the message is > > even queued for processing by MailScanner. If the mailbox does not > > exists, it rejects the incoming message. When I implemented this some > > time ago, I say a 50% drop in the amount of Spam coming into the system > > I help manage. > > I'm not sure what the other MTA's like Postfix or Exim provide. > > > > Errol > > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > > Behalf Of Casanova, Chase > > Sent: Friday, December 17, 2004 10:48 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Share real email addresses between MailScanner and Exchange > > > > Is there a way for Exchange and MailScanner to share their "address > > books?" That way MailScanner could tell the difference between real and > > fake addresses and just stop processing emails that Exchange does not > > have a mailbox for? This would be a nice thing to have. > > > > Thanks, > > Chase > > > > ------------------------ MailScanner list ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Fri Dec 17 16:58:35 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:27:57 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Casanova, Chase wrote: > Is there a way for Exchange and MailScanner to share their "address books?" That way MailScanner could tell the difference between real and fake addresses and just stop processing emails that Exchange does not have a mailbox for? This would be a nice thing to have. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and This can be found in the MAQ that is referenced in every post to this list. http://www.mailscanner.biz/maq/#whatifijust -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at DFI-INTL.COM Fri Dec 17 16:55:42 2004 From: eneal at DFI-INTL.COM (Errol Neal) Date: Thu Jan 12 21:27:57 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: If you use milter-sender, you'll need to compile libmilter in sendmail. Milter-sender is not that hard to setup. It's much easier than LDAP IMHO. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of brichter Sent: Friday, December 17, 2004 11:57 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Share real email addresses between MailScanner and Exchange I should also note that the 10,000 messages are the dead messages I can account fo.r. And I am hoping that their is something I can integrate with Sendmail without re-compiling anything. I can have whatever it is communicate back to an exchange 2003 server or an AD server if need be. On Fri, 17 Dec 2004, brichter wrote: > So which product would be the one to be used with Sendmail? > > The easiest to intigrate. I would really be interested in doing this. > We use Sendmail + Mailscanner. I get at least 10,000 messages every 3 > days that have to have bounces because of spammers trolling for email > addresses. > > Thanks for any links > > > On Fri, 17 Dec 2004, Errol Neal wrote: > > > MailScanner would not be the component of the mail gateway to do this. > > This job would be the responsibility of the MTA. > > If you are using Sendmail, you can use LDAP, or milter-sender. I > > choose milter-sender because Imail's LDAP interface is screwy. > > Minimally configured, it [milter-sender] can check the destination > > MTA to verify that the mailbox actually exists. This is done before > > the message is even queued for processing by MailScanner. If the > > mailbox does not exists, it rejects the incoming message. When I > > implemented this some time ago, I say a 50% drop in the amount of > > Spam coming into the system I help manage. > > I'm not sure what the other MTA's like Postfix or Exim provide. > > > > Errol > > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > On Behalf Of Casanova, Chase > > Sent: Friday, December 17, 2004 10:48 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Share real email addresses between MailScanner and Exchange > > > > Is there a way for Exchange and MailScanner to share their "address > > books?" That way MailScanner could tell the difference between real > > and fake addresses and just stop processing emails that Exchange > > does not have a mailbox for? This would be a nice thing to have. > > > > Thanks, > > Chase > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Dec 17 17:04:27 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:57 2006 Subject: Serious problems running Mailscanner Message-ID: Richard when you upgraded did you run the uprade_SailScanner_conf script?? Also how did you upgrade - apt, tar style??? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Richard Thomas wrote: > We recently upgraded our Mailscanner to 4.36.4 Suddenly, we were losing > a lot of messages with a "Could not analyze message" errors. Also, doing > a ps -ef, there was the original Mailscanner job and its spawned > children but a lot of additional Mailscanner jobs (at one point reaching > over 790) with parent process IDs of 1. > > We lost a lot of emails. They got thrown into quarantine but without > headers so I am now working on getting them out to the correct people. > > Currently, I am running mailscanner in foreground and debug modes using > the watch command. This seems to work fine and we haven't lost any > messages. However, we are still getting errors like > > Could not get to parent of incoming work directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 187. > and > Can't unlink file > /var/spool/MailScanner/incoming/5243/1CfKnq-0000m6-DL/msg-5243-39.html: > No such file or directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > Can't remove directory > /var/spool/MailScanner/incoming/5243/1CfKp8-0000zU-Ny: No such file or > directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > and can't restore permissions to 0700 > at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > > We have a dual CPU system and are running Debian and Exim. > > Does anyone have any insight into this? > > Rich > > -- > MIS Department | |Phone: +1 615 312 5787 > 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 > Suite 460 | | > Franklin, TN 37067 | | > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Fri Dec 17 16:45:38 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:57 2006 Subject: Serious problems running Mailscanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] We recently upgraded our Mailscanner to 4.36.4 Suddenly, we were losing a lot of messages with a "Could not analyze message" errors. Also, doing a ps -ef, there was the original Mailscanner job and its spawned children but a lot of additional Mailscanner jobs (at one point reaching over 790) with parent process IDs of 1. We lost a lot of emails. They got thrown into quarantine but without headers so I am now working on getting them out to the correct people. Currently, I am running mailscanner in foreground and debug modes using the watch command. This seems to work fine and we haven't lost any messages. However, we are still getting errors like Could not get to parent of incoming work directory at /usr/share/MailScanner/MailScanner/WorkArea.pm line 187. and Can't unlink file /var/spool/MailScanner/incoming/5243/1CfKnq-0000m6-DL/msg-5243-39.html: No such file or directory at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 Can't remove directory /var/spool/MailScanner/incoming/5243/1CfKp8-0000zU-Ny: No such file or directory at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 and can't restore permissions to 0700 at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 We have a dual CPU system and are running Debian and Exim. Does anyone have any insight into this? Rich -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From martinh at SOLID-STATE-LOGIC.COM Fri Dec 17 17:09:51 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:58 2006 Subject: Serious problems running Mailscanner Message-ID: Richard have you checked the permissions on all the files like the work area etc. As it's running in debug mode (probably as root) I'd check that all the files in the /var/spool/MailScanner/incoming/ are wriable by the User as defined in MailScanner.conf -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Richard Thomas wrote: > We recently upgraded our Mailscanner to 4.36.4 Suddenly, we were losing > a lot of messages with a "Could not analyze message" errors. Also, doing > a ps -ef, there was the original Mailscanner job and its spawned > children but a lot of additional Mailscanner jobs (at one point reaching > over 790) with parent process IDs of 1. > > We lost a lot of emails. They got thrown into quarantine but without > headers so I am now working on getting them out to the correct people. > > Currently, I am running mailscanner in foreground and debug modes using > the watch command. This seems to work fine and we haven't lost any > messages. However, we are still getting errors like > > Could not get to parent of incoming work directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 187. > and > Can't unlink file > /var/spool/MailScanner/incoming/5243/1CfKnq-0000m6-DL/msg-5243-39.html: > No such file or directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > Can't remove directory > /var/spool/MailScanner/incoming/5243/1CfKp8-0000zU-Ny: No such file or > directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > and can't restore permissions to 0700 > at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > > We have a dual CPU system and are running Debian and Exim. > > Does anyone have any insight into this? > > Rich > > -- > MIS Department | |Phone: +1 615 312 5787 > 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 > Suite 460 | | > Franklin, TN 37067 | | > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brose at MED.WAYNE.EDU Fri Dec 17 17:32:14 2004 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: Milter-sender doesn't check recipient addresses so it's not going to know who your local users are. I use milter-sender as well but use ldap for checking local recipeints. The ldap directory determines the final destination aka exchange environment. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Errol Neal Sent: Friday, December 17, 2004 11:00 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Share real email addresses between MailScanner and Exchange MailScanner would not be the component of the mail gateway to do this. This job would be the responsibility of the MTA. If you are using Sendmail, you can use LDAP, or milter-sender. I choose milter-sender because Imail's LDAP interface is screwy. Minimally configured, it [milter-sender] can check the destination MTA to verify that the mailbox actually exists. This is done before the message is even queued for processing by MailScanner. If the mailbox does not exists, it rejects the incoming message. When I implemented this some time ago, I say a 50% drop in the amount of Spam coming into the system I help manage. I'm not sure what the other MTA's like Postfix or Exim provide. Errol -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Casanova, Chase Sent: Friday, December 17, 2004 10:48 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Share real email addresses between MailScanner and Exchange Is there a way for Exchange and MailScanner to share their "address books?" That way MailScanner could tell the difference between real and fake addresses and just stop processing emails that Exchange does not have a mailbox for? This would be a nice thing to have. Thanks, Chase ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brose at MED.WAYNE.EDU Fri Dec 17 17:34:28 2004 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: I think your confusing milter-sender with milter-ahead. Milter-sender just does call backs to validate the sender not the recipient. http://www.milter.info/ -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Errol Neal Sent: Friday, December 17, 2004 11:31 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Share real email addresses between MailScanner and Exchange If you are asking about milter-sender, here is the link: http://www.milter.info/milter-sender/index.shtml Milter-sender works via SMTP. It does a call ahead to verify the RCPT with the next hop. It relies on the mailterable. So, to answer your question, it ca work on vintage Exchange so long as your servers supports SMTP. Errol -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Kevin Miller Sent: Friday, December 17, 2004 11:17 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Share real email addresses between MailScanner and Exchange Casanova, Chase wrote: > If you are using Sendmail, you can use LDAP, or milter-sender. I > choose Have a link to that? Does it work with either AD or vintage Exchange (5.5)? TIA... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at ERUS.CO.UK Fri Dec 17 17:25:24 2004 From: alex at ERUS.CO.UK (Alex Pimperton) Date: Thu Jan 12 21:27:58 2006 Subject: Serious problems running Mailscanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Richard Thomas wrote: > We recently upgraded our Mailscanner to 4.36.4 Suddenly, we were losing > a lot of messages with a "Could not analyze message" errors. Also, doing > a ps -ef, there was the original Mailscanner job and its spawned > children but a lot of additional Mailscanner jobs (at one point reaching > over 790) with parent process IDs of 1. > > We lost a lot of emails. They got thrown into quarantine but without > headers so I am now working on getting them out to the correct people. > > Currently, I am running mailscanner in foreground and debug modes using > the watch command. This seems to work fine and we haven't lost any > messages. However, we are still getting errors like > > Could not get to parent of incoming work directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 187. > and > Can't unlink file > /var/spool/MailScanner/incoming/5243/1CfKnq-0000m6-DL/msg-5243-39.html: > No such file or directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > Can't remove directory > /var/spool/MailScanner/incoming/5243/1CfKp8-0000zU-Ny: No such file or > directory at > /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > and can't restore permissions to 0700 > at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 > > We have a dual CPU system and are running Debian and Exim. > > Does anyone have any insight into this? > > Rich This isn's a solution, but I had the same problem a while ago with Exim on Debian Sarge. I tried just about everything suggested by the list, and still couldnt get it working so I removed Exim and installed Postfix and then installed MailScanner and that fixed the problem. I don't want to start a MTA flame war but I have had several problems with exim that I havn't had postfix, including the one above. Alex ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Dec 17 17:48:48 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: Kevin there's some scripts floating around tyhe 'net that grab the ldap info from AD and make a postfix equivalent of the sendmail /etc/mail/access file They are batch jobs rather than on the fly checks (so do them once a day or so to update), but you might be able to mangle them to cope with sendmail. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Kevin Miller wrote: > Steve Swaney wrote: > >>I believe that milter-sender only works with Exchange 2003 because >>Exchange 2000 and 5.5 cannot be configured to reject email for >>non-existent users. In 2003 the default install also blindly accepts >>email for any username. You must specifically re-configure Exchange >>to reject email for non-existent users. > > > Thanks Steve, > > We're rolling to 2003 in a few months so I guess I'll put off science > experiments until then. Sure will be a lot easier than hand rolling the > /etc/mail/access file! > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Fri Dec 17 17:42:40 2004 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: Steve Swaney wrote: > > I believe that milter-sender only works with Exchange 2003 because > Exchange 2000 and 5.5 cannot be configured to reject email for > non-existent users. In 2003 the default install also blindly accepts > email for any username. You must specifically re-configure Exchange > to reject email for non-existent users. Thanks Steve, We're rolling to 2003 in a few months so I guess I'll put off science experiments until then. Sure will be a lot easier than hand rolling the /etc/mail/access file! ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bart at TEXAN.NET Fri Dec 17 17:40:42 2004 From: bart at TEXAN.NET (Bart E. Hawley Sr.) Date: Thu Jan 12 21:27:58 2006 Subject: Major features? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Very late into the fray on this, but I have not seen mentioned the one major feature that should be noticed by us poor slobs in the IT department. Site wide config + per-user config So that the pointy haired boss can continue to receive his OH so important MLM mail, while the sensible people aren't inundated with the same cruft. As well as protecting against the encrypted zip viruses while still allowing departments to receive the all important encrypted zips containing legal/vital information files. Thanks for the sanity-saving MailScanner Julian! Bart E Hawley Sr. using MailScanner in front of or on everything including Exchange. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Fri Dec 17 18:09:25 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ah the relay_recipient_maps feature of postfix will do this nicely, with a bit of scripting. I never went hunting for ready-made scripts, and ended up rolling my own around ldapsearch... It's really not rocket sience:-).The important thing is to look at proxyAddress (else you miss aliases etc)... And remember that M-Sexchange have a ridiculous amount of "local only admin type addresses" that you really shouldn't expose. I run it once every 15 minutes, so that the M$-techies don't have to bother with it:-):-). Upon request I might be pestered to share a "sanitized" version. -- Glenn -----Original Message----- From: MailScanner mailing list on behalf of Martin Hepworth Sent: fr 2004-12-17 18:48 To: MAILSCANNER@JISCMAIL.AC.UK Cc: Subject: Re: Share real email addresses between MailScanner and Exchange Kevin there's some scripts floating around tyhe 'net that grab the ldap info from AD and make a postfix equivalent of the sendmail /etc/mail/access file They are batch jobs rather than on the fly checks (so do them once a day or so to update), but you might be able to mangle them to cope with sendmail. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Kevin Miller wrote: > Steve Swaney wrote: > >>I believe that milter-sender only works with Exchange 2003 because >>Exchange 2000 and 5.5 cannot be configured to reject email for >>non-existent users. In 2003 the default install also blindly accepts >>email for any username. You must specifically re-configure Exchange >>to reject email for non-existent users. > > > Thanks Steve, > > We're rolling to 2003 in a few months so I guess I'll put off science > experiments until then. Sure will be a lot easier than hand rolling the > /etc/mail/access file! > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at DFI-INTL.COM Fri Dec 17 18:03:54 2004 From: eneal at DFI-INTL.COM (Errol Neal) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: Nope. I user milter-sender but I only use the CallAhead -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rose, Bobby Sent: Friday, December 17, 2004 12:34 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Share real email addresses between MailScanner and Exchange I think your confusing milter-sender with milter-ahead. Milter-sender just does call backs to validate the sender not the recipient. http://www.milter.info/ -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Errol Neal Sent: Friday, December 17, 2004 11:31 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Share real email addresses between MailScanner and Exchange If you are asking about milter-sender, here is the link: http://www.milter.info/milter-sender/index.shtml Milter-sender works via SMTP. It does a call ahead to verify the RCPT with the next hop. It relies on the mailterable. So, to answer your question, it ca work on vintage Exchange so long as your servers supports SMTP. Errol -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Kevin Miller Sent: Friday, December 17, 2004 11:17 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Share real email addresses between MailScanner and Exchange Casanova, Chase wrote: > If you are using Sendmail, you can use LDAP, or milter-sender. I > choose Have a link to that? Does it work with either AD or vintage Exchange (5.5)? TIA... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Leonard.Hermens at POTLATCHCORP.COM Fri Dec 17 18:21:39 2004 From: Leonard.Hermens at POTLATCHCORP.COM (Leonard Hermens) Date: Thu Jan 12 21:27:58 2006 Subject: Dangerous attachment according to Microsoft Q883260 Message-ID: At 10:01 AM 12/17/2004, Stewart Ives wrote: >I have searched the MS site and the archives and can't find any >reference to this MS Q#. Hello, You are probably being referred to the "unsafe" attachment list that Microsoft publishes: http://support.microsoft.com/default.aspx?scid=kb;en-us;883260 My list is longer than theirs. :) -- Leonard ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ivessm at softecusa.com Fri Dec 17 18:01:10 2004 From: ivessm at softecusa.com (Stewart Ives) Date: Thu Jan 12 21:27:58 2006 Subject: Dangerous attachment according to Microsoft Q883260 Message-ID: I have searched the MS site and the archives and can't find any reference to this MS Q#. Does anyone have some info on it?? This is a response fm MailScanner when it tagged a zipped attachment as thus and removed the attachment. Thanks and this is a REALLY GREAT PROGRAM!!!! stew ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Fri Dec 17 18:31:30 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: Major features? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks! Bart E. Hawley Sr. wrote: > Very late into the fray on this, but I have not seen mentioned the one > major feature that should be noticed by us poor slobs in the IT > department. > > Site wide config + per-user config > > So that the pointy haired boss can continue to receive his OH so > important MLM mail, while the sensible people aren't inundated with the > same cruft. > As well as protecting against the encrypted zip viruses while still > allowing departments to receive the all important encrypted zips > containing legal/vital information files. > > Thanks for the sanity-saving MailScanner Julian! > > Bart E Hawley Sr. > using MailScanner in front of or on > everything including Exchange. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Fri Dec 17 18:46:42 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Errol Neal > Sent: Friday, December 17, 2004 1:04 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Share real email addresses between MailScanner and Exchange > > Nope. I user milter-sender but I only use the CallAhead > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Rose, Bobby > Sent: Friday, December 17, 2004 12:34 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Share real email addresses between MailScanner and Exchange > > I think your confusing milter-sender with milter-ahead. Milter-sender > just does call backs to validate the sender not the recipient. > > http://www.milter.info/ > Sorry, wasn't paying attention on the milter-sender dialog. It's milter-ahead you want to use for this look-ahead capability. While milter-sender can also check for the ability to deliver mail to the final/next destination, milter-ahead is a lot more sophisticated in how it handles errors and caching. I did quit a bit of testing and was very impressed with the program. The milter-ahead site: http://www.milter.info/milter-ahead/ I've also just put instructions for configuring Exchange 2003 to reject email for unknown recipients on our web site. They are available at: www.fsl.com/support - Milter-ahead and Exchange settings Hope this helps, Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KGoods at AIAINSURANCE.COM Fri Dec 17 18:49:58 2004 From: KGoods at AIAINSURANCE.COM (Ken Goods) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: Casanova, Chase [mailto:Chase.Casanova@RDU.COM] >Sent: Friday, December 17, 2004 7:48 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: [MAILSCANNER] Share real email addresses between MailScanner >and Exchange >Is there a way for Exchange and MailScanner to share their "address books?" >That way MailScanner could tell the difference between real and fake addresses >and just stop processing emails that Exchange does not have a mailbox for? >This would be a nice thing to have. >Thanks, >Chase Funny this should come up. I just implemented this very thing this morning and it's working splendidly. There are several ways to do this as I'm sure you've already found out. :) And by now I'm sure you realize this isn't a job for MailScanner. I chose the simplest route for *my* environment YMMV. I used to use SBL-XBL to reject at the MTA (sendmail) but one of our business partners got themselves blacklisted so I had to allow this traffic on Tuesday. This effectively almost tripled our inbound email and the load on our gateway email server went up to the point of sendmail rejecting connections (load 12+). So I *had* to do something. I researched the groups and googled around most of the day yesterday looking for the least painful way of doing this. I chose to use the virtusertable route. My initial thought was to use the access (access.db) table but found out that it does not look at users, only domains. I don't have that many email boxes on my exchange (5.5) server (about 75 or so) and they don't change that often so I have no problem hand rolling the virtusertable and keeping it up to date as people come and go. I simply exported all the email recipients out of exchange into a file then wrote a small VB program to parse the file and write it in virtusertable format, then ran it through todos32 to create a *nix formatted file and copied it to the server. Since I have 4 email domains on the exchange box I had to create a file with my domains in it (I named it virtuser-domain) and put it in /etc/mail. I then had to add one single line to my sendmail.mc: VIRTUSER_DOMAIN_FILE(`/etc/mail/virtuser-domain')dnl and then m4 sendmail.mc sendmail.cf I then did a "service MailScanner stop" and a "service MailScanner start" and whalla... done! I didn't even have to "makefile hash virtusertable.db < virtusertable" it just worked! (don't ask me why) The time it took to actually implement this change was about a half hour. Time reading and researching the somewhat frustrating and incomplete directions/info I found around the net ~8 hours. I can recommend this method fully if: 1. You don't have thousands of users, and 2. Your user base doesn't change on a daily basis If that were the case I would look harder at LDAP or at lease scripting what I did and scheduling it. If this sounds like it may work for you respond with any questions you may have. I'd also be happy to send copies of the files in question so you would have "real" examples. HTH Ken Ken Goods Network Administrator AIA Insurance, Inc. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From robshep at INFORMATICS.BANGOR.AC.UK Fri Dec 17 19:05:06 2004 From: robshep at INFORMATICS.BANGOR.AC.UK (Rob Shepherd) Date: Thu Jan 12 21:27:58 2006 Subject: MIME::tools failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Trying to install the patched version of MIME-tools-5.411 from http://www.sng.ecs.soton.ac.uk/mailscanner/files/modules/MIME-tools-5.411-patched.tar.gz on Solaris 9, perl 5.8.2 Some Misc tests fail. the following is the contents of testout/Misc.tlog ------------------------------------------ 1..7 1: bug 971008-MWN: are MIME attributes parsed ok? 1: A: "application/vnd.ms-powerpoint" 1: B: "application/vnd.ms-powerpoint" 1: ok 1 2: bug 970822-AL: Mail::Field register problem (paramstr) 2: A: "text/HTML" 2: B: "text/HTML" 2: ok 2 3: bug 970822-AL: Mail::Field register problem (type) 3: A: "text/html" 3: B: "text/html" 3: ok 3 4: bug 970725-DNA: QP use of RFC2049 guideline 8 4: A: "=46rom me=\n" 4: B: "=46rom me" 4: not ok 4 5: bug 970725-DNA: QP use of RFC2049 guideline 8 5: A: ".=\n" 5: B: "=2E" 5: not ok 5 6: bug 970725-DNA: QP use of RFC2049 guideline 8 6: A: " From you=\n" 6: B: " From you" 6: not ok 6 7: bug 970626-TS: header get_all() case problem fixed? 7: A: "4" 7: B: "4" 7: ok 7 END ----------------------------------------- As you can see some minor errors. Does anybody know what is wrong? I am no perl expert. Many thanks Rob -- /** * Rob Shepherd, * University Of Wales, Bangor, * School of Informatics, * Dean Street, * Bangor, * Gwynedd, UK /\ /\ * LL57 1UT / \/ \ /\ * --------------/---/ \--\---- * * robshep@informatics.bangor.ac.uk * * +44 (0) 1248 38 27 */ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From mailscanner at ecs.soton.ac.uk Fri Dec 17 19:24:25 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: MIME::tools failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] There have since been newer versions released, which you should use with new versions of MailScanner. The tar distribution of MailScanner includes all the parts, which you should install by running ./install.sh from within the unpacked distribution directory. I must update the docs some time, maybe that's a job for Christmas. I've got some work to do on the book as well, to add docs for the latest features to keep it up to date. Rob Shepherd wrote: > Trying to install the patched version of MIME-tools-5.411 from > > http://www.sng.ecs.soton.ac.uk/mailscanner/files/modules/MIME-tools-5.411-patched.tar.gz > > > on Solaris 9, perl 5.8.2 > > Some Misc tests fail. > > the following is the contents of testout/Misc.tlog > > ------------------------------------------ > 1..7 > > 1: bug 971008-MWN: are MIME attributes parsed ok? > 1: A: "application/vnd.ms-powerpoint" > 1: B: "application/vnd.ms-powerpoint" > 1: ok 1 > > 2: bug 970822-AL: Mail::Field register problem (paramstr) > 2: A: "text/HTML" > 2: B: "text/HTML" > 2: ok 2 > > 3: bug 970822-AL: Mail::Field register problem (type) > 3: A: "text/html" > 3: B: "text/html" > 3: ok 3 > > 4: bug 970725-DNA: QP use of RFC2049 guideline 8 > 4: A: "=46rom me=\n" > 4: B: "=46rom me" > 4: not ok 4 > > 5: bug 970725-DNA: QP use of RFC2049 guideline 8 > 5: A: ".=\n" > 5: B: "=2E" > 5: not ok 5 > > 6: bug 970725-DNA: QP use of RFC2049 guideline 8 > 6: A: " From you=\n" > 6: B: " From you" > 6: not ok 6 > > 7: bug 970626-TS: header get_all() case problem fixed? > 7: A: "4" > 7: B: "4" > 7: ok 7 > > END > ----------------------------------------- > > As you can see some minor errors. Does anybody know what is wrong? > > I am no perl expert. > > Many thanks > > Rob -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dom at VBI.VT.EDU Fri Dec 17 19:26:15 2004 From: dom at VBI.VT.EDU (Dominik L. Borkowski) Date: Thu Jan 12 21:27:58 2006 Subject: adding custom spam headers Message-ID: Hello, Recently we integrated our existing spamassassin installation with mailscanner. One thing that is causing us a headache is the fact that previously with SA we had by default an extra header added to all e-mails marked as spam: X-Spam-Status: YES Now, looking through all the docs I could not find a way how to add that header to e-mails flagged as spam by SA+mailscanner. Even adding custom rules in spam.assassin.prefs.conf doesn't work. I guess my question is: is there any way to add that extra header? This would be less time consuming than changing our users' filters. any hints would be greatly appreciated, sincerely, dom ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Fri Dec 17 19:40:48 2004 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:27:58 2006 Subject: file sizes and scanning Message-ID: I know that files over N bytes (settable in the conf file) aren't spam scanned, but am umclear as to whether they are subsequently virus scanned. Is that skipped too, or is it just the spam filtering that is circumvented? Thanks... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Dec 17 19:52:58 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:27:58 2006 Subject: file sizes and scanning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kevin Miller wrote: > I know that files over N bytes (settable in the conf file) aren't spam > scanned, but am umclear as to whether they are subsequently virus > scanned. Is that skipped too, or is it just the spam filtering that > is circumvented? > Kevin, Everything is virus scanned. The first X bytes (defaults to 30000) of every attachment is also scanned by SA. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From mailscanner at ecs.soton.ac.uk Fri Dec 17 20:12:16 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: adding custom spam headers Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] In MailScanner.conf, set Spam Header = X-Spam-Status: Detailed Spam Report = no And in /etc/MailScanner/reports/en/languages.conf, set Spam = YES and you should be able to get the header you want. Dominik L. Borkowski wrote: >Hello, >Recently we integrated our existing spamassassin installation with >mailscanner. One thing that is causing us a headache is the fact that >previously with SA we had by default an extra header added to all e-mails >marked as spam: > >X-Spam-Status: YES > >Now, looking through all the docs I could not find a way how to add that >header to e-mails flagged as spam by SA+mailscanner. Even adding custom rules >in spam.assassin.prefs.conf doesn't work. > >I guess my question is: is there any way to add that extra header? This would >be less time consuming than changing our users' filters. > >any hints would be greatly appreciated, >sincerely, >dom > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Fri Dec 17 20:14:11 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: file sizes and scanning Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Kevin Miller wrote: > >> I know that files over N bytes (settable in the conf file) aren't >> spam scanned, but am umclear as to whether they are subsequently >> virus scanned. Is that skipped too, or is it just the spam filtering >> that is circumvented? >> > > Everything is virus scanned. The first X bytes (defaults to 30000) of > every attachment is also scanned by SA. Just to confirm, files over N bytes are spam scanned, just only the first N bytes of them. You don't need the whole of a 100MByte mail message to decide if it is spam or not, so I don't waste time making it handle the whole message when it's huge. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Fri Dec 17 22:00:33 2004 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:27:58 2006 Subject: OT: SPF comments requested Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It seems that the MS mailing list is somewhat authoritative on so many things dealing with MS, Sendmail, SA, and this list is probably the only one that is up on all three, I would like to hear comments from the opinionated that are listening. I'm not sure if the SPF thing is something all of us should be dealing with _now_, but if we all should be updating our DNS records, I'd like to hear about some ideas from the list. I have gleaned as much as I can absorb from all of the different sites required to explore implementing SPF, and I'm still not sure how to use it other than setting up my DNS so others can use it. As I understand this, I have many options on how to use it for our protection. Much like RBLs, I can set this up in Sendmail, or use the SPF functions of SA, and probably a few more. And the same reasons for deciding this are basicly the same as for using RBLs. If anyone would like to comment to me off-list to keep the clutter out of the archives, I would really like to hear opinions, experiences, and any other words of wisdom about the best way to implement this SPF thing and it current importance. Such things as "Is the SA modules really sufficient for blocking", and the like would be along the lines I require. Thank you for any responses. Steve Campbell campbell@cnpapers.com Charleston Newspapers ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Fri Dec 17 22:28:10 2004 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:27:58 2006 Subject: file sizes and scanning Message-ID: Julian Field wrote: > Denis Beauchemin wrote: > >> Kevin Miller wrote: >> >>> I know that files over N bytes (settable in the conf file) aren't >>> spam scanned, but am umclear as to whether they are subsequently >>> virus scanned. Is that skipped too, or is it just the spam >>> filtering that is circumvented? >>> >> >> Everything is virus scanned. The first X bytes (defaults to 30000) >> of every attachment is also scanned by SA. > > Just to confirm, files over N bytes are spam scanned, just only the > first N bytes of them. You don't need the whole of a 100MByte mail > message to decide if it is spam or not, so I don't waste time making > it handle the whole message when it's huge. Thanks guys for the clarification. That makes a lot of sense. (Senior moment here: why did I expect less!) Have a great weekend... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Sat Dec 18 05:35:31 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:58 2006 Subject: Share real email addresses between MailScanner and Exchange Message-ID: Right... If you only have a dozen or so users it's easier to add To:legitimateuser@yourdomain.com OK To:anotherlegituser@yourdomain.com OK To:yourdomain.com mailbox doesn't exist That's what I've done when there are less than two dozen users. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Ken Goods Sent: Friday, December 17, 2004 1:50 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Share real email addresses between MailScanner and Exchange >-----Original Message----- >From: Casanova, Chase [mailto:Chase.Casanova@RDU.COM] >Sent: Friday, December 17, 2004 7:48 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: [MAILSCANNER] Share real email addresses between MailScanner >and Exchange >Is there a way for Exchange and MailScanner to share their "address books?" >That way MailScanner could tell the difference between real and fake addresses >and just stop processing emails that Exchange does not have a mailbox for? >This would be a nice thing to have. >Thanks, >Chase Funny this should come up. I just implemented this very thing this morning and it's working splendidly. There are several ways to do this as I'm sure you've already found out. :) And by now I'm sure you realize this isn't a job for MailScanner. I chose the simplest route for *my* environment YMMV. I used to use SBL-XBL to reject at the MTA (sendmail) but one of our business partners got themselves blacklisted so I had to allow this traffic on Tuesday. This effectively almost tripled our inbound email and the load on our gateway email server went up to the point of sendmail rejecting connections (load 12+). So I *had* to do something. I researched the groups and googled around most of the day yesterday looking for the least painful way of doing this. I chose to use the virtusertable route. My initial thought was to use the access (access.db) table but found out that it does not look at users, only domains. I don't have that many email boxes on my exchange (5.5) server (about 75 or so) and they don't change that often so I have no problem hand rolling the virtusertable and keeping it up to date as people come and go. I simply exported all the email recipients out of exchange into a file then wrote a small VB program to parse the file and write it in virtusertable format, then ran it through todos32 to create a *nix formatted file and copied it to the server. Since I have 4 email domains on the exchange box I had to create a file with my domains in it (I named it virtuser-domain) and put it in /etc/mail. I then had to add one single line to my sendmail.mc: VIRTUSER_DOMAIN_FILE(`/etc/mail/virtuser-domain')dnl and then m4 sendmail.mc sendmail.cf I then did a "service MailScanner stop" and a "service MailScanner start" and whalla... done! I didn't even have to "makefile hash virtusertable.db < virtusertable" it just worked! (don't ask me why) The time it took to actually implement this change was about a half hour. Time reading and researching the somewhat frustrating and incomplete directions/info I found around the net ~8 hours. I can recommend this method fully if: 1. You don't have thousands of users, and 2. Your user base doesn't change on a daily basis If that were the case I would look harder at LDAP or at lease scripting what I did and scheduling it. If this sounds like it may work for you respond with any questions you may have. I'd also be happy to send copies of the files in question so you would have "real" examples. HTH Ken Ken Goods Network Administrator AIA Insurance, Inc. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Sat Dec 18 10:12:58 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:27:58 2006 Subject: Mailserver replacement of exchange Message-ID: Does anyone has a good alternative for MS exchange (groupware) in the opensource world? If it is possible an outlook client must be able to connect to it. thanks Koen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Sat Dec 18 10:17:56 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:27:58 2006 Subject: What's the best web config GUI for a mailscanner server Message-ID: I there allready a GUI where you can fully configure your Mailscanner config + Spamassaain +Antivirus and your serverconfig (hostname IP, ...) +MTA config (blacklists ...) And also that the user can blacklist + trean spam/ham.personally tere settings? Like baracuda, maybe others thanks Koen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sat Dec 18 10:27:03 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:58 2006 Subject: What's the best web config GUI for a mailscanner server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Koen Teugels wrote: > I there allready a GUI where you can fully configure your Mailscanner > config + Spamassaain +Antivirus and your serverconfig (hostname IP, ...) > +MTA config (blacklists ...) And also that the user can blacklist + > trean spam/ham.personally tere settings? Like baracuda, maybe others > The closest you will find for that lot will be Webmin (www.webmin.com) with the MailScanner additional module (Like on the MS site I think) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Sat Dec 18 11:24:19 2004 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:27:58 2006 Subject: Mailserver replacement of exchange Message-ID: Koen Teugels wrote: > Does anyone has a good alternative for MS exchange (groupware) in the > opensource world? If it is possible an outlook client must be able to > connect to it. > > thanks Koen > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! I have a few SuSE OpenExchange servers and they work fine. Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From denis at CROOMBS.ORG Sat Dec 18 11:35:02 2004 From: denis at CROOMBS.ORG (Denis Croombs) Date: Thu Jan 12 21:27:58 2006 Subject: Mailserver replacement of exchange Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Does anyone has a good alternative for MS exchange (groupware) in the > opensource world? If it is possible an outlook client must be able to > connect to it. > > thanks Koen > > > Support MailScanner development - buy the book off the website! >I have a few SuSE OpenExchange servers and they work fine. >Mike I use Kolab www.kolab.org with the toltec connector to link the outlook users to the server. I have customers from 5 to 100 users. Denis www.just-servers.co.uk --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.817 / Virus Database: 555 - Release Date: 15/12/2004 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. Marvin the E-Mail scanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at TC3NET.COM Sat Dec 18 11:09:43 2004 From: mike at TC3NET.COM (Michael Baird) Date: Thu Jan 12 21:27:58 2006 Subject: Mailserver replacement of exchange Message-ID: > Does anyone has a good alternative for MS exchange (groupware) in the > opensource world? If it is possible an outlook client must be able to > connect to it. I've been looking as well, been following 3 projects, http://www.egroupware.com, http://www.opengroupware.com, http://www.open-xchange.org, they all have varying levels of outlook connectivity, very raw. A non-opensource solution, that is inexpensive and runs under linux is the kerio mailserver, it has a great web interface as well as full outlook support (evolution/thunderbird support is expected in the near future as well) and some nice Exchange migration tools. > > thanks Koen > Regards MIKE ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Dec 18 12:39:28 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:58 2006 Subject: How to test if it is working? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Anyone have some steps to do to see if the system is working? Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sat Dec 18 12:40:22 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: How to test if it is working? Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Send sample "test-virus" message through the server. The test file to use is available from www.eicar.org. It is detected as a virus by all the virus scanners, but it is not actually a virus at all and is totally harmless. Lance Haig wrote: > Anyone have some steps to do to see if the system is working? > * > * -- -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Dec 18 12:54:35 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:58 2006 Subject: How to test if it is working? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] HI Julian, Great Product.... Thanks for the tip I am not receiving any mail through the system at all yet so I want to test that mail is working before I start to test for spam and viruses Lance On Sat, 2004-12-18 at 12:40, Julian Field wrote: Send sample "test-virus" message through the server. The test file to use is available from www.eicar.org. It is detected as a virus by all the virus scanners, but it is not actually a virus at all and is totally harmless. Lance Haig wrote: > Anyone have some steps to do to see if the system is working? > * > * -- -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From listas at TKS.COM.BR Sat Dec 18 13:40:27 2004 From: listas at TKS.COM.BR (Bento Loewenstein) Date: Thu Jan 12 21:27:58 2006 Subject: Queue file corruption with MS + postfix +debian Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] i have this problem with some debian boxes showing a few corrupted queue files. the full scoop is this: most of them were running dibian stable (woody) with postfix 1.1 and amavis. then we decided to move them to postfix 2.1 + mailscanner to use some of mailscanner's capabilities such as rules. so instead of doing a full dist-upgrade to debian testing we took diferent paths for each of them to see what would happen. so we have some boxes with: - postfix from backports.org and mailscanner 4.30 and perl 5.6.1 from woody (lets call them "type 1") - postfix from debian testing, mailscanner 4.36 and perl 5.8.1 partially upgraded used apt-get's "pinning". most packages are still from woody, with a bunch of depencies from "sarge" to run MS + postfix 2.1 (lets call this kind "type 2" boxes) - an ancient redhat 7.2 with postfix 2.1.4 + mailscanner 4.35 with perl 5.6.1 (call them "type 3") In "type 3" and "type 1" machines i only have corrupt queue files ocasionally, 2 or 3 a month maybe, but in "type 2" boxes (the ones "pinned" with sarge packages) i consistently have 3 or 4 corrupt files every day. postfix always claims the same: "rcpt count mismatch" I assume this is something specific to my "pinned" debian, since it doesn't happend at all with red hat and very litle with boxes using backports.org's postfix. Bellow there's a list of packages from the "pinned" machines and some logs. strange as it is, if i return the corrrupt messages to postfix's "hold" queue, so MS scans them again, they end up delivered normally. i even mailed Julian this week but he couldn't reproduce the error, so does anyone have any idea of what's wrong ? BTW. i have a workaround to this problem (a script to return corrupt messages to the hold queue) but what i really want is to _understand_ what's going on. TKS, BEnto Loewenstein Packages: postfix 2.1.4-5 mailscanner 4.35.11-1 libarchive-tar-perl 0.22-2 libarchive-zip-perl 1.14-1 libcompress-zlib-perl 1.33-3 libconfhelper-perl 0.12 libconvert-binhex-perl 1.119-2 libconvert-tnef-perl 0.16-2 libconvert-uulib-perl 1.0.3-1 libcurses-perl 1.06-11 libcurses-ui-perl 0.94-1lire1 libdbd-mysql-perl 2.9003-3 libdbi-perl 1.45-1 libhtml-parser-perl 3.36-1 libhtml-tagset-perl 3.03-1 libhtml-tree-perl 3.11-2 libintl-perl 1.11-1 libio-stringy-perl 2.108-1 liblocale-gettext-perl 1.01-17 liblogfile-rotate-perl 1.04-1 libmailtools-perl 1.44-1woody2 libmime-perl 5.415-1 libnet-cidr-perl 0.10-1 libnet-daemon-perl 0.38-1 libnet-pcap-perl 0.04-3 libnet-snpp-perl 1.17-1 libnet-telnet-perl 3.02-1 libperl5.6 5.6.1-8.7 libplrpc-perl 0.2017-1 libsnmp-session-perl 0.90-1 libterm-readkey-perl 2.21-1.3 libtext-charwidth-perl 0.04-1 libtext-iconv-perl 1.2-3 libtext-wrapi18n-perl 0.06-1 libtime-modules-perl 100.010301-1 libtimedate-perl 1.11-1 libunix-syslog-perl 0.100-4 liburi-perl 1.18-1 libwww-perl 5.800-2 libxml-parser-perl 2.34-3 perl 5.8.4-3 perl-base 5.8.4-3 perl-modules 5.8.4-3 Some logs: Dec 17 19:32:59 chris postfix/smtpd[3706]: 22D2D4C1BB: client=unknown[131.1.1.8] Dec 17 19:32:59 chris postfix/cleanup[3802]: 22D2D4C1BB: hold: header Received: from prxexc.taterka.com.br (unknown [131.1.1.8])??by chris.taterka.com.br (Postfix) with ESMTP id 22D2D4C1BB??for ; Fri, 17 Dec 2004 19:32:59 -0200 (BRST) from unknown[131.1.1.8]; from= to= proto=ESMTP helo= Dec 17 19:32:59 chris postfix/cleanup[3802]: 22D2D4C1BB: hold: header Received: by PRXEXC with Internet Mail Service (5.5.2653.19)??id ; Fri, 17 Dec 2004 19:40:01 -0300 from unknown[131.1.1.8]; from= to= proto=ESMTP helo= Dec 17 19:32:59 chris postfix/cleanup[3802]: 22D2D4C1BB: message-id=<219641918B72D3119FC3005004AC8A6A020C0E3E@PRXEXC> Dec 17 19:33:30 chris MailScanner[31078]: Requeue: 22D2D4C1BB to BE1804C211 Dec 17 19:33:30 chris postfix/qmgr[3540]: BE1804C211: from=, size=7604152, nrcpt=2 (queue active) Dec 17 19:33:30 chris postfix/qmgr[3540]: warning: BE1804C211: rcpt count mismatch (1) Dec 17 19:33:35 chris postfix/smtp[3688]: warning: corrupted queue file: active/B/BE1804C211 Dec 17 19:33:36 chris postfix/qmgr[3540]: warning: saving corrupt file "BE1804C211" from queue "active" to queue "corrupt" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brad at BECKENHAUER.COM Sat Dec 18 14:34:27 2004 From: brad at BECKENHAUER.COM (Brad Beckenhauer) Date: Thu Jan 12 21:27:58 2006 Subject: Mailserver replacement of exchange Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Michael, I believe thaty you meant .org for the first two sites. below are the corrected links: http://www.egroupware.org not .com http://www.opengroupware.org not.com http://www.open-xchange.org thanks for the links :-) Everything should be as simple as possible but not one bit simpler - Albert Einstein >>> Michael Baird 12/18/2004 5:09:43 AM >>> > Does anyone has a good alternative for MS exchange (groupware) in the > opensource world? If it is possible an outlook client must be able to > connect to it. I've been looking as well, been following 3 projects, http://www.egroupware.com, http://www.opengroupware.com, http://www.open-xchange.org, they all have varying levels of outlook connectivity, very raw. A non-opensource solution, that is inexpensive and runs under linux is the kerio mailserver, it has a great web interface as well as full outlook support (evolution/thunderbird support is expected in the near future as well) and some nice Exchange migration tools. > > thanks Koen > Regards MIKE ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Sat Dec 18 19:05:14 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:27:58 2006 Subject: OT: SPF comments requested Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Campbell wrote: >I'm not sure if the SPF thing is something all of us should be dealing with >_now_, but if we all should be updating our DNS records, I'd like to hear >about some ideas from the list. I have gleaned as much as I can absorb from >all of the different sites required to explore implementing SPF, and I'm >still not sure how to use it other than setting up my DNS so others can use >it. > >As I understand this, I have many options on how to use it for our >protection. Much like RBLs, I can set this up in Sendmail, or use the SPF >functions of SA, and probably a few more. And the same reasons for deciding >this are basicly the same as for using RBLs. > >If anyone would like to comment to me off-list to keep the clutter out of >the archives, I would really like to hear opinions, experiences, and any >other words of wisdom about the best way to implement this SPF thing and it >current importance. Such things as "Is the SA modules really sufficient for >blocking", and the like would be along the lines I require. > > OK. I'm opinionated. Roughly in order or importance: 1. Publish an SPF record for your domain. This will allow me to reject mail from spammers claiming to be you. 2. Upgrade to the latest MailScanner. It has a bugfix related to SPF checks. 3. Watch your logs, etc. to see if you are receiving legitimate mail from your regular correspondents with SPF_FAIL. If so, contact the admins of those domains so they can correct their problems. 4. Once you have some confidence in it, increase the score of SPF_FAIL in SpamAssassin. In my experience, it is ridiculously low by default, and I see a much higher correlation between SPF_FAIL and spam than the SA developers see in their test spam corpus. I also expect it to continue rising as more admins deploy it and correct their errors. 5. Eventually, maybe move to a system of rejecting mail at the MTA level. Note that step 1 above requires that you know where all of your mail originates. If you have roaming users or home workers, etc., you need to set up a way for them to send mail through one of your approved servers. You don't want them sending through their ISP's with your domain as the envelope, or their messagges may be rejected at the recipients' servers. If an e-mail administrator publishes an SPF record with "-all" in it, he or she is telling you to reject mail that claims to come from his or her domain, unless it comes from one of the approved servers. So I think we should do just that. Mark Nienberg ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sat Dec 18 19:17:19 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: ANNOUNCE: Beta 4.37.5 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released beta version 4.37.5. There is one major new feature in this release, the ability to add any number of arbitrary headers to messages depending on the spam/mcp status. This is designed to be very useful for sites migrating to MailScanner from other anti-spam systems. For example, SpamAssassin (when used without MailScanner) will add a header "X-Spam-Status: YES" to outgoing messages, which many users filter automatically. With this new feature, the extra header can be generated so that they do not have to change anything when the site migrates to MailScanner. Spam and MCP actions (and of course their non- and high-scoring- alternatives) can now include extra headers which are added in each case. These entire headers must be contained in double quotes. So for example, you can have Spam Actions = header "X-Spam-Status: yes" deliver and the message will be delivered but with the extra header X-Spam-Status: yes added to the message. You can have more than one extra header in the actions setting, add as many as you like. In the case where matching headers already exists in the message, the MailScanner.conf setting Multiple Headers is consulted to decide whether to append, add or replace the header. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Dec 18 20:48:15 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:58 2006 Subject: How does one upgrade? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just finished installing Mailscanner on my system. Having see Julian's announcement, I would like to know how one would go about updating Mailscanner should a new version come out. Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sat Dec 18 21:00:49 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: How does one upgrade? Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Depends what distribution you are using. If you are using the RPM distribution, then install the new one the same way you installed the old one. Then run upgrade_MailScanner_conf and follow what it tells you to do, and then upgrade_languages_conf and follow its instructions. Then stop and restart MailScanner (using the "service" command if you have one). Lance Haig wrote: > I have just finished installing Mailscanner on my system. > Having see Julian's announcement, I would like to know how one would > go about updating Mailscanner should a new version come out. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Dec 18 21:17:40 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:58 2006 Subject: How does one upgrade? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, Thanks for the reply. Would it be safe to upgrade the current version I have to the BETA? I am running on SUSE 9.1 and used the tar version from your site. Thanks again Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sat Dec 18 21:19:44 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: How does one upgrade? Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > Julian, > > Thanks for the reply. > > Would it be safe to upgrade the current version I have to the BETA? > > I am running on SUSE 9.1 and used the tar version from your site. Hopefully you used my distribution intended for SuSE, in that case the instructions I gave you will work. As for whether it is safe or not, that's your call. You might want to wait until a few other people have confirmed it works for them, as you are a new user. Do you need the extra features in 4.37.5 over what is in 4.36? Consult the ChangeLog and see if you need to. If I were in your position, I would hold off for 24 or 48 hours and see what other people say. If there is no new release in that time, then it's probably safe. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Dec 18 21:35:26 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:58 2006 Subject: How does one upgrade? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks I don't need the features just yet so I will hold off Thanks again Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jonas.back at pin.se Sat Dec 18 21:58:56 2004 From: jonas.back at pin.se (Jonas Back) Date: Thu Jan 12 21:27:58 2006 Subject: SV: How to test if it is working? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] One good utility is http://www.gfi.com/emailsecuritytest/ Cheers, Jonas Back -----Ursprungligt meddelande----- Från: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] För Lance Haig Skickat: den 18 december 2004 13:39 Till: MAILSCANNER@JISCMAIL.AC.UK Ämne: How to test if it is working? Anyone have some steps to do to see if the system is working? Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Dec 18 22:20:47 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:58 2006 Subject: SV: How to test if it is working? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jonas, Thanks that worked a treat Lance On Sat, 2004-12-18 at 21:58, Jonas Back wrote: One good utility is http://www.gfi.com/emailsecuritytest/ Cheers, Jonas Back -----Ursprungligt meddelande----- Fran: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] Foer Lance Haig Skickat: den 18 december 2004 13:39 Till: MAILSCANNER@JISCMAIL.AC.UK AEmne: How to test if it is working? Anyone have some steps to do to see if the system is working? Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sat Dec 18 23:12:35 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: SV: How to test if it is working? Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I will re-iterate my usual warning about the GFI tests as well as those at http://www.webmail.us/testvirus. These tests are both provided by companies trying to sell their products. They in no way represent a set of techniques used by real viruses or attacks that have been seen in the wild, they represent a carefully controlled set techniques that they know their software will detect. Treat them with a large pinch of salt. Lance Haig wrote: > Jonas, > > Thanks that worked a treat > > Lance > > > > On Sat, 2004-12-18 at 21:58, Jonas Back wrote: > >> /One good utility is //_http://www.gfi.com/emailsecuritytest/__ >> >> Cheers, >> Jonas Back _/ >> >> /_ -----Ursprungligt meddelande----- >> *FrÃ¥n:* MailScanner mailing list >> [mailto:MAILSCANNER@JISCMAIL.AC.UK] *För *Lance Haig >> *Skickat:* den 18 december 2004 13:39 >> *Till:* MAILSCANNER@JISCMAIL.AC.UK >> *Ã^Ämne:* How to test if it is working? >> >> >> Anyone have some steps to do to see if the system is working? >> >> Thanks >> _/ >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Dec 18 23:22:54 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:58 2006 Subject: SV: How to test if it is working? Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks Julian, I have gone "live" with my mailscanner solution now and it is working as expected. Thanks for all the hard work. Ps I did buy a book :-) Lance On Sat, 2004-12-18 at 23:12, Julian Field wrote: I will re-iterate my usual warning about the GFI tests as well as those at http://www.webmail.us/testvirus. These tests are both provided by companies trying to sell their products. They in no way represent a set of techniques used by real viruses or attacks that have been seen in the wild, they represent a carefully controlled set techniques that they know their software will detect. Treat them with a large pinch of salt. Lance Haig wrote: > Jonas, > > Thanks that worked a treat > > Lance > > > > On Sat, 2004-12-18 at 21:58, Jonas Back wrote: > >> /One good utility is //_http://www.gfi.com/emailsecuritytest/__ >> >> Cheers, >> Jonas Back _/ >> >> /_ -----Ursprungligt meddelande----- >> *Fran:* MailScanner mailing list >> [mailto:MAILSCANNER@JISCMAIL.AC.UK] *Foer *Lance Haig >> *Skickat:* den 18 december 2004 13:39 >> *Till:* MAILSCANNER@JISCMAIL.AC.UK >> *AEmne:* How to test if it is working? >> >> >> Anyone have some steps to do to see if the system is working? >> >> Thanks >> _/ >> ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Image/PNG 1.1KB. ] [ Unable to print this part. ] From drew at THEMARSHALLS.CO.UK Sun Dec 19 00:09:24 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:58 2006 Subject: How does one upgrade? Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: Thanks I don't need the features just yet so I will hold off Having said all of that Julian does himself a huge injustice. The vast majority of Beta releases are production quality and actually if you do have a problem it is fixed (If it's a bug ;-) ) in under 24 hours. For Beta read 'Comfort blanket for just in cases' :-) . Enjoy MailScanner! Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From clicknow at SWIFTDSL.COM.AU Sun Dec 19 01:43:45 2004 From: clicknow at SWIFTDSL.COM.AU (Brian Parish) Date: Thu Jan 12 21:27:58 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Fri, 17 Dec 2004 03:05 am, Alex Neuman van der Hans wrote: > Too bad you can't do a "keep 'Archive Mail' Archive clean"... Yes - I've been meaning to ask about this. Archived mail skips virus checking - correct? If so, I don't understand the logic of this. best regards Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Sun Dec 19 03:28:18 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:58 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: The logic is that Archiving is done "pre" spam and virus checks if I recall correctly. The only way to overcome this is to reject mail using RBL's or milters (like milter-sender and clamav-milter) at the MTA level. Also helps keep your cpu utilization low, as MailScanner has less left to do. Does anybody know if there's an MTA-level way for Sendmail to reject mail based on SPF, like an SPF-milter, that works well? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Brian Parish Sent: Saturday, December 18, 2004 8:44 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: ANNOUNCE: Beta 4.37.3 released On Fri, 17 Dec 2004 03:05 am, Alex Neuman van der Hans wrote: > Too bad you can't do a "keep 'Archive Mail' Archive clean"... Yes - I've been meaning to ask about this. Archived mail skips virus checking - correct? If so, I don't understand the logic of this. best regards Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From admin at thenamegame.com Sun Dec 19 08:38:28 2004 From: admin at thenamegame.com (Michael Freeman) Date: Thu Jan 12 21:27:58 2006 Subject: How do we kill spam to BLOGS on localhost? Message-ID: We have a number of users using BLOGS on their sites. The problem being that these sites are being targeted by spam comments. The problem being, MS is not catching them because it refers to these sites as being local. What settings do we need to make to MS to make sure it scans spam to local sites. Noticed in Bayes that it reduced the score by up to -2.73 just because the site was local. How can we force MS to scan all spam to local sites from comment spammers? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sun Dec 19 12:19:43 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Brian Parish wrote: >On Fri, 17 Dec 2004 03:05 am, Alex Neuman van der Hans wrote: > > >>Too bad you can't do a "keep 'Archive Mail' Archive clean"... >> >> > >Yes - I've been meaning to ask about this. Archived mail skips virus checking >- correct? If so, I don't understand the logic of this. > > The "Archive Mail" archive is intentionally kept as an identical copy of what comes in. Most of the people who use this feature are financial and legal companies where they must archive their email by law. This archive must be an exact copy, else it has no use whatsoever as a legal copy. This archive was never meant to be accessed by your users. I also use it for building test datasets of hundreds of thousands of messages, which I use for load and capacity testing. A filtered archive would be no use for this at all. Changing this archive so that it could be kept 'clean' would be quite a major change, so I am very reluctant to do it. As MailScanner works through a batch of messages, it clears messages out of memory once it has finished with them, so it doesn't do more processing on a message than is absolutely needed. Hope you understand. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From faisal at MITSUMINET.COM Sun Dec 19 12:57:04 2004 From: faisal at MITSUMINET.COM (Faisal) Date: Thu Jan 12 21:27:58 2006 Subject: Problem Receiving Mails Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Guys, I have strange problem with Mail Scanner. If i enable the option of spamassassin i m not able to send mail to myself. From server logs i can see those mails r queing.When spamassassin is disable i m able to recieve the mails.Please help. Regards Faisal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sun Dec 19 14:20:43 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:58 2006 Subject: Problem Receiving Mails Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Faisal wrote: > Hi Guys, > I have strange problem with Mail Scanner. If i enable the option of > spamassassin i m not able to send mail to myself. From server logs i > can see those mails r queing.When spamassassin is disable i m able > to recieve the mails.Please help. what are your spam actions? what are you high-scoring spam action? Please read some doc. Please see the footer of every message. Regards, Ugo > > Regards > Faisal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sun Dec 19 14:23:14 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:58 2006 Subject: How do we kill spam to BLOGS on localhost? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michael Freeman wrote: > We have a number of users using BLOGS on their sites. The problem being > that these sites are being targeted by spam comments. The problem being, > MS is not catching them because it refers to these sites as being local. > What settings do we need to make to MS to make sure it scans spam to > local sites. Noticed in Bayes that it reduced the score by up to -2.73 > just because the site was local. How can we force MS to scan all spam to > local sites from comment spammers? First: Are those e-mails or just posts? MailScanner only scans e-mails. If it doesn't reach your MTA, MailScanner can't do anything about it. If they are e-mails: Do you have mailwatch installed? Do you have only one web server installed? What you could do is install a second web server who runs under another username and whitelist this user only, don't ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Sun Dec 19 17:38:21 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:58 2006 Subject: How do we kill spam to BLOGS on localhost? Message-ID: Michael Freeman wrote: > We have a number of users using BLOGS on their sites. The problem > being that these sites are being targeted by spam comments. The > problem being, MS is not catching them because it refers to these > sites as being local. What settings do we need to make to MS to make > sure it scans spam to local sites. Noticed in Bayes that it reduced > the score by up to -2.73 just because the site was local. How can we > force MS to scan all spam to local sites from comment spammers? You didn't mention which blog software they are using. Blog spam is very annoying, but has nothing to do with MailScanner really, as the comments are posted to the blog and the email is then generated server-side. It might help to have a look at some of my mutterings on this: http://www.mneylon.com/blog/archives/2004/12/15/more-blog-spam-solutions/ http://www.mneylon.com/blog/archives/2004/12/01/blog-spam/ If the users are using Movable Type there is very little you can do about it except suggesting that they move to Wordpress :) HTH Michele Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From admin at thenamegame.com Sun Dec 19 18:16:59 2004 From: admin at thenamegame.com (Michael Freeman) Date: Thu Jan 12 21:27:58 2006 Subject: How do we kill spam to BLOGS on localhost? Message-ID: Actually, as mentioned, messages are being run though mailscanner but they are not being caught. I can clearly see this in the header of each message getting stuck in the queue. Here is an example. Header; 143P Received: from mailnull by server7 with local (Exim 4.43) id 1CfCOM-000755-RP for b2@www.lapl.xxx; Fri, 17 Dec 2004 02:19:10 -0500 031 Auto_submitted: auto-generated 061F From: Mail Delivery System 020T To: b2@www.lapl.xxx 047 Subject: Mail failure - no recipient addresses 050I Message-Id: 038 Date: Fri, 17 Dec 2004 02:19:10 -0500 084 X-EfastServers-MailScanner-Information: Please contact the ISP for more information 046 X-EfastServers-MailScanner: Found to be clean 040 X-EfastServers-MailScanner-SpamScore: 1 021 X-MailScanner-From: 034 X-MailScanner-To: b2@www.lapl.xxx This bounce indicates that these messages are passing though MS but the score is very low so its not being caught. Also, most of these msgs are being sent to a blank TO: See: To: Subject: comment on post #18 "" From: b2@www.lapl.xxx X-Mailer: b2 0.6.1 - PHP/4.3.9 Message-Id: X-rewrote-sender: nobody@server7 Date: Fri, 17 Dec 2004 02:19:10 -0500 New comment on your post #18. author : online poker (IP: 129.121.3.248 , wnt248.vip.osogrande.com) e-mail : msjqjlsp@a5618a2e7109df6683f8b7cca9a835518.com url : http://www.sindyhalliday.com comment: 'Creation science' has not entered the curriculum for a reason so simple and so basic that we often forget to mention it: because it is false, and because good teachers understand exactly why it is false. What could be more destructive of that most fragile yet most precious commodity in our entire intellectual heritage - good teaching - than a bill forcing honorable teachers to sully their sacred trust by granting equal treatment to a doctrine not only known to be false, but calculated to undermine any general understanding of science as an enterprise? by online poker Notice the To field is blank. Is there a rule that can be added that catches messages to to a blank to? Blog is b2b. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Michele Neylon :: Blacknight Solutions Sent: Sunday, December 19, 2004 12:38 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: How do we kill spam to BLOGS on localhost? Michael Freeman wrote: > We have a number of users using BLOGS on their sites. The problem > being that these sites are being targeted by spam comments. The > problem being, MS is not catching them because it refers to these > sites as being local. What settings do we need to make to MS to make > sure it scans spam to local sites. Noticed in Bayes that it reduced > the score by up to -2.73 just because the site was local. How can we > force MS to scan all spam to local sites from comment spammers? You didn't mention which blog software they are using. Blog spam is very annoying, but has nothing to do with MailScanner really, as the comments are posted to the blog and the email is then generated server-side. It might help to have a look at some of my mutterings on this: http://www.mneylon.com/blog/archives/2004/12/15/more-blog-spam-solutions/ http://www.mneylon.com/blog/archives/2004/12/01/blog-spam/ If the users are using Movable Type there is very little you can do about it except suggesting that they move to Wordpress :) HTH Michele Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Sun Dec 19 22:43:34 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:58 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: I do understand your point, and agree wholeheartedly with your reasons for this. I just brought it up as an FYI, not as a gripe. Perhaps someone on the list could offer a procmail recipe or some other way where every piece of "clean" mail can be archived to mbox files? I don't know enough about procmail to do something like that, but I'm sure a couple of the list regulars here are familiar enough with it... How about it, guys? Anyone? :) -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Sunday, December 19, 2004 7:20 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: ANNOUNCE: Beta 4.37.3 released Brian Parish wrote: >On Fri, 17 Dec 2004 03:05 am, Alex Neuman van der Hans wrote: > > >>Too bad you can't do a "keep 'Archive Mail' Archive clean"... >> >> > >Yes - I've been meaning to ask about this. Archived mail skips virus >checking >- correct? If so, I don't understand the logic of this. > > The "Archive Mail" archive is intentionally kept as an identical copy of what comes in. Most of the people who use this feature are financial and legal companies where they must archive their email by law. This archive must be an exact copy, else it has no use whatsoever as a legal copy. This archive was never meant to be accessed by your users. I also use it for building test datasets of hundreds of thousands of messages, which I use for load and capacity testing. A filtered archive would be no use for this at all. Changing this archive so that it could be kept 'clean' would be quite a major change, so I am very reluctant to do it. As MailScanner works through a batch of messages, it clears messages out of memory once it has finished with them, so it doesn't do more processing on a message than is absolutely needed. Hope you understand. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Mon Dec 20 09:30:33 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:58 2006 Subject: How do we kill spam to BLOGS on localhost? Message-ID: MailScanner mailing list wrote: > Actually, as mentioned, messages are being run though > mailscanner but they are not being caught. I can clearly see > this in the header of each message getting stuck in the > queue. Here is an example. > I think you are missing my point. The emails are only notifications of the comments. The problem is not the emails but the comments themselves. Block the spam comments and you will do away with the issue. Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From holger.banko at PGAM.COM Mon Dec 20 09:54:48 2004 From: holger.banko at PGAM.COM (Holger Banko) Date: Thu Jan 12 21:27:58 2006 Subject: Rejecting unknown Users Message-ID: [ The following text is in the "iso-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello everybody, we use SuSE 9.1 and an actual Mailscanner in front of our Louts Notes Mailserver. As I can see in the /var/log/mail logfile, we have a lot of trouble with dictionary attacks. The Notes server is rejecting all unknown users so I have an always full outgoing que. Is it possible to already reject all unknown users by the Mailscanner System? I can access the LDAP Directory of the notes server. Or just create an "valid users file" and point the Mailscanner/Sendmail to it. But I dont know how. I dont have much experience in configuring sendmail. Thanks in advance you for your help -- Holger Banko IT-Administrator ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Mon Dec 20 10:11:41 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:58 2006 Subject: Rejecting unknown Users Message-ID: You could look at milter-ahead. I know some people have been using this successfully http://www.milter.info/milter-ahead/index.shtml Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dh at UPTIME.AT Mon Dec 20 10:13:16 2004 From: dh at UPTIME.AT ([ISO-8859-15] David Höhn) Date: Thu Jan 12 21:27:58 2006 Subject: Rejecting unknown Users Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Holger Banko wrote: | Hello everybody, | | we use SuSE 9.1 and an actual Mailscanner in front of our Louts Notes | Mailserver. | | As I can see in the /var/log/mail logfile, we have a lot of trouble with | dictionary attacks. The Notes server is rejecting all unknown users so I have | an always full outgoing que. | | Is it possible to already reject all unknown users by the Mailscanner System? | I can access the LDAP Directory of the notes server. Or just create an "valid | users file" and point the Mailscanner/Sendmail to it. | | But I dont know how. I dont have much experience in configuring sendmail. | | Thanks in advance you for your help For a general idea http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html - -d - -- nee anata wo mitsukete soshite nidoto wasurezu ~ donna ni munega itakutemo soba ni iru no ~ zutto...zutto...zutto Key fingerprint = FD77 F0B7 5C65 F546 EB08 A4EC 3CCA 1A32 7E24 291E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (Darwin) iD8DBQFBxqW8PMoaMn4kKR4RAyfSAKCPfQilNdN6y1jpwFBTK3S/vNIHcACfWYtR W3V71EpfgL6Wi4uU20FkgnM= =KAIm -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Mon Dec 20 11:57:27 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:58 2006 Subject: Persistent spam - suggestions welcome Message-ID: I'm seeing a lot of these spams slipping through with the following address in the body: XE International Exports Ltd St. Gerry #3708 Belize City, Belize Or some variation on it. Has anybody else seen these? Has anybody come up with a way of stopping them? Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dh at UPTIME.AT Mon Dec 20 12:01:39 2004 From: dh at UPTIME.AT ([ISO-8859-1] David Höhn) Date: Thu Jan 12 21:27:58 2006 Subject: Persistent spam - suggestions welcome Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Michele Neylon :: Blacknight Solutions wrote: | I'm seeing a lot of these spams slipping through with the following address | in the body: | | XE International Exports Ltd | St. Gerry #3708 | Belize City, Belize | | Or some variation on it. | | Has anybody else seen these? Has anybody come up with a way of stopping | them? | | I would assume that those bits of spam are from different sources? The unique bits are the address? If so, you could simply score on that address or a compbination of keywords that would lead to that address - -d - -- nee anata wo mitsukete soshite nidoto wasurezu ~ donna ni munega itakutemo soba ni iru no ~ zutto...zutto...zutto Key fingerprint = FD77 F0B7 5C65 F546 EB08 A4EC 3CCA 1A32 7E24 291E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (Darwin) iD8DBQFBxr8jPMoaMn4kKR4RA54DAJ9joaxJw/kTTHrYhcXDDx/Vm2LoPgCfdz7h NZd+UBb/g6oJiIdh/BEZuB0= =4tcS -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Mon Dec 20 14:20:21 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:58 2006 Subject: Persistent spam - suggestions welcome Message-ID: > I would assume that those bits of spam are from different > sources? Yes >The unique bits are the address? Yes again > If so, you could simply score on that address or a > compbination of keywords that would lead to that address True, I was just wondering if anyone else had already dealt with this one. No point in reinventing the wheel :) Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Mon Dec 20 14:26:20 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:27:58 2006 Subject: Offtopic - Mail Size limits Message-ID: What, if any, limits do you set on mail attachments for your users? Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Mon Dec 20 14:35:20 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: Offtopic - Mail Size limits Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Max message size of 100Mb. Otherwise, just legal content. Michele Neylon :: Blacknight Solutions wrote: >What, if any, limits do you set on mail attachments for your users? > > -- -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ELIQUID.COM Mon Dec 20 14:45:42 2004 From: mailscanner at ELIQUID.COM (Wess) Date: Thu Jan 12 21:27:58 2006 Subject: Offtopic - Mail Size limits Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I like to limit users to 25MB here. On Mon, 2004-12-20 at 09:35, Julian Field wrote: Max message size of 100Mb. Otherwise, just legal content. Michele Neylon :: Blacknight Solutions wrote: >What, if any, limits do you set on mail attachments for your users? > > -- -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! MailScanner on IRC Community Support irc.freenode.net #mailscanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Mon Dec 20 14:49:02 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:58 2006 Subject: Serious problems running Mailscanner Message-ID: Martin Hepworth wrote: > Richard > > when you upgraded did you run the uprade_SailScanner_conf script?? > > Also how did you upgrade - apt, tar style??? > > > Upgraded with apt. The upgrade script was run. Rich -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From alex at nkpanama.com Mon Dec 20 14:50:12 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:58 2006 Subject: Offtopic - Mail Size limits Message-ID: I usually enable a global limit at the MTA level (say, 25 Megs) and then tweak MS according to each user's needs. I've never needed to use quotas, but it's also something to consider. ________________________________________________________________________________ From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Wess Sent: Monday, December 20, 2004 9:46 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Offtopic - Mail Size limits I like to limit users to 25MB here. On Mon, 2004-12-20 at 09:35, Julian Field wrote: Max message size of 100Mb. Otherwise, just legal content. Michele Neylon :: Blacknight Solutions wrote: >What, if any, limits do you set on mail attachments for your users? > > -- -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! MailScanner on IRC Community Support irc.freenode.net #mailscanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Mon Dec 20 15:00:31 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:27:58 2006 Subject: Offtopic - Mail Size limits Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Max message size of 100Mb. Otherwise, just legal content. > And here but enforced at MTA rather than MailScanner Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From prandal at HEREFORDSHIRE.GOV.UK Mon Dec 20 15:06:08 2004 From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil) Date: Thu Jan 12 21:27:58 2006 Subject: Offtopic - Mail Size limits Message-ID: The biggest problem with huge emails is the limits imposed by ISPs or at the receiving end. As that's beyond our control, I'd keep the limit low. Eeeek, just peeked at our MailScanner.conf, what's that "-1" doing there?. I'm going to have to practice what I preach, methinks. Happy Christmas to you all, Phil ---- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Michele > Neylon :: Blacknight Solutions > Sent: 20 December 2004 14:26 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Offtopic - Mail Size limits > > What, if any, limits do you set on mail attachments for your users? > > Mr Michele Neylon > Blacknight Internet Solutions Ltd > Hosting, co-location & domains > http://www.blacknight.ie/ > Tel. +353 59 9137101 > http://www.blacknight.ie/specialoffers.html > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Dec 20 15:07:46 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:27:58 2006 Subject: Offtopic - Mail Size limits Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michele Neylon :: Blacknight Solutions wrote: >What, if any, limits do you set on mail attachments for your users? > > > Our 15MB limit is enforced by sendmail. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From richard.thomas at PSYSOLUTIONS.COM Mon Dec 20 15:09:15 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:58 2006 Subject: Serious problems running Mailscanner Message-ID: Martin Hepworth wrote: > Richard > > > have you checked the permissions on all the files like the work area etc. > > As it's running in debug mode (probably as root) I'd check that all the > files in the /var/spool/MailScanner/incoming/ are wriable by the User as > defined in MailScanner.conf > > > The permissions all look fine. Rich -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From ssilva at SGVWATER.COM Mon Dec 20 16:01:36 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:58 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Brian Parish wrote: | On Fri, 17 Dec 2004 03:05 am, Alex Neuman van der Hans wrote: | |>Too bad you can't do a "keep 'Archive Mail' Archive clean"... | | | Yes - I've been meaning to ask about this. Archived mail skips virus checking | - correct? If so, I don't understand the logic of this. | | best regards | Brian If you want a more "clean" archive then you could use something in the form of; Non spam actions = deliver forward user@domain.com Where the address is an account to use as the "clean" archive. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBxvdgRADw9lziUqQRAvWwAJ9gat40rRcXK7GFU3TXPXxnPvaMegCdEyIY 0QrODMyzS689ukR2f4Y3ZxI= =8cfu -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Mon Dec 20 16:44:27 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:58 2006 Subject: ANNOUNCE: Beta 4.37.3 released Message-ID: Right... But then it would be difficult to separate into, say, a folder for each user, which you *can* do using rulesets in the Archive Mail option. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Scott Silva Sent: Monday, December 20, 2004 11:02 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: ANNOUNCE: Beta 4.37.3 released -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Brian Parish wrote: | On Fri, 17 Dec 2004 03:05 am, Alex Neuman van der Hans wrote: | |>Too bad you can't do a "keep 'Archive Mail' Archive clean"... | | | Yes - I've been meaning to ask about this. Archived mail skips virus checking | - correct? If so, I don't understand the logic of this. | | best regards | Brian If you want a more "clean" archive then you could use something in the form of; Non spam actions = deliver forward user@domain.com Where the address is an account to use as the "clean" archive. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBxvdgRADw9lziUqQRAvWwAJ9gat40rRcXK7GFU3TXPXxnPvaMegCdEyIY 0QrODMyzS689ukR2f4Y3ZxI= =8cfu -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Mon Dec 20 16:57:36 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:58 2006 Subject: Serious problems running Mailscanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Wondering if this sheds any light (I uncommented line 185). It looks like the destructor is getting called 3 or more times. Note that /var/spool/exim3/input is 750 and is owned by the user and group specified in the conf file. Rich ++++ In Debugging mode, not forking... SA bayes lock is /var/lib/MailScanner/bayes.lock Bayes lock is at /var/lib/MailScanner/bayes.lock Cannot create + lock clean body /var/spool/exim4/input/1CgQaA-0007bD-UO-D, at /usr/share/MailScanner/MailScanner/EximDiskStore.pm line 370 Cannot create + lock clean body /var/spool/exim4/input/1CgQaA-0007bD-UO-D, at /usr/share/MailScanner/MailScanner/EximDiskStore.pm line 370 About to destroy working area at /var/spool/MailScanner/incoming/29336 About to destroy working area at /var/spool/MailScanner/incoming/29336 About to destroy working area at /var/spool/MailScanner/incoming/29336 Can't unlink file /var/spool/MailScanner/incoming/29336/1CgQZR-0007UY-AQ.header: No such file or directory at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 Can't read /var/spool/MailScanner/incoming/29336/1CgQZB-0007SQ-4s: No such file or directory at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 Can't remove directory /var/spool/MailScanner/incoming/29336: No such file or directory at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 Stopping now as you are debugging me. and can't restore permissions to 0700 at /usr/share/MailScanner/MailScanner/WorkArea.pm line 193 Stopping now as you are debugging me. About to destroy working area at /var/spool/MailScanner/incoming/29336 Could not get to parent of incoming work directory at /usr/share/MailScanner/MailScanner/WorkArea.pm line 187. Stopping now as you are debugging me. Stopping now as you are debugging me. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From marcel-ml at IRC-ADDICTS.DE Mon Dec 20 17:27:44 2004 From: marcel-ml at IRC-ADDICTS.DE (g) Date: Thu Jan 12 21:27:58 2006 Subject: Some Problems with MS Message-ID: Hi there, somehow my MS-System does no longer check Mails against spam.. As in the Header nothing is to be found as tagged as spam or even the spam-score :( somehow some mails even slip through unscanned.. no ms-action at all :( as no header-fields had been added to the mail Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Mon Dec 20 17:36:42 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:58 2006 Subject: Some Problems with MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Have you upgraded anything recently? New version of sendmail by chance? g wrote: >Hi there, > >somehow my MS-System does no longer check Mails against spam.. > >As in the Header nothing is to be found as tagged as spam or even the >spam-score :( > >somehow some mails even slip through unscanned.. > >no ms-action at all :( as no header-fields had been added to the mail > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 20 17:25:27 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:59 2006 Subject: Offtopic - Mail Size limits Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Michele Neylon :: Blacknight Solutions wrote: | What, if any, limits do you set on mail attachments for your users? | I have no limits, as my users that are sofisticated enough to use zip files to get past the filename and filetype rules don't abuse e-mail, and those that aren't that skilled get caught and stopped by MailScanner. It is amazing how many people try to send the same stupid mpeg over and over. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBxwsGRADw9lziUqQRAlpjAJ0Y7Jpx1cg4x41ntlruStXkdgGn5ACfTUy0 ifENXV94RBGCmVJadHIQhHo= =PuXx -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Mon Dec 20 17:51:52 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:59 2006 Subject: Debian sendmail start script Message-ID: 1. Does anyone have a Debian sendmail init script they would like to share. 2. I noticed that the standard Debian testing sendmail 8.13 supplied with sendmail does not seem to be complied with HASFLOCK yet the default Lock Type = Setting is blank. Shouldn't that be set to: Lock Type = posix Thanks, Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 20 18:07:26 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:59 2006 Subject: Offtopic - Mail Size limits Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Scott Silva wrote: | Michele Neylon :: Blacknight Solutions wrote: | | What, if any, limits do you set on mail attachments for your users? | | | I have no limits, as my users that are sofisticated enough to use zip | files to get past the filename and filetype rules don't abuse e-mail, | and those that aren't that skilled get caught and stopped by | MailScanner. It is amazing how many people try to send the same stupid | mpeg over and over. I guess I need to be sophisticated enough to spell sophisticated! I hate Mondays!!! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBxxTdRADw9lziUqQRAsqQAJwIEYbic5Un73L9gWVW6nBRrIgWNgCfYVDG +JxJgAETaBYyxKKkUcdBEZA= =AtTW -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Mon Dec 20 18:21:53 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:59 2006 Subject: Debian Bayes starter database available Message-ID: I just posted a Bayes Starter database for Debian SA 2.64 http://www/fsl/com/support Bayes Starter DB (Debian SA 2.64) On a side note. Anyone have any recent word when SpamAssassin 3.0.x will be available for Debian. It looks lie it was submitted to testing on 11/4/2004 Thanks, Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Steve Swaney > Sent: Monday, December 20, 2004 12:52 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Debian sendmail start script > > 1. Does anyone have a Debian sendmail init script they would like to > share. > > > 2. I noticed that the standard Debian testing sendmail 8.13 supplied with > sendmail does not seem to be complied with HASFLOCK yet the default > > Lock Type = > > Setting is blank. Shouldn't that be set to: > > Lock Type = posix > > Thanks, > > Steve > > Steve Swaney > President > Fortress Systems Ltd. > www.fsl.com > steve.swaney@fsl.com > > > > > -- > This message has been scanned for viruses and dangerous content by The > MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be > clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Dec 20 18:09:37 2004 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:27:59 2006 Subject: Debian sendmail start script Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Steve Swaney wrote: | 1. Does anyone have a Debian sendmail init script they would like to share. | | | 2. I noticed that the standard Debian testing sendmail 8.13 supplied with | sendmail does not seem to be complied with HASFLOCK yet the default | | Lock Type = | | Setting is blank. Shouldn't that be set to: | | Lock Type = posix | I do believe the Sendmail people know that Flock is broken in 8.13. I have seen several recommendations to use posix locking. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBxxVhRADw9lziUqQRAulDAJ9nE8aaoYFWQmd6iXSD6lhjgxrsoQCdGR9g EqwFAXbiGZ14+4rf5ow3inQ= =+Ukc -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Mon Dec 20 18:34:11 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:59 2006 Subject: Max Children Message-ID: Alex, did you ever get this fixed? It looks similar to the messages we are getting. Ore you using a single or multiple CPU machine? Rich >Starting MailScanner... > >In Debugging mode, not forking... > >SA bayes lock is /var/lib/MailScanner/bayes.lock > >Bayes lock is at /var/lib/MailScanner/bayes.lock > >Stopping now as you are debugging me. > >Could not get to parent of incoming work directory at >/usr/share/MailScanner/MailScanner/WorkArea.pm line 187. > >Stopping now as you are debugging me. > >Stopping now as you are debugging me. > >Could not get to parent of incoming work directory at >/usr/share/MailScanner/MailScanner/WorkArea.pm line 187. > >Stopping now as you are debugging me. > > > >.but the permissions seem to be set correctly: > > > >"Incoming Work Dir = /var/spool/MailScanner/incoming" > > > >server01:/var/spool/MailScanner# ls -al > >total 20 > >drwxrwx--- 5 Debian-exim Debian-exim 4096 Oct 1 14:59 . > >drwxr-xr-x 9 root root 4096 Oct 4 11:52 .. > >drwxr-x--- 2 Debian-exim Debian-exim 4096 Sep 10 17:56 archive > >drwxrwx--- 2 Debian-exim Debian-exim 4096 Oct 6 13:36 incoming > >drwxr-x--- 8 Debian-exim Debian-exim 4096 Oct 6 00:38 quarantine > > > >Anybody any idea's? > > > >Alex > -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From dom at VBI.VT.EDU Mon Dec 20 18:36:57 2004 From: dom at VBI.VT.EDU (Dominik L. Borkowski) Date: Thu Jan 12 21:27:59 2006 Subject: Debian sendmail start script Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Monday 20 December 2004 01:09 pm, Scott Silva wrote: > | 2. I noticed that the standard Debian testing sendmail 8.13 supplied with > | sendmail does not seem to be complied with HASFLOCK yet the default > | > | Lock Type = > | > | Setting is blank. Shouldn't that be set to: > | > | Lock Type = posix > > I do believe the Sendmail people know that Flock is broken in 8.13. > I have seen several recommendations to use posix locking. I can second that. After moving to 8.13 on some occasions we started to get 'No message collected' e-mails. We found that using Lock type = posix in MS fixed this issue. dom ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From public at RUCH-T.DE Mon Dec 20 18:39:41 2004 From: public at RUCH-T.DE (sebastian g. ruchti) Date: Thu Jan 12 21:27:59 2006 Subject: Debian Bayes starter database available Message-ID: Steve, I have successfully installe the testing version of SA 3.0.1 on my Debian box and it has been running just fine together with MS 4.35.11 since the beginning of November. .sebastian > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Steve Swaney > Sent: Monday, December 20, 2004 7:22 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Debian Bayes starter database available > > > I just posted a Bayes Starter database for Debian SA 2.64 > > http://www/fsl/com/support Bayes Starter DB (Debian SA 2.64) > > On a side note. Anyone have any recent word when SpamAssassin > 3.0.x will be > available for Debian. It looks lie it was submitted to testing on > 11/4/2004 > > Thanks, > > Steve > > Steve Swaney > President > Fortress Systems Ltd. > www.fsl.com > steve.swaney@fsl.com > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > > Behalf Of Steve Swaney > > Sent: Monday, December 20, 2004 12:52 PM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Debian sendmail start script > > > > 1. Does anyone have a Debian sendmail init script they would like to > > share. > > > > > > 2. I noticed that the standard Debian testing sendmail 8.13 > supplied with > > sendmail does not seem to be complied with HASFLOCK yet the default > > > > Lock Type = > > > > Setting is blank. Shouldn't that be set to: > > > > Lock Type = posix > > > > Thanks, > > > > Steve > > > > Steve Swaney > > President > > Fortress Systems Ltd. > > www.fsl.com > > steve.swaney@fsl.com > > > > > > > > > > -- > > This message has been scanned for viruses and dangerous content by The > > MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be > > clean. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > This message has been scanned for viruses and dangerous content > by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is > believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Mon Dec 20 18:39:11 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:59 2006 Subject: Serious problems running Mailscanner Message-ID: Alex Pimperton wrote: > > This isn's a solution, but I had the same problem a while ago with Exim > on Debian Sarge. > > I tried just about everything suggested by the list, and still couldnt > get it working so I removed Exim and installed Postfix and then > installed MailScanner and that fixed the problem. > > I don't want to start a MTA flame war but I have had several problems > with exim that I havn't had postfix, including the one above. > > Alex > Oops, just sent an email to the list regarding what you wrote about this problem. I don't really see how it can be an exim issue but I guess you never know. Changing MTA isn't really an option at this stage. It sounds like reinstalling MailScanner might be on the cards. One thing I have noticed is that there is a bunch of crap hanging out in the various spool directories. I have no idea why this could be causing an issue but I plan to bring exim down at the end of the day and do some serious spring cleaning. IMO, MailScanner does not have enough debugging built in. Rich -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From richard.thomas at PSYSOLUTIONS.COM Mon Dec 20 19:57:03 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:59 2006 Subject: Clarification... Message-ID: I am still digging into my problem but I seek some clarification about how MailScanner actually works... In MailScanner, you define have to specify the input and output directories. MailScanner picks up an email from the incoming, does its stuff and then drops it in the outgoing queue. My puzzlement is about what heppens next: The page about the exim set up says you need to have exim running to process the queue (exim -q15m kind-of stuff). However, it also says you need to specify the Sendmail2 configuration option to make the delivery attempt. But I don't understand why you need both. Surely the q15m takes care of things? What further perplexes me is that in our configuration file, Sendmail2 is specifies as "usr/bin/exim" which doesn't exist. Mail is still getting delivered just fine though (presumably by the exim that is running in the background). So what is going on? Did Mailscanner see that /usr/bin/exim didn't exist and use the value specified for Sendmail? Or could this line be the rason we are having problems (mailscanner attempting to use /usr/bin/exim and erroring out and then funky stuff happening)? It also appears that multiple calls to Destroy() are being made for the WorkArea object. Seriously scratching my head here guys. Rich -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From mailscanner at ecs.soton.ac.uk Mon Dec 20 20:08:15 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:59 2006 Subject: Clarification... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You have a exim -q15m running to regularly attempt to deliver the messages in the outgoing queue. If you just drop messages into the queue, they will be delivered within 15 minutes. But this is way too slow, you don't want to wait 15 minutes while a message sits in a queue. So there is another setting that tells it how to attempt delivery of a message from the queue. This is called immediately after the message is dropped into the outgoing queue, so that the message is most likely to be delivered immediately. If you set this wrong, the immediate delivery attempt won't be made, but it will still be delivered eventually (by the exim -q15m). Richard Thomas wrote: > I am still digging into my problem but I seek some clarification about > how MailScanner actually works... > > In MailScanner, you define have to specify the input and output > directories. MailScanner picks up an email from the incoming, does its > stuff and then drops it in the outgoing queue. My puzzlement is about > what heppens next: > > The page about the exim set up says you need to have exim running to > process the queue (exim -q15m kind-of stuff). However, it also says you > need to specify the Sendmail2 configuration option to make the delivery > attempt. But I don't understand why you need both. Surely the q15m takes > care of things? > > What further perplexes me is that in our configuration file, Sendmail2 > is specifies as "usr/bin/exim" which doesn't exist. Mail is still > getting delivered just fine though (presumably by the exim that is > running in the background). So what is going on? Did Mailscanner see > that /usr/bin/exim didn't exist and use the value specified for > Sendmail? Or could this line be the rason we are having problems > (mailscanner attempting to use /usr/bin/exim and erroring out and then > funky stuff happening)? -- -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Mon Dec 20 20:27:02 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:59 2006 Subject: Think I fixed it Message-ID: By changing the value of sendmail2 to the correct exim binary, things seem to be under control. Perhaps MailScanner could do with a little work on the error condition in this situation but I'm jsut glad to have things sane again. Rich -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From mlm at LOANPROCESSING.NET Mon Dec 20 21:22:19 2004 From: mlm at LOANPROCESSING.NET (Mike McMullen) Date: Thu Jan 12 21:27:59 2006 Subject: MailScanner and Gentoo Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi All, I'm considering trying Gentoo for a mail server that offers MailScanner, SpamAssassin, ClamAV, Samba, IMAPS and Hylafax as its major services. I would use this server to replace a current system using FC2 to provide these services. I'd be very interested in people's experiences with Gentoo and MailScanner. I'm looking to Gentoo for the perfomance increase over Fedora. I'd appreciate any feedback from people with experiences using Gentoo and Fedora for a MailScanner system. Thanks, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at ERUS.CO.UK Mon Dec 20 21:31:01 2004 From: alex at ERUS.CO.UK (Alex Pimperton) Date: Thu Jan 12 21:27:59 2006 Subject: Serious problems running Mailscanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Richard Thomas wrote: > Alex Pimperton wrote: > >> >> This isn's a solution, but I had the same problem a while ago with Exim >> on Debian Sarge. >> >> I tried just about everything suggested by the list, and still couldnt >> get it working so I removed Exim and installed Postfix and then >> installed MailScanner and that fixed the problem. >> >> I don't want to start a MTA flame war but I have had several problems >> with exim that I havn't had postfix, including the one above. >> >> Alex >> > > Oops, just sent an email to the list regarding what you wrote about this > problem. > > I don't really see how it can be an exim issue but I guess you never > know. Changing MTA isn't really an option at this stage. It sounds like > reinstalling MailScanner might be on the cards. > > One thing I have noticed is that there is a bunch of crap hanging out in > the various spool directories. I have no idea why this could be causing > an issue but I plan to bring exim down at the end of the day and do some > serious spring cleaning. > > IMO, MailScanner does not have enough debugging built in. > > Rich > > -- The original problem never did get fixed. I sent a few emails to the list and tried all the suggestions, including reinstalling everything including the whole box till I was blue in the face and still nothing. The box is a virtual pc, running under UML and sat on a dual xeon host machine (I use bytemark hosting) I didn't understand it either, but at that point I was past caring as long as it stopped losing mail! I'm glad you managed to fix it, if only I'd tried that at the start... Alex ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ELIQUID.COM Mon Dec 20 21:52:47 2004 From: mailscanner at ELIQUID.COM (Wess Bechard) Date: Thu Jan 12 21:27:59 2006 Subject: MailScanner and Gentoo Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike, I am currently using Gentoo on two servers with MailScanner, ClamAV, and SpamAssassin 3.x. I am not using Gentoo to improve performance, rather I use it because of the amazing portage package management system. I don't really think you will see that much of a speed improvement, but you will have a much easier time keeping system packages up to date. I have a few thousand accounts managed and authenticated through mysql. Gentoo + MailScanner = Pure Joy On Mon, 2004-12-20 at 16:22, Mike McMullen wrote: Hi All, I'm considering trying Gentoo for a mail server that offers MailScanner, SpamAssassin, ClamAV, Samba, IMAPS and Hylafax as its major services. I would use this server to replace a current system using FC2 to provide these services. I'd be very interested in people's experiences with Gentoo and MailScanner. I'm looking to Gentoo for the perfomance increase over Fedora. I'd appreciate any feedback from people with experiences using Gentoo and Fedora for a MailScanner system. Thanks, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! MailScanner on IRC Community Support irc.freenode.net #mailscanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Mon Dec 20 22:03:39 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:59 2006 Subject: SA 3.0 giving errors Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, as you all probebly know I have just finished installing my first MS machine. I ran a lint on the machine and this is the error I found at the end of the script. Lint output: config: SpamAssassin failed to parse line, skipping: rewrite_subject 0 config: SpamAssassin failed to parse line, skipping: use_terse_report 1 lint: 2 issues detected. please rerun with debug enabled for more information. Can anyone enlighten me as to what could be wrong? Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Mon Dec 20 22:12:11 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:59 2006 Subject: SA 3.0 giving errors Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Lance Haig > Sent: Monday, December 20, 2004 5:04 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: SA 3.0 giving errors > > Hi, > > as you all probebly know I have just finished installing my first MS > machine. I ran a lint on the machine and this is the error I found at the > end of the script. > > Lint output: config: SpamAssassin failed to parse line, skipping: > rewrite_subject 0 > config: SpamAssassin failed to parse line, skipping: use_terse_report 1 > lint: 2 issues detected. please rerun with debug enabled for more > information. > > Can anyone enlighten me as to what could be wrong? > Glad to. Remove the lines use_terse_report 1 rewrite_subject 0 From marco at XSSNET.COM Mon Dec 20 22:12:44 2004 From: marco at XSSNET.COM (Marco Benton) Date: Thu Jan 12 21:27:59 2006 Subject: SA 3.0 giving errors Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Lance Haig wrote: | Hi, | | as you all probebly know I have just finished installing my first | MS machine. I ran a lint on the machine and this is the error I | found at the end of the script. | | Lint output: config: SpamAssassin failed to parse line, skipping: | rewrite_subject 0 config: SpamAssassin failed to parse line, | skipping: use_terse_report 1 lint: 2 issues detected. please rerun | with debug enabled for more information. | | Can anyone enlighten me as to what could be wrong? sounds like you had an SA 2.x install once, i beleive those params are now deprecated. simply remove them. - -- Marco Benton - BOFH, BSMFH Network Consultant Phone: (774) 808-4051 Fax : (508) 519-6033 BOFH excuse #200: The cause of the problem is: RPC_PMAP_FAILURE -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBx05c2+PYgoYkw8ERAuJ5AJ41IPmEfH0EqZHL3/MHuBy4xdNxrQCgmeUD 2JVOrGQlpdO5PIVQ9cSv7mk= =wNPA -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ohookins at GMAIL.COM Mon Dec 20 23:08:41 2004 From: ohookins at GMAIL.COM (Oliver Hookins) Date: Thu Jan 12 21:27:59 2006 Subject: Problem after installing SpamAssassin on MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Oliver Hookins wrote: > >> Martin Hepworth wrote: >> >>> Oliver >>> >>> you need to install the latest MS (or at least 4.34) for it to work with >>> SA3.x. The SA 3.x API is different from the 2.x so you'll need to >>> upgrade. >> >> >> >> OK I have now installed MS 4.36.4-1, and SpamAssassin and I believe >> configured it all to work properly. Incoming emails appear to trigger >> virus and content filtering, and there aren't any error messages about >> exiting processes like there were before >> >> However now that the sendmail processes are split up into receiving mail >> and processing the queue I am finding that the queue runner is not >> touching anything in /var/spool/mqueue. >> >> Any ideas? Here's the directory listing: >> >> root@web:/opt/MailScanner # ls -la /var/spool/mqueue >> total 56 >> drwxr-s--- 2 smmsp smmsp 4096 2004-12-16 11:11 . >> drwxr-xr-x 9 root root 4096 2004-12-15 14:08 .. >> -rw-rw---- 1 smmsp smmsp 14 2004-12-15 14:40 dfiBF3dOYm020026 >> -rw-rw---- 1 smmsp smmsp 6 2004-12-15 14:45 dfiBF3jCEV020094 >> -rw-rw---- 1 smmsp smmsp 154 2004-12-15 15:45 dfiBF4i0HU023251 >> -rw-rw---- 1 smmsp smmsp 125 2004-12-15 16:53 dfiBF5qlAS023679 >> -rw-rw---- 1 smmsp smmsp 46 2004-12-16 10:59 dfiBFNvx58032373 >> -rw-rw---- 1 smmsp smmsp 157 2004-12-16 11:10 dfiBG09HUG032463 >> -rw------- 1 root smmsp 955 2004-12-15 16:44 qfiBF3dOYm020026 >> -rw------- 1 root smmsp 817 2004-12-15 16:44 qfiBF3jCEV020094 >> -rw------- 1 root smmsp 895 2004-12-15 16:44 qfiBF4i0HU023251 >> -rw------- 1 root smmsp 882 2004-12-16 10:57 qfiBF5qlAS023679 >> -rw------- 1 root smmsp 941 2004-12-16 10:59 qfiBFNvx58032373 >> -rw------- 1 root smmsp 928 2004-12-16 11:11 qfiBG09HUG032463 >> > The ownership of these files is wrong. The clientmqueue version of > sendmail should be putting hem into /var/spool/clientmqueue instead of > here. Check your startup script to ensure the right queues are being > used for the right sendmails. All the files in mqueue should be owned by > root. Set that, and these files should be delivered. Yes I noticed that right after I posted (as usual). I changed the ownership and they were all processed. I'm still trying to figure out why the ownership was root.smmsp in the first place though. Thanks for your help. Oliver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Tue Dec 21 02:47:37 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:59 2006 Subject: Some Problems with MS Message-ID: You could be running a separate sendmail. Check your logs for "can't bind to socket" or something. In the meantime, killall -9 sendmail killall -9 MailScanner service MailScanner start -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Monday, December 20, 2004 12:37 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Some Problems with MS Have you upgraded anything recently? New version of sendmail by chance? g wrote: >Hi there, > >somehow my MS-System does no longer check Mails against spam.. > >As in the Header nothing is to be found as tagged as spam or even the >spam-score :( > >somehow some mails even slip through unscanned.. > >no ms-action at all :( as no header-fields had been added to the mail > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Tue Dec 21 02:49:31 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:59 2006 Subject: MailScanner and Gentoo Message-ID: I'm sure you could have speed improvements by tweaking the box. Check the FAQ/MAQ about it. ________________________________________________________________________________ From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Wess Bechard Sent: Monday, December 20, 2004 4:53 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: MailScanner and Gentoo Mike, I am currently using Gentoo on two servers with MailScanner, ClamAV, and SpamAssassin 3.x. I am not using Gentoo to improve performance, rather I use it because of the amazing portage package management system. I don't really think you will see that much of a speed improvement, but you will have a much easier time keeping system packages up to date. I have a few thousand accounts managed and authenticated through mysql. Gentoo + MailScanner = Pure Joy On Mon, 2004-12-20 at 16:22, Mike McMullen wrote: Hi All, I'm considering trying Gentoo for a mail server that offers MailScanner, SpamAssassin, ClamAV, Samba, IMAPS and Hylafax as its major services. I would use this server to replace a current system using FC2 to provide these services. I'd be very interested in people's experiences with Gentoo and MailScanner. I'm looking to Gentoo for the perfomance increase over Fedora. I'd appreciate any feedback from people with experiences using Gentoo and Fedora for a MailScanner system. Thanks, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! MailScanner on IRC Community Support irc.freenode.net #mailscanner ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Dec 21 04:07:06 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:59 2006 Subject: MailScanner and Gentoo Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Alex Neuman van der Hans wrote: > I'm sure you could have speed improvements by tweaking the box. Check > the FAQ/MAQ about it. yes, but he meant "no speed improvement by just choosing gentoo" (gentoo is supposed to be more optimized than other distros). ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Tue Dec 21 08:49:56 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:59 2006 Subject: Van MS scan for spam in other languages? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] We have a multicultural environment here and I was wondering if MS can kill spam in Spanish, Italian and French. I know that most spam is English but we have been asked to see if our current solution does it. Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Tue Dec 21 09:25:57 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:27:59 2006 Subject: Van MS scan for spam in other languages? Message-ID: There's a lot about spam that isn't really bound to language... Common "faults" due to tools used, "tricks" employed etc. And MS&SA seems to be very adept at finding all those. And the RBLs and digest tests aren't really bound to language either. That's why I've seen at least _some_ swedish (and spanish, I think at least:-) spam get caught. The volume of "localized" spam is to low to make any projections on how well it does this though. I'm guessing this might change in the future;). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Lance Haig > Sent: den 21 december 2004 09:50 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Van MS scan for spam in other languages? > > > We have a multicultural environment here and I was wondering if MS can > kill spam in Spanish, Italian and French. > I know that most spam is English but we have been asked to see if our > current solution does it. > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From clas at MAYER.SE Tue Dec 21 10:35:09 2004 From: clas at MAYER.SE (Clas Mayer) Date: Thu Jan 12 21:27:59 2006 Subject: Threded perl and mailwatch Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Im having problem with mailwatch, after a perl --> perl threaded what does "Could not use Custom Function code MailScanner::CustomConfig::InitMailWatchLogging" in maillog tell me? -- Clas Mayer ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Tue Dec 21 10:52:33 2004 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:27:59 2006 Subject: Van MS scan for spam in other languages? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks Glenn, I will mention that Lance Steen, Glenn wrote: There's a lot about spam that isn't really bound to language... Common "faults" due to tools used, "tricks" employed etc. And MS&SA seems to be very adept at finding all those. And the RBLs and digest tests aren't really bound to language either. That's why I've seen at least _some_ swedish (and spanish, I think at least:-) spam get caught. The volume of "localized" spam is to low to make any projections on how well it does this though. I'm guessing this might change in the future;). -- Glenn -----Original Message----- From: MailScanner mailing list ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From giulio.cervera at EDSPA.IT Tue Dec 21 10:53:23 2004 From: giulio.cervera at EDSPA.IT (Giulio Cervera) Date: Thu Jan 12 21:27:59 2006 Subject: Duplicate emails (STILL OCCURING) - same smtp id processed by different MS processes. Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] With RHEL ES 3 Update 3, sendmail-8.12.11-4.RHEL3.1, MailScanner 4.36.4-1 and posix Lock Type i get the same problem from yesterday **i'm trying this patch and the problem sames to be fixed ... Julian Field ha scritto: > Please try the attached patch to SMDiskStore.pm and let me know if it > helps. > > Quentin Campbell wrote: > >> Julian >> >> I am _still_ seeing some duplicate processing by MailScanner when I set >> "Lock Type = posix" although not as many as when I let "Lock Type" >> default. >> >> The setup is: >> >> Red Hat Enterprise Linux AS release 3 (Taroon Update 1) >> - its own Sendmail 8.12.10 >> - have not applied most recent kernel updates >> >> MailScanner-4.35.11-1 >> - with a more recent Message.pm >> >> MailScanner.conf >> - Lock Type = posix >> >> >> Quentin >> --- >> PHONE: +44 191 222 8209 Information Systems and Services (ISS), >> University of Newcastle, >> Newcastle upon Tyne, >> FAX: +44 191 222 8765 United Kingdom, NE1 7RU. >> ------------------------------------------------------------------------ >> "Any opinion expressed above is mine. The University can get its own." >> >> >> >>> -----Original Message----- >>> From: MailScanner mailing list >>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell >>> Sent: 13 December 2004 09:58 >>> To: MAILSCANNER@JISCMAIL.AC.UK >>> Subject: Re: Duplicate emails - same smtp id processed by >>> different MS processes. >>> >>> The situation appears even more confused. >>> >>> I also have to specify "Lock Type = posix" to stop the duplication on >>> our Red Hat Enterprise Linux AS release 3 (Taroon Update 1) but it is >>> running with its own Sendmail 8.12.10. >>> >>> Quentin >>> --- >>> PHONE: +44 191 222 8209 Information Systems and Services (ISS), >>> University of Newcastle, >>> Newcastle upon Tyne, >>> FAX: +44 191 222 8765 United Kingdom, NE1 7RU. >>> --------------------------------------------------------------- >>> --------- >>> "Any opinion expressed above is mine. The University can get >>> its own." >>> >>> >>> >>>> -----Original Message----- >>>> From: MailScanner mailing list >>>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alan Dobkin >>>> Sent: 09 December 2004 16:50 >>>> To: MAILSCANNER@JISCMAIL.AC.UK >>>> Subject: Re: Duplicate emails - same smtp id processed by >>>> different MS processes. >>>> >>>> On 12/7/2004 12:34 PM, Julian Field wrote: >>>> >>>> >>>>> With sendmail-8.13 on Linux systems, you need to set >>>>> "Lock Type = posix" in MailScanner.conf. >>>>> >>>>> >>>> FWIW, I upgraded my server from Fedora Core 2 to Fedora Core 3 >>>> and around the same time upgraded MailScanner to version 4.36.1-1. >>>> Fedora Core 3 included sendmail 8.13 (previously 8.12 in Core 2), >>>> and I didn't realize that the locking method had changed. Around >>>> the same time, the MailScanner.conf file, which used to default >>>> to "Lock Type = flock" was changed to just "Lock Type = " (blank), >>>> so I suspected MailScanner may be causing the problem, but making >>>> the change to "Lock Type = posix" seems to do the trick. >>>> >>>> In retrospect, I now see that the sendmail release notes warned >>>> about this change over 2 years ago, back in release 8.12.5: >>>> >>>> 8.12.5/8.12.5 2002/06/25 >>>> NOTE: Linux appears to have broken flock() again. Unless >>>> the bug is fixed before sendmail 8.13 is shipped, >>>> 8.13 will change the default locking method to >>>> fcntl() for Linux kernel 2.4 and later. You may >>>> want to do this in 8.12 by compiling with >>>> -DHASFLOCK=0. Be sure to update other sendmail >>>> related programs to match locking techniques. >>>> >>>> So, this begs the question, why not set "Lock Type = fcntl" instead >>>> of posix in MailScanner? Does it not understand this method? >>>> >>>> Thanks, >>>> Alan >>>> >>>> -- >>>> Reclaim Your Inbox - Get Thunderbird! >>>> http://www.Mozilla.org/products/thunderbird/ >>>> >>>> Rediscover the Web - Get Firefox! >>>> http://www.SpreadFirefox.com/?q=affiliates&id=21548&t=68 >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >>> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- *Giulio Cervera* EDS PA SpA Via Atanasio Soldati 80 00155 Roma (Italy) tel: +39 06 22739 270 fax: +39 06 22739 233 e-mail: giulio.cervera@edspa.it ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Tue Dec 21 12:14:00 2004 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:27:59 2006 Subject: ZIP file attachments passing through MS 4.35.9 unscanned Message-ID: Recently I have noticed some people bypassing the contents scanning of Zip file attachments. When a message contains a .zip file attachment, renamed to .txt, MailScanner does not seems to detect the presence of the zip file, despite the setting of 'Find Archives By Content = yes' in the MailScanner.conf file. Examing the message, the zip file is attached as follows: Content-Type: text/plain; name="test.txt"; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Content-Disposition: inline; filename="test.txt" PK\003\004 Has anyone else noticed this problem? It is real easy to pass executables and other mallicious content. Regards, Adri Koppes ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Tue Dec 21 12:38:05 2004 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:27:59 2006 Subject: ZIP file attachments passing through MS 4.35.9 unscanned Message-ID: > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Adri Koppes > > Recently I have noticed some people bypassing the contents scanning of Zip > file attachments. > When a message contains a .zip file attachment, renamed to .txt, > MailScanner does not seems to detect the presence of the zip file, despite > the setting of 'Find Archives By Content = yes' in the MailScanner.conf > file. Examing the message, the zip file is attached as follows: > > Has anyone else noticed this problem? It is real easy to pass executables > and other mallicious content. Use this option in MailScanner.conf: "File Command = /usr/bin/file". > Regards, > > Adri Koppes Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Tue Dec 21 12:51:30 2004 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:27:59 2006 Subject: ZIP file attachments passing through MS 4.35.9 unscanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: Mike [mailto:michael@NOMENNESCIO.NET] > Sent: 21 December, 2004 13:38 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: ZIP file attachments passing through MS 4.35.9 unscanned > > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > > Behalf Of Adri Koppes > > > > Recently I have noticed some people bypassing the contents > scanning of > Zip > > file attachments. > > When a message contains a .zip file attachment, renamed to .txt, > > MailScanner does not seems to detect the presence of the zip file, > despite > the setting of 'Find Archives By Content = yes' in the > MailScanner.conf > file. Examing the message, the zip file > is attached > as follows: > > > > Has anyone else noticed this problem? It is real easy to pass > executables > > and other mallicious content. > > Use this option in MailScanner.conf: "File Command = /usr/bin/file". I already have that set and verified it's working. For instance MPEG's and AVI's are blocked regardless of the attached filename. Adri > > Mike. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Tue Dec 21 13:14:51 2004 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:27:59 2006 Subject: Duplicate emails (STILL OCCURING) - same smtp id processed by different MS processes. Message-ID: Giulio Yes, the patch fixed the problem for me as well on my RHEL AS 3. The real cause of the problem was that I had not updated my AS 3 kernel and system for a long time. When the kernel is a more recent one I do not need to set "Lock Type = posix" and do not need to install the patch. It seems clear that older versions of the RHEL AS/ES 3 kernel had a bug in it that effects locking (flock & Posix). Quentin --- PHONE: +44 191 222 8209 Information Systems and Services (ISS), University of Newcastle, Newcastle upon Tyne, FAX: +44 191 222 8765 United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." >-----Original Message----- >From: MailScanner mailing list >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Giulio Cervera >Sent: 21 December 2004 10:53 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Duplicate emails (STILL OCCURING) - same smtp id >processed by different MS processes. > >With RHEL ES 3 Update 3, sendmail-8.12.11-4.RHEL3.1, >MailScanner 4.36.4-1 >and posix Lock Type i get the same problem > >from yesterday **i'm trying this patch and the problem sames >to be fixed ... > >Julian Field ha scritto: > >> Please try the attached patch to SMDiskStore.pm and let me know if it >> helps. >> >> Quentin Campbell wrote: >> >>> Julian >>> >>> I am _still_ seeing some duplicate processing by >MailScanner when I set >>> "Lock Type = posix" although not as many as when I let "Lock Type" >>> default. >>> >>> The setup is: >>> >>> Red Hat Enterprise Linux AS release 3 (Taroon Update 1) >>> - its own Sendmail 8.12.10 >>> - have not applied most recent kernel updates >>> >>> MailScanner-4.35.11-1 >>> - with a more recent Message.pm >>> >>> MailScanner.conf >>> - Lock Type = posix >>> >>> >>> Quentin >>> --- >>> PHONE: +44 191 222 8209 Information Systems and Services (ISS), >>> University of Newcastle, >>> Newcastle upon Tyne, >>> FAX: +44 191 222 8765 United Kingdom, NE1 7RU. >>> >--------------------------------------------------------------- >--------- >>> "Any opinion expressed above is mine. The University can >get its own." >>> >>> >>> >>>> -----Original Message----- >>>> From: MailScanner mailing list >>>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell >>>> Sent: 13 December 2004 09:58 >>>> To: MAILSCANNER@JISCMAIL.AC.UK >>>> Subject: Re: Duplicate emails - same smtp id processed by >>>> different MS processes. >>>> >>>> The situation appears even more confused. >>>> >>>> I also have to specify "Lock Type = posix" to stop the >duplication on >>>> our Red Hat Enterprise Linux AS release 3 (Taroon Update >1) but it is >>>> running with its own Sendmail 8.12.10. >>>> >>>> Quentin >>>> --- >>>> PHONE: +44 191 222 8209 Information Systems and Services (ISS), >>>> University of Newcastle, >>>> Newcastle upon Tyne, >>>> FAX: +44 191 222 8765 United Kingdom, NE1 7RU. >>>> --------------------------------------------------------------- >>>> --------- >>>> "Any opinion expressed above is mine. The University can get >>>> its own." >>>> >>>> >>>> >>>>> -----Original Message----- >>>>> From: MailScanner mailing list >>>>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alan Dobkin >>>>> Sent: 09 December 2004 16:50 >>>>> To: MAILSCANNER@JISCMAIL.AC.UK >>>>> Subject: Re: Duplicate emails - same smtp id processed by >>>>> different MS processes. >>>>> >>>>> On 12/7/2004 12:34 PM, Julian Field wrote: >>>>> >>>>> >>>>>> With sendmail-8.13 on Linux systems, you need to set >>>>>> "Lock Type = posix" in MailScanner.conf. >>>>>> >>>>>> >>>>> FWIW, I upgraded my server from Fedora Core 2 to Fedora Core 3 >>>>> and around the same time upgraded MailScanner to version 4.36.1-1. >>>>> Fedora Core 3 included sendmail 8.13 (previously 8.12 in Core 2), >>>>> and I didn't realize that the locking method had changed. Around >>>>> the same time, the MailScanner.conf file, which used to default >>>>> to "Lock Type = flock" was changed to just "Lock Type = " (blank), >>>>> so I suspected MailScanner may be causing the problem, but making >>>>> the change to "Lock Type = posix" seems to do the trick. >>>>> >>>>> In retrospect, I now see that the sendmail release notes warned >>>>> about this change over 2 years ago, back in release 8.12.5: >>>>> >>>>> 8.12.5/8.12.5 2002/06/25 >>>>> NOTE: Linux appears to have broken flock() again. Unless >>>>> the bug is fixed before sendmail 8.13 is shipped, >>>>> 8.13 will change the default locking method to >>>>> fcntl() for Linux kernel 2.4 and later. You may >>>>> want to do this in 8.12 by compiling with >>>>> -DHASFLOCK=0. Be sure to update other sendmail >>>>> related programs to match locking techniques. >>>>> >>>>> So, this begs the question, why not set "Lock Type = >fcntl" instead >>>>> of posix in MailScanner? Does it not understand this method? >>>>> >>>>> Thanks, >>>>> Alan >>>>> >>>>> -- >>>>> Reclaim Your Inbox - Get Thunderbird! >>>>> http://www.Mozilla.org/products/thunderbird/ >>>>> >>>>> Rediscover the Web - Get Firefox! >>>>> http://www.SpreadFirefox.com/?q=affiliates&id=21548&t=68 >>>>> >>>>> ------------------------ MailScanner list ------------------------ >>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>> 'leave mailscanner' in the body of the email. >>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > >-- > >*Giulio Cervera* > >EDS PA SpA >Via Atanasio Soldati 80 >00155 Roma (Italy) >tel: +39 06 22739 270 >fax: +39 06 22739 233 >e-mail: giulio.cervera@edspa.it > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sjlist at HEIDELBERG.EDU Tue Dec 21 13:37:41 2004 From: sjlist at HEIDELBERG.EDU (S JList) Date: Thu Jan 12 21:27:59 2006 Subject: MS/SA and DNS load (really: "relays.visi.com")? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello. I suppose this is not the most appropriate question for this list, but: we are running MailScanner & SpamAssassin with few modifications from the defaults. Recently, our DNS servers started going crazy, opening tens of thousands of query connections to reverse domains in "relays.visi.com" from our MailScanner machine. Not knowing too much, I was able to figure out that both MailScanner (via RSL) and SpamAssassin (via RCVD_IN_RSL) were attempting to use that site to check open relays, so I commented out the former in spam.lists.conf and set the latter's "score" to 0 in spam.assassin.prefs.conf. The extra traffic to our DNS servers stopped immediately. I've done some searching on the Web to see if "relays.visi.com" has gone quiet, but haven't found any confirmation. Regardless, that site is no longer resolvable via our DNS (or via my ISP at home, for that matter). Has anyone else seen such traffic being generated? Is there a setting I'm missing in MailScanner that would help these DNS lookups to die after a timeout? (I suspect this is also some failure on my part to configure our named servers properly, so maybe I'd better check on the BIND list.) TIA if anyone can offer any suggestions. We have been beyond pleased with MailScanner (and I'm going to buy the book when I get back to work!). S Joyce Heidelberg College sjlist@heidelberg.edu ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Dec 21 13:55:08 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:27:59 2006 Subject: MS/SA and DNS load (really: "relays.visi.com")? Message-ID: Hi yes the visi.com RBL is dead and is not expected to be resurected... disable it by giving it a zero score in spam.assassin.prefs.conf -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 S JList wrote: > Hello. I suppose this is not the most appropriate question for this > list, but: we are running MailScanner & SpamAssassin with few > modifications from the defaults. Recently, our DNS servers started > going crazy, opening tens of thousands of query connections to reverse > domains in "relays.visi.com" from our MailScanner machine. > > Not knowing too much, I was able to figure out that both MailScanner > (via RSL) and SpamAssassin (via RCVD_IN_RSL) were attempting to use that > site to check open relays, so I commented out the former in > spam.lists.conf and set the latter's "score" to 0 in > spam.assassin.prefs.conf. The extra traffic to our DNS servers stopped > immediately. > > I've done some searching on the Web to see if "relays.visi.com" has gone > quiet, but haven't found any confirmation. Regardless, that site is no > longer resolvable via our DNS (or via my ISP at home, for that matter). > Has anyone else seen such traffic being generated? Is there a setting > I'm missing in MailScanner that would help these DNS lookups to die > after a timeout? (I suspect this is also some failure on my part to > configure our named servers properly, so maybe I'd better check on the > BIND list.) > > TIA if anyone can offer any suggestions. We have been beyond pleased > with MailScanner (and I'm going to buy the book when I get back to work!). > > S Joyce > Heidelberg College > sjlist@heidelberg.edu > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 21 14:08:34 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:59 2006 Subject: ZIP file attachments passing through MS 4.35.9 unscanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please try the attached patch to Message.pm. Adri Koppes wrote: >>-----Original Message----- >>From: Mike [mailto:michael@NOMENNESCIO.NET] >>Sent: 21 December, 2004 13:38 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: ZIP file attachments passing through MS 4.35.9 unscanned >> >> >> >> >>>From: MailScanner mailing list >>> >>> >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On >> >> >>>Behalf Of Adri Koppes >>> >>>Recently I have noticed some people bypassing the contents >>> >>> >>scanning of >>Zip >> >> >>>file attachments. >>>When a message contains a .zip file attachment, renamed to .txt, >>>MailScanner does not seems to detect the presence of the zip file, >>> >>> >>despite > the setting of 'Find Archives By Content = yes' in the >>MailScanner.conf > file. Examing the message, the zip file >>is attached >>as follows: >> >> >>>Has anyone else noticed this problem? It is real easy to pass >>> >>> >>executables >> >> >>>and other mallicious content. >>> >>> >>Use this option in MailScanner.conf: "File Command = /usr/bin/file". >> >> > >I already have that set and verified it's working. For instance MPEG's and >AVI's are blocked regardless of the attached filename. > >Adri > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/X-GZIP 512bytes. ] [ Unable to print this part. ] From rgreen at TRAYERPRODUCTS.COM Tue Dec 21 14:11:19 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:27:59 2006 Subject: Receiving other people's mail Message-ID: Hello. I'm using MailScanner (I am not sure which version) along with Postfix. While tweaking SpamAssassin I was looking at headers of some spam I've received and noticed that my address is not anywhere in the headers. An address of a co-worker is but mine is nowhere to be found. I checked mailscanner.conf and the forward directive is not set for spam. Any ideas on how I'm receiving mail addressed to another user? I've checked my virtual maps file as well as my aliases file and nothing is setup to forward mail to me. The only mail I'm getting addressed to the co-worker is spam. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Tue Dec 21 14:27:39 2004 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:27:59 2006 Subject: ZIP file attachments passing through MS 4.35.9 unscanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, Thanks. The patch solved the problem and 'hidden' zipfiles are now scanned. Adri. > -----Original Message----- > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] > Sent: 21 December, 2004 15:09 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: ZIP file attachments passing through MS 4.35.9 unscanned > > > Please try the attached patch to Message.pm. > > Adri Koppes wrote: > > >>-----Original Message----- > >>From: Mike [mailto:michael@NOMENNESCIO.NET] > >>Sent: 21 December, 2004 13:38 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: ZIP file attachments passing through MS 4.35.9 > unscanned > >> > >> > >> > >> > >>>From: MailScanner mailing list > >>> > >>> > >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >> > >> > >>>Behalf Of Adri Koppes > >>> > >>>Recently I have noticed some people bypassing the contents > >>> > >>> > >>scanning of > >>Zip > >> > >> > >>>file attachments. > >>>When a message contains a .zip file attachment, renamed to .txt, > >>>MailScanner does not seems to detect the presence of the zip file, > >>> > >>> > >>despite > the setting of 'Find Archives By Content = yes' in the > >>MailScanner.conf > file. Examing the message, the zip file > >>is attached > >>as follows: > >> > >> > >>>Has anyone else noticed this problem? It is real easy to pass > >>> > >>> > >>executables > >> > >> > >>>and other mallicious content. > >>> > >>> > >>Use this option in MailScanner.conf: "File Command = > /usr/bin/file". > >> > >> > > > >I already have that set and verified it's working. For > instance MPEG's and > >AVI's are blocked regardless of the attached filename. > > > >Adri > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 21 14:36:45 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:59 2006 Subject: ZIP file attachments passing through MS 4.35.9 unscanned Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It will have a slight impact on scanning speed when there are a large number of attachments, but it is much safer. Adri Koppes wrote: >Julian, > >Thanks. >The patch solved the problem and 'hidden' zipfiles are now scanned. > >Adri. > > > >>-----Original Message----- >>From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] >>Sent: 21 December, 2004 15:09 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: ZIP file attachments passing through MS 4.35.9 unscanned >> >> >>Please try the attached patch to Message.pm. >> >>Adri Koppes wrote: >> >> >> >>>>-----Original Message----- >>>>From: Mike [mailto:michael@NOMENNESCIO.NET] >>>>Sent: 21 December, 2004 13:38 >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: ZIP file attachments passing through MS 4.35.9 >>>> >>>> >>unscanned >> >> >>>> >>>> >>>> >>>> >>>>>From: MailScanner mailing list >>>>> >>>>> >>>>> >>>>> >>>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>>> >>>> >>>> >>>> >>>>>Behalf Of Adri Koppes >>>>> >>>>>Recently I have noticed some people bypassing the contents >>>>> >>>>> >>>>> >>>>> >>>>scanning of >>>>Zip >>>> >>>> >>>> >>>> >>>>>file attachments. >>>>>When a message contains a .zip file attachment, renamed to .txt, >>>>>MailScanner does not seems to detect the presence of the zip file, >>>>> >>>>> >>>>> >>>>> >>>>despite > the setting of 'Find Archives By Content = yes' in the >>>>MailScanner.conf > file. Examing the message, the zip file >>>>is attached >>>>as follows: >>>> >>>> >>>> >>>> >>>>>Has anyone else noticed this problem? It is real easy to pass >>>>> >>>>> >>>>> >>>>> >>>>executables >>>> >>>> >>>> >>>> >>>>>and other mallicious content. >>>>> >>>>> >>>>> >>>>> >>>>Use this option in MailScanner.conf: "File Command = >>>> >>>> >>/usr/bin/file". >> >> >>>> >>>> >>>I already have that set and verified it's working. For >>> >>> >>instance MPEG's and >> >> >>>AVI's are blocked regardless of the attached filename. >>> >>>Adri >>> >>> >>> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Tue Dec 21 14:53:41 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:59 2006 Subject: Receiving other people's mail Message-ID: Rodney Green wrote: >Hello. I'm using MailScanner (I am not sure which version) along with >Postfix. While tweaking SpamAssassin I was looking at headers of some spam >I've received and noticed that my address is not anywhere in the headers. An >address of a co-worker is but mine is nowhere to be found. I checked >mailscanner.conf and the forward directive is not set for spam. Any ideas on >how I'm receiving mail addressed to another user? I've checked my virtual >maps file as well as my aliases file and nothing is setup to forward mail to >me. The only mail I'm getting addressed to the co-worker is spam. > >Thanks, >Rod > > Post some headers (edit them suitably first of course) and we'll try to suggest. Probably the spamming software is adding a different to: header than it is sending as the RCPT TO: in the SMTP transaction. Rich -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From alex at nkpanama.com Tue Dec 21 14:57:23 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:59 2006 Subject: Receiving other people's mail Message-ID: You could be in BCC. Check your mail logs (you can use the message ID for reference) and, if you want to be sure in the future (except in cases where end user privacy may be a concern) check the MailScanner.conf file for a setting that adds "mailscanner from" and "mailscanner to" to the headers so you'll know. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green Sent: Tuesday, December 21, 2004 9:11 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Receiving other people's mail Hello. I'm using MailScanner (I am not sure which version) along with Postfix. While tweaking SpamAssassin I was looking at headers of some spam I've received and noticed that my address is not anywhere in the headers. An address of a co-worker is but mine is nowhere to be found. I checked mailscanner.conf and the forward directive is not set for spam. Any ideas on how I'm receiving mail addressed to another user? I've checked my virtual maps file as well as my aliases file and nothing is setup to forward mail to me. The only mail I'm getting addressed to the co-worker is spam. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 21 15:00:55 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:59 2006 Subject: Receiving other people's mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Richard Thomas wrote: > Rodney Green wrote: > >> Hello. I'm using MailScanner (I am not sure which version) along with >> Postfix. While tweaking SpamAssassin I was looking at headers of some >> spam >> I've received and noticed that my address is not anywhere in the >> headers. An >> address of a co-worker is but mine is nowhere to be found. I checked >> mailscanner.conf and the forward directive is not set for spam. Any >> ideas on >> how I'm receiving mail addressed to another user? I've checked my >> virtual >> maps file as well as my aliases file and nothing is setup to forward >> mail to >> me. The only mail I'm getting addressed to the co-worker is spam. >> >> Thanks, >> Rod >> >> > > Post some headers (edit them suitably first of course) and we'll try to > suggest. > > Probably the spamming software is adding a different to: header than it > is sending as the RCPT TO: in the SMTP transaction. > The addresses in the headers are totally irrelevant to the delivery of the message. The only addresses that matter are the recipients as stated in the message envelope. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Tue Dec 21 15:20:48 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:27:59 2006 Subject: Receiving other people's mail Message-ID: Thanks a lot guys. I looked through the logs and found the following line: Dec 21 09:38:21 mail2 MailScanner[10307]: Spam Actions: message C7AF64BE0 actions are store,forward,rgreen@trayerproducts.com So, I missed the forward in the MailScanner.conf file. Odd because I opened the file with my editor and used the search in the editor and didn't find it the first time. In the conf file is the following line: High Scoring Spam Actions = store forward rgreen@trayerproducts.com I do now recall setting this up to do that. With all my responsibilities it's difficult to remember everything I've done. Maybe it would be cool to have MailScanner send the forward as an attachment rather than have it appear as if it was delivered normally. Maybe this would prevent confusion for me. :-) Thanks again, Rod -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alex Neuman van der Hans Sent: Tuesday, December 21, 2004 9:57 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Receiving other people's mail You could be in BCC. Check your mail logs (you can use the message ID for reference) and, if you want to be sure in the future (except in cases where end user privacy may be a concern) check the MailScanner.conf file for a setting that adds "mailscanner from" and "mailscanner to" to the headers so you'll know. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green Sent: Tuesday, December 21, 2004 9:11 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Receiving other people's mail Hello. I'm using MailScanner (I am not sure which version) along with Postfix. While tweaking SpamAssassin I was looking at headers of some spam I've received and noticed that my address is not anywhere in the headers. An address of a co-worker is but mine is nowhere to be found. I checked mailscanner.conf and the forward directive is not set for spam. Any ideas on how I'm receiving mail addressed to another user? I've checked my virtual maps file as well as my aliases file and nothing is setup to forward mail to me. The only mail I'm getting addressed to the co-worker is spam. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Dec 21 15:12:55 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:59 2006 Subject: Van MS scan for spam in other languages? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > We have a multicultural environment here and I was wondering if MS can > kill spam in Spanish, Italian and French. > I know that most spam is English but we have been asked to see if our > current solution does it. Spamassassin, which is used to catch spam in MailScanner, has rules for different languages. See the tests list at www.spamassassin.org > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Tue Dec 21 15:25:08 2004 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:27:59 2006 Subject: Receiving other people's mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You can do that to. Change the line to: High Scoring Spam Actions = store attachment forward rgreen@trayerproducts.com Adri. > -----Original Message----- > From: Rodney Green [mailto:rgreen@TRAYERPRODUCTS.COM] > Sent: 21 December, 2004 16:21 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Receiving other people's mail > > > Thanks a lot guys. I looked through the logs and found the > following line: > > Dec 21 09:38:21 mail2 MailScanner[10307]: Spam Actions: > message C7AF64BE0 > actions are store,forward,rgreen@trayerproducts.com > > So, I missed the forward in the MailScanner.conf file. Odd > because I opened > the file with my editor and used the search in the editor and > didn't find it > the first time. In the conf file is the following line: > > High Scoring Spam Actions = store forward rgreen@trayerproducts.com > > I do now recall setting this up to do that. With all my > responsibilities > it's difficult to remember everything I've done. > > Maybe it would be cool to have MailScanner send the forward > as an attachment > rather than have it appear as if it was delivered normally. > Maybe this would > prevent confusion for me. :-) > > Thanks again, > Rod > > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Alex Neuman van der Hans > Sent: Tuesday, December 21, 2004 9:57 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Receiving other people's mail > > > You could be in BCC. Check your mail logs (you can use the > message ID for > reference) and, if you want to be sure in the future (except > in cases where > end user privacy may be a concern) check the MailScanner.conf > file for a > setting that adds "mailscanner from" and "mailscanner to" to > the headers so > you'll know. > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green Sent: Tuesday, December 21, 2004 9:11 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Receiving other people's mail Hello. I'm using MailScanner (I am not sure which version) along with Postfix. While tweaking SpamAssassin I was looking at headers of some spam I've received and noticed that my address is not anywhere in the headers. An address of a co-worker is but mine is nowhere to be found. I checked mailscanner.conf and the forward directive is not set for spam. Any ideas on how I'm receiving mail addressed to another user? I've checked my virtual maps file as well as my aliases file and nothing is setup to forward mail to me. The only mail I'm getting addressed to the co-worker is spam. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Tue Dec 21 15:27:14 2004 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:27:59 2006 Subject: Van MS scan for spam in other languages? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Check the options: ok_languages ok_locales in your local.cf or spam.assassin.prefs.conf file. Adri. > -----Original Message----- > From: Ugo Bellavance [mailto:ugob@CAMO-ROUTE.COM] > Sent: 21 December, 2004 16:13 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Van MS scan for spam in other languages? > > > Lance Haig wrote: > > We have a multicultural environment here and I was > wondering if MS can > > kill spam in Spanish, Italian and French. > > I know that most spam is English but we have been asked to > see if our > > current solution does it. > > Spamassassin, which is used to catch spam in MailScanner, has > rules for > different languages. See the tests list at www.spamassassin.org > > > > > Thanks > > > > Lance > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Tue Dec 21 15:30:04 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:27:59 2006 Subject: Receiving other people's mail Message-ID: Ahh.. Very cool! Thanks! -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Adri Koppes Sent: Tuesday, December 21, 2004 10:25 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Receiving other people's mail You can do that to. Change the line to: High Scoring Spam Actions = store attachment forward rgreen@trayerproducts.com Adri. > -----Original Message----- > From: Rodney Green [mailto:rgreen@TRAYERPRODUCTS.COM] > Sent: 21 December, 2004 16:21 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Receiving other people's mail > > > Thanks a lot guys. I looked through the logs and found the following > line: > > Dec 21 09:38:21 mail2 MailScanner[10307]: Spam Actions: message > C7AF64BE0 actions are store,forward,rgreen@trayerproducts.com > > So, I missed the forward in the MailScanner.conf file. Odd because I > opened the file with my editor and used the search in the editor and > didn't find it > the first time. In the conf file is the following line: > > High Scoring Spam Actions = store forward rgreen@trayerproducts.com > > I do now recall setting this up to do that. With all my > responsibilities it's difficult to remember everything I've done. > > Maybe it would be cool to have MailScanner send the forward as an > attachment rather than have it appear as if it was delivered normally. > Maybe this would > prevent confusion for me. :-) > > Thanks again, > Rod > > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Alex Neuman van der Hans > Sent: Tuesday, December 21, 2004 9:57 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Receiving other people's mail > > > You could be in BCC. Check your mail logs (you can use the message ID > for > reference) and, if you want to be sure in the future (except in cases > where end user privacy may be a concern) check the MailScanner.conf > file for a > setting that adds "mailscanner from" and "mailscanner to" to > the headers so > you'll know. > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green Sent: Tuesday, December 21, 2004 9:11 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Receiving other people's mail Hello. I'm using MailScanner (I am not sure which version) along with Postfix. While tweaking SpamAssassin I was looking at headers of some spam I've received and noticed that my address is not anywhere in the headers. An address of a co-worker is but mine is nowhere to be found. I checked mailscanner.conf and the forward directive is not set for spam. Any ideas on how I'm receiving mail addressed to another user? I've checked my virtual maps file as well as my aliases file and nothing is setup to forward mail to me. The only mail I'm getting addressed to the co-worker is spam. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Tue Dec 21 15:38:45 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:27:59 2006 Subject: SA/MS Testing Message-ID: Hello. Is there a way to re-inject a message into MailScanner so it will be scanned again by MS/ClamAV/SpamAssassin? I've added some spam to my bayes DB using sa-learn and would like to test sending the same spam through again and see if it is filtered properly. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Tue Dec 21 15:51:06 2004 From: marcel-ml at IRC-ADDICTS.DE (g) Date: Thu Jan 12 21:27:59 2006 Subject: Some Problems with MS Message-ID: Hi there, > Have you upgraded anything recently? New version of sendmail by chance? > nothing updated.. currently running the following: my system seems to have enough space to handle the mails, as my load seems to be low .. marcel:~ # MailScanner -v Running on Linux marcel 2.4.21-261-athlon #1 Wed Nov 17 22:47:12 UTC 2004 i686 unknown This is SuSE Linux 8.1 (i386) This is Perl version 5.008004 (5.8.4) This is MailScanner version 4.35.11 Module versions are: 1.00 AnyDBM_File 1.14 Archive::Zip 1.02 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.05 Fcntl 2.72 File::Basename 2.07 File::Copy 2.01 FileHandle 1.06 File::Path 0.14 File::Temp 1.27 HTML::Entities 3.38 HTML::Parser 2.28 HTML::TokeParser 1.21 IO 1.10 IO::File 1.123 IO::Pipe 3.05 MIME::Base64 5.415 MIME::Decoder 5.415 MIME::Decoder::UU 5.415 MIME::Head 5.415 MIME::Parser 3.03 MIME::QuotedPrint 5.415 MIME::Tools 0.10 Net::CIDR 1.08 POSIX 1.77 Socket 0.05 Sys::Syslog 1.02 Time::localtime Optional module versions are: 1.810 DB_File 1.06 Digest 1.01 Digest::HMAC 2.33 Digest::MD5 2.10 Digest::SHA1 missing Inline missing Mail::ClamAV 2.64 Mail::SpamAssassin 1.997 Mail::SPF::Query 0.15 Net::CIDR::Lite 0.48 Net::DNS 0.32 Net::LDAP missing Parse::RecDescent missing SAVI 1.2 Sys::Hostname::Long 2.40 Test::Harness 0.47 Test::Simple 1.95 Text::Balanced 1.32 URI ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Tue Dec 21 15:52:54 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:27:59 2006 Subject: SA/MS Testing Message-ID: Try telnetting to port 25, doing a "HELO " followed by what the spammer said his/her hello was, then "MAIL FROM:" what the spammer said the origin was, "RCPT TO:" to you, then DATA, and finally, the message itself. A single period, and QUIT. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green Sent: Tuesday, December 21, 2004 10:39 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: SA/MS Testing Hello. Is there a way to re-inject a message into MailScanner so it will be scanned again by MS/ClamAV/SpamAssassin? I've added some spam to my bayes DB using sa-learn and would like to test sending the same spam through again and see if it is filtered properly. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.thomas at PSYSOLUTIONS.COM Tue Dec 21 16:47:30 2004 From: richard.thomas at PSYSOLUTIONS.COM (Richard Thomas) Date: Thu Jan 12 21:27:59 2006 Subject: Receiving other people's mail Message-ID: Julian Field wrote: >> > The addresses in the headers are totally irrelevant to the delivery of > the message. The only addresses that matter are the recipients as stated > in the message envelope. Which will frequently get added to the headers by the SMTP server. I would much prefer to see a few headers from which some real infomration might be divined than sit here making wild-ass guesses. Rich > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > -- MIS Department | |Phone: +1 615 312 5787 840 Crescent Ctr Dr | Psychiatric Solutions Inc |Fax: +1 615 312 5711 Suite 460 | | Franklin, TN 37067 | | ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Tue Dec 21 16:52:18 2004 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:27:59 2006 Subject: Mail Server problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, Forgive me as this may or may not be a true MailScanner issue but I would appreciate some input from the experts on this list. My mail server has been periodically rejecting mail with the following error [logs from sending mail-relay]: 2004-12-20 18:07:49.596345500 delivery 12914: deferral: Connected_to_199.243.151.38_but_sender_was_rejected./Remote_host_said:_452_4.4.5_Insufficient_disk_space;_try_again_later/ My logs report: Dec 20 18:15:29 rosewood sendmail[20639]: iBKNFTDN020639: low on space (SMTP-DAEMON needs 1451858 bytes + 100 blocks in /var/spool/mqueue), max avail: 0 My disk usage looks like: Filesystem Size Used Avail Use% Mounted on /dev/hda2 572M 375M 168M 70% / /dev/hda1 122M 24M 92M 21% /boot /dev/hda3 5.4G 2.1G 3.1G 41% /home none 496M 0 496M 0% /dev/shm /dev/hda7 28G 15G 12G 56% /usr /dev/hda5 2.0G 1.8G 101M 95% /var So, it is obvious I have a disk space issue in my /var partition. Someone on the list recently suggested copying my /var/mail directories to say my /usr partition and then symlinking to it from /var. Any thoughts on the viability of this? Also, when I first built this machine, I had not anticipated using MailScanner and Spamassassin and mail quarantines etc, so what do most of you assign for a partition size to /var when you are building your machines? I greatly appreciate any help anyone has to offer on this as I have some very agitated clients. Cheers Dave ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Tue Dec 21 16:54:49 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:27:59 2006 Subject: Mail Server problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Now I'm going to work with LVM Dave Filchak wrote: > Hello, > > Forgive me as this may or may not be a true MailScanner issue but I > would appreciate some input from the experts on this list. > > My mail server has been periodically rejecting mail with the following > error [logs from sending mail-relay]: > > 2004-12-20 18:07:49.596345500 delivery 12914: deferral: > Connected_to_199.243.151.38_but_sender_was_rejected./Remote_host_said:_452_4.4.5_Insufficient_disk_space;_try_again_later/ > > > > My logs report: > > Dec 20 18:15:29 rosewood sendmail[20639]: iBKNFTDN020639: low on space > (SMTP-DAEMON needs 1451858 bytes + 100 blocks in /var/spool/mqueue), max > avail: 0 > > My disk usage looks like: > > Filesystem Size Used Avail Use% Mounted on > /dev/hda2 572M 375M 168M 70% / > /dev/hda1 122M 24M 92M 21% /boot > /dev/hda3 5.4G 2.1G 3.1G 41% /home > none 496M 0 496M 0% /dev/shm > /dev/hda7 28G 15G 12G 56% /usr > /dev/hda5 2.0G 1.8G 101M 95% /var > > So, it is obvious I have a disk space issue in my /var partition. > Someone on the list recently suggested copying my /var/mail directories > to say my /usr partition and then symlinking to it from /var. Any > thoughts on the viability of this? Also, when I first built this > machine, I had not anticipated using MailScanner and Spamassassin and > mail quarantines etc, so what do most of you assign for a partition size > to /var when you are building your machines? > > I greatly appreciate any help anyone has to offer on this as I have some > very agitated clients. > > Cheers > > Dave > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Tue Dec 21 17:00:04 2004 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:27:59 2006 Subject: Idiot Message-ID: Sorry to the list. I feel like an idiot as my last email got sent to the list twice, and in different versions. I thought my local virus and privacy settings had blocked it from going. Sorry Dave ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Tue Dec 21 17:58:13 2004 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:27:59 2006 Subject: Mail Server problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Additional log info: to follow is another log info indicating an issue with what seems to be disk space: (626/12), delay=00:05:06, xdelay=00:00:00, mailer=local, pri=1564209, dsn=4.0.0, stat=Deferred: local mailer (/usr/bin/procmail) exited with EX_TEMPFAIL Dave Dave Filchak wrote: > Hello, > > Forgive me as this may or may not be a true MailScanner issue but I > would appreciate some input from the experts on this list. > > My mail server has been periodically rejecting mail with the following > error [logs from sending mail-relay]: > > 2004-12-20 18:07:49.596345500 delivery 12914: deferral: > Connected_to_199.243.151.38_but_sender_was_rejected./Remote_host_said:_452_4.4.5_Insufficient_disk_space;_try_again_later/ > > > > My logs report: > > Dec 20 18:15:29 rosewood sendmail[20639]: iBKNFTDN020639: low on space > (SMTP-DAEMON needs 1451858 bytes + 100 blocks in /var/spool/mqueue), max > avail: 0 > > My disk usage looks like: > > Filesystem Size Used Avail Use% Mounted on > /dev/hda2 572M 375M 168M 70% / > /dev/hda1 122M 24M 92M 21% /boot > /dev/hda3 5.4G 2.1G 3.1G 41% /home > none 496M 0 496M 0% /dev/shm > /dev/hda7 28G 15G 12G 56% /usr > /dev/hda5 2.0G 1.8G 101M 95% /var > > So, it is obvious I have a disk space issue in my /var partition. > Someone on the list recently suggested copying my /var/mail directories > to say my /usr partition and then symlinking to it from /var. Any > thoughts on the viability of this? Also, when I first built this > machine, I had not anticipated using MailScanner and Spamassassin and > mail quarantines etc, so what do most of you assign for a partition size > to /var when you are building your machines? > > I greatly appreciate any help anyone has to offer on this as I have some > very agitated clients. > > Cheers > > Dave > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cpicciotto at KALISYSTEMS.COM Tue Dec 21 18:09:39 2004 From: cpicciotto at KALISYSTEMS.COM (Chris Picciotto) Date: Thu Jan 12 21:27:59 2006 Subject: MS/SA and DNS load (really: "relays.visi.com")? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is *really* good information. Since a dead DNSBL requires SA to timeout, which is a resource drain, you would think that the SA folks would have regular "updates" of some sort to make sure the tests are valid and not failiing. Not version updates to SA, but perhaps test data/scoring updates. Just my thoughts. Chris ----- Original Message ----- From: "Martin Hepworth" To: Sent: Tuesday, December 21, 2004 3:55 AM Subject: Re: MS/SA and DNS load (really: "relays.visi.com")? > Hi > > yes the visi.com RBL is dead and is not expected to be resurected... > > disable it by giving it a zero score in spam.assassin.prefs.conf > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Tue Dec 21 18:15:16 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:59 2006 Subject: MS/SA and DNS load (really: "relays.visi.com")? Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Chris Picciotto > Sent: Tuesday, December 21, 2004 1:10 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MS/SA and DNS load (really: "relays.visi.com")? > > This is *really* good information. > > Since a dead DNSBL requires SA to timeout, which is a resource drain, you > would think that the SA folks would have regular "updates" of some sort to > make sure the tests are valid and not failiing. Not version updates to SA, > but perhaps test data/scoring updates. > > Just my thoughts. > Chris I picked this up off the web a while back. I was just waiting for the right question to fire it off to the list. Thanks for asking the right question Chris :) "At the Las Vegas conference, Apache also revealed that the planned 3.1 release of its open-source spam filter, SpamAssassin, would focus on speed and accuracy. Expected in three to four months, version 3.1 is expected to feature faster filtering and quicker updates to rules, which look for spam-related patterns in messaging. Theo Van Dinter, who serves on the Apache management committee for SpamAssassin, said rules had to be updated quickly so Apache could stay ahead of spammers. "It's an arms race, really," he said. Also planned for release 3.1 is an "early exit" feature that allows the spam engine not to process an e-mail any further once it identifies it as spam." Sorry but I can't remember which clipping server sent me the quote. Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 21 18:17:05 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:27:59 2006 Subject: MS/SA and DNS load (really: "relays.visi.com")? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just add score RCVD_IN_RSL 0 to your spam.assassin.prefs.conf and restart MailScanner. Chris Picciotto wrote: > This is *really* good information. > > Since a dead DNSBL requires SA to timeout, which is a resource drain, you > would think that the SA folks would have regular "updates" of some > sort to > make sure the tests are valid and not failiing. Not version updates to > SA, > but perhaps test data/scoring updates. > > Just my thoughts. > Chris > > ----- Original Message ----- > From: "Martin Hepworth" > To: > Sent: Tuesday, December 21, 2004 3:55 AM > Subject: Re: MS/SA and DNS load (really: "relays.visi.com")? > > >> Hi >> >> yes the visi.com RBL is dead and is not expected to be resurected... >> >> disable it by giving it a zero score in spam.assassin.prefs.conf > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Tue Dec 21 18:36:01 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:27:59 2006 Subject: SA/MS Testing Message-ID: Thanks Alex. I did as you said. Odd how when I run the message through the system, by telneting like you said, and it gives me an SA score below 5. When I run the same message through spamassassin using "spamassassin -t < messagefile" I see a much higher score of 11.9. I noticed that when running "spamassasin -t" that BAYES_99 is one of the tests listed but when I send the message through the system I see no BAYES related tests in the message headers. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alex Neuman van der Hans Sent: Tuesday, December 21, 2004 10:53 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: SA/MS Testing Try telnetting to port 25, doing a "HELO " followed by what the spammer said his/her hello was, then "MAIL FROM:" what the spammer said the origin was, "RCPT TO:" to you, then DATA, and finally, the message itself. A single period, and QUIT. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green Sent: Tuesday, December 21, 2004 10:39 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: SA/MS Testing Hello. Is there a way to re-inject a message into MailScanner so it will be scanned again by MS/ClamAV/SpamAssassin? I've added some spam to my bayes DB using sa-learn and would like to test sending the same spam through again and see if it is filtered properly. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Tue Dec 21 19:29:25 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:59 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: Recently I am noticing the following messages in my mail log. As far as I can tell it does not appear an issue other than making me wonder why it is saying it. Thoughts? r, Steve iBLJa1Gu008596: machinename [10.10.8.103] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Tue Dec 21 19:48:24 2004 From: marcel-ml at IRC-ADDICTS.DE (g) Date: Thu Jan 12 21:27:59 2006 Subject: RulesDuJour Questions Message-ID: Hi there, currently i am using the RulesDuJour-Script on SA 2.64.. Now i received the following msgs as postmaster.. maybe i am a bit paranoid..or completely stupid.. but does someone could tell me what to do with these msgs? --- snip here --- SARE Adult Content Ruleset has changed on marcel. Version line: # Version: 01.02.03 # The Adult set has been renamed to match SARE's updated standards, the new name is 70_sare_adult.cf SARE BIZ/Marketing/Learning Ruleset (for SA ver. 2.5x and greater) has changed on marcel. Version line: # Version: 01.02.02 # The BML set has been renamed to match SARE's updated standards, the new name is 72_sare_bml_post25x.cf SARE Fraud Detection Ruleset (for SA ver. 2.5x and greater) has changed on marcel. Version line: # Version: 01.03.02 # NOTE: Please update your scripts to pull this file from it's new location http://www.rulesemporium.com/rules/99_sare_fraud_post25x.cf ***WARNING***: /usr/bin/spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint failed. Lint output: Failed to parse line in SpamAssassin configuration, skipping: report_header 1 Failed to parse line in SpamAssassin configuration, skipping: detailed_phrase_score 1 Failed to parse line in SpamAssassin configuration, skipping: envelope_sender_header X-MailScanner-From Failed to parse line in SpamAssassin configuration, skipping: lock_method flock --- snip here --- all these in just one mail.. thanks for any kind of help.. and happy christmas season-time.. Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Tue Dec 21 19:54:13 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:27:59 2006 Subject: RulesDuJour Questions Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of g > Sent: Tuesday, December 21, 2004 2:48 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: RulesDuJour Questions > > Hi there, > > currently i am using the RulesDuJour-Script on SA 2.64.. > > Now i received the following msgs as postmaster.. > > maybe i am a bit paranoid..or completely stupid.. > > but does someone could tell me what to do with these msgs? > > --- snip here --- > > SARE Adult Content Ruleset has changed on marcel. > Version line: # Version: 01.02.03 # The Adult set has been renamed to > match SARE's updated standards, the new name is 70_sare_adult.cf > > SARE BIZ/Marketing/Learning Ruleset (for SA ver. 2.5x and greater) has > changed on marcel. > Version line: # Version: 01.02.02 # The BML set has been renamed to match > SARE's updated standards, the new name is 72_sare_bml_post25x.cf > > SARE Fraud Detection Ruleset (for SA ver. 2.5x and greater) has changed on > marcel. > Version line: # Version: 01.03.02 # NOTE: Please update your scripts to > pull this file from it's new location > http://www.rulesemporium.com/rules/99_sare_fraud_post25x.cf > Everything to this point is informational. It's jus telling you what it's doing. > > ***WARNING***: /usr/bin/spamassassin -p > /etc/MailScanner/spam.assassin.prefs.conf --lint failed. This is not good and it is important. > > Lint output: Failed to parse line in SpamAssassin configuration, skipping: > report_header 1 > Failed to parse line in SpamAssassin configuration, skipping: > detailed_phrase_score 1 > Failed to parse line in SpamAssassin configuration, skipping: > envelope_sender_header X-MailScanner-From > Failed to parse line in SpamAssassin configuration, skipping: lock_method > flock Remove these lines from your spam assassin configuration file, it's probably /etc/MailScanner/spam.assassin.prefs.conf: report_header 1 detailed_phrase_score 1 envelope_sender_header X-MailScanner-From- flock Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com > > --- snip here --- > > all these in just one mail.. > > thanks for any kind of help.. > > and happy christmas season-time.. > > Marcel > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and dangerous content by The > MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be > clean. > > -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Dec 21 21:35:05 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:27:59 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Hickel wrote: > Recently I am noticing the following messages in my mail log. As far as > I can tell it does not appear an issue other than making me wonder why > it is saying it. Thoughts? > > r, > > Steve > > iBLJa1Gu008596: machinename [10.10.8.103] did not issue > MAIL/EXPN/VRFY/ETRN during connection to MTA You server was waiting for a command, and never got it, this usually happens on dropped connexions, testing or when you just telnet to your box (port 25) and then cut the connexion. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Tue Dec 21 21:56:32 2004 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:27:59 2006 Subject: Mail Server problems Message-ID: Dave Filchak wrote: > Hello, > > Forgive me as this may or may not be a true MailScanner issue but I > would appreciate some input from the experts on this list. > > My mail server has been periodically rejecting mail with the following > error [logs from sending mail-relay]: > > 2004-12-20 18:07:49.596345500 delivery 12914: deferral: > Connected_to_199.243.151.38_but_sender_was_rejected./Remote_host_said:_452_4 .4.5_Insufficient_disk_space;_try_again_later/ > How aggressive are you rolling your log files? I'd look in /var/log to see if there's not a years worth or so of old logs that have been tarred/gzipped and and just taking up space. If so, I'd archive them to another partition or delete them and see if you can free up a few hundred megs. Not sure about other distros, but SuSE seems to default to keeping logs around for a 365 days or 99 iterations, whichever comes first (if I understand logrotate arightly). If you distro is similar there's probably a lot of deadwood that you could prune... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Tue Dec 21 22:06:53 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:27:59 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: Could pinging the box give this message in the log?? On Tue, 2004-12-21 at 16:35, Ugo Bellavance wrote: > Steve Hickel wrote: > > Recently I am noticing the following messages in my mail log. As far as > > I can tell it does not appear an issue other than making me wonder why > > it is saying it. Thoughts? > > > > r, > > > > Steve > > > > iBLJa1Gu008596: machinename [10.10.8.103] did not issue > > MAIL/EXPN/VRFY/ETRN during connection to MTA > > You server was waiting for a command, and never got it, this usually > happens on dropped connexions, testing or when you just telnet to your > box (port 25) and then cut the connexion. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rzewnickie at RFA.ORG Tue Dec 21 22:18:27 2004 From: rzewnickie at RFA.ORG (Eric Dantan Rzewnicki) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: On Tue, Dec 21, 2004 at 05:06:53PM -0500, Steve Hickel wrote: > Could pinging the box give this message in the log?? no. -- Eric Dantan Rzewnicki | Systems Engineer I Technical Operations Division | Radio Free Asia 2025 M Street, NW | Washington, DC 20036 | 202-530-4900 CONFIDENTIAL COMMUNICATION This e-mail message is intended only for the use of the addressee and may contain information that is privileged and confidential. Any unauthorized dissemination, distribution, or copying is strictly prohibited. If you receive this transmission in error, please contact network@rfa.org. sorry for the above company mandated noise .... :( ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Tue Dec 21 22:40:52 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: So what would cause this? Seems only to have started recently after upgrading to latest mailscanner?? r, Steve On Tue, 2004-12-21 at 16:35, Ugo Bellavance wrote: > Steve Hickel wrote: > > Recently I am noticing the following messages in my mail log. As far as > > I can tell it does not appear an issue other than making me wonder why > > it is saying it. Thoughts? > > > > r, > > > > Steve > > > > iBLJa1Gu008596: machinename [10.10.8.103] did not issue > > MAIL/EXPN/VRFY/ETRN during connection to MTA > > You server was waiting for a command, and never got it, this usually > happens on dropped connexions, testing or when you just telnet to your > box (port 25) and then cut the connexion. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KGoods at AIAINSURANCE.COM Tue Dec 21 22:46:49 2004 From: KGoods at AIAINSURANCE.COM (Ken Goods) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY /ETRN during connection to MTA Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: Steve Hickel [mailto:smhickel@CHARTERMI.NET] >Sent: Tuesday, December 21, 2004 2:41 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: [MAILSCANNER] iBLJa1Gu008596: .. did not issue >MAIL/EXPN/VRFY/ETRN during connection to MTA >So what would cause this? Seems only to have started recently after >upgrading to latest mailscanner?? >r, >Steve Steve, In my case this is fairly common. I have been seeing this for as long as I've been here... ~5 years, as someone said, it's a connection problem between MTA's and I choose to think it's on the other end. My guess is zombie-spam-bots getting taken off line in the middle of a spam attempt. I've not heard of any valid emails being affected by this message. I've listed below what I see on a normal day... sometimes less not normally any more than this. Regards, Ken Did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA: 217.5.142.194 : 34 Time(s) 203.200.95.35 : 2 Time(s) 24.17.12.212 : 2 Time(s) 4.62.85.216 : 2 Time(s) 63.245.89.85 : 2 Time(s) 216.21.210.32 : 1 Time(s) 83.102.136.96 : 1 Time(s) 62.59.193.130 : 1 Time(s) 64.169.100.217 : 1 Time(s) 66.126.254.87 : 1 Time(s) 195.47.196.198 : 1 Time(s) 69.172.10.37 : 1 Time(s) 24.98.171.158 : 1 Time(s) 82.122.64.248 : 1 Time(s) 60.42.26.204 : 1 Time(s) 64.252.199.35 : 1 Time(s) 216.130.236.133 : 1 Time(s) 207.164.149.3 : 1 Time(s) 85.72.12.88 : 1 Time(s) 195.120.10.86 : 1 Time(s) 82.224.117.154 : 1 Time(s) 68.115.26.85 : 1 Time(s) 207.200.128.40 : 1 Time(s) 83.134.75.164 : 1 Time(s) 64.231.60.245 : 1 Time(s) 157.130.127.82 : 1 Time(s) 222.94.240.204 : 1 Time(s) 216.21.210.26 : 1 Time(s) 12.135.59.186 : 1 Time(s) 24.86.115.133 : 1 Time(s) 66.67.63.197 : 1 Time(s) 84.120.75.212 : 1 Time(s) 200.83.226.152 : 1 Time(s) 61.2.32.96 : 1 Time(s) 222.156.102.71 : 1 Time(s) 24.20.119.161 : 1 Time(s) 68.150.35.208 : 1 Time(s) 213.22.46.222 : 1 Time(s) 81.169.226.55 : 1 Time(s) 200.37.44.119 : 1 Time(s) 69.9.84.98 : 1 Time(s) 213.169.167.120 : 1 Time(s) 65.200.81.195 : 1 Time(s) 83.35.32.76 : 1 Time(s) 128.59.58.92 : 1 Time(s) 193.248.118.198 : 1 Time(s) 63.251.136.47 : 1 Time(s) 69.108.45.219 : 1 Time(s) 64.52.238.67 : 1 Time(s) 62.44.5.2 : 1 Time(s) 195.38.68.116 : 1 Time(s) 85.97.66.189 : 1 Time(s) 213.220.239.176 : 1 Time(s) 64.125.101.69 : 1 Time(s) 202.71.128.246 : 1 Time(s) 195.157.85.93 : 1 Time(s) 24.130.193.2 : 1 Time(s) 24.199.115.11 : 1 Time(s) 213.189.174.203 : 1 Time(s) 200.90.17.85 : 1 Time(s) 12.144.86.78 : 1 Time(s) 217.57.42.109 : 1 Time(s) 84.121.112.133 : 1 Time(s) 200.30.246.1 : 1 Time(s) 82.155.0.156 : 1 Time(s) 61.11.48.252 : 1 Time(s) 66.238.96.51 : 1 Time(s) 141.153.32.193 : 1 Time(s) 213.186.236.165 : 1 Time(s) 82.226.194.24 : 1 Time(s) 69.18.207.34 : 1 Time(s) 24.247.187.75 : 1 Time(s) 209.17.156.35 : 1 Time(s) 144.137.56.153 : 1 Time(s) 198.109.216.83 : 1 Time(s) 24.241.164.27 : 1 Time(s) 84.4.34.2 : 1 Time(s) 69.211.117.148 : 1 Time(s) 204.126.194.10 : 1 Time(s) 207.115.86.178 : 1 Time(s) 201.245.1.218 : 1 Time(s) 81.67.18.165 : 1 Time(s) 82.64.7.169 : 1 Time(s) 64.132.145.15 : 1 Time(s) 82.255.59.82 : 1 Time(s) 212.36.51.145 : 1 Time(s) Ken Goods Network Administrator AIA Insurance, Inc. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Tue Dec 21 22:58:43 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Hickel wrote: > So what would cause this? Seems only to have started recently after > upgrading to latest mailscanner?? > > On Tue, 2004-12-21 at 16:35, Ugo Bellavance wrote: > >>>iBLJa1Gu008596: machinename [10.10.8.103] did not issue >>>MAIL/EXPN/VRFY/ETRN during connection to MTA >> >>You server was waiting for a command, and never got it, this usually >>happens on dropped connexions, testing or when you just telnet to your >>box (port 25) and then cut the connexion. Ugo mentioned several ways of getting those logs, I get them from our monitoring servers that connect every five minutes to see if the smtp service is available, it drops the connection when satisfied. You can create such a log yourself by issuing "telnet localhost 25" and typing "quit" immediately after the MTA answers. Ping does not connect to 53/tcp, it's a completely different mechanism. Who is machinename [10.10.8.103]? That would be a good start. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Tue Dec 21 23:02:44 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Peter Bonivart wrote: > Ping does not connect to 53/tcp, it's a completely different mechanism. Sorry for replying to my own post but I for some reason wrote 53 (DNS) when I of course meant 25 (SMTP). Sorry for the confusion. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Tue Dec 21 23:05:59 2004 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:28:00 2006 Subject: Mail Server problems Message-ID: Actually, we roll them over every month and keep only the last 4 months and then the older ones are discarded or archived. Dave Kevin Miller wrote: >Dave Filchak wrote: > > >>Hello, >> >>Forgive me as this may or may not be a true MailScanner issue but I >>would appreciate some input from the experts on this list. >> >>My mail server has been periodically rejecting mail with the following >>error [logs from sending mail-relay]: >> >>2004-12-20 18:07:49.596345500 delivery 12914: deferral: >> >> >> >Connected_to_199.243.151.38_but_sender_was_rejected./Remote_host_said:_452_4 >.4.5_Insufficient_disk_space;_try_again_later/ > > >> >> >> > >How aggressive are you rolling your log files? I'd look in /var/log to see >if there's not a years worth or so of old logs that have been tarred/gzipped >and and just taking up space. If so, I'd archive them to another partition >or delete them and see if you can free up a few hundred megs. Not sure >about other distros, but SuSE seems to default to keeping logs around for a >365 days or 99 iterations, whichever comes first (if I understand logrotate >arightly). If you distro is similar there's probably a lot of deadwood that >you could prune... > >...Kevin >-- >Kevin Miller Registered Linux User No: 307357 >CBJ MIS Dept. Network Systems Admin., Mail Admin. >155 South Seward Street ph: (907) 586-0242 >Juneau, Alaska 99801 fax: (907 586-4500 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ohookins at GMAIL.COM Tue Dec 21 23:22:13 2004 From: ohookins at GMAIL.COM (Oliver Hookins) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Peter Bonivart wrote: > Peter Bonivart wrote: > >> Ping does not connect to 53/tcp, it's a completely different mechanism. > > > Sorry for replying to my own post but I for some reason wrote 53 (DNS) > when I of course meant 25 (SMTP). Sorry for the confusion. > > -- > /Peter Bonivart Ping doesn't connect to port 25 either. It's a different protocol altogether. Ping uses ICMP whereas SMTP uses TCP. DNS most often uses UDP. Ping can't be altogether relied on to determine connectivity with a host as it might be blocking ICMP traffic. Regards, Oliver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Tue Dec 21 23:14:40 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Hickel wrote: > So what would cause this? Seems only to have started recently after > upgrading to latest mailscanner?? It seems to be a private address, so maybe you should check what is this machine... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cpicciotto at KALISYSTEMS.COM Tue Dec 21 23:32:00 2004 From: cpicciotto at KALISYSTEMS.COM (Chris Picciotto) Date: Thu Jan 12 21:28:00 2006 Subject: MS/SA and DNS load (really: "relays.visi.com")? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks for this Steve. I think that SA is *very* much on the right track with release 3.1. They need to begin to think of their functionality a little more like virus scanning providers do. It is a "cat and mouse" game (or an "arms race" if you like), and they need to stay up on their definitions as well. Quick automated updates would do the trick. Just a quick comment on "early exit" as you point out. The only thing I would worry about is if this will break MS's High Scoring Spam actions. If it exits as soon as the "spam" level is reached, how will we know if it is High Scoring (and handle differently if needed). This is one nice functionality of MS I think. Food for thought..... Chris ----- Original Message ----- From: "Steve Swaney" To: Sent: Tuesday, December 21, 2004 8:15 AM Subject: Re: MS/SA and DNS load (really: "relays.visi.com")? > > I picked this up off the web a while back. I was just waiting for the > right > question to fire it off to the list. Thanks for asking the right question > Chris :) > > "At the Las Vegas conference, Apache also revealed that the planned 3.1 > release of its open-source spam filter, SpamAssassin, would focus on speed > and accuracy. Expected in three to four months, version 3.1 is expected to > feature faster filtering and quicker updates to rules, which look for > spam-related patterns in messaging. > > Theo Van Dinter, who serves on the Apache management committee for > SpamAssassin, said rules had to be updated quickly so Apache could stay > ahead of spammers. "It's an arms race, really," he said. > > Also planned for release 3.1 is an "early exit" feature that allows the > spam > engine not to process an e-mail any further once it identifies it as > spam." > > Sorry but I can't remember which clipping server sent me the quote. > > Steve > > Steve Swaney > President > Fortress Systems Ltd. > www.fsl.com > steve.swaney@fsl.com > > > -- > This message has been scanned for viruses and dangerous content by The > MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be > clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Tue Dec 21 23:39:21 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:28:00 2006 Subject: MS/SA and DNS load (really: "relays.visi.com")? Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Chris Picciotto > Sent: Tuesday, December 21, 2004 6:32 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MS/SA and DNS load (really: "relays.visi.com")? > > Thanks for this Steve. > > I think that SA is *very* much on the right track with release 3.1. They > need to begin to think of their functionality a little more like virus > scanning providers do. It is a "cat and mouse" game (or an "arms race" if > you like), and they need to stay up on their definitions as well. Quick > automated updates would do the trick. > > Just a quick comment on "early exit" as you point out. The only thing I > would worry about is if this will break MS's High Scoring Spam actions. If > it exits as soon as the "spam" level is reached, how will we know if it is > High Scoring (and handle differently if needed). This is one nice > functionality of MS I think. > > Food for thought..... > The really great thing about MailScanner is Julian :) When SA 3.1 comes out Julian will make MailScanner "do the right thing". Then we'll all download the latest version and it will work just fine. Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Tue Dec 21 23:52:46 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Oliver Hookins wrote: > Peter Bonivart wrote: > >> Peter Bonivart wrote: >> >>> Ping does not connect to 53/tcp, it's a completely different mechanism. >> >> >> >> Sorry for replying to my own post but I for some reason wrote 53 (DNS) >> when I of course meant 25 (SMTP). Sorry for the confusion. >> >> -- >> /Peter Bonivart > > > Ping doesn't connect to port 25 either. It's a different protocol > altogether. Ping uses ICMP whereas SMTP uses TCP. DNS most often uses > UDP. Ping can't be altogether relied on to determine connectivity with a > host as it might be blocking ICMP traffic. Uhm...I already know that and tried to explain it to Steve who asked if the log lines could come from pings. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Wed Dec 22 01:45:52 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: Understood. ;-) On Tue, 2004-12-21 at 18:02, Peter Bonivart wrote: > Peter Bonivart wrote: > > Ping does not connect to 53/tcp, it's a completely different mechanism. > > Sorry for replying to my own post but I for some reason wrote 53 (DNS) > when I of course meant 25 (SMTP). Sorry for the confusion. > > -- > /Peter Bonivart > > --Unix lovers do it in the Sun > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Wed Dec 22 01:45:21 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: Both servers with this problem share one thing in common. My guess is that it is a monitoring server checking smtp port for operation. I suspect that if I disabled the smtp service check these messages would go away. In Peter's case then since he too see this a lot in the log, it would make sense that he had a device monitoring his SMTP port on his mailserver. Thanks all, Steve On Tue, 2004-12-21 at 17:58, Peter Bonivart wrote: > Steve Hickel wrote: > > So what would cause this? Seems only to have started recently after > > upgrading to latest mailscanner?? > > > > On Tue, 2004-12-21 at 16:35, Ugo Bellavance wrote: > > > >>>iBLJa1Gu008596: machinename [10.10.8.103] did not issue > >>>MAIL/EXPN/VRFY/ETRN during connection to MTA > >> > >>You server was waiting for a command, and never got it, this usually > >>happens on dropped connexions, testing or when you just telnet to your > >>box (port 25) and then cut the connexion. > > Ugo mentioned several ways of getting those logs, I get them from our > monitoring servers that connect every five minutes to see if the smtp > service is available, it drops the connection when satisfied. You can > create such a log yourself by issuing "telnet localhost 25" and typing > "quit" immediately after the MTA answers. > > Ping does not connect to 53/tcp, it's a completely different mechanism. > > Who is machinename [10.10.8.103]? That would be a good start. > > -- > /Peter Bonivart > > --Unix lovers do it in the Sun > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smhickel at CHARTERMI.NET Wed Dec 22 01:47:38 2004 From: smhickel at CHARTERMI.NET (Steve Hickel) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: I believe it is a What's up gold server checking the smtp service is running. That would make sense. Obviously not a MailScanner issue. Thanks all! Steve On Tue, 2004-12-21 at 18:22, Oliver Hookins wrote: > Peter Bonivart wrote: > > Peter Bonivart wrote: > > > >> Ping does not connect to 53/tcp, it's a completely different mechanism. > > > > > > Sorry for replying to my own post but I for some reason wrote 53 (DNS) > > when I of course meant 25 (SMTP). Sorry for the confusion. > > > > -- > > /Peter Bonivart > > Ping doesn't connect to port 25 either. It's a different protocol > altogether. Ping uses ICMP whereas SMTP uses TCP. DNS most often uses > UDP. Ping can't be altogether relied on to determine connectivity with a > host as it might be blocking ICMP traffic. > > Regards, > Oliver > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ohookins at GMAIL.COM Wed Dec 22 02:02:41 2004 From: ohookins at GMAIL.COM (Oliver Hookins) Date: Thu Jan 12 21:28:00 2006 Subject: iBLJa1Gu008596: .. did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Hickel wrote: > I believe it is a What's up gold server checking the smtp service is > running. That would make sense. > > Obviously not a MailScanner issue. Thanks all! > > Steve That sounds familiar. We also use a similar product - Servers Alive - that can do checks on a number of different ports. If you select the SMTP check it connects to that port, sends a HELO command and then a QUIT straight after it receives a response. Regards, Oliver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 22 08:53:22 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:28:00 2006 Subject: RulesDuJour Questions Message-ID: Marcel I'd check the rules_du_jour setting for SA_LINT. It looks like it's not taking the -p parameter properly. make sure it's all on once line and if needed changed the -p to a -C which is what I use. Run the SA_LINT command by hand to make sure you get no errors.. Rest of the updates messages can be ignored as they are purely informational. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 g wrote: > Hi there, > > currently i am using the RulesDuJour-Script on SA 2.64.. > > Now i received the following msgs as postmaster.. > > maybe i am a bit paranoid..or completely stupid.. > > but does someone could tell me what to do with these msgs? > > --- snip here --- > > SARE Adult Content Ruleset has changed on marcel. > Version line: # Version: 01.02.03 # The Adult set has been renamed to > match SARE's updated standards, the new name is 70_sare_adult.cf > > SARE BIZ/Marketing/Learning Ruleset (for SA ver. 2.5x and greater) has > changed on marcel. > Version line: # Version: 01.02.02 # The BML set has been renamed to match > SARE's updated standards, the new name is 72_sare_bml_post25x.cf > > SARE Fraud Detection Ruleset (for SA ver. 2.5x and greater) has changed on > marcel. > Version line: # Version: 01.03.02 # NOTE: Please update your scripts to > pull this file from it's new location > http://www.rulesemporium.com/rules/99_sare_fraud_post25x.cf > > > ***WARNING***: /usr/bin/spamassassin -p > /etc/MailScanner/spam.assassin.prefs.conf --lint failed. > > > Lint output: Failed to parse line in SpamAssassin configuration, skipping: > report_header 1 > Failed to parse line in SpamAssassin configuration, skipping: > detailed_phrase_score 1 > Failed to parse line in SpamAssassin configuration, skipping: > envelope_sender_header X-MailScanner-From > Failed to parse line in SpamAssassin configuration, skipping: lock_method > flock > > > --- snip here --- > > all these in just one mail.. > > thanks for any kind of help.. > > and happy christmas season-time.. > > Marcel ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 22 08:56:32 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:28:00 2006 Subject: MS/SA and DNS load (really: "relays.visi.com")? Message-ID: Hi I'll echo Chris's comments about the early exit. Hopefully this will be an optional feature as I use MW to get info on the score distribution and effectiveness of each rule. If it's bombing out when it reaches a set threshhold you'll loose these stats (or make them meaningless). Hopefully they are doing something sensible like making (my)_rules_du_jour part of the distribution and including the default rules as part of the RDJ check. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Steve Swaney wrote: >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Chris Picciotto >>Sent: Tuesday, December 21, 2004 1:10 PM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: MS/SA and DNS load (really: "relays.visi.com")? >> >>This is *really* good information. >> >>Since a dead DNSBL requires SA to timeout, which is a resource drain, you >>would think that the SA folks would have regular "updates" of some sort to >>make sure the tests are valid and not failiing. Not version updates to SA, >>but perhaps test data/scoring updates. >> >>Just my thoughts. >>Chris > > > I picked this up off the web a while back. I was just waiting for the right > question to fire it off to the list. Thanks for asking the right question > Chris :) > > "At the Las Vegas conference, Apache also revealed that the planned 3.1 > release of its open-source spam filter, SpamAssassin, would focus on speed > and accuracy. Expected in three to four months, version 3.1 is expected to > feature faster filtering and quicker updates to rules, which look for > spam-related patterns in messaging. > > Theo Van Dinter, who serves on the Apache management committee for > SpamAssassin, said rules had to be updated quickly so Apache could stay > ahead of spammers. "It's an arms race, really," he said. > > Also planned for release 3.1 is an "early exit" feature that allows the spam > engine not to process an e-mail any further once it identifies it as spam." > > Sorry but I can't remember which clipping server sent me the quote. > > Steve > > Steve Swaney > President > Fortress Systems Ltd. > www.fsl.com > steve.swaney@fsl.com > > > -- > This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 22 10:17:19 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:00 2006 Subject: SA/MS Testing Message-ID: Please correct me if I'm wrong, but you'd need to "revert" the message to it's pristine look (meaning no headers from your server etc) before reinjecting it(?). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 21 december 2004 19:36 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: SA/MS Testing > > > Thanks Alex. I did as you said. > > Odd how when I run the message through the system, by > telneting like you > said, and it gives me an SA score below 5. When I run the same message > through spamassassin using "spamassassin -t < messagefile" I > see a much > higher score of 11.9. I noticed that when running > "spamassasin -t" that > BAYES_99 is one of the tests listed but when I send the > message through the > system I see no BAYES related tests in the message headers. > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Alex Neuman van der Hans > Sent: Tuesday, December 21, 2004 10:53 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: SA/MS Testing > > > Try telnetting to port 25, doing a "HELO " followed by what > the spammer said > his/her hello was, then "MAIL FROM:" what the spammer said > the origin was, > "RCPT TO:" to you, then DATA, and finally, the message > itself. A single > period, and QUIT. > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Rodney Green > > Sent: Tuesday, December 21, 2004 10:39 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: SA/MS Testing > > Hello. Is there a way to re-inject a message into MailScanner > so it will be > scanned again by MS/ClamAV/SpamAssassin? I've added some spam > to my bayes DB > using sa-learn and would like to test sending the same spam > through again > and see if it is filtered properly. > > Thanks, > Rod > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 22 10:33:49 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:28:00 2006 Subject: SA/MS Testing Message-ID: Could be mailscanner processes haven't got the correct bayes database (mentioned in spam.assassin.prefs.conf) or permissions. When running by hand you need to be (1) the MailScanner user as defined in MailScanner.conf and (2) use "spamassassin -p /spam.assassin.pref.conf -t < message" -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Steen, Glenn wrote: > Please correct me if I'm wrong, but you'd need to "revert" the message > to it's pristine look (meaning no headers from your server etc) before > reinjecting it(?). > > -- Glenn > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green >>Sent: den 21 december 2004 19:36 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: SA/MS Testing >> >> >>Thanks Alex. I did as you said. >> >>Odd how when I run the message through the system, by >>telneting like you >>said, and it gives me an SA score below 5. When I run the same message >>through spamassassin using "spamassassin -t < messagefile" I >>see a much >>higher score of 11.9. I noticed that when running >>"spamassasin -t" that >>BAYES_99 is one of the tests listed but when I send the >>message through the >>system I see no BAYES related tests in the message headers. >> >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >>Of Alex Neuman van der Hans >>Sent: Tuesday, December 21, 2004 10:53 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: SA/MS Testing >> >> >>Try telnetting to port 25, doing a "HELO " followed by what >>the spammer said >>his/her hello was, then "MAIL FROM:" what the spammer said >>the origin was, >>"RCPT TO:" to you, then DATA, and finally, the message >>itself. A single >>period, and QUIT. >> >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >>Of Rodney Green >> >>Sent: Tuesday, December 21, 2004 10:39 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: SA/MS Testing >> >>Hello. Is there a way to re-inject a message into MailScanner >>so it will be >>scanned again by MS/ClamAV/SpamAssassin? I've added some spam >>to my bayes DB >>using sa-learn and would like to test sending the same spam >>through again >>and see if it is filtered properly. >> >>Thanks, >>Rod >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>mailscanner' in the body of the email. Before posting, read the MAQ >>(http://www.mailscanner.biz/maq/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>mailscanner' in the body of the email. Before posting, read the MAQ >>(http://www.mailscanner.biz/maq/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gary at SAHARA.CO.ZA Wed Dec 22 13:03:04 2004 From: gary at SAHARA.CO.ZA (Gary Alexander) Date: Thu Jan 12 21:28:00 2006 Subject: Weird Problems trying to start MailScanner for first time Message-ID: Hi All I have a number of very successful MailScanner servers, but this new server is giving me problems. I am receiving the following error: ---- orion MailScanner # /opt/MailScanner/bin/check_mailscanner Starting MailScanner... Global symbol "$FIELD_NAME" requires explicit package name at /opt/MailScanner/lib/MailScanner/Message.pm line 4329. Global symbol "$FIELD_NAME" requires explicit package name at /opt/MailScanner/lib/MailScanner/Message.pm line 4332. Compilation failed in require at /opt/MailScanner/bin/MailScanner line 74. BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner line 74. ---- orion MailScanner # perl -v This is perl, v5.8.5 built for i686-linux ---- I have This error is found after installing from the tar.gz version on Gentoo with the latest stable and beta versions (As of 22/12/2004). I have even copied over an install of 4.35.11 from an existing server (also running Gentoo). I have also tried re-emerging perl on the system with no luck. Also I have used CPAN to manually install all required modules, and searched on the mailscanner list archive, google and gentoo forums :( Please contact me privately should you require a log of the installation from install.sh Can anyone assist me here? I am at my wits end :( Thanks Gary - PLEASE NOTE - This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Sahara Computers (Pty) Ltd. Finally, while Sahara Computers attempts to ensure that all email is virus-free, Sahara Computers accepts no liability for any damage caused by any virus transmitted by this email. Sahara Computers (PTY) Ltd 89 Gazelle Avenue, Corporate Park, Midrand, South Africa Private Bag X180, Halfway House, 1685, South Africa ----- Scanned and protected by MailScanner @ mail.sahara.co.za ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 22 13:47:51 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:28:00 2006 Subject: Weird Problems trying to start MailScanner for first time Message-ID: Gary what does "MailScanner -v" show -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Gary Alexander wrote: > Hi All > > I have a number of very successful MailScanner servers, but this new > server is giving me problems. I am receiving the following error: > > ---- > orion MailScanner # /opt/MailScanner/bin/check_mailscanner > Starting MailScanner... > Global symbol "$FIELD_NAME" requires explicit package name at > /opt/MailScanner/lib/MailScanner/Message.pm line 4329. > Global symbol "$FIELD_NAME" requires explicit package name at > /opt/MailScanner/lib/MailScanner/Message.pm line 4332. > Compilation failed in require at /opt/MailScanner/bin/MailScanner line > 74. > BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner > line 74. > ---- > orion MailScanner # perl -v > > This is perl, v5.8.5 built for i686-linux > ---- > > I have > > This error is found after installing from the tar.gz version on Gentoo > with the latest stable and beta versions (As of 22/12/2004). I have even > copied over an install of 4.35.11 from an existing server (also running > Gentoo). I have also tried re-emerging perl on the system with no luck. > Also I have used CPAN to manually install all required modules, and > searched on the mailscanner list archive, google and gentoo forums :( > > Please contact me privately should you require a log of the installation > from install.sh > > Can anyone assist me here? I am at my wits end :( > > Thanks > Gary > > > > - PLEASE NOTE - > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. Please note that any views or opinions presented > in this email are solely those of the author and do not necessarily > represent those of Sahara Computers (Pty) Ltd. Finally, while Sahara > Computers attempts to ensure that all email is virus-free, Sahara > Computers accepts no liability for any damage caused by any virus > transmitted by this email. > > Sahara Computers (PTY) Ltd > 89 Gazelle Avenue, Corporate Park, Midrand, South Africa > Private Bag X180, Halfway House, 1685, South Africa > > ----- > Scanned and protected by MailScanner @ mail.sahara.co.za > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From P.Holzleitner at UNIDO.ORG Wed Dec 22 13:59:19 2004 From: P.Holzleitner at UNIDO.ORG (Peter HOLZLEITNER) Date: Thu Jan 12 21:28:00 2006 Subject: X-MailScanner-From header not passed to SpamAssassin? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I gather that the X-MailScanner-From (and -To) headers, if enabled, are only added at the end of processing. Would it be possible to change that so they are already passed to SpamAssassin (and could be tested in local rules) and the custom logging routine? --Peter ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 22 14:14:22 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:28:00 2006 Subject: X-MailScanner-From header not passed to SpamAssassin? Message-ID: Peter and you'd trust the inclusion of these headers weren't added by a virus/spam before it go to you??? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Peter HOLZLEITNER wrote: > I gather that the X-MailScanner-From (and -To) headers, if enabled, are > only added at the end of processing. Would it be possible to change > that so they are already passed to SpamAssassin (and could be tested in > local rules) and the custom logging routine? > > --Peter > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 22 14:15:40 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: Hello. When a message is quarantined as being spam, how do I unquarantine it so it can be delivered to the user? I use postfix as my MTA. Thanks, Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gary at SAHARA.CO.ZA Wed Dec 22 14:17:48 2004 From: gary at SAHARA.CO.ZA (Gary Alexander) Date: Thu Jan 12 21:28:00 2006 Subject: Weird Problems trying to start MailScanner for first time Message-ID: >Gary > >what does "MailScanner -v" show Exactly the same errors as /opt/MailScanner/bin/check_mailscanner - PLEASE NOTE - This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Sahara Computers (Pty) Ltd. Finally, while Sahara Computers attempts to ensure that all email is virus-free, Sahara Computers accepts no liability for any damage caused by any virus transmitted by this email. Sahara Computers (PTY) Ltd 89 Gazelle Avenue, Corporate Park, Midrand, South Africa Private Bag X180, Halfway House, 1685, South Africa ----- Scanned and protected by MailScanner @ mail.sahara.co.za ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 22 14:33:26 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:00 2006 Subject: SA/MS Testing Message-ID: What I found was that the bayes db path was not set in spam.assassin.prefs.conf and also bayes_file_mode was not set. I set those and bayes is definitely working now. Now some tweaking because there are some false positives. :-) -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth Sent: Wednesday, December 22, 2004 5:34 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: SA/MS Testing Could be mailscanner processes haven't got the correct bayes database (mentioned in spam.assassin.prefs.conf) or permissions. When running by hand you need to be (1) the MailScanner user as defined in MailScanner.conf and (2) use "spamassassin -p /spam.assassin.pref.conf -t < message" -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Steen, Glenn wrote: > Please correct me if I'm wrong, but you'd need to "revert" the message > to it's pristine look (meaning no headers from your server etc) > before reinjecting it(?). > > -- Glenn > > >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Rodney Green >>Sent: den 21 december 2004 19:36 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: SA/MS Testing >> >> >>Thanks Alex. I did as you said. >> >>Odd how when I run the message through the system, by telneting like >>you said, and it gives me an SA score below 5. When I run the same >>message through spamassassin using "spamassassin -t < messagefile" I >>see a much >>higher score of 11.9. I noticed that when running >>"spamassasin -t" that >>BAYES_99 is one of the tests listed but when I send the >>message through the >>system I see no BAYES related tests in the message headers. >> >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Alex Neuman van der Hans >>Sent: Tuesday, December 21, 2004 10:53 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: SA/MS Testing >> >> >>Try telnetting to port 25, doing a "HELO " followed by what the >>spammer said his/her hello was, then "MAIL FROM:" what the spammer >>said the origin was, >>"RCPT TO:" to you, then DATA, and finally, the message >>itself. A single >>period, and QUIT. >> >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Rodney Green >> >>Sent: Tuesday, December 21, 2004 10:39 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: SA/MS Testing >> >>Hello. Is there a way to re-inject a message into MailScanner so it >>will be scanned again by MS/ClamAV/SpamAssassin? I've added some spam >>to my bayes DB >>using sa-learn and would like to test sending the same spam >>through again >>and see if it is filtered properly. >> >>Thanks, >>Rod >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>mailscanner' in the body of the email. Before posting, read the MAQ >>(http://www.mailscanner.biz/maq/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>mailscanner' in the body of the email. Before posting, read the MAQ >>(http://www.mailscanner.biz/maq/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>mailscanner' in the body of the email. Before posting, read the MAQ >>(http://www.mailscanner.biz/maq/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 22 14:42:14 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: If you keep your quarantined files as queue files you could use the postdrop -r -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 15:16 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Quarantined messages > > > Hello. When a message is quarantined as being spam, how do I > unquarantine it > so it can be delivered to the user? I use postfix as my MTA. > > Thanks, > Rod > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ccampbell at BRUEGGERS.COM Wed Dec 22 14:57:59 2004 From: ccampbell at BRUEGGERS.COM (Christian Campbell) Date: Thu Jan 12 21:28:00 2006 Subject: freshclam Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I've been receiving the following for the past two days when running freshclam. Does anyone have any idea how to fix this? I'm running ClamAV .80 ClamAV update process started at Wed Dec 22 09:08:40 2004 Reading CVD header (main.cvd): OK main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: tomek) Reading CVD header (daily.cvd): OK Downloading daily.cvd [*] ERROR: Verification: Broken or not a CVD file Trying again... ClamAV update process started at Wed Dec 22 09:08:44 2004 Reading CVD header (main.cvd): OK main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: tomek) Reading CVD header (daily.cvd): OK Downloading daily.cvd [*] ERROR: Verification: Broken or not a CVD file Trying again... ClamAV update process started at Wed Dec 22 09:08:47 2004 Reading CVD header (main.cvd): OK main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: tomek) Reading CVD header (daily.cvd): OK Downloading daily.cvd [*] ERROR: Verification: Broken or not a CVD file Giving up... Christian Campbell Systems Engineer, Sair LCP, A+, N+, i-Net+ Bruegger's Enterprises Desk: 802-652-9270 Cell: 802-734-5023 Fax: 802-660-4034 Email: ccampbell at brueggers dot com PGP Public Key available via PGP keyservers or http://www2.brueggers.com/pgp/ccampbell.html "We all know Linux is great... It does infinite loops in 5 seconds." -Linus Torvalds ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martelm at QUARK.VSC.EDU Wed Dec 22 15:03:10 2004 From: martelm at QUARK.VSC.EDU (Michael H. Martel) Date: Thu Jan 12 21:28:00 2006 Subject: Could not parse Outlook Rich Text attachment Message-ID: Hello! I'm getting some messages like this : MessageID: iBLGPwu13257 Report: Could not parse Outlook Rich Text attachment Is it just a sign of a bad Rich Text attachment like it says, or is there something I need to do to make MailScanner happy with it ? Thanks for any thoughts! This is Red Hat Linux release 7.3 (Valhalla) This is Perl version 5.008005 (5.8.5) This is MailScanner version 4.36.4 Module versions are: 1.00 AnyDBM_File 1.14 Archive::Zip 1.03 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.05 Fcntl 2.73 File::Basename 2.08 File::Copy 2.01 FileHandle 1.06 File::Path 0.14 File::Temp 1.29 HTML::Entities 3.43 HTML::Parser 2.30 HTML::TokeParser 1.21 IO 1.10 IO::File 1.123 IO::Pipe 3.05 MIME::Base64 5.415 MIME::Decoder 5.415 MIME::Decoder::UU 5.415 MIME::Head 5.415 MIME::Parser 3.03 MIME::QuotedPrint 5.415 MIME::Tools 0.09 Net::CIDR 1.08 POSIX 1.77 Socket 0.05 Sys::Syslog 1.02 Time::localtime Optional module versions are: 1.810 DB_File 1.08 Digest 1.01 Digest::HMAC 2.33 Digest::MD5 2.10 Digest::SHA1 0.44 Inline missing Mail::ClamAV 3.000002 Mail::SpamAssassin 1.997 Mail::SPF::Query 0.15 Net::CIDR::Lite 0.48 Net::DNS 0.32 Net::LDAP 1.94 Parse::RecDescent missing SAVI 1.2 Sys::Hostname::Long 2.42 Test::Harness 0.47 Test::Simple 1.95 Text::Balanced 1.35 URI /usr/local/bin/tnef tnef --version tnef 1.2.3.1 Copyright (C) 1999-2003 by Mark Simpson Copyright (C) 1997 by Thomas Boll (original code) tnef comes with ABSOLUTELY NO WARRANTY. You may redistribute copies of tnef under the terms of the GNU General Public License. For more information about these matters, see the file named COPYING. Michael -- --------------------------------o--------------------------------- Michael H. Martel | Systems Administrator martelm@quark.vsc.edu | Vermont State Colleges http://probe.vsc.edu/~michael | PH:802-241-2544 FX:802-241-3363 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From unews122003 at GMX.NET Wed Dec 22 14:54:18 2004 From: unews122003 at GMX.NET (Ulrich Schneider) Date: Thu Jan 12 21:28:00 2006 Subject: Outlook Mails - MIME::QuotedPrint version 3.03 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi ! I´m running mailscanner-4.31.6-1 on Fedora Core2. Today I´ve updated via yum the following packages: php-mbstring 4.3.10-2.4.i386 php-pear 4.3.10-2.4.i386 php 4.3.10-2.4.i386 krb5-libs 1.3.6-1.i386 Mails - i suppose only sent via Microsoft Outlook - will get quarantined. Postmaster´s sending "sender.error.report.txt" back. This is new! So I suppose it´s because of the updated packages? /var/log/maillog is reporting: Dec 22 11:10:38 orange MailScanner[12692]: Cannot parse /var/spool/MailScanner/incoming/12692/7536B7FAEE.header and , MIME::QuotedPrint version 3.03 required--this is only version 2.21 at /usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder/QuotedPrint.pm line 57. Any Ideas how to get things working again ? Thanks Uli -- Psssst! Mit GMX Handyrechnung senken: http://www.gmx.net/de/go/mail 100 FreeSMS/Monat (GMX TopMail), 50 (GMX ProMail), 10 (GMX FreeMail) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 22 15:03:48 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: Thanks Glenn. When I try running sendmail I get a bounce message from postfix: Reporting-MTA: dns; mail2.trayerproducts.com Arrival-Date: Wed, 22 Dec 2004 09:59:19 -0500 (EST) Final-Recipient: rfc822; unknown Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; No recipients specified I looked in the message file itself and the recipient is there. Any ideas? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn Sent: Wednesday, December 22, 2004 9:42 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Quarantined messages If you keep your quarantined files as queue files you could use the postdrop -r -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 15:16 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Quarantined messages > > > Hello. When a message is quarantined as being spam, how do I > unquarantine it > so it can be delivered to the user? I use postfix as my MTA. > > Thanks, > Rod > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martelm at QUARK.VSC.EDU Wed Dec 22 15:08:31 2004 From: martelm at QUARK.VSC.EDU (Michael H. Martel) Date: Thu Jan 12 21:28:00 2006 Subject: Could not parse Outlook Rich Text attachment Message-ID: --On Wednesday, December 22, 2004 10:03 AM -0500 "Michael H. Martel" wrote: > MessageID: iBLGPwu13257 > Report: Could not parse Outlook Rich Text attachment What a shmuck I am. First off, if I look in the config file, I see that I can let it deliver unparseable TNEF's. Deliver Unparsable TNEF = no Second I see this entry. Hmm. The tnef in my /opt/MailScanner/bin doesn't work. Pointing this at the tnef installed in my /usr/local/bin fixes the problem. #TNEF Expander = /opt/MailScanner/bin/tnef --maxsize=100000000 TNEF Expander = /usr/local/bin/tnef --maxsize=100000000 You would think that I'd been hitting the eggnog from the Office Party again. Sorry to waste everybody's time! Michael -- --------------------------------o--------------------------------- Michael H. Martel | Systems Administrator martelm@quark.vsc.edu | Vermont State Colleges http://probe.vsc.edu/~michael | PH:802-241-2544 FX:802-241-3363 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 22 15:08:12 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:28:00 2006 Subject: Weird Problems trying to start MailScanner for first time Message-ID: Gary have you got 2 perl versions installed - eg one /usr/bin/perl and one /usr/local/bin/perl ? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Gary Alexander wrote: >>Gary >> >>what does "MailScanner -v" show > > > Exactly the same errors as /opt/MailScanner/bin/check_mailscanner > > > > - PLEASE NOTE - > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. Please note that any views or opinions presented > in this email are solely those of the author and do not necessarily > represent those of Sahara Computers (Pty) Ltd. Finally, while Sahara > Computers attempts to ensure that all email is virus-free, Sahara > Computers accepts no liability for any damage caused by any virus > transmitted by this email. > > Sahara Computers (PTY) Ltd > 89 Gazelle Avenue, Corporate Park, Midrand, South Africa > Private Bag X180, Halfway House, 1685, South Africa > > ----- > Scanned and protected by MailScanner @ mail.sahara.co.za > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 22 15:10:58 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: One think I noticed is that the message files have some weird characters in them and there are no line wraps. Not sure really which format these are in. I use "High Scoring Spam Actions = store" in my MS config file. Not sure what format that uses to store the messages. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn Sent: Wednesday, December 22, 2004 9:42 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Quarantined messages If you keep your quarantined files as queue files you could use the postdrop -r -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 15:16 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Quarantined messages > > > Hello. When a message is quarantined as being spam, how do I > unquarantine it > so it can be delivered to the user? I use postfix as my MTA. > > Thanks, > Rod > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 22 15:18:03 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: If they look OK with postcat, then they're in postfix queue format, else they might be damaged perhaps. Do you have Quarantine Whole Messages As Queue Files = no or yes? -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 16:11 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > One think I noticed is that the message files have some weird > characters in > them and there are no line wraps. Not sure really which > format these are in. > I use "High Scoring Spam Actions = store" in my MS config > file. Not sure > what format that uses to store the messages. > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 9:42 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > If you keep your quarantined files as queue files you could > use the postdrop > -r {possible@other.recipient} > -t > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > Sent: den 22 december 2004 15:16 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Quarantined messages > > > > > > Hello. When a message is quarantined as being spam, how do I > > unquarantine it > > so it can be delivered to the user? I use postfix as my MTA. > > > > Thanks, > > Rod > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 22 15:24:00 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:00 2006 Subject: freshclam Message-ID: Does sigtool think it OK? If not, then remove it and replace it with another... Perhaps the one from the install... and rerun the freshclam. -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Christian Campbell > Sent: den 22 december 2004 15:58 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: freshclam > > > I've been receiving the following for the past two days when running > freshclam. Does anyone have any idea how to fix this? I'm > running ClamAV > .80 > > ClamAV update process started at Wed Dec 22 09:08:40 2004 > Reading CVD header (main.cvd): OK > main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: > tomek) > Reading CVD header (daily.cvd): OK > Downloading daily.cvd [*] > ERROR: Verification: Broken or not a CVD file > Trying again... > ClamAV update process started at Wed Dec 22 09:08:44 2004 > Reading CVD header (main.cvd): OK > main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: > tomek) > Reading CVD header (daily.cvd): OK > Downloading daily.cvd [*] > ERROR: Verification: Broken or not a CVD file > Trying again... > ClamAV update process started at Wed Dec 22 09:08:47 2004 > Reading CVD header (main.cvd): OK > main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: > tomek) > Reading CVD header (daily.cvd): OK > Downloading daily.cvd [*] > ERROR: Verification: Broken or not a CVD file > Giving up... > > > Christian Campbell > Systems Engineer, Sair LCP, A+, N+, i-Net+ > Bruegger's Enterprises > Desk: 802-652-9270 > Cell: 802-734-5023 > Fax: 802-660-4034 > Email: ccampbell at brueggers dot com > > PGP Public Key available via PGP keyservers > or http://www2.brueggers.com/pgp/ccampbell.html > > "We all know Linux is great... > It does infinite loops in 5 seconds." > -Linus Torvalds > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 22 15:27:19 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: That is set to yes. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn Sent: Wednesday, December 22, 2004 10:18 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Quarantined messages If they look OK with postcat, then they're in postfix queue format, else they might be damaged perhaps. Do you have Quarantine Whole Messages As Queue Files = no or yes? -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 16:11 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > One think I noticed is that the message files have some weird > characters in > them and there are no line wraps. Not sure really which > format these are in. > I use "High Scoring Spam Actions = store" in my MS config > file. Not sure > what format that uses to store the messages. > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 9:42 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > If you keep your quarantined files as queue files you could > use the postdrop > -r {possible@other.recipient} > -t > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > On Behalf Of Rodney Green > > Sent: den 22 december 2004 15:16 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Quarantined messages > > > > > > Hello. When a message is quarantined as being spam, how do I > > unquarantine it so it can be delivered to the user? I use postfix as > > my MTA. > > > > Thanks, > > Rod > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 22 15:30:57 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: Postcat output looks fine. Here's the output of postdrop -r [root@mail2 spam]# postdrop -r -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 16:11 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > One think I noticed is that the message files have some weird > characters in > them and there are no line wraps. Not sure really which > format these are in. > I use "High Scoring Spam Actions = store" in my MS config > file. Not sure > what format that uses to store the messages. > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 9:42 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > If you keep your quarantined files as queue files you could > use the postdrop > -r {possible@other.recipient} > -t > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > On Behalf Of Rodney Green > > Sent: den 22 december 2004 15:16 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Quarantined messages > > > > > > Hello. When a message is quarantined as being spam, how do I > > unquarantine it so it can be delivered to the user? I use postfix as > > my MTA. > > > > Thanks, > > Rod > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Wed Dec 22 15:57:58 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:28:00 2006 Subject: freshclam Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steen, Glenn wrote: >Does sigtool think it OK? >If not, then remove it and replace it with another... Perhaps the one >from the install... and rerun the freshclam. > >>I've been receiving the following for the past two days when running >>freshclam. Does anyone have any idea how to fix this? I'm >>running ClamAV .80 >> # freshclam ; ll /usr/local/clamav-0.80/database/*.cvd ClamAV update process started at Wed Dec 22 16:53:47 2004 main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: tomek) daily.cvd is up to date (version: 639, sigs: 2070, f-level: 3, builder: trog) -rw-r--r-- 1 1000 1000 102483 17. Okt 04:03 /usr/local/clamav-0.80/database/daily.cvd -rw-rw-r-- 1 1000 1000 1284637 9. Okt 00:30 /usr/local/clamav-0.80/database/main.cvd -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 22 16:08:09 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: Ok, then you have the queue files there. If one should follow the "postfix way" of reintroducing it, you should stop postfix, plop it into a suitable queue directory (perhaps /var/spool/postfix/incoming//) make sure it is owned by the postfix user, postsuper -s, start postfix. I'm sure one could skip some of that... and do it more like MS does:) Sorry about the postdrop thing (it doesn't work). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 16:27 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > That is set to yes. > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 10:18 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > If they look OK with postcat, then they're in postfix queue > format, else > they might be damaged perhaps. > > Do you have > Quarantine Whole Messages As Queue Files = no > or yes? > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > Sent: den 22 december 2004 16:11 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > One think I noticed is that the message files have some weird > > characters in > > them and there are no line wraps. Not sure really which > > format these are in. > > I use "High Scoring Spam Actions = store" in my MS config > > file. Not sure > > what format that uses to store the messages. > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > > Of Steen, Glenn > > Sent: Wednesday, December 22, 2004 9:42 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > If you keep your quarantined files as queue files you could > > use the postdrop > > -r > {possible@other.recipient} > > -t > > > -- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Rodney Green > > > Sent: den 22 december 2004 15:16 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Quarantined messages > > > > > > > > > Hello. When a message is quarantined as being spam, how do I > > > unquarantine it so it can be delivered to the user? I use > postfix as > > > my MTA. > > > > > > Thanks, > > > Rod > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 22 16:09:19 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: Ah, you found that out. Sorry, bum memory cell on my part. -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 16:31 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > Postcat output looks fine. Here's the output of postdrop -r > > [root@mail2 spam]# postdrop -r > queue_id5AC4F4C06postdrop: fatal: uid=0: unexpected record type: 67 > > > > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 10:18 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > If they look OK with postcat, then they're in postfix queue > format, else > they might be damaged perhaps. > > Do you have > Quarantine Whole Messages As Queue Files = no > or yes? > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > Sent: den 22 december 2004 16:11 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > One think I noticed is that the message files have some weird > > characters in > > them and there are no line wraps. Not sure really which > > format these are in. > > I use "High Scoring Spam Actions = store" in my MS config > > file. Not sure > > what format that uses to store the messages. > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > > Of Steen, Glenn > > Sent: Wednesday, December 22, 2004 9:42 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > If you keep your quarantined files as queue files you could > > use the postdrop > > -r > {possible@other.recipient} > > -t > > > -- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Rodney Green > > > Sent: den 22 december 2004 15:16 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Quarantined messages > > > > > > > > > Hello. When a message is quarantined as being spam, how do I > > > unquarantine it so it can be delivered to the user? I use > postfix as > > > my MTA. > > > > > > Thanks, > > > Rod > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From webmaster at EW3D.COM Wed Dec 22 16:15:39 2004 From: webmaster at EW3D.COM (John Hinton) Date: Thu Jan 12 21:28:00 2006 Subject: freshclam Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] shrek-m@gmx.de wrote: > Steen, Glenn wrote: > >> Does sigtool think it OK? >> If not, then remove it and replace it with another... Perhaps the one >> from the install... and rerun the freshclam. >> >>> I've been receiving the following for the past two days when running >>> freshclam. Does anyone have any idea how to fix this? I'm >>> running ClamAV .80 >>> > http://www.clamav.net/ Did you fix your Freshclam setup as requested on the ClamAV site? News item 3 on the main page. It seems that this is about the time they were going to enact this. John Hinton ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 22 16:51:29 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: Thanks for your help, Glenn. I've copied the message to the /var/spool/postfix/incoming/0 directory and ran postsuper -s and they just sit there in that same directory. Don't know why they aren't being processed -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn Sent: Wednesday, December 22, 2004 11:08 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Quarantined messages Ok, then you have the queue files there. If one should follow the "postfix way" of reintroducing it, you should stop postfix, plop it into a suitable queue directory (perhaps /var/spool/postfix/incoming//) make sure it is owned by the postfix user, postsuper -s, start postfix. I'm sure one could skip some of that... and do it more like MS does:) Sorry about the postdrop thing (it doesn't work). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 16:27 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > That is set to yes. > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 10:18 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > If they look OK with postcat, then they're in postfix queue > format, else > they might be damaged perhaps. > > Do you have > Quarantine Whole Messages As Queue Files = no > or yes? > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > On Behalf Of Rodney Green > > Sent: den 22 december 2004 16:11 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > One think I noticed is that the message files have some weird > > characters in them and there are no line wraps. Not sure really > > which format these are in. > > I use "High Scoring Spam Actions = store" in my MS config > > file. Not sure > > what format that uses to store the messages. > > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > On Behalf Of Steen, Glenn > > Sent: Wednesday, December 22, 2004 9:42 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > If you keep your quarantined files as queue files you could use the > > postdrop -r > {possible@other.recipient} > > -t > > > -- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Rodney Green > > > Sent: den 22 december 2004 15:16 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Quarantined messages > > > > > > > > > Hello. When a message is quarantined as being spam, how do I > > > unquarantine it so it can be delivered to the user? I use > postfix as > > > my MTA. > > > > > > Thanks, > > > Rod > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 22 16:56:51 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:00 2006 Subject: Outlook Mails - MIME::QuotedPrint version 3.03 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Update to the latest MIME::Base64 module from CPAN. Ulrich Schneider wrote: >Hi ! > >I´m running mailscanner-4.31.6-1 on Fedora Core2. Today I´ve updated >via yum the following packages: > >php-mbstring 4.3.10-2.4.i386 >php-pear 4.3.10-2.4.i386 >php 4.3.10-2.4.i386 >krb5-libs 1.3.6-1.i386 > >Mails - i suppose only sent via Microsoft Outlook - will get quarantined. >Postmaster´s sending "sender.error.report.txt" back. This is new! So >I suppose it´s because of the updated packages? > >/var/log/maillog is reporting: > >Dec 22 11:10:38 orange MailScanner[12692]: Cannot parse >/var/spool/MailScanner/incoming/12692/7536B7FAEE.header and , >MIME::QuotedPrint version 3.03 required--this is only version 2.21 at >/usr/lib/perl5/vendor_perl/5.8.3/MIME/Decoder/QuotedPrint.pm line 57. > >Any Ideas how to get things working again ? > >Thanks >Uli > > > > > > > > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 22 16:57:53 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:00 2006 Subject: Could not parse Outlook Rich Text attachment Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Also, try setting TNEF Expander = internal as it can expand more versions than the external binary one. It's just slower, that's all. Michael H. Martel wrote: > --On Wednesday, December 22, 2004 10:03 AM -0500 "Michael H. Martel" > wrote: > >> MessageID: iBLGPwu13257 >> Report: Could not parse Outlook Rich Text attachment > > > What a shmuck I am. > > First off, if I look in the config file, I see that I can let it deliver > unparseable TNEF's. > > Deliver Unparsable TNEF = no > > Second I see this entry. Hmm. The tnef in my /opt/MailScanner/bin > doesn't > work. Pointing this at the tnef installed in my /usr/local/bin fixes the > problem. > > #TNEF Expander = /opt/MailScanner/bin/tnef --maxsize=100000000 > TNEF Expander = /usr/local/bin/tnef --maxsize=100000000 > > > You would think that I'd been hitting the eggnog from the Office Party > again. > > Sorry to waste everybody's time! > > > Michael > > -- > > --------------------------------o--------------------------------- > Michael H. Martel | Systems Administrator > martelm@quark.vsc.edu | Vermont State Colleges > http://probe.vsc.edu/~michael | PH:802-241-2544 FX:802-241-3363 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 22 17:02:35 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: Try making sure they're "palatable" to postfix by chmod 0700 touch ... and perhaps finish up with a "postkick public qmgr I" or somesuch. As you perhaps can guess I don't keep my quarantine as queue files (very little point in doing so, and MailWatch needs them "decoded") so I've been rediscovered some of the reasons I don't do that:-):-) A thought, perhaps one should look into making a "both" option for this... Would preserve the envelope info in the queue file, and the "ease of use" of having "decoded". -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 17:51 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > Thanks for your help, Glenn. I've copied the message to the > /var/spool/postfix/incoming/0 directory and ran postsuper -s > and they just > sit there in that same directory. Don't know why they aren't > being processed > > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 11:08 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > Ok, then you have the queue files there. If one should follow > the "postfix > way" of reintroducing it, you should stop postfix, plop it > into a suitable > queue directory (perhaps /var/spool/postfix/incoming/ letter>/) make sure it is owned by the postfix > user, postsuper -s, > start postfix. I'm sure one could skip some of that... and do > it more like > MS does:) > > Sorry about the postdrop thing (it doesn't work). > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > Sent: den 22 december 2004 16:27 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > That is set to yes. > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > > Of Steen, Glenn > > Sent: Wednesday, December 22, 2004 10:18 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > If they look OK with postcat, then they're in postfix queue > > format, else > > they might be damaged perhaps. > > > > Do you have > > Quarantine Whole Messages As Queue Files = no > > or yes? > > > > -- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Rodney Green > > > Sent: den 22 december 2004 16:11 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > One think I noticed is that the message files have some weird > > > characters in them and there are no line wraps. Not sure really > > > which format these are in. > > > I use "High Scoring Spam Actions = store" in my MS config > > > file. Not sure > > > what format that uses to store the messages. > > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Steen, Glenn > > > Sent: Wednesday, December 22, 2004 9:42 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > If you keep your quarantined files as queue files you > could use the > > > postdrop -r > > {possible@other.recipient} > > > -t > > > > > -- Glenn > > > > > > > -----Original Message----- > > > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > On Behalf Of Rodney Green > > > > Sent: den 22 december 2004 15:16 > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > Subject: Quarantined messages > > > > > > > > > > > > Hello. When a message is quarantined as being spam, how do I > > > > unquarantine it so it can be delivered to the user? I use > > postfix as > > > > my MTA. > > > > > > > > Thanks, > > > > Rod > > > > > > > > ------------------------ MailScanner list > > > ------------------------ To > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > words: 'leave > > > > mailscanner' in the body of the email. Before posting, > > read the MAQ > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 22 17:12:08 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: (Sorry for replying to myself... Stepwise refinement:-) Don't forget to chown . too. -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn > Sent: den 22 december 2004 18:03 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > Try making sure they're "palatable" to postfix by > chmod 0700 > touch > ... and perhaps finish up with a "postkick public qmgr I" or > somesuch. > > As you perhaps can guess I don't keep my quarantine as queue files > (very little point in doing so, and MailWatch needs them "decoded") > so I've been rediscovered some of the reasons I don't do that:-):-) > > A thought, perhaps one should look into making a "both" option for > this... Would preserve the envelope info in the queue file, and > the "ease of use" of having "decoded". > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > Sent: den 22 december 2004 17:51 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > Thanks for your help, Glenn. I've copied the message to the > > /var/spool/postfix/incoming/0 directory and ran postsuper -s > > and they just > > sit there in that same directory. Don't know why they aren't > > being processed > > > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > > Of Steen, Glenn > > Sent: Wednesday, December 22, 2004 11:08 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > Ok, then you have the queue files there. If one should follow > > the "postfix > > way" of reintroducing it, you should stop postfix, plop it > > into a suitable > > queue directory (perhaps /var/spool/postfix/incoming/ > letter>/) make sure it is owned by the postfix > > user, postsuper -s, > > start postfix. I'm sure one could skip some of that... and do > > it more like > > MS does:) > > > > Sorry about the postdrop thing (it doesn't work). > > > > -- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > > Sent: den 22 december 2004 16:27 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > That is set to yes. > > > > > > -----Original Message----- > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > > > Of Steen, Glenn > > > Sent: Wednesday, December 22, 2004 10:18 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > If they look OK with postcat, then they're in postfix queue > > > format, else > > > they might be damaged perhaps. > > > > > > Do you have > > > Quarantine Whole Messages As Queue Files = no > > > or yes? > > > > > > -- Glenn > > > > > > > -----Original Message----- > > > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > On Behalf Of Rodney Green > > > > Sent: den 22 december 2004 16:11 > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > Subject: Re: Quarantined messages > > > > > > > > > > > > One think I noticed is that the message files have some weird > > > > characters in them and there are no line wraps. Not sure really > > > > which format these are in. > > > > I use "High Scoring Spam Actions = store" in my MS config > > > > file. Not sure > > > > what format that uses to store the messages. > > > > > > > > -----Original Message----- > > > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > On Behalf Of Steen, Glenn > > > > Sent: Wednesday, December 22, 2004 9:42 AM > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > Subject: Re: Quarantined messages > > > > > > > > > > > > If you keep your quarantined files as queue files you > > could use the > > > > postdrop -r > > > {possible@other.recipient} > > > > -t > > > > > > > -- Glenn > > > > > > > > > -----Original Message----- > > > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > > On Behalf Of Rodney Green > > > > > Sent: den 22 december 2004 15:16 > > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > > Subject: Quarantined messages > > > > > > > > > > > > > > > Hello. When a message is quarantined as being spam, how do I > > > > > unquarantine it so it can be delivered to the user? I use > > > postfix as > > > > > my MTA. > > > > > > > > > > Thanks, > > > > > Rod > > > > > > > > > > ------------------------ MailScanner list > > > > ------------------------ To > > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > > words: 'leave > > > > > mailscanner' in the body of the email. Before posting, > > > read the MAQ > > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > > > Support MailScanner development - buy the book off > the website! > > > > > > > > > > > > > ------------------------ MailScanner list > > > ------------------------ To > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > words: 'leave > > > > mailscanner' in the body of the email. Before posting, > > read the MAQ > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > ------------------------ MailScanner list > > > ------------------------ To > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > words: 'leave > > > > mailscanner' in the body of the email. Before posting, > > read the MAQ > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 22 17:36:30 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:00 2006 Subject: Quarantined messages Message-ID: Glenn, CHMOD'ing it and touching the files did the trick. Thanks so much! If I were to set "Quarantine Whole Messages As Queue Files" as no, would it write the messages in mbox style format? Thanks again, Rod -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn Sent: Wednesday, December 22, 2004 12:03 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Quarantined messages Try making sure they're "palatable" to postfix by chmod 0700 touch ... and perhaps finish up with a "postkick public qmgr I" or somesuch. As you perhaps can guess I don't keep my quarantine as queue files (very little point in doing so, and MailWatch needs them "decoded") so I've been rediscovered some of the reasons I don't do that:-):-) A thought, perhaps one should look into making a "both" option for this... Would preserve the envelope info in the queue file, and the "ease of use" of having "decoded". -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 17:51 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > Thanks for your help, Glenn. I've copied the message to the > /var/spool/postfix/incoming/0 directory and ran postsuper -s and they > just sit there in that same directory. Don't know why they aren't > being processed > > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 11:08 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > Ok, then you have the queue files there. If one should follow > the "postfix > way" of reintroducing it, you should stop postfix, plop it > into a suitable > queue directory (perhaps /var/spool/postfix/incoming/ letter>/) make sure it is owned by the postfix > user, postsuper -s, > start postfix. I'm sure one could skip some of that... and do > it more like > MS does:) > > Sorry about the postdrop thing (it doesn't work). > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > On Behalf Of Rodney Green > > Sent: den 22 december 2004 16:27 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > That is set to yes. > > > > -----Original Message----- > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > On Behalf Of Steen, Glenn > > Sent: Wednesday, December 22, 2004 10:18 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > If they look OK with postcat, then they're in postfix queue format, > > else they might be damaged perhaps. > > > > Do you have > > Quarantine Whole Messages As Queue Files = no > > or yes? > > > > -- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Rodney Green > > > Sent: den 22 december 2004 16:11 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > One think I noticed is that the message files have some weird > > > characters in them and there are no line wraps. Not sure really > > > which format these are in. > > > I use "High Scoring Spam Actions = store" in my MS config > > > file. Not sure > > > what format that uses to store the messages. > > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Steen, Glenn > > > Sent: Wednesday, December 22, 2004 9:42 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > If you keep your quarantined files as queue files you > could use the > > > postdrop -r > > {possible@other.recipient} -t > > > > > -- Glenn > > > > > > > -----Original Message----- > > > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > On Behalf Of Rodney Green > > > > Sent: den 22 december 2004 15:16 > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > Subject: Quarantined messages > > > > > > > > > > > > Hello. When a message is quarantined as being spam, how do I > > > > unquarantine it so it can be delivered to the user? I use > > postfix as > > > > my MTA. > > > > > > > > Thanks, > > > > Rod > > > > > > > > ------------------------ MailScanner list > > > ------------------------ To > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > words: 'leave > > > > mailscanner' in the body of the email. Before posting, > > read the MAQ > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Wed Dec 22 17:44:04 2004 From: marcel-ml at IRC-ADDICTS.DE (g) Date: Thu Jan 12 21:28:00 2006 Subject: RulesDuJour Questions Message-ID: Hi there, > > report_header 1 > detailed_phrase_score 1 > envelope_sender_header X-MailScanner-From- > flock > i tried to delete those.. but these entries are not in the spam.assassin.conf...and then i tried grep -i "report_header" * nothing found.. maybe another idea?? Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Wed Dec 22 17:47:29 2004 From: marcel-ml at IRC-ADDICTS.DE (g) Date: Thu Jan 12 21:28:00 2006 Subject: RulesDuJour Questions Message-ID: Hi Martin, > Marcel > > I'd check the rules_du_jour setting for SA_LINT. It looks like it's not > taking the -p parameter properly. make sure it's all on once line and if > needed changed the -p to a -C which is what I use. > > Run the SA_LINT command by hand to make sure you get no errors.. tried that again.. and still these errors.. Failed to parse line in SpamAssassin configuration, skipping: report_header 1 Failed to parse line in SpamAssassin configuration, skipping: detailed_phrase_score 1 but i cannot find these configurations within the file /etc/MailScanner/spam.assassin.prefs.conf :( Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Wed Dec 22 17:45:41 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:28:00 2006 Subject: X-MailScanner-From header not passed to SpamAssassin? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Peter HOLZLEITNER wrote: >I gather that the X-MailScanner-From (and -To) headers, if enabled, are >only added at the end of processing. Would it be possible to change >that so they are already passed to SpamAssassin (and could be tested in >local rules) and the custom logging routine? > > In the latest version of MailScanner, the X-MailScanner-From header (or whatever you specified in Envelope From Header =) is added at the top of the message before it is passed to SpamAssassin, so you should be able to test for it. Also, any previous version of the same header is removed before sending the message to SA, so you can trust it. The same is not true for the X-MailScanner-To header. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Wed Dec 22 17:53:05 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:28:00 2006 Subject: RulesDuJour Questions Message-ID: Look in /etc/mail/spamassassin and /usr/share/spamassassin Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Dec 22 17:50:15 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:28:00 2006 Subject: RulesDuJour Questions Message-ID: Marcel must either be in one of the rules file in /etc/mail/spamassassin (more likely) or /usr/local/share/spamassassin (less likely(. It could be you got a rule downloading via rdj that doesn't match the version of SA you are running...some names indicate that, eg name_pre30.cf, name_post25.cf etc. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 g wrote: > Hi Martin, > > > >>Marcel >> >>I'd check the rules_du_jour setting for SA_LINT. It looks like it's not >>taking the -p parameter properly. make sure it's all on once line and if >>needed changed the -p to a -C which is what I use. >> >>Run the SA_LINT command by hand to make sure you get no errors.. > > tried that again.. > > and still these errors.. > > Failed to parse line in SpamAssassin configuration, skipping: > report_header 1 > Failed to parse line in SpamAssassin configuration, skipping: > detailed_phrase_score 1 > > > but i cannot find these configurations within the file > /etc/MailScanner/spam.assassin.prefs.conf > > > :( > > Greetings > > Marcel > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Wed Dec 22 19:12:49 2004 From: marcel-ml at IRC-ADDICTS.DE (g) Date: Thu Jan 12 21:28:00 2006 Subject: Question about QuarantineReport-Script and MS Message-ID: Hi there, i am also using the QuarantineReport-Skript from the fsl-website. It seems that this script only works fine, if i do quarantine the mails in whole and not as queue-files.. But...if i do want to release another mail, which was stated as virus, but should be processed, it is not that easy to put it into the mailqueue.. in the past, i just had to copy those 2 files into the mqueue-dir, and sendmail pushes them out.. now i had to use the command sendmail -toi user@domain.com < message but..this starts the ordinary sendmail-command, which makes MS check those mails again.. is there a way to put mails into the quarantine as queue-files and as one message-file, so that the Quarantine-Report-Script would work to? Or that MS put the virus-mails, which are not affected by the quarantine-script, are put into quarantine as queue-file, and the spamfiles as one mail? Would make life a lot easier :) Thanks for all the hard work anyway Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 22 19:29:33 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:00 2006 Subject: Question about QuarantineReport-Script and MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >is there a way to put mails into the quarantine as queue-files and as one >message-file, so that the Quarantine-Report-Script would work to? > >Or that MS put the virus-mails, which are not affected by the >quarantine-script, are put into quarantine as queue-file, and the >spamfiles as one mail? > > So you would like the infected archive to be one, and the spam/MCP archive as the other? So that would involve Quarantine Whole Messages As Queue Files and Quarantine Whole Spam Messages As Queue Files as separate configuration options. Is that what you are after? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Wed Dec 22 19:36:06 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:28:00 2006 Subject: Question about QuarantineReport-Script and MS Message-ID: If you use one of Julian's latest additions you won't have this issue as virus will be detected as viruses if your action is set to store Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 http://www.blacknight.ie/specialoffers.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From spamtrap71892316634 at ANIME.NET Wed Dec 22 20:22:00 2004 From: spamtrap71892316634 at ANIME.NET (Dan Hollis) Date: Thu Jan 12 21:28:00 2006 Subject: problems with "very long filename" rule? Message-ID: Why is this rule tripping? filename.rules.conf:deny .{150,} Very long filename, possible OE attack Very long filenames are good signs of attacks against Microsoft e-mail packages Our users are getting reports like this: Report: Very long filenames are good signs of attacks against Microsoft e-mail packages (Inbox%3Fnumber=5.jpg) Surely it shouldnt be tripping on that file? It's not a long filename. -Dan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Wed Dec 22 20:32:46 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:28:00 2006 Subject: RulesDuJour Questions Message-ID: Hi there, > Look in /etc/mail/spamassassin and /usr/share/spamassassin > found it under /etc/mail/spamassassin.. thanks :) Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Wed Dec 22 20:31:39 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:28:00 2006 Subject: problems with "very long filename" rule? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dan Hollis wrote: > Why is this rule tripping? > filename.rules.conf:deny .{150,} Very long filename, possible OE attack Very long filenames are good signs of attacks against Microsoft e-mail packages > > Our users are getting reports like this: > Report: Very long filenames are good signs of attacks against Microsoft e-mail packages (Inbox%3Fnumber=5.jpg) > > Surely it shouldnt be tripping on that file? It's not a long filename. That's the sanitized version of the name. Look in the quarantine for the real name. -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Wed Dec 22 20:38:51 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:28:00 2006 Subject: Question about QuarantineReport-Script and MS Message-ID: Hi Julian, [...] > >is there a way to put mails into the quarantine as queue-files and as one > >message-file, so that the Quarantine-Report-Script would work to? > > > >Or that MS put the virus-mails, which are not affected by the > >quarantine-script, are put into quarantine as queue-file, and the > >spamfiles as one mail? > > > > > So you would like the infected archive to be one, and the spam/MCP > archive as the other? So that would involve > Quarantine Whole Messages As Queue Files > and > Quarantine Whole Spam Messages As Queue Files > as separate configuration options. Is that what you are after? > i am sorry to bug you :( The Quarantine Script only checks for whole msgs (at least, if i do switch to queue-files, nothing seems to work..could test it again..) but i would like to have queue-files, so that it would be easy to put shose two files for each mail into the ordinary sendmail-queue.. so that MS would not check those mails again, and mark them as virus or spam.. So i think yes.. would be great, if i (or we) could setup the script to create queue-files for virus-mails and for spam-mails seperatly.. But..only if it would not make your life to hard.. Because your script works fine.. but maybe you understand my point of view.. some users (my non-ml-account for example) receives about 100 spam-mails a day.. and to create one mail for every spam-mail would fill my mailbox with over 100 mails..if MS would do the job to check those quarantines once a day and create once a day a mail with all stored mails and those Message-Ids, i would not need the Quarantine-Script ;) Because then the users would just send me the id as stated in the long list, and i could put these mails into the sendmail-mail-queue.. Thanks for listing (or reading) my idea.. have a great holiday season though.. Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Wed Dec 22 22:12:39 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:28:01 2006 Subject: {Scanned} Virus is slipping through mailscanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The attachment copfilter.tgz has the EICAR test virus in it but the lµatest version of mailscanner let it pass to the real mailserver thanks koen Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/site_perl/5.8.2/Mail/Audit.pm Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit.pm". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/site_perl/5.8.2/Mail/Audit/ Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/site_perl/5.8.2/Mail/Audit/KillDups.pm Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/KillDups.pm". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/site_perl/5.8.2/Mail/Audit/List.pm Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/List.pm". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/site_perl/5.8.2/Mail/Audit/PGP.pm Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/PGP.pm". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/site_perl/5.8.2/Mail/Audit/MAPS.pm Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/site_perl/5.8.2/Mail/Audit/MAPS.pm". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/ Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/ Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/perllocal.pod Dec 22 23:02:50 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/perllocal.pod". Please contact the authors! Dec 22 23:02:50 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/ Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/Net/ Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Net/". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/Net/.packlist Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Net/.packlist". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/Test/ Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Test/". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/Test/Simple/ Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Test/Simple/". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/Test/Simple/.packlist Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/Test/Simple/.packlist". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/ Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/DB_File.so Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/DB_File.so". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/DB_File.bs Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/DB_File.bs". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/autosplit.ix Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/autosplit.ix". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/.packlist Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/auto/DB_File/.packlist". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/i386-linux/DB_File.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/i386-linux/DB_File.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/ Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/POP3.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/POP3.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/SMTP.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/SMTP.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/Config.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/Config.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/libnetFAQ.pod Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/libnetFAQ.pod". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/Domain.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/Domain.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/Cmd.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/Cmd.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/FTP.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/FTP.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/libnet.cfg Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/libnet.cfg". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/Netrc.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/Netrc.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/NNTP.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/NNTP.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/Time.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/Time.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/FTP/ Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/FTP/dataconn.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/dataconn.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/FTP/E.pm Dec 22 23:02:51 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/E.pm". Please contact the authors! Dec 22 23:02:51 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/FTP/A.pm Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/A.pm". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/FTP/L.pm Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/L.pm". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Net/FTP/I.pm Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Net/FTP/I.pm". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Test/ Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Test/". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Test/Builder.pm Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Test/Builder.pm". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Test/Simple.pm Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Test/Simple.pm". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Test/More.pm Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Test/More.pm". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: usr/lib/perl5/5.8.2/Test/Tutorial.pod Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "usr/lib/perl5/5.8.2/Test/Tutorial.pod". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: compile_cache_prgs.sh Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "compile_cache_prgs.sh". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: compile_cache_prgs.sh_p3scan_manually Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "compile_cache_prgs.sh_p3scan_manually". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: compile_cache_prgs_perl_stuff.sh_manuall Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "compile_cache_prgs_perl_stuff.sh_manuall". Please contact the authors! Dec 22 23:02:52 scanmail MailScanner[1170]: compile_cache_prgs_perl_stuff.sh_manuall_with_cpan Dec 22 23:02:52 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised line "compile_cache_prgs_perl_stuff.sh_manuall_with_cpan". Please contact the authors! Dec 22 23:03:07 scanmail MailScanner[1170]: /tmp/clamav.2148/clamav-4c74bbbad44f83d5/var/log/copfilter/0.0.95.1/tests/virus/eicar.com: Eicar-Test-Signature FOUND Dec 22 23:03:07 scanmail MailScanner[1170]: /tmp/clamav.2148/clamav-4c74bbbad44f83d5/var/log/copfilter/0.0.95.1/tests/virus/eicar.zip: Eicar-Test-Signature FOUND Dec 22 23:03:07 scanmail MailScanner[1170]: /tmp/clamav.2148/clamav-4c74bbbad44f83d5/var/log/copfilter/0.0.95.1/tests/virus/eicar_com.zip: Eicar-Test-Signature FOUND Dec 22 23:03:07 scanmail MailScanner[1170]: /tmp/clamav.2148/clamav-4c74bbbad44f83d5/var/log/copfilter/0.0.95.1/tests/virus/eicarcom2.zip: Eicar-Test-Signature FOUND Dec 22 23:03:13 scanmail MailScanner[1170]: Virus Scanning: ClamAV found 4 infections Dec 22 23:03:13 scanmail MailScanner[1170]: Virus Scanning: Found 4 viruses Dec 22 23:03:13 scanmail MailScanner[1170]: Content Checks: Detected and will disarm HTML message in iBMM0QbE002061 Dec 22 23:03:18 scanmail MailScanner[1170]: Uninfected: Delivered 1 messages Dec 22 23:03:19 scanmail MailScanner[1170]: MailScanner child dying of old age Dec 22 23:03:19 scanmail MailScanner[2207]: MailScanner E-Mail Virus Scanner version 4.36.4 starting... ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Wed Dec 22 22:15:25 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:28:01 2006 Subject: Red Hat up2date can stop email on name servers Message-ID: Red Hat recently released Red Hat Enterprise Linux 3 Update 4. We have seen this update stop mail flow at several client sites on the email gateways that are also running DNS named services. If you are NOT running the named server, you should be able to run up2date without problems. If you are running the named services: What we have seen is that installing these updates may cause named to fail during the update. Here are the symptoms. At or near the end of the update you will see: .. 117:gimp-print ########################################### [100%] 118:redhat-config-printer ########################################### [100% https://xmlrpc.rhn.redhat.com/XMLRPC https://xmlrpc.rhn.redhat.com/XMLRPC https://xmlrpc.rhn.redhat.com/XMLRPC https://xmlrpc.rhn.redhat.com/XMLRPC https://xmlrpc.rhn.redhat.com/XMLRPC And the connection to the Red Hat up2date server fails. We believe this is because the named service is killed by the up2date process. To correct this error, first restart named: service named restart And this is a bit ugly, up2date seems to alter the system configuration to NOT run named on boot. To make sure that named is configured to start at boot, run: chkconfig named on And we saw on one system that nscd was incorrectly configured to start on boot. to make sure that nscd is not configured to start at boot time, run: chkconfig nscd off And finally restart up2date: up2date -u If up2date has any work yet to finish, it should complete normally. Have a happy holidays Be careful out there, Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Wed Dec 22 22:21:43 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:28:01 2006 Subject: {Scanned} Virus is slipping through mailscanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Koen Teugels wrote: > The attachment copfilter.tgz has the EICAR test virus in it but the > latest version of mailscanner let it pass to the real mailserver > I've seen this too with ClamAv and ".tgz" files. In my case I have Sophos installed in tandem with Clam so I haven't worried about it. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From spamtrap71892316634 at ANIME.NET Wed Dec 22 23:17:01 2004 From: spamtrap71892316634 at ANIME.NET (Dan Hollis) Date: Thu Jan 12 21:28:01 2006 Subject: problems with "very long filename" rule? Message-ID: Peter Bonivart wrote: > Dan Hollis wrote: > > Why is this rule tripping? > > filename.rules.conf:deny .{150,} Very long filename, possible OE attack Very long filenames are good signs of attacks against Microsoft e-mail packages > > > > Our users are getting reports like this: > > Report: Very long filenames are good signs of attacks against Microsoft e-mail packages (Inbox%3Fnumber=5.jpg) > > > > Surely it shouldnt be tripping on that file? It's not a long filename. > That's the sanitized version of the name. Look in the quarantine for the > real name. They don't get quarantined, they get rejected outright and bounced. I can't see any way to enable quarantine for 'deny' Filename Rules ? What exact MailScanner.conf entry enables quarantine for rule-denied files? -Dan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Dec 22 23:35:44 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:28:01 2006 Subject: problems with "very long filename" rule? Message-ID: At 06:17 PM 12/22/2004, Dan Hollis wrote: >They don't get quarantined, they get rejected outright and bounced. > >I can't see any way to enable quarantine for 'deny' Filename Rules ? >What exact MailScanner.conf entry enables quarantine for rule-denied files? Hmm, I assume you mean they get bounced, as rejected and bounced doesn't make sense. It's impossible to bounce something that's been rejected. (hint: rejection involves a SMTP layer error code at the time of delivery, bouncing is a post-delivery failure message. Very different things) Besides, MailScanner can't reject mail anyway, it can only delete, bounce, modify, quarantine, or generate a warning message. However, really, it's unlikely they got bounced, probably MailScanner issued a blocked attachment warning to the sender, which is similar, but not quite the same. I'd also double-check if they aren't quarantined anyway... If you've got this setting: Notify Senders Of Blocked Filenames Or Filetypes = yes That setting will cause Mailscanner to send a failure message to the sender. However, it will also quarantine it if you have: Quarantine Infections = yes ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From spamtrap71892316634 at ANIME.NET Wed Dec 22 23:59:31 2004 From: spamtrap71892316634 at ANIME.NET (Dan Hollis) Date: Thu Jan 12 21:28:01 2006 Subject: problems with "very long filename" rule? Message-ID: On Wed, 22 Dec 2004, Matt Kettler wrote: > However, really, it's unlikely they got bounced, probably MailScanner > issued a blocked attachment warning to the sender, which is similar, but > not quite the same. > I'd also double-check if they aren't quarantined anyway... It turned out to be quarantined, but they didn't get a quarantine message, only a blocked content message. > If you've got this setting: > Notify Senders Of Blocked Filenames Or Filetypes = yes > That setting will cause Mailscanner to send a failure message to the sender. > However, it will also quarantine it if you have: > Quarantine Infections = yes I have both enabled. # ls -al iBL2hW0l004695 total 157 drwx------ 2 root root 88 Dec 20 18:43 . drwx------ 1014 root root 32432 Dec 20 23:56 .. -rw------- 1 root root 124019 Dec 20 18:43 Inbox%3Fnumber=5.jpg So it appears it's quarantining using the "repaired" filename. It makes no sense to me for mailscanner to report a "long filename violation" but report a "short repaired filename". There's no way to tell what exactly the original filename was, then... mailscanner should report the original filename when reporting a violation. -Dan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From peter at UCGBOOK.COM Thu Dec 23 01:04:02 2004 From: peter at UCGBOOK.COM (Peter Bonivart) Date: Thu Jan 12 21:28:01 2006 Subject: problems with "very long filename" rule? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dan Hollis wrote: > # ls -al iBL2hW0l004695 > total 157 > drwx------ 2 root root 88 Dec 20 18:43 . > drwx------ 1014 root root 32432 Dec 20 23:56 .. > -rw------- 1 root root 124019 Dec 20 18:43 Inbox%3Fnumber=5.jpg > > So it appears it's quarantining using the "repaired" filename. > > It makes no sense to me for mailscanner to report a "long filename > violation" but report a "short repaired filename". There's no way to tell > what exactly the original filename was, then... > > mailscanner should report the original filename when reporting a > violation. It can be risky to use the original filename if it's intended to do damage. Julian always sanitize logs and other stuff generated by MS. I quarantine the message as queue files so I look into the Sendmail df-file to see all attachments. If you really want to know I recommend you do the same but why do you need to know the original name? It tells you the reason for blocking the message, do you have to check if the rule is working? That will get old real fast. :-) -- /Peter Bonivart --Unix lovers do it in the Sun ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From spamtrap71892316634 at ANIME.NET Thu Dec 23 01:55:12 2004 From: spamtrap71892316634 at ANIME.NET (Dan Hollis) Date: Thu Jan 12 21:28:01 2006 Subject: problems with "very long filename" rule? Message-ID: On Thu, 23 Dec 2004, Peter Bonivart wrote: > > mailscanner should report the original filename when reporting a > > violation. > It can be risky to use the original filename if it's intended to do > damage. Only risky if it's used as filename attachment, surely putting something like C:\\something\really\long\filename\blablabla\yadda\file.jpg in the body of a message can't do damage? It's not a link and it's not an attachment. Or, you're saying I just did potentially do some damage from the above line? :-) > Julian always sanitize logs and other stuff generated by MS. I > quarantine the message as queue files so I look into the Sendmail > df-file to see all attachments. If you really want to know I recommend > you do the same but why do you need to know the original name? It tells > you the reason for blocking the message, do you have to check if the > rule is working? That will get old real fast. :-) There are a number of problems here: 1) The problem here is that while it _was_ quarantined, the body of the message did not say that at all. So I had to dig through filesystem. We are medium sized isp with many users and heavy mail load and 'find' took quite some time. 2) In any case it's nice to have the original ("non-safed") filename in order to point out to the user exactly what was wrong. I had to dig through gigabytes of server logs to find the original filename. (Not to mention the quarantine id, which was not included in the report!) 3) And shouldnt this be a choice of the mail administrator anyways, not a unilateral decision of mailscanner to always mangle the filename without consent of the server admin? -Dan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From miguelk at konsultex.com.br Thu Dec 23 04:10:33 2004 From: miguelk at konsultex.com.br (Miguel Koren OBrien de Lacy) Date: Thu Jan 12 21:28:01 2006 Subject: [OT] - Size limit rules Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This might be somewhat off topic. I have a need to limit the size of emails from/to certain users or certain domains to a maximum number of bytes regardless of attachments or not. This has to be with incoming and outgoing emails (to the same maximum size for both cases). This site runs qmail. Limiting the size of outgoing emails seems like a less frequent thing to do. Qmail can limit but not per user or domain. I am thinking of using Mailscanner for this purpose. Can I do that with Mailscanner in a rule set? Any other ideas for this? Miguel -- Konsultex Informatica (http://www.konsultex.com.br) -- Esta mensagem foi verificada pelo sistema de antivírus e acredita-se estar livre de perigo. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gary at SAHARA.CO.ZA Thu Dec 23 05:58:12 2004 From: gary at SAHARA.CO.ZA (Gary Alexander) Date: Thu Jan 12 21:28:01 2006 Subject: Weird Problems trying to start MailScanner for first time Message-ID: I only have a /usr/bin/perl .. I also thought about that but this is a fresh install of gentoo - PLEASE NOTE - This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Sahara Computers (Pty) Ltd. Finally, while Sahara Computers attempts to ensure that all email is virus-free, Sahara Computers accepts no liability for any damage caused by any virus transmitted by this email. Sahara Computers (PTY) Ltd 89 Gazelle Avenue, Corporate Park, Midrand, South Africa Private Bag X180, Halfway House, 1685, South Africa ----- Scanned and protected by MailScanner @ mail.sahara.co.za ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Dec 23 08:44:06 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:01 2006 Subject: Quarantined messages Message-ID: More like rfc822. I use MailWatch (http://mailwatch.sf.net) which needs the message in that format. Incidentally, all (or at least most) envelope info is stored in the MailWatch database, so there's really no need to save the queue files when using that. A very useful complement to MS, and what sold my PHB on the solution... Perhaps worth a look;). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: den 22 december 2004 18:37 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > Glenn, > > CHMOD'ing it and touching the files did the trick. Thanks so much! > > If I were to set "Quarantine Whole Messages As Queue Files" > as no, would it > write the messages in mbox style format? > > Thanks again, > Rod > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Wednesday, December 22, 2004 12:03 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantined messages > > > Try making sure they're "palatable" to postfix by > chmod 0700 > touch > ... and perhaps finish up with a "postkick public qmgr I" or somesuch. > > As you perhaps can guess I don't keep my quarantine as queue > files (very > little point in doing so, and MailWatch needs them "decoded") > so I've been > rediscovered some of the reasons I don't do that:-):-) > > A thought, perhaps one should look into making a "both" > option for this... > Would preserve the envelope info in the queue file, and the > "ease of use" of > having "decoded". > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > Sent: den 22 december 2004 17:51 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > Thanks for your help, Glenn. I've copied the message to the > > /var/spool/postfix/incoming/0 directory and ran postsuper > -s and they > > just sit there in that same directory. Don't know why they aren't > > being processed > > > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > > Of Steen, Glenn > > Sent: Wednesday, December 22, 2004 11:08 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > Ok, then you have the queue files there. If one should follow > > the "postfix > > way" of reintroducing it, you should stop postfix, plop it > > into a suitable > > queue directory (perhaps /var/spool/postfix/incoming/ > letter>/) make sure it is owned by the postfix > > user, postsuper -s, > > start postfix. I'm sure one could skip some of that... and do > > it more like > > MS does:) > > > > Sorry about the postdrop thing (it doesn't work). > > > > -- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Rodney Green > > > Sent: den 22 december 2004 16:27 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > That is set to yes. > > > > > > -----Original Message----- > > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > On Behalf Of Steen, Glenn > > > Sent: Wednesday, December 22, 2004 10:18 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > If they look OK with postcat, then they're in postfix > queue format, > > > else they might be damaged perhaps. > > > > > > Do you have > > > Quarantine Whole Messages As Queue Files = no > > > or yes? > > > > > > -- Glenn > > > > > > > -----Original Message----- > > > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > On Behalf Of Rodney Green > > > > Sent: den 22 december 2004 16:11 > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > Subject: Re: Quarantined messages > > > > > > > > > > > > One think I noticed is that the message files have some weird > > > > characters in them and there are no line wraps. Not sure really > > > > which format these are in. > > > > I use "High Scoring Spam Actions = store" in my MS config > > > > file. Not sure > > > > what format that uses to store the messages. > > > > > > > > -----Original Message----- > > > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > On Behalf Of Steen, Glenn > > > > Sent: Wednesday, December 22, 2004 9:42 AM > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > Subject: Re: Quarantined messages > > > > > > > > > > > > If you keep your quarantined files as queue files you > > could use the > > > > postdrop -r > > > {possible@other.recipient} -t > > > > > > > -- Glenn > > > > > > > > > -----Original Message----- > > > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > > On Behalf Of Rodney Green > > > > > Sent: den 22 december 2004 15:16 > > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > > Subject: Quarantined messages > > > > > > > > > > > > > > > Hello. When a message is quarantined as being spam, how do I > > > > > unquarantine it so it can be delivered to the user? I use > > > postfix as > > > > > my MTA. > > > > > > > > > > Thanks, > > > > > Rod > > > > > > > > > > ------------------------ MailScanner list > > > > ------------------------ To > > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > > words: 'leave > > > > > mailscanner' in the body of the email. Before posting, > > > read the MAQ > > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > > > Support MailScanner development - buy the book off > the website! > > > > > > > > > > > > > ------------------------ MailScanner list > > > ------------------------ To > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > words: 'leave > > > > mailscanner' in the body of the email. Before posting, > > read the MAQ > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > ------------------------ MailScanner list > > > ------------------------ To > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > words: 'leave > > > > mailscanner' in the body of the email. Before posting, > > read the MAQ > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, > read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From unews122003 at GMX.NET Thu Dec 23 08:46:55 2004 From: unews122003 at GMX.NET (Ulrich Schneider) Date: Thu Jan 12 21:28:01 2006 Subject: Outlook Mails - MIME::QuotedPrint version 3.03 Message-ID: Thank you - it worked :-) > Update to the latest MIME::Base64 module from CPAN. -- +++ Sparen Sie mit GMX DSL +++ http://www.gmx.net/de/go/dsl AKTION für Wechsler: DSL-Tarife ab 3,99 EUR/Monat + Startguthaben ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Dec 23 08:58:59 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:01 2006 Subject: Question about QuarantineReport-Script and MS Message-ID: Julian (& all) Why not make it a "tristate" of {yes, no, both}? Just for ... ease of use:-). Or does that upset things with the new "keep quarantine clean" thing? -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Marcel Blenkers > Sent: den 22 december 2004 21:39 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Question about QuarantineReport-Script and MS > > > Hi Julian, > > [...] > > >is there a way to put mails into the quarantine as > queue-files and as one > > >message-file, so that the Quarantine-Report-Script would work to? > > > > > >Or that MS put the virus-mails, which are not affected by the > > >quarantine-script, are put into quarantine as queue-file, and the > > >spamfiles as one mail? > > > > > > > > So you would like the infected archive to be one, and the spam/MCP > > archive as the other? So that would involve > > Quarantine Whole Messages As Queue Files > > and > > Quarantine Whole Spam Messages As Queue Files > > as separate configuration options. Is that what you are after? > > > > i am sorry to bug you :( > > The Quarantine Script only checks for whole msgs (at least, > if i do switch > to queue-files, nothing seems to work..could test it again..) > but i would > like to have queue-files, so that it would be easy to put > shose two files > for each mail into the ordinary sendmail-queue.. > > so that MS would not check those mails again, and mark them > as virus or > spam.. > > So i think yes.. > > would be great, if i (or we) could setup the script to create > queue-files > for virus-mails and for spam-mails seperatly.. > > But..only if it would not make your life to hard.. > > Because your script works fine.. > > but maybe you understand my point of view.. > some users (my non-ml-account for example) receives about 100 > spam-mails a > day.. > and to create one mail for every spam-mail would fill my > mailbox with over > 100 mails..if MS would do the job to check those quarantines > once a day > and create once a day a mail with all stored mails and those > Message-Ids, > i would not need the Quarantine-Script ;) > > Because then the users would just send me the id as stated in the long > list, and i could put these mails into the sendmail-mail-queue.. > > Thanks for listing (or reading) my idea.. > > have a great holiday season though.. > > Marcel > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-list at OKLA.COM Thu Dec 23 09:09:15 2004 From: mailscanner-list at OKLA.COM (Tracy Greggs) Date: Thu Jan 12 21:28:01 2006 Subject: Quarantined messages Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] MailWatch is an invaluable tool IMHO. Setup is well documented, forums and mailing lists of course. I would highly recommend at least looking at it if you never have. Tracy ----- Original Message ----- From: "Steen, Glenn" To: Sent: Thursday, December 23, 2004 2:44 AM Subject: Re: Quarantined messages > More like rfc822. > > I use MailWatch (http://mailwatch.sf.net) which needs the message in > that > format. Incidentally, all (or at least most) envelope info is stored in > the MailWatch database, so there's really no need to save the queue > files > when using that. A very useful complement to MS, and what sold my PHB on > the solution... Perhaps worth a look;). > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > Sent: den 22 december 2004 18:37 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > Glenn, > > > > CHMOD'ing it and touching the files did the trick. Thanks so much! > > > > If I were to set "Quarantine Whole Messages As Queue Files" > > as no, would it > > write the messages in mbox style format? > > > > Thanks again, > > Rod > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > > Of Steen, Glenn > > Sent: Wednesday, December 22, 2004 12:03 PM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Quarantined messages > > > > > > Try making sure they're "palatable" to postfix by > > chmod 0700 > > touch > > ... and perhaps finish up with a "postkick public qmgr I" or somesuch. > > > > As you perhaps can guess I don't keep my quarantine as queue > > files (very > > little point in doing so, and MailWatch needs them "decoded") > > so I've been > > rediscovered some of the reasons I don't do that:-):-) > > > > A thought, perhaps one should look into making a "both" > > option for this... > > Would preserve the envelope info in the queue file, and the > > "ease of use" of > > having "decoded". > > > > -- Glenn > > > > > -----Original Message----- > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > > > Sent: den 22 december 2004 17:51 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > Thanks for your help, Glenn. I've copied the message to the > > > /var/spool/postfix/incoming/0 directory and ran postsuper > > -s and they > > > just sit there in that same directory. Don't know why they aren't > > > being processed > > > > > > > > > -----Original Message----- > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > > > Of Steen, Glenn > > > Sent: Wednesday, December 22, 2004 11:08 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: Quarantined messages > > > > > > > > > Ok, then you have the queue files there. If one should follow > > > the "postfix > > > way" of reintroducing it, you should stop postfix, plop it > > > into a suitable > > > queue directory (perhaps /var/spool/postfix/incoming/ > > letter>/) make sure it is owned by the postfix > > > user, postsuper -s, > > > start postfix. I'm sure one could skip some of that... and do > > > it more like > > > MS does:) > > > > > > Sorry about the postdrop thing (it doesn't work). > > > > > > -- Glenn > > > > > > > -----Original Message----- > > > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > On Behalf Of Rodney Green > > > > Sent: den 22 december 2004 16:27 > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > Subject: Re: Quarantined messages > > > > > > > > > > > > That is set to yes. > > > > > > > > -----Original Message----- > > > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > On Behalf Of Steen, Glenn > > > > Sent: Wednesday, December 22, 2004 10:18 AM > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > Subject: Re: Quarantined messages > > > > > > > > > > > > If they look OK with postcat, then they're in postfix > > queue format, > > > > else they might be damaged perhaps. > > > > > > > > Do you have > > > > Quarantine Whole Messages As Queue Files = no > > > > or yes? > > > > > > > > -- Glenn > > > > > > > > > -----Original Message----- > > > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > > On Behalf Of Rodney Green > > > > > Sent: den 22 december 2004 16:11 > > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > > Subject: Re: Quarantined messages > > > > > > > > > > > > > > > One think I noticed is that the message files have some weird > > > > > characters in them and there are no line wraps. Not sure really > > > > > which format these are in. > > > > > I use "High Scoring Spam Actions = store" in my MS config > > > > > file. Not sure > > > > > what format that uses to store the messages. > > > > > > > > > > -----Original Message----- > > > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > > On Behalf Of Steen, Glenn > > > > > Sent: Wednesday, December 22, 2004 9:42 AM > > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > > Subject: Re: Quarantined messages > > > > > > > > > > > > > > > If you keep your quarantined files as queue files you > > > could use the > > > > > postdrop -r > > > > {possible@other.recipient} -t > > > > > > > > > -- Glenn > > > > > > > > > > > -----Original Message----- > > > > > > From: MailScanner mailing list > > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > > > > > On Behalf Of Rodney Green > > > > > > Sent: den 22 december 2004 15:16 > > > > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > > > > Subject: Quarantined messages > > > > > > > > > > > > > > > > > > Hello. When a message is quarantined as being spam, how do I > > > > > > unquarantine it so it can be delivered to the user? I use > > > > postfix as > > > > > > my MTA. > > > > > > > > > > > > Thanks, > > > > > > Rod > > > > > > > > > > > > ------------------------ MailScanner list > > > > > ------------------------ To > > > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > > > words: 'leave > > > > > > mailscanner' in the body of the email. Before posting, > > > > read the MAQ > > > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > > > > > Support MailScanner development - buy the book off > > the website! > > > > > > > > > > > > > > > > ------------------------ MailScanner list > > > > ------------------------ To > > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > > words: 'leave > > > > > mailscanner' in the body of the email. Before posting, > > > read the MAQ > > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > ------------------------ MailScanner list > > > > ------------------------ To > > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the > > words: 'leave > > > > > mailscanner' in the body of the email. Before posting, > > > read the MAQ > > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > > > > ------------------------ MailScanner list > > > ------------------------ To > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > > mailscanner' in the body of the email. Before posting, > > read the MAQ > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > ------------------------ MailScanner list > > > ------------------------ To > > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > > mailscanner' in the body of the email. Before posting, > > read the MAQ > > > > (http://www.mailscanner.biz/maq/) and the archives > > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > > mailscanner' in the body of the email. Before posting, read the MAQ > > > (http://www.mailscanner.biz/maq/) and the archives > > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > Oklahoma Network Consulting has scanned this > message for viruses and dangerous content with > MailScanner, and commercial virus scanners McAfee > and F-Prot and is believed to be clean. > --- > -- Oklahoma Network Consulting has scanned this message for viruses and dangerous content with MailScanner, and commercial virus scanners McAfee and F-Prot and is believed to be clean. --- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Dec 23 13:44:59 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:28:01 2006 Subject: Question about QuarantineReport-Script and MS Message-ID: Hi there again too.. thought a bit around.. maybe it would be possible to create a script, which could send one mail a day to those users considering their spam, as there is one for cleaning the quaratine? But, the script should be made adjustable, as some spam-mails do contain some strange adresses outside of my server within the to-field, and the local-users are within the cc or bcc field. so it would be nice, to have some kind of send.spam.report.rules, with default = no and then the admin could add those users within this rules, who would like to get only one daily report, or others who would like to receive their spam-mail-report directly after receiving the spam.. Hope someone could make a fuzz out of it.. Greetings Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Dec 23 13:53:46 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:28:01 2006 Subject: Off Topic - or..some Holiday Greetings Message-ID: Hi there, would like to send a nice and warm happy Christmas Time and a happy new Year out to everybody.. and a great thanks for every advice taken from this ML. And of course an even greater thank you out to Julian, who made my life a lot easier and simpler with writing this great piece of code.. And of course for his great support.. One Question to Julian: Do you ever sleep?? :) Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Thu Dec 23 13:50:45 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:28:01 2006 Subject: Question about QuarantineReport-Script and MS Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Marcel Blenkers > Sent: Thursday, December 23, 2004 8:45 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Question about QuarantineReport-Script and MS > > Hi there again too.. > > thought a bit around.. > > maybe it would be possible to create a script, which could send one mail a > day to those users considering their spam, as there is one for cleaning > the quaratine? > > But, the script should be made adjustable, as some spam-mails do contain > some strange adresses outside of my server within the to-field, and the > local-users are within the cc or bcc field. > > so it would be nice, to have some kind of send.spam.report.rules, with > default = no and then the admin could add those users within this rules, > who would like to get only one daily report, or others who would like to > receive their spam-mail-report directly after receiving the spam.. > > Hope someone could make a fuzz out of it.. > > Greetings > > Marcel I haven't followed the whole thread so I may be off base here but since one of our staffers wrote the release from quarantine script on our website I'm at least familiar with it. If you're using a release from quarantine script, you should set your MTA to split a message to multiple recipients into individual emails one for each recipient. This way each recipient can release their own email. Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Thu Dec 23 14:38:02 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:28:01 2006 Subject: {Scanned} Re: Virus is slipping through mailscanner Message-ID: I have Bitdefender and Clamav installed.But they don't detect it. And when a tgz attachment is passing the mail relay. He suffers everything on the server is slowing down. Koen Mark Nienberg wrote: Koen Teugels wrote: The attachment copfilter.tgz has the EICAR test virus in it but the latest version of mailscanner let it pass to the real mailserver I've seen this too with ClamAv and ".tgz" files. In my case I have Sophos installed in tandem with Clam so I haven't worried about it. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- Koen Teugels N.V. NEXIS S.A. Chaussee de Namur 79 1300 Wavre Belgium Visit us at http://www.nexis.be e-mail : kte@nexis.be tel.: +32 (0)10 81.81.81 fax: +32 (0)10 81.81.80 visit us at : http://www.nexis.be ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Image/JPEG 13KB. ] [ Unable to print this part. ] From Denis.Beauchemin at USHERBROOKE.CA Thu Dec 23 14:47:04 2004 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:28:01 2006 Subject: Red Hat up2date can stop email on name servers Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Swaney wrote: >Red Hat recently released Red Hat Enterprise Linux 3 Update 4. We have seen >this update stop mail flow at several client sites on the email gateways >that are also running DNS named services. > >If you are NOT running the named server, you should be able to run up2date >without problems. > >If you are running the named services: > > > ... I've been bitten by this one yesterday. Did the same thing. I'm really not happy with Red Hat releasing more than 75 patches to RHEL 3 this close to the Christmas holidays... I just hope my patched systems will be OK without me watching them closely over the next week or so. Happy Holidays everybody and thanks again Julian for this fantastic software!!! We owe you so much! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From Steve.Swaney at FSL.COM Thu Dec 23 15:32:52 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:28:01 2006 Subject: Red Hat up2date can stop email on name servers Message-ID: [ Part 1, Application/X-PKCS7-MIME 6.2KB. ] [ Unable to print this part. ] From mailscanner at ecs.soton.ac.uk Thu Dec 23 16:15:02 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:01 2006 Subject: problems with "very long filename" rule? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dan Hollis wrote: >On Thu, 23 Dec 2004, Peter Bonivart wrote: > > >>>mailscanner should report the original filename when reporting a >>>violation. >>> >>> >>It can be risky to use the original filename if it's intended to do >>damage. >> >> > >Only risky if it's used as filename attachment, surely putting something >like > >C:\\something\really\long\filename\blablabla\yadda\file.jpg > >in the body of a message can't do damage? It's not a link and it's not an >attachment. > >Or, you're saying I just did potentially do some damage from the above line? :-) > > Ah, if only the world was that friendly. Now imagine what happens when someone constructs a filename that includes a MIME boundary string and possibly some MIME-encoded data as well, all in the filename. Now by just reporting the full filename you have provided a way for them to inject a virus into the report message. You *never* report input data back to anyone without santising it first. One of the basic rules of secure and defensive programming. > > >>Julian always sanitize logs and other stuff generated by MS. I >>quarantine the message as queue files so I look into the Sendmail >>df-file to see all attachments. If you really want to know I recommend >>you do the same but why do you need to know the original name? It tells >>you the reason for blocking the message, do you have to check if the >>rule is working? That will get old real fast. :-) >> >> > >There are a number of problems here: > >1) The problem here is that while it _was_ quarantined, the body of the >message did not say that at all. So I had to dig through filesystem. We >are medium sized isp with many users and heavy mail load and 'find' took >quite some time. > > You know the location already. It's in the quarantine, you know the date and you know the message id. So you don't need "find" at all, there's only 1 place it can be. >2) In any case it's nice to have the original ("non-safed") filename >in order to point out to the user exactly what was wrong. I had to dig >through gigabytes of server logs to find the original filename. (Not to >mention the quarantine id, which was not included in the report!) > > No way! >3) And shouldnt this be a choice of the mail administrator anyways, not a >unilateral decision of mailscanner to always mangle the filename without >consent of the server admin? > > I clearly need to protect you from yourself. No insult intended, but it's true as a general rule. Just because you don't know a way of breaking something, doesn't mean it can't be broken by someone who does know. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 23 16:16:47 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:01 2006 Subject: [OT] - Size limit rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Miguel Koren OBrien de Lacy wrote: >This might be somewhat off topic. I have a need to limit the size of emails from/to >certain users or certain domains to a maximum number of bytes regardless of >attachments or not. This has to be with incoming and outgoing emails (to the same >maximum size for both cases). This site runs qmail. Limiting the size of outgoing >emails seems like a less frequent thing to do. Qmail can limit but not per user or >domain. I am thinking of using Mailscanner for this purpose. Can I do that with >Mailscanner in a rule set? Any other ideas for this? > > Yes. Please read the MailScanner.conf file to find the correct option (look for the word Maximum) and read the MAQ (address at the bottom of this post) or the FAQ (on www.mailscanner.info) or the book for instructions on how to do this per domain and/or per user. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 23 16:18:54 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:01 2006 Subject: Off Topic - or..some Holiday Greetings Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Marcel Blenkers wrote: >would like to send a nice and warm happy Christmas Time and a happy new >Year out to everybody.. > >and a great thanks for every advice taken from this ML. > >And of course an even greater thank you out to Julian, who made my life a >lot easier and simpler with writing this great piece of code.. > >And of course for his great support.. > >One Question to Julian: > >Do you ever sleep?? :) > > Occasionally, but only when no-one is looking :-) Happy Christmas to all of you! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dfilchak at SYMPATICO.CA Thu Dec 23 16:39:24 2004 From: dfilchak at SYMPATICO.CA (Dave Filchak) Date: Thu Jan 12 21:28:01 2006 Subject: Red Hat up2date can stop email on name servers Message-ID: Thanks for this. Dave Steve Swaney wrote: >Red Hat recently released Red Hat Enterprise Linux 3 Update 4. We have seen >this update stop mail flow at several client sites on the email gateways >that are also running DNS named services. > >If you are NOT running the named server, you should be able to run up2date >without problems. > >If you are running the named services: > >What we have seen is that installing these updates may cause named to fail >during the update. Here are the symptoms. At or near the end of the update >you will see: > >.. > >117:gimp-print ########################################### >[100%] > 118:redhat-config-printer ########################################### >[100% >https://xmlrpc.rhn.redhat.com/XMLRPC >https://xmlrpc.rhn.redhat.com/XMLRPC >https://xmlrpc.rhn.redhat.com/XMLRPC >https://xmlrpc.rhn.redhat.com/XMLRPC >https://xmlrpc.rhn.redhat.com/XMLRPC > >And the connection to the Red Hat up2date server fails. We believe this is >because the named service is killed by the up2date process. To correct this >error, first restart named: > >service named restart > >And this is a bit ugly, up2date seems to alter the system configuration to >NOT run named on boot. To make sure that named is configured to start at >boot, run: > chkconfig named on > >And we saw on one system that nscd was incorrectly configured to start on >boot. to make sure that nscd is not configured to start at boot time, run: > > chkconfig nscd off > >And finally restart up2date: > > up2date -u > >If up2date has any work yet to finish, it should complete normally. > >Have a happy holidays Be careful out there, > >Steve >Steve Swaney >President >Fortress Systems Ltd. >www.fsl.com >steve.swaney@fsl.com > > >-- >This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Dec 23 17:25:58 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:01 2006 Subject: Off Topic - or..some Holiday Greetings Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Thu, December 23, 2004 13:53, Marcel Blenkers said: > Hi there, > > would like to send a nice and warm happy Christmas Time and a happy new > Year out to everybody.. Beaten to it (Again!). I would like to add my personal good wishes for Christmas and the New Year (For those who celebrate!!). > and a great thanks for every advice taken from this ML. > > And of course an even greater thank you out to Julian, who made my life a > lot easier and simpler with writing this great piece of code.. > > And of course for his great support.. Hear, hear. Enjoy! Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From miguelk at konsultex.com.br Thu Dec 23 18:49:53 2004 From: miguelk at konsultex.com.br (Miguel Koren OBrien de Lacy) Date: Thu Jan 12 21:28:01 2006 Subject: [OT] - Size limit rules Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thank you everybody for the answers. This server runs an unmodified RH8 at the moment. Do I run a risk of Perl problems when I install the latest MS? Let me also ask if I undestand the solution. To limit for example someuser@some.domain for incoming and outgoing I would have 2 rules, one as a "from" and anoher as a "to". Is this correct? Miguel -- Konsultex Informatica (http://www.konsultex.com.br) ---------- Original Message ----------- From: Julian Field To: MAILSCANNER@JISCMAIL.AC.UK Sent: Thu, 23 Dec 2004 16:16:47 +0000 Subject: Re: [OT] - Size limit rules > Miguel Koren OBrien de Lacy wrote: > > >This might be somewhat off topic. I have a need to limit the size of emails from/to > >certain users or certain domains to a maximum number of bytes regardless of > >attachments or not. This has to be with incoming and outgoing emails (to the same > >maximum size for both cases). This site runs qmail. Limiting the size of outgoing > >emails seems like a less frequent thing to do. Qmail can limit but not per user or > >domain. I am thinking of using Mailscanner for this purpose. Can I do that with > >Mailscanner in a rule set? Any other ideas for this? > > > > > Yes. Please read the MailScanner.conf file to find the correct option > (look for the word Maximum) and read the MAQ (address at the bottom of > this post) or the FAQ (on www.mailscanner.info) or the book for > instructions on how to do this per domain and/or per user. > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > Esta mensagem foi verificada pelo sistema de antivírus e > acredita-se estar livre de perigo. ------- End of Original Message ------- -- Esta mensagem foi verificada pelo sistema de antivírus e acredita-se estar livre de perigo. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at LISTS.COM.AR Thu Dec 23 18:48:54 2004 From: mailscanner at LISTS.COM.AR (Leonardo Helman) Date: Thu Jan 12 21:28:01 2006 Subject: Off Topic - or..some Holiday Greetings Message-ID: Felices Fiestas! from the other side of the world. LeoH On Thu, Dec 23, 2004 at 05:25:36PM -0000, Drew Marshall wrote: > On Thu, December 23, 2004 13:53, Marcel Blenkers said: > > Hi there, > > > > would like to send a nice and warm happy Christmas Time and a happy new > > Year out to everybody.. > > > Beaten to it (Again!). I would like to add my personal good wishes for > Christmas and the New Year (For those who celebrate!!). > > > and a great thanks for every advice taken from this ML. > > > > And of course an even greater thank you out to Julian, who made my life a > > lot easier and simpler with writing this great piece of code.. > > > > And of course for his great support.. > > Hear, hear. > > Enjoy! > > Drew > > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 23 20:19:15 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:01 2006 Subject: [OT] - Size limit rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] As long as you are running Perl 5.6.0 or newer, you should be okay. Do a "MailScanner -v" after installing MailScanner (or a "perl -v" before!) to check. And the answer to your second question is: You can use "fromorto" in a rule. For example: FromOrTo: some user@some.domain 100000 in the ruleset file. Miguel Koren OBrien de Lacy wrote: >Thank you everybody for the answers. This server runs an unmodified RH8 at the moment. >Do I run a risk of Perl problems when I install the latest MS? > >Let me also ask if I undestand the solution. To limit for example someuser@some.domain >for incoming and outgoing I would have 2 rules, one as a "from" and anoher as a "to". >Is this correct? > >Miguel > >-- >Konsultex Informatica (http://www.konsultex.com.br) > >---------- Original Message ----------- >From: Julian Field >To: MAILSCANNER@JISCMAIL.AC.UK >Sent: Thu, 23 Dec 2004 16:16:47 +0000 >Subject: Re: [OT] - Size limit rules > > > >>Miguel Koren OBrien de Lacy wrote: >> >> >> >>>This might be somewhat off topic. I have a need to limit the size of emails from/to >>>certain users or certain domains to a maximum number of bytes regardless of >>>attachments or not. This has to be with incoming and outgoing emails (to the same >>>maximum size for both cases). This site runs qmail. Limiting the size of outgoing >>>emails seems like a less frequent thing to do. Qmail can limit but not per user or >>>domain. I am thinking of using Mailscanner for this purpose. Can I do that with >>>Mailscanner in a rule set? Any other ideas for this? >>> >>> >>> >>> >>Yes. Please read the MailScanner.conf file to find the correct option >>(look for the word Maximum) and read the MAQ (address at the bottom of >>this post) or the FAQ (on www.mailscanner.info) or the book for >>instructions on how to do this per domain and/or per user. >> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>-- >>Esta mensagem foi verificada pelo sistema de antivírus e >> acredita-se estar livre de perigo. >> >> >------- End of Original Message ------- > > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mail at WOZENILEK.DE Thu Dec 23 22:34:00 2004 From: mail at WOZENILEK.DE (Martin Wozenilek) Date: Thu Jan 12 21:28:01 2006 Subject: Norman (nvcc) does not scan Message-ID: Hi! I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate the norman scanner in the config file the eicar testfile is detectet by all my virus scanners, but not by nvcc. The wrapper works perfect .... mmmh .... Any ideas? Thanks! Martin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Dec 23 22:48:53 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:28:01 2006 Subject: Norman (nvcc) does not scan Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Wozenilek wrote: > Hi! > > I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate the norman > scanner in the config file the eicar testfile is detectet by all my virus > scanners, but not by nvcc. The wrapper works perfect .... mmmh .... > > Any ideas? Thanks! any logs? Thanks, Ugo > > Martin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mail at WOZENILEK.DE Thu Dec 23 23:15:50 2004 From: mail at WOZENILEK.DE (Martin Wozenilek) Date: Thu Jan 12 21:28:01 2006 Subject: Norman (nvcc) does not scan Message-ID: Hi Ugo, thanks for your fast response! I've turned on all log options in MailScanner.conf and I've checked if nvcc is logging anything itself. Nothing ... it seems that MailScanner does not call nvcc. But like I said before: the wrapper works from command line. Maybe there is a problem with MailScanner? BTW: the OS is Fedora Core 2 Ugo Bellavance wrote: > Martin Wozenilek wrote: > >> Hi! >> >> I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate the >> norman >> scanner in the config file the eicar testfile is detectet by all my >> virus >> scanners, but not by nvcc. The wrapper works perfect .... mmmh .... >> >> Any ideas? Thanks! > > > any logs? > > Thanks, > > Ugo > >> >> Martin > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Martin Wozenilek Alte Landstrasse 155 21039 Escheburg mailto: mail@wozenilek.de PGP-Key-ID: 0x00105C52 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From hden at KCBBS.GEN.NZ Fri Dec 24 03:05:03 2004 From: hden at KCBBS.GEN.NZ (Hendrik den Hartog) Date: Thu Jan 12 21:28:01 2006 Subject: [OT] - Size limit rules Message-ID: > And the answer to your second question is: You can use "fromorto" in a > rule. For example: > FromOrTo: some > user@some.domain 100000 > in the ruleset file. forgive my ignorance, but the number 100000 = 100000 bytes? Reason for asking is I may use this to set a control on students email. Cheers! Hendrik ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From evertjan at VANRAMSELAAR.NL Fri Dec 24 06:26:56 2004 From: evertjan at VANRAMSELAAR.NL (Evert Jan van Ramselaar) Date: Thu Jan 12 21:28:01 2006 Subject: Off Topic - or..some Holiday Greetings Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Thu, December 23, 2004 14:53, Marcel Blenkers said: > would like to send a nice and warm happy Christmas Time and a happy new > Year out to everybody.. I wish the same to you and everybody on this list. Prettige kerstdagen en een gelukkig nieuwjaar! ( ehm... yeah... that's dutch :-) ) -- Evert Jan van Ramselaar ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Fri Dec 24 10:36:46 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:01 2006 Subject: [OT] - Size limit rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hendrik den Hartog wrote: >>And the answer to your second question is: You can use "fromorto" in a >>rule. For example: >>FromOrTo: someuser@some.domain 100000 >>in the ruleset file. >> >> > > forgive my ignorance, but the number 100000 = 100000 bytes? > > Yes. To quote from MailScanner.conf, in the 1st line of the comments about the "Maximum Message Size" option: # The maximum size, in bytes, of any message including the headers. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Fri Dec 24 22:11:59 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:28:01 2006 Subject: Norman (nvcc) does not scan Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Wozenilek wrote: > Hi Ugo, > > thanks for your fast response! > I've turned on all log options in MailScanner.conf and I've checked if > nvcc is logging anything itself. Nothing ... it seems that MailScanner > does not call nvcc. But like I said before: the wrapper works from > command line. Maybe there is a problem with MailScanner? > I meant: Could you show us some logs? Please show us relevant entries from MailScanner.conf and virus.scanners.conf. What version of MailScanner and norman? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Sat Dec 25 01:15:23 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:28:01 2006 Subject: OT: SPF comments requested Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mark Nienberg wrote: > Steve Campbell wrote: > >> I'm not sure if the SPF thing is something all of us should be >> dealing with >> _now_, but if we all should be updating our DNS records, I'd like to >> hear >> about some ideas from the list. I have gleaned as much as I can >> absorb from >> all of the different sites required to explore implementing SPF, and I'm >> still not sure how to use it other than setting up my DNS so others >> can use >> it. >> >> As I understand this, I have many options on how to use it for our >> protection. Much like RBLs, I can set this up in Sendmail, or use the >> SPF >> functions of SA, and probably a few more. And the same reasons for >> deciding >> this are basicly the same as for using RBLs. >> >> > OK. I'm opinionated. > > Roughly in order or importance: > > 1. Publish an SPF record for your domain. This will allow me to reject > mail from spammers claiming to be you. > 2. Upgrade to the latest MailScanner. It has a bugfix related to SPF > checks. Whoops, that isn't quite right. The SPF bugfix is in the latest beta version, not yet in the stable version. Sorry. > 3. Watch your logs, etc. to see if you are receiving legitimate mail > from your regular correspondents with SPF_FAIL. If so, contact the > admins of those domains so they can correct their problems. > 4. Once you have some confidence in it, increase the score of SPF_FAIL > in SpamAssassin. In my experience, it is ridiculously low by default, > and I see a much higher correlation between SPF_FAIL and spam than the > SA developers see in their test spam corpus. I also expect it to > continue rising as more admins deploy it and correct their errors. > 5. Eventually, maybe move to a system of rejecting mail at the MTA level. Mark Nienberg ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Sun Dec 26 04:43:06 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Volume: 500 messages/day MTA: Postfix 2.X Hardware: 1 X Pentium IV, 2.6Ghz, 1.0 Gig RAM, 2x SATA Raid 1 Operating System: RHEL 3.0 RBLs: 1 in MTA Virus Scanners: ClamAV (clamav-0.80-2.1.el3.rf) Mailscanner Version: mailscanner-4.36.4-1 Domains: 5 Spamassassin: Not being used First let me say how impressed I am with Mailscanner. I have been using it in a production enviorment for the last 4 weeks. I have only ever just played with it in the past. I am about to start adding more domains to my email server and have some concerns. I have read a lot of negativity about Mailscanner and postfix being used together in the postfix community and else where. We all know this story so I don't need to go any farther. I have searched the Mailscanner archives for any opinions from the Mailscanner experts within the last 4 months, and have found very little information. I have noticed however that the suggested way of setting up Mailscanner to work with postfix has changed http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml so I figured anything before the change was irrelevant. Hence the 4 month limitation on the search. My question is this: has the way in which Mailscanner is now being setup with postfix changed the integrity of things? Has the overall outlook of Mailscanner when being used with postfix improved at all in the postfix community? I personally have not experienced any real serous problems yet. I have however had some email sit in the queue for 10+ min. Before getting delivered. One other time I needed to restart the Mailscanner service because all mail was getting queued up and not getting delivered. After restarting the service everything worked. I know this has something to do with Mailscanner because before I integrated Mailscanner into this server I never had this problem. Pardon me for asking this question, but it seems that for the most part, the Mailscanner community doesn't seem to see a real problem in which the way Mailscanner works with postfix. On the other hand the Postfix community does. Is this more personal than anything, or is there actually some legitimacy behind it all? Thanks, Schrock ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Sun Dec 26 14:03:08 2004 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: Hi The 'problem' from the PS community is the way MS drags messages from one place to another without using the proper PS way of doing things. Every other MTA is quite happy for this to happen, and PS in practice doesn't seem to object. Its just the developers that get upset as it breaks one otf their design rules. Lots of people use the two in combination with no problems. You do have to keep up to date with MS if you upgrade PS as the PS developers tend to change things that MS relies upon. Julian is normally pretty quick at getting a fix out, but its just something to watch out for.. (no I'm not at work, just checking out a few things from home :-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 avery wrote: > Volume: 500 messages/day > MTA: Postfix 2.X > Hardware: 1 X Pentium IV, 2.6Ghz, 1.0 Gig RAM, 2x SATA Raid 1 > Operating System: RHEL 3.0 > RBLs: 1 in MTA > Virus Scanners: ClamAV (clamav-0.80-2.1.el3.rf) > Mailscanner Version: mailscanner-4.36.4-1 > Domains: 5 > Spamassassin: Not being used > > First let me say how impressed I am with Mailscanner. I have been using > it in a production enviorment for the last 4 weeks. I have only ever > just played with it in the past. > > I am about to start adding more domains to my email server and have some > concerns. I have read a lot of negativity about Mailscanner and postfix > being used together in the postfix community and else where. We all know > this story so I don't need to go any farther. I have searched the > Mailscanner archives for any opinions from the Mailscanner experts > within the last 4 months, and have found very little information. I have > noticed however that the suggested way of setting up Mailscanner to work > with postfix has changed > http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml so I > figured anything before the change was irrelevant. Hence the 4 month > limitation on the search. My question is this: has the way in which > Mailscanner is now being setup with postfix changed the integrity of > things? Has the overall outlook of Mailscanner when being used with > postfix improved at all in the postfix community? > > I personally have not experienced any real serous problems yet. I have > however had some email sit in the queue for 10+ min. Before getting > delivered. One other time I needed to restart the Mailscanner service > because all mail was getting queued up and not getting delivered. After > restarting the service everything worked. I know this has something to > do with Mailscanner because before I integrated Mailscanner into this > server I never had this problem. > > Pardon me for asking this question, but it seems that for the most part, > the Mailscanner community doesn't seem to see a real problem in which > the way Mailscanner works with postfix. On the other hand the Postfix > community does. Is this more personal than anything, or is there > actually some legitimacy behind it all? > > Thanks, > Schrock > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Sun Dec 26 19:00:35 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: Martin Hepworth wrote: > Hi > The 'problem' from the PS community is the way MS drags messages from > one place to another without using the proper PS way of doing things. > > Every other MTA is quite happy for this to happen, and PS in practice > doesn't seem to object. Its just the developers that get upset as it > breaks one otf their design rules. > > Lots of people use the two in combination with no problems. > > You do have to keep up to date with MS if you upgrade PS as the PS > developers tend to change things that MS relies upon. Julian is normally > pretty quick at getting a fix out, but its just something to watch out > for.. > > > (no I'm not at work, just checking out a few things from home :-) > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > avery wrote: > >> Volume: 500 messages/day >> MTA: Postfix 2.X >> Hardware: 1 X Pentium IV, 2.6Ghz, 1.0 Gig RAM, 2x SATA Raid 1 >> Operating System: RHEL 3.0 >> RBLs: 1 in MTA >> Virus Scanners: ClamAV (clamav-0.80-2.1.el3.rf) >> Mailscanner Version: mailscanner-4.36.4-1 >> Domains: 5 >> Spamassassin: Not being used >> >> First let me say how impressed I am with Mailscanner. I have been using >> it in a production enviorment for the last 4 weeks. I have only ever >> just played with it in the past. >> >> I am about to start adding more domains to my email server and have some >> concerns. I have read a lot of negativity about Mailscanner and postfix >> being used together in the postfix community and else where. We all know >> this story so I don't need to go any farther. I have searched the >> Mailscanner archives for any opinions from the Mailscanner experts >> within the last 4 months, and have found very little information. I have >> noticed however that the suggested way of setting up Mailscanner to work >> with postfix has changed >> http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml so I >> figured anything before the change was irrelevant. Hence the 4 month >> limitation on the search. My question is this: has the way in which >> Mailscanner is now being setup with postfix changed the integrity of >> things? Has the overall outlook of Mailscanner when being used with >> postfix improved at all in the postfix community? >> >> I personally have not experienced any real serous problems yet. I have >> however had some email sit in the queue for 10+ min. Before getting >> delivered. One other time I needed to restart the Mailscanner service >> because all mail was getting queued up and not getting delivered. After >> restarting the service everything worked. I know this has something to >> do with Mailscanner because before I integrated Mailscanner into this >> server I never had this problem. >> >> Pardon me for asking this question, but it seems that for the most part, >> the Mailscanner community doesn't seem to see a real problem in which >> the way Mailscanner works with postfix. On the other hand the Postfix >> community does. Is this more personal than anything, or is there >> actually some legitimacy behind it all? >> >> Thanks, >> Schrock >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Good inforamation, thanks for the advise. But I am also interested in the reasons why the method in which Mailscanner and Postfix work together has changed in the last few months. What were the reasons in changing this? At one time postfix needed to run in 2 instances one for incoming and one for outgoing. This does not seem to be the case anymore. It seems to be some top secret reason that no one knows about. Thanks again, Schrock ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at OMEGADATA.NO Sun Dec 26 20:02:43 2004 From: john at OMEGADATA.NO (John Berntsen) Date: Thu Jan 12 21:28:01 2006 Subject: SV: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Let's just say that this top secret thing :) is just another way of doing things. The new way just tells postfix to put all new incoming mails on hold, mailscanner takes the mail out from the hold queue, does it's thing and then have postfix do the final delivery. Hope this cleared up things. Well i'm not at work either, i'm just an addict :) Happy holidays, to you all! Best Regards John Berntsen > -----Opprinnelig melding----- > Fra: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] På vegne av avery > Sendt: 26. desember 2004 20:01 > Til: MAILSCANNER@JISCMAIL.AC.UK > Emne: Re: Postfix and Mailscanner sitting in a tree k-iss-ing > > Martin Hepworth wrote: > > > Hi > > The 'problem' from the PS community is the way MS drags > messages from > > one place to another without using the proper PS way of > doing things. > > > > Every other MTA is quite happy for this to happen, and PS > in practice > > doesn't seem to object. Its just the developers that get upset as it > > breaks one otf their design rules. > > > > Lots of people use the two in combination with no problems. > > > > You do have to keep up to date with MS if you upgrade PS as the PS > > developers tend to change things that MS relies upon. > Julian is normally > > pretty quick at getting a fix out, but its just something > to watch out > > for.. > > > > > > (no I'm not at work, just checking out a few things from home :-) > > -- > > Martin Hepworth > > Snr Systems Administrator > > Solid State Logic > > Tel: +44 (0)1865 842300 > > > > > > avery wrote: > > > >> Volume: 500 messages/day > >> MTA: Postfix 2.X > >> Hardware: 1 X Pentium IV, 2.6Ghz, 1.0 Gig RAM, 2x SATA Raid 1 > >> Operating System: RHEL 3.0 > >> RBLs: 1 in MTA > >> Virus Scanners: ClamAV (clamav-0.80-2.1.el3.rf) > >> Mailscanner Version: mailscanner-4.36.4-1 > >> Domains: 5 > >> Spamassassin: Not being used > >> > >> First let me say how impressed I am with Mailscanner. I > have been using > >> it in a production enviorment for the last 4 weeks. I have > only ever > >> just played with it in the past. > >> > >> I am about to start adding more domains to my email server > and have some > >> concerns. I have read a lot of negativity about > Mailscanner and postfix > >> being used together in the postfix community and else > where. We all know > >> this story so I don't need to go any farther. I have searched the > >> Mailscanner archives for any opinions from the Mailscanner experts > >> within the last 4 months, and have found very little > information. I have > >> noticed however that the suggested way of setting up > Mailscanner to work > >> with postfix has changed > >> > http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml so I > >> figured anything before the change was irrelevant. Hence > the 4 month > >> limitation on the search. My question is this: has the way in which > >> Mailscanner is now being setup with postfix changed the > integrity of > >> things? Has the overall outlook of Mailscanner when being used with > >> postfix improved at all in the postfix community? > >> > >> I personally have not experienced any real serous problems > yet. I have > >> however had some email sit in the queue for 10+ min. Before getting > >> delivered. One other time I needed to restart the > Mailscanner service > >> because all mail was getting queued up and not getting > delivered. After > >> restarting the service everything worked. I know this has > something to > >> do with Mailscanner because before I integrated > Mailscanner into this > >> server I never had this problem. > >> > >> Pardon me for asking this question, but it seems that for > the most part, > >> the Mailscanner community doesn't seem to see a real > problem in which > >> the way Mailscanner works with postfix. On the other hand > the Postfix > >> community does. Is this more personal than anything, or is there > >> actually some legitimacy behind it all? > >> > >> Thanks, > >> Schrock > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > > > > > > > ********************************************************************** > > > > This email and any files transmitted with it are confidential and > > intended solely for the use of the individual or entity to whom they > > are addressed. If you have received this email in error > please notify > > the system manager. > > > > This footnote confirms that this email message has been swept > > for the presence of computer viruses and is believed to be clean. > > > > > ********************************************************************** > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > Good inforamation, thanks for the advise. But I am also interested in > the reasons why the method in which Mailscanner and Postfix work > together has changed in the last few months. What were the reasons in > changing this? At one time postfix needed to run in 2 > instances one for > incoming and one for outgoing. This does not seem to be the case > anymore. It seems to be some top secret reason that no one > knows about. > > Thanks again, > Schrock > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sun Dec 26 20:19:41 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] avery wrote: > > Good inforamation, thanks for the advise. But I am also interested in > the reasons why the method in which Mailscanner and Postfix work > together has changed in the last few months. What were the reasons in > changing this? At one time postfix needed to run in 2 instances one for > incoming and one for outgoing. This does not seem to be the case > anymore. It seems to be some top secret reason that no one knows about. Not that secret really. Postfix, being of 'modular design' relies on a beast known as queue runner (You will find manual entries about it and an entry in master.cf which controls it). Basically the queue runner moves messages about to the different bits of Postfix e.g. smtpd receives the message, the queue runner moves it to an out going queue or delivery agent, you get the idea. Now Wietse (Sorry if that's spelt wrong but it's Christmas and I can't be bothered to look it up ;-) ) doesn't feel the need to use any form of locking on any of the queue files as from his perspective the only thing moving messages is Postfix (And probably the queue runner at that) so there is no need to lock files from it's self. That's fine until you introduce MailScanner who will pick up messages and scan them and quite possibly while the queue runner is trying to move them, hence making duplicate and truncated messages (Which is the complaint from the Postfix community). The solution is quite simple. Put the unscanned mail some where that the queue runner doesn't ever go - the hold queue. From there MS can do it's bit with out fear of interference and then MS moves the message from the hold queue back into an active queue for delivery. That is the 'secret' of single verses double Postfix instances. Hope that makes it clearer. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Sun Dec 26 20:44:48 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew Marshall wrote: > avery wrote: > > > >> >> Good inforamation, thanks for the advise. But I am also interested in >> the reasons why the method in which Mailscanner and Postfix work >> together has changed in the last few months. What were the reasons in >> changing this? At one time postfix needed to run in 2 instances one for >> incoming and one for outgoing. This does not seem to be the case >> anymore. It seems to be some top secret reason that no one knows about. > > > Not that secret really. Postfix, being of 'modular design' relies on a > beast known as queue runner (You will find manual entries about it and > an entry in master.cf which controls it). Basically the queue runner > moves messages about to the different bits of Postfix e.g. smtpd > receives the message, the queue runner moves it to an out going queue or > delivery agent, you get the idea. Now Wietse (Sorry if that's spelt > wrong but it's Christmas and I can't be bothered to look it up ;-) ) > doesn't feel the need to use any form of locking on any of the queue > files as from his perspective the only thing moving messages is Postfix > (And probably the queue runner at that) so there is no need to lock > files from it's self. That's fine until you introduce MailScanner who > will pick up messages and scan them and quite possibly while the queue > runner is trying to move them, hence making duplicate and truncated > messages (Which is the complaint from the Postfix community). The > solution is quite simple. Put the unscanned mail some where that the > queue runner doesn't ever go - the hold queue. From there MS can do it's > bit with out fear of interference and then MS moves the message from the > hold queue back into an active queue for delivery. That is the 'secret' > of single verses double Postfix instances. > > Hope that makes it clearer. > > Drew > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Drew, Awesome, Awesome, Awesome, thank you. I needed that information badly and so do others. I am making a proposal to expose this information. I just wanted someone to specifically state the reasons why things have changed. If more postfix users knew this they might not be so afraid of using Mailscanner with postfix. The postfix community is still telling people not to use Mailscanner with postfix even though it seems a solution has been found. As of right this second the postfix experts on the postfix mailing list are telling people that it is not safe to use postfix and Mailscanner together. This is no longer the case as you have just explained to me. It seems to me that this information should be more readily available. This has been my point all along. Information my fellow friends, its all about information. Is there someone I can make a request to that would post this information you just presented to me on the Mailscanner website? Mailscanner needs a wiki : ) Thanks again, Schrock ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sun Dec 26 21:01:15 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew, > > Awesome, Awesome, Awesome, thank you. I needed that information badly > and so do others. I am making a proposal to expose this information. I > just wanted someone to specifically state the reasons why things have > changed. If more postfix users knew this they might not be so afraid of > using Mailscanner with postfix. The postfix community is still telling > people not to use Mailscanner with postfix even though it seems a > solution has been found. As of right this second the postfix experts on > the postfix mailing list are telling people that it is not safe to use > postfix and Mailscanner together. As you have researched, Julian Field (I *can* spell that one!) and the Postfix development team don't see eye to eye (To put it mildly). The attitude from the Postfix end is do it our way or not at all, which is sad and not totally in the spirit of open source (IMHO), after all what difference is MS moving messages to the queue runner moving messages? Anyway I'm not going to stand on that soap box :-) . I love MailScanner as it's well documented, easy to configure and does loads of clever stuff without me needing to know too much and it's always evolving and developing. Ironically, I love Postfix for the same reasons and it's pretty quick too! Fortunately there is a neat way to make the two work together. One last point. If you ever want to 'hold' a message you can't use Postfix to do so (As that is the MS interface) however MailScanner comes with great quarantine features which you can set up via rule sets which are much simpler than the regex required to make Postfix's content or header specific system work, just in case that one should surface as an argument... :-) Drew Happy to help Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Sun Dec 26 21:33:51 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew Marshall wrote: > Drew, > >> >> Awesome, Awesome, Awesome, thank you. I needed that information badly >> and so do others. I am making a proposal to expose this information. I >> just wanted someone to specifically state the reasons why things have >> changed. If more postfix users knew this they might not be so afraid of >> using Mailscanner with postfix. The postfix community is still telling >> people not to use Mailscanner with postfix even though it seems a >> solution has been found. As of right this second the postfix experts on >> the postfix mailing list are telling people that it is not safe to use >> postfix and Mailscanner together. > > > As you have researched, Julian Field (I *can* spell that one!) and the > Postfix development team don't see eye to eye (To put it mildly). The > attitude from the Postfix end is do it our way or not at all, which is > sad and not totally in the spirit of open source (IMHO), after all what > difference is MS moving messages to the queue runner moving messages? > Anyway I'm not going to stand on that soap box :-) . I love MailScanner > as it's well documented, easy to configure and does loads of clever > stuff without me needing to know too much and it's always evolving and > developing. Ironically, I love Postfix for the same reasons and it's > pretty quick too! Fortunately there is a neat way to make the two work > together. One last point. If you ever want to 'hold' a message you can't > use Postfix to do so (As that is the MS interface) however MailScanner > comes with great quarantine features which you can set up via rule sets > which are much simpler than the regex required to make Postfix's content > or header specific system work, just in case that one should surface as > an argument... :-) > > Drew > > Happy to help > > Drew > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Drew, I agree completely that Mailscanner is a awesome piece of software, so is postfix though. Maybe this isn't my place to say this, but at least this sort of information should be on the Mailscanner website. The strength of GNU/GPL/OpenSource communities is all of the great information you can get that the proprietary world lacks so much of. Why not just openly state that the postfix community does not agree with how Mailscanner works with postfix and that Mailscanner has tried to accommodate the postfix community. No politics no bull just the facts. Then people like me are more educated on the subject and less people would be bothering the Mailscanner experts on the mailing list : ) . Sometime exposting the facts kills off the politics and drama. A lot of people like me are struggling to keep open source products a part of the IT infrastructure we work in. We sometimes have difficulty getting the facts, and a lot of people are getting scared away from Mailscanner because of this. I am not proposing changing anything, I am just saying lets expose the facts. Thanks for all of your great help, Schrock ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Sun Dec 26 21:50:46 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] avery wrote: > Drew Marshall wrote: > >> Drew, >> >>> Awesome, Awesome, Awesome, thank you. I needed that information badly >>> and so do others. I am making a proposal to expose this information. I >>> just wanted someone to specifically state the reasons why things have >>> changed. If more postfix users knew this they might not be so afraid of >>> using Mailscanner with postfix. The postfix community is still telling >>> people not to use Mailscanner with postfix even though it seems a >>> solution has been found. As of right this second the postfix experts on >>> the postfix mailing list are telling people that it is not safe to use >>> postfix and Mailscanner together. >> >> >> >> As you have researched, Julian Field (I *can* spell that one!) and the >> Postfix development team don't see eye to eye (To put it mildly). The >> attitude from the Postfix end is do it our way or not at all, which is >> sad and not totally in the spirit of open source (IMHO), after all what >> difference is MS moving messages to the queue runner moving messages? >> Anyway I'm not going to stand on that soap box :-) . I love MailScanner >> as it's well documented, easy to configure and does loads of clever >> stuff without me needing to know too much and it's always evolving and >> developing. Ironically, I love Postfix for the same reasons and it's >> pretty quick too! Fortunately there is a neat way to make the two work >> together. One last point. If you ever want to 'hold' a message you can't >> use Postfix to do so (As that is the MS interface) however MailScanner >> comes with great quarantine features which you can set up via rule sets >> which are much simpler than the regex required to make Postfix's content >> or header specific system work, just in case that one should surface as >> an argument... :-) >> > > Drew, > > I agree completely that Mailscanner is a awesome piece of software, so > is postfix though. > > Maybe this isn't my place to say this, but at least this sort of > information should be on the Mailscanner website. The strength of > GNU/GPL/OpenSource communities is all of the great information you can > get that the proprietary world lacks so much of. Why not just openly > state that the postfix community does not agree with how Mailscanner > works with postfix and that Mailscanner has tried to accommodate the > postfix community. No politics no bull just the facts. Then people like > me are more educated on the subject and less people would be bothering > the Mailscanner experts on the mailing list : ) . Sometime exposting the > facts kills off the politics and drama. > > A lot of people like me are struggling to keep open source products a > part of the IT infrastructure we work in. We sometimes have difficulty > getting the facts, and a lot of people are getting scared away from > Mailscanner because of this. I am not proposing changing anything, I am > just saying lets expose the facts. It would be great if you could add this to the FAQ on the website. It's not a wiki but works very like one. Thanks! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Sun Dec 26 21:58:35 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > avery wrote: > >> Drew Marshall wrote: >> >>> Drew, >>> >>>> Awesome, Awesome, Awesome, thank you. I needed that information badly >>>> and so do others. I am making a proposal to expose this information. I >>>> just wanted someone to specifically state the reasons why things have >>>> changed. If more postfix users knew this they might not be so >>>> afraid of >>>> using Mailscanner with postfix. The postfix community is still telling >>>> people not to use Mailscanner with postfix even though it seems a >>>> solution has been found. As of right this second the postfix >>>> experts on >>>> the postfix mailing list are telling people that it is not safe to use >>>> postfix and Mailscanner together. >>> >>> >>> >>> >>> As you have researched, Julian Field (I *can* spell that one!) and the >>> Postfix development team don't see eye to eye (To put it mildly). The >>> attitude from the Postfix end is do it our way or not at all, which is >>> sad and not totally in the spirit of open source (IMHO), after all what >>> difference is MS moving messages to the queue runner moving messages? >>> Anyway I'm not going to stand on that soap box :-) . I love MailScanner >>> as it's well documented, easy to configure and does loads of clever >>> stuff without me needing to know too much and it's always evolving and >>> developing. Ironically, I love Postfix for the same reasons and it's >>> pretty quick too! Fortunately there is a neat way to make the two work >>> together. One last point. If you ever want to 'hold' a message you >>> can't >>> use Postfix to do so (As that is the MS interface) however MailScanner >>> comes with great quarantine features which you can set up via rule sets >>> which are much simpler than the regex required to make Postfix's >>> content >>> or header specific system work, just in case that one should surface as >>> an argument... :-) >>> >> >> Drew, >> >> I agree completely that Mailscanner is a awesome piece of software, so >> is postfix though. >> >> Maybe this isn't my place to say this, but at least this sort of >> information should be on the Mailscanner website. The strength of >> GNU/GPL/OpenSource communities is all of the great information you can >> get that the proprietary world lacks so much of. Why not just openly >> state that the postfix community does not agree with how Mailscanner >> works with postfix and that Mailscanner has tried to accommodate the >> postfix community. No politics no bull just the facts. Then people like >> me are more educated on the subject and less people would be bothering >> the Mailscanner experts on the mailing list : ) . Sometime exposting the >> facts kills off the politics and drama. >> >> A lot of people like me are struggling to keep open source products a >> part of the IT infrastructure we work in. We sometimes have difficulty >> getting the facts, and a lot of people are getting scared away from >> Mailscanner because of this. I am not proposing changing anything, I am >> just saying lets expose the facts. > > > It would be great if you could add this to the FAQ on the website. It's > not a wiki but works very like one. Thanks! > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Julian, Thanks you for the info Mr. FAQ Administrator. Consider it done. Schrock ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sun Dec 26 22:00:35 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > avery wrote: > >> Drew Marshall wrote: >> >>> Drew, >>> >>>> Awesome, Awesome, Awesome, thank you. I needed that information badly >>>> and so do others. I am making a proposal to expose this information. I >>>> just wanted someone to specifically state the reasons why things have >>>> changed. If more postfix users knew this they might not be so >>>> afraid of >>>> using Mailscanner with postfix. The postfix community is still telling >>>> people not to use Mailscanner with postfix even though it seems a >>>> solution has been found. As of right this second the postfix >>>> experts on >>>> the postfix mailing list are telling people that it is not safe to use >>>> postfix and Mailscanner together. >>> >>> >>> >>> >>> As you have researched, Julian Field (I *can* spell that one!) and the >>> Postfix development team don't see eye to eye (To put it mildly). The >>> attitude from the Postfix end is do it our way or not at all, which is >>> sad and not totally in the spirit of open source (IMHO), after all what >>> difference is MS moving messages to the queue runner moving messages? >>> Anyway I'm not going to stand on that soap box :-) . I love MailScanner >>> as it's well documented, easy to configure and does loads of clever >>> stuff without me needing to know too much and it's always evolving and >>> developing. Ironically, I love Postfix for the same reasons and it's >>> pretty quick too! Fortunately there is a neat way to make the two work >>> together. One last point. If you ever want to 'hold' a message you >>> can't >>> use Postfix to do so (As that is the MS interface) however MailScanner >>> comes with great quarantine features which you can set up via rule sets >>> which are much simpler than the regex required to make Postfix's >>> content >>> or header specific system work, just in case that one should surface as >>> an argument... :-) >>> >> >> Drew, >> >> I agree completely that Mailscanner is a awesome piece of software, so >> is postfix though. >> >> Maybe this isn't my place to say this, but at least this sort of >> information should be on the Mailscanner website. The strength of >> GNU/GPL/OpenSource communities is all of the great information you can >> get that the proprietary world lacks so much of. Why not just openly >> state that the postfix community does not agree with how Mailscanner >> works with postfix and that Mailscanner has tried to accommodate the >> postfix community. No politics no bull just the facts. Then people like >> me are more educated on the subject and less people would be bothering >> the Mailscanner experts on the mailing list : ) . Sometime exposting the >> facts kills off the politics and drama. >> >> A lot of people like me are struggling to keep open source products a >> part of the IT infrastructure we work in. We sometimes have difficulty >> getting the facts, and a lot of people are getting scared away from >> Mailscanner because of this. I am not proposing changing anything, I am >> just saying lets expose the facts. > > > It would be great if you could add this to the FAQ on the website. It's > not a wiki but works very like one. Thanks! I'll try to put something together. Won't be immediate as I would like to make it readable and could do with less beer and more sleep inside of me :-) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sun Dec 26 22:02:07 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] avery wrote: > Julian Field wrote: > >> avery wrote: >> >>> Drew Marshall wrote: >>> >>>> Drew, >>>> >>>>> Awesome, Awesome, Awesome, thank you. I needed that information badly >>>>> and so do others. I am making a proposal to expose this >>>>> information. I >>>>> just wanted someone to specifically state the reasons why things have >>>>> changed. If more postfix users knew this they might not be so >>>>> afraid of >>>>> using Mailscanner with postfix. The postfix community is still >>>>> telling >>>>> people not to use Mailscanner with postfix even though it seems a >>>>> solution has been found. As of right this second the postfix >>>>> experts on >>>>> the postfix mailing list are telling people that it is not safe to >>>>> use >>>>> postfix and Mailscanner together. >>>> >>>> >>>> >>>> >>>> >>>> As you have researched, Julian Field (I *can* spell that one!) and the >>>> Postfix development team don't see eye to eye (To put it mildly). The >>>> attitude from the Postfix end is do it our way or not at all, which is >>>> sad and not totally in the spirit of open source (IMHO), after all >>>> what >>>> difference is MS moving messages to the queue runner moving messages? >>>> Anyway I'm not going to stand on that soap box :-) . I love >>>> MailScanner >>>> as it's well documented, easy to configure and does loads of clever >>>> stuff without me needing to know too much and it's always evolving and >>>> developing. Ironically, I love Postfix for the same reasons and it's >>>> pretty quick too! Fortunately there is a neat way to make the two work >>>> together. One last point. If you ever want to 'hold' a message you >>>> can't >>>> use Postfix to do so (As that is the MS interface) however MailScanner >>>> comes with great quarantine features which you can set up via rule >>>> sets >>>> which are much simpler than the regex required to make Postfix's >>>> content >>>> or header specific system work, just in case that one should >>>> surface as >>>> an argument... :-) >>>> >>> >>> Drew, >>> >>> I agree completely that Mailscanner is a awesome piece of software, so >>> is postfix though. >>> >>> Maybe this isn't my place to say this, but at least this sort of >>> information should be on the Mailscanner website. The strength of >>> GNU/GPL/OpenSource communities is all of the great information you can >>> get that the proprietary world lacks so much of. Why not just openly >>> state that the postfix community does not agree with how Mailscanner >>> works with postfix and that Mailscanner has tried to accommodate the >>> postfix community. No politics no bull just the facts. Then people like >>> me are more educated on the subject and less people would be bothering >>> the Mailscanner experts on the mailing list : ) . Sometime exposting >>> the >>> facts kills off the politics and drama. >>> >>> A lot of people like me are struggling to keep open source products a >>> part of the IT infrastructure we work in. We sometimes have difficulty >>> getting the facts, and a lot of people are getting scared away from >>> Mailscanner because of this. I am not proposing changing anything, I am >>> just saying lets expose the facts. >> >> >> >> It would be great if you could add this to the FAQ on the website. It's >> not a wiki but works very like one. Thanks! >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > Julian, > > Thanks you for the info Mr. FAQ Administrator. Consider it done. > > Schrock Ok beat me to it! I'll leave to you Schrock. Feel free to mail me off list if you need any help or more detail. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Sun Dec 26 22:05:33 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew Marshall wrote: > avery wrote: > >> Julian Field wrote: >> >>> avery wrote: >>> >>>> Drew Marshall wrote: >>>> >>>>> Drew, >>>>> >>>>>> Awesome, Awesome, Awesome, thank you. I needed that information >>>>>> badly >>>>>> and so do others. I am making a proposal to expose this >>>>>> information. I >>>>>> just wanted someone to specifically state the reasons why things >>>>>> have >>>>>> changed. If more postfix users knew this they might not be so >>>>>> afraid of >>>>>> using Mailscanner with postfix. The postfix community is still >>>>>> telling >>>>>> people not to use Mailscanner with postfix even though it seems a >>>>>> solution has been found. As of right this second the postfix >>>>>> experts on >>>>>> the postfix mailing list are telling people that it is not safe to >>>>>> use >>>>>> postfix and Mailscanner together. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> As you have researched, Julian Field (I *can* spell that one!) and >>>>> the >>>>> Postfix development team don't see eye to eye (To put it mildly). The >>>>> attitude from the Postfix end is do it our way or not at all, >>>>> which is >>>>> sad and not totally in the spirit of open source (IMHO), after all >>>>> what >>>>> difference is MS moving messages to the queue runner moving messages? >>>>> Anyway I'm not going to stand on that soap box :-) . I love >>>>> MailScanner >>>>> as it's well documented, easy to configure and does loads of clever >>>>> stuff without me needing to know too much and it's always evolving >>>>> and >>>>> developing. Ironically, I love Postfix for the same reasons and it's >>>>> pretty quick too! Fortunately there is a neat way to make the two >>>>> work >>>>> together. One last point. If you ever want to 'hold' a message you >>>>> can't >>>>> use Postfix to do so (As that is the MS interface) however >>>>> MailScanner >>>>> comes with great quarantine features which you can set up via rule >>>>> sets >>>>> which are much simpler than the regex required to make Postfix's >>>>> content >>>>> or header specific system work, just in case that one should >>>>> surface as >>>>> an argument... :-) >>>>> >>>> >>>> Drew, >>>> >>>> I agree completely that Mailscanner is a awesome piece of software, so >>>> is postfix though. >>>> >>>> Maybe this isn't my place to say this, but at least this sort of >>>> information should be on the Mailscanner website. The strength of >>>> GNU/GPL/OpenSource communities is all of the great information you can >>>> get that the proprietary world lacks so much of. Why not just openly >>>> state that the postfix community does not agree with how Mailscanner >>>> works with postfix and that Mailscanner has tried to accommodate the >>>> postfix community. No politics no bull just the facts. Then people >>>> like >>>> me are more educated on the subject and less people would be bothering >>>> the Mailscanner experts on the mailing list : ) . Sometime exposting >>>> the >>>> facts kills off the politics and drama. >>>> >>>> A lot of people like me are struggling to keep open source products a >>>> part of the IT infrastructure we work in. We sometimes have difficulty >>>> getting the facts, and a lot of people are getting scared away from >>>> Mailscanner because of this. I am not proposing changing anything, >>>> I am >>>> just saying lets expose the facts. >>> >>> >>> >>> >>> It would be great if you could add this to the FAQ on the website. It's >>> not a wiki but works very like one. Thanks! >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> Professional Support Services at www.MailScanner.biz >>> MailScanner thanks transtec Computers for their support >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> Julian, >> >> Thanks you for the info Mr. FAQ Administrator. Consider it done. >> >> Schrock > > > Ok beat me to it! I'll leave to you Schrock. Feel free to mail me off > list if you need any help or more detail. > > Drew > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Drew, Awsome, you guys are great. I will do my best. Schrock ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Mon Dec 27 11:03:54 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:28:01 2006 Subject: Mailscanner virus errors Message-ID: What can be the problem because the virus passes though the mail scanner. Is this a problem with clamav? Why does bitdefender doesn't see it? ... Here is some info 1) MailScanner -v Running on Linux 2.4.21-27.0.1.TLsmp #1 SMP Thu Dec 23 20:38:15 EST 2004 i686 i686 i386 GNU/Linux This is Tao Linux release 1 (Mooch Update 3) This is Perl version 5.008000 (5.8.0) This is MailScanner version 4.36.4 Module versions are: 1.00 AnyDBM_File 1.14 Archive::Zip 1.01 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.04 Fcntl 2.71 File::Basename 2.05 File::Copy 2.01 FileHandle 1.05 File::Path 0.13 File::Temp 1.29 HTML::Entities 3.43 HTML::Parser 2.30 HTML::TokeParser 1.20 IO 1.09 IO::File 1.122 IO::Pipe 3.05 MIME::Base64 5.415 MIME::Decoder 5.415 MIME::Decoder::UU 5.415 MIME::Head 5.415 MIME::Parser 3.03 MIME::QuotedPrint 5.415 MIME::Tools 0.09 Net::CIDR 1.05 POSIX 1.75 Socket 0.03 Sys::Syslog 1.02 Time::localtime Optional module versions are: 1.810 DB_File 1.00 Digest 1.01 Digest::HMAC 2.20 Digest::MD5 2.01 Digest::SHA1 0.44 Inline missing Mail::ClamAV 3.000002 Mail::SpamAssassin 1.997 Mail::SPF::Query 0.15 Net::CIDR::Lite 0.48 Net::DNS missing Net::LDAP 1.94 Parse::RecDescent missing SAVI 1.2 Sys::Hostname::Long 2.26 Test::Harness 0.47 Test::Simple 1.89 Text::Balanced 1.19 URI 2) virusscanners bitdefender7.0.1-3-gcc3x an clamav 0.80 3) Maillog output Dec 22 23:01:30 scanmail MailScanner[1170]: copfilter_200411060253_setup.tgz Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "copfilter_200411060253_setup.tgz". Please contact the authors! Dec 22 23:01:30 scanmail MailScanner[1170]: setup.sh Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "setup.sh". Please contact the authors! Dec 22 23:01:30 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/ Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/ Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/globa l_settings Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/global_settings". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/clamd _counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/clamd_counter". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/globa l_settings.backup2 Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/global_settings.backup2". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/fprot _counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/fprot_counter". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/clamd _counter.conf Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/clamd_counter.conf". Please contact the autho rs! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/fprot _counter.conf Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/fprot_counter.conf". Please contact the autho rs! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/rules _du_jour_counter.conf Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/rules_du_jour_counter.conf". Please contact t he authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/rules _du_jour_counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/rules_du_jour_counter". Please contact the au thors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/p3sca n_rm_counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/p3scan_rm_counter". Please contact the author s! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/fprot _prg_counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/fprot_prg_counter". Please contact the author s! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/p3sca n_rm_counter.conf Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/p3scan_rm_counter.conf". Please contact the a uthors! Dec 22 23:01:32 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/fprot --More--(5%) -- Koen Teugels N.V. NEXIS S.A. Chaussee de Namur 79 1300 Wavre Belgium Visit us at http://www.nexis.be e-mail : kte@nexis.be tel.: +32 (0)10 81.81.81 fax: +32 (0)10 81.81.80 visit us at : http://www.nexis.be ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Image/JPEG 13KB. ] [ Unable to print this part. ] From kte at NEXIS.BE Mon Dec 27 11:29:27 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:28:01 2006 Subject: Mailserver replacement of exchange Message-ID: Michael Baird wrote: Does anyone has a good alternative for MS exchange (groupware) in the opensource world? If it is possible an outlook client must be able to connect to it. I've been looking as well, been following 3 projects, http://www.egroupware.com, http://www.opengroupware.com, http://www.open-xchange.org, they all have varying levels of outlook connectivity, very raw. A non-opensource solution, that is inexpensive and runs under linux is the kerio mailserver, it has a great web interface as well as full outlook support (evolution/thunderbird support is expected in the near future as well) and some nice Exchange migration tools. Hello I've been looking for for 3 products. But I wondering do you have a favorite? I'm looking for a mail server / client + calendar + cms (document ) + knowledge database + integration possibilities op mail scanner. Do you know people with installation experience. Can you customize the product ?. Deactivate functions. Future of the products. Used technologies, ... Thanks Koen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mail at WOZENILEK.DE Mon Dec 27 13:12:52 2004 From: mail at WOZENILEK.DE (Martin Wozenilek) Date: Thu Jan 12 21:28:01 2006 Subject: Mailserver replacement of exchange Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Try: http://www.group-office.com/ http://www.egroupware.org/ http://mgw.k-fish.de/ Koen Teugels wrote: > > > > > > > >Michael Baird wrote:
>
type="cite"> >
> 
Does anyone has a good alternative for MS exchange
>(groupware) in the
>opensource world? If it is possible an outlook client must be able to
>connect to it.
>
>
> 

>I've been looking as well, been following 3 projects,
>href="http://www.egroupware.com">http://www.egroupware.com, class="moz-txt-link-freetext"
>href="http://www.opengroupware.com">http://www.opengroupware.com,
>href="http://www.open-xchange.org">http://www.open-xchange.org, they
>all have varying levels of outlook
>connectivity, very raw. A non-opensource solution, that is inexpensive
>and runs under linux is the kerio mailserver, it has a great web
>interface as well as full outlook support (evolution/thunderbird support
>is expected in the near future as well) and some nice Exchange migration
>tools.
>
>
>
>Hello I've been looking for for 3 products. But I wondering do you have >a favorite? I'm looking for a mail server / client + calendar + cms >(document ) + knowledge database + integration possibilities op mail >scanner.
>Do you know people with installation experience. Can you customize the >product ?. Deactivate functions. Future of the products. Used >technologies, ...
>
>Thanks Koen
> > >------------------------ MailScanner list ------------------------
>To unsubscribe, email href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk >with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/)
and >the archives (href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html). >

>Support MailScanner development - buy the book off the website! > -- Martin Wozenilek Am Langberg 91a 21033 Hamburg mailto: mail@wozenilek.de PGP-Key-ID: 0x00105C52 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Mon Dec 27 14:16:33 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of avery Sent: Sunday, December 26, 2004 5:06 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Postfix and Mailscanner sitting in a tree k-iss-ing Drew Marshall wrote: > avery wrote: > >> Julian Field wrote: >> >>> avery wrote: >>> >>>> Drew Marshall wrote: >>>> >>>>> Drew, >>>>> >>>>>> Awesome, Awesome, Awesome, thank you. I needed that information >>>>>> badly and so do others. I am making a proposal to expose this >>>>>> information. I >>>>>> just wanted someone to specifically state the reasons why things >>>>>> have >>>>>> changed. If more postfix users knew this they might not be so >>>>>> afraid of >>>>>> using Mailscanner with postfix. The postfix community is still >>>>>> telling >>>>>> people not to use Mailscanner with postfix even though it seems a >>>>>> solution has been found. As of right this second the postfix >>>>>> experts on >>>>>> the postfix mailing list are telling people that it is not safe to >>>>>> use >>>>>> postfix and Mailscanner together. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> As you have researched, Julian Field (I *can* spell that one!) and >>>>> the >>>>> Postfix development team don't see eye to eye (To put it mildly). The >>>>> attitude from the Postfix end is do it our way or not at all, >>>>> which is >>>>> sad and not totally in the spirit of open source (IMHO), after all >>>>> what >>>>> difference is MS moving messages to the queue runner moving messages? >>>>> Anyway I'm not going to stand on that soap box :-) . I love >>>>> MailScanner >>>>> as it's well documented, easy to configure and does loads of clever >>>>> stuff without me needing to know too much and it's always evolving >>>>> and >>>>> developing. Ironically, I love Postfix for the same reasons and it's >>>>> pretty quick too! Fortunately there is a neat way to make the two >>>>> work >>>>> together. One last point. If you ever want to 'hold' a message you >>>>> can't >>>>> use Postfix to do so (As that is the MS interface) however >>>>> MailScanner >>>>> comes with great quarantine features which you can set up via rule >>>>> sets >>>>> which are much simpler than the regex required to make Postfix's >>>>> content >>>>> or header specific system work, just in case that one should >>>>> surface as >>>>> an argument... :-) >>>>> >>>> >>>> Drew, >>>> >>>> I agree completely that Mailscanner is a awesome piece of software, so >>>> is postfix though. >>>> >>>> Maybe this isn't my place to say this, but at least this sort of >>>> information should be on the Mailscanner website. The strength of >>>> GNU/GPL/OpenSource communities is all of the great information you can >>>> get that the proprietary world lacks so much of. Why not just openly >>>> state that the postfix community does not agree with how Mailscanner >>>> works with postfix and that Mailscanner has tried to accommodate the >>>> postfix community. No politics no bull just the facts. Then people >>>> like >>>> me are more educated on the subject and less people would be bothering >>>> the Mailscanner experts on the mailing list : ) . Sometime exposting >>>> the >>>> facts kills off the politics and drama. >>>> >>>> A lot of people like me are struggling to keep open source products a >>>> part of the IT infrastructure we work in. We sometimes have difficulty >>>> getting the facts, and a lot of people are getting scared away from >>>> Mailscanner because of this. I am not proposing changing anything, >>>> I am >>>> just saying lets expose the facts. >>> >>> >>> >>> >>> It would be great if you could add this to the FAQ on the website. It's >>> not a wiki but works very like one. Thanks! >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> Professional Support Services at www.MailScanner.biz >>> MailScanner thanks transtec Computers for their support >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> Julian, >> >> Thanks you for the info Mr. FAQ Administrator. Consider it done. >> >> Schrock > > > Ok beat me to it! I'll leave to you Schrock. Feel free to mail me off > list if you need any help or more detail. > > Drew > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! >Drew, >Awsome, you guys are great. I will do my best. >Schrock I've definitely gotten the third degree from the postfix users list regarding MailScanner. I continue to use it because it just works. I've been using it for well over a year now without any major problems. People on the postfix list can be brusque. While I respect Mr. Venema, I believe that MailScanner is an effective solution to run along with Postfix. Rod ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.bourque at MELLOUL.COM Mon Dec 27 19:11:52 2004 From: richard.bourque at MELLOUL.COM (Richard Bourque) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: On Sat, 25 Dec 2004 20:43:06 -0800, avery wrote: >First let me say how impressed I am with Mailscanner. I have been using >it in a production enviorment for the last 4 weeks. I have only ever >just played with it in the past. > >I am about to start adding more domains to my email server and have some >concerns. I have read a lot of negativity about Mailscanner and postfix >being used together in the postfix community and else where. We all know >this story so I don't need to go any farther. I have searched the >Mailscanner archives for any opinions from the Mailscanner experts >within the last 4 months, and have found very little information. I have >noticed however that the suggested way of setting up Mailscanner to work >with postfix has changed >http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml so I >figured anything before the change was irrelevant. Hence the 4 month >limitation on the search. My question is this: has the way in which >Mailscanner is now being setup with postfix changed the integrity of >things? Has the overall outlook of Mailscanner when being used with >postfix improved at all in the postfix community? > >I personally have not experienced any real serous problems yet. I have >however had some email sit in the queue for 10+ min. Before getting >delivered. One other time I needed to restart the Mailscanner service >because all mail was getting queued up and not getting delivered. After >restarting the service everything worked. I know this has something to >do with Mailscanner because before I integrated Mailscanner into this >server I never had this problem. > >Pardon me for asking this question, but it seems that for the most part, >the Mailscanner community doesn't seem to see a real problem in which >the way Mailscanner works with postfix. On the other hand the Postfix >community does. Is this more personal than anything, or is there >actually some legitimacy behind it all? > >Thanks, >Schrock > I used Postfix and MailScanner in the old days for an entire year without any major problems. Once or twice the queues slowed down and I had to restart Postfix and MailScanner, but that was normal under the older configuration for Postfix. I switched to Exim on my 3 email servers mainly because I read some of Wietse Venema's (author of Postfix) opinions of Mailscanner and was really turned off by his attitude. Julian gives better support than any commercial product we use and the author of Exim has no problems with people interfacing with his mail server so I switched. Postfix worked great for me and I never would have switched except because of his comments. (Anyone know if Wietse has come down off his pedastal yet?) BTW, I haven't had a single problem with my mailservers since the switch to Exim. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Mon Dec 27 23:23:24 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:28:01 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: Call me crazy, but I've always used sendmail and never had any problems. I like the way milters can be set up to do a lot of things, straightforward configuration files (once you've googled around for sendmail.mc settings and such), and 0 problems with MailScanner (unless you count running a rogue sendmail process from /etc/rc.d/init.d on some stubborn old Red Hat distros as a problem). Maybe it's because I've never had to handle more than 10k msgs/day or more than 1k users, but sendmail just plain works (tm). -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Richard Bourque Sent: Monday, December 27, 2004 2:12 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Postfix and Mailscanner sitting in a tree k-iss-ing On Sat, 25 Dec 2004 20:43:06 -0800, avery wrote: >First let me say how impressed I am with Mailscanner. I have been using >it in a production enviorment for the last 4 weeks. I have only ever >just played with it in the past. > >I am about to start adding more domains to my email server and have >some concerns. I have read a lot of negativity about Mailscanner and >postfix being used together in the postfix community and else where. We >all know this story so I don't need to go any farther. I have searched >the Mailscanner archives for any opinions from the Mailscanner experts >within the last 4 months, and have found very little information. I >have noticed however that the suggested way of setting up Mailscanner >to work with postfix has changed >http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml so I >figured anything before the change was irrelevant. Hence the 4 month >limitation on the search. My question is this: has the way in which >Mailscanner is now being setup with postfix changed the integrity of >things? Has the overall outlook of Mailscanner when being used with >postfix improved at all in the postfix community? > >I personally have not experienced any real serous problems yet. I have >however had some email sit in the queue for 10+ min. Before getting >delivered. One other time I needed to restart the Mailscanner service >because all mail was getting queued up and not getting delivered. After >restarting the service everything worked. I know this has something to >do with Mailscanner because before I integrated Mailscanner into this >server I never had this problem. > >Pardon me for asking this question, but it seems that for the most >part, the Mailscanner community doesn't seem to see a real problem in >which the way Mailscanner works with postfix. On the other hand the >Postfix community does. Is this more personal than anything, or is >there actually some legitimacy behind it all? > >Thanks, >Schrock > I used Postfix and MailScanner in the old days for an entire year without any major problems. Once or twice the queues slowed down and I had to restart Postfix and MailScanner, but that was normal under the older configuration for Postfix. I switched to Exim on my 3 email servers mainly because I read some of Wietse Venema's (author of Postfix) opinions of Mailscanner and was really turned off by his attitude. Julian gives better support than any commercial product we use and the author of Exim has no problems with people interfacing with his mail server so I switched. Postfix worked great for me and I never would have switched except because of his comments. (Anyone know if Wietse has come down off his pedastal yet?) BTW, I haven't had a single problem with my mailservers since the switch to Exim. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Tue Dec 28 09:04:57 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:28:01 2006 Subject: Mailscanner virus errors Message-ID: What can be the problem because the virus passes though the mail scanner. Is this a problem with clamav? Why does bitdefender doesn't see it? ... Here is some info 1) MailScanner -v Running on Linux 2.4.21-27.0.1.TLsmp #1 SMP Thu Dec 23 20:38:15 EST 2004 i686 i686 i386 GNU/Linux This is Tao Linux release 1 (Mooch Update 3) This is Perl version 5.008000 (5.8.0) This is MailScanner version 4.36.4 Module versions are: 1.00 AnyDBM_File 1.14 Archive::Zip 1.01 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.04 Fcntl 2.71 File::Basename 2.05 File::Copy 2.01 FileHandle 1.05 File::Path 0.13 File::Temp 1.29 HTML::Entities 3.43 HTML::Parser 2.30 HTML::TokeParser 1.20 IO 1.09 IO::File 1.122 IO::Pipe 3.05 MIME::Base64 5.415 MIME::Decoder 5.415 MIME::Decoder::UU 5.415 MIME::Head 5.415 MIME::Parser 3.03 MIME::QuotedPrint 5.415 MIME::Tools 0.09 Net::CIDR 1.05 POSIX 1.75 Socket 0.03 Sys::Syslog 1.02 Time::localtime Optional module versions are: 1.810 DB_File 1.00 Digest 1.01 Digest::HMAC 2.20 Digest::MD5 2.01 Digest::SHA1 0.44 Inline missing Mail::ClamAV 3.000002 Mail::SpamAssassin 1.997 Mail::SPF::Query 0.15 Net::CIDR::Lite 0.48 Net::DNS missing Net::LDAP 1.94 Parse::RecDescent missing SAVI 1.2 Sys::Hostname::Long 2.26 Test::Harness 0.47 Test::Simple 1.89 Text::Balanced 1.19 URI 2) virusscanners bitdefender7.0.1-3-gcc3x an clamav 0.80 3) Maillog output Dec 22 23:01:30 scanmail MailScanner[1170]: copfilter_200411060253_setup.tgz Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "copfilter_200411060253_setup.tgz". Please contact the authors! Dec 22 23:01:30 scanmail MailScanner[1170]: setup.sh Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "setup.sh". Please contact the authors! Dec 22 23:01:30 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/ Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/ Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/globa l_settings Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/global_settings". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/clamd _counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/clamd_counter". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/globa l_settings.backup2 Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/global_settings.backup2". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/fprot _counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/fprot_counter". Please contact the authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/clamd _counter.conf Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/clamd_counter.conf". Please contact the autho rs! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/fprot _counter.conf Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/fprot_counter.conf". Please contact the autho rs! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/rules _du_jour_counter.conf Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/rules_du_jour_counter.conf". Please contact t he authors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/rules _du_jour_counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/rules_du_jour_counter". Please contact the au thors! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/p3sca n_rm_counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/p3scan_rm_counter". Please contact the author s! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/fprot _prg_counter Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/fprot_prg_counter". Please contact the author s! Dec 22 23:01:31 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/p3sca n_rm_counter.conf Dec 22 23:01:31 scanmail MailScanner[1170]: ProcessClamAVOutput: unrecognised li ne "var/log/copfilter/0.0.95.1/etc/p3scan_rm_counter.conf". Please contact the a uthors! Dec 22 23:01:32 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/etc/fprot --More--(5%) -- Koen Teugels N.V. NEXIS S.A. Chaussee de Namur 79 1300 Wavre Belgium Visit us at http://www.nexis.be e-mail : kte@nexis.be tel.: +32 (0)10 81.81.81 fax: +32 (0)10 81.81.80 visit us at : http://www.nexis.be ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Image/JPEG 13KB. ] [ Unable to print this part. ] From shrek-m at GMX.DE Tue Dec 28 09:51:59 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:28:01 2006 Subject: Mailscanner virus errors Message-ID: Koen Teugels wrote: > What can be the problem because the virus passes though the mail scanner. > Is this a problem with clamav? Why does bitdefender doesn't see it? ... is clamav ok? # freshclam # clamscan . # /usr/lib/MailScanner/clamav-wrapper /usr/local/ . > Here is some info [...] > *3) *Maillog output > Dec 22 23:01:30 scanmail MailScanner[1170]: > copfilter_200411060253_setup.tgz > Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: > unrecognised li > ne "copfilter_200411060253_setup.tgz". Please contact the authors! > Dec 22 23:01:30 scanmail MailScanner[1170]: setup.sh > Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: > unrecognised li > ne "setup.sh". Please contact the authors! > Dec 22 23:01:30 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/ > [...] sorry, i could not find copfilter. # grep -ir copfilter /var/log/ # grep -ir copfilter /etc/MailScanner/ # grep -ir copfilter /usr/lib/MailScanner/ # copfilter ? http://members.inode.at/m.madlener/ipcop/index.html copfilter is an ipcop addon which scans incoming pop3 email for viruses and spam using the following software [...] spamassasin clamscan [...] -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kte at NEXIS.BE Tue Dec 28 10:17:30 2004 From: kte at NEXIS.BE (Koen Teugels) Date: Thu Jan 12 21:28:01 2006 Subject: Mailscanner virus errors Message-ID: shrek-m@gmx.de wrote: > Koen Teugels wrote: > >> What can be the problem because the virus passes though the mail >> scanner. >> Is this a problem with clamav? Why does bitdefender doesn't see it? ... > > > > is clamav ok? > > # freshclam yes ClamAV update process started at Tue Dec 28 11:13:32 2004 main.cvd is up to date (version: 28, sigs: 26630, f-level: 3, builder: tomek) daily.cvd is up to date (version: 645, sigs: 2326, f-level: 3, builder: ccordes > # clamscan . > > # /usr/lib/MailScanner/clamav-wrapper /usr/local/ . > >> Here is some info > > > > [...] > >> *3) *Maillog output >> Dec 22 23:01:30 scanmail MailScanner[1170]: >> copfilter_200411060253_setup.tgz >> Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: >> unrecognised li >> ne "copfilter_200411060253_setup.tgz". Please contact the authors! >> Dec 22 23:01:30 scanmail MailScanner[1170]: setup.sh >> Dec 22 23:01:30 scanmail MailScanner[1170]: ProcessClamAVOutput: >> unrecognised li >> ne "setup.sh". Please contact the authors! >> Dec 22 23:01:30 scanmail MailScanner[1170]: var/log/copfilter/0.0.95.1/ >> [...] > > > sorry, i could not find copfilter. > > # grep -ir copfilter /var/log/ > # grep -ir copfilter /etc/MailScanner/ > # grep -ir copfilter /usr/lib/MailScanner/ > # > > copfilter ? > > http://members.inode.at/m.madlener/ipcop/index.html > > copfilter is an ipcop addon which scans incoming pop3 email for viruses > and spam using the following software > [...] > spamassasin > clamscan > [...] > > copfilter is the attachment that I send though mailscanner. So I guess he does an unzip on the attachment. And he puts it in /var/log. How can we solve that? thanks Koen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martelm at QUARK.VSC.EDU Tue Dec 28 10:37:36 2004 From: martelm at QUARK.VSC.EDU (Michael H. Martel) Date: Thu Jan 12 21:28:01 2006 Subject: Configuring MailScanner and Majordomo Message-ID: Hello! I'm trying to migrate my Majordomo lists over to my new mail sevrer. They work wonderfully. However, because of how they're implemented (sendmail aliases) MailScanner never sees the traffic to the lists and therefore can't sanitize it. Has anyone managed to setup MailScanner and Majordomo so that MailScanner can scan the lists ? Thanks! Michael -- --------------------------------o--------------------------------- Michael H. Martel | Vermont State Colleges martelm@quark.vsc.edu | Systems Administrator http://probe.vsc.edu/~michael | PH:802-241-2544 FX:802-241-3363 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stefan.hanauska at ALTMUEHLNET.DE Tue Dec 28 11:59:04 2004 From: stefan.hanauska at ALTMUEHLNET.DE (Stefan Hanauska) Date: Thu Jan 12 21:28:01 2006 Subject: Individual settings for every user Message-ID: Hi, is it possible for every user to have individual settings for MailScanner? I want to let the user choose whether there is spam and/or virus checking and what to do with the scanned mails. Cu, Stefan Hanauska ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sanjay.patel at REXWIRE.COM Tue Dec 28 13:31:53 2004 From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel) Date: Thu Jan 12 21:28:01 2006 Subject: Rules Du Jour Message-ID: I have installed RDJ but keep getting this error. /usr/bin/spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint failed. Than it rolls back all the changes. Has anyone else seen this? -SKP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Steve.Swaney at FSL.COM Tue Dec 28 13:48:38 2004 From: Steve.Swaney at FSL.COM (Steve Swaney) Date: Thu Jan 12 21:28:02 2006 Subject: Rules Du Jour Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Sanjay K. Patel > Sent: Tuesday, December 28, 2004 8:32 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Rules Du Jour > > I have installed RDJ but keep getting this error. > > /usr/bin/spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint > failed. > > Than it rolls back all the changes. > > Has anyone else seen this? > You have a SpamAssassin configuration problem. Manually run: spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint 2>&1 | more And look for errors. Correct these errors and Rules Du Jour should work. Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Tue Dec 28 13:42:05 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Blacknight Solutions) Date: Thu Jan 12 21:28:02 2006 Subject: Individual settings for every user Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Stefan Hanauska wrote: > Hi, > > is it possible for every user to have individual settings for > MailScanner? > > I want to let the user choose whether there is spam and/or virus > checking and what to do with the scanned mails. It *is* possible, but you would need to do quite a bit of work to make it work *exactly* the way you want. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Tue Dec 28 13:40:50 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Blacknight Solutions) Date: Thu Jan 12 21:28:02 2006 Subject: Rules Du Jour Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Sanjay K. Patel wrote: > I have installed RDJ but keep getting this error. > > /usr/bin/spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint > failed. Read the error message. If it fails it does so for a reason. Fix the problem and it will stop failing Michele ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sanjay.patel at REXWIRE.COM Tue Dec 28 14:13:18 2004 From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel) Date: Thu Jan 12 21:28:02 2006 Subject: Rules Du Jour Message-ID: This is the error I get after running spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint 2>&1 | more config: SpamAssassin failed to parse line, skipping: detailed_phrase_score 1 But I cant find any reference to detailed_phrase in spam.assasin.conf Where is it finding this line? Thanks for all the help. -SKP -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steve Swaney Sent: Tuesday, December 28, 2004 8:49 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Rules Du Jour > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Sanjay K. Patel > Sent: Tuesday, December 28, 2004 8:32 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Rules Du Jour > > I have installed RDJ but keep getting this error. > > /usr/bin/spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf > --lint failed. > > Than it rolls back all the changes. > > Has anyone else seen this? > You have a SpamAssassin configuration problem. Manually run: spamassassin -p /etc/MailScanner/spam.assassin.prefs.conf --lint 2>&1 | more And look for errors. Correct these errors and Rules Du Jour should work. Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com -- This message has been scanned for viruses and dangerous content by The MailScanner at Fortress Systems Ltd., www.fsl.com, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Tue Dec 28 14:33:51 2004 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:28:02 2006 Subject: Configuring MailScanner and Majordomo Message-ID: I've used aliases and such with sendmail and MailScanner, and never had problems. Why would MailScanner not see traffic to aliases? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Michael H. Martel Sent: Tuesday, December 28, 2004 5:38 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Configuring MailScanner and Majordomo Hello! I'm trying to migrate my Majordomo lists over to my new mail sevrer. They work wonderfully. However, because of how they're implemented (sendmail aliases) MailScanner never sees the traffic to the lists and therefore can't sanitize it. Has anyone managed to setup MailScanner and Majordomo so that MailScanner can scan the lists ? Thanks! Michael -- --------------------------------o--------------------------------- Michael H. Martel | Vermont State Colleges martelm@quark.vsc.edu | Systems Administrator http://probe.vsc.edu/~michael | PH:802-241-2544 FX:802-241-3363 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 14:36:43 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Configuring MailScanner and Majordomo Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Michael H. Martel wrote: > Hello! > > I'm trying to migrate my Majordomo lists over to my new mail sevrer. > They > work wonderfully. However, because of how they're implemented (sendmail > aliases) MailScanner never sees the traffic to the lists and therefore > can't sanitize it. > > Has anyone managed to setup MailScanner and Majordomo so that MailScanner > can scan the lists ? > You just need to upgrade to a vaguely recent version of sendmail that has the clientmqueue directory, and then MailScanner will see messages created by invoking the sendmail binary. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 14:37:41 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Individual settings for every user Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please read about rulesets in the MAQ (address at the bottom of every posting), the FAQ (on www.mailscanner.info) or in the book. Stefan Hanauska wrote: >Hi, > >is it possible for every user to have individual settings for >MailScanner? > >I want to let the user choose whether there is spam and/or virus >checking and what to do with the scanned mails. > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Tue Dec 28 14:30:26 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Blacknight Solutions) Date: Thu Jan 12 21:28:02 2006 Subject: Rules Du Jour Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Sanjay K. Patel wrote: > This is the error I get after running spamassassin -p > /etc/MailScanner/spam.assassin.prefs.conf --lint 2>&1 | more > > config: SpamAssassin failed to parse line, skipping: detailed_phrase_score 1 > > But I cant find any reference to detailed_phrase in spam.assasin.conf > > Where is it finding this line? > Thanks for all the help. Try grepping for the line in /etc/mail/spamassassin and /usr/share/spamassassin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martelm at QUARK.VSC.EDU Tue Dec 28 14:45:19 2004 From: martelm at QUARK.VSC.EDU (Michael H. Martel) Date: Thu Jan 12 21:28:02 2006 Subject: Configuring MailScanner and Majordomo Message-ID: --On Tuesday, December 28, 2004 2:36 PM +0000 Julian Field wrote: > You just need to upgrade to a vaguely recent version of sendmail that > has the clientmqueue directory, and then MailScanner will see messages > created by invoking the sendmail binary. Yes, yes, that was it. Many thanks. Michael -- --------------------------------o--------------------------------- Michael H. Martel | Systems Administrator martelm@quark.vsc.edu | Vermont State Colleges http://probe.vsc.edu/~michael | PH:802-241-2544 FX:802-241-3363 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chris at scorpion.nl Tue Dec 28 14:44:44 2004 From: chris at scorpion.nl (Christiaan den Besten) Date: Thu Jan 12 21:28:02 2006 Subject: Duplicate Messages after releasing from quarantaine. Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi ! Some questions about releasing messages from quarantaine. After releasing a message from quarantaine by copying these files to our outgoing-queue dir, these get delivery's pretty wel. But (there's always a but .. eh) one of our storage-servers has cyrus duplicate message suppression enabled. As you might guess: the releases message gets dumped because the server thinks its a duplicate.... So, at first I though, ok, let's first change the message id of the message to be released from quarantaine. But then I figured, this is not nice ... if a message is PGP signed or anything, it will break. On the otherhand, the 'cleaned' message with is send through (not containing the filtered attachments) is munged already, so any signing on these messages is already broken. It would make more sence to change the message id of that message. Final question therefore Julian: Would it be possible to generate a new (unique) message id and replace the existing one with this one in 'filtered', cleaned by MailScanner messages. bye, Chris ( Or am I completely on the wrong track on why our duplicate message suppression is kicking in .... ) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at PUREMESSAGE.CO.UK Tue Dec 28 16:31:51 2004 From: john at PUREMESSAGE.CO.UK (John Lee) Date: Thu Jan 12 21:28:02 2006 Subject: Norman (nvcc) does not scan Message-ID: On Thu, 23 Dec 2004 22:34:00 +0000, Martin Wozenilek wrote: >Hi! > >I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate the norman >scanner in the config file the eicar testfile is detectet by all my virus >scanners, but not by nvcc. The wrapper works perfect .... mmmh .... > >Any ideas? Thanks! > >Martin > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! Hi Martin, I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0 on Fedora Core2 and again NVCC fails to be called from the norman-wrapper. My other scanners F-prot,Bitdefender...all pick-up the Eicar test -yet no sign of Norman scanner being called when examing the sys (mail)/norman logs. Both NVCC and norman-wrapper work fine from the command shell. I've created a new norman-wrapper to simply write some text to a file - no joy,so I'm guessing it is an issue with mailscanner itself. I'll keep investigating. Regards John ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vlad at MAZEK.COM Tue Dec 28 17:15:18 2004 From: vlad at MAZEK.COM (Vlad Mazek) Date: Thu Jan 12 21:28:02 2006 Subject: store function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, Can someone explain the "store" ruleset to me? Where exactly does the message get stored, how is it stored, how can it get retrieved, etc. I've seen the comments in the config file but I'm not sure exactly sure just how things are stored, searched, etc. Is there any third party software for the store management? -Vlad P.S. We're currently doing this on the back-end Exchange servers but some folks don't stuff touching their servers at all. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHTSOLUTIONS.COM Tue Dec 28 17:51:29 2004 From: michele at BLACKNIGHTSOLUTIONS.COM (Blacknight Solutions) Date: Thu Jan 12 21:28:02 2006 Subject: store function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Vlad Mazek wrote: > Hello, > > Can someone explain the "store" ruleset to me? Where exactly does the > message get stored, how is it stored, how can it get retrieved, etc. > I've seen the comments in the config file but I'm not sure exactly sure > just how things are stored, searched, etc. Is there any third party > software for the store management? Stored mail usually lives in /var/spool/MailScanner/quarantine There's a sub-directory for each day with sub-directories for spam and viruses (and other nasties) With regard to managing quarantines have a look at the FAQ, MAQ and the mail list archive Michele ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vlad at MAZEK.COM Tue Dec 28 18:06:34 2004 From: vlad at MAZEK.COM (Vlad Mazek) Date: Thu Jan 12 21:28:02 2006 Subject: store function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Is there any way to create a new directory for each user or email address or as a part of a ruleset? Or am I stuck with just one quarentine directory? -Vlad > > Stored mail usually lives in /var/spool/MailScanner/quarantine > There's a sub-directory for each day with sub-directories for spam and > viruses (and other nasties) > > With regard to managing quarantines have a look at the FAQ, MAQ and the > mail list archive > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 18:10:34 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: store function Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Vlad Mazek wrote: > Is there any way to create a new directory for each user or email > address or as a part of a ruleset? Or am I stuck with just one > quarentine directory? > > -Vlad > >> Stored mail usually lives in /var/spool/MailScanner/quarantine >> There's a sub-directory for each day with sub-directories for spam and >> viruses (and other nasties) >> >> With regard to managing quarantines have a look at the FAQ, MAQ and the >> mail list archive >> You can do this with a simple Custom Function plugin. Take a look in CustomConfig.pm. Warning: you will need to know some Perl unless you want to pay someone to write it for you. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mail at wozenilek.de Tue Dec 28 18:13:22 2004 From: mail at wozenilek.de (Martin Wozenilek) Date: Thu Jan 12 21:28:02 2006 Subject: Norman (nvcc) does not scan Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes, exactly the same on my site ... I'm not a programmer ... but maybe I can find something in the perl code. Does anyone else have this problem? Maybe this is FedoraCore2 specific? Regards, -- Martin Wozenilek Am Langberg 91a 21033 Hamburg mailto: ----- Originalnachricht ----- Betreff: Re: Norman (nvcc) does not scan Von:  John Lee An:  Datum: 28-12-2004 17:42 On Thu, 23 Dec 2004 22:34:00 +0000, Martin Wozenilek wrote: >Hi! > >I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate the norman >scanner in the config file the eicar testfile is detectet by all my virus >scanners, but not by nvcc. The wrapper works perfect .... mmmh .... > >Any ideas? Thanks! > >Martin > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Sup port MailScanner development - buy the book off the website! Hi Martin, I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0 on Fedora Core2 and again NVCC fails to be called from the norman-wrapper. My other scanners F-prot,Bitdefender...all pick-up the Eicar test -yet no sign of Norman scanner being called when examing the sys (mail)/norman logs. Both NVCC and norman-wrapper work fine from the command shell. I've created a new norman-wrapper to simply write some text to a file - no joy,so I'm guessing it is an issue with mailscanner itself. I'll keep investigating. Regards John ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 18:26:52 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Norman (nvcc) does not scan Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What does cd /tmp /usr/lib/MailScanner/norman-wrapper /usr/sbin -c -sb:1 -s -u . produce? (Don't forget the '.' on the end of the command) Martin Wozenilek wrote: > Yes, exactly the same on my site ... I'm not a programmer ... but > maybe I can find something in the perl code. > Does anyone else have this problem? Maybe this is FedoraCore2 specific? > > Regards, > > -- > Martin Wozenilek > Am Langberg 91a > 21033 Hamburg > mailto: mail@wozenilek.de > PGP-Key-ID: 0x00105C52 > > > ----- Originalnachricht ----- > *Betreff: *Re: Norman (nvcc) does not scan > *Von: *John Lee > *An: * > *Datum: *28-12-2004 17:42 > > > On Thu, 23 Dec 2004 22:34:00 +0000, Martin Wozenilek > wrote: > > >Hi! > > > >I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate > the norman > >scanner in the config file the eicar testfile is detectet by all > my virus > >scanners, but not by nvcc. The wrapper works perfect .... mmmh .... > > > >Any ideas? Thanks! > > > >Martin > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Sup port MailScanner development - buy the book off the website! > > Hi Martin, > > I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0 on Fedora Core2 > and again > NVCC fails to be called from the norman-wrapper. > My other scanners F-prot,Bitdefender...all pick-up the Eicar test > -yet no > sign of Norman scanner being called when examing the sys > (mail)/norman logs. > > Both NVCC and norman-wrapper work fine from the command shell. > > I've created a new norman-wrapper to simply write some text to a > file - no > joy,so I'm guessing it is an issue with mailscanner itself. > > I'll keep investigating. > > Regards > > John > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mail at wozenilek.de Tue Dec 28 18:34:13 2004 From: mail at wozenilek.de (Martin Wozenilek) Date: Thu Jan 12 21:28:02 2006 Subject: Norman (nvcc) does not scan Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On my system nvcc is in /usr/bin. So I've changed your example. Now to your question: the command line gives no output. The norman log is not created ... -- Martin Wozenilek Am Langberg 91a 21033 Hamburg mailto: ----- Originalnachricht ----- Betreff: Re: Norman (nvcc) does not scan Von:  Julian Field An:  Datum: 28-12-2004 19:27 What does cd /tmp /usr/lib/MailScanner/norman-wrapper /usr/sbin -c -sb: 1 -s -u . produce? (Don't forget the '.' on the end of the command) Martin Wozenilek wrote: > Yes, exactly the same on my site ... I'm not a programmer ... but > maybe I can find something in the perl code. > Does anyone else have this problem? Maybe this is FedoraCore2 specific? > > Regards, > > -- > Martin Wozenilek > Am Langberg 91a > 21033 Hamburg > mailto: mail@wozenilek.de > PGP-Key-ID: 0x00105C52 > > > ----- Originalnachricht ----- > *Betreff: *Re: Norman (nvcc) does not scan > *Von: *John Lee > *An: * > *Datum: *28-12-2004 17:42 > > > On Thu, 23 Dec 2004 22:34:00 +0000, Martin Wozenilek > wrote: > > >Hi! > > > >I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate > the norman > >scanner in the config file the eicar testfile is detectet by all > my virus > >scanners, but not by nvcc. The wrapper works perfect .... mmmh .... > > > >Any ideas? Thanks! > > > >Martin > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Sup port MailScanner development - buy the book off the website! > > Hi Martin, > > I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0 on Fedora Core2 > and again > NVCC fails to be called from the norman-wrapper. > My other scanners F-prot,Bitdefender...all pick-up the Eicar test > -yet no > sign of Norman scanner being called when examing the sys > (mail)/norman logs. > > Both NVCC and norman-wrapper work fine from the command shell. > > I've created a new norman-wrapper to simply write some text to a > file - no > jo y,so I'm guessing it is an issue with mailscanner itself. > > I'll keep investigating. > > Regards > > John > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.aac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 18:38:39 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Norman (nvcc) does not scan Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What happens when you do /usr/bin/nvcc -c -sb: 1 -s -u . Martin Wozenilek wrote: > On my system nvcc is in /usr/bin. So I've changed your example. Now to > your question: the command line gives no output. The norman log is not > created ... > > -- > Martin Wozenilek > Am Langberg 91a > 21033 Hamburg > mailto: mail@wozenilek.de > PGP-Key-ID: 0x00105C52 > > > ----- Originalnachricht ----- > *Betreff: *Re: Norman (nvcc) does not scan > *Von: *Julian Field > *An: * > *Datum: *28-12-2004 19:27 > > > What does > cd /tmp > /usr/lib/MailScanner/norman-wrapper /usr/sbin -c -sb: 1 -s -u . > produce? (Don't forget the '.' on the end of the command) > > > Martin Wozenilek wrote: > > > Yes, exactly the same on my site ... I'm not a programmer ... but > > maybe I can find something in the perl code. > > Does anyone else have this problem? Maybe this is FedoraCore2 > specific? > > > > Regards, > > > > -- > > Martin Wozenilek > > Am Langberg 91a > > 21033 Hamburg > > mailto: mail@wozenilek.de > > > PGP-Key-ID: 0x00105C52 > > > > > > ----- Originalnachricht ----- > > *Betreff: *Re: Norman (nvcc) does not scan > > *Von: *John Lee > > *An: * > > *Datum: *28-12-2004 17:42 > > > > > > On Thu, 23 Dec 2004 22:34:00 +0000, Martin Wozenilek > > wrote: > > > > >Hi! > > > > > >I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate > > the norman > > >scanner in the config file the eicar testfile is detectet by all > > my virus > > >scanners, but not by nvcc. The wrapper works perfect .... mmmh .... > > > > > >Any ideas? Thanks! > > > > > >Martin > > > > > >------------------------ MailScanner list ------------------------ > > >To unsubscribe, email jiscmail@jiscmail.ac.uk > > with the words: > > >'leave mailscanner' in the body of the email. > > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > >Sup port MailScanner development - buy the book off the website! > > > > Hi Martin, > > > > I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0 on Fedora Core2 > > and again > > NVCC fails to be called from the norman-wrapper. > > My other scanners F-prot,Bitdefender...all pick-up the Eicar test > > -yet no > > sign of Norman scanner being called when examing the sys > > (mail)/norman logs. > > > > Both NVCC and norman-wrapper work fine from the command shell. > > > > I've created a new norman-wrapper to simply write some text to a > > file - no > > jo y,so I'm guessing it is an issue with mailscanner itself. > > > > I'll keep investigating. > > > > Regards > > > > John > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk > > > with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmmail.ac.uk > with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > *Support MailScanner development - buy the book off the website!* > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.aac.uk > with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 18:42:31 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Norman (nvcc) does not scan Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] By the way, run it from a directory with a virus in it. Otherwise it might produce no output at all. Julian Field wrote: > What happens when you do > /usr/bin/nvcc -c -sb: 1 -s -u . > > Martin Wozenilek wrote: > >> On my system nvcc is in /usr/bin. So I've changed your example. Now to >> your question: the command line gives no output. The norman log is not >> created ... >> >> ----- Originalnachricht ----- >> *Betreff: *Re: Norman (nvcc) does not scan >> *Von: *Julian Field >> *An: * >> *Datum: *28-12-2004 19:27 >> >> >> What does >> cd /tmp >> /usr/lib/MailScanner/norman-wrapper /usr/sbin -c -sb: 1 -s -u . >> produce? (Don't forget the '.' on the end of the command) >> >> >> Martin Wozenilek wrote: >> >> > Yes, exactly the same on my site ... I'm not a programmer ... but >> > maybe I can find something in the perl code. >> > Does anyone else have this problem? Maybe this is FedoraCore2 >> specific? >> > >> > Regards, >> > >> > -- >> > Martin Wozenilek >> > Am Langberg 91a >> > 21033 Hamburg >> > mailto: mail@wozenilek.de >> >> > PGP-Key-ID: 0x00105C52 >> > >> > >> > ----- Originalnachricht ----- >> > *Betreff: *Re: Norman (nvcc) does not scan >> > *Von: *John Lee >> > *An: * >> > *Datum: *28-12-2004 17:42 >> > >> > >> > On Thu, 23 Dec 2004 22:34:00 +0000, Martin Wozenilek >> > wrote: >> > >> > >Hi! >> > > >> > >I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate >> > the norman >> > >scanner in the config file the eicar testfile is detectet by all >> > my virus >> > >scanners, but not by nvcc. The wrapper works perfect .... mmmh >> .... >> > > >> > >Any ideas? Thanks! >> > > >> > >Martin >> > > >> > >------------------------ MailScanner list >> ------------------------ >> > >To unsubscribe, email jiscmail@jiscmail.ac.uk >> > with the words: >> > >'leave mailscanner' in the body of the email. >> > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >> and >> > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> > > >> > >Sup port MailScanner development - buy the book off the website! >> > >> > Hi Martin, >> > >> > I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0 on Fedora Core2 >> > and again >> > NVCC fails to be called from the norman-wrapper. >> > My other scanners F-prot,Bitdefender...all pick-up the Eicar test >> > -yet no >> > sign of Norman scanner being called when examing the sys >> > (mail)/norman logs. >> > >> > Both NVCC and norman-wrapper work fine from the command shell. >> > >> > I've created a new norman-wrapper to simply write some text to a >> > file - no >> > jo y,so I'm guessing it is an issue with mailscanner itself. >> > >> > I'll keep investigating. >> > >> > Regards >> > >> > John > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jharnish at CI.GRAND-RAPIDS.MI.US Tue Dec 28 18:49:46 2004 From: jharnish at CI.GRAND-RAPIDS.MI.US (Harnish, Joe) Date: Thu Jan 12 21:28:02 2006 Subject: Mailserver replacement of exchange Message-ID: I have found a product called Scalix (www.scalix.com) It is not free but it is very reasonable in cost and it is a drop in replacement for exchange. It runs on Linux using sendmail as it's base. Joe -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Koen Teugels Sent: Saturday, December 18, 2004 5:13 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Mailserver replacement of exchange Does anyone has a good alternative for MS exchange (groupware) in the opensource world? If it is possible an outlook client must be able to connect to it. thanks Koen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ccampbell at BRUEGGERS.COM Tue Dec 28 19:03:31 2004 From: ccampbell at BRUEGGERS.COM (Christian Campbell) Date: Thu Jan 12 21:28:02 2006 Subject: Bayes ate my disk space... Message-ID: I recently turned on bayes auto-learning and have just recently run out of space on my / volume. I've tracked it down to the /root/.spamassassin directory. It seems there are a bunch of files called bayes_toks.expireNNNN (where NNNN is a number). First question...do these files need to be there for bayes to continue operating? I'm not familiar with these files, and have limited SA experience. Second question.... Can these be moved somewhere else? If so, how to I reconfigure SA to make this change? Third question... Is there any place to establish a limit as to how much space these files take up or a way to purge old info? Thanks, Christian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mail at wozenilek.de Tue Dec 28 19:15:14 2004 From: mail at wozenilek.de (Martin Wozenilek) Date: Thu Jan 12 21:28:02 2006 Subject: Fwd: Re: Re: Norman (nvcc) does not scan Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Betreff: Re: Re: Norman (nvcc) does not scan Von:  Martin Wozenilek An: Julian Field Datum: 28-12-2004 20:12 Arrgh ... sorry ... i've played with the wrapper and inserted options to be quiet and not log anything. When i change this the wrapper gives me (invoked with /usr/lib/MailScanner/norman-wrapper /usr/bin -c -sb:1 -s -u .): ----------------------------------------------- Norman Virus Control Version 5.70.01 Jun 15 2004 10:37:11 Copyrightt (c) 1993-2003 Norman ASA NSE revision 5.70.26 nvcbin.def revision 5.70 of 2004/12/23 (60256 variants) nvcmacro.def revision 5.70 of 2004/12/22 (10060 variants) Total number of variants: 70316 Logging to '/opt/norman/logs/nvc00004.log' Possible virus in './eicar.com' -> 'EICAR_Test_file_not_a_virus!' Possible virus in '/root/./eicar_com.zip : eicar.com' -> 'EICAR_Test_file_not_a_virus!' Possible virus in '/root/./eicarcom2.zip : eicar_com.zip : eicar.com' -> 'EICAR_Test_file_not_a_virus!' | ./.cpan/sources/authors/id/S/SA/SAMPO/ * Cannot open: /root/./.cpan/sources/authors/id/S/SA/SAMPO/Net_SSLeay.pm-1.25.tar.gz : Net_SSLeay.pm-1.25 .tar : Net_SSLeay.pm-1.25/RECIPE.Win32 No message 3 possible infections found. 14 archives unpacked, 346 files found. 346 files, 8185 kbytes scanned. Could not open 1 archives. Total scanning time: 0 min. 39 secs. 209 kbytes per second. ----------------------------------------------- So, the wrapper works ... When I check with a eicar-filee the maillog tells me: ----------------------------------------------- Dec 28 20:09:30 mailgw01 MailScanner[12263]: Message 6BC222FA1A from 193.99.144.71 (emailcheck-robot@ct.heise.de) to wozenilek.de is not spam, SpamAssassin (score=-4.9, required 5, autolearn=not spam, BAYES_00 -4.90) Dec 28 20:09:31 mailgw01 MailScanner[12263]: Virus and Content Scanning: Starting Dec 28 20:09:33 mailgw01 MailScanner[12263]: /var/spool/MailScanner/incoming/12263/./6BC222FA1A/eicar.com: Eicar-Test-Signature FOUND Dec 28 20:09:33 mailgw01 MailScanner[12263]: Virus Scanning: ClamAV found 1 infections Dec 28 20:09:36 mailgw01 MailScanner[12263]: /6BC222FA1A/eicar.com Found: EICAR test file NOT a virus. Dec 28 20:09:36 mailgw01 MailScanner[12263]: Virus Scanning: McAfee found 1 infections Dec 28 20:09:37 mailgw01 MailScanner[12263]: ALERT: [Eicar-Test-Signature virus] ./6BC222FA1A/eicar.com <<< Contains code of the Eicar-Test-Signature virus Dec 28 20:09:37 mailgw01 MailScanner[12263]: Virus Scanning: AntiVir found 1 infections Dec 28 20:09:37 mailgw01 MailScanner[12263]: /var/spool/MailScanner/incoming/12263/6BC222FA1A/eicar.com Infection: EICAR_Test_File Dec 28 20:09:37 mailgw01 MailScanner[12263]: Virus Scanning: F-Prot found virus EICAR_Test_File Dec 28 20:09:37 mailgw01 MailScanner[12263]: Virus Scanning: F-Prot found 1 infections Dec 28 20:09:39 mailgw01 MailScanner[12263]: /var/spool/MailScanner/incoming/12263/./6BC222FA1A/eicar.com^Iinfected: EICAR-Test-File (not a virus) Dec 28 20:09:39 mailgw01 MailScanner[12263]: Virus Scanning: Bitdefender found 1 infections Dec 28 20:09:43 mailgw01 MailScanner[12263]: Scan started at Tue 28 Dec 2004 08:09:43 PM CET Dec 28 20:09:43 mailgw01 MailScanner[12263]: Database version: 2004-12-28_02 Dec 28 20:09:44 mailgw01 MailScanner[12263]: ./6BC222FA1A/eicar.com: Infected: EICAR_Test_File [Libra] Dec 28 20:09:44 mailgw01 MailScanner[12263]: Virus Scanning: F-Secure found virus EICAR_Test_File Dec 28 20:09:44 mailgw01 MailScanner[12263]: ./6BC222FA1A/eicar.com: Infected: EICAR Test File [Orion] Dec 28 20:09:44 mailgw01 MailScanner[12263]: Virus Scanning: F-Secure found virus EICAR Test File Dec 28 20:09:44 mailgw01 MailScanner[12263]: ./6BC222FA1A/eicar.com: Infected: EICAR-Test-File [AVP] Dec 28 20:09:44 mailgw01 MailScanner[12263]: Virus Scanning: F-Secure found virus EICAR-Test-File Dec 28 20:09:44 mailgw01 MailScanner[12263]: Scan ended at Tue 28 Dec 2004 08:09:43 PM CET Dec 28 20:09:44 mailgw01 MailScanner[12263]: 3 files scanned Dec 28 20:09:44 mailgw01 MailScanner[12263]: 1 file infected Dec 28 20:09:44 mailgw01 MailScanner[12263]: Virus Scanning: F-Secure found 1 infections Dec 28 20:09:44 mailgw01 MailScanner[12263]: Infected message 6BC222FA1A came from 193.99.144.71 Dec 28 20:09:44 mailgw01 MailScanner[12263]: Virus Scanning: Found 1 viruses Dec 28 20:09:44 mailgw01 MailScanner[12263]: Filename Checks: Windows/DOS Executable (6BC222FA1A eicar.com) Dec 28 20:09:44 mailgw01 MailScanner[12263]: Other Checks: Found 1 problems ----------------------------------------------- And there is a NormanBusy.lock in /tmp. But no log under /opt/normaan/logs/. Maybe MailScanner does not handle the nvcc return code? -- Martin Wozenilek Am Langberg 91a 21033 Hamburg mailto: mail@wozenilek.de PGP-Key-ID: 0x00105C52 ----- Originalnachricht ----- Betreff: Re: Norman (nvcc) does not scan Von: Julian Field An: Martin Wozenilek<mail@wozenilek.de>;MailScanner mailing list<MAILSCANNER@JISCMAIL.AC.UK> Datum: 28-12-2004 19:39 > What happens when you do > /usr/bin/nvcc -c -sb: 1 -s -u . > > Martin Wozenilek wrote: > > > On my system nvcc is in /usr/bin. So I've changed your example. Now to > > your question: the command line gives n o output. The norman log is not > > created ... > > > > -- > > Martin Wozenilek > > Am Langberg 91a > > 21033 Hamburg > > mailto: mail@wozenilek.de > > PGP-Key-ID: 0x00105C52 > > > > > > ----- Originalnachricht ----- > > *Betreff: *Re: Norman (nvcc) does not scan > > *Von: *Julian Field > > *An: * > > *Datum: *28-12-2004 19:27 > > > > > > What does > > cd /tmp > > /usr/lib/MailScanner/norman-wrapper /usr/sbin -c -sb: 1 -s -u . > > produce? (Don't forget the '.' on the end of the command) > > > > > > Martin Wozenilek wrote:> > > > > Yes, exactly the same on my site ... I'm not a programmer ... but > > > maybe I can find something in the perl code. > > > Does anyone else have this problem? Maybe this is FedoraCore2 > > specific? > > > > > > Regards, > > > > > > -- > > > Martin Wozenilek > > > Am Langberg 91a > > > 21033 Hamburg > > > mailto: mail@wozenilek.de > > > > > PGP-Key-ID: 0x00105C52 > > > > > > > > > ----- Originalnachricht ----- > > > *Betreff: *Re: Norman (nvcc) does not scan > > > *Von: *John Lee > > > *An: * > > > *Datum: *28-12-2004 17:42 > > > > > > > > > On Thu, 23 Dec 2004 22:34:00 +0000, Martin Wozenilek > > > wrote: > > > > > > >Hi! > > > > > > > >I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0. When i avtivate > > > the norman > > > >scanner in the config file the eicar testfile is detectet by all > > > my virus > > > >scanners, but not by nvcc. The wrapper works perfect .... mmmh .... > > > > > > > >Any ideas? Thanks! > > > > > > > >Martin > > > > > > > >------------------------ MailScanner list ------------------------ > > > >To unsubscribe, email jiscmail@jiscmail.ac.uk > > > with the words: > > > >'leave mailscanner' in the body of the email. > > > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > >Sup port MailScanner development - buy the book off the website! > > > > > > Hi Martin, > > > > > > I'm using mailscanner-4.36.4-1 and nvc-5.70.04-0 on Fedora Core2 > > > and again > > > NVCC fails to be called from the norman-wrapper. > > > My other scanners F-prot,Bitdefender...all pick-up the Eicar test > > > -yet no > > > sign of Norman scanner being called when examing the sys > > > (mail)/norman logs. > > > > > > Both NVCC and norman-wrapper work fine from the command shell. > > > > > > I've created a new norman-wrapper to simply write some text to a > > > file - no > > > jo y,so I'm guessing it is an issue with mailscanner itself. > > > > > > I'll keep investigating. > > > > > > Regards > > > > > > John > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk > > > > > with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmmail.ac.uk > > with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > *Support MailScanner development - buy the book off the website!* > > > > > > -- > > Julian Field > > www.MailScanner.info > > Buy the MailScanner book at www..MailScanner.info/store > > Professional Support Services at www.MailScanner.biz > > MailScanner thanks trans tec Computers for their support > > > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.aac.uk > > with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScann er list ------------------------ > > To unsubscribe, email jiscmail@@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > *Support MailScanner development - buy the book off the website!* > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 19:29:00 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Bayes ate my disk space... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Christian Campbell wrote: > I recently turned on bayes auto-learning and have just recently run > out of space on my / volume. > > I've tracked it down to the /root/.spamassassin directory. It seems > there are a bunch of files called bayes_toks.expireNNNN (where NNNN is > a number). > > First question...do these files need to be there for bayes to continue > operating? I'm not familiar with these files, and have limited SA > experience. You can safely delete all the expireNNNN files. > Second question.... Can these be moved somewhere else? If so, how to > I reconfigure SA to make this change? You should be able to make the .spamassassin directory a soft-link to somewhere with more space. > Third question... Is there any place to establish a limit as to how > much space these files take up or a way to purge old info? They are created by MailScanner timing out while waiting for SpamAssassin to do its bayes auto expiry. When MailScanner times out, these temporary files get left behind. You have a few options, among them being a) Increase the SpamAssassin timeout time in MailScanner.conf, so that SA gets time to do its own bayes auto expiry. b) Switch off the auto-expiry (set "bayes_auto_expire 0" in spam.assassin.prefs.conf). Then switch on MailScanner's regular bayes expiry runs (set "Rebuild Bayes Every = 86400" in MailScanner.conf). That way MailScanner gets to control the expiry process, and runs it once a day (up to once every 28 hours in fact, but don't worry about the details). If you want MailScanner to continue processing mail while the Bayes db is being rebuilt, but just ignoring the bayes result until the rebuild has finished, set "Wait During Bayes Rebuild = no" in MailScanner.conf. Quite a lot of people actually prefer option (a). I prefer option (b) myself, which is why I wrote it :-) Can someone add this to the FAQ please? This has to be the 50th time this has been explained (no insult intended, the mail archive is not easy to search well for random things like this). > > Thanks, > > Christian > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cpicciotto at KALISYSTEMS.COM Tue Dec 28 19:36:33 2004 From: cpicciotto at KALISYSTEMS.COM (Chris Picciotto) Date: Thu Jan 12 21:28:02 2006 Subject: Mailserver replacement of exchange Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] RE: Mailserver replacement of exchangeInteresting.... Specs say it is based on HP Openmail. So not sure it's sendmail based and configurable. Given above - would MailScanner integrate (vaguely nicely) with this setup? Looks like a well reviewed and highly rated product however. Chris ----- Original Message ----- From: Harnish, Joe To: MAILSCANNER@JISCMAIL.AC.UK Sent: Tuesday, December 28, 2004 8:49 AM Subject: Re: Mailserver replacement of exchange I have found a product called Scalix (www.scalix.com) It is not free but it is very reasonable in cost and it is a drop in replacement for exchange. It runs on Linux using sendmail as it's base. Joe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 19:56:48 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Mailserver replacement of exchange Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You could set up a MailScanner server in front of it just like any other unsupported mail server. Chris Picciotto wrote: > RE: Mailserver replacement of exchangeInteresting.... > > Specs say it is based on HP Openmail. So not sure it's sendmail based and > configurable. > > Given above - would MailScanner integrate (vaguely nicely) with this > setup? > Looks like a well reviewed and highly rated product however. > > Chris > > ----- Original Message ----- > From: Harnish, Joe > To: MAILSCANNER@JISCMAIL.AC.UK > Sent: Tuesday, December 28, 2004 8:49 AM > Subject: Re: Mailserver replacement of exchange > > > I have found a product called Scalix (www.scalix.com) It is not free > but it > is very reasonable in cost and it is a drop in replacement for > exchange. It > runs on Linux using sendmail as it's base. > Joe > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pverhagen at sapl.ab.ca Tue Dec 28 19:53:09 2004 From: pverhagen at sapl.ab.ca (Peter Verhagen) Date: Thu Jan 12 21:28:02 2006 Subject: MailScanner/Spamassassin/ClamAV + RelayDB (OpenBSD) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] After some tweaking I've got MailScanner successfully setup on OpenBSD with SpamAssassin and ClamAV. Now I would like to add some of OpenBSD's own anti-spam techniques to compliment MailScanner, so I was hoping someone could point out to me a method to "plug in" relaydb after mailscanner uses spamassassin to classify whether or not that the message is spam. Much like this example procmail filter does in http://www.benzedrine.cx/relaydb.8.txt :0fw | /usr/local/bin/spamc :0c * ^X-Spam-Status: Yes | /usr/local/bin/relaydb -b :0: * ^X-Spam-Status: Yes in-x-spam :0c | /usr/local/bin/relaydb -w This ( http://www.benzedrine.cx/relaydb.html ) page explains the scenario better than I could. The main goal here is to reduce the overall load on the mailserver. Many thanks in advance, Peter Verhagen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 20:02:37 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It's pretty generally agreed that the mailing list search facility provided by jiscmail is not much good. So I'm looking for alternatives. The only obvious solution that comes to mind is to use Hypermail to create a huge list archive, and then possibly use Google to provide the search facility. But I don't want to break up the archive into separate months as threads continue over month-boundaries. Alternatively I could create my own index using some other search software. I'm looking for recommendations and ideas for what would be best here! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jstevens at ATHENSDISTRIBUTING.COM Tue Dec 28 20:07:33 2004 From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens) Date: Thu Jan 12 21:28:02 2006 Subject: Mailserver replacement of exchange Message-ID: Ya know the only problem with Sendmail and IMAP is the scheduling of deleted items. I could never find/implemint a good mechanism for deleting users 'deleted items'. (I'm not the brightest person :-) Otherwise any IMAP client connected to Sendmail through IMAP works great. As everything would be local (Mailscanner,Sendmail etc..) you could publish a folder everyone put missed spam in and run salearn on that folder. ________________________________________________________________________________ From: Harnish, Joe [mailto:jharnish@CI.GRAND-RAPIDS.MI.US] Sent: Tuesday, December 28, 2004 12:50 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Mailserver replacement of exchange I have found a product called Scalix (www.scalix.com) It is not free but it is very reasonable in cost and it is a drop in replacement for exchange. It runs on Linux using sendmail as it's base. Joe -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Koen Teugels Sent: Saturday, December 18, 2004 5:13 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Mailserver replacement of exchange Does anyone has a good alternative for MS exchange (groupware) in the opensource world? If it is possible an outlook client must be able to connect to it. thanks Koen ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by Athens Hyperion Scanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by Athens Hyperion Scanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Dec 28 20:16:20 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:02 2006 Subject: Mailserver replacement of exchange Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] James R. Stevens wrote: Ya know the only problem with Sendmail and IMAP is the scheduling of deleted items. I could never find/implemint a good mechanism for deleting users 'deleted items'. (I'm not the brightest person :-) Not very Sendmail compatible but I use CourierIMAP which has an option to automatically delete messages of a certain age in certain folders (Such as Trash). This is the age in the folder not age of the mail item. Does shared folders for spam/ ham as well. Works very well but only for Maildirs... Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pverhagen at sapl.ab.ca Tue Dec 28 20:31:48 2004 From: pverhagen at sapl.ab.ca (Peter Verhagen) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You could look into keeping your existing list service and add the list marc.theaimsgroup.com.. http://marc.theaimsgroup.com/?q=about#Add about: http://marc.theaimsgroup.com/?q=about#What I've had good success with their interface. Peter Verhagen Julian Field wrote: > It's pretty generally agreed that the mailing list search facility > provided by jiscmail is not much good. > So I'm looking for alternatives. > > The only obvious solution that comes to mind is to use Hypermail to > create a huge list archive, and then possibly use Google to provide the > search facility. But I don't want to break up the archive into separate > months as threads continue over month-boundaries. Alternatively I could > create my own index using some other search software. > > I'm looking for recommendations and ideas for what would be best here! > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 20:56:46 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: MailScanner/Spamassassin/ClamAV + RelayDB (OpenBSD) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It appears from your description below that the relaydb fits in at delivery time. This is after MailScanner has done all its work, so you should be able to run the two at the same time, no problem. Peter Verhagen wrote: > After some tweaking I've got MailScanner successfully setup on OpenBSD > with SpamAssassin and ClamAV. Now I would like to add some of OpenBSD's > own anti-spam techniques to compliment MailScanner, so I was hoping > someone could point out to me a method to "plug in" relaydb after > mailscanner uses spamassassin to classify whether or not that the > message is spam. Much like this example procmail filter does in > http://www.benzedrine.cx/relaydb.8.txt > > :0fw > | /usr/local/bin/spamc > :0c > * ^X-Spam-Status: Yes > | /usr/local/bin/relaydb -b > :0: > * ^X-Spam-Status: Yes > in-x-spam > > :0c > | /usr/local/bin/relaydb -w > > This ( http://www.benzedrine.cx/relaydb.html ) page explains the > scenario better than I could. The main goal here is to reduce the > overall load on the mailserver. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pverhagen at sapl.ab.ca Tue Dec 28 21:09:59 2004 From: pverhagen at sapl.ab.ca (Peter Verhagen) Date: Thu Jan 12 21:28:02 2006 Subject: MailScanner/Spamassassin/ClamAV + RelayDB (OpenBSD) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yah I was kind of thinking that. Using the "local delivery agent?" (procmail) such to catch the re-written spam header by MailScanner. The real crutch being messages detected as spam I'd still have to deliver as opposed to silent deletion (spam message not ending up into the end user's mailbox). But, with the recent idea of shared folder dump (cool idea btw) where users can dump their spam into and automate sa-learn nightly, combined with the mail user agent filters makes a compelling case for it. Now to fight the powers at be to change from pop3 to imap. I just hope Dovecot is over it's indexing problem on OpenBSD. But with procmail able to deliver to maildir folders I'm going to see if switching to maildir makes a difference. Thanks a bunch, Peter Verhagen Julian Field wrote: > It appears from your description below that the relaydb fits in at > delivery time. This is after MailScanner has done all its work, so you > should be able to run the two at the same time, no problem. > > Peter Verhagen wrote: > >> After some tweaking I've got MailScanner successfully setup on OpenBSD >> with SpamAssassin and ClamAV. Now I would like to add some of OpenBSD's >> own anti-spam techniques to compliment MailScanner, so I was hoping >> someone could point out to me a method to "plug in" relaydb after >> mailscanner uses spamassassin to classify whether or not that the >> message is spam. Much like this example procmail filter does in >> http://www.benzedrine.cx/relaydb.8.txt >> >> :0fw >> | /usr/local/bin/spamc >> :0c >> * ^X-Spam-Status: Yes >> | /usr/local/bin/relaydb -b >> :0: >> * ^X-Spam-Status: Yes >> in-x-spam >> >> :0c >> | /usr/local/bin/relaydb -w >> >> This ( http://www.benzedrine.cx/relaydb.html ) page explains the >> scenario better than I could. The main goal here is to reduce the >> overall load on the mailserver. > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 21:31:05 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] From what I can see there, I would quite like to use their software but they make very clear that it is run in their spare time as and when they feel like it. I would rather use a rather more "maintained" system if possible. Also, how can I feed them the current list archive? I guess I just email them every message. Peter Verhagen wrote: > You could look into keeping your existing list service and add the list > marc.theaimsgroup.com.. > > http://marc.theaimsgroup.com/?q=about#Add > > about: http://marc.theaimsgroup.com/?q=about#What > > I've had good success with their interface. > > Peter Verhagen > > Julian Field wrote: > >> It's pretty generally agreed that the mailing list search facility >> provided by jiscmail is not much good. >> So I'm looking for alternatives. >> >> The only obvious solution that comes to mind is to use Hypermail to >> create a huge list archive, and then possibly use Google to provide the >> search facility. But I don't want to break up the archive into separate >> months as threads continue over month-boundaries. Alternatively I could >> create my own index using some other search software. >> >> I'm looking for recommendations and ideas for what would be best here! >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 21:42:08 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What does anyone think of Google Groups? Is it possible to use it like this without everyone on the mailing list also having to belong to googlegroups? Julian Field wrote: > From what I can see there, I would quite like to use their software but > they make very clear that it is run in their spare time as and when they > feel like it. I would rather use a rather more "maintained" system if > possible. > > Also, how can I feed them the current list archive? I guess I just email > them every message. > > Peter Verhagen wrote: > >> You could look into keeping your existing list service and add the list >> marc.theaimsgroup.com.. >> >> http://marc.theaimsgroup.com/?q=about#Add >> >> about: http://marc.theaimsgroup.com/?q=about#What >> >> I've had good success with their interface. >> >> Peter Verhagen >> >> Julian Field wrote: >> >>> It's pretty generally agreed that the mailing list search facility >>> provided by jiscmail is not much good. >>> So I'm looking for alternatives. >>> >>> The only obvious solution that comes to mind is to use Hypermail to >>> create a huge list archive, and then possibly use Google to provide the >>> search facility. But I don't want to break up the archive into separate >>> months as threads continue over month-boundaries. Alternatively I could >>> create my own index using some other search software. >>> >>> I'm looking for recommendations and ideas for what would be best here! >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Tue Dec 28 21:57:20 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: Julian Field wrote: > It's pretty generally agreed that the mailing list search facility > provided by jiscmail is not much good. > So I'm looking for alternatives. http://gmane.org http://gmane.org/info.php?group=gmane.mail.virus.mailscanner -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cpicciotto at KALISYSTEMS.COM Tue Dec 28 23:29:29 2004 From: cpicciotto at KALISYSTEMS.COM (Chris Picciotto) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] OK -- I'm sold. This is pretty good... The whole archive is there. It is NNTP so just opene up in newsreader. Chris ----- Original Message ----- From: "shrek-m@gmx.de" Newsgroups: gmane.mail.virus.mailscanner Sent: Tuesday, December 28, 2004 11:57 AM Subject: Re: Search for list archive -- ideas? > Julian Field wrote: > >> It's pretty generally agreed that the mailing list search facility >> provided by jiscmail is not much good. >> So I'm looking for alternatives. > > > http://gmane.org > http://gmane.org/info.php?group=gmane.mail.virus.mailscanner > > -- > shrek-m > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Tue Dec 28 22:16:19 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I can't get any output from the "Threaded HTTP" view of the MailScanner list at all. Sits there doing nothing for ages, then prints the helpful message: Error GMANE-03252: Something is wrong. Perhaps something didn't match a group name. Perhaps something else. shrek-m@gmx.de wrote: > Julian Field wrote: > >> It's pretty generally agreed that the mailing list search facility >> provided by jiscmail is not much good. >> So I'm looking for alternatives. > > > > http://gmane.org > http://gmane.org/info.php?group=gmane.mail.virus.mailscanner > > -- > shrek-m > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From newsgroup2 at SPACELINK.COM.AU Tue Dec 28 22:50:17 2004 From: newsgroup2 at SPACELINK.COM.AU (Stuart Clark) Date: Thu Jan 12 21:28:02 2006 Subject: Stop postmaster emails Message-ID: How do I stop Mailscanner sending me an email to postmaster whenever it discovers an infected/spam email? Kind Regards Stuart Clark Director Spacelink Communications Pty Ltd Ph. 98570800 Fx. 98597577 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jpabuyer at TECNOERA.COM Tue Dec 28 22:38:37 2004 From: jpabuyer at TECNOERA.COM (Juan Pablo Abuyeres) Date: Thu Jan 12 21:28:02 2006 Subject: Definitely Spam problem Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I'm running mailscanner-4.33.3-1 I have set up a rule for Is Definitely Spam, and action for spam is attachment. The problem is when I send an email, the mail dissapears. It never gets to the recipient, it doesn't bounce.. nothing. Dec 28 19:32:48 bonnie postfix/smtpd[31620]: connect from baltazar.tecnoera.com[200.24.224.1] Dec 28 19:32:48 bonnie postfix/smtpd[31620]: DBF1C194: client=baltazar.tecnoera.com[200.24.224.1] Dec 28 19:32:50 bonnie postfix/cleanup[31623]: DBF1C194: hold: header Received: from baltazar.tecnoera.com (baltazar.tecnoera.com [200.24.224.1])??by localhost (Postfix) with ESMTP id DBF1C194??for ; Tue, 28 Dec 2004 19:32:48 -0300 (CLST) from baltazar.tecnoera.com[200.24.224.1]; from= to= proto=ESMTP helo= Dec 28 19:32:50 bonnie postfix/cleanup[31623]: DBF1C194: hold: header Received: from blackbird.tecnoera.com (blackbird.tecnoera.com [200.24.224.8])??by baltazar.tecnoera.com (8.13.1/8.13.1) with ESMTP id iBSMTMPs001992??for ; Tue, 28 Dec 2004 19:29:22 from baltazar.tecnoera.com[200.24.224.1]; from= to= proto=ESMTP helo= Dec 28 19:32:50 bonnie postfix/cleanup[31623]: DBF1C194: message-id=<1104273045.2386.37.camel@blackbird.tecnoera.com> Dec 28 19:32:50 bonnie postfix/smtpd[31620]: disconnect from baltazar.tecnoera.com[200.24.224.1] Dec 28 19:32:53 bonnie MailScanner[31414]: New Batch: Scanning 1 messages, 1831 bytes Dec 28 19:32:53 bonnie MailScanner[31414]: Spam Checks: Starting Dec 28 19:32:53 bonnie MailScanner[31414]: Message DBF1C194 from 200.24.224.1 (jpabuyer@tecnoera.com) to wawi.nac.cl is spam (blacklisted) Dec 28 19:32:53 bonnie MailScanner[31414]: Spam Checks: Found 1 spam messages Dec 28 19:32:53 bonnie MailScanner[31414]: Spam Actions: message DBF1C194 actions are attachment Dec 28 19:32:53 bonnie MailScanner[31414]: Created attachment dirs for 0 messages Dec 28 19:32:53 bonnie MailScanner[31414]: Virus and Content Scanning: Starting Dec 28 19:32:53 bonnie MailScanner[31414]: Commencing scanning by f-secure... Stopping now as you are debugging me. Dec 28 19:32:59 bonnie MailScanner[31414]: Scan ended at Tue Dec 28 19:32:59 2004 Dec 28 19:32:59 bonnie MailScanner[31414]: 1 file scanned Dec 28 19:32:59 bonnie MailScanner[31414]: Completed scanning by f-secure Dec 28 19:32:59 bonnie MailScanner[31414]: MailScanner child dying of old age I checked the changelog, but I didn't notice any entry on this issue. Any ideas? Is it possible to set a special action for "Is Definitely Spam" matching mails? (for customers who want to receive spam, convert to attachment high scoring spam, and delete Definitely Spam). Thank you. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From matt at FILEHOLDER.NET Wed Dec 29 04:12:56 2004 From: matt at FILEHOLDER.NET (Matt) Date: Thu Jan 12 21:28:02 2006 Subject: Adding Custom Headers to SPAM Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I want to add a couple custom header lines to all messages found to be SPAM. I have tried doing it with: Spam Header = But it keeps wanting to add ",spam etc.." to end and I also need more then one line added. Any ideas? Matt ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cpicciotto at KALISYSTEMS.COM Tue Dec 28 23:31:45 2004 From: cpicciotto at KALISYSTEMS.COM (Chris Picciotto) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: I posted to the other mail-list - but will also do so here (got to experiment!) I like this. The entire archive is here, and is very easy within the news reader. Chris "shrek-m@gmx.de" wrote in message news:41D1D6C0.9070106@gmx.de... > Julian Field wrote: > >> It's pretty generally agreed that the mailing list search facility >> provided by jiscmail is not much good. >> So I'm looking for alternatives. > > > http://gmane.org > http://gmane.org/info.php?group=gmane.mail.virus.mailscanner > > -- > shrek-m > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Wed Dec 29 08:29:28 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I can't get any output from the "Threaded HTTP" view of the MailScanner > list at all. Sits there doing nothing for ages, then prints the helpful > message: > > Error GMANE-03252: Something is wrong. Perhaps something didn't match a > group name. Perhaps something else. oops, nntp is ok. try this links: http://gmane.org/lists.php (complete list) => http://news.gmane.org/ (web-interface) ==> http://news.gmane.org/search.php?match=mailscanner ===> http://news.gmane.org/gmane.mail.virus.mailscanner/cutoff=23213 you can contact Lars Magne Ingebrigtsen http://gmane.org/contact.php you can test gmane with other lists, eg. http://news.gmane.org/gmane.linux.redhat.general http://news.gmane.org/gmane.mail.exim.user ... >>> It's pretty generally agreed that the mailing list search facility >>> provided by jiscmail is not much good. >>> So I'm looking for alternatives. >> >> http://gmane.org >> http://gmane.org/info.php?group=gmane.mail.virus.mailscanner > -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Wed Dec 29 08:35:22 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:02 2006 Subject: Definitely Spam problem Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Juan Pablo Abuyeres wrote: Hi, I'm running mailscanner-4.33.3-1 I have set up a rule for Is Definitely Spam, and action for spam is attachment. The problem is when I send an email, the mail dissapears. It never gets to the recipient, it doesn't bounce.. nothing. Dec 28 19:32:53 bonnie MailScanner[31414]: Message DBF1C194 from 200.24.224.1 (jpabuyer@tecnoera.com) to wawi.nac.cl is spam (blacklisted) Dec 28 19:32:53 bonnie MailScanner[31414]: Spam Checks: Found 1 spam messages Dec 28 19:32:53 bonnie MailScanner[31414]: Spam Actions: message DBF1C194 actions are attachment Dec 28 19:32:53 bonnie MailScanner[31414]: Created attachment dirs for 0 messages Dec 28 19:32:53 bonnie MailScanner[31414]: Virus and Content Scanning: Starting Dec 28 19:32:53 bonnie MailScanner[31414]: Commencing scanning by f-secure... Stopping now as you are debugging me. Dec 28 19:32:59 bonnie MailScanner[31414]: Scan ended at Tue Dec 28 19:32:59 2004 Dec 28 19:32:59 bonnie MailScanner[31414]: 1 file scanned Dec 28 19:32:59 bonnie MailScanner[31414]: Completed scanning by f-secure Dec 28 19:32:59 bonnie MailScanner[31414]: MailScanner child dying of old age I checked the changelog, but I didn't notice any entry on this issue. Any ideas? Yes, you need to add 'deliver' to the spam actions (To go with attachment) Is it possible to set a special action for "Is Definitely Spam" matching mails? (for customers who want to receive spam, convert to attachment high scoring spam, and delete Definitely Spam). AFAIK the options are for either spam or high scoring spam. I guess the obvious move is to set the high score to a very high number (200?) and set that to delete and the spam options to attach, deliver so those get attached and delivered, then set the blacklisted spam to be high scoring spam (So they get deleted). That would do the job ;-) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Wed Dec 29 08:49:18 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Chris Picciotto wrote: > I posted to the other mail-list - but will also do so here (got to > experiment!) > > I like this. The entire archive is here, and is very easy within the news > reader. > Quite scary, I think I could fill my HDD with the whole list archive :-) Even works well in Thunderbird. Seeing this I don't see an excuse for people not to search the archives now... Drew ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Wed Dec 29 10:13:20 2004 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:28:02 2006 Subject: Stop postmaster emails Message-ID: Hi! > How do I stop Mailscanner sending me an email to postmaster whenever it > discovers an infected/spam email? Alter your Mailscanner.conf and reload ? :) Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Wed Dec 29 10:27:38 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:28:02 2006 Subject: Stop postmaster emails Message-ID: Raymond Dijkxhoorn wrote: >> How do I stop Mailscanner sending me an email to postmaster whenever it >> discovers an infected/spam email? > > Alter your Mailscanner.conf and reload ? :) # vi /etc/MailScanner/MailScanner.conf # # Notices to System Administrators # -------------------------------- # # Notify the local system administrators ("Notices To") when any infections # are found? # This can also be the filename of a ruleset. Send Notices = yes # Include the full headers of each message in the notices sent to the local # system administrators? # This can also be the filename of a ruleset. Notices Include Full Headers = yes # Hide the directory path from all the system administrator notices. # The extra directory paths give away information about your setup, and # tend to just confuse users but are still useful for local sys admins. # This can also be the filename of a ruleset. Hide Incoming Work Dir in Notices = no # What signature to add to the bottom of the notices. # To insert a line-break in there, use the sequence "\n". Notice Signature = -- \nMailScanner\nEmail Virus Scanner\nwww.mailscanner.info # The visible part of the email address used in the "From:" line of the # notices. The part of the email address is set to the # "Local Postmaster" setting. Notices From = MailScanner # Where to send the notices. # This can also be the filename of a ruleset. Notices To = postmaster # Address of the local Postmaster, which is used as the "From" address in # virus warnings sent to users. # This can also be the filename of a ruleset. Local Postmaster = postmaster ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Wed Dec 29 11:46:31 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:02 2006 Subject: Threded perl and mailwatch Message-ID: On Tue, Dec 21, 2004 at 11:35:09AM +0100, Clas Mayer wrote: > Hi > Im having problem with mailwatch, after a perl --> perl threaded > what does > > "Could not use Custom Function code > MailScanner::CustomConfig::InitMailWatchLogging" > > in maillog tell me? At a quick guess, that the DB interface in MailWatchLogging has issues around threading. In any case I suggest you go over to the mailwatch list, where I'm confident you will receive better help than I can offer :) Paddy > > -- > Clas Mayer > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Wed Dec 29 12:13:15 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:02 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: On Sun, Dec 26, 2004 at 12:44:48PM -0800, avery wrote: > Drew Marshall wrote: > > >avery wrote: > > > > > > > >> > >>Good inforamation, thanks for the advise. But I am also interested in > >>the reasons why the method in which Mailscanner and Postfix work > >>together has changed in the last few months. What were the reasons in > >>changing this? At one time postfix needed to run in 2 instances one for > >>incoming and one for outgoing. This does not seem to be the case > >>anymore. It seems to be some top secret reason that no one knows about. > > > > > >Not that secret really. Postfix, being of 'modular design' relies on a > >beast known as queue runner (You will find manual entries about it and > >an entry in master.cf which controls it). Basically the queue runner > >moves messages about to the different bits of Postfix e.g. smtpd > >receives the message, the queue runner moves it to an out going queue or > >delivery agent, you get the idea. Now Wietse (Sorry if that's spelt > >wrong but it's Christmas and I can't be bothered to look it up ;-) ) > >doesn't feel the need to use any form of locking on any of the queue > >files as from his perspective the only thing moving messages is Postfix > >(And probably the queue runner at that) so there is no need to lock > >files from it's self. That's fine until you introduce MailScanner who > >will pick up messages and scan them and quite possibly while the queue > >runner is trying to move them, hence making duplicate and truncated > >messages (Which is the complaint from the Postfix community). The > >solution is quite simple. Put the unscanned mail some where that the > >queue runner doesn't ever go - the hold queue. From there MS can do it's > >bit with out fear of interference and then MS moves the message from the > >hold queue back into an active queue for delivery. That is the 'secret' > >of single verses double Postfix instances. > > > >Hope that makes it clearer. > > > >Drew > > > >-- > >In line with our policy, this message has > >been scanned for viruses and dangerous > >content by MailScanner, and is believed to be clean. > >www.themarshalls.co.uk/policy > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > Drew, > > Awesome, Awesome, Awesome, thank you. I needed that information badly > and so do others. I am making a proposal to expose this information. I > just wanted someone to specifically state the reasons why things have > changed. If more postfix users knew this they might not be so afraid of > using Mailscanner with postfix. The postfix community is still telling > people not to use Mailscanner with postfix even though it seems a > solution has been found. As of right this second the postfix experts on > the postfix mailing list are telling people that it is not safe to use > postfix and Mailscanner together. This is no longer the case as you have > just explained to me. It seems to me that this information should be > more readily available. This has been my point all along. Information my > fellow friends, its all about information. Is there someone I can make a > request to that would post this information you just presented to me on > the Mailscanner website? Mailscanner needs a wiki : ) Schrock, I'm not familiar with the design of postfix, but if, as I fear, this solution is not entirely to the satisfaction of the postfix philosophy, then I for one would be interested in understanding further what the issues are. More optimistically, if this is the solution, then it is, as you point out, past time to put old troubles behind. Either way, with your infectious enthusiasm and disarming style, your contribution to healing this rift is important. So, thank _you_. Regards, Paddy > > Thanks again, > Schrock > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 29 13:08:06 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:02 2006 Subject: Archived mail Message-ID: Hello. I recently set the archive parameter in the ms conf file. I'd like to have it archive messages (per our policy) in mbox format, rather than postfix queue format. Is this possible? Thanks, Rod -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jpabuyer at TECNOERA.COM Wed Dec 29 13:37:11 2004 From: jpabuyer at TECNOERA.COM (Juan Pablo Abuyeres) Date: Thu Jan 12 21:28:02 2006 Subject: Definitely Spam problem Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] That was it. Thank you! On Wed, 2004-12-29 at 08:35 +0000, Drew Marshall wrote: Juan Pablo Abuyeres wrote: Hi, I'm running mailscanner-4.33.3-1 I have set up a rule for Is Definitely Spam, and action for spam is attachment. The problem is when I send an email, the mail dissapears. It never gets to the recipient, it doesn't bounce.. nothing. Dec 28 19:32:53 bonnie MailScanner[31414]: Message DBF1C194 from 200.24.224.1 (jpabuyer@tecnoera.com) to wawi.nac.cl is spam (blacklisted) Dec 28 19:32:53 bonnie MailScanner[31414]: Spam Checks: Found 1 spam messages Dec 28 19:32:53 bonnie MailScanner[31414]: Spam Actions: message DBF1C194 actions are attachment Dec 28 19:32:53 bonnie MailScanner[31414]: Created attachment dirs for 0 messages Dec 28 19:32:53 bonnie MailScanner[31414]: Virus and Content Scanning: Starting Dec 28 19:32:53 bonnie MailScanner[31414]: Commencing scanning by f-secure... Stopping now as you are debugging me. Dec 28 19:32:59 bonnie MailScanner[31414]: Scan ended at Tue Dec 28 19:32:59 2004 Dec 28 19:32:59 bonnie MailScanner[31414]: 1 file scanned Dec 28 19:32:59 bonnie MailScanner[31414]: Completed scanning by f-secure Dec 28 19:32:59 bonnie MailScanner[31414]: MailScanner child dying of old age I checked the changelog, but I didn't notice any entry on this issue. Any ideas? Yes, you need to add 'deliver' to the spam actions (To go with attachment) Is it possible to set a special action for "Is Definitely Spam" matching mails? (for customers who want to receive spam, convert to attachment high scoring spam, and delete Definitely Spam). AFAIK the options are for either spam or high scoring spam. I guess the obvious move is to set the high score to a very high number (200?) and set that to delete and the spam options to attach, deliver so those get attached and delivered, then set the blacklisted spam to be high scoring spam (So they get deleted). That would do the job ;-) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vlad at MAZEK.COM Wed Dec 29 13:44:24 2004 From: vlad at MAZEK.COM (Vlad Mazek) Date: Thu Jan 12 21:28:02 2006 Subject: Archived mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I've been at this as well for the past day or so. You can specify a ruleset instead of a directory in MailScanner.conf like this: Archive Mail = /etc/MailScanner/rules/archive.rules Then inside that archive, define the mbox files you want to keep the mail in, for example: FromOrTo: vlad@mazek.com /var/spool/mail/vladarchive.mbx FromOrTo: default no This will only archive mails sent to/from me in a separate archive file. -Vlad Rodney Green wrote: >Hello. I recently set the archive parameter in the ms conf file. I'd like to >have it archive messages (per our policy) in mbox format, rather than >postfix queue format. Is this possible? > >Thanks, >Rod > > >-- >This message has been scanned for viruses and >dangerous content by MailScanner, and is >believed to be clean. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 29 14:03:21 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Adding Custom Headers to SPAM Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just added this feature to 4.37. Expect a stable release on 1st or 2nd of January. You will be able to add any arbitrary headers you like. Matt wrote: > I want to add a couple custom header lines to all messages found to be > SPAM. > I have tried doing it with: > > Spam Header = > > But it keeps wanting to add ",spam etc.." to end and I also need more > then > one line added. Any ideas? > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 29 14:05:59 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Archived mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I hate to say it, but RTFM :-) From MailScanner.conf: # Space-separated list of any combination of # 1. email addresses to which mail should be forwarded, # 2. directory names where you want mail to be stored, # 3. file names (they must already exist!) to which mail will be appended # in "mbox" format suitable for most Unix mail systems. # # If you give this option a ruleset, you can control exactly whose mail # is archived or forwarded. If you do this, beware of the legal implications # as this could be deemed to be illegal interception unless the police have # asked you to do this. #Archive Mail = /var/spool/MailScanner/archive Archive Mail = Note point 3. Rodney Green wrote: >Hello. I recently set the archive parameter in the ms conf file. I'd like to >have it archive messages (per our policy) in mbox format, rather than >postfix queue format. Is this possible? > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 29 14:18:29 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:02 2006 Subject: Archived mail Message-ID: Sorry. I haven't ever used rules before. I read that exact stuff from the MailScanner.conf file and didn't know what to do. Sorry. Sorry. Sorry. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Wednesday, December 29, 2004 9:06 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Archived mail I hate to say it, but RTFM :-) From MailScanner.conf: # Space-separated list of any combination of # 1. email addresses to which mail should be forwarded, # 2. directory names where you want mail to be stored, # 3. file names (they must already exist!) to which mail will be appended # in "mbox" format suitable for most Unix mail systems. # # If you give this option a ruleset, you can control exactly whose mail # is archived or forwarded. If you do this, beware of the legal implications # as this could be deemed to be illegal interception unless the police have # asked you to do this. #Archive Mail = /var/spool/MailScanner/archive Archive Mail = Note point 3. Rodney Green wrote: >Hello. I recently set the archive parameter in the ms conf file. I'd >like to have it archive messages (per our policy) in mbox format, >rather than postfix queue format. Is this possible? > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jbuda at NOTICIASARGENTINAS.COM Wed Dec 29 14:56:57 2004 From: jbuda at NOTICIASARGENTINAS.COM (Jose Julian Buda) Date: Thu Jan 12 21:28:02 2006 Subject: Rules Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] i have postfix+mailscanner+clamav i have just this rules Virus Scanning ruleset : ... FromOrTO : myboss@noticiasargentinas.com no FromOrTO : myboss@noticiasargentinas.com.ar no FromOrTO : default yes ... to not scan the myboss mailbox... but today happen that i recieve an email whit virus on jbuda@noticiasargentinas.com seeing the email source and the email id i saw that really the mail-scanning procces was bypassed because an email was sent To:myboss with bcc to jbuda is that posible? the address on bcc field are not scanned if the "To:" field is seted to be bypassed? or am i missing something? sorry my english... Thank you Julian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 29 14:58:39 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: "Threaded HTTP" works OK for me (in firefox, at least). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: den 28 december 2004 23:16 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Search for list archive -- ideas? > > > I can't get any output from the "Threaded HTTP" view of the > MailScanner > list at all. Sits there doing nothing for ages, then prints > the helpful > message: > > Error GMANE-03252: Something is wrong. Perhaps something > didn't match a > group name. Perhaps something else. > > shrek-m@gmx.de wrote: > > > Julian Field wrote: > > > >> It's pretty generally agreed that the mailing list search facility > >> provided by jiscmail is not much good. > >> So I'm looking for alternatives. > > > > > > > > http://gmane.org > > http://gmane.org/info.php?group=gmane.mail.virus.mailscanner > > > > -- > > shrek-m > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Wed Dec 29 15:13:52 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: Steen, Glenn wrote: >"Threaded HTTP" works OK for me (in firefox, at least). > the link was indeed temporary broken >>I can't get any output from the "Threaded HTTP" view of the >>MailScanner list at all. Sits there doing nothing for ages, then prints >>the helpful >>message: >> >>Error GMANE-03252: Something is wrong. Perhaps something >>didn't match a >>group name. Perhaps something else. >> i got the same error this morning -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 29 15:15:35 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Archived mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] There is quite a lot about rules in the MAQ, the FAQ and the book. Read that, then write what you think is right. If it doesn't work then post it here and we will try to get it working for you. Rodney Green wrote: >Sorry. I haven't ever used rules before. I read that exact stuff from the >MailScanner.conf file and didn't know what to do. Sorry. Sorry. Sorry. > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >Of Julian Field >Sent: Wednesday, December 29, 2004 9:06 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Archived mail > > >I hate to say it, but RTFM :-) > > From MailScanner.conf: ># Space-separated list of any combination of ># 1. email addresses to which mail should be forwarded, ># 2. directory names where you want mail to be stored, ># 3. file names (they must already exist!) to which mail will be appended ># in "mbox" format suitable for most Unix mail systems. ># ># If you give this option a ruleset, you can control exactly whose mail # is >archived or forwarded. If you do this, beware of the legal implications # as >this could be deemed to be illegal interception unless the police have # >asked you to do this. #Archive Mail = /var/spool/MailScanner/archive Archive >Mail = > >Note point 3. > >Rodney Green wrote: > > > >>Hello. I recently set the archive parameter in the ms conf file. I'd >>like to have it archive messages (per our policy) in mbox format, >>rather than postfix queue format. Is this possible? >> >> >> >> >> > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store Professional Support >Services at www.MailScanner.biz MailScanner thanks transtec Computers for >their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >mailscanner' in the body of the email. Before posting, read the MAQ >(http://www.mailscanner.biz/maq/) and the archives >(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Dec 29 15:18:07 2004 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] shrek-m@gmx.de wrote: >>> message: >>> >>> Error GMANE-03252: Something is wrong. Perhaps something >>> didn't match a >>> group name. Perhaps something else. >>> I get this message as a rule rather than an exception.. gmane is broken too often for me. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 29 15:17:04 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:02 2006 Subject: Rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] If any of the recipients requested scanning, then the message is scanned. A message with many recipients is treated as one message. Jose Julian Buda wrote: > i have postfix+mailscanner+clamav > > i have just this rules Virus Scanning ruleset : > > ... > FromOrTO : myboss@noticiasargentinas.com > no > FromOrTO : myboss@noticiasargentinas.com.ar > no > FromOrTO : default yes > ... > > > to not scan the myboss mailbox... > but today happen that i recieve an email whit virus on > jbuda@noticiasargentinas.com > seeing the email source and the email id i saw that really the > mail-scanning procces was bypassed > because an email was sent To:myboss with bcc to jbuda > is that posible? > the address on bcc field are not scanned if the "To:" field is seted > to be bypassed? > or am i missing something? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 29 15:33:26 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:02 2006 Subject: Search for list archive -- ideas? Message-ID: Well... If it's at least marginally OK, it sure beats setting up and managing ones own htdig or whatnot:-). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy > Sent: den 29 december 2004 16:18 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Search for list archive -- ideas? > > > shrek-m@gmx.de wrote: > >>> message: > >>> > >>> Error GMANE-03252: Something is wrong. Perhaps something > >>> didn't match a > >>> group name. Perhaps something else. > >>> > > I get this message as a rule rather than an exception.. gmane > is broken > too often for me. > > - dhawal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 29 15:41:21 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of paddy > Sent: den 29 december 2004 13:13 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Postfix and Mailscanner sitting in a tree k-iss-ing > > > (snip) > > Schrock, > > I'm not familiar with the design of postfix, but if, as I fear, this > solution is not entirely to the satisfaction of the postfix > philosophy, > then I for one would be interested in understanding further what the > issues are. More optimistically, if this is the solution, then it is, > as you point out, past time to put old troubles behind. > > Either way, with your infectious enthusiasm and disarming style, > your contribution to healing this rift is important. > > So, thank _you_. > > Regards, > Paddy I'm not sure the "rift" would be healed that easy. Not unless we stop perusing the queue files directly and start using one of the "official" interfaces ([SMTP|LOCAL|PIPE], IIRC). I don't agree with Mr Venema on this point, I think we can view the queue files as "public interfaces" as long as there's publicly available source that details how it's "come together", but then again... I really don't think he cares what I think:-). One could dream up a solution around the pipe interface where we could invent a "MailScanner-Postfix" file format (I think someone already did that once or twice), but I don't see much point in it... With the latest fixes to make the (copied) queue files unique and the HOLD setup it is pretty darned safe to use... and fast:-). IMO this seems to be less of a technical problem anymore, and more a political/philosophical (and perhaps personal) thing. Just ignore the postfix-users list and go on being happy with MailScanner and Postfix;). -- Glenn > > > > > > Thanks again, > > Schrock > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > -- > Perl 6 will give you the big knob. -- Larry Wall > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Wed Dec 29 15:48:29 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:28:03 2006 Subject: Search for list archive -- ideas? Message-ID: Dhawal Doshy wrote: >>>> message: >>>> >>>> Error GMANE-03252: Something is wrong. Perhaps something >>>> didn't match a >>>> group name. Perhaps something else. >>> at this time the list was accessible via nntp, i have downloaded all 23.xxx headers. > I get this message as a rule rather than an exception.. gmane is broken > too often for me. i am surely not up2date: i used gmane via nntp for several lists in 2002/2003 without problems, seldom in 2004. -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jbuda at NOTICIASARGENTINAS.COM Wed Dec 29 15:48:30 2004 From: jbuda at NOTICIASARGENTINAS.COM (Jose Julian Buda) Date: Thu Jan 12 21:28:03 2006 Subject: Rules Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] so why this message pass through the mailscanning proccess? should i remove this ruleset and scan everything for security reason? ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, December 29, 2004 12:17 PM Subject: Re: Rules If any of the recipients requested scanning, then the message is scanned. A message with many recipients is treated as one message. Jose Julian Buda wrote: > i have postfix+mailscanner+clamav > > i have just this rules Virus Scanning ruleset : > > ... > FromOrTO : myboss@noticiasargentinas.com > no > FromOrTO : myboss@noticiasargentinas.com.ar > no > FromOrTO : default yes > ... > > > to not scan the myboss mailbox... > but today happen that i recieve an email whit virus on > jbuda@noticiasargentinas.com > seeing the email source and the email id i saw that really the > mail-scanning procces was bypassed > because an email was sent To:myboss with bcc to jbuda > is that posible? > the address on bcc field are not scanned if the "To:" field is seted > to be bypassed? > or am i missing something? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jbuda at NOTICIASARGENTINAS.COM Wed Dec 29 15:58:17 2004 From: jbuda at NOTICIASARGENTINAS.COM (Jose Julian Buda) Date: Thu Jan 12 21:28:03 2006 Subject: Rules Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is the log for the email i am talking about : ... Dec 28 15:45:44 serverna postfix/smtpd[2067]: 148466DDE7: client=host213.200-43-169.telecom.net.ar[200.43.169.213] Dec 28 15:45:45 serverna postfix/cleanup[2068]: 148466DDE7: hold: header Received: from fdjrsd.ar (host213.200-43-169.telecom.net.ar [200.43.169.213])??by mail.noticiasargentinas.com.ar (Postfix) with SMTP id 148466DDE7;??Tue, 28 Dec 2004 15:45:43 -0300 (ART) from host213.200-43-169.telecom.net.ar[200.43.169.213]; from= to= proto=SMTP helo= Dec 28 15:45:45 serverna postfix/cleanup[2068]: 148466DDE7: message-id=<72da.b6fcaadbcc9dcbe@senado.gov.ar> Dec 28 15:45:56 serverna MailScanner[32201]: Requeue: 148466DDE7 to 1CF476DDEA Dec 28 15:45:56 serverna postfix/qmgr[506]: 1CF476DDEA: from=, size=79614, nrcpt=7 (queue active) Dec 28 15:45:56 serverna postfix/local[2114]: 1CF476DDEA: to=, relay=local, delay=13, status=sent (delivered to mailbox) Dec 28 15:45:56 serverna postfix/local[2300]: 1CF476DDEA: to=, relay=local, delay=13, status=sent (delivered to mailbox) Dec 28 15:45:56 serverna postfix/local[2114]: 1CF476DDEA: to=, relay=local, delay=13, status=sent (delivered to mailbox) Dec 28 15:45:56 serverna postfix/local[2300]: 1CF476DDEA: to=, relay=local, delay=13, status=sent (forwarded as 6343D6DDE7) Dec 28 15:45:56 serverna postfix/local[2300]: 1CF476DDEA: to=, relay=local, delay=13, status=sent (forwarded as 6B5BB6DDEB) Dec 28 15:45:56 serverna postfix/local[2114]: 1CF476DDEA: to=, relay=local, delay=13, status=sent (delivered to mailbox) Dec 28 15:45:56 serverna postfix/local[2300]: 1CF476DDEA: to=, relay=local, delay=13, status=sent (delivered to mailbox) Dec 28 15:45:56 serverna postfix/qmgr[506]: 1CF476DDEA: removed .... the original message(148466DDE7) was to "to=" the requede message(1CF476DDEA ) pass through the mailscanner proccess...and all the mailbox with virus... i dont understand ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, December 29, 2004 12:17 PM Subject: Re: Rules If any of the recipients requested scanning, then the message is scanned. A message with many recipients is treated as one message. Jose Julian Buda wrote: > i have postfix+mailscanner+clamav > > i have just this rules Virus Scanning ruleset : > > ... > FromOrTO : myboss@noticiasargentinas.com > no > FromOrTO : myboss@noticiasargentinas.com.ar > no > FromOrTO : default yes > ... > > > to not scan the myboss mailbox... > but today happen that i recieve an email whit virus on > jbuda@noticiasargentinas.com > seeing the email source and the email id i saw that really the > mail-scanning procces was bypassed > because an email was sent To:myboss with bcc to jbuda > is that posible? > the address on bcc field are not scanned if the "To:" field is seted > to be bypassed? > or am i missing something? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 29 15:59:16 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:03 2006 Subject: Archived mail Message-ID: Thank you Vlad. I tried your example and haven't been able to get MS to write to the archive file. I created the file using touch in the correct directory. I restarted MS as well. Any ideas what might be wrong? Thanks, Rod -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Vlad Mazek Sent: Wednesday, December 29, 2004 8:44 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Archived mail I've been at this as well for the past day or so. You can specify a ruleset instead of a directory in MailScanner.conf like this: Archive Mail = /etc/MailScanner/rules/archive.rules Then inside that archive, define the mbox files you want to keep the mail in, for example: FromOrTo: vlad@mazek.com /var/spool/mail/vladarchive.mbx FromOrTo: default no This will only archive mails sent to/from me in a separate archive file. -Vlad Rodney Green wrote: >Hello. I recently set the archive parameter in the ms conf file. I'd >like to have it archive messages (per our policy) in mbox format, >rather than postfix queue format. Is this possible? > >Thanks, >Rod > > >-- >This message has been scanned for viruses and >dangerous content by MailScanner, and is >believed to be clean. > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >mailscanner' in the body of the email. Before posting, read the MAQ >(http://www.mailscanner.biz/maq/) and the archives >(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Dec 29 16:00:58 2004 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:28:03 2006 Subject: Search for list archive -- ideas? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] shrek-m@gmx.de wrote: > > i am surely not up2date: > i used gmane via nntp for several lists in 2002/2003 without problems, > seldom in 2004. > I have precisely the same experience.. last 8-10 months gmane has been unavailable with these errors just when you need to access it. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.siddall at ELIRION.NET Wed Dec 29 16:08:58 2004 From: richard.siddall at ELIRION.NET (Richard Siddall) Date: Thu Jan 12 21:28:03 2006 Subject: Search for list archive -- ideas? Message-ID: Julian Field wrote: > It's pretty generally agreed that the mailing list search facility > provided by jiscmail is not much good. > So I'm looking for alternatives. > Well, since someone mentioned htdig, I'll mention mnoGoSearch (http://mnogosearch.org/). Unfortunately, I haven't actually USED it, but it looks powerful (able to index fields from databases, use installable file parsers, etc.) and easy to install. Whether you could get more useful search results is another question. Regards, Richard. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Dec 29 16:16:00 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:03 2006 Subject: Search for list archive -- ideas? Message-ID: Yeah, "someone" mentioned it, and that "someone" (still me:-) also alluded to it being a tad much work, especially if you've gotten someone _else_ to do it for you already;-). (Don't get me wrong, I like htdig... and used it (intranet search type of thing) for years). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Richard Siddall > Sent: den 29 december 2004 17:09 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Search for list archive -- ideas? > > > Julian Field wrote: > > > It's pretty generally agreed that the mailing list search facility > > provided by jiscmail is not much good. > > So I'm looking for alternatives. > > > > Well, since someone mentioned htdig, I'll mention mnoGoSearch > (http://mnogosearch.org/). > > Unfortunately, I haven't actually USED it, but it looks powerful (able > to index fields from databases, use installable file parsers, > etc.) and > easy to install. Whether you could get more useful search results is > another question. > > Regards, > > Richard. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 29 16:43:31 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: Archived mail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Did you set the ownership and permissions correctly, so that whatever user you have in Run As User can actually write to that file? Rodney Green wrote: >Thank you Vlad. I tried your example and haven't been able to get MS to >write to the archive file. I created the file using touch in the correct >directory. I restarted MS as well. Any ideas what might be wrong? > >Thanks, >Rod > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >Of Vlad Mazek >Sent: Wednesday, December 29, 2004 8:44 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Archived mail > > >I've been at this as well for the past day or so. You can specify a ruleset >instead of a directory in MailScanner.conf like this: > >Archive Mail = /etc/MailScanner/rules/archive.rules > >Then inside that archive, define the mbox files you want to keep the mail >in, for example: > >FromOrTo: vlad@mazek.com /var/spool/mail/vladarchive.mbx >FromOrTo: default no > >This will only archive mails sent to/from me in a separate archive file. > >-Vlad > >Rodney Green wrote: > > > >>Hello. I recently set the archive parameter in the ms conf file. I'd >>like to have it archive messages (per our policy) in mbox format, >>rather than postfix queue format. Is this possible? >> >>Thanks, >>Rod >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Wed Dec 29 16:51:11 2004 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:28:03 2006 Subject: Archived mail Message-ID: That was the problem. Thank you Julian! -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Wednesday, December 29, 2004 11:44 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Archived mail Did you set the ownership and permissions correctly, so that whatever user you have in Run As User can actually write to that file? Rodney Green wrote: >Thank you Vlad. I tried your example and haven't been able to get MS to >write to the archive file. I created the file using touch in the >correct directory. I restarted MS as well. Any ideas what might be >wrong? > >Thanks, >Rod > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Vlad Mazek >Sent: Wednesday, December 29, 2004 8:44 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Archived mail > > >I've been at this as well for the past day or so. You can specify a >ruleset instead of a directory in MailScanner.conf like this: > >Archive Mail = /etc/MailScanner/rules/archive.rules > >Then inside that archive, define the mbox files you want to keep the >mail in, for example: > >FromOrTo: vlad@mazek.com /var/spool/mail/vladarchive.mbx >FromOrTo: default no > >This will only archive mails sent to/from me in a separate archive >file. > >-Vlad > >Rodney Green wrote: > > > >>Hello. I recently set the archive parameter in the ms conf file. I'd >>like to have it archive messages (per our policy) in mbox format, >>rather than postfix queue format. Is this possible? >> >>Thanks, >>Rod >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Wed Dec 29 17:46:37 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: MailScanner ANNOUNCE beta 4.37.6 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released a new beta 4.37.6. I intend this to be the last release before the stable release at the start of January, so I would appreciate it if you could help test it for me. All the messages coming through can now have arbitrary headers added. And I have added an important fix into the MIME-tools that fixes a problem causing MailScanner to crash when processing some particular bounce messages from Hotmail. When installing this release, please remember to run the ./install.sh as the perl-MIME-tools package has been updated. Download as usual from www.mailscanner.info The full Change Log is this: * New Features and Improvements * - When stripping HTML messages to plain text, the contents of script and style tags are omitted. - Phishing net improved to ignore email addresses. - Now supports split sendmail queues where any incoming mqueue.in directory can have qf, df, xf, tf subdirectories, each containing the appropriate type of file for each message. This will greatly speed operation on big queues as the directories will be less than half the size of a combined queue directory. - New option "Keep Spam And MCP Archive Clean" which forces it to virus scan all spam that is quarantined. Any spam (or MCP messages) found to be virus- infected are removed from the quarantine, so you can safely let your users have access to the spam archive safe in the knowledge that they cannot get any viruses out of it. Note: This feature is disabled by default, as most people won't want the performance hit of all the extra scanning, as they don't their users access to the spam quarantine anyway. - Changed Postfix handling so that "Archive Mail" feature creates files with unique names so that re-used message-ids don't cause overwriting of older files in the same day with the same message-id. - Spam and MCP actions (and of course their non- and high-scoring- alternatives can now include extra headers which are added in each case. These entire headers must be contained in double quotes. So for example, you can have Spam Actions = header "X-Spam-Status: yes" deliver and the message will be delivered but with the extra header X-Spam-Status: yes added to the message. * Fixes * - Fixed sendmail and ZMailer problem where subject lines starting with a line-break were not tagged correctly. - Fixed minor problems with multi-line Subject: headers. - Fixed bugs with some MTAs when keeping spam archive clean. - %vars% in MailScanner.conf are now handled properly in "other" settings. - Fixed problem with correctly removing Phishing frauds from badly formatted html with missing tags before corresponding . - Fixed problem with message duplication on some sendmail systems. - Worked around Perl bug causing crashes with a few bounces from Hotmail. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Wed Dec 29 17:49:04 2004 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:28:03 2006 Subject: Archived mail Message-ID: Julian Field wrote: > I hate to say it, but RTFM :-) Shouldn't that be BTFB*? Well worth the investment... ...Kevin *Buy the Fine Book -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at LISTS.COM.AR Wed Dec 29 19:33:51 2004 From: mailscanner at LISTS.COM.AR (Leonardo Helman) Date: Thu Jan 12 21:28:03 2006 Subject: Search for list archive -- ideas? Message-ID: I've used mnogoserch. mi thanks to the people who wroted it happy admin/happy users. (it's not google, that somehow find out what are you thinking, but...) But gmane works for me, and it's already installed and configured. Saludos LeoH On Wed, Dec 29, 2004 at 05:15:38PM +0100, Steen, Glenn wrote: > Yeah, "someone" mentioned it, and that "someone" (still me:-) also > alluded to it being a tad much work, especially if you've gotten > someone _else_ to do it for you already;-). > (Don't get me wrong, I like htdig... and used it (intranet search type > of thing) for years). > > -- Glenn > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Richard Siddall > > Sent: den 29 december 2004 17:09 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Search for list archive -- ideas? > > > > > > Julian Field wrote: > > > > > It's pretty generally agreed that the mailing list search facility > > > provided by jiscmail is not much good. > > > So I'm looking for alternatives. > > > > > > > Well, since someone mentioned htdig, I'll mention mnoGoSearch > > (http://mnogosearch.org/). > > > > Unfortunately, I haven't actually USED it, but it looks powerful (able > > to index fields from databases, use installable file parsers, > > etc.) and > > easy to install. Whether you could get more useful search results is > > another question. > > > > Regards, > > > > Richard. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Wed Dec 29 19:54:22 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steen, Glenn wrote: >I'm not sure the "rift" would be healed that easy. Not unless we stop >perusing the queue files directly and start using one of the "official" >interfaces ([SMTP|LOCAL|PIPE], IIRC). I don't agree with Mr Venema on >this >point, I think we can view the queue files as "public interfaces" as >long >as there's publicly available source that details how it's "come >together", >but then again... I really don't think he cares what I think:-). > > Or indeed any one else :-( >One could dream up a solution around the pipe interface where we could >invent a "MailScanner-Postfix" file format (I think someone already did >that once or twice), but I don't see much point in it... With the latest >fixes to make the (copied) queue files unique and the HOLD setup it is >pretty darned safe to use... and fast:-). > > >IMO this seems to be less of a technical problem anymore, and more a >political/philosophical (and perhaps personal) thing. Just ignore the >postfix-users list and go on being happy with MailScanner and Postfix;). > > I have to agree whole heartedly with all of the above. I have kinda reached that point myself. It works and works well so why should I worry about what the Postfix users list thinks? Their loss, my gain (IMHO). Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cpicciotto at KALISYSTEMS.COM Wed Dec 29 19:54:25 2004 From: cpicciotto at KALISYSTEMS.COM (Chris Picciotto) Date: Thu Jan 12 21:28:03 2006 Subject: Search for list archive -- ideas? Message-ID: Of course - if you only download the headers, you save HD space... but lose the full text search. But can do a fast easy search via web interface anyway. "Drew Marshall" wrote in message news:cqtr2f$t85$1@sea.gmane.org... > Chris Picciotto wrote: >> I posted to the other mail-list - but will also do so here (got to >> experiment!) >> >> I like this. The entire archive is here, and is very easy within the news >> reader. >> > Quite scary, I think I could fill my HDD with the whole list archive :-) > Even works well in Thunderbird. Seeing this I don't see an excuse for > people not to search the archives now... > > Drew > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marco at XSSNET.COM Thu Dec 30 00:01:40 2004 From: marco at XSSNET.COM (Marco Benton - BOFH) Date: Thu Jan 12 21:28:03 2006 Subject: MailScanner ANNOUNCE beta 4.37.6 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have just released a new beta 4.37.6. I intend this to be the last > release before the stable release at the start of January, so I would > appreciate it if you could help test it for me. > <...snip...> is it me or does the version still say "MailScanner E-Mail Virus Scanner version 4.37.5 starting..."? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mallen at FAMILYRADIO.ORG Thu Dec 30 01:04:16 2004 From: mallen at FAMILYRADIO.ORG (Mike Allen) Date: Thu Jan 12 21:28:03 2006 Subject: NOD32 integration with MailScanner.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] To All: My email server consists of the following: 2 each 2.20 MHZ CPUs 4 GB RAM Cyrus-imap email server v 2.0.16 w/SSL OS: FreeBSD v5.1 -p 18 Antivirus: ClamAV v 0.71 (yes, I know I need to upgrade to v 0.80) I have purchased NOD32 version 2.0 Enterprise edition for Unix. Other than adding 'nod32' to the "Virus Scanners = clamav nod32" configuration item, I am not sure what to do. Mike Allen Family Stations, Inc. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mlm at LOANPROCESSING.NET Thu Dec 30 01:44:27 2004 From: mlm at LOANPROCESSING.NET (Mike McMullen) Date: Thu Jan 12 21:28:03 2006 Subject: Freshclam Location Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi All, I'm setting up a new mail server. I just installed MailScanner-4.36.4-1. I tried installing it from the tar file, had a few issues and then tried installing it from the RPMs on an FC2 system. This all went ok. Now however I get the following messages in my logs regarding ClamAV auto updates: Dec 29 17:31:23 mail update.virus.scanners: Delaying cron job up to 600 seconds Dec 29 17:38:54 mail update.virus.scanners: Found clamav installed Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for clamav Dec 29 17:38:54 mail ClamAV-autoupdate[11389]: ClamAV updater /usr/local/bin/freshclam cannot be run Dec 29 17:38:54 mail update.virus.scanners: Found generic installed Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for generic My freshclam location is /usr/bin/freshclam. Where can I tell Mail-Scanner to find it there? Thanks, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Thu Dec 30 02:01:01 2004 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:28:03 2006 Subject: MailScanner ANNOUNCE beta 4.37.6 Message-ID: hi! >> release before the stable release at the start of January, so I would >> appreciate it if you could help test it for me. > <...snip...> > > is it me or does the version still say "MailScanner E-Mail Virus Scanner > version 4.37.5 starting..."? No, its not you ... ;) MailScanner E-Mail Virus Scanner version 4.37.5 starting... But more important, does it seems to run just fine ? :) Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From eneal at dfi-intl.com Thu Dec 30 00:00:00 2004 From: eneal at dfi-intl.com (Errol Uriel Neal Jr.) Date: Thu Jan 12 21:28:03 2006 Subject: Freshclam Location Message-ID: I believe you need to edit virusscanners.conf. -----Original Message----- From: Mike McMullen Date: Wed, 29 Dec 2004 17:44:27 To:MAILSCANNER@JISCMAIL.AC.UK Subject: Freshclam Location Hi All, I'm setting up a new mail server. I just installed MailScanner-4.36.4-1. I tried installing it from the tar file, had a few issues and then tried installing it from the RPMs on an FC2 system. This all went ok. Now however I get the following messages in my logs regarding ClamAV auto updates: Dec 29 17:31:23 mail update.virus.scanners: Delaying cron job up to 600 seconds Dec 29 17:38:54 mail update.virus.scanners: Found clamav installed Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for clamav Dec 29 17:38:54 mail ClamAV-autoupdate[11389]: ClamAV updater /usr/local/bin/freshclam cannot be run Dec 29 17:38:54 mail update.virus.scanners: Found generic installed Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for generic My freshclam location is /usr/bin/freshclam. Where can I tell Mail-Scanner to find it there? Thanks, Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! __________________________________________ Errol Uriel Neal Jr. Network Administrator DFI International, Inc. 1717 Pennsylvania Ave NW, Suite 1300 Washington, DC 20006 Tel (202)452-6955 Fax (202)452-6910 eneal@dfi-intl.com www.dfi-intl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marco at XSSNET.COM Thu Dec 30 02:23:50 2004 From: marco at XSSNET.COM (Marco Benton - BOFH) Date: Thu Jan 12 21:28:03 2006 Subject: MailScanner ANNOUNCE beta 4.37.6 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Raymond Dijkxhoorn wrote: | hi! | |>> release before the stable release at the start of January, so I would |>> appreciate it if you could help test it for me. | | |> <...snip...> |> |> is it me or does the version still say "MailScanner E-Mail Virus Scanner |> version 4.37.5 starting..."? | | | No, its not you ... ;) | | MailScanner E-Mail Virus Scanner version 4.37.5 starting... | | But more important, does it seems to run just fine ? :) seems to run fine so far... was wondering if a module didnt make it into the install or did i screw up something (which i usually do on purpose). :) thanx. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFB02a22+PYgoYkw8ERAs9fAJ4g4wDXvaJyQuGn6aN3IgLu5e3RhACfWKAj ixAPFWI8y3GHflFKWirG5cU= =PwnB -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From test at NEXTMILL.NET Thu Dec 30 04:41:39 2004 From: test at NEXTMILL.NET (Brian Lewis) Date: Thu Jan 12 21:28:03 2006 Subject: Child Processes bumped to 10 works best for me! Message-ID: Been fighting an issue I've had with one of my MailScanners which would always have a backlog of emails and I would have to cancel the incoming for it to catch up many times each day. We have 3 Mailscanners, all Athlon XP processor based, two of them running 2100+ processors and one running 2400+ processor. The 2400+ processor was always lagging behind and for the life I me I couldn't figure it out. I was changing the # of child processes to 3,4,5,6 and it wouldn't help, I then looked at the other two servers and I had them set to 10 Child Processes, so I changed this third unit to 10 and walla, its been able to keep on top of everything for a few hours now! So if you are having problems with your system keeping up with your mail load, try increasing the # of child processes from 5 to 10. We average about 60,000 emails per server per day, the systems run 2100-2400+ AMD Athlon processors with 512mb of ram, Fedora Core 2, MailScanner 4.37.6, SpamAssassin 3.0.2, latest Razor/DCC/Pyzor. All 3 scanners are setup on equal priority for the MX records and all do MailWatch Mysql queries to a dedicated Mysql/RBLDNSD/DNSCache server that runs a few rbl's locally using Rsync. Btw I know someone who uses 12 Child Processes but thats on Athlon64 processors with a gig of ram, scans 100,000-120,000 emails a day per server. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Thu Dec 30 05:49:53 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:28:03 2006 Subject: MailScanner ANNOUNCE beta 4.37.6 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > > The full Change Log is this: > > * New Features and Improvements * > - When stripping HTML messages to plain text, the contents of script and > style tags are omitted. > - Phishing net improved to ignore email addresses. > - Now supports split sendmail queues where any incoming mqueue.in > directory > can have qf, df, xf, tf subdirectories, each containing the appropriate > type of file for each message. This will greatly speed operation on big > queues as the directories will be less than half the size of a combined > queue directory. > - New option "Keep Spam And MCP Archive Clean" which forces it to > virus scan > all spam that is quarantined. Any spam (or MCP messages) found to be > virus- > infected are removed from the quarantine, so you can safely let your > users > have access to the spam archive safe in the knowledge that they > cannot get > any viruses out of it. > Note: This feature is disabled by default, as most people won't want the > performance hit of all the extra scanning, as they don't their > users > access to the spam quarantine anyway. > - Changed Postfix handling so that "Archive Mail" feature creates files > with unique names so that re-used message-ids don't cause overwriting of > older files in the same day with the same message-id. > - Spam and MCP actions (and of course their non- and high-scoring- > alternatives > can now include extra headers which are added in each case. These entire > headers must be contained in double quotes. So for example, you can have > Spam Actions = header "X-Spam-Status: yes" deliver > and the message will be delivered but with the extra header > X-Spam-Status: yes > added to the message. > > * Fixes * > - Fixed sendmail and ZMailer problem where subject lines starting with a > line-break were not tagged correctly. > - Fixed minor problems with multi-line Subject: headers. > - Fixed bugs with some MTAs when keeping spam archive clean. > - %vars% in MailScanner.conf are now handled properly in "other" > settings. > - Fixed problem with correctly removing Phishing frauds from badly > formatted > html with missing tags before corresponding . > - Fixed problem with message duplication on some sendmail systems. > - Worked around Perl bug causing crashes with a few bounces from Hotmail. > Although it isn't listed in the changelog, I assume this version has the SPF fix introduced in 4.37.3 on Dec 14. Mark Nienberg ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From myeasytech at YAHOO.COM.HK Thu Dec 30 07:40:30 2004 From: myeasytech at YAHOO.COM.HK (hkbyte) Date: Thu Jan 12 21:28:03 2006 Subject: Block outgoing bcc Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am working with a solution to block user to send out email by using bcc. My idea is grapping the "Envelope recipient" during the SMTP conversation and then check with all To: and CC: headers, if the envelope recipient do not appear in the headers, the email is rejected. Is there any help MailScanner can do ? Or where can I put my own Perl Script if working with MailScanner. hkbyte ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Thu Dec 30 09:16:33 2004 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:28:03 2006 Subject: Freshclam Location Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike McMullen wrote: > I'm setting up a new mail server. I just installed > MailScanner-4.36.4-1. I tried > installing it from the tar file, had a few issues and then tried > installing it from > the RPMs on an FC2 system. This all went ok. > > Now however I get the following messages in my logs regarding ClamAV auto > updates: > > Dec 29 17:31:23 mail update.virus.scanners: Delaying cron job up to > 600 seconds > Dec 29 17:38:54 mail update.virus.scanners: Found clamav installed > Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for clamav > Dec 29 17:38:54 mail ClamAV-autoupdate[11389]: ClamAV updater > /usr/local/bin/freshclam cannot be run > Dec 29 17:38:54 mail update.virus.scanners: Found generic installed > Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for > generic > > My freshclam location is /usr/bin/freshclam. Where can I tell > Mail-Scanner to find > it there? you have to remove the tar-version # make uninstall or eg. # rm /usr/local/bin/freshlam if you get permission-errors whith /usr/bin/freshclam set the permissions for the user clamav # chown clamav:clamav /path/to/error-files -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 09:19:37 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: MailScanner ANNOUNCE beta 4.37.6 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Marco Benton - BOFH wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Raymond Dijkxhoorn wrote: > | hi! > | > |>> release before the stable release at the start of January, so I would > |>> appreciate it if you could help test it for me. > | > | > |> <...snip...> > |> > |> is it me or does the version still say "MailScanner E-Mail Virus > Scanner > |> version 4.37.5 starting..."? > | > | > | No, its not you ... ;) > | > | MailScanner E-Mail Virus Scanner version 4.37.5 starting... > | > | But more important, does it seems to run just fine ? :) > > seems to run fine so far... was wondering if a module didnt make it > into the install or did i screw up something (which i usually do on > purpose). :) > > thanx. Sorry, my mistake. It's just what it prints. I will obviously fix this for the stable release. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 09:24:12 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: NOD32 integration with MailScanner.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike Allen wrote: > To All: > > My email server consists of the following: > > 2 each 2.20 MHZ CPUs > 4 GB RAM > Cyrus-imap email server v 2.0.16 w/SSL > OS: FreeBSD v5.1 -p 18 > Antivirus: ClamAV v 0.71 (yes, I know I need to upgrade to v 0.80) > > I have purchased NOD32 version 2.0 Enterprise edition for Unix. Other > than adding 'nod32' to > the "Virus Scanners = clamav nod32" configuration item, I am not sure > what to do. Send yourself some test messages with a virus in them (see www.eicar.org for the virus test file) and see if you get nod32 reports in them. If you have installed nod32 somewhere non-standard then check /etc/MailScanner/virus.scanners.conf. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 09:34:05 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: Block outgoing bcc Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You could do this with a Custom Function attached to the Non Spam Actions option. This could check the message, then return 'store' or 'delete' for messages it didn't like and 'deliver' for messages it did. hkbyte wrote: > I am working with a solution to block user to send out email by using > bcc. My idea is grapping the "Envelope recipient" during the SMTP > conversation and then check with all To: and CC: headers, if the > envelope recipient do not appear in the headers, the email is rejected. > Is there any help MailScanner can do ? Or where can I put my own Perl > Script if working with MailScanner. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 09:26:36 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: Freshclam Location Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] See /etc/MailScanner/virus.scanners.conf for the setting you need. Mike McMullen wrote: > Hi All, > > I'm setting up a new mail server. I just installed > MailScanner-4.36.4-1. I tried > installing it from the tar file, had a few issues and then tried > installing it from > the RPMs on an FC2 system. This all went ok. > > Now however I get the following messages in my logs regarding ClamAV auto > updates: > > Dec 29 17:31:23 mail update.virus.scanners: Delaying cron job up to > 600 seconds > Dec 29 17:38:54 mail update.virus.scanners: Found clamav installed > Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for clamav > Dec 29 17:38:54 mail ClamAV-autoupdate[11389]: ClamAV updater > /usr/local/bin/freshclam cannot be run > Dec 29 17:38:54 mail update.virus.scanners: Found generic installed > Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for > generic > > My freshclam location is /usr/bin/freshclam. Where can I tell > Mail-Scanner to find > it there? > > Thanks, > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 09:29:32 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: MailScanner ANNOUNCE beta 4.37.6 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yes.It escaped the Change log. >> > Although it isn't listed in the changelog, I assume this version has the > SPF fix introduced in 4.37.3 on Dec 14. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Dec 30 13:55:52 2004 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:28:03 2006 Subject: Question about QuarantineReport-Script and MS Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi there, and sorry for the late answer.. On Thu, 23 Dec 2004, Steve Swaney wrote: [...] > > I haven't followed the whole thread so I may be off base here but since one > of our staffers wrote the release from quarantine script on our website I'm > at least familiar with it. > > If you're using a release from quarantine script, you should set your MTA to > split a message to multiple recipients into individual emails one for each > recipient. This way each recipient can release their own email. > as i haven´t change a thing, but it seems to split those mails for every recipient, i guess ms does this for me ;) My Problem is not that it is not splitting those mails.. as the mails got scanned via MS, and the script need to send those mails via sendmail, i had to insert the postmaster into the whitelists for ms and spamassassin. thats the first thing.. second: as the script only handles mails saved in complete, all mails considered as virus-infected are also saved in one message-file.. so, if someone of my users would like to have this mails delivered, i have to use the command sendmail -toi ... but..this only puts the mail into the ms-check-queue.. so, the mail again will be considered virus-infected..only workaround (as far as i can see it) is to stop ms, start only sendmail, deliver this mail, sto sendmail again, and start ms again.. a bit unhandy..i think.. or i could put the sender in the "not to scan"-list. So it would be easy to use queue-files again, as i can put those two files for the mail into the mailqueue for sendmail itself..and sendmail would send it without ms interfering... So my idea was the following two: idea 1: Julian could insert some extra config on virus-infected and spam-infected mails, how to save those two..so, everyone could switch the toggle for himself..so i would save spams as one message file and virus-infected as queue-files. idea 2: There is the "clean-quarantine"-script written by julian.. maybe there would be the possiblity to create a script which could go throgu the spam-dirs, and send the users one report, only with the from-header, the subject and the message-id.As this are only the infos, the would receive, after creating the notify-mail.. But..as some users are receiving a lot of spam, they say, that those notify-mails are even like spam in their eyes..as those mails are created on _every_ incoming mail..they would love to have only one mail a day.. maybe someone could make a ruleset for the recipients.. for those, who do not care just create a mail on very incoming mail, for those, with a lot mails (like me..about 100 a day) one report a day..does not need to be an html-script, for those to click on..just makes their live a lot easier..but they never said a word about just receiving the info-mail and they had to send this to the postmaster, who could release the mail again..if the wanted to.. But..the script should be made clear, that it only sends mail to those users, who really want those mails..so default should be "no report at all", as some spams, do have in their "To-Field" again the sender of the spam, and the real recipient on my maschine only in the bcc or cc fields.. and if i cannot stop those mails to be sended out to the senders, i would send a lot unwanted mails around.. ;) (I hope everything was understandable until this point!) @steve: The Quarantine-Script works like a charm, but i had to do some adjustments to my configs and to the script, maybe i could give some hints for the readme-file? 1. You should make clear, that the user has to change the url within the Emails.pm..because if they do not change it, the link would be something like "http://osiris...". So this would be really important ;) 2. You should point out, that they should check for the chgrp-command, because for example on my maschine, the webserveris _not_ running within the group apache.. 3. Someone should check the links to the original-files..as the webserver on my maschine for example was not able to read those mail-files, as they are original only readable for the mail-server.. and not for his group or something like that. I think the copy-command would help a lot here? 4. To release those mails, ms and sa should know postmaster as whitelisted..or not check the mails from postmaster@localhost, because else the mails will not slip through.. 5. Make clear, that only whole message-files are handled..no queue-files.. So..what i am saying is: The Quarantine-Script works fine..after some adjustments..but, as the user never said a word about the original notify-mail, but only said a word about the amount of notifies (if they receive a lot of spam), the option only to send one big notify-mail in the form of the original-notify-mail, but with all spam-mails of that day, maybe this would be a great idea for the future release of ms? So.. that should be it.. wish you all a great new year.. Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Thu Dec 30 14:45:16 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:03 2006 Subject: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? Message-ID: Hi, Can anyone point me at a sendmail equivalent of zmailer's MaxSameIPsource ? I want to limit the maximum number simultaneous connections from a single IP, as I've been hit several times over the last few days by 50+ connections from a single source that never complete. A quick look at one IP on openrbl suggests this may be spam or virus related, and I will look deeper into the problem, but I'd like to put this safeguard in - OOM no fun :( Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 14:56:40 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Look in CustomConfig.pm for the IPBlock stuff. It's all there, ready to roll. There's even the associated cron job there for tidying up the database. paddy wrote: >Hi, > >Can anyone point me at a sendmail equivalent of zmailer's MaxSameIPsource ? > >I want to limit the maximum number simultaneous connections from a single >IP, as I've been hit several times over the last few days by 50+ connections >from a single source that never complete. A quick look at one IP on >openrbl suggests this may be spam or virus related, and I will look deeper >into the problem, but I'd like to put this safeguard in - OOM no fun :( > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 15:00:35 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Oops, sorry, just read your posting again (more carefully this time). The IPBlock code doesn't limit the max number of simultaneous connections, it limits the max number of messages per hour accepted from any particular IP address, thereby choking spam zombies. Still, it's not exactly what you were asking for, but it might solve your problem via a different route. Julian Field wrote: > Look in CustomConfig.pm for the IPBlock stuff. It's all there, ready to > roll. There's even the associated cron job there for tidying up the > database. > > paddy wrote: > >> Hi, >> >> Can anyone point me at a sendmail equivalent of zmailer's >> MaxSameIPsource ? >> >> I want to limit the maximum number simultaneous connections from a >> single >> IP, as I've been hit several times over the last few days by 50+ >> connections >> from a single source that never complete. A quick look at one IP on >> openrbl suggests this may be spam or virus related, and I will look >> deeper >> into the problem, but I'd like to put this safeguard in - OOM no fun :( > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Thu Dec 30 15:00:51 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: On Wed, Dec 29, 2004 at 07:54:22PM +0000, Drew Marshall wrote: > Steen, Glenn wrote: > > >I'm not sure the "rift" would be healed that easy. Not unless we stop > >perusing the queue files directly and start using one of the "official" > >interfaces ([SMTP|LOCAL|PIPE], IIRC). I don't agree with Mr Venema on > >this > >point, I think we can view the queue files as "public interfaces" as > >long > >as there's publicly available source that details how it's "come > >together", > >but then again... I really don't think he cares what I think:-). > > > > > Or indeed any one else :-( > > >One could dream up a solution around the pipe interface where we could > >invent a "MailScanner-Postfix" file format (I think someone already did > >that once or twice), but I don't see much point in it... With the latest > >fixes to make the (copied) queue files unique and the HOLD setup it is > >pretty darned safe to use... and fast:-). > > > > > > >IMO this seems to be less of a technical problem anymore, and more a > >political/philosophical (and perhaps personal) thing. Just ignore the > >postfix-users list and go on being happy with MailScanner and Postfix;). > > > > > I have to agree whole heartedly with all of the above. I have kinda > reached that point myself. It works and works well so why should I worry > about what the Postfix users list thinks? Their loss, my gain (IMHO). I do! Not even being a postfix user myself, you'd probably be happiest ignoring my curiosity as well ! ;) I get the general idea ... I'm interested in the details. I understand the "official" interfaces idea just fine. What fascinates me is the question: What is wrong with the sanctioned interfaces provided? How is it not a technical problem? (bear in mind, I know next to nothing about postfix, but I'm aware, for example of ordinary unix pipes, or even of LMTP. I believe I understand, for example, why mailscanner can't be a milter) In the past I've asked questions that had difficult answers and had to turn my whole intuition upside-down to comprehend them, but the experience is generally positive in the end. I see technologies like mailscanner picking up where the traditional MTA leaves off, and not without friction. I'm deliriously happy with what I have, but not yet so complacent as to believe that I can't learn more or that what I have can't be improved. Worse than that, I have the time for writing turgid apologies like this one ;) Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Thu Dec 30 15:12:26 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:03 2006 Subject: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? Message-ID: On Thu, Dec 30, 2004 at 02:56:40PM +0000, Julian Field wrote: > Look in CustomConfig.pm for the IPBlock stuff. It's all there, ready to > roll. There's even the associated cron job there for tidying up the > database. Thanks Julian, but it's before that :( These connections don't seem to progress beyond RCPT, so it's neither a mailscanner issue, nor something mailscanner can help with, hence [OT]. I'm aware of MaxDaemonChildren and will be setting that anyway, but something along the lines of MaxSameIPsource would be really nice. I don't think I can even use a milter, this sendmail is too old. So this is just a ping off the list 1) In case I've missed an obvious way of doing this 2) to share the experience - I've not noticed this pattern before, and it is a potential nuisance and possibly spam or malware related. Whatabout some more general OS level connection limiting, anyone? linux-2.2, can I squeeze this out of the firewalling or something ? Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 15:14:10 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >I get the general idea ... I'm interested in the details. I understand the >"official" interfaces idea just fine. What fascinates me is the question: > >What is wrong with the sanctioned interfaces provided? > >How is it not a technical problem? > > MailScanner is built on the basis that what it does is take messages from one queue, clean them up, and put them in another queue. That's the fundamental design of MailScanner, and it's a very simple one. That's the way it is. In Postfix's case, the "sanctioned interfaces" don't provide for any way of implementing MailScanner's design, without changing the whole way MailScanner works. Which I am not prepared to do. Quite reasonably, I think. Wietse thought up a way for programs to interface with Postfix, and stamps his feet saying that everyone must use the method *he* thought of. He didn't think of anyone doing it the way I did, so he says I'm wrong. It's an odd area of engineering where a novel design is wrong just because someone else didn't think of it first. Yes, it is a technical problem. But not one I can/will solve the way Wietse wants me to. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Thu Dec 30 15:16:17 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:03 2006 Subject: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? Message-ID: On Thu, Dec 30, 2004 at 03:00:35PM +0000, Julian Field wrote: > Oops, sorry, just read your posting again (more carefully this time). > The IPBlock code doesn't limit the max number of simultaneous > connections, it limits the max number of messages per hour accepted from > any particular IP address, thereby choking spam zombies. Still, it's not > exactly what you were asking for, but it might solve your problem via a > different route. Yeah, I'm at the thinking out loud stage. IPblock turns out to have been a helpful suggestion - I'm quite entertained by the prospect of simply dropping their packets in the bit-bucket :) Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Dec 30 15:20:38 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:03 2006 Subject: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? Message-ID: I had a similar thing a couple of weeks back. Found out, in MailWatch that the culprit never had any "legal" communication with us, so I ended up blocking the IP in the FW. Linux-2.2 == Kernel 2.2.x? ... Meaning ipchains? Been to long for me to remember how:-). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of paddy > Sent: den 30 december 2004 16:12 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? > > > On Thu, Dec 30, 2004 at 02:56:40PM +0000, Julian Field wrote: > > Look in CustomConfig.pm for the IPBlock stuff. It's all > there, ready to > > roll. There's even the associated cron job there for tidying up the > > database. > > Thanks Julian, but it's before that :( > > These connections don't seem to progress beyond RCPT, so it's neither > a mailscanner issue, nor something mailscanner can help with, > hence [OT]. > > I'm aware of MaxDaemonChildren and will be setting that anyway, but > something along the lines of MaxSameIPsource would be really nice. > I don't think I can even use a milter, this sendmail is too old. > > So this is just a ping off the list > > 1) In case I've missed an obvious way of doing this > 2) to share the experience - I've not noticed this pattern before, and > it is a potential nuisance and possibly spam or malware related. > > Whatabout some more general OS level connection limiting, anyone? > linux-2.2, can I squeeze this out of the firewalling or something ? > > Regards, > Paddy > -- > Perl 6 will give you the big knob. -- Larry Wall > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 15:19:28 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] At this rate I might as well publish a book entitled something along the lines of "Jules' writings on all things MailScanner". I imagine it would be a cross between similar volumes by Chairman Mao and Tim O'Reilly. :-) Julian Field wrote: > MailScanner is built on the basis that what it does is take messages > from one queue, clean them up, and put them in another queue. That's the > fundamental design of MailScanner, and it's a very simple one. That's > the way it is. > > In Postfix's case, the "sanctioned interfaces" don't provide for any way > of implementing MailScanner's design, without changing the whole way > MailScanner works. Which I am not prepared to do. Quite reasonably, I > think. Wietse thought up a way for programs to interface with Postfix, > and stamps his feet saying that everyone must use the method *he* > thought of. He didn't think of anyone doing it the way I did, so he says > I'm wrong. > > It's an odd area of engineering where a novel design is wrong just > because someone else didn't think of it first. > > Yes, it is a technical problem. But not one I can/will solve the way > Wietse wants me to. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vlad at MAZEK.COM Thu Dec 30 15:21:01 2004 From: vlad at MAZEK.COM (Vlad Mazek) Date: Thu Jan 12 21:28:03 2006 Subject: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] There is some excellent code in Vispan that you can tweak to do this with sendmail. Essentially scan the maillog for the logged connections and write to access.db (or iptables/ipchains) to reject further connections. By default Vispan only scans for viruses and spam but you can easilly implement that for any host that shows up in the logs. You can find more about vispan at http://www.while.homeunix.net/mailstats/ -Vlad >Hi, > >Can anyone point me at a sendmail equivalent of zmailer's MaxSameIPsource ? > >I want to limit the maximum number simultaneous connections from a single >IP, as I've been hit several times over the last few days by 50+ connections >from a single source that never complete. A quick look at one IP on >openrbl suggests this may be spam or virus related, and I will look deeper >into the problem, but I'd like to put this safeguard in - OOM no fun :( > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Dec 30 15:37:42 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: den 30 december 2004 16:14 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Postfix and Mailscanner sitting in a tree k-iss-ing > > > >I get the general idea ... I'm interested in the details. I > understand the > >"official" interfaces idea just fine. What fascinates me is > the question: > > > >What is wrong with the sanctioned interfaces provided? > > > >How is it not a technical problem? > > > > > MailScanner is built on the basis that what it does is take messages > from one queue, clean them up, and put them in another queue. > That's the > fundamental design of MailScanner, and it's a very simple one. That's > the way it is. > > In Postfix's case, the "sanctioned interfaces" don't provide > for any way > of implementing MailScanner's design, without changing the whole way > MailScanner works. Which I am not prepared to do. Quite reasonably, I > think. Wietse thought up a way for programs to interface with Postfix, > and stamps his feet saying that everyone must use the method *he* > thought of. He didn't think of anyone doing it the way I did, > so he says > I'm wrong. > > It's an odd area of engineering where a novel design is wrong just > because someone else didn't think of it first. > > Yes, it is a technical problem. But not one I can/will solve the way > Wietse wants me to. Just so Julian (spotted this while s-l-o-w-l-y typing a reply to Paddy:). What I mean by saying it's not really a "technical" problem is that it is rather a problem of "colliding ideas" or "policy", if you will. In my book (still to be written:), "policy" short of bearing the mark of "standard" is just another word for politics and/or philosophy... Which sometimes takes the form of shouting at the top of ones lung-capacity "I'm right! You are wrong!", and sometimes ... milder forms of agrements to disagree. Anyway... You're doing a splendid job of supporting an "unsupported solution", so... I'm happy enough with that:-). Have a Fun&Fulfilling Happy New Year! -- Glenn > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Dec 30 15:45:00 2004 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: See, I said it was about politics/philosophy:-):-):-) -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: den 30 december 2004 16:19 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Postfix and Mailscanner sitting in a tree k-iss-ing > > > At this rate I might as well publish a book entitled > something along the > lines of "Jules' writings on all things MailScanner". I > imagine it would > be a cross between similar volumes by Chairman Mao and Tim O'Reilly. > :-) > > Julian Field wrote: > > > MailScanner is built on the basis that what it does is take messages > > from one queue, clean them up, and put them in another > queue. That's the > > fundamental design of MailScanner, and it's a very simple > one. That's > > the way it is. > > > > In Postfix's case, the "sanctioned interfaces" don't > provide for any way > > of implementing MailScanner's design, without changing the whole way > > MailScanner works. Which I am not prepared to do. Quite > reasonably, I > > think. Wietse thought up a way for programs to interface > with Postfix, > > and stamps his feet saying that everyone must use the method *he* > > thought of. He didn't think of anyone doing it the way I > did, so he says > > I'm wrong. > > > > It's an odd area of engineering where a novel design is wrong just > > because someone else didn't think of it first. > > > > Yes, it is a technical problem. But not one I can/will solve the way > > Wietse wants me to. > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Thu Dec 30 16:12:41 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:03 2006 Subject: [OT] sendmail equivalent of zmailer's MaxSameIpSource ?? Message-ID: On Thu, Dec 30, 2004 at 10:21:01AM -0500, Vlad Mazek wrote: > There is some excellent code in Vispan that you can tweak to do this > with sendmail. Essentially scan the maillog for the logged connections > and write to access.db (or iptables/ipchains) to reject further > connections. By default Vispan only scans for viruses and spam but you > can easilly implement that for any host that shows up in the logs. > > You can find more about vispan at http://www.while.homeunix.net/mailstats/ > > -Vlad Thanks. One of the things that threw me initially is the paucity of logging for these connections (LogLevel 9). The direction I'm currently heading in is something like this: netstat -n | grep :25 | cut -c45-65 | sed 's/:.*//' | sort | uniq -c | egrep "^ *[0-9]{2}" then I'm thinking, poor man's snort: tcpdump -s0 -w host $IP 'cos I'd like to know what's going on ... up to some number of connections, after which I'll just block them on the firewalling I'm also looking to see if there's a setting of sendmail's LogLevel that I'd be more comfortable with. The number of connections seems to ramp up over some time (half-an-hour or more) so I figure sh and cron will be enough for now. Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Thu Dec 30 16:57:07 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: On Thu, Dec 30, 2004 at 03:19:28PM +0000, Julian Field wrote: > At this rate I might as well publish a book entitled something along the > lines of "Jules' writings on all things MailScanner". I imagine it would > be a cross between similar volumes by Chairman Mao and Tim O'Reilly. > :-) > Julian Field wrote: > > >MailScanner is built on the basis that what it does is take messages > >from one queue, clean them up, and put them in another queue. That's the > >fundamental design of MailScanner, and it's a very simple one. That's > >the way it is. Yep, got this. Can't see a problem here: this is just email. I would say that ... MailScanner dequeues messages from an MTA queues them for itself, (does arbitrary and unspeakable things to them ;) and then eventually queues some messages at an MTA since MTA appears to be subclassed in the code. The problem is at the interface to postfix ... ? If I had to implement it for myself, I imagine I'd quite like to do the initial dequeue and final queue by file ops: sounds simple and cheap to me. But I can't yet see how the detail of how this is implemented get's its tendrils deep enough into the code to get to ... > >In Postfix's case, the "sanctioned interfaces" don't provide for any way > >of implementing MailScanner's design, without changing the whole way > >MailScanner works. So, just for the sake of understanding, what would such a change look like? just roughly. > >Which I am not prepared to do. Quite reasonably, I think. If that's really what its a case of, then you'll get no argument from me. Indeed, 'quite reasonable' sums it up rather well :) For that matter, not doing it, simply 'cos you're not _that_ interested in it would be simply dandy by me. I don't use postfix and have no plans to, so an actual implementation matters not one jot to me. Understanding what the big deal is, I place value on, because, for me at least, it can sometimes be a sign of something worth learning. > >Wietse thought up a way for programs to interface with Postfix, > >and stamps his feet saying that everyone must use the method *he* > >thought of. I've always thought (from the comfort of afar) of the postfix as more evolutionary than revolutionary, perhaps I missed something. I think I know what you mean though! > >He didn't think of anyone doing it the way I did, Ah! but did you file that patent on moving files in and out of queues yet! ;) > >so he says I'm wrong. > >It's an odd area of engineering where a novel design is wrong just > >because someone else didn't think of it first. > > > >Yes, it is a technical problem. But not one I can/will solve the way > >Wietse wants me to. Okay, here's a guess, based on nothing more than idle speculation, and a lifetime of cynicism: The current mailscanner implementation is the best that anyone, who is concerned with down-to-earth things like MailScanner performance, etc, has come up with - it works and is supported by Julian (which is worth at least his weight in gold, incidentally) - and users are happy. Chances are it doesn't sit well with the postfix design, and so Wietse is not willing to support it. Naturally not supporting it means telling people you don't support it, which entails explaining ... you can see where this is going. Add a dash of historical teething problems. I still eager to be surprised by a description of why it would be _technically_ difficult to implement a solution that could earn the Wietse gold seal of approval. My guess would be that noone is motivated to do so, and why should they be? Tell me I'm wrong. Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Dec 30 16:36:00 2004 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > > Drew, > > Awsome, you guys are great. I will do my best. > Please send me the (real) URL of your FAQ entry, I could put that up the MAQ page. Ugo > Schrock ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Thu Dec 30 17:19:08 2004 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:28:03 2006 Subject: Bitdefender doesn't seem to do anything but update Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have bitdefender installed with a relatively new version of MS. I get nothing except update.virus.scanner messages in my logs concerning bitdefender. It never seems to find anything. MailWatch shows nothing also.I have looked through MAQ/FAQ and everything else I can think of with no results to help. A tip would be most appreciated. An answer would even be better. I have done a 'which bdc' to make sure my virus.scanner.conf file is pointing properly (/usr ) and I have sent test viruses to my account to see if it will catch anything. Only ClamAV ever catches anything. I don't have a clue why bitdefender is idle. Does anyone have a clue? Thanks Steve Campbell campbell@cnpapers.com Charleston Newspapers ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mlm at LOANPROCESSING.NET Thu Dec 30 17:23:22 2004 From: mlm at LOANPROCESSING.NET (Mike McMullen) Date: Thu Jan 12 21:28:03 2006 Subject: Solved: Re: Freshclam Location Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ----- Original Message ----- From: "shrek-m@gmx.de" > Mike McMullen wrote: > >> I'm setting up a new mail server. I just installed >> MailScanner-4.36.4-1. I tried >> installing it from the tar file, had a few issues and then tried >> installing it from >> the RPMs on an FC2 system. This all went ok. >> >> Now however I get the following messages in my logs regarding ClamAV auto >> updates: >> >> Dec 29 17:31:23 mail update.virus.scanners: Delaying cron job up to >> 600 seconds >> Dec 29 17:38:54 mail update.virus.scanners: Found clamav installed >> Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for clamav >> Dec 29 17:38:54 mail ClamAV-autoupdate[11389]: ClamAV updater >> /usr/local/bin/freshclam cannot be run >> Dec 29 17:38:54 mail update.virus.scanners: Found generic installed >> Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for >> generic >> >> My freshclam location is /usr/bin/freshclam. Where can I tell >> Mail-Scanner to find >> it there? > > > you have to remove the tar-version > # make uninstall > > or eg. > # rm /usr/local/bin/freshlam > > > if you get permission-errors whith /usr/bin/freshclam > set the permissions for the user clamav > > # chown clamav:clamav /path/to/error-files > > -- > shrek-m > Hi shrek, this cleaned up my mess nicely. Thanks to everyone else who suggested editing the virus.scanners.conf. Doing that got the updating going. Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Dec 30 17:31:09 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > At this rate I might as well publish a book entitled something along the > lines of "Jules' writings on all things MailScanner". I imagine it would > be a cross between similar volumes by Chairman Mao and Tim O'Reilly. > :-) :-) :-D -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Dec 30 17:45:08 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:28:03 2006 Subject: Bitdefender doesn't seem to do anything but update Message-ID: At 12:19 PM 12/30/2004, Steve Campbell wrote: >I have bitdefender installed with a relatively new version of MS. I get >nothing except update.virus.scanner messages in my logs concerning >bitdefender. It never seems to find anything. MailWatch shows nothing also.I >have looked through MAQ/FAQ and everything else I can think of with no >results to help. A tip would be most appreciated. An answer would even be >better. > >I have done a 'which bdc' to make sure my virus.scanner.conf file is >pointing properly (/usr ) and I have sent test viruses to my account to see >if it will catch anything. Only ClamAV ever catches anything. > >I don't have a clue why bitdefender is idle. Does anyone have a clue? In MailScanner.conf, does the "Virus Scanners" setting contain bitdefender? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Dec 30 17:45:30 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] paddy wrote: >Chances are it doesn't sit well with the postfix design, and so Wietse >is not willing to support it. Naturally not supporting it means telling >people you don't support it, which entails explaining ... you can see >where this is going. > >Add a dash of historical teething problems. > >I still eager to be surprised by a description of why it would be >_technically_ difficult to implement a solution that could earn the >Wietse gold seal of approval. > > Problem is that any such solution would involve extra overhead. For example you could use some form of SMTP/ LMTP interface, either the Perl module (Like AMAVIS) or even a stripped down version of Exim or Sendmail but that means running effectively two SMTP servers, more to go wrong and extra overhead. After all if you wanted to use Exim you would full stop... You have to pipe to a program but MS is not built like that and you would have to change the whole processing idea (And indeed lose batch processing and therefore the benefits of bulk scanning speed) and the potential security of allowing the MTA to queue messages in a back log should it become over whelmed due to a virus break for example. You see the problem. MS doesn't fit because it has a unique design which was not thought about when Postfix (And indeed any MTA) was thought about) >My guess would be that noone is motivated to do so, and why should they be? > > I don't think it is motivation but simply recognition that square pegs don't fit well in round holes, so you have to make a decision that you like the peg and live with it's poorer fit (In some people's eyes) or you change one element (Hole or peg). Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 18:00:20 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Very good summary. You just saved me a whole load of typing and thinking. I would have to pipe messages out of Postfix, implementing my own entire robust queueing system, process them and then feed them back into Postfix by some "sanctioned" method, with another queue to buffer the MailScanner-->Postfix interface. Very messy. Incidentally, something in the same vein has already been done for Communigate Pro, but I have never looked at that. I suspect (though without evidence either way) that it is not approx. 100% robust in the face of a concerted DoS attack. I go to some lengths to try to ensure that, when under attack, the MTA will give out long before MailScanner does. Thanks for your well thought-out explanation, Drew! Drew Marshall wrote: > paddy wrote: > >> Chances are it doesn't sit well with the postfix design, and so Wietse >> is not willing to support it. Naturally not supporting it means telling >> people you don't support it, which entails explaining ... you can see >> where this is going. >> >> Add a dash of historical teething problems. >> >> I still eager to be surprised by a description of why it would be >> _technically_ difficult to implement a solution that could earn the >> Wietse gold seal of approval. >> >> > Problem is that any such solution would involve extra overhead. For > example you could use some form of SMTP/ LMTP interface, either the Perl > module (Like AMAVIS) or even a stripped down version of Exim or Sendmail > but that means running effectively two SMTP servers, more to go wrong > and extra overhead. After all if you wanted to use Exim you would full > stop... > > You have to pipe to a program but MS is not built like that and you > would have to change the whole processing idea (And indeed lose batch > processing and therefore the benefits of bulk scanning speed) and the > potential security of allowing the MTA to queue messages in a back log > should it become over whelmed due to a virus break for example. > > You see the problem. MS doesn't fit because it has a unique design which > was not thought about when Postfix (And indeed any MTA) was thought > about) > >> My guess would be that noone is motivated to do so, and why should >> they be? >> >> > I don't think it is motivation but simply recognition that square pegs > don't fit well in round holes, so you have to make a decision that you > like the peg and live with it's poorer fit (In some people's eyes) or > you change one element (Hole or peg). > > Drew > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MHewryk at SYMCOR.COM Thu Dec 30 18:13:01 2004 From: MHewryk at SYMCOR.COM (Magda Hewryk) Date: Thu Jan 12 21:28:03 2006 Subject: How to tune RBL checks and Spam score Message-ID: Hi, Two questions about scoring SPAM because thousands of emails on our system are not flagged correctly as SPAM: 1.) I'd like all emails detected by RBL as spam to be marked as spam, regardless of the required SpamAssassin score. How can I accomplish it? For example the following email was not marked as spam and it was a spam. LOG: ======= 30 07:59:32 host MailScanner[5299]: RBL checks: iBUCxTIt027267 found in SBL+XBL, DSBL, spamcop.net Dec 30 07:59:43 mailgw02 MailScanner[5299]: Message iBUCxTIt027267 from 99.99.99.99 (ixxx@fxxx.com) to xxx.com i s spam, SBL+XBL, DSBL, spamcop.net, SpamAssassin (score=0.704, required 4.9, BAYES_44 -0.00, MSGID_FROM_MTA_HEADER 0.70) Dec 30 07:59:43 hostMailScanner[5299]: Spam Checks: Found 1 spam messages Dec 30 07:59:43 host MailScanner[5299]: Spam Actions: message iBUCxTIt027267 actions are deliver 2.) How can I make sure BAYES_xx doesn't sscore with eg. "1-1.43"? LOG: ======== Dec 28 14:19:46 host MailScanner[26230]: Spam Checks: Starting Dec 28 14:19:46 host MailScanner[26230]: RBL checks: iBSJJdvB029996 found in SBL+XBL, DSBL, spamcop.net Dec 28 14:19:48 host MailScanner[26230]: Message iBSJJdvB029996 from 99.99.99.99(rxxx@base.com.br) to xxx.com is spam, SBL+XBL, DSBL, spamcop.net, SpamAssassin (score=-1.428, required 4.9, autolearn=not spam, BAYES_20 -1.43) Dec 28 14:19:48 mailgw01 MailScanner[26230]: Spam Checks: Found 1 spam messages Thanks, Magda Hewryk -------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Thu Dec 30 18:15:06 2004 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:28:03 2006 Subject: Bitdefender doesn't seem to do anything but update Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ----- Original Message ----- From: "Matt Kettler" To: Sent: Thursday, December 30, 2004 12:45 PM Subject: Re: Bitdefender doesn't seem to do anything but update > At 12:19 PM 12/30/2004, Steve Campbell wrote: > >I have bitdefender installed with a relatively new version of MS. I get > >nothing except update.virus.scanner messages in my logs concerning > >bitdefender. It never seems to find anything. MailWatch shows nothing also.I > >have looked through MAQ/FAQ and everything else I can think of with no > >results to help. A tip would be most appreciated. An answer would even be > >better. > > > >I have done a 'which bdc' to make sure my virus.scanner.conf file is > >pointing properly (/usr ) and I have sent test viruses to my account to see > >if it will catch anything. Only ClamAV ever catches anything. > > > >I don't have a clue why bitdefender is idle. Does anyone have a clue? > > In MailScanner.conf, does the "Virus Scanners" setting contain bitdefender? > Matt, This seems so obvious, I almost refused to reply. But of course, the obvious is usually what bites you. At some time, bitdefender got removed from my conf file. It was so simple, I just couldn't look there to begin with. I don't know when I removed it, though. I do know the update script caused me a little problem, so maybe it was then. Thanks, Matt, for making me blush. I deserve it. Happy new year to all. Steve Campbell campbell@cnpapers.com Charleston Newspapers ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 18:22:39 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: How to tune RBL checks and Spam score Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Magda Hewryk wrote: >Hi, > >Two questions about scoring SPAM because thousands of emails on our system >are not flagged correctly as SPAM: > >1.) >I'd like all emails detected by RBL as spam to be marked as spam, >regardless of the required SpamAssassin score. >How can I accomplish it? > > See the "Spam List" setting in MailScanner.conf. This does exactly what you want. >For example the following email was not marked as spam and it was a spam. > >LOG: >======= >30 07:59:32 host MailScanner[5299]: RBL checks: iBUCxTIt027267 found in >SBL+XBL, DSBL, spamcop.net >Dec 30 07:59:43 mailgw02 MailScanner[5299]: Message iBUCxTIt027267 from >99.99.99.99 (ixxx@fxxx.com) to xxx.com i >s spam, SBL+XBL, DSBL, spamcop.net, SpamAssassin (score=0.704, required >4.9, BAYES_44 -0.00, MSGID_FROM_MTA_HEADER 0.70) >Dec 30 07:59:43 hostMailScanner[5299]: Spam Checks: Found 1 spam messages >Dec 30 07:59:43 host MailScanner[5299]: Spam Actions: message >iBUCxTIt027267 actions are deliver > >2.) >How can I make sure BAYES_xx doesn't sscore with eg. "1-1.43"? > > ? It didn't. As Bayes was saying it probably wasn't spam (50% is the "no indication either way" point, >50% is spam, <50% is not spam) it knocked 1.43 off the score, which is entirely correct. If you want to change the scores for the different BAYES_* levels, then set their scores in spam.assassin.prefs.conf. >LOG: >======== >Dec 28 14:19:46 host MailScanner[26230]: Spam Checks: Starting >Dec 28 14:19:46 host MailScanner[26230]: RBL checks: iBSJJdvB029996 found >in SBL+XBL, DSBL, spamcop.net >Dec 28 14:19:48 host MailScanner[26230]: Message iBSJJdvB029996 from >99.99.99.99(rxxx@base.com.br) to xxx.com is >spam, SBL+XBL, DSBL, spamcop.net, SpamAssassin (score=-1.428, required 4.9, >autolearn=not spam, BAYES_20 -1.43) >Dec 28 14:19:48 mailgw01 MailScanner[26230]: Spam Checks: Found 1 spam >messages > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 18:25:18 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: Bitdefender doesn't seem to do anything but update Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Campbell wrote: >----- Original Message ----- >From: "Matt Kettler" >To: >Sent: Thursday, December 30, 2004 12:45 PM >Subject: Re: Bitdefender doesn't seem to do anything but update > > > > >>At 12:19 PM 12/30/2004, Steve Campbell wrote: >> >> >>>I have bitdefender installed with a relatively new version of MS. I get >>>nothing except update.virus.scanner messages in my logs concerning >>>bitdefender. It never seems to find anything. MailWatch shows nothing >>> >>> >also.I > > >>>have looked through MAQ/FAQ and everything else I can think of with no >>>results to help. A tip would be most appreciated. An answer would even be >>>better. >>> >>>I have done a 'which bdc' to make sure my virus.scanner.conf file is >>>pointing properly (/usr ) and I have sent test viruses to my account to >>> >>> >see > > >>>if it will catch anything. Only ClamAV ever catches anything. >>> >>>I don't have a clue why bitdefender is idle. Does anyone have a clue? >>> >>> >>In MailScanner.conf, does the "Virus Scanners" setting contain >> >> >bitdefender? > > > >Matt, > >This seems so obvious, I almost refused to reply. But of course, the obvious >is usually what bites you. > >At some time, bitdefender got removed from my conf file. It was so simple, I >just couldn't look there to begin with. I don't know when I removed it, >though. I do know the update script caused me a little problem, so maybe it >was then. > >Thanks, Matt, for making me blush. I deserve it. > > This is a fine example of the situation that is why I wrote update_virus_scanners so that it updates all the virus scanners it finds installed, and not just the ones you are using in your MailScanner.conf setting. You can now add bitdefender back to the MailScanner.conf file, safe in the knowledge that it is already up to date with its virus signatures. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MHewryk at SYMCOR.COM Thu Dec 30 18:34:36 2004 From: MHewryk at SYMCOR.COM (Magda Hewryk) Date: Thu Jan 12 21:28:03 2006 Subject: How to tune RBL checks and Spam score Message-ID: Hi Julian, My Spam List is set. How can I make sure it overwrites a SpamAssassin Score? Spam List = SBL+XBL NJABL DSBL AHBL spamcop.net Required SpamAssassin Score = 4.9 Thanks, Magda Hewryk -------------------------------- Mid-Range Systems 905-273-1637 (Office) 416-554-0743 (Cell) Julian Field To Sent by: MAILSCANNER@JISCMAIL.AC.UK MailScanner cc mailing list Re: How to tune RBL checks and Spam score 12/30/2004 01:22 PM Please respond to MailScanner mailing list Magda Hewryk wrote: >Hi, > >Two questions about scoring SPAM because thousands of emails on our system >are not flagged correctly as SPAM: > >1.) >I'd like all emails detected by RBL as spam to be marked as spam, >regardless of the required SpamAssassin score. >How can I accomplish it? > > See the "Spam List" setting in MailScanner.conf. This does exactly what you want. >For example the following email was not marked as spam and it was a spam. > >LOG: >======= >30 07:59:32 host MailScanner[5299]: RBL checks: iBUCxTIt027267 found in >SBL+XBL, DSBL, spamcop.net >Dec 30 07:59:43 mailgw02 MailScanner[5299]: Message iBUCxTIt027267 from >99.99.99.99 (ixxx@fxxx.com) to xxx.com i >s spam, SBL+XBL, DSBL, spamcop.net, SpamAssassin (score=0.704, required >4.9, BAYES_44 -0.00, MSGID_FROM_MTA_HEADER 0.70) >Dec 30 07:59:43 hostMailScanner[5299]: Spam Checks: Found 1 spam messages >Dec 30 07:59:43 host MailScanner[5299]: Spam Actions: message >iBUCxTIt027267 actions are deliver > >2.) >How can I make sure BAYES_xx doesn't sscore with eg. "1-1.43"? > > ? It didn't. As Bayes was saying it probably wasn't spam (50% is the "no indication either way" point, >50% is spam, <50% is not spam) it knocked 1.43 off the score, which is entirely correct. If you want to change the scores for the different BAYES_* levels, then set their scores in spam.assassin.prefs.conf. >LOG: >======== >Dec 28 14:19:46 host MailScanner[26230]: Spam Checks: Starting >Dec 28 14:19:46 host MailScanner[26230]: RBL checks: iBSJJdvB029996 found >in SBL+XBL, DSBL, spamcop.net >Dec 28 14:19:48 host MailScanner[26230]: Message iBSJJdvB029996 from >99.99.99.99(rxxx@base.com.br) to xxx.com is >spam, SBL+XBL, DSBL, spamcop.net, SpamAssassin (score=-1.428, required 4.9, >autolearn=not spam, BAYES_20 -1.43) >Dec 28 14:19:48 mailgw01 MailScanner[26230]: Spam Checks: Found 1 spam >messages > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 18:44:58 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: How to tune RBL checks and Spam score Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The Spam List setting is entirely separate from the SpamAssassin score, it doesn't use SpamAssassin. Make sure the lists you are using are all defined in spam.lists.conf, or else they won't work. The AHBL list is not defined in the supplied spam.lists.conf so you will need to add that one yourself. The only other tweaks you can do are Minimum Stars If On Spam List which sets what gets reported to the user in the headers, Spam Lists To Reach High Score which sets what happens when a message hits multiple Spam Lists, Check SpamAssassin If On Spam List which controls whether it bothers running SpamAssassin on messages which have hit a Spam List, which saves lots of CPU and network time. Magda Hewryk wrote: >Hi Julian, > >My Spam List is set. How can I make sure it overwrites a SpamAssassin >Score? > > >Spam List = SBL+XBL NJABL DSBL AHBL spamcop.net >Required SpamAssassin Score = 4.9 > > >Thanks, > >Magda Hewryk >-------------------------------- >Mid-Range Systems >905-273-1637 (Office) >416-554-0743 (Cell) > > > > Julian Field > SOTON.AC.UK> To > Sent by: MAILSCANNER@JISCMAIL.AC.UK > MailScanner cc > mailing list > MAIL.AC.UK> Re: How to tune RBL checks and > Spam score > > 12/30/2004 01:22 > PM > > > Please respond to > MailScanner > mailing list > MAIL.AC.UK> > > > > > > >Magda Hewryk wrote: > > > >>Hi, >> >>Two questions about scoring SPAM because thousands of emails on our system >>are not flagged correctly as SPAM: >> >>1.) >>I'd like all emails detected by RBL as spam to be marked as spam, >>regardless of the required SpamAssassin score. >>How can I accomplish it? >> >> >> >> >See the "Spam List" setting in MailScanner.conf. This does exactly what >you want. > > > >>For example the following email was not marked as spam and it was a spam. >> >>LOG: >>======= >>30 07:59:32 host MailScanner[5299]: RBL checks: iBUCxTIt027267 found in >>SBL+XBL, DSBL, spamcop.net >>Dec 30 07:59:43 mailgw02 MailScanner[5299]: Message iBUCxTIt027267 from >>99.99.99.99 (ixxx@fxxx.com) to xxx.com i >>s spam, SBL+XBL, DSBL, spamcop.net, SpamAssassin (score=0.704, required >>4.9, BAYES_44 -0.00, MSGID_FROM_MTA_HEADER 0.70) >>Dec 30 07:59:43 hostMailScanner[5299]: Spam Checks: Found 1 spam messages >>Dec 30 07:59:43 host MailScanner[5299]: Spam Actions: message >>iBUCxTIt027267 actions are deliver >> >>2.) >>How can I make sure BAYES_xx doesn't sscore with eg. "1-1.43"? >> >> >> >> >? It didn't. As Bayes was saying it probably wasn't spam (50% is the "no >indication either way" point, >50% is spam, <50% is not spam) it knocked >1.43 off the score, which is entirely correct. If you want to change the >scores for the different BAYES_* levels, then set their scores in >spam.assassin.prefs.conf. > > > >>LOG: >>======== >>Dec 28 14:19:46 host MailScanner[26230]: Spam Checks: Starting >>Dec 28 14:19:46 host MailScanner[26230]: RBL checks: iBSJJdvB029996 found >>in SBL+XBL, DSBL, spamcop.net >>Dec 28 14:19:48 host MailScanner[26230]: Message iBSJJdvB029996 from >>99.99.99.99(rxxx@base.com.br) to xxx.com is >>spam, SBL+XBL, DSBL, spamcop.net, SpamAssassin (score=-1.428, required >> >> >4.9, > > >>autolearn=not spam, BAYES_20 -1.43) >>Dec 28 14:19:48 mailgw01 MailScanner[26230]: Spam Checks: Found 1 spam >>messages >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Thu Dec 30 18:51:29 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: On Thu, Dec 30, 2004 at 05:45:30PM +0000, Drew Marshall wrote: > paddy wrote: > > >Chances are it doesn't sit well with the postfix design, and so Wietse > >is not willing to support it. Naturally not supporting it means telling > >people you don't support it, which entails explaining ... you can see > >where this is going. > > > >Add a dash of historical teething problems. > > > >I still eager to be surprised by a description of why it would be > >_technically_ difficult to implement a solution that could earn the > >Wietse gold seal of approval. > > > > > Problem is that any such solution would involve extra overhead. For > example you could use some form of SMTP/ LMTP interface, either the Perl > module (Like AMAVIS) or even a stripped down version of Exim or Sendmail > but that means running effectively two SMTP servers, more to go wrong > and extra overhead. After all if you wanted to use Exim you would full > stop... Precisely what I'm guessing. It may seem absurd to you or me, but that would seem to be the postfix philosophy, unless I've misunderstood. No doubt there is some value in such a discipline that is explained in that phliosophy (I genuinely don't know, but I cheekily think I can guess). > You have to pipe to a program but MS is not built like that granted. > and you > would have to change the whole processing idea (And indeed lose batch > processing and therefore the benefits of bulk scanning speed) Surely some smidge of a program drops the files on the disk in a format MailScanner knows, and the reverse the other side ? Does this sound like bloat, compared to raiding the queues on the disk ? Well, it does to me, but it doesn't sound like a huge technical problem. Whether anyone would want to write, maintain, support or even use such a beast ... well that's another thing :) > and the > potential security of allowing the MTA to queue messages in a back log > should it become over whelmed due to a virus break for example. Granted if you try to change the mailscanner pull into a postfix push, without any buffer in between. But as you point out, that's absurd. Could also be fun getting certain kinds of failure semantics. (At one time I think I had my systems, dual sendmail, set up so that if MailScanner ever failed to start, mail would continue to flow. I don't presently recall how or even whether its still like this, never needed it :) > You see the problem. MS doesn't fit because it has a unique design which > was not thought about when Postfix (And indeed any MTA) was thought about) No offence to yourself or Julian, but I fail to see anything very novel or unique about using files in this way, even if its a jolly good way. That postfix eschews this method, well I suspect that's another story. > >My guess would be that noone is motivated to do so, and why should they be? > > > > > I don't think it is motivation but simply recognition that square pegs > don't fit well in round holes, so you have to make a decision that you > like the peg and live with it's poorer fit (In some people's eyes) or > you change one element (Hole or peg). Yes! Each party is pursuing a best solution, it is simply that their opinions differ as to what is best. Suppose that the only uses for an interface using a sanctioned API are things only of interest to the postfix developers, and the option for users to debug postfix problems with postfix team support. Against the cost of implementing, maintaining and supporting another interface to postfix, it would come as no surprise to me that such an interface doesn't exist. Indeed, the fact of its non-existence may well be evidence that it simply isn't necessary. That doesn't make it a big technical problem. Hopefully, with these improved results, what we hear about the word on the postfix list will become more along the lines of 'We hear that it now works well, but if you use the unsupported API, we do ask that you go _there_ first for support in the event that you have any problems' Which is, after all, I'm sure all that was ever really meant. Hell after gassing so much I've half a mind to try to hack something together to prove a point, but I'll try to hide behind the excuse htat I'd only replicate something trivial already done long ago. Mind you, wouldn't it be fun if what they said was: "Can you try that again with the 'prim' interface?" :) Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Thu Dec 30 19:20:49 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: On Thu, Dec 30, 2004 at 06:00:20PM +0000, Julian Field wrote: > Very good summary. You just saved me a whole load of typing and thinking. > I would have to pipe messages out of Postfix, implementing my own entire > robust queueing system, process them and then feed them back into > Postfix by some "sanctioned" method, with another queue to buffer the > MailScanner-->Postfix interface. > Very messy. Yes and no. Aside from the verboten sharing of files, what other interactions does Mailscanner have with postfix ? I'm guessing maybe some but not a lot. I'm not saying the problem you describe is totally trivial, just that its not MailScanner's problem: a seperate app could provide this service. Indeed, this is surely the point about 'you could add another MTA, but why would you want to do that?' But, in the postfix design this seems to be encouraged, or perhaps I have misunderstood? MailScanner provides an interface to postfix that happens not to be supported by the postfix people, but the impression I get is that users like it. We're already agreed that there are (perhaps hypothetical) options that would enjoy only the sanctified API, however bloated. > Incidentally, something in the same vein has already been done for > Communigate Pro, but I have never looked at that. I suspect (though > without evidence either way) that it is not approx. 100% robust in the > face of a concerted DoS attack. I go to some lengths to try to ensure > that, when under attack, the MTA will give out long before MailScanner does. Agreed, failure modes are at least as important as 'ordinary' operation with this kind of thing. To keep your head when all around are losing theirs :) > Thanks for your well thought-out explanation, Drew! Thank you both for having the patience to go over this with me. Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Dec 30 19:39:52 2004 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] paddy wrote: On Thu, Dec 30, 2004 at 06:00:20PM +0000, Julian Field wrote: Very good summary. You just saved me a whole load of typing and thinking. I would have to pipe messages out of Postfix, implementing my own entire robust queueing system, process them and then feed them back into Postfix by some "sanctioned" method, with another queue to buffer the MailScanner-->Postfix interface. Very messy. Yes and no. Aside from the verboten sharing of files, what other interactions does Mailscanner have with postfix ? I'm guessing maybe some but not a lot. AFAIK none. Mail picked up from a directory (AKA Queue file. Lets not mess about here it's a directory. Not much else ;-) ) processed and returned to another one (Ok slightly simplistic but you get the idea). I'm not saying the problem you describe is totally trivial, just that its not MailScanner's problem: a seperate app could provide this service. Indeed, this is surely the point about 'you could add another MTA, but why would you want to do that?' But, in the postfix design this seems to be encouraged, or perhaps I have misunderstood? Hmm, encouraged by one party yes but not by the other. Personally I belong to the old school of customer service that states that the fewer number of cogs in a process the less likely it is to break. I do know of someone who has done just that and installed a stripped down Exim install as the interface for Postfix, listening on another port. To me that seems daft. You might as well install Exim to do the whole job (Something I never quite managed, obviously being thick. All those routers...) MailScanner provides an interface to postfix that happens not to be supported by the postfix people, but the impression I get is that users like it. We're already agreed that there are (perhaps hypothetical) options that would enjoy only the sanctified API, however bloated. Incidentally, something in the same vein has already been done for Communigate Pro, but I have never looked at that. I suspect (though without evidence either way) that it is not approx. 100% robust in the face of a concerted DoS attack. I go to some lengths to try to ensure that, when under attack, the MTA will give out long before MailScanner does. Agreed, failure modes are at least as important as 'ordinary' operation with this kind of thing. To keep your head when all around are losing theirs :) Thanks for your well thought-out explanation, Drew! Thank you both for having the patience to go over this with me. A pleasure :-) Have a Happy New Year all Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Dec 30 19:59:24 2004 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:28:03 2006 Subject: How to tune RBL checks and Spam score Message-ID: At 01:13 PM 12/30/2004, Magda Hewryk wrote: Others answered the RBL question, but missed this part... >2.) >How can I make sure BAYES_xx doesn't sscore with eg. "1-1.43"? You can turn bayes off entirely.. /etc/mail/spamassassin/local.cf: use_bayes 0 You'll save some CPU this way too, as SA won't bother tracking bayes tokens at all. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Thu Dec 30 21:39:03 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: >> >> Drew, >> >> Awsome, you guys are great. I will do my best. >> > > Please send me the (real) URL of your FAQ entry, I could put that up the > MAQ page. > > Ugo > >> Schrock > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/368.html ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Thu Dec 30 21:40:58 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:03 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] avery wrote: > Drew Marshall wrote: > >> avery wrote: >> >>> Julian Field wrote: >>> >>>> avery wrote: >>>> >>>>> Drew Marshall wrote: >>>>> >>>>>> Drew, >>>>>> >>>>>>> Awesome, Awesome, Awesome, thank you. I needed that information >>>>>>> badly >>>>>>> and so do others. I am making a proposal to expose this >>>>>>> information. I >>>>>>> just wanted someone to specifically state the reasons why things >>>>>>> have >>>>>>> changed. If more postfix users knew this they might not be so >>>>>>> afraid of >>>>>>> using Mailscanner with postfix. The postfix community is still >>>>>>> telling >>>>>>> people not to use Mailscanner with postfix even though it seems a >>>>>>> solution has been found. As of right this second the postfix >>>>>>> experts on >>>>>>> the postfix mailing list are telling people that it is not safe to >>>>>>> use >>>>>>> postfix and Mailscanner together. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> As you have researched, Julian Field (I *can* spell that one!) and >>>>>> the >>>>>> Postfix development team don't see eye to eye (To put it mildly). >>>>>> The >>>>>> attitude from the Postfix end is do it our way or not at all, >>>>>> which is >>>>>> sad and not totally in the spirit of open source (IMHO), after all >>>>>> what >>>>>> difference is MS moving messages to the queue runner moving >>>>>> messages? >>>>>> Anyway I'm not going to stand on that soap box :-) . I love >>>>>> MailScanner >>>>>> as it's well documented, easy to configure and does loads of clever >>>>>> stuff without me needing to know too much and it's always evolving >>>>>> and >>>>>> developing. Ironically, I love Postfix for the same reasons and it's >>>>>> pretty quick too! Fortunately there is a neat way to make the two >>>>>> work >>>>>> together. One last point. If you ever want to 'hold' a message you >>>>>> can't >>>>>> use Postfix to do so (As that is the MS interface) however >>>>>> MailScanner >>>>>> comes with great quarantine features which you can set up via rule >>>>>> sets >>>>>> which are much simpler than the regex required to make Postfix's >>>>>> content >>>>>> or header specific system work, just in case that one should >>>>>> surface as >>>>>> an argument... :-) >>>>>> >>>>> >>>>> Drew, >>>>> >>>>> I agree completely that Mailscanner is a awesome piece of >>>>> software, so >>>>> is postfix though. >>>>> >>>>> Maybe this isn't my place to say this, but at least this sort of >>>>> information should be on the Mailscanner website. The strength of >>>>> GNU/GPL/OpenSource communities is all of the great information you >>>>> can >>>>> get that the proprietary world lacks so much of. Why not just openly >>>>> state that the postfix community does not agree with how Mailscanner >>>>> works with postfix and that Mailscanner has tried to accommodate the >>>>> postfix community. No politics no bull just the facts. Then people >>>>> like >>>>> me are more educated on the subject and less people would be >>>>> bothering >>>>> the Mailscanner experts on the mailing list : ) . Sometime exposting >>>>> the >>>>> facts kills off the politics and drama. >>>>> >>>>> A lot of people like me are struggling to keep open source products a >>>>> part of the IT infrastructure we work in. We sometimes have >>>>> difficulty >>>>> getting the facts, and a lot of people are getting scared away from >>>>> Mailscanner because of this. I am not proposing changing anything, >>>>> I am >>>>> just saying lets expose the facts. >>>> >>>> >>>> >>>> >>>> >>>> It would be great if you could add this to the FAQ on the website. >>>> It's >>>> not a wiki but works very like one. Thanks! >>>> >>>> -- >>>> Julian Field >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> Professional Support Services at www.MailScanner.biz >>>> MailScanner thanks transtec Computers for their support >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> >>> >>> >>> Julian, >>> >>> Thanks you for the info Mr. FAQ Administrator. Consider it done. >>> >>> Schrock >> >> >> >> Ok beat me to it! I'll leave to you Schrock. Feel free to mail me off >> list if you need any help or more detail. >> >> Drew >> >> -- >> In line with our policy, this message has >> been scanned for viruses and dangerous >> content by MailScanner, and is believed to be clean. >> www.themarshalls.co.uk/policy >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > Drew, > > Awsome, you guys are great. I will do my best. > > Schrock > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Ok here it is. http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/368.html Thanks again Drew : ) Schrock ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Thu Dec 30 21:43:36 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:28:03 2006 Subject: error building ClamAV module Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have ClamAV 0.80 installed as one of my scanners and I've been trying to install the ClamAVmodule without success. Clam was installed from the rpms on the ClamAV site. This is Fedora Core 1. [root@gingham linuxupdates]# rpm -qa | grep clam clamav-devel-0.80-2 clamav-0.80-2 Here is the relevant output from CPAN: Removing previously used /root/.cpan/build/Mail-ClamAV-0.13 CPAN.pm: Going to build S/SA/SABECK/Mail-ClamAV-0.13.tar.gz Checking if your kit is complete... Looks good Writing Makefile for Mail::ClamAV cp ClamAV.pm blib/lib/Mail/ClamAV.pm /usr/bin/perl -Mblib -MInline=NOISY,_INSTALL_ -MMail::ClamAV -e1 0.13 blib/arch Starting Build Prepocess Stage Finished Build Prepocess Stage Starting Build Parse Stage Finished Build Parse Stage Starting Build Glue 1 Stage Finished Build Glue 1 Stage Starting Build Glue 2 Stage Finished Build Glue 2 Stage Starting Build Glue 3 Stage Finished Build Glue 3 Stage Starting Build Compile Stage Starting "perl Makefile.PL" Stage Writing Makefile for Mail::ClamAV Finished "perl Makefile.PL" Stage Starting "make" Stage make[1]: Entering directory `/root/.cpan/build/Mail-ClamAV-0.13/_Inline/build/Ma il/ClamAV' /usr/bin/perl /usr/lib/perl5/5.8.3/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8. 3/ExtUtils/typemap ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c gcc -c -I/root/.cpan/build/Mail-ClamAV-0.13 -I/usr/include -D_REENTRANT -D_GNU_ SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -ma rch=i386 -mcpu=i686 -DVERSION=\"0.13\" -DXS_VERSION=\"0.13\" -fPIC "-I/usr/lib /perl5/5.8.3/i386-linux-thread-multi/CORE" ClamAV.c Running Mkbootstrap for Mail::ClamAV () chmod 644 ClamAV.bs rm -f blib/arch/auto/Mail/ClamAV/ClamAV.so LD_RUN_PATH="/usr/lib" gcc -shared -L/usr/local/lib ClamAV.o -o blib/arch/auto /Mail/ClamAV/ClamAV.so -L/usr/lib -lz -lbz2 -lgmp -lcurl -L/usr/kerberos/lib - lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv -ldl -lz -L/usr /kerberos/lib -lz -lssl -lcrypto -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err - lk5crypto -lresolv -ldl -lz -lz -lpthread -lclamav /usr/bin/ld: cannot find -lcurl collect2: ld returned 1 exit status make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 make[1]: Leaving directory `/root/.cpan/build/Mail-ClamAV-0.13/_Inline/build/Mai l/ClamAV' A problem was encountered while attempting to compile and install your Inline C code. The command that failed was: make The build directory was: /root/.cpan/build/Mail-ClamAV-0.13/_Inline/build/Mail/ClamAV To debug the problem, cd to the build directory, and inspect the output files. at /root/.cpan/build/Mail-ClamAV-0.13/blib/lib/Mail/ClamAV.pm line 190 BEGIN failed--compilation aborted at /root/.cpan/build/Mail-ClamAV-0.13/blib/lib /Mail/ClamAV.pm line 529. Compilation failed in require. BEGIN failed--compilation aborted. make: *** [ClamAV.inl] Error 2 /usr/bin/make -- NOT OK Running make test Can't test without successful make Running make install make had returned bad status, install seems impossible Any suggestions appreciated. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Thu Dec 30 21:48:43 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: error building ClamAV module Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Install curl and (if there is one) curl-devel or libcurl. Mark Nienberg wrote: > I have ClamAV 0.80 installed as one of my scanners and I've been trying > to install the ClamAVmodule without success. > Clam was installed from the rpms on the ClamAV site. This is Fedora > Core 1. > > [root@gingham linuxupdates]# rpm -qa | grep clam > clamav-devel-0.80-2 > clamav-0.80-2 > > Here is the relevant output from CPAN: > > Removing previously used /root/.cpan/build/Mail-ClamAV-0.13 > > CPAN.pm: Going to build S/SA/SABECK/Mail-ClamAV-0.13.tar.gz > > Checking if your kit is complete... > Looks good > Writing Makefile for Mail::ClamAV > cp ClamAV.pm blib/lib/Mail/ClamAV.pm > /usr/bin/perl -Mblib -MInline=NOISY,_INSTALL_ -MMail::ClamAV -e1 0.13 > blib/arch > Starting Build Prepocess Stage > Finished Build Prepocess Stage > > Starting Build Parse Stage > Finished Build Parse Stage > > Starting Build Glue 1 Stage > Finished Build Glue 1 Stage > > Starting Build Glue 2 Stage > Finished Build Glue 2 Stage > > Starting Build Glue 3 Stage > Finished Build Glue 3 Stage > > Starting Build Compile Stage > Starting "perl Makefile.PL" Stage > Writing Makefile for Mail::ClamAV > Finished "perl Makefile.PL" Stage > > Starting "make" Stage > make[1]: Entering directory > `/root/.cpan/build/Mail-ClamAV-0.13/_Inline/build/Ma > il/ClamAV' > /usr/bin/perl /usr/lib/perl5/5.8.3/ExtUtils/xsubpp -typemap > /usr/lib/perl5/5.8. > 3/ExtUtils/typemap ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c > gcc -c -I/root/.cpan/build/Mail-ClamAV-0.13 -I/usr/include -D_REENTRANT > -D_GNU_ > SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing > -I/usr/local/include > -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g > -pipe -ma > rch=i386 -mcpu=i686 -DVERSION=\"0.13\" -DXS_VERSION=\"0.13\" -fPIC > "-I/usr/lib > /perl5/5.8.3/i386-linux-thread-multi/CORE" ClamAV.c > Running Mkbootstrap for Mail::ClamAV () > chmod 644 ClamAV.bs > rm -f blib/arch/auto/Mail/ClamAV/ClamAV.so > LD_RUN_PATH="/usr/lib" gcc -shared -L/usr/local/lib ClamAV.o -o > blib/arch/auto > /Mail/ClamAV/ClamAV.so -L/usr/lib -lz -lbz2 -lgmp -lcurl > -L/usr/kerberos/lib - > lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv -ldl > -lz -L/usr > /kerberos/lib -lz -lssl -lcrypto -lssl -lcrypto -lgssapi_krb5 -lkrb5 > -lcom_err - > lk5crypto -lresolv -ldl -lz -lz -lpthread -lclamav > /usr/bin/ld: cannot find -lcurl > collect2: ld returned 1 exit status > make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 > make[1]: Leaving directory > `/root/.cpan/build/Mail-ClamAV-0.13/_Inline/build/Mai > l/ClamAV' > > A problem was encountered while attempting to compile and install your > Inline > C code. The command that failed was: > make > > The build directory was: > /root/.cpan/build/Mail-ClamAV-0.13/_Inline/build/Mail/ClamAV > > To debug the problem, cd to the build directory, and inspect the output > files. > > at /root/.cpan/build/Mail-ClamAV-0.13/blib/lib/Mail/ClamAV.pm line 190 > BEGIN failed--compilation aborted at > /root/.cpan/build/Mail-ClamAV-0.13/blib/lib > /Mail/ClamAV.pm line 529. > Compilation failed in require. > BEGIN failed--compilation aborted. > make: *** [ClamAV.inl] Error 2 > /usr/bin/make -- NOT OK > Running make test > Can't test without successful make > Running make install > make had returned bad status, install seems impossible > > Any suggestions appreciated. > > -- > Mark Nienberg, SE > Tipping Mar + associates > 1906 Shattuck Ave > Berkeley, CA 94704 > http://www.tippingmar.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Thu Dec 30 22:23:10 2004 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:28:03 2006 Subject: error building ClamAV module Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Install curl and (if there is one) curl-devel or libcurl. Thanks, it was the curl-devel that was missing. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From schrock at DAYZED.COM Thu Dec 30 22:37:11 2004 From: schrock at DAYZED.COM (avery) Date: Thu Jan 12 21:28:03 2006 Subject: Freshclam Location Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] edit the file /usr/lib/MailScanner/clamav-autoupdate find the line that says $PackageDir....... change it to this location instead $PackageDir = shift || "/usr"; Then restart mailscanner Errol Uriel Neal Jr. wrote: >I believe you need to edit virusscanners.conf. > >-----Original Message----- >From: Mike McMullen >Date: Wed, 29 Dec 2004 17:44:27 >To:MAILSCANNER@JISCMAIL.AC.UK >Subject: Freshclam Location > >Hi All, > >I'm setting up a new mail server. I just installed MailScanner-4.36.4-1. I tried >installing it from the tar file, had a few issues and then tried installing it from >the RPMs on an FC2 system. This all went ok. > >Now however I get the following messages in my logs regarding ClamAV auto >updates: > >Dec 29 17:31:23 mail update.virus.scanners: Delaying cron job up to 600 seconds >Dec 29 17:38:54 mail update.virus.scanners: Found clamav installed >Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for clamav >Dec 29 17:38:54 mail ClamAV-autoupdate[11389]: ClamAV updater /usr/local/bin/freshclam cannot be run >Dec 29 17:38:54 mail update.virus.scanners: Found generic installed >Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for generic > >My freshclam location is /usr/bin/freshclam. Where can I tell Mail-Scanner to find >it there? > >Thanks, > >Mike > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >__________________________________________ >Errol Uriel Neal Jr. >Network Administrator >DFI International, Inc. >1717 Pennsylvania Ave NW, Suite 1300 >Washington, DC 20006 >Tel (202)452-6955 >Fax (202)452-6910 >eneal@dfi-intl.com >www.dfi-intl.com > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ecs.soton.ac.uk Fri Dec 31 12:28:56 2004 From: mailscanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:03 2006 Subject: Freshclam Location Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You should *not* edit the clamav-autoupdate script. This is quite configurable using virus.scanners.conf. If you want to run the clamav-autoupdate script yourself, rather than having update_virus_scanners run it for you, then you should run it /usr/lib/MailScanner/clamav-autoupdate /usr It needs the command-line parameter telling it where clamav is installed. avery wrote: > edit the file /usr/lib/MailScanner/clamav-autoupdate > find the line that says > $PackageDir....... > change it to this location instead > $PackageDir = shift || "/usr"; > Then restart mailscanner > > Errol Uriel Neal Jr. wrote: > >> I believe you need to edit virusscanners.conf. >> >> -----Original Message----- >> From: Mike McMullen >> Date: Wed, 29 Dec 2004 17:44:27 >> To:MAILSCANNER@JISCMAIL.AC.UK >> Subject: Freshclam Location >> >> Hi All, >> >> I'm setting up a new mail server. I just installed >> MailScanner-4.36.4-1. I tried >> installing it from the tar file, had a few issues and then tried >> installing it from >> the RPMs on an FC2 system. This all went ok. >> >> Now however I get the following messages in my logs regarding ClamAV >> auto >> updates: >> >> Dec 29 17:31:23 mail update.virus.scanners: Delaying cron job up to >> 600 seconds >> Dec 29 17:38:54 mail update.virus.scanners: Found clamav installed >> Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for >> clamav >> Dec 29 17:38:54 mail ClamAV-autoupdate[11389]: ClamAV updater >> /usr/local/bin/freshclam cannot be run >> Dec 29 17:38:54 mail update.virus.scanners: Found generic installed >> Dec 29 17:38:54 mail update.virus.scanners: Running autoupdate for >> generic >> >> My freshclam location is /usr/bin/freshclam. Where can I tell >> Mail-Scanner to find >> it there? >> >> Thanks, >> >> Mike >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> __________________________________________ >> Errol Uriel Neal Jr. >> Network Administrator >> DFI International, Inc. >> 1717 Pennsylvania Ave NW, Suite 1300 >> Washington, DC 20006 >> Tel (202)452-6955 >> Fax (202)452-6910 >> eneal@dfi-intl.com >> www.dfi-intl.com >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Felix.Schwarz at WEB.DE Fri Dec 31 15:12:14 2004 From: Felix.Schwarz at WEB.DE (Felix Schwarz) Date: Thu Jan 12 21:28:03 2006 Subject: SpamAssassin preferences for every domain Message-ID: Hi all, if I understand the docs correctly I can't set up a SpamAssassin preference file for every domain I'm hosting (only 1 MailScanner instance running). That is because MS uses SA as a library and SA initializes all options at the beginning (MS start). Are there any plans to circumvent this limitation? What I would like to do: Hosting multiple domains (customers) on one server. Every customer should have its own SA preferences (especially bayes database). When browsing the SA sourcecode I found the signal_user_changed method (especially the user_dir option is interessting to me). IMHO that method would be sufficient in order to implement the behavior described above. I know that this would be less efficient that the normal MS operation mode because the bayes db and the whole stuff must be loaded, verified etc. but as I'm in the process of installing a server that won't have much load (5-10K mails/day) I think that would be worth it. Furthermore there are some optimizations that could be done (such as having multiple SA instances that are specific for a certain domain/user so that they don't have to reload their databases all the time). If you don't want to implement that by yourself what do you think: + How much work would it be for a moderately skilled perl programmer? + Would you (Julian) accept a patch that would implement the feature described above (without changing the default behavior of course? -- Felix ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Fri Dec 31 17:28:02 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:04 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: On Thu, Dec 30, 2004 at 06:00:20PM +0000, Julian Field wrote: > Incidentally, something in the same vein has already been done for > Communigate Pro, but I have never looked at that. I suspect (though > without evidence either way) that it is not approx. 100% robust in the > face of a concerted DoS attack. I go to some lengths to try to ensure > that, when under attack, the MTA will give out long before MailScanner does. Julian, Overnight I got to thinking about this ... which is a dangerously long period of time :) Looking at CriticalQueueSize I wonder if there might be some optimisation possible that prefers to processes mail that is more likely to ham by some simple criteria, a sort of express checkout. Possible devices to avoid starvation on the main queue could include running a slow queue along side the fast queue, so that the system is always progressing, and/or an elevator algorithm. Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Dec 31 17:33:36 2004 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:04 2006 Subject: Postfix and Mailscanner sitting in a tree k-iss-ing Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] paddy wrote: >On Thu, Dec 30, 2004 at 06:00:20PM +0000, Julian Field wrote: > > >>Incidentally, something in the same vein has already been done for >>Communigate Pro, but I have never looked at that. I suspect (though >>without evidence either way) that it is not approx. 100% robust in the >>face of a concerted DoS attack. I go to some lengths to try to ensure >>that, when under attack, the MTA will give out long before MailScanner does. >> >> > >Looking at CriticalQueueSize I wonder if there might be some optimisation >possible that prefers to processes mail that is more likely to ham by some >simple criteria, a sort of express checkout. > >Possible devices to avoid starvation on the main queue could include running >a slow queue along side the fast queue, so that the system is always progressing, >and/or an elevator algorithm. > > Either you appear to have changed the subject without changing the Subject: or else I don't understand the link between the quoted text and your reply... -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Fri Dec 31 18:16:21 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:04 2006 Subject: SpamAssassin preferences for every domain Message-ID: On Fri, Dec 31, 2004 at 04:12:14PM +0100, Felix Schwarz wrote: > Hi all, > > if I understand the docs correctly I can't set up a SpamAssassin > preference file for every domain I'm hosting (only 1 MailScanner > instance running). That is because MS uses SA as a library and SA > initializes all options at the beginning (MS start). > > Are there any plans to circumvent this limitation? > What I would like to do: Hosting multiple domains (customers) on one > server. Every customer should have its own SA preferences (especially > bayes database). > > > When browsing the SA sourcecode I found the signal_user_changed method > (especially the user_dir option is interessting to me). IMHO that method > would be sufficient in order to implement the behavior described > above. > > I know that this would be less efficient that the normal MS operation > mode because the bayes db and the whole stuff must be loaded, verified > etc. but as I'm in the process of installing a server that won't have > much load (5-10K mails/day) I think that would be worth it. > > Furthermore there are some optimizations that could be done (such as > having multiple SA instances that are specific for a certain > domain/user so that they don't have to reload their databases all the > time). I think I know what you mean. A couple of thoughts: (Note that I am far from being an expert on the subject, and the following will likely need substantial correction from Julian!) When SA is implemented, for example, by running it from your .procmailrc you know who you are because it is already delivery time. AFAIK MailScanner deals with recipient addresses, which is not quite the same thing, but may be close enough for your liking. Similarly, MailScanner is built around a batch processing design that gives good scalability, but I thought that the combination with SA in this case is that you'd be stuck with the same prefs for at least the lifetime of a batch. signal_user_changed certainly sounds interesting. If you were stuck, what could you do? Changing batch creation so that all the contents of a batch would be of the same domain would be simple enough to do, not absurdly expensive at batch creation time, but very likely make a nonsense of having a batch processing design in the first place. With a small load, that may not be much of an issue for you, and you could consider various strategies such as waiting for a load and falling back to the batch mode at some critical load/queue size. As to the cost of an SA load, when it happens, pre-forking and that sort of thing, I'd need to look, but we're not in outer space yet as far as I can see. How many domains ? Even if signal_user_changed would work, you'd be into approximately the same things to get the benefits of batching against SA, but at least you might more easily retain batched virus scanning. Also, I understand the amavisd-new endeavours to do this sort of thing, but I haven't used it, mainly because (to my untutored eye) it appears to written in an obscure dialect of martian that I don't speak. :) > If you don't want to implement that by yourself what do you think: > + How much work would it be for a moderately skilled perl programmer? Disclaimer: I am not even a skilled perl programmer! Not an enourmous amount. > + Would you (Julian) accept a patch that would implement the feature > described above (without changing the default behavior of course? Disclaimer: I am (still) not Julian :) How intrusive is the patch ? Without actually looking at the SA stuff, I can't see why it would have to be especially bad. What would be the consequences in terms of the way MailScanner was used, for instance would it cause more problems than it solved ? (I'll let someone else answer that one, I really don't know) Why am I answering these questions ? Because I too came to MailScanner expecting to find something like this. Now I'm inclined to ask 'Are you sure you really need that?'. Perhaps you do, I realised I didn't. Last quick thoughts: Bayes is a good example of a system that works better at the periphery of the network than at the center, but that doesn't mean you can't do both. If you're deeply wedded to the per-user/per-domain idea, then you should also at how the MailScanner configuration works: its not a ~/.mailscanner.conf sort of thing, but more like, say, sendmail. Good Luck, and Happy New Year! Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Dec 31 18:32:56 2004 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:04 2006 Subject: SpamAssassin preferences for every domain Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] My only immediate comments are these: Amavis (in all 4 split versions) runs at delivery time, so all the resolution email address ---> user name has been done by the MTA. MailScanner fits in before this resolution has been done, so would have to do all the resolution itself, which is "hard". It varies hugely between different MTAs and is impractical to implement in MailScanner. You can change the threshold scores, delivery actions, and black+white lists per user and per domain within MailScanner anyway. If you take a look at the Bayes scores in the most recent SA release, you will see they don't actually have a huge effect any more anyway, as the system has been largely defeated by spammers. Other tests such as the SURBL lookups have far more effect. Don't get hooked on Bayes, it isn't the "ultimate spam solution" it was touted to be when first published. paddy wrote: >On Fri, Dec 31, 2004 at 04:12:14PM +0100, Felix Schwarz wrote: > > >>Hi all, >> >>if I understand the docs correctly I can't set up a SpamAssassin >>preference file for every domain I'm hosting (only 1 MailScanner >>instance running). That is because MS uses SA as a library and SA >>initializes all options at the beginning (MS start). >> >>Are there any plans to circumvent this limitation? >>What I would like to do: Hosting multiple domains (customers) on one >>server. Every customer should have its own SA preferences (especially >>bayes database). >> >> >>When browsing the SA sourcecode I found the signal_user_changed method >>(especially the user_dir option is interessting to me). IMHO that method >>would be sufficient in order to implement the behavior described >>above. >> >>I know that this would be less efficient that the normal MS operation >>mode because the bayes db and the whole stuff must be loaded, verified >>etc. but as I'm in the process of installing a server that won't have >>much load (5-10K mails/day) I think that would be worth it. >> >>Furthermore there are some optimizations that could be done (such as >>having multiple SA instances that are specific for a certain >>domain/user so that they don't have to reload their databases all the >>time). >> >> > >I think I know what you mean. A couple of thoughts: > >(Note that I am far from being an expert on the subject, and the following >will likely need substantial correction from Julian!) > >When SA is implemented, for example, by running it from your .procmailrc >you know who you are because it is already delivery time. AFAIK MailScanner >deals with recipient addresses, which is not quite the same thing, but >may be close enough for your liking. > >Similarly, MailScanner is built around a batch processing design that >gives good scalability, but I thought that the combination with SA in this >case is that you'd be stuck with the same prefs for at least the lifetime of >a batch. signal_user_changed certainly sounds interesting. > >If you were stuck, what could you do? Changing batch creation so that all >the contents of a batch would be of the same domain would be simple enough >to do, not absurdly expensive at batch creation time, but very likely make a >nonsense of having a batch processing design in the first place. With a >small load, that may not be much of an issue for you, and you could consider >various strategies such as waiting for a load and falling back to the batch >mode at some critical load/queue size. As to the cost of an SA load, when >it happens, pre-forking and that sort of thing, I'd need to look, but we're >not in outer space yet as far as I can see. How many domains ? > >Even if signal_user_changed would work, you'd be into approximately the >same things to get the benefits of batching against SA, but at least you >might more easily retain batched virus scanning. > >Also, I understand the amavisd-new endeavours to do this sort of thing, but >I haven't used it, mainly because (to my untutored eye) it appears to >written in an obscure dialect of martian that I don't speak. :) > > > >>If you don't want to implement that by yourself what do you think: >>+ How much work would it be for a moderately skilled perl programmer? >> >> > >Disclaimer: I am not even a skilled perl programmer! > >Not an enourmous amount. > > > >>+ Would you (Julian) accept a patch that would implement the feature >>described above (without changing the default behavior of course? >> >> > >Disclaimer: I am (still) not Julian :) > >How intrusive is the patch ? > >Without actually looking at the SA stuff, I can't see why it would have >to be especially bad. > >What would be the consequences in terms of the way MailScanner was used, >for instance would it cause more problems than it solved ? > >(I'll let someone else answer that one, I really don't know) > >Why am I answering these questions ? > >Because I too came to MailScanner expecting to find something like this. >Now I'm inclined to ask 'Are you sure you really need that?'. > >Perhaps you do, I realised I didn't. > >Last quick thoughts: > >Bayes is a good example of a system that works better at the periphery of >the network than at the center, but that doesn't mean you can't do both. > >If you're deeply wedded to the per-user/per-domain idea, then you should >also at how the MailScanner configuration works: its not a >~/.mailscanner.conf sort of thing, but more like, say, sendmail. > >Good Luck, and Happy New Year! > >Regards, >Paddy >-- >Perl 6 will give you the big knob. -- Larry Wall > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Fri Dec 31 18:43:31 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:04 2006 Subject: An express checkout? [was: Re: Postfix and Mailscanner sitting in a tree k-iss-ing] Message-ID: On Fri, Dec 31, 2004 at 05:33:36PM +0000, Julian Field wrote: > paddy wrote: > > >On Thu, Dec 30, 2004 at 06:00:20PM +0000, Julian Field wrote: > > > > > >>Incidentally, something in the same vein has already been done for > >>Communigate Pro, but I have never looked at that. I suspect (though > >>without evidence either way) that it is not approx. 100% robust in the > >>face of a concerted DoS attack. I go to some lengths to try to ensure > >>that, when under attack, the MTA will give out long before MailScanner > >>does. > >> > >> > > > >Looking at CriticalQueueSize I wonder if there might be some optimisation > >possible that prefers to processes mail that is more likely to ham by some > >simple criteria, a sort of express checkout. > > > >Possible devices to avoid starvation on the main queue could include > >running > >a slow queue along side the fast queue, so that the system is always > >progressing, > >and/or an elevator algorithm. > > > > > Either you appear to have changed the subject without changing the > Subject: or else I don't understand the link between the quoted text and > your reply... Okay, I confess it was a bit of a leap ... :) I started from 'in the face of a concerted DoS attack'. I've seen peaks of up to 500+ messages queued, which can take some time (on a tiny, underpowered, overloaded system) to clear up. At times like that I find myself doing stuff like tail -f maillog | grep delay | sed 's/\(...............\).*\]: \([^:]*\):.* delay=\([^,]*\),.*/\1 \2 \3/' and trying not to worry about it! (or maybe that should be xdelay, I don't know!) But its not a feature request, more of a 'what do you think?' So, yes, this no longer bears any relation to the previous Subject, sorry! Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Dec 31 18:55:32 2004 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:28:04 2006 Subject: An express checkout? [was: Re: Postfix and Mailscanner sitting in a tree k-iss-ing] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] paddy wrote: >On Fri, Dec 31, 2004 at 05:33:36PM +0000, Julian Field wrote: > > >>paddy wrote: >> >> >> >>>On Thu, Dec 30, 2004 at 06:00:20PM +0000, Julian Field wrote: >>> >>> >>> >>> >>>>Incidentally, something in the same vein has already been done for >>>>Communigate Pro, but I have never looked at that. I suspect (though >>>>without evidence either way) that it is not approx. 100% robust in the >>>>face of a concerted DoS attack. I go to some lengths to try to ensure >>>>that, when under attack, the MTA will give out long before MailScanner >>>>does. >>>> >>>> >>>> >>>> >>>Looking at CriticalQueueSize I wonder if there might be some optimisation >>>possible that prefers to processes mail that is more likely to ham by some >>>simple criteria, a sort of express checkout. >>> >>>Possible devices to avoid starvation on the main queue could include >>>running >>>a slow queue along side the fast queue, so that the system is always >>>progressing, >>>and/or an elevator algorithm. >>> >>> >>> >>> >>Either you appear to have changed the subject without changing the >>Subject: or else I don't understand the link between the quoted text and >>your reply... >> >> > >Okay, I confess it was a bit of a leap ... :) > >I started from 'in the face of a concerted DoS attack'. > >I've seen peaks of up to 500+ messages queued, which can take some time >(on a tiny, underpowered, overloaded system) to clear up. At times like >that I find myself doing stuff like > >tail -f maillog | grep delay | sed 's/\(...............\).*\]: \([^:]*\):.* delay=\([^,]*\),.*/\1 \2 \3/' > >and trying not to worry about it! > >(or maybe that should be xdelay, I don't know!) > >But its not a feature request, more of a 'what do you think?' > >So, yes, this no longer bears any relation to the previous Subject, sorry! > > What does your sed command actually do? And what would your quick "likely to be ham" test do? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Fri Dec 31 19:55:40 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:04 2006 Subject: An express checkout? [was: Re: Postfix and Mailscanner sitting in a tree k-iss-ing] Message-ID: On Fri, Dec 31, 2004 at 06:55:32PM +0000, Julian Field wrote: > paddy wrote: > > >On Fri, Dec 31, 2004 at 05:33:36PM +0000, Julian Field wrote: > > > > > >>paddy wrote: > >> > >> > >> > >>>On Thu, Dec 30, 2004 at 06:00:20PM +0000, Julian Field wrote: > >>> > >>> > >>> > >>> > >>>>Incidentally, something in the same vein has already been done for > >>>>Communigate Pro, but I have never looked at that. I suspect (though > >>>>without evidence either way) that it is not approx. 100% robust in the > >>>>face of a concerted DoS attack. I go to some lengths to try to ensure > >>>>that, when under attack, the MTA will give out long before MailScanner > >>>>does. > >>>> > >>>> > >>>> > >>>> > >>>Looking at CriticalQueueSize I wonder if there might be some optimisation > >>>possible that prefers to processes mail that is more likely to ham by > >>>some > >>>simple criteria, a sort of express checkout. > >>> > >>>Possible devices to avoid starvation on the main queue could include > >>>running > >>>a slow queue along side the fast queue, so that the system is always > >>>progressing, > >>>and/or an elevator algorithm. > >>> > >>> > >>> > >>> > >>Either you appear to have changed the subject without changing the > >>Subject: or else I don't understand the link between the quoted text and > >>your reply... > >> > >> > > > >Okay, I confess it was a bit of a leap ... :) > > > >I started from 'in the face of a concerted DoS attack'. > > > >I've seen peaks of up to 500+ messages queued, which can take some time > >(on a tiny, underpowered, overloaded system) to clear up. At times like > >that I find myself doing stuff like > > > >tail -f maillog | grep delay | sed 's/\(...............\).*\]: > >\([^:]*\):.* delay=\([^,]*\),.*/\1 \2 \3/' > > > >and trying not to worry about it! > > > >(or maybe that should be xdelay, I don't know!) > > > >But its not a feature request, more of a 'what do you think?' > > > >So, yes, this no longer bears any relation to the previous Subject, sorry! > > > > > What does your sed command actually do? It pulls three fields from a sendmail syslog entry. That gives me something I imagine to be an indicator of how long mail has languished in the queue. Output looks like: Dec 31 17:29:08 iBVHSYR02477 00:00:00 Dec 31 17:32:27 iBVHVSR02862 00:00:00 Dec 31 17:33:45 iBVHX6R02977 00:00:00 Dec 31 17:34:20 iBVHXhR03023 00:00:00 On a good day :) > And what would your quick "likely to be ham" test do? perhaps use info in the qf file (I realise this is a relatively expensive operation, which is the last thing that you need if your optimising solely for load, but the objective would be to buy latency at that cost) to match against some 'not-quite-white' list perhaps generated in a similiar fashion to the WhiteListFutureSender (ie: there is a history of transactions in the opposite direction) stuff that I posted here, for example. I don't know really, maybe its just a hairbrained idea. :) It makes me think though. My system almost serialised, there is a very low limit on the number of simultaneous mailscanner children (because at some point I thought it was a source of problems - we have limited vm to work with), but this idea mirrors the kind of scheduling that goes on inside a maliscanner batch, more parallelism. Rather desperately perhaps, I find the thread of my thought returns to the postfix conversation: Imagine for a moment that postfix can take delivery of mail, and pass it on to mailscanner without it paging out to disk in an operation that optimises away to a little page-table shuffling (which is going to happen anyway). I don't know if this optimistic view is possible, but anyway ... MailScanner would have a chance to do or kick off some operations before the mail pages out to disk. Would this ever improve throughput in a high load situation? I really don't know, I can't immediately see how it would, but it perhaps it could improve the cost of any 'express checkout'. (for that matter, if mailscanner reads the files as they appear in the queue the pages may still be in RAM anyway) Until recently I thought of whitelisting as a rather naive approach to the problem (what about the unsolicited mail that you want, for example?) But I've come round to the idea that relatively good stuff is often easy to identify, and an ability to optimise for latency, to let the mice through quickly, so to speak, is a usefull strategy. Faced with two tasks, one of which is five minutes, one five hours, equal priority, no deadline trouble, I tend to do the short one first. Similarly, a higher value task. I don't really care if spam is badly delayed, especially within some reasonable limit, and mailscanner already solves this problem excellently. An express checkout could mean better mix of QOS against spamminess in a high-load situation. Then again I could easily be missing the bit where this is all done already! Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From paddy at PANICI.NET Fri Dec 31 23:44:19 2004 From: paddy at PANICI.NET (paddy) Date: Thu Jan 12 21:28:04 2006 Subject: An express checkout? [was: Re: Postfix and Mailscanner sitting in a tree k-iss-ing] Message-ID: Julian, I'm glad I'm the only one of us that's the sad-act posting here on new year's eve ;) (hell, easier than apologising for replying to myself!) I'll try to improve on my last thoughts _and_ keep it short. With any luck you'll read this one first _and_ it'll make sense :) the tail|sed gives me a rolling indication of latency on the mail queue. (In practice I'm intersted in the time to get through mailscanner, which under ordinary conditions is a non-issue, and even under critical conditions I have found to be very acceptable). I see there is now a LogSpeed option, never noticed that before (probably been there forever :) Upon reflection I can't see a 'simple criteria' that's cheap enough to be a no-brainer to use unless you can do some processing before the incoming mail first goes to disk. (My first choice would be originating IP. I did briefly, in desperation, consider size). Anything else is just equivalent to what MailScanner already does (dispatch RBL queries early, etc) only my suggestions were weaker :) I'm also imagining that any processing before the mail hits disk is at a premium in a DoS/highload situation, although that may not be the case if the cpu is not the bottleneck ... I don't think the express checkout idea is necessarily a totally lost cause: sure, the cost of scheduling can easily drown the value, but a system where the order of operations effects the cost is a promising target. the original intention - differential QoS based on approximate spamminess - still seems good. The problem is implementing it at acceptable costs. (remember Magnus Pike?) I also had this vague idea that using directories for the elevator in the CriticalQueue condition might be cheaper than sorting by date, but the problem is obvious .... What I realise is: I don't really understand the trade-off between batch size and MaxChildren I'd certainly appreciate it if you, or anyone for that matter :), could help me with this. Since they are both limits, I imagine that describing the limiting conditions will help. I'm just re-reading the notes in the conf file. Does a mailscanner child really consume ~20MB ? Why ? based on your 'try 5 children per CPU' comment, I'm guessing that more children = more cpu heavy (which makes sense anyway). (must fix my CPU utlisation logging! :) Is there even a BatchSize type option? Is MailScanner even batch-oriented in the way I had imagined? is MaxUnscannedMessagesPerScan it ? I'm also amused to discover (see previous mail) I have Max Normal Queue Size = 5000 This reminds me of the 'per-user spamsassasin' thread tonight. There are already so many options, no doubt for each one there is somebody who really needs it, but nobody could really need them all (could they?), and the idea that anybody needs a new one should at least attract a little skepticism. But then, I expect I'm preaching to the priest ! would any of the options make sense in multiple units? for (over)simplified example: 5000 mails or 5 mails per GHz of cpu perhaps this is best left to admin and configuration tools? And it's easy to think you (I mean me, of course!) know what going on, until .... I wish you a Very Happy New Year ! Regards, Paddy -- Perl 6 will give you the big knob. -- Larry Wall ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website!